epan/dissectors/pidl/svcctl/svcctl.cnf

   1 # Conformance file for svcctl
   2
   3 HF_FIELD hf_svcctl_service_buffer_size "Buffer Size" "svcctl.services.buffer_size" FT_UINT32 BASE_DEC NULL 0 NULL HFILL
   4 HF_FIELD hf_svcctl_service_referent_id "Referent ID(offset)" "svcctl.ENUM_SERVICE_STATUSW.referent_id" FT_UINT32 BASE_DEC NULL 0 NULL HFILL
   5
   6 MANUAL svcctl_dissect_EnumServicesStatusW_response
   7
   8 ETT_FIELD ett_svcctl_service
   9 ETT_FIELD ett_svcctl_service_name
  10 ETT_FIELD ett_svcctl_display_name
  11
  12 NOEMIT svcctl_dissect_element_EnumServicesStatusW_services
  13 NOEMIT svcctl_dissect_element_EnumServicesStatusW_bytes_needed
  14 NOEMIT svcctl_dissect_element_EnumServicesStatusW_services_returned
  15
  16 CODE START
  17
  18 /*  ENUM_SERVICE_STATUSW Caveats
  19         https://github.com/fortra/impacket/blob/4888172ce638910104da4bda2c3301c24e17564c/impacket/dcerpc/v5/scmr.py#L1274
  20 */
  21 static int
  22 svcctl_dissect_struct_ENUM_SERVICE_STATUSW_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, dcerpc_info* di, uint8_t *drep, int hf_index, int starting_offset);
  23 static int
  24 svcctl_dissect_struct_ENUM_SERVICE_STATUSW_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, dcerpc_info* di, uint8_t *drep, int hf_index, int starting_offset)
  25 {
  26         proto_item *item = NULL;
  27         proto_tree *tree = NULL;
  28         proto_tree *tr = NULL;
  29         int old_offset;
  30         uint32_t _referent_id = 0;
  31
  32         ALIGN_TO_5_BYTES;
  33
  34         old_offset = offset;
  35
  36         if (parent_tree) {
  37                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
  38                 tree = proto_item_add_subtree(item, ett_svcctl_ENUM_SERVICE_STATUSW);
  39         }
  40
  41         // Service Name
  42         tr = proto_tree_add_subtree(tree, tvb, offset, 4, ett_svcctl_service_name, NULL, "Pointer to Service Name");
  43         offset = PIDL_dissect_uint32_val(tvb, offset, pinfo, tr, di, drep, hf_svcctl_service_referent_id, 0, &_referent_id);
  44         dissect_null_term_wstring(tvb, starting_offset + _referent_id, pinfo, tr, drep, hf_svcctl_ENUM_SERVICE_STATUSW_service_name , 0);
  45
  46         // Display Name
  47         tr = proto_tree_add_subtree(tree, tvb, offset, 4, ett_svcctl_display_name, NULL, "Pointer to Display Name");
  48         offset = PIDL_dissect_uint32_val(tvb, offset, pinfo, tr, di, drep, hf_svcctl_service_referent_id, 0, &_referent_id);
  49         dissect_null_term_wstring(tvb, starting_offset + _referent_id, pinfo, tr, drep, hf_svcctl_ENUM_SERVICE_STATUSW_display_name , 0);
  50
  51         // Status
  52         offset = svcctl_dissect_element_ENUM_SERVICE_STATUSW_status(tvb, offset, pinfo, tree, di, drep);
  53
  54         proto_item_set_len(item, offset-old_offset);
  55
  56         if (di->call_data->flags & DCERPC_IS_NDR64) {
  57                 ALIGN_TO_5_BYTES;
  58         }
  59
  60         return offset;
  61 }
  62
  63 /*  REnumServicesStatusW
  64         https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/22b4ff3d-29c6-481f-b598-8ce66a46944a
  65 */
  66 static int
  67 svcctl_dissect_EnumServicesStatusW_response(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, uint8_t *drep)
  68 {
  69         uint32_t status;
  70         uint32_t services_returned= 0;
  71         proto_item *item;
  72         proto_tree  *tr           = NULL;
  73         int         services_buffer_offset;
  74         int         payload_starting_offset = offset;
  75         uint64_t buffer_size = 0;
  76
  77         ALIGN_TO_5_BYTES
  78
  79         di->dcerpc_procedure_name="EnumServicesStatusW";
  80
  81         tr = proto_tree_add_subtree(tree, tvb, offset, 0, ett_svcctl_service, &item, "Pointer to Services Status");
  82
  83         // Services Buffer Size
  84         offset = dissect_ndr_uint3264(tvb, offset, pinfo, tr, di, drep, hf_svcctl_service_buffer_size, &buffer_size);
  85         services_buffer_offset = offset;
  86
  87         offset += (int)buffer_size;
  88
  89         proto_item_set_len(item, offset-payload_starting_offset);
  90
  91         ALIGN_TO_4_BYTES
  92
  93         // Bytes Needed
  94         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_svcctl_svcctl_EnumServicesStatusW_bytes_needed, 0);
  95
  96         // Services Returned
  97         offset = PIDL_dissect_uint32_val( tvb, offset, pinfo, tree, di, drep
  98                                         , hf_svcctl_svcctl_EnumServicesStatusW_services_returned
  99                                         , 0, &services_returned);
 100
 101         // Services
 102         if (services_returned > 0){
 103                 payload_starting_offset = services_buffer_offset;
 104                 for(unsigned idx = 0; idx < services_returned ; ++idx){
 105                         services_buffer_offset = svcctl_dissect_struct_ENUM_SERVICE_STATUSW_ptr( tvb, services_buffer_offset
 106                                                                                                , pinfo, tr, di, drep
 107                                                                                                , hf_svcctl_svcctl_EnumDependentServicesW_service_status
 108                                                                                                , payload_starting_offset);
 109                 }
 110                 dissect_deferred_pointers(pinfo, tvb, services_buffer_offset, di, drep);
 111         }
 112
 113         // Resume Index
 114         offset = svcctl_dissect_element_EnumServicesStatusW_resume_index(tvb, offset, pinfo, tree, di, drep);
 115
 116         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 117
 118         // Return status
 119         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_svcctl_werror, &status);
 120
 121         if (status != 0)
 122                 col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str_ext(status, &WERR_errors_ext, "Unknown DOS error 0x%08x"));
 123
 124         return offset;
 125 }
 126
 127 CODE END