a
    kÄ#dß  ã                   @   s 	  d Z ddlmZ ddlmZmZ ddlZddlmZ ddl	m
Z
 ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZmZmZmZmZ ddlmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z?m@Z@mAZAmBZBmCZCmDZDmEZEmFZFmGZG ddlHmIZI ddlJmKZKmLZLmMZM ddlNmOZO ddlPmQZQ ddlRmSZSmTZTmUZUmVZV ddlWmX  mYZY ddddddddddddddd d!d"d#d$d%d&œZZg d'¢Z[g d(¢Z\d)d*„ Z]G d+d,„ d,eSƒZ^G d-d.„ d.eƒZ_eeQe_d/d0� eeQe_d/d1� G d2d3„ d3eƒZ`ed4d5d6d7d8gƒed9dd6d:d;gƒed<dg d=¢ƒed>dƒgZaG d?d@„ d@eƒZbG dAdB„ dBeƒZcG dCdD„ dDeƒZddEdFdGdHdIdJdGdKœZedLdMdNdOdPdQdRdSœZfG dTdU„ dUeƒZgdVdWdXdYdZd[d\d]œZhd^d_d`dadbdcdddedfdgdhdidjdkdldmdndodpœZiG dqdr„ dreƒZji Zki ZledsƒdteduƒdvedwƒdxedyƒdziZmG d{d|„ d|eTƒZnG d}d~„ d~eTƒZoG dd€„ d€eTƒZpG d�d‚„ d‚eTƒZqG dƒd„„ d„eTƒZrG d…d†„ d†e`ƒZseejesd‡dˆ� G d‰dŠ„ dŠe`ƒZteejetd‹dˆ� G dŒd�„ d�eTƒZuG dŽd�„ d�e`ƒZveejevd�dˆ� G d‘d’„ d’e`ƒZweejewd“dˆ� G d”d•„ d•e`ƒZxeejexd–dˆ� G d—d˜„ d˜eƒZyeejeyd™dˆ� G dšd›„ d›e`ƒZzeejezdœdˆ� G d�dž„ dže`ƒZ{eeje{ddˆ� G dŸd „ d e`ƒZ|eeje|d¡dˆ� ed¢ddgƒZ}i Z~G d£d¤„ d¤ƒZd¥d¦„ Z€d§d¨„ Z�d©dª„ Z‚G d«d¬„ d¬eƒZƒG d­d®„ d®ƒZ„G d¯d°„ d°e„e5ƒZ…G d±d²„ d²e
ƒZ†eY ‡e†¡G d³d´„ d´eƒƒƒZˆeZ‰e8ZŠG dµd¶„ d¶e…ƒZ‹G d·d¸„ d¸e…ƒZŒG d¹dº„ dºe…ƒZ�G d»d¼„ d¼e…ƒZŽG d½d¾„ d¾e…ƒZ�G d¿dÀ„ dÀe…ƒZ�G dÁdÂ„ dÂe…ƒZ‘G dÃdÄ„ dÄe…ƒZ’G dÅdÆ„ dÆeƒZ“G dÇdÈ„ dÈe…ƒZ”G dÉdÊ„ dÊe…ƒZ•G dËdÌ„ dÌe ƒZ–G dÍdÎ„ dÎe–ƒZ—G dÏdÐ„ dÐeƒƒZ˜G dÑdÒ„ dÒeƒZ™G dÓdÔ„ dÔe™ƒZšG dÕdÖ„ dÖe›ƒZœG d×dØ„ dØe1ƒZ�G dÙdÚ„ dÚeœe…ƒZžG dÛdÜ„ dÜeœe3ƒZŸG dÝdÞ„ dÞeœe"ƒZ G dßdà„ dàeƒƒZ¡G dádâ„ dâe›ƒZ¢G dãdä„ däeƒƒZ£G dådæ„ dæeƒƒZ¤G dçdè„ dèe›ƒZ¥G dédê„ dêe¢eŸƒZ¦G dëdì„ dìe¥eŸƒZ§G dídî„ dîe¥e¢eŸƒZ¨G dïdð„ dðe¥e ƒZ©G dñdò„ dòe¥e¢e ƒZªG dódô„ dôe¥e;ƒZ«G dõdö„ döe¥e<ƒZ¬G d÷dø„ døe¢e;ƒZ­G dùdú„ dúe¢e<ƒZ®G dûdü„ düe¥e¢e;ƒZ¯G dýdþ„ dþe¥e¢e<ƒZ°G dÿ�d „ �d e¥e¢e=ƒZ±G �d�d„ �de¥e¢e>ƒZ²G �d�d„ �deƒƒZ³G �d�d„ �de0ƒZ´G �d�d„ �deœe´ƒZµG �d	�d
„ �d
e ƒZ¶G �d�d„ �deˆƒZ·G �d�d„ �deƒZ¸G �d�d„ �deƒZ¹�d�d�d„Zº�d�d�d„Z»G �d�d„ �deIƒZ¼G �d�d„ �deƒZ½eebe½ƒ dS (  a  
DCE/RPC
Distributed Computing Environment / Remote Procedure Calls

Based on [C706] - aka DCE/RPC 1.1
https://pubs.opengroup.org/onlinepubs/9629399/toc.pdf

And on [MS-RPCE]
https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rpce/290c38b1-92fe-4229-91e6-4fc376610c15
é    )Úpartial)Ú
namedtupleÚdequeN)ÚUUID)ÚPacket_metaclass)Úconf)Úlog_runtime)ÚDNSStrField)ÚNTLM_Header)ÚPacketÚRawÚbind_bottom_upÚbind_layersÚbind_top_down).Ú_FieldContainerÚBitEnumFieldÚByteEnumFieldÚ	ByteFieldÚConditionalFieldÚ	EnumFieldÚFieldÚFieldLenFieldÚFieldListFieldÚ
FlagsFieldÚIEEEDoubleFieldÚIEEEFloatFieldÚIntFieldÚLEIntEnumFieldÚ
LEIntFieldÚLELongFieldÚLEShortEnumFieldÚLEShortFieldÚLESignedIntFieldÚLESignedLongFieldÚLESignedShortFieldÚLenFieldÚMultipleTypeFieldÚPacketFieldÚPacketLenFieldÚPacketListFieldÚPadFieldÚReversePadFieldÚShortEnumFieldÚ
ShortFieldÚSignedByteFieldÚStrFieldÚStrFixedLenFieldÚStrLenFieldÚStrLenFieldUtf16ÚStrNullFieldÚStrNullFieldUtf16ÚTrailerFieldÚUUIDEnumFieldÚ	UUIDFieldÚ
XByteFieldÚXLEIntFieldÚXLELongFieldÚXLEShortFieldÚXShortFieldÚXStrFixedLenField)ÚDefaultSession)ÚKRB5_GSS_Wrap_RFC1964ÚKRB5_GSS_WrapÚKerberos)ÚGSSAPI_BLOB)ÚTCP)ÚEFieldÚEPacketÚEPacketFieldÚEPacketListFieldÚrequestZpingÚresponseÚfaultZworkingZno_callZrejectZacknowledgeZconnectionless_cancelZfrag_ackZ
cancel_ackÚbindZbind_ackZbind_nakZalter_contextZalter_context_respZauth3ÚshutdownZ	co_cancelZorphaned)r   é   é   é   é   é   é   é   é   é	   é
   é   é   é   é   é   é   é   é   é   )Zreserved_01Z	last_fragÚfragZno_frag_ackÚmaybeZ
idempotentÚ	broadcastÚ
reserved_7)Z
reserved_0Zcancel_pendingZ
reserved_2Z
reserved_3Z
reserved_4Z
reserved_5Z
reserved_6rc   c                 C   s$   | j dkrdS | j dkrdS dS dS )zH
    Determine the right endianness sign for a given DCE/RPC packet
    r   ú>rM   ú<ú!N)Úendian©Úpkt© rj   úJ/var/www/html/gsl.tools/lib/python3.9/site-packages/scapy/layers/dcerpc.pyÚ_dce_rpc_endianessŽ   s
    

rl   c                       s   e Zd Z‡ fdd„Z‡  ZS )Ú_EFieldc                    s   t t| ƒj|td� d S )N)Úendianness_from)Úsuperrm   Ú__init__rl   )ÚselfÚfld©Ú	__class__rj   rk   rp   ›   s    z_EField.__init__©Ú__name__Ú
__module__Ú__qualname__rp   Ú__classcell__rj   rj   rs   rk   rm   š   s   rm   c                   @   s   e Zd ZdZeddd„ƒZdS )ÚDceRpczDCE/RPC packetNc                 O   s<   |r8t |ƒdkr8t|dd… ƒ}|dkr,tS |dkr8tS tS )NrM   r   rP   rQ   )ÚlenÚordÚDceRpc4ÚDceRpc5)ÚclsÚ_pktÚargsÚkargsÚverrj   rj   rk   Údispatch_hook¢   s    zDceRpc.dispatch_hook)N)rv   rw   rx   Ú__doc__Úclassmethodr„   rj   rj   rj   rk   rz   Ÿ   s   rz   é‡   )Zsport)Údportc                   @   s   e Zd Zedd„ ƒZdS )Ú_DceRpcPayloadc                 C   s   | j s
dS t| j ƒS )Nrf   )Ú
underlayerrl   ©rq   rj   rj   rk   Ú
endianness²   s    z_DceRpcPayload.endiannessN)rv   rw   rx   ÚpropertyrŒ   rj   rj   rj   rk   r‰   ±   s   r‰   rg   rM   rP   ÚbigÚlittleÚencodingÚASCIIZEBCDICÚfloat)ZIEEEÚVAXZCRAYZIBMZ	reserved1c                   @   sø   e Zd ZdZdZedddddœƒedd	eƒed
d	deƒedd	de	ƒge
 edd	ƒeeddƒƒeeddƒƒeeddƒƒeedd	ƒƒeeddƒƒeedd	ƒƒeedd	ƒƒeeddƒƒeeddƒƒeedddd�ƒeedd	ƒƒedd	dd gƒed!d	ƒg ZdS )"r}   z-
    DCE/RPC v4 'connection-less' packet
    z
DCE/RPC v4Úrpc_versrP   ú4 (connection-less)ú5 (connection-oriented)©rP   rQ   Úptyper   Úflags1rT   Úflags2Z	serial_hiÚobjectNZif_idZact_idZserver_bootZif_versrM   ZseqnumÚopnumZihintéÿÿ  Zahintr{   ÚH©ÚfmtZfragnumZ
auth_protoÚnonezOSF DCE Private KeyZ	serial_lo)rv   rw   rx   r…   Únamer   ÚDCE_RPC_TYPEr   Ú_DCE_RPC_4_FLAGS1Ú_DCE_RPC_4_FLAGS2Ú_drepr8   rm   r7   r   r-   r<   r%   Úfields_descrj   rj   rj   rk   r}   Ã   s8   ÿ
úø
ò÷ÿr}   c                
   @   sŽ   e Zd Zd Zedddddœƒedddg d¢ƒeed	d
ƒdd„ ƒeedd
ƒdd„ ƒeedd
ƒdd„ ƒeedd
ƒdd„ ƒeedd
ƒdd„ ƒgZ	dS )ÚNL_AUTH_MESSAGEZMessageTyper   ÚRequestÚResponse©r   rM   ÚFlagsiàÿÿÿ)ÚNETBIOS_DOMAIN_NAMEÚNETBIOS_COMPUTER_NAMEÚDNS_DOMAIN_NAMEÚDNS_HOST_NAMEÚNETBIOS_COMPUTER_NAME_UTF8ZNetbiosDomainNameÚ c                 C   s   | j jS ©N)r¬   r­   rh   rj   rj   rk   Ú<lambda>  ó    zNL_AUTH_MESSAGE.<lambda>ZNetbiosComputerNamec                 C   s   | j jS r³   )r¬   r®   rh   rj   rj   rk   r´     rµ   ZDnsDomainNamec                 C   s   | j jS r³   )r¬   r¯   rh   rj   rj   rk   r´     rµ   ZDnsHostNamec                 C   s   | j jS r³   )r¬   r°   rh   rj   rj   rk   r´     rµ   ZNetbiosComputerNameUtf8c                 C   s   | j jS r³   )r¬   r±   rh   rj   rj   rk   r´     rµ   N)
rv   rw   rx   r¢   r   r   r   r3   r	   r§   rj   rj   rj   rk   r¨   é   sF   þýüþþþþüÛr¨   c                   @   s–   e Zd ZdZedddddœƒeddd	d
ddœƒeddƒeddƒedddd�edddd�eedddd�dd„ ƒe	e
dddd�dd„ fgeddƒƒgZdS )ÚNL_AUTH_SIGNATUREzNL_AUTH_(SHA2_)SIGNATUREÚSignatureAlgorithméw   zHMAC-MD5zHMAC-SHA256)r¸   r_   ÚSealAlgorithmr�   ZUnencryptedZRC4zAES-128)r�   éz   é¡   ZPadr¬   r   ZSequenceNumberrµ   rT   ©ÚlengthZChecksumZ
Confounderc                 C   s
   | j dkS )Nr�   )r¹   rh   rj   rj   rk   r´   5  rµ   zNL_AUTH_SIGNATURE.<lambda>Z	Reserved2é   c                 C   s
   | j dkS )Nr_   )r·   rh   rj   rj   rk   r´   9  rµ   N)rv   rw   rx   r¢   r    r;   r-   r=   r   r&   r0   r/   r§   rj   rj   rj   rk   r¶     s@   þýýý	þÿÿýær¶   ÚNoneZSPNEGOZNTLMZTLSrA   ZNetlogon)r   rU   rV   rZ   r\   éD   éÿ   ZRPC_C_AUTHN_LEVEL_DEFAULTZRPC_C_AUTHN_LEVEL_NONEZRPC_C_AUTHN_LEVEL_CONNECTZRPC_C_AUTHN_LEVEL_CALLZRPC_C_AUTHN_LEVEL_PKTZRPC_C_AUTHN_LEVEL_PKT_INTEGRITYZRPC_C_AUTHN_LEVEL_PKT_PRIVACY)r   rM   rN   rO   rP   rQ   rR   c                   @   sö   e Zd ZdZeddeƒeddeƒeddƒeddƒeddƒe	e
d	eƒ ed
d„ d�dd„ fe
d	eƒ edd„ d�dd„ fe
d	eƒ edd„ d�dd„ fe
d	eƒ edd„ d�dd„ fe
d	eƒ edd„ d�dd„ fge
d	dejdd„ d�ƒgZdd„ Zdd„ ZdS )ÚCommonAuthVerifierz,Common Authentication Verifier (sec_trailer)Ú	auth_typer   Z
auth_levelÚauth_pad_lengthNZauth_reservedZauth_context_idÚ
auth_valuec                 C   s   | j jS r³   ©ÚparentÚauth_lenrh   rj   rj   rk   r´   l  rµ   zCommonAuthVerifier.<lambda>©Zlength_fromc                 C   s
   | j dkS )NrU   ©rÃ   rh   rj   rj   rk   r´   n  rµ   c                 C   s   | j jS r³   rÆ   rh   rj   rj   rk   r´   u  rµ   c                 C   s
   | j dv S )N)rV   rÁ   rÊ   rh   rj   rj   rk   r´   w  rµ   c                 C   s   | j jS r³   rÆ   rh   rj   rj   rk   r´   ~  rµ   c                 C   s
   | j dkS )Nr\   rÊ   rh   rj   rj   rk   r´   €  rµ   c                 C   s   | j jS r³   rÆ   rh   rj   rj   rk   r´   ˆ  rµ   c                 C   s   | j dko| jo| jjdv S ©NrÀ   ©rW   rX   rY   rZ   r[   ©rÃ   rÇ   r˜   rh   rj   rj   rk   r´   Š  s   
ÿc                 C   s   | j jS r³   rÆ   rh   rj   rj   rk   r´   “  rµ   c                 C   s   | j dko| j p| jjdvS rË   rÍ   rh   rj   rj   rk   r´   •  s   
c                 C   s   | j r| j jpdS ©Nr   rÆ   rh   rj   rj   rk   r´   �  rµ   c                 C   sJ   | j dkr(t| jtƒr(t| jjttfƒS | j dkrF| j pD| jjdvS dS )NrU   rÀ   rÌ   F)	rÃ   Ú
isinstancerÅ   rB   ZinnerContextTokenr?   r@   rÇ   r˜   r‹   rj   rj   rk   Úis_encrypted¢  s    þ
zCommonAuthVerifier.is_encryptedc                 C   s   t jS r³   ©r   Úpadding_layer©rq   ri   rj   rj   rk   Údefault_payload_class¬  s    z(CommonAuthVerifier.default_payload_class)rv   rw   rx   r¢   r   Ú_MSRPCE_SECURITY_PROVIDERSÚ_MSRPCE_SECURITY_AUTHLEVELSr   r9   r&   r(   rB   r
   rA   r¨   r¶   r   Ú	raw_layerr§   rÐ   rÔ   rj   rj   rj   rk   rÂ   Y  s|   ý
üù
üù
üùüùüùØ3üÌöG
rÂ   Z
FIRST_FRAGZ	LAST_FRAGZPENDING_CANCELZCONC_MPXZDID_NOT_EXECUTEZMAYBEÚOBJECT_UUID)rM   rN   rP   r\   é    é@   é€   Znca_rpc_version_mismatchZnca_unspec_rejectZnca_s_bad_actidZnca_who_are_you_failedZnca_manager_not_enteredZnca_op_rng_errorZ
nca_unk_ifZnca_wrong_boot_timeZnca_s_you_crashedZnca_proto_errorZnca_out_args_too_bigZnca_server_too_busyZnca_unsupported_typeZnca_invalid_pres_context_idZnca_unsupported_authn_levelZnca_invalid_checksumZnca_invalid_crcZRPC_X_BAD_STUB_DATA)i  i	  i
  i  i  i i i i	 i i i i i  i  i  i   i÷  c                   @   sÂ   e Zd ZdZdZedddddœƒedd	ƒed
d	eƒedd	de	ƒge
 edd	ƒeeddƒƒeedddddd„ d�ƒeeddƒƒeeeddedd„ d�ƒdd„ ƒg Zdd„ Zdd„ Zedd„ ƒZdS ) r~   z1
    DCE/RPC v5 'connection-oriented' packet
    z
DCE/RPC v5r”   rQ   r•   r–   r—   Zrpc_vers_minorr   r˜   Ú	pfc_flagsrT   Ú	reserved2Úfrag_lenNrÈ   rž   Úauth_verifierc                 C   s   |sdS |d S )Nr   rT   rj   )ri   Úxrj   rj   rk   r´   î  rµ   zDceRpc5.<lambda>)r    Ú	length_ofÚadjustÚcall_idc                 C   s
   | j d S )NrT   ©rÈ   rh   rj   rj   rk   r´   ø  rµ   rÉ   c                 C   s
   | j dkS rÎ   rä   rh   rj   rj   rk   r´   û  rµ   c                 C   sæ   | j r˜| j jd u r˜|  d¡ | |dd… ¡d d }|| d … |d | …  }}t|ƒd  d }|d d… t d|¡ |d	d …  }||d
  | }| jd u rÞt|ƒt|ƒ }|d d… |  d¡ | d|¡ |dd …  }|| S )NrÈ   rV   rX   rM   rT   r\   rN   ÚBrO   ó    rÞ   rµ   )	rß   rÄ   Ú	get_fieldÚgetfieldr{   ÚstructÚpackrÞ   Úaddfield)rq   ri   ÚpayrÈ   rß   Úpadlenr½   rj   rj   rk   Ú
post_build   s     ""ÿ

ÿ
þÿzDceRpc5.post_buildc                 C   s   t |tƒo|t j| jkS r³   )rÏ   r~   rã   rÓ   rj   rj   rk   Úanswers  s    zDceRpc5.answersc                 C   s    |dd… dkrd S t  d|dd… ¡d d? }|dvr<d S t  |rHdnd	d
 |dd… ¡d }t|ƒ|krœ| dd ¡}|sŠtƒ  }|d< | t|ƒ¡}|S d S )Nr   rM   ó   z!BrP   rQ   r«   re   rd   rž   rT   rV   Údcerpc_session)ré   Úunpackr{   ÚgetÚDceRpcSessionÚ_process_dcerpc_packetr~   )r   ÚdataÚ_Úsessionrg   r½   rñ   ri   rj   rj   rk   Útcp_reassemble  s    $zDceRpc5.tcp_reassemble)rv   rw   rx   r…   r¢   r   r   r£   r   Ú_DCE_RPC_5_FLAGSr¦   rm   r-   r   r   r   r5   r(   rÂ   r§   rî   rï   r†   rù   rj   rj   rj   rk   r~   Õ  sR   ÿ
úø
ûÿ	üÿ÷ó÷ÿ%r~   z$00000000-0000-0000-0000-000000000000ZNULLz$6cb71c2c-9812-4540-0300-000000000000zBind Time Feature Negotiationz$8a885d04-1ceb-11c9-9fe8-08002b104860zNDR 2.0z$71710533-beba-4937-8319-b5dbef9ccc36ÚNDR64c                   @   sB   e Zd ZdZeeddejejfƒƒee	ddƒƒee	ddƒƒgZ
dS )ÚDceRpc5AbstractSyntaxz#Presentation Syntax (p_syntax_id_t)Úif_uuidNÚ
if_versionrO   Zif_version_minorr   )rv   rw   rx   r¢   rm   r6   ÚDCE_RPC_INTERFACES_NAMESró   ÚDCE_RPC_INTERFACES_NAMES_revr-   r§   rj   rj   rj   rk   rü   9  s   ýýÿórü   c                   @   s:   e Zd ZdZeeddeƒƒeeddƒƒeeddƒƒgZdS )ÚDceRpc5TransferSyntaxz,Presentation Transfer Syntax (p_syntax_id_t)rý   Nrþ   rO   Úreservedr   )	rv   rw   rx   r¢   rm   r6   ÚDCE_RPC_TRANSFER_SYNTAXESr-   r§   rj   rj   rj   rk   r  L  s   ýÿ÷r  c                   @   sT   e Zd ZdZeeddƒƒeddddd�ed	dƒed
de	ƒe
ddedd„ ed�gZdS )ÚDceRpc5Contextz$Presentation Context (p_cont_elem_t)Z
context_idr   Ún_transfer_synNZtransfer_syntaxesrå   ©Zcount_ofr    r  Úabstract_syntaxc                 C   s   | j S r³   )r  rh   rj   rj   rk   r´   f  rµ   zDceRpc5Context.<lambda>©Ú
count_fromrn   )rv   rw   rx   r¢   rm   r-   r   r   rF   rü   rG   r  rl   r§   rj   rj   rj   rk   r  [  s   
ûûr  c                   @   sB   e Zd ZdZeeddg d¢ƒƒeeddg d¢ƒƒeddeƒgZdS )	ÚDceRpc5ResultzContext negotiation ResultÚresultr   )Z
acceptanceZuser_rejectionZprovider_rejectionÚreason)Zreason_not_specifiedZabstract_syntax_not_supportedZ(proposed_transfer_syntaxes_not_supportedZlocal_limit_exceededÚtransfer_syntaxN)	rv   rw   rx   r¢   rm   r,   rF   r  r§   rj   rj   rj   rk   r
  l  s   
ÿÿýÿ
îr
  c                   @   s:   e Zd ZdZeeddddd�ƒeedddd	„ d
�ƒgZdS )ÚDceRpc5PortAnyzPort Any (port_any_t)r½   NÚ	port_specrž   ©rá   r    rµ   c                 C   s   | j S r³   r¼   rh   rj   rj   rk   r´   ˆ  rµ   zDceRpc5PortAny.<lambda>rÉ   )rv   rw   rx   r¢   rm   r   r1   r§   rj   rj   rj   rk   r  „  s   þr  c                   @   sj   e Zd ZdZeeddƒƒeeddƒƒeeddƒƒeedd	d
dd�ƒedddd�e	d
g e
edd„ d�gZd	S )ÚDceRpc5BindzDCE/RPC v5 - BindÚmax_xmit_fragéÐ  Úmax_recv_fragé    Úassoc_group_idr   Ún_context_elemNÚcontext_elemrå   r  r  rO   r¼   c                 C   s   | j S r³   )r  rh   rj   rj   rk   r´   Ÿ  rµ   zDceRpc5Bind.<lambda>©rn   r	  )rv   rw   rx   r¢   rm   r-   r   r   r0   rG   r  rl   r§   rj   rj   rj   rk   r  �  s    ÿû÷r  rW   )r˜   c                   @   s|   e Zd ZdZeeddƒƒeeddƒƒeeddƒƒeedd	e	ƒd
d�ee
dd	ddd�ƒedddd�edg eedd„ d�gZd	S )ÚDceRpc5BindAckzDCE/RPC v5 - Bind Ackr  r  r  r  r  r   Zsec_addrNrP   ©ÚalignÚ	n_resultsÚresultsrå   r  r  rO   r¼   c                 C   s   | j S r³   )r  rh   rj   rj   rk   r´   »  rµ   zDceRpc5BindAck.<lambda>r  )rv   rw   rx   r¢   rm   r-   r   r*   rF   r  r   r0   rG   r
  rl   r§   rj   rj   rj   rk   r  ©  s$   
þûõr  rX   c                   @   s$   e Zd ZdZeddƒeddƒgZdS )ÚDceRpc5VersionZ	version_tÚmajorr   ÚminorN)rv   rw   rx   r¢   r   r§   rj   rj   rj   rk   r  Å  s   þr  c                	   @   sF   e Zd ZdZeeddƒƒeeddddd�ƒedg ed	d
„ e	d�gZ
dS )ÚDceRpc5BindNakzDCE/RPC v5 - Bind NakZprovider_reject_reasonr   Ún_protocolsNÚ	protocolsrå   r  c                 C   s   | j S r³   )r#  rh   rj   rj   rk   r´   ×  rµ   zDceRpc5BindNak.<lambda>r  )rv   rw   rx   r¢   rm   r-   r   rG   r  rl   r§   rj   rj   rj   rk   r"  Í  s   ûür"  rY   c                   @   s   e Zd ZdZejZdS )ÚDceRpc5AlterContextzDCE/RPC v5 - AlterContextN)rv   rw   rx   r¢   r  r§   rj   rj   rj   rk   r%  ã  s   r%  rZ   c                   @   s   e Zd ZdZejZdS )ÚDceRpc5AlterContextRespzDCE/RPC v5 - AlterContextRespN)rv   rw   rx   r¢   r  r§   rj   rj   rj   rk   r&  î  s   r&  r[   c                   @   s    e Zd ZdZedddd�gZdS )ÚDceRpc5Auth3zDCE/RPC v5 - Auth3Úpadrµ   rP   r¼   N)rv   rw   rx   r¢   r0   r§   rj   rj   rj   rk   r'  ø  s   r'  r\   c                	   @   sR   e Zd ZdZeeddƒƒeeddƒƒeddƒeddƒeedde	ƒƒeddƒgZ
d	S )
ÚDceRpc5FaultzDCE/RPC v5 - FaultÚ
alloc_hintr   Úcont_idÚcancel_countr  ÚstatusrÝ   N)rv   rw   rx   r¢   rm   r   r-   r   r   Ú_DCE_RPC_ERROR_CODESr§   rj   rj   rj   rk   r)    s   úr)  rO   c                	   @   sV   e Zd ZdZeeddƒƒeeddƒƒeeddƒƒeeee	ddƒƒdd	�d
d„ ƒgZ
dS )ÚDceRpc5RequestzDCE/RPC v5 - Requestr*  r   r+  rœ   r›   NrT   r  c                 C   s   | j o| j jjS r³   )rŠ   rÜ   rØ   rh   rj   rj   rk   r´     rµ   zDceRpc5Request.<lambda>)rv   rw   rx   r¢   rm   r   r-   r   r*   r7   r§   rj   rj   rj   rk   r/    s   þûür/  c                   @   s<   e Zd ZdZeeddƒƒeeddƒƒeddƒeddƒgZdS )ÚDceRpc5ResponsezDCE/RPC v5 - Responser*  r   r+  r,  r  N)	rv   rw   rx   r¢   rm   r   r-   r   r§   rj   rj   rj   rk   r0  )  s   ür0  rN   ÚDceRpcOpc                   @   s   e Zd Zdd„ Zdd„ ZdS )ÚDceRpcInterfacec                 C   s.   || _ || _tt| d¡ƒ\| _| _|| _d S )NÚ.)r¢   ÚuuidÚmapÚintÚsplitÚversionÚminor_versionÚopnums)rq   r¢   r4  r8  r:  rj   rj   rk   rp   <  s    zDceRpcInterface.__init__c                 C   s   d| j | jf S )Nz<DCE/RPC Interface %s v%s>)r¢   r8  r‹   rj   rj   rk   Ú__repr__B  s    zDceRpcInterface.__repr__N)rv   rw   rx   rp   r;  rj   rj   rj   rk   r2  ;  s   r2  c                 C   sh   |t v rtdƒ‚d|  ¡ |f t|< |t|  ¡ < t| |||ƒt |< | ¡ D ]\}}tt|j	|d� qJdS )z&
    Register a DCE/RPC interface
    z!Interface is already registered !z%s (v%s))rœ   N)
ÚDCE_RPC_INTERFACESÚ
ValueErrorÚupperrÿ   r   r2  Úitemsr   r/  rH   )r¢   r4  r8  r:  rœ   Ú
operationsrj   rj   rk   Úregister_dcerpc_interfaceF  s    ürA  c                    s<   zt ‡ fdd„t ¡ D ƒƒW S  ty6   tdƒ‚Y n0 dS )z>
    Find an interface object through the name in the IDL
    c                 3   s   | ]}|j ˆ kr|V  qd S r³   ©r¢   ©Ú.0rà   rB  rj   rk   Ú	<genexpr>^  rµ   z(find_dcerpc_interface.<locals>.<genexpr>zUnknown interface !N)Únextr<  ÚvaluesÚStopIterationÚAttributeErrorrB  rj   rB  rk   Úfind_dcerpc_interfaceY  s    rJ  c                 C   s8   t | tƒr|| _t | tƒr4| D ]}t |tƒr||_qd S r³   )rÏ   Ú
_NDRPacketÚndr64Úlist)ÚfrL  rà   rj   rj   rk   Ú_set_ndr_onf  s    


rO  c                       sn   e Zd Zg d¢Z‡ fdd„Z‡ fdd„Z‡ fdd„Zdd	„ Z‡ fd
d„Z‡ fdd„Z	ddd„Z
dd„ Z‡  ZS )rK  )rL  Údefered_pointersÚrequest_packetc                    s<   |  dd¡| _|  dd ¡| _g | _tt| ƒj|i |¤Ž d S )NrL  TrQ  )ÚpoprL  rQ  rP  ro   rK  rp   ©rq   r�   Úkwargsrs   rj   rk   rp   r  s    z_NDRPacket.__init__c                    s2   | j p
| j}|r"t|tƒr"|j| _tt| ƒ |¡S r³   )rÇ   rŠ   rÏ   rK  rL  ro   Údissect)rq   ÚsZ_uprs   rj   rk   rU  z  s    z_NDRPacket.dissectc                    s*   | j  ¡ D ]}t|| jƒ q
tt| ƒ ¡ S r³   )ÚfieldsrG  rO  rL  ro   rK  Údo_build©rq   rN  rs   rj   rk   rX  €  s    z_NDRPacket.do_buildc                 C   s   t jS r³   rÑ   rÓ   rj   rj   rk   rÔ   …  s    z _NDRPacket.default_payload_classc                    s*   t t| ƒj|i |¤Ž}| j|_| j|_|S r³   )ro   rK  Ú
clone_withrP  rL  )rq   r�   rT  ri   rs   rj   rk   rZ  ˆ  s    z_NDRPacket.clone_withc                    s"   t t| ƒ ¡ }| j|_| j|_|S r³   )ro   rK  ÚcopyrP  rL  rÓ   rs   rj   rk   r[  �  s    z_NDRPacket.copyFrO   r²   c                 C   s    | j t| ƒ| jd� ||||¡S )N©rL  )rt   ÚbytesrL  Úshow)rq   ÚdumpÚindentZlvlZ	label_lvlrj   rj   rk   Úshow2–  s    ÿz_NDRPacket.show2c                 C   sT   zt  | |¡W S  tyN   | jrHz| j |¡W  Y S  tyF   Y n0 ‚ Y n0 d S r³   )r   Úgetfield_and_valr=  rQ  rI  )rq   Úattrrj   rj   rk   rb  ›  s    z_NDRPacket.getfield_and_val)FrO   r²   r²   )rv   rw   rx   Ú	__slots__rp   rU  rX  rÔ   rZ  r[  ra  rb  ry   rj   rj   rs   rk   rK  o  s   
rK  c                   @   s   e Zd Zdd„ Zdd„ ZdS )Ú	_NDRAlignc                 C   s   | | j |j  S r³   )Ú_alignrL  )rq   Zflenri   rj   rj   rk   rí   ©  s    z_NDRAlign.padlenc                 C   s2   |r(|j p|j}|r(t|tƒr(|}q q(q t|jƒS r³   )rÇ   rŠ   rÏ   rK  r{   Úoriginal)rq   ri   Úparrj   rj   rk   Úoriginal_length¬  s    z_NDRAlign.original_lengthN)rv   rw   rx   rí   ri  rj   rj   rj   rk   re  ¨  s   re  c                       s"   e Zd ZdZd‡ fdd„	Z‡  ZS )ÚNDRAlignz³
    ReversePadField modified to fit NDR.

    - If no align size is specified, use the one from the inner field
    - Size is calculated from the beginning of the NDR stream
    Nc                    s   t t| ƒj|||d� d S )N)r  Úpadwith)ro   rj  rp   )rq   rr   r  rk  rs   rj   rk   rp   ¿  s    zNDRAlign.__init__)N)rv   rw   rx   r…   rp   ry   rj   rj   rs   rk   rj  ·  s   rj  c                       s   e Zd Z‡ fdd„Z‡  ZS )Ú_NDRPacketMetaclassc                    sÀ   t t| ƒ | |||¡}| dd¡‰ ˆ r¼ˆ dkrZ|j dttddƒdd„ fgtddƒƒ¡ nb|j dtt	t
ddtddƒ‡ fd	d„d
�dd�dd„ fgt	t
ddtddƒ‡ fdd„d
�dd�ƒ¡ |S )NÚCONFORMANT_COUNTr   rM   Ú	max_countc                 S   s
   | o| j S r³   r\  rh   rj   rj   rk   r´   Ï  rµ   z-_NDRPacketMetaclass.__new__.<locals>.<lambda>Z
max_countsr²   c                    s   ˆ S r³   rj   ©r÷   ©Zconformantsrj   rk   r´   à  rµ   ©r	  ©rT   rT   r  c                 S   s
   | o| j S r³   r\  rh   rj   rj   rk   r´   ä  rµ   c                    s   ˆ S r³   rj   ro  rp  rj   rk   r´   ì  rµ   ©rP   rP   )ro   rl  Ú__new__ró   r§   Úinsertr&   ÚNDRLongFieldÚNDRIntFieldrj  r   r   r   )r   r¢   ÚbasesÚdctZnewclsrs   rp  rk   rt  Ä  sR    þÿùþ
üù	öÿ
üùñþz_NDRPacketMetaclass.__new__)rv   rw   rx   rt  ry   rj   rj   rs   rk   rl  Ã  s   rl  c                   @   s   e Zd ZdZdgZdZdZdS )Ú	NDRPacketz9
    A NDR Packet. Handles pointer size & endianness
    rf  )rM   rM   r   N)rv   rw   rx   r…   rd  Ú	ALIGNMENTrm  rj   rj   rj   rk   rz  õ  s   rz  c                       s   e Zd Z‡ fdd„Z‡  ZS )ÚNDRShortFieldc                    s"   t t| ƒjt|i |¤Ždd� d S ©N)rN   rN   r  )ro   r|  rp   r!   rS  rs   rj   rk   rp   
  s    zNDRShortField.__init__ru   rj   rj   rs   rk   r|  	  s   r|  c                       s   e Zd Z‡ fdd„Z‡  ZS )ÚNDRSignedShortFieldc                    s"   t t| ƒjt|i |¤Ždd� d S r}  )ro   r~  rp   r$   rS  rs   rj   rk   rp     s    
ÿzNDRSignedShortField.__init__ru   rj   rj   rs   rk   r~    s   r~  c                       s   e Zd Z‡ fdd„Z‡  ZS )rw  c                    s"   t t| ƒjt|i |¤Ždd� d S ©Nrs  r  )ro   rw  rp   r   rS  rs   rj   rk   rp     s    zNDRIntField.__init__ru   rj   rj   rs   rk   rw    s   rw  c                       s   e Zd Z‡ fdd„Z‡  ZS )ÚNDRSignedIntFieldc                    s"   t t| ƒjt|i |¤Ždd� d S r  )ro   r€  rp   r"   rS  rs   rj   rk   rp     s    
ÿzNDRSignedIntField.__init__ru   rj   rj   rs   rk   r€    s   r€  c                       s   e Zd Z‡ fdd„Z‡  ZS )rv  c                    s"   t t| ƒjt|i |¤Ždd� d S ©Nrr  r  )ro   rv  rp   r   rS  rs   rj   rk   rp   "  s    zNDRLongField.__init__ru   rj   rj   rs   rk   rv  !  s   rv  c                       s   e Zd Z‡ fdd„Z‡  ZS )ÚNDRSignedLongFieldc                    s"   t t| ƒjt|i |¤Ždd� d S r�  )ro   r‚  rp   r#   rS  rs   rj   rk   rp   '  s    
ÿzNDRSignedLongField.__init__ru   rj   rj   rs   rk   r‚  &  s   r‚  c                       s   e Zd Z‡ fdd„Z‡  ZS )ÚNDRIEEEFloatFieldc                    s"   t t| ƒjt|i |¤Ždd� d S r  )ro   rƒ  rp   r   rS  rs   rj   rk   rp   .  s    
ÿzNDRIEEEFloatField.__init__ru   rj   rj   rs   rk   rƒ  -  s   rƒ  c                       s   e Zd Z‡ fdd„Z‡  ZS )ÚNDRIEEEDoubleFieldc                    s"   t t| ƒjt|i |¤Ždd� d S r�  )ro   r„  rp   r   rS  rs   rj   rk   rp   5  s    
ÿzNDRIEEEDoubleField.__init__ru   rj   rj   rs   rk   r„  4  s   r„  c                   @   s$   e Zd ZddgZdd„ Zdd„ ZdS )Ú_NDREnumFieldz<Hú<Ic                 C   s*   | j |j }ttdd|d�dd� ||¡S ©Nr²   r   rŸ   ©rN   rP   r  ©ÚFMTSrL  rj  r   rè   ©rq   ri   rV  r    rj   rj   rk   rè   B  s    z_NDREnumField.getfieldc                 C   s,   | j |j }ttdd|d�dd� |||¡S r‡  ©rŠ  rL  rj  r   rë   ©rq   ri   rV  Úvalr    rj   rj   rk   rë   F  s    z_NDREnumField.addfieldN©rv   rw   rx   rŠ  rè   rë   rj   rj   rj   rk   r…  >  s   r…  c                       s   e Zd Z‡ fdd„Z‡  ZS )ÚNDRInt3264EnumFieldc                    s"   t t| ƒjt|i |¤Ždd� d S )Nrˆ  r  )ro   r�  rp   r…  rS  rs   rj   rk   rp   L  s    
ÿzNDRInt3264EnumField.__init__ru   rj   rj   rs   rk   r�  K  s   r�  c                       s   e Zd Z‡ fdd„Z‡  ZS )ÚNDRIntEnumFieldc                    s"   t t| ƒjt|i |¤Ždd� d S r  )ro   r‘  rp   r   rS  rs   rj   rk   rp   T  s    
ÿzNDRIntEnumField.__init__ru   rj   rj   rs   rk   r‘  R  s   r‘  c                   @   s$   e Zd ZddgZdd„ Zdd„ ZdS )ÚNDRInt3264Fieldr†  ú<Qc                 C   s*   | j |j }ttdd|d�dd� ||¡S ©Nr²   r   rŸ   ©rP   rT   r  r‰  r‹  rj   rj   rk   rè   `  s    zNDRInt3264Field.getfieldc                 C   s,   | j |j }ttdd|d�dd� |||¡S r”  rŒ  r�  rj   rj   rk   rë   d  s    zNDRInt3264Field.addfieldNr�  rj   rj   rj   rk   r’  ]  s   r’  c                   @   s   e Zd ZddgZdS )ÚNDRSignedInt3264Fieldz<iz<qN)rv   rw   rx   rŠ  rj   rj   rj   rk   r–  i  s   r–  c                   @   s:   e Zd Zeeddƒdd„ fgeddƒƒeddejƒgZ	dS )Ú
NDRPointerÚreferent_idrM   c                 C   s
   | o| j S r³   r\  rh   rj   rj   rk   r´   s  rµ   zNDRPointer.<lambda>ÚvalueN)
rv   rw   rx   r&   r:   r9   r'   r   r×   r§   rj   rj   rj   rk   r—  p  s   þûr—  c                   @   sV   e Zd ZdZdZddd„Zdd„ Zdd	„ Zd
d„ Zdd„ Z	dd„ Z
dd„ Zdd„ ZdS )ÚNDRFullPointerFielda  
    A NDR Full/Unique pointer field encapsulation.

    :param deferred: This pointer is deferred. This means that it's representation
                     will not appear after the pointer.
                     See [C706] 14.3.12.3 - Algorithm for Deferral of Referents
    FÚIc                 C   s   || _ d | _|| _d S r³   )rr   ÚdefaultÚdeferred)rq   rr   r�  r    rj   rj   rk   rp   …  s    zNDRFullPointerField.__init__c                 C   s¢   ddg|j  }ttdd|d�dd� ||¡\}}| jsF|dkrF|d fS | jr|t|j |d�}|j |t	| j
j|ƒf¡ ||fS | j
 ||¡\}}|t|j ||d	�fS )
Nr†  r“  r²   r   rŸ   r•  r  )rL  r˜  ©rL  r˜  r™  )rL  rj  r   rè   ÚEMBEDDEDr�  r—  rP  Úappendr   rr   )rq   ri   rV  r    Úremainr˜  ÚptrrŽ  rj   rj   rk   rè   Š  s    ÿzNDRFullPointerField.getfieldc                    s¶   ˆd ur t ˆtƒs tdˆj ƒ‚ddgˆ j }ttdd|d�dd�}ˆjs`ˆd u r`| ˆ |d¡S t	ˆj
ˆ jƒ | ˆ |ˆj¡}ˆjr¤ˆ j ‡ ‡‡fd	d
„ˆf¡ |S ˆj ˆ |ˆj
¡S )Nz2Expected NDRPointer in %s. You are using it wrong!r†  r“  r²   r   rŸ   r•  r  c                    s   ˆj  ˆ | ˆj¡S r³   )rr   rë   r™  )rV  ©ri   rq   rŽ  rj   rk   r´   ¨  rµ   z.NDRFullPointerField.addfield.<locals>.<lambda>)rÏ   r—  r=  r¢   rL  rj  r   rŸ  rë   rO  r™  r˜  r�  rP  r   rr   )rq   ri   rV  rŽ  r    rr   rj   r£  rk   rë   ™  s     ÿÿzNDRFullPointerField.addfieldc                 C   s,   |d ur(t |tƒs(td| j ||¡d�S |S )Né   )r˜  r™  )rÏ   r—  rr   Úany2i©rq   ri   rà   rj   rj   rk   r¥  ­  s    þzNDRFullPointerField.any2ic                 C   s   t |ƒS r³   ©Úrepr©rq   ri   rŽ  rj   rj   rk   Úi2repr·  s    zNDRFullPointerField.i2reprc                 C   s   |S r³   rj   r¦  rj   rj   rk   Úi2hº  s    zNDRFullPointerField.i2hc                 C   s   |S r³   rj   r¦  rj   rj   rk   Úh2i½  s    zNDRFullPointerField.h2ic                 C   s   dS ©NrM   rj   r¦  rj   rj   rk   Úi2countÀ  s    zNDRFullPointerField.i2countN)Fr›  )rv   rw   rx   r…   rŸ  rp   rè   rë   r¥  rª  r«  r¬  r®  rj   rj   rj   rk   rš  z  s   

rš  c                   @   s   e Zd ZdZdZdS )ÚNDRRefEmbPointerFieldz*
    A NDR Embedded Reference pointer
    TN)rv   rw   rx   r…   rŸ  rj   rj   rj   rk   r¯  Ä  s   r¯  c                       s8   e Zd Zdd„ Zdd„ Z‡ fdd„Z‡ fdd„Z‡  ZS )	ÚNDRConstructedTypec                 C   s   d| _ || _|  ¡  d S ©NF)Úhandles_deferredÚ
ndr_fieldsÚrec_check_deferral)rq   rW  rj   rj   rk   rp   Ó  s    zNDRConstructedType.__init__c                 C   sJ   | j D ]>}t|tƒr |jr d| _t|tƒr| ¡  |jrd| _d|_qd S )NTF)r³  rÏ   rš  r�  r²  r°  r´  rY  rj   rj   rk   r´  Ø  s    

z%NDRConstructedType.rec_check_deferralc                    s¬   t t| ƒ ||¡\}}t|tƒr:|j |j¡ |jd d …= | jr¤tƒ }| |j¡ |jd d …= |r¤| 	¡ \}}||ƒ\}}||_
t|tƒr^| |j¡ |jd d …= q^||fS r³   )ro   r°  rè   rÏ   rK  rP  Úextendr²  r   Úpopleftr™  )rq   ri   rV  ÚfvalÚqr¢  ZgetfldrŽ  rs   rj   rk   rè   å  s     

zNDRConstructedType.getfieldc                    s¬   t t| ƒ |||¡}t|tƒr8|j |j¡ |jd d …= | jr¨tƒ }| |j¡ |jd d …= |r¨| 	¡ \}}||ƒ}t|t
ƒr\t|jtƒr\| |jj¡ |jjd d …= q\|S r³   )ro   r°  rë   rÏ   rK  rP  rµ  r²  r   r¶  r—  r™  )rq   ri   rV  rŽ  r¸  Zaddfldr·  rs   rj   rk   rë   ü  s    
zNDRConstructedType.addfield)rv   rw   rx   rp   r´  rè   rë   ry   rj   rj   rs   rk   r°  Ò  s   r°  c                   @   s   e Zd Zdd„ ZdS )Ú_NDRPacketFieldc                 C   s   | j ||j|d�S )N)rL  Ú_parent)r   rL  )rq   ri   Úmrj   rj   rk   Úm2i  s    z_NDRPacketField.m2iN)rv   rw   rx   r¼  rj   rj   rj   rk   r¹    s   r¹  c                   @   s   e Zd Zdd„ ZdS )ÚNDRPacketFieldc                 K   s:   t ||fd|i|¤Ž}tj| ||jd� t | |j¡ d S )NÚpkt_clsr  )r¹  rj  rp   r{  r°  r§   )rq   r¢   rœ  r¾  rT  rr   rj   rj   rk   rp     s    ûzNDRPacketField.__init__N)rv   rw   rx   rp   rj   rj   rj   rk   r½    s   r½  c                   @   s@   e Zd ZdZdZdZddgZdd„ Zdd„ Zd	d
„ Z	dd„ Z
dS )Ú_NDRPacketListFieldzY
    A PacketListField for NDR that can optionally pack the packets into NDRPointers
    rM   Úptr_packrr   c                 K   sh   |  dd¡| _tj| ||fd|i|¤Ž | jrFttdd |ƒdd�| _ntdd |ƒ| _t | | jg¡ d S )NrÀ  Fr¾  r²   T)r�  )rR  rÀ  r)   rp   rš  r½  rr   r°  )rq   r¢   rœ  r¾  rT  rj   rj   rk   rp   6  s    ÿ
z_NDRPacketListField.__init__c                 C   s&   | j  ||¡\}}| t |¡¡ |S r³   )rr   rè   Zadd_payloadr   rÒ   )rq   ri   rV  r¡  rŽ  rj   rj   rk   r¼  A  s    z_NDRPacketListField.m2ic                 C   s   | j  |d|¡S )Nrµ   )rr   rë   r©  rj   rj   rk   Úi2mH  s    z_NDRPacketListField.i2mc                 C   s   t |ƒS r³   )r{   r¦  rj   rj   rk   Úi2lenK  s    z_NDRPacketListField.i2lenN)rv   rw   rx   r…   ÚislistZholds_packetsrd  rp   r¼  rÁ  rÂ  rj   rj   rj   rk   r¿  ,  s   r¿  c                   @   s   e Zd ZdZdZdd„ ZdS )ÚNDRFieldListFieldz"
    A FieldListField for NDR
    rM   c                 O   s,   t j| g|¢R i |¤Ž t | | jg¡ d S r³   )r   rp   r°  ÚfieldrS  rj   rj   rk   rp   V  s    zNDRFieldListField.__init__N)rv   rw   rx   r…   rÃ  rp   rj   rj   rj   rk   rÄ  O  s   rÄ  c                   @   sX   e Zd Zeeddƒdd„ fgeddƒƒeeddƒdd„ fgeddƒƒeddejƒgZ	dS )	ÚNDRVaryingArrayÚoffsetr   c                 C   s
   | o| j S r³   r\  rh   rj   rj   rk   r´   ^  rµ   zNDRVaryingArray.<lambda>Úactual_countNc                 C   s
   | o| j S r³   r\  rh   rj   rj   rk   r´   e  rµ   r™  )
rv   rw   rx   r&   r   r   r'   r   r×   r§   rj   rj   rj   rk   rÆ  [  s   þþÿù	òrÆ  c                       s`   e Zd Z‡ fdd„Z‡ fdd„Z‡ fdd„Z‡ fdd„Zd	d
„ Zdd„ Zdd„ Z	dd„ Z
‡  ZS )Ú_NDRVarFieldc              	      sŒ   ddg|j  }ttdd|d�dd� ||¡\}}ttdd|d�dd� ||¡\}}tt| ƒ ||¡\}}|t|j ||tt| ƒ ||¡d�fS )	Nr†  r“  r²   r   rŸ   r•  r  )rL  rÇ  rÈ  r™  )rL  rj  r   rè   ro   rÉ  rÆ  r«  )rq   ri   rV  r    r¡  rÇ  rÈ  rŽ  rs   rj   rk   rè   o  s    "ÿüz_NDRVarField.getfieldc                    sº   t |tƒstd| j ƒ‚ddg|j }t|j|jƒ ttdd|d�dd� 	|||j
¡}ttdd|d�dd� 	|||jd u rŽtt| ƒ ||j¡p’|j¡}tt| ƒ 	||tt| ƒ ||j¡¡S )	Nz7Expected NDRVaryingArray in %s. You are using it wrong!r†  r“  r²   r   rŸ   r•  r  )rÏ   rÆ  r=  r¢   rL  rO  r™  rj  r   rë   rÇ  rÈ  ro   rÉ  rÂ  r¬  r�  rs   rj   rk   rë   }  s$    
ÿ"
ÿû
ÿz_NDRVarField.addfieldc                    s   t t| ƒ ||j¡S r³   )ro   rÉ  rÂ  r™  r¦  rs   rj   rk   rÂ  �  s    z_NDRVarField.i2lenc                    s&   t |tƒs"ttt| ƒ ||¡d�S |S ©N)r™  )rÏ   rÆ  ro   rÉ  r¥  r¦  rs   rj   rk   r¥  “  s
    
ÿz_NDRVarField.any2ic                 C   s   t |ƒS r³   r§  r©  rj   rj   rk   rª  œ  s    z_NDRVarField.i2reprc                 C   s   |S r³   rj   r¦  rj   rj   rk   r«  Ÿ  s    z_NDRVarField.i2hc                 C   s   |S r³   rj   r¦  rj   rj   rk   r¬  ¢  s    z_NDRVarField.h2ic                 C   s   dS r­  rj   r¦  rj   rj   rk   r®  ¥  s    z_NDRVarField.i2count)rv   rw   rx   rè   rë   rÂ  r¥  rª  r«  r¬  r®  ry   rj   rj   rs   rk   rÉ  n  s   	rÉ  c                   @   sB   e Zd Zeeddƒdd„ fgeddƒƒedg ejdd„ d�gZ	dS )ÚNDRConformantArrayrn  Nc                 C   s
   | o| j S r³   r\  rh   rj   rj   rk   r´   ¬  rµ   zNDRConformantArray.<lambda>r™  c                 C   s   | j S r³   )rn  rh   rj   rj   rk   r´   °  rµ   rq  )
rv   rw   rx   r&   r   r   r)   r   r×   r§   rj   rj   rj   rk   rË  ©  s   þÿûrË  c                   @   s6   e Zd Zeeddƒdd„ fgeddƒƒeddƒgZdS )ÚNDRConformantStringrn  Nc                 C   s
   | o| j S r³   r\  rh   rj   rj   rk   r´   ¸  rµ   zNDRConformantString.<lambda>r™  r²   )rv   rw   rx   r&   r   r   r/   r§   rj   rj   rj   rk   rÌ  µ  s   þûrÌ  c                       sp   e Zd ZdZ‡ fdd„Z‡ fdd„Z‡ fdd„Z‡ fdd	„Z‡ fd
d„Zdd„ Z	dd„ Z
dd„ Zdd„ Z‡  ZS )Ú_NDRConfFieldFc                    s(   |  dd¡| _tt| ƒj|i |¤Ž d S )NÚconformant_in_structF)rR  rÎ  ro   rÍ  rp   rS  rs   rj   rk   rp   Â  s    z_NDRConfField.__init__c                    s|   ddg|j  }| jr&tt| ƒ ||¡S ttdd|d�dd� ||¡\}}tt| ƒ ||¡\}}|| jrjtnt	|j ||d�fS )	Nr†  r“  r²   r   rŸ   r•  r  )rL  rn  r™  )
rL  rÎ  ro   rÍ  rè   rj  r   ÚCONFORMANT_STRINGrÌ  rË  )rq   ri   rV  r    r¡  rn  rŽ  rs   rj   rk   rè   Æ  s    ÿþz_NDRConfField.getfieldc                    sè   | j rtt| ƒ |||¡S | jr:t|tƒs:td| j ƒ‚n| jsXt|t	ƒsXtd| j ƒ‚ddg|j
 }t|j|j
ƒ t|jd tƒr�|jd }n|j}ttdd|d�dd	� |||jd u rÌtt| ƒ ||¡pÐ|j¡}tt| ƒ |||¡S )
Nz;Expected NDRConformantString in %s. You are using it wrong!z:Expected NDRConformantArray in %s. You are using it wrong!r†  r“  r   r²   rŸ   r•  r  )rÎ  ro   rÍ  rë   rÏ  rÏ   rÌ  r=  r¢   rË  rL  rO  r™  rÆ  rj  r   rn  rÂ  )rq   ri   rV  rŽ  r    r™  rs   rj   rk   rë   Ó  s4    ÿÿÿ
ÿûz_NDRConfField.addfieldc                    s:   | j s"t|jd tƒr"|jd }n|j}tt| ƒ ||¡S rÎ   )rÏ  rÏ   r™  rÆ  ro   rÍ  rÂ  )rq   ri   rà   r™  rs   rj   rk   rÂ  î  s    z_NDRConfField.i2lenc                    sX   | j r
|S | jr2t|tƒs2ttt| ƒ ||¡d�S t|tƒsTttt| ƒ ||¡d�S |S rÊ  )rÎ  rÏ  rÏ   rÌ  ro   rÍ  r¥  rË  r¦  rs   rj   rk   r¥  õ  s    ÿ
ÿz_NDRConfField.any2ic                 C   s   t |ƒS r³   r§  r©  rj   rj   rk   rª    s    z_NDRConfField.i2reprc                 C   s   |S r³   rj   r¦  rj   rj   rk   r«    s    z_NDRConfField.i2hc                 C   s   |S r³   rj   r¦  rj   rj   rk   r¬  
  s    z_NDRConfField.h2ic                 C   s   dS r­  rj   r¦  rj   rj   rk   r®    s    z_NDRConfField.i2count)rv   rw   rx   rÏ  rp   rè   rë   rÂ  r¥  rª  r«  r¬  r®  ry   rj   rj   rs   rk   rÍ  ¿  s   rÍ  c                   @   s   e Zd ZdZdS )ÚNDRVarPacketListFieldz%
    NDR Varying PacketListField
    N©rv   rw   rx   r…   rj   rj   rj   rk   rÐ    s   rÐ  c                   @   s   e Zd ZdZdS )ÚNDRConfPacketListFieldz(
    NDR Conformant PacketListField
    NrÑ  rj   rj   rj   rk   rÒ    s   rÒ  c                   @   s   e Zd ZdZdS )ÚNDRConfVarPacketListFieldz0
    NDR Conformant Varying PacketListField
    NrÑ  rj   rj   rj   rk   rÓ  !  s   rÓ  c                   @   s   e Zd ZdZdS )ÚNDRConfFieldListFieldz'
    NDR Conformant FieldListField
    NrÑ  rj   rj   rj   rk   rÔ  )  s   rÔ  c                   @   s   e Zd ZdZdS )ÚNDRConfVarFieldListFieldz/
    NDR Conformant Varying FieldListField
    NrÑ  rj   rj   rj   rk   rÕ  1  s   rÕ  c                   @   s   e Zd ZdZdZdS )ÚNDRConfStrLenFieldz‡
    NDR Conformant StrLenField.

    This is not a "string" per NDR, but an a conformant byte array
    (e.g. tower_octet_string)
    TN)rv   rw   rx   r…   rÏ  rj   rj   rj   rk   rÖ  <  s   rÖ  c                   @   s   e Zd ZdZdZdZdS )ÚNDRConfStrLenFieldUtf16zN
    NDR Conformant StrLenField.

    See NDRConfLenStrField for comment.
    TFN)rv   rw   rx   r…   rÏ  ÚON_WIRE_SIZE_UTF16rj   rj   rj   rk   r×  G  s   r×  c                   @   s   e Zd ZdZdS )ÚNDRVarStrLenFieldú!
    NDR Varying StrLenField
    NrÑ  rj   rj   rj   rk   rÙ  R  s   rÙ  c                   @   s   e Zd ZdZdZdS )ÚNDRVarStrLenFieldUtf16rÚ  FN©rv   rw   rx   r…   rØ  rj   rj   rj   rk   rÛ  Z  s   rÛ  c                   @   s   e Zd ZdZdS )ÚNDRConfVarStrLenFieldú,
    NDR Conformant Varying StrLenField
    NrÑ  rj   rj   rj   rk   rÝ  b  s   rÝ  c                   @   s   e Zd ZdZdZdS )ÚNDRConfVarStrLenFieldUtf16rÞ  FNrÜ  rj   rj   rj   rk   rß  j  s   rß  c                   @   s   e Zd ZdZdS )ÚNDRConfVarStrNullFieldú2
    NDR Conformant Varying StrNullFieldUtf16
    NrÑ  rj   rj   rj   rk   rà  r  s   rà  c                   @   s   e Zd ZdZdZdS )ÚNDRConfVarStrNullFieldUtf16rá  FNrÜ  rj   rj   rj   rk   râ  z  s   râ  c                   @   s$   e Zd ZeddƒeddejƒgZdS )ÚNDRUnionÚtagr   r™  N)rv   rw   rx   r   r'   r   r×   r§   rj   rj   rj   rk   rã  …  s   þrã  c                       s`   e Zd ZddgZ‡ fdd„Z‡ fdd„Z‡ fdd„Z‡ fd	d
„Zdd„ Zdd„ Z	dd„ Z
‡  ZS )Ú_NDRUnionFieldÚ
switch_fmtr  c                    s"   || _ || _tt| ƒ ||¡ d S r³   )ræ  r  ro   rå  rp   ©rq   ÚfldsZdfltr  ræ  rs   rj   rk   rp   �  s    z_NDRUnionField.__init__c           	         sr   | j |j }ttdd|d�| jd� ||¡\}}tt| ƒ |t	|d�¡\}}| ||¡\}}|t	|||j|d�fS )Nr²   r   rŸ   r  )rä  )rä  r™  rL  rº  )
ræ  rL  rj  r   r  rè   ro   rå  Ú_find_fld_pkt_valrã  )	rq   ri   rV  r    r¡  rä  rr   r÷   rŽ  rs   rj   rk   rè   ”  s
    $z_NDRUnionField.getfieldc                    sj   | j |j }t|tƒs$td| j ƒ‚t|j|jƒ tt	dd|d�| j
d� |||j¡}tt| ƒ |||¡S )Nz0Expected NDRUnion in %s. You are using it wrong!r²   r   rŸ   r  )ræ  rL  rÏ   rã  r=  r¢   rO  r™  rj  r   r  rë   rä  ro   rå  r�  rs   rj   rk   rë   ›  s    
ÿ$z_NDRUnionField.addfieldc                    s    t t| ƒ ||¡\}}||jfS r³   )ro   rå  ré  r™  )rq   ri   rŽ  rr   rs   rj   rk   ré  §  s    z _NDRUnionField._find_fld_pkt_valc                 C   s   t |ƒS r³   r§  r©  rj   rj   rk   rª  ¬  s    z_NDRUnionField.i2reprc                 C   s   |S r³   rj   r¦  rj   rj   rk   r«  ¯  s    z_NDRUnionField.i2hc                 C   s   |S r³   rj   r¦  rj   rj   rk   r¬  ²  s    z_NDRUnionField.h2i)rv   rw   rx   rd  rp   rè   rë   ré  rª  r«  r¬  ry   rj   rj   rs   rk   rå  Œ  s   rå  c                   @   s   e Zd Zdd„ Zdd„ ZdS )ÚNDRUnionFieldc                 C   s4   t j| ||||d� t | dd„ |D ƒ|g ¡ d S )N)r  ræ  c                 S   s   g | ]}|d  ‘qS )r   rj   rC  rj   rj   rk   Ú
<listcomp>¹  rµ   z*NDRUnionField.__init__.<locals>.<listcomp>)rå  rp   r°  rç  rj   rj   rk   rp   ·  s    zNDRUnionField.__init__c                 C   s2   |r.t |tƒstd| j ƒ‚nt | ||¡|_|S )Nz(Invalid value for %s; should be NDRUnion)rÏ   rã  r=  r¢   rå  r¥  r™  r¦  rj   rj   rk   r¥  »  s
    
zNDRUnionField.any2iN)rv   rw   rx   rp   r¥  rj   rj   rj   rk   rê  ¶  s   rê  c                       s2   e Zd ZdZd	‡ fdd„	Zdd„ Zdd„ Z‡  ZS )
ÚNDRRecursiveFieldz<
    A special Field that is used for pointer recursion
    r›  c                    s   t t| ƒj|d |d� d S )NrŸ   )ro   rì  rp   )rq   r¢   r    rs   rj   rk   rp   Í  s    zNDRRecursiveField.__init__c                 C   s„   ddg|j  \}}|d |… d| kr6||d … d fS t ||d |… ¡d }tdd |jƒ |||d … ¡\}}|t|j ||d�fS )N)r†  rP   )r“  rT   ræ   r   r²   rž  )rL  ré   rò   r½  rt   rè   r—  )rq   ri   rV  r    Úszr˜  r¡  rŽ  rj   rj   rk   rè   Ð  s    "zNDRRecursiveField.getfieldc                 C   s.   |d u r"ddg|j  }|d|  S |t|ƒ S )NrP   rT   ræ   )rL  r]  )rq   ri   rV  rŽ  rí  rj   rj   rk   rë   Ø  s    zNDRRecursiveField.addfield)r›  )rv   rw   rx   r…   rp   rè   rë   ry   rj   rj   rs   rk   rì  È  s   rì  c                   @   s0   e Zd ZdZeddƒedddd�gZdd	„ Zd
S )ÚNDRContextHandlers  Ú
attributesr   r4  rµ   r\   r¼   c                 C   s   t jS r³   rÑ   )rq   Úpayloadrj   rj   rk   Úguess_payload_classé  s    z$NDRContextHandle.guess_payload_classN)rv   rw   rx   r{  r   r0   r§   rñ  rj   rj   rj   rk   rî  â  s
   þrî  c                   @   s8   e Zd Zeddƒedddddœƒedd	ƒed
dƒgZdS )ÚNDRSerialization1HeaderÚVersionrM   Z
Endiannessr   z
Big-endianzLittle-endian)r   r\   ZCommonHeaderLengthrT   ÚFillerl   ÌL™ N)rv   rw   rx   r   r   r!   r9   r§   rj   rj   rj   rk   rò  ð  s
   ürò  c                   @   s    e Zd ZeddƒeddƒgZdS )ÚNDRSerialization1PrivateHeaderÚObjectBufferLengthr   rô  N)rv   rw   rx   r   r§   rj   rj   rj   rk   rõ  ù  s   þrõ  Fc              	   C   s|   t |tƒr\t| dd… ƒt| dd… ƒ t|t d| dd… ¡d || dd… |d�d� S t| dd… ƒ|| dd… ƒ S )	zT
    Deserialize Type Serialization Version 1 according to [MS-RPCE] sect 2.2.6
    NrT   r\   r†  é   r   r\  rž  )Ú
issubclassrz  rò  rõ  r—  ré   rò   )Úbr   rL  rj   rj   rk   Úndr_deserialize1   s    
ÿýþÿ	rú  c                 C   s�   |   ¡ } t| tƒs^t| tƒrPt| tƒs4t|d| d�} tƒ tt| jƒd� |  } nttƒ |  ƒS t	 
d| j¡t| jƒ }| t j ¡  t| ƒ| S )z0
    Serialize Type Serialization Version 1
    r¤  rž  )rö  r†  )r[  rÏ   rò  rz  r—  rõ  r{   r™  r]  ré   rê   r˜  rŠ   Úremove_payload)ri   rL  rì   rj   rj   rk   Úndr_serialize1  s"    


ÿÿüÿrü  c                       s<   e Zd ZdZ‡ fdd„Zdd„ Zdd„ Z‡ fdd	„Z‡  ZS )
rô   z0
    A DCE/RPC session within a TCP socket.
    c                    s,   d | _ d| _i | _tt| ƒj|i |¤Ž d S r±  )Úrpc_bind_interfacerL  Úmap_callid_opnumro   rô   rp   rS  rs   rj   rk   rp   0  s    zDceRpcSession.__init__c                 C   s~   t |v }z| jj| | }W n( tyD   t d|| jf ¡ Y d S 0 |t|tj ƒfd| j	i|¤Ž}|tj j
 ¡  || S )Nz!Unknown opnum %s for interface %srL  )r0  rý  r:  ÚKeyErrorr   Úwarningr]  r   r×   rL  rŠ   rû  )rq   ri   rœ   ÚoptsZis_responser   rð  rj   rj   rk   Ú_parse_with_opnum6  s    ÿÿ zDceRpcSession._parse_with_opnumc              	   C   sP  d }i }t |v rV|jD ]<}|jj}zt| | _W q tyP   t d| ¡ Y q0 qn²t	|v r�|t	 j
D ]$}|jdkrh|j d¡dkrhd| _qhnxt|v r¶|j}||t jf| j|j< nRt|v �rz"| j|j \}|d< | j|j= W n$ t�y   t d|j ¡ Y n0 |j�r |j ¡ �r |S |d u�rL| j�rLtj|v �rL|  |||¡}|S )Nz-Unknown RPC interface %s. Try loading the IDLr   z	%if_uuid%rû   TrQ  z%Unknown call_id %s in DCE/RPC session)r  r  r  rý   r<  rý  rÿ  r   r   r  r  r  r  ZsprintfrL  r/  rœ   rð  rþ  rã   r0  Úinforß   rÐ   r   r×   r  )rq   ri   rœ   r  Úctxrý   Úresrj   rj   rk   rõ   F  s<    
ÿ


z$DceRpcSession._process_dcerpc_packetc                    s.   t |v rtt| ƒ |  |¡¡S tt| ƒ |¡S r³   )r~   ro   rô   Úon_packet_receivedrõ   rÓ   rs   rj   rk   r  m  s
    
ÿz DceRpcSession.on_packet_received)	rv   rw   rx   r…   rp   r  rõ   r  ry   rj   rj   rs   rk   rô   +  s
   'rô   c                   @   s.   e Zd ZdZg Zeddd„ƒZedd„ ƒZdS )ÚDceRpc4PayloadzADummy class which use the dispatch_hook to find the payload classNc                 O   s6   | j D ]"}t|dƒr| ||¡r|  S qtdƒ tS )z;dispatch_hook to choose among different registered payloadsÚ
can_handlez8DCE/RPC payload class not found or undefined (using Raw))Ú_payload_classÚhasattrr  Úprintr   )r   r€   Z_underlayerr�   r‚   Úklassrj   rj   rk   r„   ‹  s
    

zDceRpc4Payload.dispatch_hookc                 C   s   | j  |¡ dS )zXMethod to call from possible DCE/RPC endpoint to register it as
        possible payloadN)r	  r   )r   rì   rj   rj   rk   Úregister_possible_payload”  s    z(DceRpc4Payload.register_possible_payload)N)rv   rw   rx   r…   r	  r†   r„   r  rj   rj   rj   rk   r  †  s   r  )F)F)¾r…   Ú	functoolsr   Úcollectionsr   r   ré   r4  r   Zscapy.base_classesr   Zscapy.configr   Zscapy.errorr   Zscapy.layers.dnsr	   Zscapy.layers.ntlmr
   Zscapy.packetr   r   r   r   r   Zscapy.fieldsr   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r0   r1   r2   r3   r4   r5   r6   r7   r8   r9   r:   r;   r<   r=   Zscapy.sessionsr>   Zscapy.layers.kerberosr?   r@   rA   Zscapy.layers.gssapirB   Zscapy.layers.inetrC   Zscapy.contrib.rtps.common_typesrD   rE   rF   rG   Zscapy.libs.sixZlibsÚsixr£   r¤   r¥   rl   rm   rz   r‰   r¦   r}   r¨   r¶   rÕ   rÖ   rÂ   rú   r.  r~   rÿ   r   r  rü   r  r  r
  r  r  r  r  r"  r%  r&  r'  r)  r/  r0  r1  r<  r2  rA  rJ  rO  rK  re  rj  rl  Úadd_metaclassrz  ZNDRByteFieldZNDRSignedByteFieldr|  r~  rw  r€  rv  r‚  rƒ  r„  r…  r�  r‘  r’  r–  r—  rš  r¯  r›   r°  r¹  r½  r¿  rÄ  rÆ  rÉ  rË  rÌ  rÍ  rÐ  rÒ  rÓ  rÔ  rÕ  rÖ  r×  rÙ  rÛ  rÝ  rß  rà  râ  rã  rå  rê  rì  rî  rò  rõ  rú  rü  rô   r  rj   rj   rj   rk   Ú<module>
   s†  À0ì
ü&1*øø[ùìYü
	92

J=#;
R*	[