2.2.3.3 Data Block

The general structure of the data block is similar to that of the Parameter block, except that the length of the buffer portion is measured in bytes.

 SMB_Data
   {
   USHORT ByteCount;
   UCHAR  Bytes[ByteCount] (variable);
   } 

0	1	2	3	4	5	6	7	8	9	1 0	1	2	3	4	5	6	7	8	9	2 0	1	2	3	4	5	6	7	8	9	3 0	1
ByteCount																Bytes (variable)
...

ByteCount (2 bytes): The size, in bytes, of the Bytes field. This field can be 0x0000, indicating that the Bytes field is empty. Because the SMB_Parameters.Words field is unaligned and the SMB_Data.ByteCount field is two bytes in size, the first byte of SMB_Data.Bytes is also unaligned.

Bytes (variable): The message-specific data structure. The size of this field MUST be ByteCount bytes. If ByteCount is 0x0000, this field is not included.