ruby_smb 3.0.4 → 3.1.0

data/lib/ruby_smb/smb1/commands.rb

@@ -12,6 +12,7 @@ module RubySMB
       SMB_COM_NEGOTIATE               = 0x72
       SMB_COM_SESSION_SETUP_ANDX      = 0x73
       SMB_COM_LOGOFF                  = 0x74
+      SMB_COM_LOGOFF_ANDX             = 0x74
       SMB_COM_TREE_CONNECT            = 0x75
       SMB_COM_NT_TRANSACT             = 0xA0
       SMB_COM_NT_TRANSACT_SECONDARY   = 0xA1

data/lib/ruby_smb/smb1/packet/nt_create_andx_request.rb

@@ -47,7 +47,17 @@ module RubySMB
 
         # Represents the specific layout of the DataBlock for a {NtCreateAndxRequest} Packet.
         class DataBlock < RubySMB::SMB1::DataBlock
-          string :file_name, label: 'File Name'
+          uint8  :pad,  label: 'Pad',  onlyif: :has_padding?
+          choice :file_name, selection: -> { parent.smb_header.flags2.unicode } do
+            stringz   0
+            stringz16 1
+          end
+
+          # This method checks if the optional pad field is present.
+          def has_padding?
+            parent.smb_header.flags2.unicode == 1 && pad.abs_offset % 2 == 1
+          end
+          private :has_padding?
         end
 
         smb_header        :smb_header

data/lib/ruby_smb/smb1/packet/nt_trans/create_request.rb

@@ -57,7 +57,7 @@ module RubySMB
             end
           end
 
-          # The Trans2 Data Blcok for this particular Subcommand
+          # The Trans2 Data Block for this particular Subcommand
           class Trans2Data < BinData::Record
             security_descriptor :security_descriptor
             file_full_ea_info   :extended_attributes

data/lib/ruby_smb/smb1/packet/read_andx_response.rb

@@ -22,13 +22,14 @@ module RubySMB
 
         # Represents the specific layout of the DataBlock for a {ReadAndxResponse} Packet.
         class DataBlock < RubySMB::SMB1::DataBlock
-          uint8  :pad,  label: 'Pad',  onlyif: -> { has_padding? }
+          uint8  :pad,  label: 'Pad',  onlyif: :has_padding?
           string :data, label: 'Data', read_length: -> { parent.parameter_block.data_length }
 
-          # This method checks if the optional pad field is present in the response.
+          # This method checks if the optional pad field is present.
           def has_padding?
-            return false if byte_count.zero?
-            return true if byte_count - parent.parameter_block.data_length == 1
+            bc = byte_count.clear? ? 0 : byte_count  # work around infinite recursion
+            return false if bc == 0
+            return true if bc - parent.parameter_block.data_length == 1
             false
           end
           private :has_padding?

data/lib/ruby_smb/smb1/packet/session_setup_request.rb

@@ -23,9 +23,17 @@ module RubySMB
         # for the security blob, you must null-terminate the {native_os} and {native_lan_man} fields
         # yourself if you set them away from their defaults.
         class DataBlock < RubySMB::SMB1::DataBlock
-          string      :security_blob,  label: 'Security Blob (GSS-API)', length: -> { parent.parameter_block.security_blob_length }
-          string      :native_os,      label: 'Native OS',             initial_value: "Windows 7 Ultimate N 7601 Service Pack 1\x00"
-          string      :native_lan_man, label: 'Native LAN Manager',    initial_value: "Windows 7 Ultimate N 6.1\x00"
+          string      :security_blob,  label: 'Security Blob (GSS-API)', read_length: -> { parent.parameter_block.security_blob_length }
+          uint8       :pad1,           label: 'Pad 1', onlyif: -> { parent.smb_header.flags2.unicode == 1 && pad1.abs_offset % 2 == 1 }
+          choice      :native_os,      label: 'Native OS', selection: -> { parent.smb_header.flags2.unicode } do
+            stringz   0, initial_value: 'Windows 7 Ultimate N 7601 Service Pack 1'
+            stringz16 1, initial_value: 'Windows 7 Ultimate N 7601 Service Pack 1'.encode('utf-16le')
+          end
+          uint8       :pad2,           label: 'Pad 2', onlyif: -> { parent.smb_header.flags2.unicode == 1 && pad2.abs_offset % 2 == 1 }
+          choice      :native_lan_man, label: 'Native LAN Manager', selection: -> { parent.smb_header.flags2.unicode } do
+            stringz   0, initial_value: 'Windows 7 Ultimate N 6.1'
+            stringz16 1, initial_value: 'Windows 7 Ultimate N 6.1'.encode('utf-16le')
+          end
         end
 
         smb_header        :smb_header
@@ -34,7 +42,7 @@ module RubySMB
 
         # Takes an NTLM Type 1 Message and creates the GSS Security Blob
         # for it and sets it in the {RubySMB::SMB1::Packet::SessionSetupRequest::DataBlock#security_blob}
-        # field. It also automaticaly sets the length in
+        # field. It also automatically sets the length in
         # {RubySMB::SMB1::Packet::SessionSetupRequest::ParameterBlock#security_blob_length}
         #
         # @param type1_message [String] the serialized Type 1 NTLM message

data/lib/ruby_smb/smb1/packet/trans2/data_block.rb

@@ -35,13 +35,21 @@ module RubySMB
           # Determines the correct length for the padding in front of
           # #trans2_data. It should always force a 4-byte alignment.
           def pad2_length
-            if enable_padding
+            if enable_padding && (trans2_data.num_bytes > 0 || (!byte_count.clear? && offset_of(pad2) - byte_count.num_bytes < byte_count))
               offset = (trans2_parameters.abs_offset + trans2_parameters.length) % 4
               (4 - offset) % 4
             else
               0
             end
           end
+
+          # Some structures use an opaque buffer in trans2_data. Calculate its
+          # size here.
+          def buffer_read_length
+            return 0 if byte_count.clear?
+
+            byte_count + byte_count.num_bytes - offset_of(trans2_data)
+          end
         end
       end
     end

data/lib/ruby_smb/smb1/packet/trans2/find_first2_request.rb

@@ -2,70 +2,71 @@ module RubySMB
   module SMB1
     module Packet
       module Trans2
-        # A Trans2 FIND_FIRST2 Request Packet as defined in
-        # [2.2.6.2.1](https://msdn.microsoft.com/en-us/library/ee441987.aspx)
-        class FindFirst2Request < RubySMB::GenericPacket
-          COMMAND = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
-
-          class ParameterBlock < RubySMB::SMB1::Packet::Trans2::Request::ParameterBlock
-          end
+        # The Trans2 Parameter Block for this particular Subcommand
+        class FindFirst2RequestTrans2Parameters < BinData::Record
+          endian :little
 
-          # The Trans2 Parameter Block for this particular Subcommand
-          class Trans2Parameters < BinData::Record
-            endian :little
-            smb_file_attributes :search_attributes, label: 'File Attributes'
-            uint16              :search_count,      label: 'Search Count'
+          smb_file_attributes :search_attributes, label: 'File Attributes'
+          uint16              :search_count,      label: 'Search Count'
 
-            struct :flags do
-              bit3  :reserved,    label: 'Reserved Space'
-              bit1  :backup,      label: 'With Backup Intent'
-              bit1  :continue,    label: 'Continue From Last'
-              bit1  :resume_keys, label: 'Return Resume Keys'
-              bit1  :close_eos,   label: 'Close at End of Search'
-              bit1  :close,       label: 'Close Search After This Request'
+          struct  :flags do
+            bit3  :reserved,    label: 'Reserved Space'
+            bit1  :backup,      label: 'With Backup Intent'
+            bit1  :continue,    label: 'Continue From Last'
+            bit1  :resume_keys, label: 'Return Resume Keys'
+            bit1  :close_eos,   label: 'Close at End of Search'
+            bit1  :close,       label: 'Close Search After This Request'
 
-              bit8  :reserved2,   label: 'Reserved Space'
-            end
+            bit8  :reserved2,   label: 'Reserved Space'
+          end
 
-            uint16    :information_level, label: 'Information Level'
-            uint32    :storage_type,      label: 'Search Storage type'
+          uint16    :information_level, label: 'Information Level'
+          uint32    :storage_type,      label: 'Search Storage type'
 
-            choice :filename, :copy_on_change => true, selection: -> { self.smb_header.flags2.unicode } do
-              stringz16 1, label: 'FileName'
-              stringz   0, label: 'FileName'
-            end
+          choice :filename, :copy_on_change => true, selection: -> { self.smb_header.flags2.unicode } do
+            stringz16 1, label: 'FileName'
+            stringz   0, label: 'FileName'
+          end
 
-            # Returns the length of the Trans2Parameters struct
-            # in number of bytes
-            def length
-              do_num_bytes
-            end
+          # Returns the length of the Trans2Parameters struct
+          # in number of bytes
+          def length
+            do_num_bytes
           end
+        end
 
-          # The Trans2 Data Blcok for this particular Subcommand
-          class Trans2Data < BinData::Record
-            smb_gea_list :extended_attribute_list, label: 'Get Extended Attribute List',
-              onlyif: -> { parent.trans2_parameters.information_level == FindInformationLevel::SMB_INFO_QUERY_EAS_FROM_LIST}
+        # The Trans2 Data Block for this particular Subcommand
+        class FindFirst2RequestTrans2Data < BinData::Record
+          smb_gea_list :extended_attribute_list, label: 'Get Extended Attribute List',
+            onlyif: -> { parent.trans2_parameters.information_level == FindInformationLevel::SMB_INFO_QUERY_EAS_FROM_LIST}
 
-            # Returns the length of the Trans2Data struct
-            # in number of bytes
-            def length
-              do_num_bytes
-            end
+          # Returns the length of the Trans2Data struct
+          # in number of bytes
+          def length
+            do_num_bytes
           end
+        end
+
+        # The {RubySMB::SMB1::DataBlock} specific to this packet type.
+        class FindFirst2RequestDataBlock < RubySMB::SMB1::Packet::Trans2::DataBlock
+          uint8                                  :name,               label: 'Name', initial_value: 0x00
+          string                                 :pad1,               length: -> { pad1_length }
+          find_first2_request_trans2_parameters  :trans2_parameters,  label: 'Trans2 Parameters'
+          string                                 :pad2,               length: -> { pad2_length }
+          find_first2_request_trans2_data        :trans2_data,        label: 'Trans2 Data'
+        end
 
-          # The {RubySMB::SMB1::DataBlock} specific to this packet type.
-          class DataBlock < RubySMB::SMB1::Packet::Trans2::DataBlock
-            uint8              :name,               label: 'Name', initial_value: 0x00
-            string             :pad1,               length: -> { pad1_length }
-            trans2_parameters  :trans2_parameters,  label: 'Trans2 Parameters'
-            string             :pad2,               length: -> { pad2_length }
-            trans2_data        :trans2_data,        label: 'Trans2 Data'
+        # A Trans2 FIND_FIRST2 Request Packet as defined in
+        # [2.2.6.2.1](https://msdn.microsoft.com/en-us/library/ee441987.aspx)
+        class FindFirst2Request < RubySMB::GenericPacket
+          COMMAND = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
+
+          class ParameterBlock < RubySMB::SMB1::Packet::Trans2::Request::ParameterBlock
           end
 
-          smb_header        :smb_header
-          parameter_block   :parameter_block
-          data_block        :data_block
+          smb_header                      :smb_header
+          parameter_block                 :parameter_block
+          find_first2_request_data_block  :data_block
 
           def initialize_instance
             super

data/lib/ruby_smb/smb1/packet/trans2/find_first2_response.rb

@@ -2,53 +2,53 @@ module RubySMB
   module SMB1
     module Packet
       module Trans2
-        # This class represents an SMB1 Trans2 FIND_FIRST2 Response Packet as defined in
-        # [2.2.6.2.2 Response](https://msdn.microsoft.com/en-us/library/ee441704.aspx)
-        class FindFirst2Response < RubySMB::GenericPacket
-          COMMAND = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
+        # The Trans2 Parameter Block for this particular Subcommand
+        class FindFirst2ResponseTrans2Parameters < BinData::Record
+          endian  :little
 
-          class ParameterBlock < RubySMB::SMB1::Packet::Trans2::Response::ParameterBlock
-          end
+          uint16  :sid,               label: 'Search ID'
+          uint16  :search_count,      label: 'Search Count'
+          uint16  :eos,               label: 'End of Search'
+          uint16  :ea_error_offset,   label: 'Offset to EA Error'
+          uint16  :last_name_offset,  label: 'Last Name Offset'
 
-          # The Trans2 Parameter Block for this particular Subcommand
-          class Trans2Parameters < BinData::Record
-            endian  :little
+          # Returns the length of the Trans2Parameters struct
+          # in number of bytes
+          def length
+            do_num_bytes
+          end
+        end
 
-            uint16  :sid,               label: 'Search ID'
-            uint16  :search_count,      label: 'Search Count'
-            uint16  :eos,               label: 'End of Search'
-            uint16  :ea_error_offset,   label: 'Offset to EA Error'
-            uint16  :last_name_offset,  label: 'Last Name Offset'
+        # The Trans2 Data Block for this particular Subcommand
+        class FindFirst2ResponseTrans2Data < BinData::Record
+          string :buffer, label: 'Results Buffer', read_length: :buffer_read_length
 
-            # Returns the length of the Trans2Parameters struct
-            # in number of bytes
-            def length
-              do_num_bytes
-            end
+          # Returns the length of the Trans2Data struct
+          # in number of bytes
+          def length
+            do_num_bytes
           end
+        end
 
-          # The Trans2 Data Blcok for this particular Subcommand
-          class Trans2Data < BinData::Record
-            rest :buffer, label: 'Results Buffer'
+        # The {RubySMB::SMB1::DataBlock} specific to this packet type.
+        class FindFirst2ResponseDataBlock < RubySMB::SMB1::Packet::Trans2::DataBlock
+          string                                  :pad1,               length: -> { pad1_length }
+          find_first2_response_trans2_parameters  :trans2_parameters,  label: 'Trans2 Parameters'
+          string                                  :pad2,               length: -> { pad2_length }
+          find_first2_response_trans2_data        :trans2_data,        label: 'Trans2 Data', length: 0
+        end
 
-            # Returns the length of the Trans2Data struct
-            # in number of bytes
-            def length
-              do_num_bytes
-            end
-          end
+        # This class represents an SMB1 Trans2 FIND_FIRST2 Response Packet as defined in
+        # [2.2.6.2.2 Response](https://msdn.microsoft.com/en-us/library/ee441704.aspx)
+        class FindFirst2Response < RubySMB::GenericPacket
+          COMMAND = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
 
-          # The {RubySMB::SMB1::DataBlock} specific to this packet type.
-          class DataBlock < RubySMB::SMB1::Packet::Trans2::DataBlock
-            string             :pad1,               length: -> { pad1_length }
-            trans2_parameters  :trans2_parameters,  label: 'Trans2 Parameters'
-            string             :pad2,               length: -> { pad2_length }
-            trans2_data        :trans2_data,        label: 'Trans2 Data', length: 0
+          class ParameterBlock < RubySMB::SMB1::Packet::Trans2::Response::ParameterBlock
           end
 
-          smb_header        :smb_header
-          parameter_block   :parameter_block
-          data_block        :data_block
+          smb_header                       :smb_header
+          parameter_block                  :parameter_block
+          find_first2_response_data_block  :data_block
 
           def initialize_instance
             super

data/lib/ruby_smb/smb1/packet/trans2/find_information_level/find_file_both_directory_info.rb

@@ -0,0 +1,48 @@
+module RubySMB
+  module SMB1
+    module Packet
+      module Trans2
+        module FindInformationLevel
+          # The SMB_FIND_FILE_BOTH_DIRECTORY_INFO class as defined in
+          # [2.2.8.1.7 SMB_FIND_FILE_BOTH_DIRECTORY_INFO](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-cifs/2aa849f4-1bc0-42bf-9c8f-d09f11fccc4c)
+          class FindFileBothDirectoryInfo < BinData::Record
+            CLASS_LEVEL = FindInformationLevel::SMB_FIND_FILE_BOTH_DIRECTORY_INFO
+
+            endian :little
+
+            uint32                  :next_offset,         label: 'Next Entry Offset'
+            uint32                  :file_index,          label: 'File Index'
+            file_time               :create_time,         label: 'Create Time'
+            file_time               :last_access,         label: 'Last Accessed Time'
+            file_time               :last_write,          label: 'Last Write Time'
+            file_time               :last_change,         label: 'Last Attribute Change Time'
+            uint64                  :end_of_file,         label: 'End of File'
+            uint64                  :allocation_size,     label: 'Allocated Size'
+            smb_ext_file_attributes :ext_file_attributes, label: 'Extended File Attributes'
+            uint32                  :file_name_length,    label: 'File Name Length', initial_value: -> { file_name.do_num_bytes }
+            uint32                  :ea_size,             label: 'Extended Attributes Size'
+            uint8                   :short_name_length,   label: 'Short Name Length'
+            uint8                   :reserved,            label: 'Reserved'
+            string16                :short_name,          label: 'Short Name', length: 24 # always 12 wchars / 24 bytes
+
+            choice :file_name, :copy_on_change => true, selection: -> { unicode } do
+              string16 true,  label: 'File Name', read_length: -> { file_name_length }
+              stringz  false, label: 'File Name', read_length: -> { file_name_length }
+            end
+
+            # Set unicode encoding for filename
+            # @!attribute [rw] unicode
+            #   @return [Boolean]
+            attr_accessor :unicode
+
+            def initialize_instance
+              super
+              @unicode = false
+            end
+
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ruby_smb/smb1/packet/trans2/find_information_level.rb

@@ -7,24 +7,37 @@ module RubySMB
         # of information that a server MUST respond with for each file matching the
         # request's search criteria.
         module FindInformationLevel
-          # Return creation, access, and last write timestamps, size and file attributes along with the file name.
-          SMB_INFO_STANDARD                 = 0x0001
-          # Return the SMB_INFO_STANDARD data along with the size of a file's extended attributes (EAs).
-          SMB_INFO_QUERY_EA_SIZE            = 0x0002
-          # Return the SMB_INFO_QUERY_EA_SIZE data along with a specific list of a file's EAs. The requested EAs are provided in the Trans2_Data block of the request.
-          SMB_INFO_QUERY_EAS_FROM_LIST      = 0x0003
-          # Return 64-bit format versions of: creation, access, last write, and last attribute change timestamps; size. In addition, return extended file attributes and file name.
-          SMB_FIND_FILE_DIRECTORY_INFO      = 0x0101
-          # Returns the SMB_FIND_FILE_DIRECTORY_INFO data along with the size of a file's EAs.
-          SMB_FIND_FILE_FULL_DIRECTORY_INFO = 0x0102
-          # Returns the name(s) of the file(s).
-          SMB_FIND_FILE_NAMES_INFO          = 0x0103
-          # Returns a combination of the data from SMB_FIND_FILE_FULL_DIRECTORY_INFO and SMB_FIND_FILE_NAMES_INFO.
-          SMB_FIND_FILE_BOTH_DIRECTORY_INFO = 0x0104
+          # Constants defined in
+          # [2.2.2.3.1 FIND Information Level Codes](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-cifs/f5dcd594-1c46-4bc6-963f-581a4c78ea99)
+          # [dialect] description
 
+          # [LANMAN2.0] Return creation, access, and last write timestamps, size and file attributes along with the file name.
+          SMB_INFO_STANDARD                 = 0x0001 # 1
 
-          require 'ruby_smb/smb1/packet/trans2/find_information_level/find_file_full_directory_info'
+          # [LANMAN2.0] Return the SMB_INFO_STANDARD data along with the size of a file's extended attributes (EAs).
+          SMB_INFO_QUERY_EA_SIZE            = 0x0002 # 2
+
+          # [LANMAN2.0] Return the SMB_INFO_QUERY_EA_SIZE data along with a specific list of a file's EAs. The requested EAs are provided in the Trans2_Data block of the request.
+          SMB_INFO_QUERY_EAS_FROM_LIST      = 0x0003 # 3
+
+          # [NT LANMAN] Return 64-bit format versions of: creation, access, last write, and last attribute change timestamps; size. In addition, return extended file attributes and file name.
+          SMB_FIND_FILE_DIRECTORY_INFO      = 0x0101 # 257
+
+          # [NT LANMAN] Returns the SMB_FIND_FILE_DIRECTORY_INFO data along with the size of a file's EAs.
+          SMB_FIND_FILE_FULL_DIRECTORY_INFO = 0x0102 # 258
 
+          # [NT LANMAN] Returns the name(s) of the file(s).
+          SMB_FIND_FILE_NAMES_INFO          = 0x0103 # 259
+
+          # [NT LANMAN] Returns a combination of the data from SMB_FIND_FILE_FULL_DIRECTORY_INFO and SMB_FIND_FILE_NAMES_INFO.
+          SMB_FIND_FILE_BOTH_DIRECTORY_INFO = 0x0104 # 260
+
+          def self.name(value)
+            constants.select { |c| c.upcase == c }.find { |c| const_get(c) == value }
+          end
+
+          require 'ruby_smb/smb1/packet/trans2/find_information_level/find_file_both_directory_info'
+          require 'ruby_smb/smb1/packet/trans2/find_information_level/find_file_full_directory_info'
         end
       end
     end

data/lib/ruby_smb/smb1/packet/trans2/find_next2_request.rb

@@ -2,70 +2,70 @@ module RubySMB
   module SMB1
     module Packet
       module Trans2
-        # A Trans2 FIND_NEXT2 Request Packet as defined in
-        # [2.2.6.3.1 Request](https://msdn.microsoft.com/en-us/library/ee441844.aspx)
-        class FindNext2Request < RubySMB::GenericPacket
-          COMMAND = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
+        # The Trans2 Parameter Block for this particular Subcommand
+        class FindNext2RequestTrans2Parameters < BinData::Record
+          endian  :little
 
-          class ParameterBlock < RubySMB::SMB1::Packet::Trans2::Request::ParameterBlock
-          end
+          uint16  :sid,               label: 'Search ID'
+          uint16  :search_count,      label: 'Search Count'
+          uint16  :information_level, label: 'Information Level'
+          uint32  :resume_key,        label: 'Resume Key'
 
-          # The Trans2 Parameter Block for this particular Subcommand
-          class Trans2Parameters < BinData::Record
-            endian  :little
+          struct :flags do
+            bit3  :reserved,    label: 'Reserved Space'
+            bit1  :backup,      label: 'With Backup Intent'
+            bit1  :continue,    label: 'Continue From Last'
+            bit1  :resume_keys, label: 'Return Resume Keys'
+            bit1  :close_eos,   label: 'Close at End of Search'
+            bit1  :close,       label: 'Close Search After This Request'
 
-            uint16  :sid,               label: 'Search ID'
-            uint16  :search_count,      label: 'Search Count'
-            uint16  :information_level, label: 'Information Level'
-            uint32  :resume_key,        label: 'Resume Key'
+            bit8  :reserved2,   label: 'Reserved Space'
+          end
 
-            struct :flags do
-              bit3  :reserved,    label: 'Reserved Space'
-              bit1  :backup,      label: 'With Backup Intent'
-              bit1  :continue,    label: 'Continue From Last'
-              bit1  :resume_keys, label: 'Return Resume Keys'
-              bit1  :close_eos,   label: 'Close at End of Search'
-              bit1  :close,       label: 'Close Search After This Request'
+          choice :filename, :copy_on_change => true, selection: -> { @obj.parent.parent.parent.smb_header.flags2.unicode } do
+            stringz16 1, label: 'FileName'
+            stringz   0, label: 'FileName'
+          end
 
-              bit8  :reserved2,   label: 'Reserved Space'
-            end
+          # Returns the length of the Trans2Parameters struct
+          # in number of bytes
+          def length
+            do_num_bytes
+          end
+        end
 
-            choice :filename, :copy_on_change => true, selection: -> { @obj.parent.parent.parent.smb_header.flags2.unicode } do
-              stringz16 1, label: 'FileName'
-              stringz   0, label: 'FileName'
-            end
+        # The Trans2 Data Block for this particular Subcommand
+        class FindNext2RequestTrans2Data < BinData::Record
+          smb_gea_list :extended_attribute_list, label: 'Get Extended Attribute List',
+            onlyif: -> { parent.trans2_parameters.information_level == FindInformationLevel::SMB_INFO_QUERY_EAS_FROM_LIST}
 
-            # Returns the length of the Trans2Parameters struct
-            # in number of bytes
-            def length
-              do_num_bytes
-            end
+          # Returns the length of the Trans2Data struct
+          # in number of bytes
+          def length
+            do_num_bytes
           end
+        end
 
-          # The Trans2 Data Blcok for this particular Subcommand
-          class Trans2Data < BinData::Record
-            smb_gea_list :extended_attribute_list, label: 'Get Extended Attribute List',
-              onlyif: -> { parent.trans2_parameters.information_level == FindInformationLevel::SMB_INFO_QUERY_EAS_FROM_LIST}
+        # The {RubySMB::SMB1::DataBlock} specific to this packet type.
+        class FindNext2RequestDataBlock < RubySMB::SMB1::Packet::Trans2::DataBlock
+          uint8                                 :name,               label: 'Name', initial_value: 0x00
+          string                                :pad1,               length: -> { pad1_length }
+          find_next2_request_trans2_parameters  :trans2_parameters,  label: 'Trans2 Parameters'
+          string                                :pad2,               length: -> { pad2_length }
+          find_next2_request_trans2_data        :trans2_data,        label: 'Trans2 Data'
+        end
 
-            # Returns the length of the Trans2Data struct
-            # in number of bytes
-            def length
-              do_num_bytes
-            end
-          end
+        # A Trans2 FIND_NEXT2 Request Packet as defined in
+        # [2.2.6.3.1 Request](https://msdn.microsoft.com/en-us/library/ee441844.aspx)
+        class FindNext2Request < RubySMB::GenericPacket
+          COMMAND = RubySMB::SMB1::Commands::SMB_COM_TRANSACTION2
 
-          # The {RubySMB::SMB1::DataBlock} specific to this packet type.
-          class DataBlock < RubySMB::SMB1::Packet::Trans2::DataBlock
-            uint8              :name,               label: 'Name', initial_value: 0x00
-            string             :pad1,               length: -> { pad1_length }
-            trans2_parameters  :trans2_parameters,  label: 'Trans2 Parameters'
-            string             :pad2,               length: -> { pad2_length }
-            trans2_data        :trans2_data,        label: 'Trans2 Data'
+          class ParameterBlock < RubySMB::SMB1::Packet::Trans2::Request::ParameterBlock
           end
 
-          smb_header        :smb_header
-          parameter_block   :parameter_block
-          data_block        :data_block
+          smb_header                     :smb_header
+          parameter_block                :parameter_block
+          find_next2_request_data_block  :data_block
 
           def initialize_instance
             super