Various client requests and server responses, such as SMB_COM_OPEN, pass file access modes encoded into a USHORT. The encoding of these is as follows:
1111 11
5432 1098 7654 3210
rWrC rLLL rSSS rAAA
where:
W - Write through mode. No read ahead or write behind allowed on
this file or device. When the response is returned, data is
expected to be on the disk or device.
S - Sharing mode:
0 - Compatibility mode
1 - Deny read/write/execute (exclusive)
2 - Deny write
3 - Deny read/execute
4 - Deny none
A - Access mode
0 - Open for reading
1 - Open for writing
2 - Open for reading and writing
3 - Open for execute
rSSSrAAA = 11111111 (hex FF) indicates FCB open (???)
C - Cache mode
0 - Normal file
1 - Do not cache this file
L - Locality of reference
0 - Locality of reference is unknown
1 - Mainly sequential access
2 - Mainly random access
3 - Random access with some locality
4 to 7 - Currently undefined