ruby_smb 2.0.2 → 3.0.0

data/lib/ruby_smb/dcerpc/winreg/enum_value_request.rb

@@ -12,27 +12,18 @@ module RubySMB
         endian :little
 
         rpc_hkey           :hkey
-        uint32             :dw_index
+        ndr_uint32         :dw_index
         rrp_unicode_string :lp_value_name
-        string             :pad, length: -> { pad_length }
-        ndr_lp_dword       :lp_type
-        ndr_lp_byte        :lp_data
-        ndr_lp_dword       :lpcb_data
-        ndr_lp_dword       :lpcb_len
+        ndr_uint32_ptr     :lp_type
+        ndr_byte_array_ptr :lp_data
+        ndr_uint32_ptr     :lpcb_data
+        ndr_uint32_ptr     :lpcb_len
 
         def initialize_instance
           super
           @opnum = REG_ENUM_VALUE
         end
-
-        # Determines the correct length for the padding in front of
-        # #lp_type. It should always force a 4-byte alignment.
-        def pad_length
-          offset = (lp_value_name.abs_offset + lp_value_name.to_binary_s.length) % 4
-          (4 - offset) % 4
-        end
       end
-
     end
   end
 end

data/lib/ruby_smb/dcerpc/winreg/enum_value_response.rb

@@ -10,26 +10,17 @@ module RubySMB
         endian :little
 
         rrp_unicode_string :lp_value_name
-        string             :pad, length: -> { pad_length }
-        ndr_lp_dword       :lp_type
-        ndr_lp_byte        :lp_data
-        ndr_lp_dword       :lpcb_data
-        ndr_lp_dword       :lpcb_len
-        uint32             :error_status
+        ndr_uint32_ptr     :lp_type
+        ndr_byte_array_ptr :lp_data
+        ndr_uint32_ptr     :lpcb_data
+        ndr_uint32_ptr     :lpcb_len
+        ndr_uint32         :error_status
 
         def initialize_instance
           super
           @opnum = REG_ENUM_VALUE
         end
-
-        # Determines the correct length for the padding in front of
-        # #lp_type. It should always force a 4-byte alignment.
-        def pad_length
-          offset = (lp_value_name.abs_offset + lp_value_name.to_binary_s.length) % 4
-          (4 - offset) % 4
-        end
       end
-
     end
   end
 end

data/lib/ruby_smb/dcerpc/winreg/open_key_request.rb

@@ -13,21 +13,13 @@ module RubySMB
 
         rpc_hkey           :hkey
         rrp_unicode_string :lp_sub_key
-        string             :pad, length: -> { pad_length }
-        uint32             :dw_options
+        ndr_uint32         :dw_options
         regsam             :sam_desired
 
         def initialize_instance
           super
           @opnum = REG_OPEN_KEY
         end
-
-        # Determines the correct length for the padding in front of
-        # #dw_options. It should always force a 4-byte alignment.
-        def pad_length
-          offset = (lp_sub_key.abs_offset + lp_sub_key.to_binary_s.length) % 4
-          (4 - offset) % 4
-        end
       end
     end
   end

data/lib/ruby_smb/dcerpc/winreg/open_key_response.rb

@@ -9,9 +9,10 @@ module RubySMB
       class OpenKeyResponse < BinData::Record
         attr_reader :opnum
 
-        endian    :little
-        prpc_hkey :phk_result
-        uint32    :error_status
+        endian :little
+
+        prpc_hkey     :phk_result
+        ndr_uint32    :error_status
 
         def initialize_instance
           super

data/lib/ruby_smb/dcerpc/winreg/open_root_key_request.rb

@@ -4,10 +4,9 @@ module RubySMB
 
       # This class represents a PREGISTRY_SERVER_NAME structure as defined in
       # [2.2.2 PREGISTRY_SERVER_NAME](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/8bcd15fd-1aa5-44e2-8662-112ec3e9817b)
-      class PRegistryServerName < Ndr::NdrTopLevelFullPointer
-        endian :little
-
-        string16 :referent, read_length: -> { 4 }
+      class PRegistryServerName < BinData::Array
+        default_parameter type: :ndr_wide_char, referent_byte_align: 2
+        extend Ndr::PointerClassPlugin
       end
 
       # This class is a generic class that represents OpenXXX Request packet,
@@ -27,14 +26,14 @@ module RubySMB
         attr_reader :opnum
 
         endian :little
-        p_registry_server_name :p_registry_server_name
+        p_registry_server_name :server_name
         regsam                 :sam_desired
 
         def initialize_instance
           super
           @opnum = get_parameter(:opnum) if has_parameter?(:opnum)
-          p_registry_server_name.referent = "\0\0"
-          sam_desired.maximum = 1 unless [OPEN_HKPD, OPEN_HKPT, OPEN_HKPN].include?(@opnum)
+          self.server_name = :null
+          self.sam_desired.maximum = 1 unless [OPEN_HKPD, OPEN_HKPT, OPEN_HKPN].include?(@opnum)
         end
       end
 

data/lib/ruby_smb/dcerpc/winreg/open_root_key_response.rb

@@ -21,8 +21,8 @@ module RubySMB
         attr_reader :opnum
 
         endian    :little
-        prpc_hkey :ph_key
-        uint32    :error_status
+        prpc_hkey  :ph_key
+        ndr_uint32 :error_status
 
         def initialize_instance
           super

data/lib/ruby_smb/dcerpc/winreg/query_info_key_request.rb

@@ -12,7 +12,7 @@ module RubySMB
         endian :little
 
         rpc_hkey           :hkey
-        rrp_unicode_string :lp_class, initial_value: 0
+        rrp_unicode_string :lp_class
 
         def initialize_instance
           super

data/lib/ruby_smb/dcerpc/winreg/query_info_key_response.rb

@@ -9,30 +9,21 @@ module RubySMB
         endian :little
 
         rrp_unicode_string :lp_class, initial_value: 0
-        string             :pad,      length: -> { pad_length }
-        uint32             :lpc_sub_keys
-        uint32             :lpc_max_sub_key_len
-        uint32             :lpc_max_class_len
-        uint32             :lpc_values
-        uint32             :lpcb_max_value_name_len
-        uint32             :lpcb_max_value_len
-        uint32             :lpcb_security_descriptor
-        file_time          :lpft_last_write_time
-        uint32             :error_status
+        ndr_uint32         :lpc_sub_keys
+        ndr_uint32         :lpc_max_sub_key_len
+        ndr_uint32         :lpc_max_class_len
+        ndr_uint32         :lpc_values
+        ndr_uint32         :lpcb_max_value_name_len
+        ndr_uint32         :lpcb_max_value_len
+        ndr_uint32         :lpcb_security_descriptor
+        ndr_file_time      :lpft_last_write_time
+        ndr_uint32         :error_status
 
         def initialize_instance
           super
           @opnum = REG_QUERY_INFO_KEY
         end
-
-        # Determines the correct length for the padding in front of
-        # #lpc_sub_keys. It should always force a 4-byte alignment.
-        def pad_length
-          offset = (lp_class.abs_offset + lp_class.to_binary_s.length) % 4
-          (4 - offset) % 4
-        end
       end
-
     end
   end
 end

data/lib/ruby_smb/dcerpc/winreg/query_value_request.rb

@@ -13,25 +13,16 @@ module RubySMB
 
         rpc_hkey           :hkey
         rrp_unicode_string :lp_value_name
-        string             :pad, length: -> { pad_length }
-        ndr_lp_dword       :lp_type
-        ndr_lp_byte        :lp_data
-        ndr_lp_dword       :lpcb_data
-        ndr_lp_dword       :lpcb_len
+        ndr_uint32_ptr     :lp_type
+        ndr_byte_array_ptr :lp_data
+        ndr_uint32_ptr     :lpcb_data
+        ndr_uint32_ptr     :lpcb_len
 
         def initialize_instance
           super
           @opnum = REG_QUERY_VALUE
         end
-
-        # Determines the correct length for the padding in front of
-        # #lp_type. It should always force a 4-byte alignment.
-        def pad_length
-          offset = (lp_value_name.abs_offset + lp_value_name.to_binary_s.length) % 4
-          (4 - offset) % 4
-        end
       end
-
     end
   end
 end

data/lib/ruby_smb/dcerpc/winreg/query_value_response.rb

@@ -9,29 +9,21 @@ module RubySMB
 
         endian :little
 
-        ndr_lp_dword :lp_type
-        ndr_lp_byte  :lp_data
-        string       :pad, length: -> { pad_length }
-        ndr_lp_dword :lpcb_data
-        ndr_lp_dword :lpcb_len
-        uint32       :error_status
+        ndr_uint32_ptr     :lp_type
+        ndr_byte_array_ptr :lp_data
+        ndr_uint32_ptr     :lpcb_data
+        ndr_uint32_ptr     :lpcb_len
+        ndr_uint32         :error_status
 
         def initialize_instance
           super
           @opnum = REG_QUERY_VALUE
         end
 
-        # Determines the correct length for the padding in front of
-        # #lpcb_data. It should always force a 4-byte alignment.
-        def pad_length
-          offset = (lp_data.abs_offset + lp_data.to_binary_s.length) % 4
-          (4 - offset) % 4
-        end
-
         # Returns the data portion of the registry value formatted according to its type:
         # [3.1.1.5 Values](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/3d64dbea-f016-4373-8cac-e43bf343837d)
         def data
-          bytes = lp_data.bytes.to_a.pack('C*')
+          bytes = lp_data.to_a.pack('C*')
           case lp_type
           when 1,2
             bytes.force_encoding('utf-16le').strip
@@ -47,7 +39,7 @@ module RubySMB
           when 11
             bytes.unpack('Q<').first
           else
-            ""
+            ''
           end
         end
 

data/lib/ruby_smb/dcerpc/winreg/regsam.rb

@@ -5,8 +5,10 @@ module RubySMB
       # This class represents a REGSAM structure as defined in
       # [2.2.3 REGSAM](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/fefbc801-b141-4bb1-9dcb-bf366da3ae7e)
       # [2.4.3 ACCESS_MASK](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/7a53f60e-e730-4dfe-bbe9-b21b62eb790b)
-      class Regsam < BinData::Record
+      class Regsam < Ndr::NdrStruct
+        default_parameter byte_align: 4
         endian  :little
+
         bit2    :reserved,               label: 'Reserved Space'
         bit1    :key_create_link,        label: 'Key Create Link'
         bit1    :key_notify,             label: 'Key Notify'

data/lib/ruby_smb/dcerpc/winreg/save_key_request.rb

@@ -0,0 +1,28 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      class RpcHkey < Ndr::NdrContextHandle; end
+
+      # This class represents a BaseRegSaveKey Request Packet as defined in
+      # [3.1.5.20 BaseRegSaveKey (Opnum 20)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/f022247d-6ef1-4f46-b195-7f60654f4a0d)
+      class SaveKeyRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        rpc_hkey                 :hkey
+        rrp_unicode_string       :lp_file
+        prpc_security_attributes :lp_security_attributes
+
+        def initialize_instance
+          super
+          @opnum = REG_SAVE_KEY
+        end
+      end
+    end
+  end
+end
+
+
+

data/lib/ruby_smb/dcerpc/winreg/save_key_response.rb

@@ -0,0 +1,23 @@
+module RubySMB
+  module Dcerpc
+    module Winreg
+
+      # This class represents a BaseRegSaveKey Response Packet as defined in
+      # [3.1.5.20 BaseRegSaveKey (Opnum 20)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/f022247d-6ef1-4f46-b195-7f60654f4a0d)
+      class SaveKeyResponse < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        ndr_uint32 :error_status
+
+        def initialize_instance
+          super
+          @opnum = REG_CREATE_KEY
+        end
+      end
+
+    end
+  end
+end
+

data/lib/ruby_smb/dcerpc/winreg.rb

@@ -13,11 +13,13 @@ module RubySMB
       OPEN_HKPD             = 0x03
       OPEN_HKU              = 0x04
       REG_CLOSE_KEY         = 0x05
+      REG_CREATE_KEY        = 0x06
       REG_ENUM_KEY          = 0x09
       REG_ENUM_VALUE        = 0x0a
       REG_OPEN_KEY          = 0x0f
       REG_QUERY_INFO_KEY    = 0x10
       REG_QUERY_VALUE       = 0x11
+      REG_SAVE_KEY          = 0x14
       OPEN_HKCC             = 0x1b
       OPEN_HKPT             = 0x20
       OPEN_HKPN             = 0x21
@@ -37,6 +39,10 @@ module RubySMB
       require 'ruby_smb/dcerpc/winreg/query_info_key_response'
       require 'ruby_smb/dcerpc/winreg/query_value_request'
       require 'ruby_smb/dcerpc/winreg/query_value_response'
+      require 'ruby_smb/dcerpc/winreg/create_key_request'
+      require 'ruby_smb/dcerpc/winreg/create_key_response'
+      require 'ruby_smb/dcerpc/winreg/save_key_request'
+      require 'ruby_smb/dcerpc/winreg/save_key_response'
 
       ROOT_KEY_MAP = {
         "HKEY_CLASSES_ROOT"         => OPEN_HKCR,
@@ -57,6 +63,8 @@ module RubySMB
         "HKPN"                      => OPEN_HKPN
       }
 
+      BUFFER_SIZE = 1024
+
       # Open the registry root key and return a handle for it. The key can be
       # either a long format (e.g. HKEY_LOCAL_MACHINE) or a short format
       # (e.g. HKLM)
@@ -125,7 +133,9 @@ module RubySMB
       # @raise [RubySMB::Dcerpc::Error::WinregError] if the response error status is not ERROR_SUCCESS
       def query_value(handle, value_name)
         query_value_request_packet = RubySMB::Dcerpc::Winreg::QueryValueRequest.new(hkey: handle, lp_value_name: value_name)
-        query_value_request_packet.lp_data.referent_identifier = 0
+        query_value_request_packet.lp_type = 0
+        query_value_request_packet.lpcb_data = 0
+        query_value_request_packet.lpcb_len = 0
         response = dcerpc_request(query_value_request_packet)
         begin
           query_value_response = RubySMB::Dcerpc::Winreg::QueryValueResponse.read(response)
@@ -137,9 +147,9 @@ module RubySMB
             "#{WindowsError::Win32.find_by_retval(query_value_response.error_status.value).join(',')}"
         end
 
-        query_value_request_packet = RubySMB::Dcerpc::Winreg::QueryValueRequest.new(hkey: handle, lp_value_name: value_name)
         query_value_request_packet.lpcb_data = query_value_response.lpcb_data
-        query_value_request_packet.lp_data.max_count = query_value_response.lpcb_data.referent
+        query_value_request_packet.lp_data = []
+        query_value_request_packet.lp_data.max_count = query_value_response.lpcb_data.to_i
         response = dcerpc_request(query_value_request_packet)
         begin
           query_value_response = RubySMB::Dcerpc::Winreg::QueryValueResponse.read(response)
@@ -185,6 +195,7 @@ module RubySMB
       # @raise [RubySMB::Dcerpc::Error::WinregError] if the response error status is not ERROR_SUCCESS
       def query_info_key(handle)
         query_info_key_request_packet = RubySMB::Dcerpc::Winreg::QueryInfoKeyRequest.new(hkey: handle)
+        query_info_key_request_packet.lp_class.set_max_buffer_size(BUFFER_SIZE)
         response = dcerpc_request(query_info_key_request_packet)
         begin
           query_info_key_response = RubySMB::Dcerpc::Winreg::QueryInfoKeyResponse.read(response)
@@ -208,9 +219,9 @@ module RubySMB
       # @raise [RubySMB::Dcerpc::Error::WinregError] if the response error status is not ERROR_SUCCESS
       def enum_key(handle, index)
         enum_key_request_packet = RubySMB::Dcerpc::Winreg::EnumKeyRequest.new(hkey: handle, dw_index: index)
-        enum_key_request_packet.lpft_last_write_time = 0
-        enum_key_request_packet.lp_class.referent.buffer = 0
-        enum_key_request_packet.lp_name.buffer.referent.max_count = 256
+        # `lp_class` cannot be null, even if it contains no value
+        enum_key_request_packet.lp_class.instantiate_referent
+        enum_key_request_packet.lp_name.set_max_buffer_size(BUFFER_SIZE)
         response = dcerpc_request(enum_key_request_packet)
         begin
           enum_key_response = RubySMB::Dcerpc::Winreg::EnumKeyResponse.read(response)
@@ -222,7 +233,7 @@ module RubySMB
             "#{WindowsError::Win32.find_by_retval(enum_key_response.error_status.value).join(',')}"
         end
 
-        enum_key_response.lp_name.to_s
+        enum_key_response.lp_name[:buffer]
       end
 
       # Enumerate the value at the specified index for the specified registry key.
@@ -234,8 +245,7 @@ module RubySMB
       # @raise [RubySMB::Dcerpc::Error::WinregError] if the response error status is not ERROR_SUCCESS
       def enum_value(handle, index)
         enum_value_request_packet = RubySMB::Dcerpc::Winreg::EnumValueRequest.new(hkey: handle, dw_index: index)
-        enum_value_request_packet.lp_data.referent_identifier = 0
-        enum_value_request_packet.lp_value_name.buffer.referent.max_count = 256
+        enum_value_request_packet.lp_value_name.set_max_buffer_size(BUFFER_SIZE)
         response = dcerpc_request(enum_value_request_packet)
         begin
           enum_value_response = RubySMB::Dcerpc::Winreg::EnumValueResponse.read(response)
@@ -247,7 +257,66 @@ module RubySMB
             "#{WindowsError::Win32.find_by_retval(enum_value_response.error_status.value).join(',')}"
         end
 
-        enum_value_response.lp_value_name.to_s
+        enum_value_response.lp_value_name[:buffer]
+      end
+
+      # Creates the specified registry key and returns a handle to the newly created key
+      #
+      # @param handle [Ndr::NdrContextHandle] the handle for the key
+      # @param sub_key [String] the name of the key
+      # @param opts [Hash] options for the CreateKeyRequest
+      # @return [RubySMB::Dcerpc::Winreg::PrpcHkey] the handle to the opened or created key
+      # @raise [RubySMB::Dcerpc::Error::InvalidPacket] if the response is not a CreateKeyResponse packet
+      # @raise [RubySMB::Dcerpc::Error::WinregError] if the response error status is not ERROR_SUCCESS
+      def create_key(handle, sub_key, opts = {})
+        opts = {
+          hkey:                   handle,
+          lp_sub_key:             sub_key,
+          lp_class:               opts[:lp_class] || :null,
+          dw_options:             opts[:dw_options] || RubySMB::Dcerpc::Winreg::CreateKeyRequest::REG_KEY_TYPE_VOLATILE,
+          sam_desired:            opts[:sam_desired] || RubySMB::Dcerpc::Winreg::Regsam.new(maximum: 1),
+          lp_security_attributes: opts[:lp_security_attributes] || RubySMB::Dcerpc::RpcSecurityAttributes.new,
+          lpdw_disposition:       opts[:lpdw_disposition] || RubySMB::Dcerpc::Winreg::CreateKeyRequest::REG_CREATED_NEW_KEY,
+        }
+        create_key_request_packet = RubySMB::Dcerpc::Winreg::CreateKeyRequest.new(opts)
+        response = dcerpc_request(create_key_request_packet)
+        begin
+          create_key_response = RubySMB::Dcerpc::Winreg::CreateKeyResponse.read(response)
+        rescue IOError
+          raise RubySMB::Dcerpc::Error::InvalidPacket, "Error reading the CreateKey response"
+        end
+        unless create_key_response.error_status == WindowsError::Win32::ERROR_SUCCESS
+          raise RubySMB::Dcerpc::Error::WinregError, "Error returned when creating key #{sub_key}: "\
+            "#{WindowsError::Win32.find_by_retval(create_key_response.error_status.value).join(',')}"
+        end
+
+        create_key_response.hkey
+      end
+
+      # Saves the specified key, subkeys, and values to a new file
+      #
+      # @param handle [Ndr::NdrContextHandle] the handle for the key
+      # @param file_name [String] the name of the registry file in which the specified key and subkeys are to be saved
+      # @param opts [Hash] options for the SaveKeyRequest
+      # @raise [RubySMB::Dcerpc::Error::InvalidPacket] if the response is not a SaveKeyResponse packet
+      # @raise [RubySMB::Dcerpc::Error::WinregError] if the response error status is not ERROR_SUCCESS
+      def save_key(handle, file_name, opts = {})
+        opts = {
+          hkey:                   handle,
+          lp_file:                file_name,
+          lp_security_attributes: opts[:lp_security_attributes] || :null,
+        }
+        save_key_request_packet = RubySMB::Dcerpc::Winreg::SaveKeyRequest.new(opts)
+        response = dcerpc_request(save_key_request_packet)
+        begin
+          save_key_response = RubySMB::Dcerpc::Winreg::SaveKeyResponse.read(response)
+        rescue IOError
+          raise RubySMB::Dcerpc::Error::InvalidPacket, "Error reading the SaveKeyResponse response"
+        end
+        unless save_key_response.error_status == WindowsError::Win32::ERROR_SUCCESS
+          raise RubySMB::Dcerpc::Error::WinregError, "Error returned when saving key to #{file_name}: "\
+            "#{WindowsError::Win32.find_by_retval(save_key_response.error_status.value).join(',')}"
+        end
       end
 
       # Checks if the specified registry key exists. It returns true if it
@@ -255,8 +324,8 @@ module RubySMB
       #
       # @param key [String] the registry key to check
       # @return [Boolean]
-      def has_registry_key?(key)
-        bind(endpoint: RubySMB::Dcerpc::Winreg)
+      def has_registry_key?(key, bind: true)
+        bind(endpoint: RubySMB::Dcerpc::Winreg) if bind
 
         root_key, sub_key = key.gsub(/\//, '\\').split('\\', 2)
         begin
@@ -265,8 +334,10 @@ module RubySMB
         rescue RubySMB::Dcerpc::Error::WinregError
           return false
         end
-        close_key(subkey_handle)
         return true
+      ensure
+        close_key(subkey_handle) if subkey_handle
+        close_key(root_key_handle) if root_key_handle
       end
 
       # Retrieve the data associated with the named value of a specified
@@ -275,15 +346,17 @@ module RubySMB
       # @param key [String] the registry key
       # @param value_name [String] the name of the value to read
       # @return [String] the data of the value entry
-      def read_registry_key_value(key, value_name)
-        bind(endpoint: RubySMB::Dcerpc::Winreg)
+      def read_registry_key_value(key, value_name, bind: true)
+        bind(endpoint: RubySMB::Dcerpc::Winreg) if bind
 
         root_key, sub_key = key.gsub(/\//, '\\').split('\\', 2)
         root_key_handle = open_root_key(root_key)
         subkey_handle = open_key(root_key_handle, sub_key)
         value = query_value(subkey_handle, value_name)
-        close_key(subkey_handle)
         value
+      ensure
+        close_key(subkey_handle) if subkey_handle
+        close_key(root_key_handle) if root_key_handle
       end
 
       # Enumerate the subkeys of a specified registry key. If only a root key
@@ -291,8 +364,8 @@ module RubySMB
       #
       # @param key [String] the registry key
       # @return [Array<String>] the subkeys
-      def enum_registry_key(key)
-        bind(endpoint: RubySMB::Dcerpc::Winreg)
+      def enum_registry_key(key, bind: true)
+        bind(endpoint: RubySMB::Dcerpc::Winreg) if bind
 
         root_key, sub_key = key.gsub(/\//, '\\').split('\\', 2)
         root_key_handle = open_root_key(root_key)
@@ -307,16 +380,18 @@ module RubySMB
         key_count.times do |i|
           enum_result << enum_key(subkey_handle, i)
         end
-        close_key(subkey_handle)
         enum_result
+      ensure
+        close_key(subkey_handle) if subkey_handle
+        close_key(root_key_handle) if root_key_handle && root_key_handle != subkey_handle
       end
 
       # Enumerate the values for the specified registry key.
       #
       # @param key [String] the registry key
       # @return [Array<String>] the values
-      def enum_registry_values(key)
-        bind(endpoint: RubySMB::Dcerpc::Winreg)
+      def enum_registry_values(key, bind: true)
+        bind(endpoint: RubySMB::Dcerpc::Winreg) if bind
 
         root_key, sub_key = key.gsub(/\//, '\\').split('\\', 2)
         root_key_handle = open_root_key(root_key)
@@ -331,8 +406,10 @@ module RubySMB
         value_count.times do |i|
           enum_result << enum_value(subkey_handle, i)
         end
-        close_key(subkey_handle)
         enum_result
+      ensure
+        close_key(subkey_handle) if subkey_handle
+        close_key(root_key_handle) if root_key_handle && root_key_handle != subkey_handle
       end
 
     end

data/lib/ruby_smb/dcerpc/wkssvc/netr_wksta_get_info_request.rb

@@ -0,0 +1,26 @@
+module RubySMB
+  module Dcerpc
+    module Wkssvc
+
+      # [2.2.2.1 WKSSVC_IDENTIFY_HANDLE](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/9ef94a11-0e5c-49d7-9ac7-68d6f03565de)
+      class WkssvcIdentifyHandle < Ndr::NdrWideStringPtr; end
+
+      # [3.2.4.1 NetrWkstaGetInfo (Opnum 0)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/4af41d6f-b800-4de1-af5b-0b15a85f8e04)
+      class NetrWkstaGetInfoRequest < BinData::Record
+        attr_reader :opnum
+
+        endian :little
+
+        wkssvc_identify_handle :server_name
+        ndr_uint32             :level
+
+        def initialize_instance
+          super
+          @opnum = NETR_WKSTA_GET_INFO
+        end
+      end
+
+    end
+  end
+end
+