@netkitty/codec 1.0.0

package/dist/headers/SLP.js

@@ -0,0 +1,207 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SLP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * SLP — Service Location Protocol Version 2 (RFC 2608), UDP (and TCP) port 427. Every SLPv2 message
+ * begins with a common header: an 8-bit Version (2), an 8-bit Function-ID (1 SrvRqst, 2 SrvRply,
+ * 3 SrvReg, 4 SrvDeReg, 5 SrvAck, 6 AttrRqst, 7 AttrRply, 8 DAAdvert, 9 SrvTypeRqst, 10 SrvTypeRply,
+ * 11 SAAdvert), a 24-bit Length (the entire message octet count including this header), a 16-bit Flags
+ * field (bit 0 Overflow, bit 1 Fresh, bit 2 Request-multicast, the remaining 13 bits reserved), a 24-bit
+ * Next Extension Offset, a 16-bit XID, a 16-bit Language Tag Length and the Language Tag of that many
+ * octets — then the Function-ID-specific body.
+ *
+ * The body layout differs per Function-ID (SrvRqst's PRList/service-type/scope/predicate/SPL SPI,
+ * SrvRply's URL entries, SrvReg's URL + attributes, …) and several sub-structures carry authentication
+ * blocks and cross-message context, so this common-header codec keeps the body verbatim as `body` hex
+ * (byte-perfect) and does not sub-decode it. The Length is auto-computed on encode when not supplied,
+ * else honored verbatim (a crafted message may lie); the Language Tag Length is likewise honor-else-
+ * derive. The message is bounded by its Length (and the UDP datagram) so trailing / pipelined bytes are
+ * left to the codec's recursion / RawData. A well-formed message round-trips byte-for-byte.
+ */
+class SLP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'slp';
+        this.name = 'Service Location Protocol';
+        this.nickname = 'SLP';
+        this.matchKeys = ['udpport:427', 'tcpport:427'];
+        //A leaf header — the Function-ID-specific body requires per-type, cross-message parsing.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (SLP.#schemaCache ??= SLP.#buildSchema());
+    }
+    /** The UDP payload length bounded by the datagram, so trailing padding is not absorbed. */
+    #boundedAvailable() {
+        let available = this.packet.length - this.startPos;
+        if (this.prevCodecModule && this.prevCodecModule.id === 'udp') {
+            const udpLength = this.prevCodecModule.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < available)
+                available = udpLength - 8;
+        }
+        return available < 0 ? 0 : available;
+    }
+    /** The decoded Language Tag octet count, clamped to what is actually present after the 14-byte header. */
+    #langTagBytes() {
+        let count = this.instance.langTagLen.getValue(0);
+        if (count < 0)
+            count = 0;
+        const available = this.#boundedAvailable();
+        if (14 + count > available)
+            count = available - 14;
+        return count < 0 ? 0 : count;
+    }
+    /** A plain big-endian unsigned 24-bit field of 3 octets at `offset`. */
+    static #fieldUInt24(name, offset, label) {
+        return {
+            type: 'integer',
+            label: label,
+            minimum: 0,
+            maximum: 16777215,
+            decode: function () {
+                const b = this.readBytes(offset, 3);
+                this.instance[name].setValue((b[0] << 16) | (b[1] << 8) | b[2]);
+            },
+            encode: function () {
+                const node = this.instance[name];
+                let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                if (value > 16777215) {
+                    this.recordError(node.getPath(), 'Maximum value is 16777215');
+                    value = 16777215;
+                }
+                if (value < 0) {
+                    this.recordError(node.getPath(), 'Minimum value is 0');
+                    value = 0;
+                }
+                node.setValue(value);
+                this.writeBytes(offset, Buffer.from([(value >> 16) & 0xff, (value >> 8) & 0xff, value & 0xff]));
+            }
+        };
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'SLP func=${functionId} xid=${xid}',
+            properties: {
+                version: this.fieldUInt('version', 0, 1, 'Version'),
+                functionId: this.fieldUInt('functionId', 1, 1, 'Function-ID'),
+                length: {
+                    type: 'integer',
+                    label: 'Length',
+                    minimum: 0,
+                    maximum: 16777215,
+                    decode: function () {
+                        const b = this.readBytes(2, 3);
+                        this.instance.length.setValue((b[0] << 16) | (b[1] << 8) | b[2]);
+                    },
+                    encode: function () {
+                        //Length counts the whole message = 14-byte common header + Language Tag + body.
+                        //Honored when supplied (a crafted message may lie); else derived from the fields.
+                        const provided = this.instance.length.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : 14 + (0, HexToBuffer_1.HexToBuffer)(this.instance.langTag.getValue('')).length + (0, HexToBuffer_1.HexToBuffer)(this.instance.body.getValue('')).length;
+                        if (value > 16777215) {
+                            this.recordError(this.instance.length.getPath(), 'Maximum value is 16777215');
+                            value = 16777215;
+                        }
+                        if (value < 0)
+                            value = 0;
+                        this.instance.length.setValue(value);
+                        this.writeBytes(2, Buffer.from([(value >> 16) & 0xff, (value >> 8) & 0xff, value & 0xff]));
+                    }
+                },
+                //Flags: bit 0 Overflow, bit 1 Fresh, bit 2 Request-multicast; the remaining 13 bits are
+                //reserved. Kept as a plain uint16 so reserved bits round-trip; the bit split is UI
+                //enrichment for later.
+                flags: this.fieldUInt('flags', 5, 2, 'Flags'),
+                nextExtOffset: this.#fieldUInt24('nextExtOffset', 7, 'Next Extension Offset'),
+                xid: this.fieldUInt('xid', 10, 2, 'XID'),
+                langTagLen: {
+                    type: 'integer',
+                    label: 'Language Tag Length',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        const b = this.readBytes(12, 2);
+                        this.instance.langTagLen.setValue((b[0] << 8) | b[1]);
+                    },
+                    encode: function () {
+                        //Length of the Language Tag that follows. Honored when supplied (a crafted message
+                        //may lie); else derived from the Language Tag bytes.
+                        const provided = this.instance.langTagLen.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : (0, HexToBuffer_1.HexToBuffer)(this.instance.langTag.getValue('')).length;
+                        if (value > 65535) {
+                            this.recordError(this.instance.langTagLen.getPath(), 'Maximum value is 65535');
+                            value = 65535;
+                        }
+                        if (value < 0)
+                            value = 0;
+                        this.instance.langTagLen.setValue(value);
+                        this.writeBytes(12, Buffer.from([(value >> 8) & 0xff, value & 0xff]));
+                    }
+                },
+                //The Language Tag (US-ASCII, e.g. "en"), kept verbatim as hex so any tag round-trips
+                //byte-for-byte. Bounded by the Language Tag Length and the bytes actually present.
+                langTag: {
+                    type: 'string',
+                    label: 'Language Tag',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const count = this.#langTagBytes();
+                        this.instance.langTag.setValue(count > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(14, count)) : '');
+                    },
+                    encode: function () {
+                        const langTag = this.instance.langTag.getValue('');
+                        if (langTag)
+                            this.writeBytes(14, (0, HexToBuffer_1.HexToBuffer)(langTag));
+                    }
+                },
+                //The Function-ID-specific body after the common header + Language Tag, kept verbatim.
+                //Bounded by the message Length (the message ends at offset Length) and the captured / UDP
+                //bytes, so trailing / pipelined data is left to the codec's recursion / RawData.
+                body: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#boundedAvailable();
+                        const length = this.instance.length.getValue(0);
+                        let bodyStart = 14 + this.#langTagBytes();
+                        if (bodyStart > available)
+                            bodyStart = available;
+                        let end = length;
+                        if (end > available)
+                            end = available;
+                        this.instance.body.setValue(end > bodyStart ? (0, BufferToHex_1.BufferToHex)(this.readBytes(bodyStart, end - bodyStart)) : '');
+                    },
+                    encode: function () {
+                        const body = this.instance.body.getValue('');
+                        if (body)
+                            this.writeBytes(14 + (0, HexToBuffer_1.HexToBuffer)(this.instance.langTag.getValue('')).length, (0, HexToBuffer_1.HexToBuffer)(body));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //SLP rides on UDP/TCP port 427 (selected via the udpport:427 / tcpport:427 bucket). Require the
+        //full 14-byte common header and Version == 2 (the SLPv2 content signature) so non-SLP 427 traffic
+        //falls through to raw.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'udp' && this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.packet.length - this.startPos < 14)
+            return false;
+        return this.readBytes(0, 1, true)[0] === 2;
+    }
+}
+exports.SLP = SLP;

package/dist/headers/SLPv1.d.ts

@@ -0,0 +1,32 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * SLPv1 — Service Location Protocol Version 1 (RFC 2165), UDP (and TCP) port 427. An SLPv1 message
+ * begins with a 12-octet common header: an 8-bit Version (1), an 8-bit Function (1 SrvReq, 2 SrvRply,
+ * 3 SrvReg, 4 SrvDeReg, 5 SrvAck, 6 AttrRqst, 7 AttrRply, 8 DAAdvert, 9 SrvTypeRqst, 10 SrvTypeRply),
+ * a 16-bit Length (the whole message octet count including this header), an 8-bit Flags field (bit 0
+ * Overflow, bit 1 Monolingual, bit 2 URL Authentication, bit 3 Attribute Authentication, bit 4 Fresh;
+ * the remaining 3 bits reserved), an 8-bit Dialect, a 2-octet Language Code (ISO 639, e.g. "en"), a
+ * 16-bit Character Encoding (MIBenum) and a 16-bit XID — then the Function-specific body.
+ *
+ * The body layout differs per Function and several sub-structures carry authentication blocks and
+ * cross-message context, so this common-header codec keeps the body verbatim as `body` hex (byte-
+ * perfect) and does not sub-decode it. The Length is auto-computed on encode when not supplied, else
+ * honored verbatim (a crafted message may lie). The message is bounded by its Length (and the UDP
+ * datagram) so trailing / pipelined bytes are left to the codec's recursion / RawData. A well-formed
+ * message round-trips byte-for-byte.
+ *
+ * Note: SLPv1 (RFC 2165) and SLPv2 (RFC 2608, see SLP) share port 427 but have entirely different
+ * header layouts, so they are separate codecs selected by the Version octet (1 vs 2).
+ */
+export declare class SLPv1 extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/SLPv1.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SLPv1 = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * SLPv1 — Service Location Protocol Version 1 (RFC 2165), UDP (and TCP) port 427. An SLPv1 message
+ * begins with a 12-octet common header: an 8-bit Version (1), an 8-bit Function (1 SrvReq, 2 SrvRply,
+ * 3 SrvReg, 4 SrvDeReg, 5 SrvAck, 6 AttrRqst, 7 AttrRply, 8 DAAdvert, 9 SrvTypeRqst, 10 SrvTypeRply),
+ * a 16-bit Length (the whole message octet count including this header), an 8-bit Flags field (bit 0
+ * Overflow, bit 1 Monolingual, bit 2 URL Authentication, bit 3 Attribute Authentication, bit 4 Fresh;
+ * the remaining 3 bits reserved), an 8-bit Dialect, a 2-octet Language Code (ISO 639, e.g. "en"), a
+ * 16-bit Character Encoding (MIBenum) and a 16-bit XID — then the Function-specific body.
+ *
+ * The body layout differs per Function and several sub-structures carry authentication blocks and
+ * cross-message context, so this common-header codec keeps the body verbatim as `body` hex (byte-
+ * perfect) and does not sub-decode it. The Length is auto-computed on encode when not supplied, else
+ * honored verbatim (a crafted message may lie). The message is bounded by its Length (and the UDP
+ * datagram) so trailing / pipelined bytes are left to the codec's recursion / RawData. A well-formed
+ * message round-trips byte-for-byte.
+ *
+ * Note: SLPv1 (RFC 2165) and SLPv2 (RFC 2608, see SLP) share port 427 but have entirely different
+ * header layouts, so they are separate codecs selected by the Version octet (1 vs 2).
+ */
+class SLPv1 extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'slpv1';
+        this.name = 'Service Location Protocol Version 1';
+        this.nickname = 'SLPv1';
+        this.matchKeys = ['udpport:427', 'tcpport:427'];
+        //A leaf header — the Function-specific body requires per-type, cross-message parsing.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (SLPv1.#schemaCache ??= SLPv1.#buildSchema());
+    }
+    /** The UDP payload length bounded by the datagram, so trailing padding is not absorbed. */
+    #boundedAvailable() {
+        let available = this.packet.length - this.startPos;
+        if (this.prevCodecModule && this.prevCodecModule.id === 'udp') {
+            const udpLength = this.prevCodecModule.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < available)
+                available = udpLength - 8;
+        }
+        return available < 0 ? 0 : available;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'SLPv1 func=${functionId} xid=${xid}',
+            properties: {
+                version: this.fieldUInt('version', 0, 1, 'Version'),
+                functionId: this.fieldUInt('functionId', 1, 1, 'Function'),
+                length: {
+                    type: 'integer',
+                    label: 'Length',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        const b = this.readBytes(2, 2);
+                        this.instance.length.setValue((b[0] << 8) | b[1]);
+                    },
+                    encode: function () {
+                        //Length counts the whole message = 12-byte common header + body. Honored when
+                        //supplied (a crafted message may lie); else derived from the body bytes.
+                        const provided = this.instance.length.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : 12 + (0, HexToBuffer_1.HexToBuffer)(this.instance.body.getValue('')).length;
+                        if (value > 65535) {
+                            this.recordError(this.instance.length.getPath(), 'Maximum value is 65535');
+                            value = 65535;
+                        }
+                        if (value < 0)
+                            value = 0;
+                        this.instance.length.setValue(value);
+                        this.writeBytes(2, Buffer.from([(value >> 8) & 0xff, value & 0xff]));
+                    }
+                },
+                //Flags: bit 0 Overflow, bit 1 Monolingual, bit 2 URL Auth, bit 3 Attr Auth, bit 4 Fresh;
+                //the remaining 3 bits reserved. Kept as a plain uint8 so reserved bits round-trip.
+                flags: this.fieldUInt('flags', 4, 1, 'Flags'),
+                dialect: this.fieldUInt('dialect', 5, 1, 'Dialect'),
+                //2-octet ISO 639 Language Code (e.g. "en"), kept verbatim as hex so any value round-trips.
+                languageCode: {
+                    type: 'string',
+                    label: 'Language Code',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        this.instance.languageCode.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(6, 2)));
+                    },
+                    encode: function () {
+                        const code = this.instance.languageCode.getValue('');
+                        this.writeBytes(6, code ? (0, HexToBuffer_1.HexToBuffer)(code) : Buffer.alloc(2, 0));
+                    }
+                },
+                charEncoding: this.fieldUInt('charEncoding', 8, 2, 'Character Encoding'),
+                xid: this.fieldUInt('xid', 10, 2, 'XID'),
+                //The Function-specific body after the 12-byte common header, kept verbatim. Bounded by the
+                //message Length and the captured / UDP bytes, so trailing / pipelined data is left to the
+                //codec's recursion / RawData.
+                body: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#boundedAvailable();
+                        let end = this.instance.length.getValue(0);
+                        if (end > available)
+                            end = available;
+                        this.instance.body.setValue(end > 12 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(12, end - 12)) : '');
+                    },
+                    encode: function () {
+                        const body = this.instance.body.getValue('');
+                        if (body)
+                            this.writeBytes(12, (0, HexToBuffer_1.HexToBuffer)(body));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //SLPv1 rides on UDP/TCP port 427 (shared with SLPv2). Require the full 12-byte common header and
+        //Version == 1 (the SLPv1 content signature) so non-SLP 427 traffic falls through to raw.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'udp' && this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.packet.length - this.startPos < 12)
+            return false;
+        return this.readBytes(0, 1, true)[0] === 1;
+    }
+}
+exports.SLPv1 = SLPv1;

package/dist/headers/SMB1.d.ts

@@ -0,0 +1,37 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * SMB1 / CIFS (MS-CIFS / MS-SMB), TCP port 445 (Direct TCP) and TCP port 139 (over NBSS). Both transports
+ * frame the SMB message with a 4-byte prefix: a zero "session message" type byte followed by a 24-bit
+ * big-endian length giving the number of SMB message bytes that follow — the Direct TCP transport header
+ * (MS-SMB2 §2.1) on 445, and the equivalent NetBIOS Session Service session-message header on 139. The
+ * prefix is kept structurally so a message on either port round-trips byte-for-byte.
+ *
+ * After the prefix comes the 32-byte SMB1 header (MS-CIFS §2.2.3.1): Protocol (the 0xFF 'S' 'M' 'B' magic,
+ * ff534d42), Command (1 byte — 0x72 NEGOTIATE, 0x73 SESSION_SETUP_ANDX, 0x75 TREE_CONNECT_ANDX, …), a
+ * 4-byte NT Status, Flags (1 byte), Flags2 (2 bytes), PIDHigh (2 bytes), an 8-byte SecuritySignature,
+ * 2 reserved bytes, TID / PIDLow / UID / MID (2 bytes each). The parameter/data block follows: WordCount
+ * (1 byte), the Words (WordCount × 2 bytes), ByteCount (2 bytes) and the Bytes.
+ *
+ * ⚠️ Every multi-byte scalar in the SMB1 header is LITTLE-ENDIAN (SMB's on-wire byte order). There is no
+ * little-endian helper in this codebase, so the uint16 / uint32 fields are read and written byte-by-byte
+ * in their closures. The 8-byte SecuritySignature and the 2-byte Reserved field are kept verbatim as hex
+ * (opaque), so they round-trip byte-for-byte.
+ *
+ * The parameter/data block (WordCount + Words + ByteCount + Bytes) is command-dependent, cross-message
+ * state, so this single-message codec keeps it verbatim as `body` hex (byte-perfect). The 24-bit prefix
+ * length is honored when supplied (a crafted frame may lie) else derived as 32 + body bytes; the message
+ * is bounded by it, so a second pipelined message or trailing bytes are left to the codec's recursion /
+ * RawData. A well-formed message round-trips byte-for-byte.
+ */
+export declare class SMB1 extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/SMB1.js

@@ -0,0 +1,200 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SMB1 = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * SMB1 / CIFS (MS-CIFS / MS-SMB), TCP port 445 (Direct TCP) and TCP port 139 (over NBSS). Both transports
+ * frame the SMB message with a 4-byte prefix: a zero "session message" type byte followed by a 24-bit
+ * big-endian length giving the number of SMB message bytes that follow — the Direct TCP transport header
+ * (MS-SMB2 §2.1) on 445, and the equivalent NetBIOS Session Service session-message header on 139. The
+ * prefix is kept structurally so a message on either port round-trips byte-for-byte.
+ *
+ * After the prefix comes the 32-byte SMB1 header (MS-CIFS §2.2.3.1): Protocol (the 0xFF 'S' 'M' 'B' magic,
+ * ff534d42), Command (1 byte — 0x72 NEGOTIATE, 0x73 SESSION_SETUP_ANDX, 0x75 TREE_CONNECT_ANDX, …), a
+ * 4-byte NT Status, Flags (1 byte), Flags2 (2 bytes), PIDHigh (2 bytes), an 8-byte SecuritySignature,
+ * 2 reserved bytes, TID / PIDLow / UID / MID (2 bytes each). The parameter/data block follows: WordCount
+ * (1 byte), the Words (WordCount × 2 bytes), ByteCount (2 bytes) and the Bytes.
+ *
+ * ⚠️ Every multi-byte scalar in the SMB1 header is LITTLE-ENDIAN (SMB's on-wire byte order). There is no
+ * little-endian helper in this codebase, so the uint16 / uint32 fields are read and written byte-by-byte
+ * in their closures. The 8-byte SecuritySignature and the 2-byte Reserved field are kept verbatim as hex
+ * (opaque), so they round-trip byte-for-byte.
+ *
+ * The parameter/data block (WordCount + Words + ByteCount + Bytes) is command-dependent, cross-message
+ * state, so this single-message codec keeps it verbatim as `body` hex (byte-perfect). The 24-bit prefix
+ * length is honored when supplied (a crafted frame may lie) else derived as 32 + body bytes; the message
+ * is bounded by it, so a second pipelined message or trailing bytes are left to the codec's recursion /
+ * RawData. A well-formed message round-trips byte-for-byte.
+ */
+class SMB1 extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'smb1';
+        this.name = 'SMB1';
+        this.nickname = 'SMB1';
+        //SMB1/CIFS rides TCP port 445 (Direct TCP) and 139 (over NBSS).
+        this.matchKeys = ['tcpport:445', 'tcpport:139'];
+        //A leaf header — the command-specific parameter/data block requires per-command, cross-message parsing.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (SMB1.#schemaCache ??= SMB1.#buildSchema());
+    }
+    /** A little-endian unsigned 16-bit field of 2 octets at `offset`. */
+    static #fieldUInt16LE(name, offset, label) {
+        return {
+            type: 'integer',
+            label: label,
+            minimum: 0,
+            maximum: 65535,
+            decode: function () {
+                const b = this.readBytes(offset, 2);
+                this.instance[name].setValue(b[0] | (b[1] << 8));
+            },
+            encode: function () {
+                const node = this.instance[name];
+                let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                if (value > 65535) {
+                    this.recordError(node.getPath(), 'Maximum value is 65535');
+                    value = 65535;
+                }
+                if (value < 0) {
+                    this.recordError(node.getPath(), 'Minimum value is 0');
+                    value = 0;
+                }
+                node.setValue(value);
+                this.writeBytes(offset, Buffer.from([value & 0xff, (value >> 8) & 0xff]));
+            }
+        };
+    }
+    /** A little-endian unsigned 32-bit field of 4 octets at `offset`. */
+    static #fieldUInt32LE(name, offset, label) {
+        return {
+            type: 'integer',
+            label: label,
+            minimum: 0,
+            maximum: 4294967295,
+            decode: function () {
+                const b = this.readBytes(offset, 4);
+                this.instance[name].setValue((b[0] | (b[1] << 8) | (b[2] << 16) | (b[3] << 24)) >>> 0);
+            },
+            encode: function () {
+                const node = this.instance[name];
+                let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                if (value > 4294967295) {
+                    this.recordError(node.getPath(), 'Maximum value is 4294967295');
+                    value = 4294967295;
+                }
+                if (value < 0) {
+                    this.recordError(node.getPath(), 'Minimum value is 0');
+                    value = 0;
+                }
+                node.setValue(value);
+                this.writeBytes(offset, Buffer.from([value & 0xff, (value >> 8) & 0xff, (value >> 16) & 0xff, (value >>> 24) & 0xff]));
+            }
+        };
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'SMB1 command=${command} tid=${tid} mid=${mid}',
+            properties: {
+                //Transport prefix: byte 0 is the zero "session message" type (Direct TCP on 445, or the
+                //NetBIOS Session Service session-message header on 139); bytes 1-3 are the 24-bit
+                //big-endian message length. Kept as a plain octet so a crafted non-zero type round-trips.
+                transportType: this.fieldUInt('transportType', 0, 1, 'Transport Type'),
+                //24-bit big-endian length of the SMB message that follows (the 32-byte header + body,
+                //excluding this 4-byte transport prefix). Honored when supplied (a crafted frame may lie);
+                //else derived as 32 + body bytes.
+                streamProtocolLength: {
+                    type: 'integer',
+                    label: 'Stream Protocol Length',
+                    minimum: 0,
+                    maximum: 16777215,
+                    decode: function () {
+                        const b = this.readBytes(1, 3);
+                        this.instance.streamProtocolLength.setValue((b[0] << 16) | (b[1] << 8) | b[2]);
+                    },
+                    encode: function () {
+                        const provided = this.instance.streamProtocolLength.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : 32 + (0, HexToBuffer_1.HexToBuffer)(this.instance.body.getValue('')).length;
+                        if (value > 16777215) {
+                            this.recordError(this.instance.streamProtocolLength.getPath(), 'Maximum value is 16777215');
+                            value = 16777215;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.streamProtocolLength.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.streamProtocolLength.setValue(value);
+                        this.writeBytes(1, Buffer.from([(value >> 16) & 0xff, (value >> 8) & 0xff, value & 0xff]));
+                    }
+                },
+                //The 4-byte Protocol magic — 0xFF 'S' 'M' 'B' (ff534d42). Kept verbatim so a crafted magic
+                //round-trips; the match() gate enforces the real signature for selection (and separates
+                //SMB1 from SMB2's 0xFE 'S' 'M' 'B' in the same 445/139 buckets).
+                protocolId: this.fieldHex('protocolId', 4, 4, 'Protocol Id'),
+                //Command (MS-CIFS §2.2.2.1): 0x72 NEGOTIATE, 0x73 SESSION_SETUP_ANDX, 0x75 TREE_CONNECT_ANDX,
+                //… (kept as a plain honored uint — no enum, so an unknown/crafted opcode still round-trips).
+                command: this.fieldUInt('command', 8, 1, 'Command'),
+                //NT Status (4-byte LE) — MS-CIFS §2.2.3.1 (in the SMB_COM error class/code form when
+                //Flags2 SMB_FLAGS2_NT_STATUS is clear; a 4-byte field either way).
+                status: this.#fieldUInt32LE('status', 9, 'Status'),
+                flags: this.fieldUInt('flags', 13, 1, 'Flags'),
+                flags2: this.#fieldUInt16LE('flags2', 14, 'Flags2'),
+                //PIDHigh — the high 2 bytes of a 32-bit Process Id.
+                pidHigh: this.#fieldUInt16LE('pidHigh', 16, 'PID High'),
+                //8-byte SecuritySignature (zero when unsigned) — kept verbatim.
+                securitySignature: this.fieldHex('securitySignature', 18, 8, 'Security Signature'),
+                //2 reserved bytes — kept verbatim so they round-trip untouched.
+                reserved: this.fieldHex('reserved', 26, 2, 'Reserved'),
+                tid: this.#fieldUInt16LE('tid', 28, 'Tree Id'),
+                //PIDLow — the low 2 bytes of the Process Id.
+                pidLow: this.#fieldUInt16LE('pidLow', 30, 'PID Low'),
+                uid: this.#fieldUInt16LE('uid', 32, 'User Id'),
+                mid: this.#fieldUInt16LE('mid', 34, 'Multiplex Id'),
+                //The parameter/data block after the 32-byte header (WordCount + Words + ByteCount + Bytes),
+                //kept verbatim. Bounded by the transport prefix length (the message ends at 4 +
+                //streamProtocolLength) and the captured bytes, so trailing / pipelined data is left to the
+                //codec's recursion / RawData.
+                body: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        const streamLength = this.instance.streamProtocolLength.getValue(0);
+                        let end = 4 + streamLength;
+                        if (end > remaining)
+                            end = remaining;
+                        this.instance.body.setValue(end > 36 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(36, end - 36)) : '');
+                    },
+                    encode: function () {
+                        const body = this.instance.body.getValue('');
+                        if (body)
+                            this.writeBytes(36, (0, HexToBuffer_1.HexToBuffer)(body));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //SMB1 rides on TCP port 445 / 139 (selected via the tcpport buckets). Require the 4-byte transport
+        //prefix + the 0xFF 'S' 'M' 'B' (ff534d42) Protocol magic at offset 4 — a strong 4-byte content
+        //signature — so non-SMB1 445/139 traffic (and SMB2's 0xFE 'S' 'M' 'B') falls through to raw. The
+        //magic gate makes SMB1 and SMB2 mutually exclusive in the shared port buckets. Selection stays
+        //port-bucketed (matchKeys, no heuristicFallback) like the other length-bounded TCP payload codecs.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.packet.length - this.startPos < 8)
+            return false;
+        return (0, BufferToHex_1.BufferToHex)(this.readBytes(4, 4)) === 'ff534d42';
+    }
+}
+exports.SMB1 = SMB1;

package/dist/headers/SMB2.d.ts

@@ -0,0 +1,36 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * SMB2 / SMB3 (MS-SMB2), TCP port 445. Over the Direct TCP transport (MS-SMB2 §2.1) every message is
+ * framed by a 4-byte transport header — a zero byte followed by a 24-bit big-endian StreamProtocolLength
+ * giving the number of SMB2 message bytes that follow — then the 64-byte SMB2 packet header, then the
+ * command-specific body.
+ *
+ * The 64-byte SMB2 header (MS-SMB2 §2.2.1.2, the SYNC form) is: ProtocolId (the 0xFE 'S' 'M' 'B' magic),
+ * StructureSize (always 64), CreditCharge, Status/ChannelSequence+Reserved, Command (0 NEGOTIATE, 1
+ * SESSION_SETUP, 3 TREE_CONNECT, 5 CREATE, 8 READ, 9 WRITE, …), CreditRequest/Response, Flags, NextCommand,
+ * MessageId, Reserved(ProcessId), TreeId, SessionId and a 16-byte Signature.
+ *
+ * ⚠️ Every multi-byte scalar in the SMB2 header is LITTLE-ENDIAN (SMB's on-wire byte order). There is no
+ * little-endian helper in this codebase, so the uint16 / uint32 fields are read and written byte-by-byte
+ * in their closures. The 8-byte MessageId / SessionId and the Signature are kept verbatim as hex (opaque,
+ * and 64-bit values exceed a JS number's exact integer range), so they round-trip byte-for-byte.
+ *
+ * The command-specific body (the NEGOTIATE dialects, SESSION_SETUP security blob, CREATE contexts, READ /
+ * WRITE data, …) is cross-message, command-dependent state, so this single-message codec keeps it verbatim
+ * as `body` hex (byte-perfect). The StreamProtocolLength is honored when supplied (a crafted frame may lie)
+ * else derived as 64 + body bytes; the message is bounded by it, so a second compounded/pipelined message
+ * or trailing bytes are left to the codec's recursion / RawData. A well-formed message round-trips
+ * byte-for-byte.
+ */
+export declare class SMB2 extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}