ruby_smb 1.0.5 → 2.0.3

data/lib/ruby_smb/dcerpc/winreg/close_key_request.rb

@@ -0,0 +1,24 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegCloseKey Request Packet as defined in
+      # [3.1.5.6 BaseRegCloseKey (Opnum 5)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/bc7545ff-0a54-4465-a95a-396b5c2995df)
+      class CloseKeyRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey  :hkey
+
+        def initialize_instance
+          super
+          @opnum = REG_CLOSE_KEY
+        end
+      end
+
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/winreg/close_key_response.rb

@@ -0,0 +1,27 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegCloseKey Response Packet as defined in
+      # [3.1.5.6 BaseRegCloseKey (Opnum 5)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/bc7545ff-0a54-4465-a95a-396b5c2995df)
+      class CloseKeyResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey  :hkey
+        uint32    :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_CLOSE_KEY
+        end
+      end
+
+    end
+  end
+end
+
+

data/lib/ruby_smb/dcerpc/winreg/create_key_request.rb

@@ -0,0 +1,73 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegCreateKey Request Packet as defined in
+      # [3.1.5.7 BaseRegCreateKey (Opnum 6)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/c7186ae2-1c82-45e9-933b-97d9873657e8)
+      class CreateKeyRequest < BinData::Record
+        # Options:
+        # bitwise OR of one of the key types (REG_KEY_TYPE_*), and any or none
+        # of the other options:
+        #
+        # This key is not volatile. The key and all its values MUST be
+        # persisted to the backing store and is preserved when the registry
+        # server loses context due to a computer restart, reboot, or shut down
+        # process.
+        REG_KEY_TYPE_NON_VOLATILE  = 0x00000000
+        # This key is volatile. The key with all its subkeys and values MUST
+        # NOT be preserved when the registry server loses context due to a
+        # computer restart, reboot, or shut down process.
+        REG_KEY_TYPE_VOLATILE      = 0x00000001
+        # This key is a symbolic link to another key.
+        REG_KEY_TYPE_SYMLINK       = 0x00000002
+        # Indicates that the caller wishes to assert its backup and/or restore
+        # privileges.
+        REG_OPTION_BACKUP_RESTORE  = 0x00000004
+        # Indicates that the caller wishes to open the targeted symlink source
+        # rather than the symlink target.
+        REG_OPTION_OPEN_LINK       = 0x00000008
+        # Indicates that the caller wishes to disable limited user access
+        # virtualization for this operation.
+        REG_OPTION_DONT_VIRTUALIZE = 0x00000010
+
+
+        # Create disposition:
+        # The key did not exist and was created.
+        REG_CREATED_NEW_KEY     = 0x00000001
+        # The key already existed and was opened without being changed.
+        REG_OPENED_EXISTING_KEY = 0x00000002
+
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey                 :hkey
+        rrp_unicode_string       :lp_sub_key
+        string                   :pad1, length: -> { pad_length(self.lp_sub_key) }
+        rrp_unicode_string       :lp_class
+        string                   :pad2, length: -> { pad_length(self.lp_class) }
+        uint32                   :dw_options
+        regsam                   :sam_desired
+        prpc_security_attributes :lp_security_attributes
+        string                   :pad3, length: -> { pad_length(self.lp_security_attributes) }
+        ndr_lp_dword             :lpdw_disposition
+
+        def initialize_instance
+          super
+          @opnum = REG_CREATE_KEY
+        end
+
+        # Determines the correct length for the padding, so that the next
+        # field is 4-byte aligned.
+        def pad_length(prev_element)
+          offset = (prev_element.abs_offset + prev_element.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/winreg/create_key_response.rb

@@ -0,0 +1,36 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class PrpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegCreateKey Response Packet as defined in
+      # [3.1.5.7 BaseRegCreateKey (Opnum 6)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/c7186ae2-1c82-45e9-933b-97d9873657e8)
+      class CreateKeyResponse < BinData::Record
+        # Create disposition
+        # The key did not exist and was created.
+        REG_CREATED_NEW_KEY     = 0x00000001
+        # The key already existed and was opened without being changed.
+        REG_OPENED_EXISTING_KEY = 0x00000002
+
+        attr_reader :opnum
+
+        endian :little
+
+        prpc_hkey    :hkey
+        ndr_lp_dword :lpdw_disposition
+        uint32       :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_CREATE_KEY
+        end
+      end
+
+    end
+  end
+end
+
+
+
+

data/lib/ruby_smb/dcerpc/winreg/enum_key_request.rb

@@ -0,0 +1,45 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegEnumKey Request Packet as defined in
+      # [3.1.5.10 BaseRegEnumKey (Opnum 9)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/668627e9-e0eb-4ab1-911f-0af589beeac3)
+      class EnumKeyRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey            :hkey
+        uint32              :dw_index
+        rrp_unicode_string :lp_name
+        string              :pad1,     length: -> { pad_length1 }
+        prrp_unicode_string :lp_class
+        string              :pad2,     length: -> { pad_length2 }
+        ndr_lp_file_time    :lpft_last_write_time
+
+        def initialize_instance
+          super
+          @opnum = REG_ENUM_KEY
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lp_class. It should always force a 4-byte alignment.
+        def pad_length1
+          offset = (lp_name.abs_offset + lp_name.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lpft_last_write_time. It should always force a 4-byte alignment.
+        def pad_length2
+          offset = (lp_class.abs_offset + lp_class.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/winreg/enum_key_response.rb

@@ -0,0 +1,42 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      # This class represents a BaseRegEnumKey Response Packet as defined in
+      # [3.1.5.10 BaseRegEnumKey (Opnum 9)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/668627e9-e0eb-4ab1-911f-0af589beeac3)
+      class EnumKeyResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rrp_unicode_string  :lp_name
+        string              :pad1,     length: -> { pad_length1 }
+        prrp_unicode_string :lp_class, initial_value: 0
+        string              :pad2,     length: -> { pad_length2 }
+        ndr_lp_file_time    :lpft_last_write_time
+        uint32              :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_ENUM_KEY
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lp_class. It should always force a 4-byte alignment.
+        def pad_length1
+          offset = (lp_name.abs_offset + lp_name.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lpft_last_write_time. It should always force a 4-byte alignment.
+        def pad_length2
+          offset = (lp_class.abs_offset + lp_class.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/winreg/enum_value_request.rb

@@ -0,0 +1,39 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegEnumValue Request Packet as defined in
+      # [3.1.5.11 BaseRegEnumValue (Opnum 10)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/56e99ef3-05dc-4f24-bcf5-9cff00412945)
+      class EnumValueRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey           :hkey
+        uint32             :dw_index
+        rrp_unicode_string :lp_value_name
+        string             :pad, length: -> { pad_length }
+        ndr_lp_dword       :lp_type
+        ndr_lp_byte_array  :lp_data
+        ndr_lp_dword       :lpcb_data
+        ndr_lp_dword       :lpcb_len
+
+        def initialize_instance
+          super
+          @opnum = REG_ENUM_VALUE
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lp_type. It should always force a 4-byte alignment.
+        def pad_length
+          offset = (lp_value_name.abs_offset + lp_value_name.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/winreg/enum_value_response.rb

@@ -0,0 +1,36 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      # This class represents a BaseRegEnumValue Response Packet as defined in
+      # [3.1.5.11 BaseRegEnumValue (Opnum 10)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/56e99ef3-05dc-4f24-bcf5-9cff00412945)
+      class EnumValueResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rrp_unicode_string :lp_value_name
+        string             :pad, length: -> { pad_length }
+        ndr_lp_dword       :lp_type
+        ndr_lp_byte_array  :lp_data
+        ndr_lp_dword       :lpcb_data
+        ndr_lp_dword       :lpcb_len
+        uint32             :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_ENUM_VALUE
+        end
+
+        # Determines the correct length for the padding in front of
+        # #lp_type. It should always force a 4-byte alignment.
+        def pad_length
+          offset = (lp_value_name.abs_offset + lp_value_name.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/winreg/open_key_request.rb

@@ -0,0 +1,34 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegOpenKey Request Packet as defined in
+      # [3.1.5.15 BaseRegOpenKey (Opnum 15)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/8cb48f55-19e1-4ea2-8d76-dd0f6934f0d9)
+      class OpenKeyRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey           :hkey
+        rrp_unicode_string :lp_sub_key
+        string             :pad, length: -> { pad_length }
+        uint32             :dw_options
+        regsam             :sam_desired
+
+        def initialize_instance
+          super
+          @opnum = REG_OPEN_KEY
+        end
+
+        # Determines the correct length for the padding in front of
+        # #dw_options. It should always force a 4-byte alignment.
+        def pad_length
+          offset = (lp_sub_key.abs_offset + lp_sub_key.to_binary_s.length) % 4
+          (4 - offset) % 4
+        end
+      end
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/winreg/open_key_response.rb

@@ -0,0 +1,25 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class PrpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegOpenKey Response Packet as defined in
+      # [3.1.5.15 BaseRegOpenKey (Opnum 15)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/8cb48f55-19e1-4ea2-8d76-dd0f6934f0d9)
+      class OpenKeyResponse < BinData::Record
+        attr_reader :opnum
+
+        endian    :little
+        prpc_hkey :phk_result
+        uint32    :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_OPEN_KEY
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/winreg/open_root_key_request.rb

@@ -0,0 +1,43 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      # This class represents a PREGISTRY_SERVER_NAME structure as defined in
+      # [2.2.2 PREGISTRY_SERVER_NAME](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/8bcd15fd-1aa5-44e2-8662-112ec3e9817b)
+      class PRegistryServerName < Ndr::NdrPointer
+        endian :little
+
+        string16 :referent, onlyif: -> { self.referent_id != 0 }, read_length: -> { 4 }
+      end
+
+      # This class is a generic class that represents OpenXXX Request packet,
+      # used to open one of the root keys, as defined in:
+      # [3.1.5.1 OpenClassesRoot (Opnum 0)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/956a3052-6580-43ee-91aa-aaf61726149b)
+      # [3.1.5.2 OpenCurrentUser (Opnum 1)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/ec140ed9-4d00-4c03-a15c-c7245a497ed5)
+      # [3.1.5.3 OpenLocalMachine (Opnum 2)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/6cef29ae-21ba-423f-9158-05145ac80a5b)
+      # [3.1.5.4 OpenPerformanceData (Opnum 3)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/7b514c63-6cad-4fe1-9780-743959e377e6)
+      # [3.1.5.5 OpenUsers (Opnum 4)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/694e57f4-da3e-4285-8b71-3181d71d6cd1)
+      # [3.1.5.25 OpenCurrentConfig (Opnum 27)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/160767d7-83cf-4718-a4f3-d864faee3bb1)
+      # [3.1.5.28 OpenPerformanceText (Opnum 32)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/44954f6d-ef2c-4ec1-a27d-32b9b87e3c8a)
+      # [3.1.5.29 OpenPerformanceNlsText (Opnum 33)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/3626fa8a-b20f-4243-bf85-cdb615ed2ca0)
+      # The structure is define by the value of the #opnum parameter
+      # e.g. (OpenLocalMachine):
+      #   OpenRootKeyRequest.new(opnum: RubySMB::Dcerpc::Winreg::OPEN_HKLM)
+      class OpenRootKeyRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+        p_registry_server_name :p_registry_server_name
+        regsam                 :sam_desired
+
+        def initialize_instance
+          super
+          @opnum = get_parameter(:opnum) if has_parameter?(:opnum)
+          self.p_registry_server_name = :null
+          self.sam_desired.maximum = 1 unless [OPEN_HKPD, OPEN_HKPT, OPEN_HKPN].include?(@opnum)
+        end
+      end
+
+    end
+  end
+end

data/lib/ruby_smb/dcerpc/winreg/open_root_key_response.rb

@@ -0,0 +1,35 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class PrpcHkey < Ndr::NdrContextHandle; end
+
+      # This class is a generic class that represents OpenXXX Response packet,
+      # used to open one of the root keys, as defined in:
+      # [3.1.5.1 OpenClassesRoot (Opnum 0)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/956a3052-6580-43ee-91aa-aaf61726149b)
+      # [3.1.5.2 OpenCurrentUser (Opnum 1)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/ec140ed9-4d00-4c03-a15c-c7245a497ed5)
+      # [3.1.5.3 OpenLocalMachine (Opnum 2)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/6cef29ae-21ba-423f-9158-05145ac80a5b)
+      # [3.1.5.4 OpenPerformanceData (Opnum 3)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/7b514c63-6cad-4fe1-9780-743959e377e6)
+      # [3.1.5.5 OpenUsers (Opnum 4)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/694e57f4-da3e-4285-8b71-3181d71d6cd1)
+      # [3.1.5.25 OpenCurrentConfig (Opnum 27)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/160767d7-83cf-4718-a4f3-d864faee3bb1)
+      # [3.1.5.28 OpenPerformanceText (Opnum 32)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/44954f6d-ef2c-4ec1-a27d-32b9b87e3c8a)
+      # [3.1.5.29 OpenPerformanceNlsText (Opnum 33)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/3626fa8a-b20f-4243-bf85-cdb615ed2ca0)
+      # The structure is define by the value of the #opnum parameter
+      # e.g. (OpenLocalMachine):
+      #   OpenRootKeyResponse.new(opnum: RubySMB::Dcerpc::Winreg::OPEN_HKLM)
+      class OpenRootKeyResponse < BinData::Record
+        attr_reader :opnum
+
+        endian    :little
+        prpc_hkey :ph_key
+        uint32    :error_status
+
+        def initialize_instance
+          super
+          @opnum = get_parameter(:opnum) if has_parameter?(:opnum)
+        end
+      end
+
+    end
+  end
+end