Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-dev: Re: [Ethereal-dev] MAPI and Exchange

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Ronnie Sahlberg" <ronnie_sahlberg@xxxxxxxxxxxxxx>
Date: Thu, 29 Apr 2004 17:22:39 +1000
Unfortunately no.    No one has as far as i know worked on trying to rev
engineer the rpc protocol implemented ontop of
MAPI yet.
As far as i could tell when i looked at it about 2 years ago,   it did not
look like any known encodings like
BER/DER  NDR etc etc.
Could be PER but I dont know.

If one knew what DLLs are used with the process maybe one can make a gues
son what kind of wire encoding is used.

But i fear it would be a lot of work required to reverse engineer it. A lot
of work.
It would probably also require one to have a full blown exchange setup with
clients where one can make a small operation and see
what rpc they generate.



----- Original Message ----- 
From: "Cresley Dansen"
Sent: Thursday, April 29, 2004 8:28 AM
Subject: [Ethereal-dev] MAPI and Exchange


> Hi, there,
>
> Can anyone tell me if the MAPI parser is finally made
> to work or not? I have the latest version of Ethereal
> and when I use it to display captured Exchange packets,
> it only parses up to the RPC header and all Exchange contents
> are shown as "stub data"?
>
> Any info is appreciated?