Module: RubySMB::Dcerpc::Ndr::StructPlugin

Includes:

ConstructedTypePlugin

Defined in:

lib/ruby_smb/dcerpc/ndr.rb

Overview

Structures

Instance Method Summary

• #bytes_to_align(obj, rel_offset) ⇒ Object
• #do_num_bytes ⇒ Object
• #do_read(io) ⇒ Object
• #do_write(io) ⇒ Object
• #retrieve_max_count ⇒ Object
• #set_max_count(val) ⇒ Object
• #should_process_max_count? ⇒ Boolean

Methods included from ConstructedTypePlugin

#defer_ptr, #do_num_bytes_ptr, #get_top_level_constructed_type, #has_deferred_ptrs?, #initialize_instance, #is_deferring, #read_ptr, #write_ptr

Instance Method Details

#bytes_to_align(obj, rel_offset) ⇒ Object

# File 'lib/ruby_smb/dcerpc/ndr.rb', line 784

def bytes_to_align(obj, rel_offset)
  if obj.is_a?(PointerPlugin)
    # Pointers are always 4-bytes aligned
    return (4 - (rel_offset % 4)) % 4
  end
  if obj.is_a?(ConfPlugin)
    # `max_count` should have been handled at the beginning of the structure
    # already. We need to fix `rel_offset` since it includes the
    # `max_count` 4 bytes, plus the possible padding bytes needed to align
    # the structure. This is required because BinData Struct is not
    # aware of `max_count` and consider the first field to be the beginning
    # of the structure instead. We have to make sure the alignment is
    # calculated from the beginning of the structure.
    align = eval_parameter(:byte_align)
    pad_length = (align - (4 % align)) % align
    rel_offset += (4 + pad_length)

    # We need to handle another corner case, which is a Conformant array
    # (not Varying). The size information (max_count) has been place in
    # from of the structure and no other size information is present before
    # the actual elements of the array. Therefore, the alignment must be
    # done according to the rules of the elements. Since a NdrArray has its
    # default :byte_align value set to 4 (:max_count size), we have to make
    # sure the element size is used instead.
    unless obj.is_a?(VarPlugin)
      return obj.align_element_size(rel_offset)
    end
  end
  is_a?(BinData::ByteAlignPlugin) ? super : 0

end

#do_num_bytes ⇒ Object

# File 'lib/ruby_smb/dcerpc/ndr.rb', line 760

def do_num_bytes
  sum = 0

  if should_process_max_count?
    # count max_count (4 bytes)
    max_count = retrieve_max_count
    sum += 4 if max_count

    if respond_to?(:referent_bytes_align)
      sum += referent_bytes_align(sum)
    elsif has_parameter?(:byte_align)
      sum += bytes_to_align(self, sum)
    end
  end

  sum += super

  if has_deferred_ptrs?
    sum += do_num_bytes_ptr(sum)
  end

  sum
end

#do_read(io) ⇒ Object

# File 'lib/ruby_smb/dcerpc/ndr.rb', line 723

def do_read(io)
  if should_process_max_count?
    max_count = io.readbytes(4).unpack1('L<')
    BinData.trace_message do |tracer|
      tracer.trace_obj("#{debug_name}.max_count", max_count.to_s)
    end
    set_max_count(max_count)

    # Align the structure according to the alignment rules for the structure
    if respond_to?(:referent_bytes_align)
      io.seekbytes(referent_bytes_align(io.offset))
    elsif has_parameter?(:byte_align)
      io.seekbytes(bytes_to_align(self, io.offset))
    end
  end

  super

  if has_deferred_ptrs?
    read_ptr(io)
  end
end

#do_write(io) ⇒ Object

# File 'lib/ruby_smb/dcerpc/ndr.rb', line 703

def do_write(io)
  if should_process_max_count?
    max_count = retrieve_max_count
    io.writebytes([max_count].pack('L<')) if max_count

    # Align the structure according to the alignment rules for the structure
    if respond_to?(:referent_bytes_align)
      io.writebytes("\x00" * referent_bytes_align(io.offset))
    elsif has_parameter?(:byte_align)
      io.writebytes("\x00" * bytes_to_align(self, io.offset))
    end
  end

  super

  if has_deferred_ptrs?
    write_ptr(io)
  end
end

#retrieve_max_count ⇒ Object

# File 'lib/ruby_smb/dcerpc/ndr.rb', line 746

def retrieve_max_count
  obj = self[field_names.last]
  return obj.length if obj.is_a?(ConfPlugin)
  return obj.get_max_count(obj) if obj.is_a?(ConfStringPlugin)
  if obj.is_a?(NdrStruct)
    return obj.retrieve_max_count
  end
end

#set_max_count(val) ⇒ Object

# File 'lib/ruby_smb/dcerpc/ndr.rb', line 755

def set_max_count(val)
  obj = self[field_names.last]
  obj.set_max_count(val)
end

#should_process_max_count? ⇒ Boolean

Returns:

• (Boolean)

# File 'lib/ruby_smb/dcerpc/ndr.rb', line 674

def should_process_max_count?
  # According to the NDR definition for Structures Containing a Conformant
  # Array:
  #
  # "In the NDR representation of a structure that contains a
  # conformant array, the unsigned long integers that give maximum element
  # counts for dimensions of the array are moved to the beginning of the
  # structure, and the array elements appear in place at the end of the
  # structure. If a structure that contains a conformant array itself a
  # member of another structure, the maximum element counts are further
  # moved to the beginning of the containing structure. This construction
  # iterates through all enclosing structures."
  #
  # This only applies if the current object is the top level structure (no
  # parent). Note that if it is a pointer to a structure and the current
  # object is being deferred, :max_count still need to be processed since
  # it had not been moved to the beginning of the parent structure.
  klass = is_a?(PointerPlugin) ? self.class.superclass : self.class
  parent_obj = nil
  # TODO: possible issue: parent can be a BinData::Choice, and won't be
  # detected as a ConstructedTypePlugin, even if the embeding structure is.
  # Check this with a BinData::Choice that points to a structure embedding
  # a conformant structure
  if parent&.is_a?(ConstructedTypePlugin)
    parent_obj = parent.get_top_level_constructed_type
  end
  klass.has_conformant_array && (parent_obj.nil? || parent_obj.is_deferring(self))
end