#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <netinet/in.h>
#include <sys/wait.h>
#include <sys/resource.h>
#include <arpa/inet.h>
#include <assert.h>
#include <ctype.h>
#include <fcntl.h>
#include <signal.h>

char *server_ip = "127.0.0.1";
char *username = "z";
char *password = "xxxxxxxx";
char *share_path = "x";
//char *share_path = "IPC$";
char *share_service = "A:";
//char *share_service = "IPC";

int s = -1;
int uid = 0;
int tid = 0;
int fid = 0;

unsigned int header_flags = 0;
unsigned int header_flags2 = 0;

int
header(char *buf, int command)
{
  int ii = 0;

  // SMB-over-TCP 4-byte header
  buf[ii++] = 0; // must be zero
  buf[ii++] = 0; // high byte of len
  *(short*)(buf+ii) = htons(sizeof(buf)-4); // non-inclusive len, filled later
  ii += 2;
  
  // 32-byte SMB header, MS-CIFS 2.2.3.1
  buf[ii++] = 0xff;
  buf[ii++] = 'S';
  buf[ii++] = 'M';
  buf[ii++] = 'B';
  buf[ii++] = command;
  buf[ii++] = 0; // status
  buf[ii++] = 0; // status
  buf[ii++] = 0; // status
  buf[ii++] = 0; // status
  buf[ii++] = header_flags; // flags
  *(short*)(buf+ii) = header_flags2; // flags2
  ii += 2;
  *(short*)(buf+ii) = 0; // PIDHigh
  ii += 2;
  ii += 8; // SecurityFeatures
  *(short*)(buf+ii) = 0; // Reserved
  ii += 2;
  *(short*)(buf+ii) = tid; // TID
  ii += 2;
  *(short*)(buf+ii) = 0; // PIDLow
  ii += 2;
  *(short*)(buf+ii) = uid; // UID
  ii += 2;
  *(short*)(buf+ii) = 0; // MID
  ii += 2;

  return ii;
}

int
readn(void *bufx, int n)
{
  char *buf = bufx;
  while(n > 0){
    int cc = read(s, buf, n);
    if(cc <= 0)
      return -1;
    n -= cc;
    buf += cc;
  }
  return 0;
}

int
readmsg(void *bufx)
{
  unsigned char *buf = bufx;
  if(readn(buf, 4) < 0)
    return -1;
  int n = (buf[2] << 8) | buf[3];
  if(readn(buf+4, n) < 0)
    return -1;
  return n + 4;
}

void
negotiate(const char *dialect)
{
  // SMB_COM_NEGOTIATE
  // dialect should probably be "NT LM 0.12"
  {
    char buf[128];
    memset(buf, 1, sizeof(buf));

    int ii = header(buf, 0x72);

    // parameter block, MS-CIFS 2.2.3.2
    int param_words = 0;
    buf[ii++] = param_words; // number of 16-bit words of parameters
    printf("parameters start at %d\n", ii);
    ii += param_words*2;

    // data block, MS-CIFS 2.2.3.3
    // SMB_COM_NEGOTIATE MS-CIFS 2.2.4.52
    int bci = ii;
    *(short*)(buf+ii) = 0; // byte count including this len (to be filled in)
    ii += 2;
    buf[ii++] = 0x02; // BufferFormat
    memcpy(buf+ii, dialect, strlen(dialect) + 1);
    ii += strlen(dialect) + 1;

    *(short*)(buf+bci) = ii - bci - 2;

    ii = sizeof(buf); // this works

    *(short*)(buf+2) = htons(ii-4); // non-inclusive len

    assert(ii <= sizeof(buf));

    printf("negotiate writing %d bytes\n", ii); fflush(stdout);

    if(write(s, buf, ii) <= 0){
      perror("write");
        exit(1);
    }
  }

  {
    // read negotiate response, MS-CIFS 2.2.4.52.2
    unsigned char buf[1024];
    memset(buf, 0, sizeof(buf));
    int cc = readmsg(buf);
    printf("read %d for negotiate response (expecting 87)\n", cc);
    printf("WordCount %d (expecting 17)\n", buf[36] & 0xff);
    printf("DialectIndex %d (expecting 0)\n", *(short*)(buf+37));
    printf("SecurityMode 0x%x (expecting 0x1)\n", buf[37+2]);
  }
}

void
setup()
{
  // SMB_COM_SESSION_SETUP_ANDX
  // MS-CIFS 3.2.4.2.3
  {
    char buf[128];
    memset(buf, 1, sizeof(buf));

    int ii = header(buf, 0x73);

    // parameter block, MS-CIFS 2.2.4.53.1
    int param_words = 13;
    buf[ii++] = param_words; // number of 16-bit words of parameters
    // ii is 37 at this point
    buf[ii++] = 0xff; // AndXCommand (next command) 0xff means none
    buf[ii++] = 0; // Reserved
    *(short*)(buf+ii) = 0; // AndXOffset
    ii += 2;
    *(short*)(buf+ii) = 8192; // MaxBufferSize
    ii += 2;
    *(short*)(buf+ii) = 2; // MaxMpxCount
    ii += 2;
    *(short*)(buf+ii) = 0; // VcNumber
    ii += 2;
    *(int*)(buf+ii) = 0; // SessionKey, from negotiate response XXX
    ii += 4;
    *(short*)(buf+ii) = 8; // OEMPasswordLen
    ii += 2;
    *(short*)(buf+ii) = 0; // UnicodePasswordLen
    ii += 2;
    *(int*)(buf+ii) = 0; // Reserved
    ii += 4;
    *(int*)(buf+ii) = 0; // Capabilities
    ii += 4;

    // data block
    int bci = ii;
    *(short*)(buf+ii) = 0; // byte count including this len (to be filled in)
    ii += 2;
    // OEMPassword
    memcpy(buf+ii, password, 8);
    ii += 8;
    // UnicodePassword
    //memcpy(buf+ii, password, 8);
    //ii += 8;
    // pad
    if(ii % 1)
      ii++;
    // AccountName
    memcpy(buf+ii, username, strlen(username) + 1);
    ii += strlen(username) + 1;
    // PrimaryDomain
    buf[ii++] = '\0';
    // NativeOS
    buf[ii++] = '\0';
    // NativeLanMan
    buf[ii++] = '\0';

    *(short*)(buf+bci) = ii - bci - 2;

    ii = sizeof(buf);

    *(short*)(buf+2) = htons(ii-4); // non-inclusive len

    assert(ii <= sizeof(buf));

    printf("setup writing %d bytes\n", ii); fflush(stdout);

    if(write(s, buf, ii) <= 0){
      perror("write");
        exit(1);
    }
  }

  {
    // read session setup response, MS-CIFS 2.2.4.53.2
    unsigned char buf[1024];
    memset(buf, 0, sizeof(buf));
    int cc = readmsg(buf);
    printf("read %d for session setup response\n", cc);
    printf("WordCount %d\n", buf[36] & 0xff);
    printf("Action %d (expecting 0)\n", *(short*)(buf+41));
    uid = *(short*)(buf+32);
    uid &= 0xffff;
    printf("UID 0x%x\n", uid);
  }
}

void
tree_connect_andx()
{
  // SMB_COM_TREE_CONNECT_ANDX, MS-CIFS 2.2.4.55
  {
    char buf[128];
    memset(buf, 1, sizeof(buf));

    int ii = header(buf, 0x75);

    // parameter block, MS-CIFS 2.2.4.53.1
    int param_words = 4;
    buf[ii++] = param_words; // number of 16-bit words of parameters
    // ii is 37 at this point
    buf[ii++] = 0xff; // AndXCommand
    buf[ii++] = 0; // Reserved
    *(short*)(buf+ii) = 0; // AndXOffset
    ii += 2;
    *(short*)(buf+ii) = 0; // Flags
    ii += 2;
    *(short*)(buf+ii) = 1; // PasswordLength
    ii += 2;

    // data block
    int bci = ii;
    *(short*)(buf+ii) = 0; // byte count including this len (to be filled in)
    ii += 2;
    buf[ii++] = '\0'; // password
    memcpy(buf+ii, share_path, strlen(share_path)+1);
    ii += strlen(share_path)+1;
    memcpy(buf+ii, share_service, strlen(share_service)+1);
    ii += strlen(share_service)+1;

    *(short*)(buf+bci) = ii - bci - 2;

    ii = sizeof(buf);

    *(short*)(buf+2) = htons(ii-4); // non-inclusive len

    assert(ii <= sizeof(buf));

    printf("tree_connect_andx writing %d bytes\n", ii); fflush(stdout);

    if(write(s, buf, ii) <= 0){
      perror("write");
        exit(1);
    }
  }

  {
    // read tree connect response, MS-CIFS 2.2.4.55.2
    unsigned char buf[1024];
    memset(buf, 0, sizeof(buf));
    int cc = readmsg(buf);
    printf("read %d for tree_connect_andx response\n", cc);
    tid = *(short*)(buf+28);
    tid &= 0xffff;
    printf("TID 0x%x\n", tid);
  }
}

void
tree_connect()
{
  // SMB_COM_TREE_CONNECT, MS-CIFS 2.2.4.50
  {
    char buf[128];
    memset(buf, 1, sizeof(buf));

    int ii = header(buf, 0x70);

    buf[ii++] = 0; // number of 16-bit words of parameters

    // data block
    int bci = ii;
    *(short*)(buf+ii) = 0; // byte count including this len (to be filled in)
    ii += 2;

    buf[ii++] = 0x04; // BufferFormat
    memcpy(buf+ii, share_path, strlen(share_path)+1);
    ii += strlen(share_path)+1;

    buf[ii++] = 0x04; // BufferFormat
    buf[ii++] = '\0'; // password

    buf[ii++] = 0x04; // BufferFormat
    memcpy(buf+ii, share_service, strlen(share_service)+1);
    ii += strlen(share_service)+1;

    *(short*)(buf+bci) = ii - bci - 2;

    ii = sizeof(buf);

    *(short*)(buf+2) = htons(ii-4); // non-inclusive len

    assert(ii <= sizeof(buf));

    printf("tree_connect writing %d bytes\n", ii); fflush(stdout);

    if(write(s, buf, ii) <= 0){
      perror("write");
        exit(1);
    }
  }

  {
    // read tree connect response, MS-CIFS 2.2.4.55.2
    unsigned char buf[1024];
    memset(buf, 0, sizeof(buf));
    int cc = readmsg(buf);
    printf("read %d for tree connect response\n", cc);
    tid = *(short*)(buf+28);
    tid &= 0xffff;
    printf("TID 0x%x\n", tid);
  }
}

void
nt_create()
{
  // SMB_COM_NT_CREATE_ANDX, MS-CIFS 2.2.4.64
  {
    char buf[128];
    memset(buf, 0xff, sizeof(buf));

    int ii = header(buf, 0xa2);

    // parameter block
    int param_words = 0x18;
    buf[ii++] = param_words; // number of 16-bit words of parameters
    // ii is 37 at this point

    buf[ii++] = 0xff; // AndXCommand
    buf[ii++] = 0; // Reserved
    *(short*)(buf+ii) = 0; // AndXOffset
    ii += 2;
    buf[ii++] = 0; // Reserved
    *(short*)(buf+ii) = 1; // NameLength
    ii += 2;
    *(int*)(buf+ii) = 0; // Flags
    ii += 4;
    *(int*)(buf+ii) = 0; // RootDirectoryFID
    ii += 4;
    *(int*)(buf+ii) = 7; // DesiredAccess
    ii += 4;
    memset(buf+ii, 0, 8); // AllocationSize
    ii += 8;
    *(int*)(buf+ii) = 0; // ExtFileAttributes
    ii += 4;
    *(int*)(buf+ii) = 7; // ShareAccess
    ii += 4;
    *(int*)(buf+ii) = 0; // CreateDisposition
    ii += 4;
    *(int*)(buf+ii) = 0; // CreateOptions
    ii += 4;
    *(int*)(buf+ii) = 0; // ImpersonationLevel
    ii += 4;
    buf[ii++] = 0; // SecurityFlags

    // data block
    int bci = ii;
    *(short*)(buf+ii) = 0; // byte count including this len (to be filled in)
    ii += 2;
    buf[ii++] = 'f'; // FileName

    *(short*)(buf+bci) = ii - bci - 2;

    ii = sizeof(buf);

    *(short*)(buf+2) = htons(ii-4); // non-inclusive len

    assert(ii <= sizeof(buf));

    printf("nt_create writing %d bytes\n", ii); fflush(stdout);

    if(write(s, buf, ii) <= 0){
      perror("write");
        exit(1);
    }
  }

  {
    // read nt_create response
    unsigned char buf[1024];
    memset(buf, 0, sizeof(buf));
    int cc = readmsg(buf);
    printf("read %d for nt_create response\n", cc);
    fid = *(short*)(buf + 42);
    fid &= 0xffff;
    printf("FID 0x%04x\n", fid);
  }
}

void
check_directory(char *name)
{
  // SMB_COM_CHECK_DIRECTORY, MS-CIFS 2.2.4.17
  {
    char buf[128];
    memset(buf, 0xff, sizeof(buf));

    int ii = header(buf, 0x10);

    // parameter block
    int param_words = 0x00;
    buf[ii++] = param_words; // number of 16-bit words of parameters
    // ii is 37 at this point

    // data block
    int bci = ii;
    *(short*)(buf+ii) = 0; // byte count including this len (to be filled in)
    ii += 2;
    buf[ii++] = 0x04; // SMB_STRING
    memcpy(buf+ii, name, strlen(name) + 1);
    ii += strlen(name) + 1;

    *(short*)(buf+bci) = ii - bci - 2;

    ii = sizeof(buf);

    *(short*)(buf+2) = htons(ii-4); // non-inclusive len

    assert(ii <= sizeof(buf));

    printf("check_directory writing %d bytes\n", ii); fflush(stdout);

    if(write(s, buf, ii) <= 0){
      perror("write");
        exit(1);
    }
  }

  {
    unsigned char buf[1024];
    memset(buf, 0, sizeof(buf));
    int cc = readmsg(buf);
    printf("read %d for check_directory response\n", cc);
    printf("check_directory Status 0x%x\n", *(unsigned int*)(buf+9));
  }
}

void
smb_ioctl()
{
  // SMB_COM_IOCTL, MS-CIFS 2.2.4.35
  {
    char buf[128];
    memset(buf, 0xff, sizeof(buf));

    int ii = header(buf, 0x27);

    // parameter block
    int param_words = 0x0e;
    buf[ii++] = param_words; // number of 16-bit words of parameters
    // ii is 37 at this point

    *(short*)(buf+ii) = fid; // FID
    ii += 2;
    *(short*)(buf+ii) = 0x53; // Category
    ii += 2;
    *(short*)(buf+ii) = 0x60; // Function
    ii += 2;
    *(short*)(buf+ii) = 8; // TotalParameterCount
    ii += 2;
    *(short*)(buf+ii) = 8; // TotalDataCount
    ii += 2;
    *(short*)(buf+ii) = 8; // MaxParameterCount
    ii += 2;
    *(short*)(buf+ii) = 8; // MaxDataCount
    ii += 2;
    *(int*)(buf+ii) = 1000000; // Timeout (ms)
    ii += 4;
    *(short*)(buf+ii) = 0; // Reserved
    ii += 2;
    *(short*)(buf+ii) = 8; // ParameterCount
    ii += 2;
    *(short*)(buf+ii) = 0; // ParameterOffset
    ii += 2;
    *(short*)(buf+ii) = 8; // DataCount
    ii += 2;
    *(short*)(buf+ii) = 0; // DataOffset
    ii += 2;

    // data block
    int bci = ii;
    *(short*)(buf+ii) = 0; // byte count including this len (to be filled in)
    ii += 2;
    ii += 48;

    *(short*)(buf+bci) = ii - bci - 2;

    ii = sizeof(buf);

    *(short*)(buf+2) = htons(ii-4); // non-inclusive len

    assert(ii <= sizeof(buf));

    printf("ioctl writing %d bytes\n", ii); fflush(stdout);

    if(write(s, buf, ii) <= 0){
      perror("write");
        exit(1);
    }
  }

  {
    unsigned char buf[1024];
    memset(buf, 0, sizeof(buf));
    int cc = readmsg(buf);
    printf("read %d for ioctl response\n", cc);
  }
}

void
transaction2()
{
  // SMB_COM_TRANSACTION2, MS-CIFS 2.2.4.46
  {
    char buf[256];
    memset(buf, 0xff, sizeof(buf));

    int ii = header(buf, 0x32);

    // parameter block
    int param_words = 14 + 1; // 14 + SetupCount
    buf[ii++] = param_words; // number of 16-bit words of parameters
    // ii is 37 at this point

    *(short*)(buf+ii) = 32; // TotalParameterCount
    ii += 2;
    *(short*)(buf+ii) = 15; // TotalDataCount
    ii += 2;
    *(short*)(buf+ii) = 256; // MaxParameterCount
    ii += 2;
    *(short*)(buf+ii) = 8192; // MaxDataCount
    ii += 2;
    buf[ii++] = 64; // MaxSetupCount
    buf[ii++] = 0; // Reserved1
    *(short*)(buf+ii) = 0; // Flags
    ii += 2;
    *(int*)(buf+ii) = 1000000; // Timeout, in ms
    ii += 4;
    *(short*)(buf+ii) = 0; // Reserved2
    ii += 2;
    *(short*)(buf+ii) = 32; // ParameterCount
    ii += 2;
    int parameter_offset_i = ii;
    *(short*)(buf+ii) = 32; // ParameterOffset XXX
    ii += 2;
    *(short*)(buf+ii) = 15; // DataCount
    ii += 2;
    int data_offset_i = ii;
    *(short*)(buf+ii) = 32; // DataOffset
    ii += 2;
    buf[ii++] = 1; // SetupCount
    buf[ii++] = 0; // Reserved3

    // Setup words
    *(short*)(buf+ii) = 0; // sub-command number -- TRANS2_OPEN2
    ii += 2;

    // data block
    int bci = ii;
    *(short*)(buf+ii) = 0; // byte count including this len (to be filled in)
    ii += 2;

    buf[ii++] = 0; // Name
    while(ii % 4)
      ii++; // Pad1

    *(short*)(buf+parameter_offset_i) = ii - 4; // ParameterOffset 

    *(short*)(buf+ii) = 0; // Flags
    ii += 2;
    *(short*)(buf+ii) = 0; // AccessMode
    ii += 2;
    *(short*)(buf+ii) = 0; // Reserved1
    ii += 2;
    *(short*)(buf+ii) = 0; // FileAttributes
    ii += 2;
    *(int*)(buf+ii) = 1; // CreationTime
    ii += 4;
    *(short*)(buf+ii) = 0x11; // OpenMode
    ii += 2;
    *(int*)(buf+ii) = 0; // AllocationSize
    ii += 4;
    memset(buf+ii, 0, 10); // Reserved
    ii += 10;
    char *name = "t";
    memcpy(buf+ii, name, strlen(name)+1);
    ii += strlen(name) + 1;

    while(ii % 4)
      ii++; // Pad2

    *(short*)(buf+data_offset_i) = ii - 4; // DataOffset 

    // Extended AttributeList
    *(int*)(buf+ii) = 12; // SizeOfListInBytes
    ii += 4;
    buf[ii++] = 0; // ExtendedAttributeFlag
    buf[ii++] = 3; // name length
    *(short*)(buf+ii) = 3; // value length
    ii += 2;
    memcpy(buf+ii, "aaa", 4);
    ii += 4;
    memcpy(buf+ii, "bbb", 4);
    ii += 4;
    
    *(short*)(buf+bci) = ii - bci - 2;

    ii = sizeof(buf);

    *(short*)(buf+2) = htons(ii-4); // non-inclusive len

    assert(ii <= sizeof(buf));

    printf("transaction2 writing %d bytes\n", ii); fflush(stdout);

    if(write(s, buf, ii) <= 0){
      perror("write");
        exit(1);
    }
  }

  {
    unsigned char buf[1024];
    memset(buf, 0, sizeof(buf));
    int cc = readmsg(buf);
    printf("read %d for transaction2 response\n", cc);
  }
}

void
nt_transaction()
{
  // SMB_COM_NT_TRANSACT, MS-CIFS 2.2.4.62
  {
    char buf[256];
    memset(buf, 0xff, sizeof(buf));

    int ii = header(buf, 0xa0);

    // parameter block
    int param_words = 19 + 0; // 19 + SetupCount
    buf[ii++] = param_words; // number of 16-bit words of parameters
    // ii is 37 at this point

    buf[ii++] = 64; // MaxSetupCount
    *(short*)(buf+ii) = 0; // Reserved1
    ii += 2;
    *(int*)(buf+ii) = 54; // TotalParameterCount
    ii += 4;
    *(int*)(buf+ii) = 15; // TotalDataCount
    ii += 4;
    *(int*)(buf+ii) = 256; // MaxParameterCount
    ii += 4;
    *(int*)(buf+ii) = 8192; // MaxDataCount
    ii += 4;
    *(int*)(buf+ii) = 54; // ParameterCount
    ii += 4;
    int parameter_offset_i = ii;
    *(int*)(buf+ii) = 32; // ParameterOffset XXX
    ii += 4;
    *(int*)(buf+ii) = 15; // DataCount
    ii += 4;
    int data_offset_i = ii;
    *(int*)(buf+ii) = 32; // DataOffset
    ii += 4;
    buf[ii++] = 0; // SetupCount
    *(short*)(buf+ii) = 1; // Function
    ii += 2;

    // Setup words
    *(short*)(buf+ii) = 0;
    ii += 2;

    // data block
    int bci = ii;
    *(short*)(buf+ii) = 0; // byte count including this len (to be filled in)
    ii += 2;

    while(ii % 4)
      ii++; // Pad1

    *(int*)(buf+parameter_offset_i) = ii - 4; // ParameterOffset 

    *(int*)(buf+ii) = 0; // Flags
    ii += 4;
    *(int*)(buf+ii) = 0; // RootDirectoryFID
    ii += 4;
    *(int*)(buf+ii) = 7; // DesiredAccess
    ii += 4;
    memset(buf+ii, 0, 8); // AllocationSize
    ii += 8;
    *(int*)(buf+ii) = 0; // ExtFileAttributes
    ii += 4;
    *(int*)(buf+ii) = 7; // ShareAccess
    ii += 4;
    *(int*)(buf+ii) = 0; // CreateDisposition
    ii += 4;
    *(int*)(buf+ii) = 0; // CreateOptions
    ii += 4;
    *(int*)(buf+ii) = 0; // SecurityDescriptorLength
    ii += 4;
    *(int*)(buf+ii) = 0; // EALength
    ii += 4;
    *(int*)(buf+ii) = 1; // NameLength
    ii += 4;
    *(int*)(buf+ii) = 0; // ImpersonationLevel
    ii += 4;
    buf[ii++] = 0; // SecurityFlags
    char *name = "t";
    memcpy(buf+ii, name, strlen(name));
    ii += strlen(name);

    while(ii % 4)
      ii++; // Pad2

    *(int*)(buf+data_offset_i) = ii - 4; // DataOffset 

    // Extended AttributeList
    *(int*)(buf+ii) = 12; // SizeOfListInBytes
    ii += 4;
    buf[ii++] = 0; // ExtendedAttributeFlag
    buf[ii++] = 3; // name length
    *(short*)(buf+ii) = 3; // value length
    ii += 2;
    memcpy(buf+ii, "aaa", 4);
    ii += 4;
    memcpy(buf+ii, "bbb", 4);
    ii += 4;
    
    *(short*)(buf+bci) = ii - bci - 2;

    ii = sizeof(buf);

    *(short*)(buf+2) = htons(ii-4); // non-inclusive len

    assert(ii <= sizeof(buf));

    printf("nt_transaction writing %d bytes\n", ii); fflush(stdout);

    if(write(s, buf, ii) <= 0){
      perror("write");
        exit(1);
    }
  }

  {
    unsigned char buf[1024];
    memset(buf, 0, sizeof(buf));
    int cc = readmsg(buf);
    printf("read %d for nt_transaction response\n", cc);
  }
}

void
transaction()
{
  // SMB_COM_TRANSACTION, MS-CIFS 2.2.4.33
  {
    char buf[256];
    memset(buf, 0xff, sizeof(buf));

    int ii = header(buf, 0x25);

    // parameter block
    int param_words = 14 + 2; // 14 + SetupCount
    buf[ii++] = param_words; // number of 16-bit words of parameters
    // ii is 37 at this point

    *(short*)(buf+ii) = 32; // TotalParameterCount
    ii += 2;
    *(short*)(buf+ii) = 15; // TotalDataCount
    ii += 2;
    *(short*)(buf+ii) = 256; // MaxParameterCount
    ii += 2;
    *(short*)(buf+ii) = 8192; // MaxDataCount
    ii += 2;
    buf[ii++] = 64; // MaxSetupCount
    buf[ii++] = 0; // Reserved1
    *(short*)(buf+ii) = 0; // Flags
    ii += 2;
    *(int*)(buf+ii) = 1000000; // Timeout, in ms
    ii += 4;
    *(short*)(buf+ii) = 0; // Reserved2
    ii += 2;
    *(short*)(buf+ii) = 32; // ParameterCount
    ii += 2;
    int parameter_offset_i = ii;
    *(short*)(buf+ii) = 32; // ParameterOffset XXX
    ii += 2;
    *(short*)(buf+ii) = 15; // DataCount
    ii += 2;
    int data_offset_i = ii;
    *(short*)(buf+ii) = 32; // DataOffset
    ii += 2;
    buf[ii++] = 2; // SetupCount
    buf[ii++] = 0; // Reserved3

    // Setup words
    *(short*)(buf+ii) = 0; // ???
    ii += 2;
    *(short*)(buf+ii) = fid; // ???
    ii += 2;

    // data block
    int bci = ii;
    *(short*)(buf+ii) = 0; // byte count including this len (to be filled in)
    ii += 2;

    //char *pname = "\\pipe\\LANMAN";
    char *pname = "\\pipe\\";
    memcpy(buf+ii, pname, strlen(pname)+1);
    ii += strlen(pname) + 1;
    
    while(ii % 4)
      ii++; // Pad1

    *(short*)(buf+parameter_offset_i) = ii - 4; // ParameterOffset 

    *(short*)(buf+ii) = 1; // Flags
    ii += 2;
    *(short*)(buf+ii) = 0; // AccessMode
    ii += 2;
    *(short*)(buf+ii) = 0; // Reserved1
    ii += 2;
    *(short*)(buf+ii) = 0; // FileAttributes
    ii += 2;
    *(int*)(buf+ii) = 1; // CreationTime
    ii += 4;
    *(short*)(buf+ii) = 0x11; // OpenMode
    ii += 2;
    *(int*)(buf+ii) = 0; // AllocationSize
    ii += 4;
    memset(buf+ii, 0, 10); // Reserved
    ii += 10;
    char *name2 = "t";
    memcpy(buf+ii, name2, strlen(name2)+1);
    ii += strlen(name2) + 1;

    while(ii % 4)
      ii++; // Pad2

    *(short*)(buf+data_offset_i) = ii - 4; // DataOffset 

    // Extended AttributeList
    *(int*)(buf+ii) = 12; // SizeOfListInBytes
    ii += 4;
    buf[ii++] = 0; // ExtendedAttributeFlag
    buf[ii++] = 3; // name length
    *(short*)(buf+ii) = 3; // value length
    ii += 2;
    memcpy(buf+ii, "aaa", 4);
    ii += 4;
    memcpy(buf+ii, "bbb", 4);
    ii += 4;
    
    *(short*)(buf+bci) = ii - bci - 2;

    ii = sizeof(buf);

    *(short*)(buf+2) = htons(ii-4); // non-inclusive len

    assert(ii <= sizeof(buf));

    printf("transaction writing %d bytes\n", ii); fflush(stdout);

    if(write(s, buf, ii) <= 0){
      perror("write");
        exit(1);
    }
  }

  {
    // read nt_create response
    unsigned char buf[1024];
    memset(buf, 0, sizeof(buf));
    int cc = readmsg(buf);
    printf("read %d for transaction response\n", cc);
  }
}

void
smb_logoff()
{
  // SMB_COM_LOGOFF_ANDX, MS-CIFS 2.2.4.54
  {
    char buf[256];
    memset(buf, 0xff, sizeof(buf));

    int ii = header(buf, 0x74);

    // parameter block
    buf[ii++] = 2; // number of 16-bit words of parameters
    buf[ii++] = 0xff; // AndXCommand
    buf[ii++] = 0; // Reserved
    *(short*)(buf+ii) = (ii - 4 + 4); // AndXOffset
    ii += 2;

    // data block
    *(short*)(buf+ii) = 0; // byte count including this len (to be filled in)
    ii += 2;

    ii = sizeof(buf);

    *(short*)(buf+2) = htons(ii-4); // non-inclusive len

    assert(ii <= sizeof(buf));

    printf("logoff writing %d bytes\n", ii); fflush(stdout);

    if(write(s, buf, ii) <= 0){
      perror("write");
        exit(1);
    }
  }

  {
    unsigned char buf[1024];
    memset(buf, 0, sizeof(buf));
    int cc = readmsg(buf);
    printf("read %d for logoff response\n", cc);
  }
}

int
main()
{
  struct rlimit r;
  r.rlim_cur = r.rlim_max = 0;
  setrlimit(RLIMIT_CORE, &r);

  signal(SIGPIPE, SIG_IGN);

  struct sockaddr_in sin;
  memset(&sin, 0, sizeof(sin));
  sin.sin_family = AF_INET;
  sin.sin_port = htons(445); // SMB over TCP
  sin.sin_addr.s_addr = inet_addr(server_ip);

  while(1){
    s = socket(AF_INET, SOCK_STREAM, 0);
    if(connect(s, (struct sockaddr *)&sin, sizeof(sin)) == 0)
      break;
    close(s);
    sleep(1);
  }

  sleep(1);

  negotiate("NT LM 0.12");
  tree_connect();

  close(s);
}