Parsing Microsoft PAC-field from KRB_AP_REQ

[Luke Howard]

>Specific questions:
>1. The pointer to the string(?) buffer in UNICODE_STRING, is it considered 
>as an "Embedded Full pointer" in NDR?

They are unique pointers.

>2. The representation of the string data itself, is it consider as a 
>"String" in NDR?

No, it's a uni-dimensional conformant and varying array.

>3. Is there a simple way to figure out which byte(s) that holds the 
>information that I'm looking for (groupIDs)?

You should let the NDR library do this for you.

-- Luke

--