Closed st-gwerner closed 5 years ago
Really thank you for opening this issue, we have updated the parse function of ModLinkAttRequest. We missed one parameter before, if you are interested about that you can see details on MS-OXNSPI 3.1.4.1.15 NspiModLinkAtt (Opnum 14) and 2.2.2.3 Binary_r Structure.
The class ModLinkAttRequest treats the list of EntryIds as an object[]. This does not show correctly in the inspection tree, and causes the cursor position of clicked items in the byte array to be off by the length of the EntryIds array.
So reproduce, run MSOXNSPI_S04_TC04_ModLinkAttSuccessWithPidTagAddressBookPublicDelegates from the ExchangeMAPIProtocolTestSuites, and you'll notice on the first ModLinkAtt call that HasEntryIds is True, EntryIdCount is 1, but the Ids themselves are not shown in the inspector.