Module commands 

SMB2 command request/response codecs ([MS-SMB2] §2.2.13–§2.2.39).

Every structure maps directly to its spec section (noted per item). Buffer fields (NameOffset, DataOffset, …) are absolute offsets from the frame start, so parsers take the complete frame including the 64-byte header.

Modules

app_instance

AppInstance create-context name GUIDs ([MS-SMB2] §2.2.13.2.13/§2.2.13.2.15), on the wire as the raw 16-byte GUID.

caps

Capability bits advertised by the server (§2.2.9.2.1 / §2.2.10.2).

copychunk_limits

Server-side copy limits ([MS-SMB2] §3.3.5.15.6).

durable

Durable-handle create-context name tags ([MS-SMB2] §2.2.13.2).

error

Wire constants for the SMB2 ERROR response ([MS-SMB2] §2.2.2) and the Symbolic Link Error Response it can carry ([MS-SMB2] §2.2.2.2.1).

find_flags

FIND flags (§2.2.33.1).

fsctl

FSCTL codes used by clients during share access ([MS-SMB2] §2.2.31).

info_type

QUERY_INFO InfoType values (§2.2.37.1).

lease

Lease caching-state bits and constants ([MS-SMB2] §2.2.13.2.8).

notify_action

FILE_NOTIFY_INFORMATION action codes ([MS-FSCC] §2.7.1).

notify_filter

CHANGE_NOTIFY completion-filter bits ([MS-SMB2] §2.2.35, [MS-FSCC] §2.7.1).

offload

A STORAGE_OFFLOAD_TOKEN ([MS-FSCC] §2.3.80) is 512 bytes: an 8-byte header (TokenType, Reserved, TokenIdLength — all big-endian) then a 504-byte TokenId. This server issues data tokens whose TokenId begins with a 16-byte server-local identifier keying the captured source range.

oplock

Oplock levels ([MS-SMB2] §2.2.13 / §2.2.14).

share_type

Share types advertised in TREE_CONNECT responses (§2.2.10.1).

tcon_off

TREE_CONNECT request fixed-part offsets (§2.2.9).

tf_off

Transform-header field offsets.

Structs

ChangeNotifyReq

CHANGE_NOTIFY request (§2.2.35).

CloseReq

CLOSE request body (§2.2.15).

CopyChunk

One SRV_COPYCHUNK entry ([MS-SMB2] §2.2.31.1).

CopyChunkCopy

Parsed SRV_COPYCHUNK_COPY request ([MS-SMB2] §2.2.31.1): a 24-byte source resume key followed by a chunk list.

CreateReq

CREATE request body (§2.2.13).

FileId

SMB2 file identifier (16 bytes, replaces SMB1’s 16-bit FID).

FlushReq

FLUSH request body (§2.2.17): StructureSize(2)=24 Reserved(2) FileId(16).

IoctlReq

IOCTL request body (§2.2.31).

LeaseBreakAck

Parsed LEASE_BREAK acknowledgement ([MS-SMB2] §2.2.24.1), distinguished from an oplock-break ack by its StructureSize of 36.

LeaseReq

Requested lease from an SMB2_CREATE_REQUEST_LEASE(_V2) context ([MS-SMB2] §2.2.13.2.8 / §2.2.13.2.10).

LeaseResp

Granted lease returned in a CREATE response RqLs context.

LockElem

Lock vector entry (§2.2.26.1).

LockReq

LOCK request (§2.2.26). The 24-byte header (StructureSize, LockCount, LockSequence, FileId) is followed by LockCount 24-byte lock elements; StructureSize is fixed at 48 (header + one element) per the SMB2 convention.

OplockBreakAck

Parsed OPLOCK_BREAK acknowledgement ([MS-SMB2] §2.2.24.1).

QueryDirReq

QUERY_DIRECTORY request body (§2.2.33).

QueryInfoReq

QUERY_INFO request body (§2.2.37).

ReadReq

READ request body (§2.2.19).

SetInfoReq

SET_INFO request body (§2.2.39).

TransformHdr

Parsed transform header ([MS-SMB2] §2.2.41).

WriteReq

WRITE request body (§2.2.21).

Enums

DurableReq

Durable-handle intent parsed from a CREATE’s create-context chain ([MS-SMB2] §2.2.13.2.3/§2.2.13.2.4/§2.2.13.2.11/§2.2.13.2.12).

Constants

BODY

Byte offset where each request body begins.

SHAREFLAG_COMPRESS_DATA

ShareFlags bit advertising compression support on the tree ([MS-SMB2] §2.2.10).

SHAREFLAG_CONTINUOUSLY_AVAILABLE

ShareFlags bit marking a continuously-available share ([MS-SMB2] §2.2.10).

SHAREFLAG_ENCRYPT_DATA

ShareFlags bit requiring SMB3 encryption on the tree ([MS-SMB2] §2.2.10).

SHARE_CAP_CONTINUOUS_AVAILABILITY

Share Capabilities bit advertising continuous availability ([MS-SMB2] §2.2.10).

TF_FLAGS_ENCRYPTED

SMB2_TF_FLAGS_ENCRYPTED.

TF_MAGIC

\xFD 'S' 'M' 'B' — transform-frame magic.

WATCH_TREE

SMB2_WATCH_TREE — recurse into subdirectories ([MS-SMB2] §2.2.35).

Functions

build_change_notify_resp

CHANGE_NOTIFY response body (§2.2.36): StructureSize=9, then the FILE_NOTIFY_INFORMATION buffer at offset 72 from the header start.

build_close_resp

CLOSE response body (§2.2.15.1).

build_copychunk_resp

Build the SRV_COPYCHUNK_RESPONSE ([MS-SMB2] §2.2.32.1). On success it reports chunks/bytes written; on a limits violation the caller sends it with STATUS_INVALID_PARAMETER carrying the server’s maximums.

build_create_resp

Build CREATE response body (§2.2.14.1).

build_echo_resp

ECHO response body (§2.2.29): StructureSize=4 then 2-byte Reserved.

build_file_level_trim_resp

Build an FSCTL_FILE_LEVEL_TRIM_OUTPUT ([MS-FSCC] §2.3.74) reporting the number of ranges processed.

build_file_notify_information

Build a FILE_NOTIFY_INFORMATION list ([MS-FSCC] §2.7.1) from (action, name) pairs. Names are directory-relative, UTF-16LE, no terminator; each record is 4-byte aligned and chained through NextEntryOffset.

build_flush_resp

FLUSH response body (§2.2.17.1): StructureSize=4 only.

build_get_integrity_resp

Build an FSCTL_GET_INTEGRITY_INFORMATION reply ([MS-FSCC] §2.3.55): ChecksumAlgorithm(2) Reserved(2) Flags(4) ChecksumChunkSizeInBytes(4) ClusterSizeInBytes(4).

build_info_resp

QUERY_DIRECTORY / QUERY_INFO response body (§2.2.34.1 / §2.2.38.1): StructureSize=9 followed by the output buffer 8-byte aligned.

build_ioctl_resp

Build an IOCTL response body (§2.2.32.1). Fixed part is 48 bytes; StructureSize mirrors smbd (49); output lands 8-byte aligned after it.

build_lease_break

Build a LEASE_BREAK notification body ([MS-SMB2] §2.2.23.2): a 44-byte structure asking the holder of key to drop from current to new state.

build_lease_break_resp

LEASE_BREAK response body ([MS-SMB2] §2.2.24.2): a 36-byte structure echoing the state the holder settled on.

build_lock_resp

LOCK response body (§2.2.27): StructureSize=4.

build_logoff_resp

LOGOFF response body (§2.2.8): StructureSize=4 then 2-byte Reserved.

build_offload_read_resp

Build an FSCTL_OFFLOAD_READ_OUTPUT ([MS-FSCC] §2.3.78) carrying the transfer length and a data token whose TokenId embeds token_id.

build_offload_write_resp

Build an FSCTL_OFFLOAD_WRITE_OUTPUT ([MS-FSCC] §2.3.80) reporting the number of bytes written.

build_oplock_break

Build an OPLOCK_BREAK notification body ([MS-SMB2] §2.2.23.1): a 24-byte structure telling the holder to break its oplock down to new_level.

build_oplock_break_resp

OPLOCK_BREAK acknowledgement/response body ([MS-SMB2] §2.2.24.2), echoing the level the holder settled on.

build_read_resp

READ response body (§2.2.19.1); DataOffset is absolute from frame start (64+16=80), 8-byte aligned.

build_resume_key_resp

Build the SRV_REQUESTED_RESUME_KEY response ([MS-SMB2] §2.2.32.3): the 24-byte key then a zero ContextLength.

build_set_info_resp

SET_INFO response body (§2.2.40): StructureSize=2 only.

build_symlink_error_response

Build the SMB2 ERROR response body ([MS-SMB2] §2.2.2) carrying a Symbolic Link Error Response ([MS-SMB2] §2.2.2.2.1) for STATUS_STOPPED_ON_SYMLINK.

build_transform

Build the 52-byte transform header with a zeroed Signature field (the AEAD tag is copied in after sealing).

build_tree_connect_resp

TREE_CONNECT response body (§2.2.10.2): 16-byte fixed part, no buffer.

build_tree_disconnect_resp

TREE_DISCONNECT response body (§2.2.11): StructureSize=4 then 2-byte Reserved — the whole structure is 4 bytes.

build_write_resp

WRITE response body (§2.2.21.1).

durable_v1_resp_data

Encode the DHnQ v1 durable-handle response data ([MS-SMB2] §2.2.14.2.3): 8 reserved bytes.

durable_v2_resp_data

Encode the DH2Q v2 durable-handle response data ([MS-SMB2] §2.2.14.2.11).

encode_create_contexts

Encode a chain of CREATE-response create-contexts ([MS-SMB2] §2.2.13.2) from (name, data) pairs, wiring NextEntryOffset links and keeping each entry 8-byte aligned. Returns an empty buffer for no entries.

lease_context_data

Encode just the lease structure ([MS-SMB2] §2.2.14.2.10/§2.2.14.2.11 data) for a granted lease, without the create-context wrapper.

parse_file_level_trim

Parse an FSCTL_FILE_LEVEL_TRIM request ([MS-FSCC] §2.3.73) into its Key and NumRanges fields. The per-range array follows but is advisory.

parse_offload_read

Parse FSCTL_OFFLOAD_READ_INPUT ([MS-FSCC] §2.3.77) into (FileOffset, CopyLength); the Size/Flags/TokenTimeToLive/Reserved header is ignored.

parse_offload_write

Parse FSCTL_OFFLOAD_WRITE_INPUT ([MS-FSCC] §2.3.79) into (FileOffset, CopyLength, TransferOffset, token_id), extracting the 16-byte identifier from the token this server issued.

parse_set_integrity

Parse the ChecksumAlgorithm field of an FSCTL_SET_INTEGRITY_INFORMATION request ([MS-FSCC] §2.3.57): ChecksumAlgorithm(2) Reserved(2) Flags(4).

parse_zero_data

Parse FILE_ZERO_DATA_INFORMATION ([MS-FSCC] §2.3.79): (FileOffset, BeyondFinalZero). The zeroed range is [FileOffset, BeyondFinalZero).