ruby_smb 1.0.5 → 1.1.0

data/lib/ruby_smb/dcerpc/winreg/close_key_request.rb

@@ -0,0 +1,24 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegCloseKey Request Packet as defined in
+      # [3.1.5.6 BaseRegCloseKey (Opnum 5)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/bc7545ff-0a54-4465-a95a-396b5c2995df)
+      class CloseKeyRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey  :hkey
+
+        def initialize_instance
+          super
+          @opnum = REG_CLOSE_KEY
+        end
+      end
+
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/winreg/close_key_response.rb

@@ -0,0 +1,27 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegCloseKey Response Packet as defined in
+      # [3.1.5.6 BaseRegCloseKey (Opnum 5)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/bc7545ff-0a54-4465-a95a-396b5c2995df)
+      class CloseKeyResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey  :hkey
+        uint32    :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_CLOSE_KEY
+        end
+      end
+
+    end
+  end
+end
+
+

data/lib/ruby_smb/dcerpc/winreg/enum_key_request.rb

@@ -0,0 +1,45 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegEnumKey Request Packet as defined in
+      # [3.1.5.10 BaseRegEnumKey (Opnum 9)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/668627e9-e0eb-4ab1-911f-0af589beeac3)
+      class EnumKeyRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey            :hkey
+        uint32              :dw_index
+        rrp_unicode_string  :lp_name
+        string              :pad1,     length: -> { pad_length1 }
+        prrp_unicode_string :lp_class
+        string              :pad2,     length: -> { pad_length2 }
+        ndr_lp_file_time    :lpft_last_write_time
+
+        def initialize_instance
+          super
+          @opnum = REG_ENUM_KEY
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lp_class. It should always force a 4-byte alignment.
+        def pad_length1
+          offset = (lp_name.abs_offset + lp_name.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lpft_last_write_time. It should always force a 4-byte alignment.
+        def pad_length2
+          offset = (lp_class.abs_offset + lp_class.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/winreg/enum_key_response.rb

@@ -0,0 +1,42 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      # This class represents a BaseRegEnumKey Response Packet as defined in
+      # [3.1.5.10 BaseRegEnumKey (Opnum 9)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/668627e9-e0eb-4ab1-911f-0af589beeac3)
+      class EnumKeyResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rrp_unicode_string  :lp_name
+        string              :pad1,     length: -> { pad_length1 }
+        prrp_unicode_string :lp_class, initial_value: 0
+        string              :pad2,     length: -> { pad_length2 }
+        ndr_lp_file_time    :lpft_last_write_time
+        uint32              :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_ENUM_KEY
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lp_class. It should always force a 4-byte alignment.
+        def pad_length1
+          offset = (lp_name.abs_offset + lp_name.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lpft_last_write_time. It should always force a 4-byte alignment.
+        def pad_length2
+          offset = (lp_class.abs_offset + lp_class.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/winreg/enum_value_request.rb

@@ -0,0 +1,39 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegEnumValue Request Packet as defined in
+      # [3.1.5.11 BaseRegEnumValue (Opnum 10)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/56e99ef3-05dc-4f24-bcf5-9cff00412945)
+      class EnumValueRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey           :hkey
+        uint32             :dw_index
+        rrp_unicode_string :lp_value_name
+        string             :pad, length: -> { pad_length }
+        ndr_lp_dword       :lp_type
+        ndr_lp_byte        :lp_data
+        ndr_lp_dword       :lpcb_data
+        ndr_lp_dword       :lpcb_len
+
+        def initialize_instance
+          super
+          @opnum = REG_ENUM_VALUE
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lp_type. It should always force a 4-byte alignment.
+        def pad_length
+          offset = (lp_value_name.abs_offset + lp_value_name.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/winreg/enum_value_response.rb

@@ -0,0 +1,36 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      # This class represents a BaseRegEnumValue Response Packet as defined in
+      # [3.1.5.11 BaseRegEnumValue (Opnum 10)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/56e99ef3-05dc-4f24-bcf5-9cff00412945)
+      class EnumValueResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rrp_unicode_string :lp_value_name
+        string             :pad, length: -> { pad_length }
+        ndr_lp_dword       :lp_type
+        ndr_lp_byte        :lp_data
+        ndr_lp_dword       :lpcb_data
+        ndr_lp_dword       :lpcb_len
+        uint32             :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_ENUM_VALUE
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lp_type. It should always force a 4-byte alignment.
+        def pad_length
+          offset = (lp_value_name.abs_offset + lp_value_name.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/winreg/open_key_request.rb

@@ -0,0 +1,34 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegOpenKey Request Packet as defined in
+      # [3.1.5.15 BaseRegOpenKey (Opnum 15)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/8cb48f55-19e1-4ea2-8d76-dd0f6934f0d9)
+      class OpenKeyRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey           :hkey
+        rrp_unicode_string :lp_sub_key
+        string             :pad, length: -> { pad_length }
+        uint32             :dw_options
+        regsam             :sam_desired
+
+        def initialize_instance
+          super
+          @opnum = REG_OPEN_KEY
+        end
+
+        # Determines the correct length for the padding in front of
+        # #dw_options. It should always force a 4-byte alignment.
+        def pad_length
+          offset = (lp_sub_key.abs_offset + lp_sub_key.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/winreg/open_key_response.rb

@@ -0,0 +1,25 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class PrpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegOpenKey Response Packet as defined in
+      # [3.1.5.15 BaseRegOpenKey (Opnum 15)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/8cb48f55-19e1-4ea2-8d76-dd0f6934f0d9)
+      class OpenKeyResponse < BinData::Record
+        attr_reader :opnum
+
+        endian    :little
+        prpc_hkey :phk_result
+        uint32    :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_OPEN_KEY
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/winreg/open_root_key_request.rb

@@ -0,0 +1,43 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      # This class represents a PREGISTRY_SERVER_NAME structure as defined in
+      # [2.2.2 PREGISTRY_SERVER_NAME](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/8bcd15fd-1aa5-44e2-8662-112ec3e9817b)
+      class PRegistryServerName < Ndr::NdrTopLevelFullPointer
+        endian :little
+
+        string16 :referent, read_length: -> { 4 }
+      end
+
+      # This class is a generic class that represents OpenXXX Request packet,
+      # used to open one of the root keys, as defined in:
+      # [3.1.5.1 OpenClassesRoot (Opnum 0)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/956a3052-6580-43ee-91aa-aaf61726149b)
+      # [3.1.5.2 OpenCurrentUser (Opnum 1)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/ec140ed9-4d00-4c03-a15c-c7245a497ed5)
+      # [3.1.5.3 OpenLocalMachine (Opnum 2)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/6cef29ae-21ba-423f-9158-05145ac80a5b)
+      # [3.1.5.4 OpenPerformanceData (Opnum 3)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/7b514c63-6cad-4fe1-9780-743959e377e6)
+      # [3.1.5.5 OpenUsers (Opnum 4)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/694e57f4-da3e-4285-8b71-3181d71d6cd1)
+      # [3.1.5.25 OpenCurrentConfig (Opnum 27)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/160767d7-83cf-4718-a4f3-d864faee3bb1)
+      # [3.1.5.28 OpenPerformanceText (Opnum 32)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/44954f6d-ef2c-4ec1-a27d-32b9b87e3c8a)
+      # [3.1.5.29 OpenPerformanceNlsText (Opnum 33)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/3626fa8a-b20f-4243-bf85-cdb615ed2ca0)
+      # The structure is define by the value of the #opnum parameter
+      # e.g. (OpenLocalMachine):
+      #   OpenRootKeyRequest.new(opnum: RubySMB::Dcerpc::Winreg::OPEN_HKLM)
+      class OpenRootKeyRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+        p_registry_server_name :p_registry_server_name
+        regsam                 :sam_desired
+
+        def initialize_instance
+          super
+          @opnum = get_parameter(:opnum) if has_parameter?(:opnum)
+          p_registry_server_name.referent = "\0\0"
+          sam_desired.maximum = 1 unless [OPEN_HKPD, OPEN_HKPT, OPEN_HKPN].include?(@opnum)
+        end
+      end
+
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/winreg/open_root_key_response.rb

@@ -0,0 +1,35 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class PrpcHkey < Ndr::NdrContextHandle; end
+
+      # This class is a generic class that represents OpenXXX Response packet,
+      # used to open one of the root keys, as defined in:
+      # [3.1.5.1 OpenClassesRoot (Opnum 0)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/956a3052-6580-43ee-91aa-aaf61726149b)
+      # [3.1.5.2 OpenCurrentUser (Opnum 1)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/ec140ed9-4d00-4c03-a15c-c7245a497ed5)
+      # [3.1.5.3 OpenLocalMachine (Opnum 2)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/6cef29ae-21ba-423f-9158-05145ac80a5b)
+      # [3.1.5.4 OpenPerformanceData (Opnum 3)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/7b514c63-6cad-4fe1-9780-743959e377e6)
+      # [3.1.5.5 OpenUsers (Opnum 4)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/694e57f4-da3e-4285-8b71-3181d71d6cd1)
+      # [3.1.5.25 OpenCurrentConfig (Opnum 27)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/160767d7-83cf-4718-a4f3-d864faee3bb1)
+      # [3.1.5.28 OpenPerformanceText (Opnum 32)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/44954f6d-ef2c-4ec1-a27d-32b9b87e3c8a)
+      # [3.1.5.29 OpenPerformanceNlsText (Opnum 33)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/3626fa8a-b20f-4243-bf85-cdb615ed2ca0)
+      # The structure is define by the value of the #opnum parameter
+      # e.g. (OpenLocalMachine):
+      #   OpenRootKeyResponse.new(opnum: RubySMB::Dcerpc::Winreg::OPEN_HKLM)
+      class OpenRootKeyResponse < BinData::Record
+        attr_reader :opnum
+
+        endian    :little
+        prpc_hkey :ph_key
+        uint32    :error_status
+
+        def initialize_instance
+          super
+          @opnum = get_parameter(:opnum) if has_parameter?(:opnum)
+        end
+      end
+
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/winreg/query_info_key_request.rb

@@ -0,0 +1,27 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegQueryInfoKey Request Packet as defined in
+      # [3.1.5.16 BaseRegQueryInfoKey (Opnum 16)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/a886ba66-5c7b-4331-bacd-7c77edc95d85)
+      class QueryInfoKeyRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey           :hkey
+        rrp_unicode_string :lp_class, initial_value: 0
+
+        def initialize_instance
+          super
+          @opnum = REG_QUERY_INFO_KEY
+        end
+      end
+
+    end
+  end
+end
+
+

data/lib/ruby_smb/dcerpc/winreg/query_info_key_response.rb

@@ -0,0 +1,40 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+      # This class represents a BaseRegQueryInfoKey Response Packet as defined in
+      # [3.1.5.16 BaseRegQueryInfoKey (Opnum 16)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/a886ba66-5c7b-4331-bacd-7c77edc95d85)
+      class QueryInfoKeyResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rrp_unicode_string :lp_class, initial_value: 0
+        string             :pad,      length: -> { pad_length }
+        uint32             :lpc_sub_keys
+        uint32             :lpc_max_sub_key_len
+        uint32             :lpc_max_class_len
+        uint32             :lpc_values
+        uint32             :lpcb_max_value_name_len
+        uint32             :lpcb_max_value_len
+        uint32             :lpcb_security_descriptor
+        file_time          :lpft_last_write_time
+        uint32             :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_QUERY_INFO_KEY
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lpc_sub_keys. It should always force a 4-byte alignment.
+        def pad_length
+          offset = (lp_class.abs_offset + lp_class.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+
+

data/lib/ruby_smb/dcerpc/winreg/query_value_request.rb

@@ -0,0 +1,39 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegQueryValue Request Packet as defined in
+      # [3.1.5.17 BaseRegQueryValue (Opnum 17)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/8bc10aa3-2f91-44e8-aa33-b3263c49ab9d)
+      class QueryValueRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey           :hkey
+        rrp_unicode_string :lp_value_name
+        string             :pad, length: -> { pad_length }
+        ndr_lp_dword       :lp_type
+        ndr_lp_byte        :lp_data
+        ndr_lp_dword       :lpcb_data
+        ndr_lp_dword       :lpcb_len
+
+        def initialize_instance
+          super
+          @opnum = REG_QUERY_VALUE
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lp_type. It should always force a 4-byte alignment.
+        def pad_length
+          offset = (lp_value_name.abs_offset + lp_value_name.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+
+