# SYS_* keys — winbox-ipc system namespace (byte_2 = 0xFF) # # Drained from strawman/winbox-m2.ksy `full_key_id` enum and the # winbox-m2-semantics.yaml overlay. Names follow the Cisco-Talos # dissector. Where this project's own PROTOCOL.md uses a divergent name # the older label is preserved in `aka:` so old code keeps grepping. --- m2ir-version: 0.1 schema-version: 0.1 profile: winbox-ipc namespace: 0xff namespace-name: system source-table: name: typeIDCode language: lua file: Winbox_Dissector.lua lines: { from: 198, to: 216 } repo: "Cisco-Talos/Winbox_Protocol_Dissector" url: "https://github.com/Cisco-Talos/Winbox_Protocol_Dissector/blob/master/Winbox_Dissector.lua#L198-L216" drained-on: 2026-05-03 notes: | SYS_* portion of `typeIDCode` (the same Lua table also feeds STD_* into std-keys.yaml and the process catch-alls into processes.yaml). Auxiliary enums `typeCode` (lines 172-175) and `statusCode` (177-180) supply the SYS_TYPE and SYS_STATUS value tables below. evidence: - source: code ref: "Cisco-Talos Winbox_Dissector.lua:198-216 (typeIDCode SYS_* portion)" url: "https://github.com/Cisco-Talos/Winbox_Protocol_Dissector/blob/master/Winbox_Dissector.lua#L198-L216" - source: code ref: "Cisco-Talos Winbox_Dissector.lua:172-175 (typeCode → SYS_TYPE values)" url: "https://github.com/Cisco-Talos/Winbox_Protocol_Dissector/blob/master/Winbox_Dissector.lua#L172-L175" - source: code ref: "Cisco-Talos Winbox_Dissector.lua:177-180 (statusCode → SYS_STATUS values)" url: "https://github.com/Cisco-Talos/Winbox_Protocol_Dissector/blob/master/Winbox_Dissector.lua#L177-L180" keys: 0xff0001: canonical-name: SYS_TO physical: { tcodes: [0x88] } semantic: handler-path role: "destination handler path; first element = process_id, rest = handler hierarchy" confidence: documented 0xff0002: canonical-name: SYS_FROM physical: { tcodes: [0x88] } semantic: handler-path role: "source handler path" confidence: documented 0xff0003: canonical-name: SYS_TYPE physical: { tcodes: [0x08, 0x09] } semantic: enum-u32 role: "message direction discriminant" values: 1: TYPE_REQUEST 2: TYPE_REPLY confidence: documented notes: | Canonical request/reply discriminant. This project's PROTOCOL.md does not list 0xFF0003 at all and uses the boolean SYS_REPLYEXP (0xFF0005) for the same purpose; the two fields likely coexist with overlapping meaning. DUAL ROLE (§40): 0xff0003 is ALSO the looper-fabric pseudo-pid ("self") — nv::Handler::pushNotifies addresses notifications TO [0xff0003], and nv::Looper::sendMessage dispatches TO-head 0xff0003 via popLooperTo + prependLooperFrom(msg, 0xff0003) + queueMessage (libumsg 0x3e099). Retry-pair leg A (TO=[] FROM=[0xff0003,slot]) is exactly that branch's output shape. Never a process; absent from PR/HD by design. 0xff0004: canonical-name: SYS_STATUS physical: { tcodes: [0x08, 0x09] } semantic: enum-u32 role: "set on TYPE_REPLY to indicate command outcome" values: 1: OK 2: ERROR confidence: documented notes: | Project-PROTOCOL.md mislabels 0xFF0008 as `SYS_STATUS`; per Cisco-Talos that's actually `SYS_ERRNO`, and the real `SYS_STATUS` is at 0xFF0004. Queue-3 batch (all 12 manifests: 65 router-errors + 64 oks, 0 violations): 0xff0004=2 on every router-error; ABSENT (null) on every ok, including GETCOUNT-ok, empty-list-ok, and bare-SYS-only empty-miss replies. evidence: - source: sample ref: "live CHR interrogation (queue-3 read-only capture batch, 6.49.23 + 7.25 + 7.26beta4, 2026-11-01): statusWord on errors, absent on oks — fixtures/winbox-ipc/{6.49,7.25,7.26beta4}-{neg-20-61,error-census,nat-raw-f40,user-family}.json" 0xff0005: canonical-name: SYS_REPLYEXP physical: { tcodes: [0x00, 0x01] } semantic: bool role: "true = sender expects a reply" aliases: - { name: SYS_REQUEST, status: superseded, source: "this project's PROTOCOL.md" } confidence: documented 0xff0006: canonical-name: SYS_REQID physical: { tcodes: [0x08, 0x09] } semantic: request-id confidence: documented 0xff0007: canonical-name: SYS_CMD physical: { tcodes: [0x08, 0x09] } semantic: command-code confidence: documented notes: | Encodes either a STD_CMD_* (0xFE0000-range; see std-commands.yaml) or a handler-private command (top byte = process_id; see commands.yaml + processes.yaml). Encoded as u8 (tcode 0x09) for legacy short-form values (cmdGet=7, cmdOpen=5) and u32 (tcode 0x08) for the canonical 0xFE0000- and process_id-prefixed forms. 0xff0008: canonical-name: SYS_ERRNO physical: { tcodes: [0x08, 0x09] } semantic: enum-u32 role: "set on TYPE_REPLY when SYS_STATUS == ERROR; values from std-errors.yaml" aliases: - { name: SYS_STATUS, status: superseded, source: "this project's PROTOCOL.md mislabel" } confidence: documented 0xff0009: canonical-name: SYS_ERRSTR physical: { tcodes: [0x20, 0x21] } semantic: utf8-string role: "human-readable error string riding some ERROR replies (last key, after SYS_REQID)" confidence: documented notes: "First sighting anywhere (queue-3 census): bare GET on [13,6]/[13,7] -> FAILED + 0xff0009/0x21='no user name provided' (len 0x15=21, wire tail `0900ff21156e6f2075736572206e616d652070726f7669646564`), identical all 3 versions x both handlers (6 replies). Absent on every other census reply (all BRKPATH/NOTIMP/UNKNOWNID/timeout legs + all oks). TOOBIG/MISSING/BUSY errstr legs stay open. Second sighting, write path (queue-3 item 3, [13,7], 7.25): SET{} -> FAILED + the identical string." evidence: - source: sample ref: "live CHR interrogation (queue-3 read-only capture batch, 6.49.23 + 7.25 + 7.26beta4, 2026-11-01): first 0xff0009 sighting on the FAILED legs — fixtures/winbox-ipc/{6.49,7.25,7.26beta4}-error-census.json" - source: sample ref: "live CHR interrogation (queue-3 mutation capture batch, 7.25, 2026-11-01): second 0xff0009 sighting on the SET{} FAILED leg — fixtures/winbox-ipc/7.25-set-13-7-overwrite.json" 0xff000a: canonical-name: SYS_USER physical: { tcodes: [0x20, 0x21] } semantic: utf8-string confidence: documented 0xff000b: canonical-name: SYS_POLICY physical: { tcodes: [0x08, 0x09] } semantic: bitmask-u32 confidence: documented values: 0x0005fffe: admin 0x0007fffe: gui-max 0x80000000: super-admin-flag 0xffffffff: super-admin notes: | Permission bitmask attached to proxied messages. MarginResearch documents 0x5FFFE as a standard admin mask, 0x7FFFE as the maximum mask settable via the WinBox GUI, and bit 0x80000000 as the super-admin gate checked by `www` handler 2 ("FoisHandler"). Internal RouterOS messages may carry 0xFFFFFFFF — seen live on every v7 compat-shim reply (1024-1030 block) and bare-[1], but on NO native service reply (sys2/net/mproxy shapes all lack it): the shim-8 envelope is the native-7 envelope plus policy−1. Loader programs the policy table at boot (add_policy over cmds {1, 0xfe0002-0xfe0006, 0x400-0x402}, v7 loader 0x80532e3 block). evidence: - source: doc ref: "MarginResearch — policy bitmask values" - source: sample ref: "live CHR interrogation (census batch, 7.25): 0xff000b=-1 on all [61,H]->[1025,H] errors; see work/2026-10-chr-extraction/ws3c-prober-findings.md §17" url: "https://margin.re/2022/06/pulling-mikrotik-into-the-limelight/" - source: sample ref: "live CHR interrogation (shim census, 7.25): byte-exact envelope classes (native-7/shim-8/mproxy-5/pid-1-6); see work/2026-10-chr-extraction/ws3c-prober-findings.md §23" - source: code ref: "RouterOS v7 loader add_policy sequence (0x805323f-0x8053330); see work/2026-10-chr-extraction/ws3c-prober-findings.md §23" 0xff000d: canonical-name: SYS_CTRL physical: { tcodes: [0x08, 0x09] } semantic: u32 confidence: documented 0xff000f: canonical-name: SYS_CTRL_ARG physical: { tcodes: ["*"] } semantic: any confidence: documented notes: "Tcode varies; argument paired with SYS_CTRL." 0xff0010: canonical-name: SYS_USER_ID physical: { tcodes: [0x08, 0x09] } semantic: u32 confidence: documented 0xff0011: canonical-name: SYS_NOTIFYCMD physical: { tcodes: [0x08, 0x09] } semantic: u32 confidence: documented 0xff0012: canonical-name: SYS_ORIGINATOR physical: { tcodes: [0x88] } semantic: handler-path confidence: documented 0xff0013: canonical-name: SYS_RADDR6 physical: { tcodes: [0x18] } semantic: ipv6-addr confidence: documented 0xff0016: canonical-name: SYS_DREASON physical: { tcodes: [0x08, 0x09] } semantic: u32 confidence: documented notes: "Scope open: presumably a disconnect-reason code traveling with CMD_DISCONNECTED / cmdDisconnected contexts; no live sighting yet to confirm." 0xff001c: canonical-name: SYS_PROXY_BANNER physical: { tcodes: [0xa0] } semantic: string-array role: "v7 proxy version stamp on every reply" confidence: observed-only notes: "Live: every 7.25 reply carries ['msg-proxy-7.25']; every 7.16.2/mipsbe reply carries ['msg-proxy-7.16.2'] (first pre-7.25 + non-CHR sighting, real hardware); 6.49.23 replies lack the key entirely (v6 envelopes are slimmer). Project-named; no documented label. Do NOT confuse with row field 0xfe001c (tags, different namespace)." evidence: - source: sample ref: "live CHR interrogation (WS-3C prober, 6.49.23 + 7.25); see work/2026-10-chr-extraction/ws3c-prober-findings.md §3" - source: sample ref: "live RouterOS interrogation (queue-3 item-5 read-only LTE leg, 7.16.2 stable mipsbe real hardware, 2026-11-01): msg-proxy-7.16.2 on every reply — fixtures/winbox-ipc/7.16-neg-20-61-lte.json" 0xff001e: canonical-name: SYS_OWNER_TOKEN physical: { tcodes: [0x08, 0x09] } semantic: u32 role: "per-interface owner/manager token (project-named; no documented label). Client-supplied u32 at ADDOBJ (stored entry+0x40, default -1 = unmanaged); echoed in rows when != -1; SETOBJ/REMOVEOBJ without the matching token fail ('can not change/remove managed interface'); CLI/REST cannot spell it, so a tokened interface is M2-only until reboot. Token is the ephemerality switch: untokened M2 rows persist across reboots (first-class, CLI-removable); tokened rows are reaped at every boot (see notes)." confidence: observed-only notes: "Full lifecycle proven live (§26): ADD stores, rows echo, SET/REMOVE gated by exact match (default -1 passes unmanaged rows). Tokened rows ARE in the store (record carries 0xff001e) but never instantiate: sstore's boot-load reaper selects token != -1 per record (selecting read 0x804d4d0, token-index trees 0x8063450/0x8063454) and appends len-0 tombstones during boot, before the first client re-persist — shutdown plays no role (proven over power-cut-only cycles). Selection is value-free (4 token values reaped live); no periodic in-memory reaper (180s timed window + multi-session survival). Guard compares against a per-entry token shadowing +0x40 (offset read +0x3c; aliasing micro-open). Also feeds the notify matcher (shouldNotify arg). v7-only (0 sites in v6 net). Tombstoned rowids stay reserved from auto-assign; explicit-rowid ADD reclaims them (live rowid -> ERROR_EXISTS); auto-assign is high-water max+1 (see ./gui-handlers.yaml interface notes). Store GC later compacts tombstones away (rotation, cfg.%04x generations)." evidence: - source: code ref: "RouterOS v7 net row-core 0x8064f1a; see work/2026-10-chr-extraction/net-bridge2-handler-tables.md §8" - source: code ref: "RouterOS v7 net 7-site lifecycle (ADD-store 0x8066a2a, SET-guards 0x8066bee/0x8066f03/0x8067087, boot-restore 0x806ddf5, notify-arg 0x80601f2, slot-7 0xff0007 subcommand dispatch); see work/2026-10-chr-extraction/ws3c-prober-findings.md §26" - source: sample ref: "live CHR interrogation (token batch, 7.25): ev/7.25-raw-20-0-addobj.json + ev/7.25-getall-20-0-ff001e.json (first sighting ff001e=12345; guard truth table; remove-with-token; ephemerality x2); see work/2026-10-chr-extraction/ws3c-prober-findings.md §26" - source: sample ref: "live CHR interrogation + store forensics (persistence batch, 7.25): untokened M2-ADD persists ADD-only across graceful reboots, token isolated 2x as the ephemerality switch; see work/2026-10-chr-extraction/ws3c-prober-findings.md §31" - source: sample ref: "live CHR interrogation + store forensics (token-gate batch, 7.25): tokened rows present in /rw/store (record shape, m2.ts decode), never instantiate at boot, tombstone = len-0 record, latest-decisive; see work/2026-10-chr-extraction/ws3c-prober-findings.md §34" - source: code ref: "RouterOS v7 sstore token-index + boot-load reaper (selecting read 0x804d4d0, index trees 0x8063450/0x8063454, boot scan 0x804f2fb); net fully exonerated (all 5 Store::remove sites + all 5 row-destructor callers classified, none token-selected); see work/2026-10-chr-extraction/ws3c-prober-findings.md §47" - source: sample ref: "live CHR interrogation + store forensics (forensics batch, 7.25): 8 boots / 6 carves, boot-only tombstoning (power-cut cycles), value-free selection (4 tokens), no periodic reaper (180s timed), rowid reservation + explicit-reclaim + high-water; ev/7.25-getall-20-0-rp47-{base,live,post,clean}.json; see work/2026-10-chr-extraction/ws3c-prober-findings.md §47" revision-history: - date: 2026-10-31 belief: "SYS_OBSERVED_1E: unknown u32, static-only, no live sighting" outcome: superseded evidence: - source: sample ref: "live CHR interrogation (token batch, 7.25): owner-token lifecycle; see work/2026-10-chr-extraction/ws3c-prober-findings.md §26" - date: 2026-11-01 belief: "M2-ADDed interfaces do not persist; boot-restore of 0xff001e is a static-only unreachable path" outcome: superseded evidence: - source: sample ref: "live CHR interrogation (persistence batch, 7.25): untokened M2 rows persist; see work/2026-10-chr-extraction/ws3c-prober-findings.md §31" - source: sample ref: "live CHR interrogation + store forensics (token-gate batch, 7.25): tokened rows are in the store; boot skips them; see work/2026-10-chr-extraction/ws3c-prober-findings.md §34" - date: 2026-11-01 belief: "tokened rows are skipped memory-only with no tombstone; freed rowids return to the pool (§34)" outcome: superseded evidence: - source: sample ref: "live CHR interrogation + store forensics (forensics batch, 7.25): sstore boot-load appends tombstones for tokened rows; tombstoned ids reserved from auto-assign; §34 reuse reconciled as explicit-reclaim; see work/2026-10-chr-extraction/ws3c-prober-findings.md §47" investigation-trail: - date: 2026-10-31 finding: | WS-4 drain of live CHR interrogation: new SYS key 0xff001c (v7-only proxy banner) + SYS_DREASON scope note (open, no live sighting). Triage: the proposed STATUS_OK rename of SYS_STATUS value 1 was DECLINED — OK/ERROR are verbatim Cisco-Talos statusCode members (source-table lines 177-180) and renaming would break that transcription; namespaced aliases can be layered if a consumer needs them. - date: 2026-10-31 finding: | Token batch (findings §26): 0xff001e renamed SYS_OBSERVED_1E -> SYS_OWNER_TOKEN (per-interface owner/manager token: ADD stores, rows echo, SET/REMOVE gated, CLI/REST locked out, M2-ADDs ephemeral; first live sighting 12345).