473 lines
12 KiB
C
473 lines
12 KiB
C
|
//*****************************************************************************
|
||
|
|
//
|
||
|
|
// Name: msrpc.h
|
||
|
|
//
|
||
|
|
// Description: MSRPC protocol parser.
|
||
|
|
//
|
||
|
|
// History:
|
||
|
|
// 08/1/93 t-glennc Created.
|
||
|
|
//
|
||
|
|
//*****************************************************************************
|
||
|
|
|
||
|
|
//*****************************************************************************
|
||
|
|
//
|
||
|
|
// Copyright (c) 1993 by Microsoft Corp. All rights reserved.
|
||
|
|
//
|
||
|
|
//*****************************************************************************
|
||
|
|
|
||
|
|
// MSRPC protocol property database identifiers
|
||
|
|
|
||
|
|
#define MSRPC_SUMMARY 0x00
|
||
|
|
#define MSRPC_VERSION 0x01
|
||
|
|
#define MSRPC_VERSION_MINOR 0x02
|
||
|
|
#define MSRPC_PTYPE 0x03
|
||
|
|
#define MSRPC_PFC_FLAGS1 0x04
|
||
|
|
#define MSRPC_PFC_FLAGS1_BITS 0x05
|
||
|
|
#define MSRPC_PACKED_DREP 0x06
|
||
|
|
#define MSRPC_FRAG_LENGTH 0x07
|
||
|
|
#define MSRPC_AUTH_LENGTH 0x08
|
||
|
|
#define MSRPC_CALL_ID 0x09
|
||
|
|
#define MSRPC_MAX_XMIT_FRAG 0x0A
|
||
|
|
#define MSRPC_MAX_RECV_FRAG 0x0B
|
||
|
|
#define MSRPC_ASSOC_GROUP_ID 0x0C
|
||
|
|
#define MSRPC_P_CONTEXT_SUM 0x0D
|
||
|
|
#define MSRPC_AUTH_VERIFIER 0x0E
|
||
|
|
#define MSRPC_SEC_ADDR 0x0F
|
||
|
|
#define MSRPC_PAD 0x10
|
||
|
|
#define MSRPC_P_RESULT_LIST 0x11
|
||
|
|
#define MSRPC_PROVIDER_REJECT_REASON 0x12
|
||
|
|
#define MSRPC_VERSIONS_SUPPORTED 0x13
|
||
|
|
#define MSRPC_ALLOC_HINT 0x14
|
||
|
|
#define MSRPC_PRES_CONTEXT_ID 0x15
|
||
|
|
#define MSRPC_CANCEL_COUNT 0x16
|
||
|
|
#define MSRPC_RESERVED 0x17
|
||
|
|
#define MSRPC_STATUS 0x18
|
||
|
|
#define MSRPC_RESERVED_2 0x19
|
||
|
|
#define MSRPC_STUB_DATA 0x1A
|
||
|
|
#define MSRPC_OPNUM 0x1B
|
||
|
|
#define MSRPC_OBJECT 0x1C
|
||
|
|
#define MSRPC_PFC_FLAGS2 0x1D
|
||
|
|
#define MSRPC_PFC_FLAGS2_BITS 0x1E
|
||
|
|
#define MSRPC_SERIAL_HI 0x1F
|
||
|
|
#define MSRPC_OBJECT_ID 0x20
|
||
|
|
#define MSRPC_INTERFACE_ID 0x21
|
||
|
|
#define MSRPC_ACTIVITY_ID 0x22
|
||
|
|
#define MSRPC_SERVER_BOOT_TIME 0x23
|
||
|
|
#define MSRPC_INTERFACE_VER 0x24
|
||
|
|
#define MSRPC_SEQ_NUM 0x25
|
||
|
|
#define MSRPC_INTERFACE_HINT 0x26
|
||
|
|
#define MSRPC_ACTIVITY_HINT 0x27
|
||
|
|
#define MSRPC_LEN_OF_PACKET_BODY 0x28
|
||
|
|
#define MSRPC_FRAG_NUM 0x29
|
||
|
|
#define MSRPC_AUTH_PROTO_ID 0x2A
|
||
|
|
#define MSRPC_SERIAL_LO 0x2B
|
||
|
|
#define MSRPC_CANCEL_ID 0x2C
|
||
|
|
#define MSRPC_SERVER_IS_ACCEPTING 0x2D
|
||
|
|
#define MSRPC_STATUS_CODE 0x2E
|
||
|
|
#define MSRPC_WINDOW_SIZE 0x2F
|
||
|
|
#define MSRPC_MAX_TPDU 0x30
|
||
|
|
#define MSRPC_MAX_PATH_TPDU 0x31
|
||
|
|
#define MSRPC_SERIAL_NUM 0x32
|
||
|
|
#define MSRPC_SELACK_LEN 0x33
|
||
|
|
#define MSRPC_SELACK 0x34
|
||
|
|
#define MSRPC_CANCEL_REQUEST_FMT_VER 0x35
|
||
|
|
#define MSRPC_SEQ_NUMBER 0x36
|
||
|
|
#define MSRPC_SEC_ADDR_LENGTH 0x37
|
||
|
|
#define MSRPC_SEC_ADDR_PORT 0x38
|
||
|
|
#define MSRPC_N_RESULTS 0x39
|
||
|
|
#define MSRPC_P_RESULTS 0x3A
|
||
|
|
#define MSRPC_P_CONT_DEF_RESULT 0x3B
|
||
|
|
#define MSRPC_P_PROVIDER_REASON 0x3C
|
||
|
|
#define MSRPC_P_TRANSFER_SYNTAX 0x3D
|
||
|
|
#define MSRPC_IF_UUID 0x3E
|
||
|
|
#define MSRPC_IF_VERSION 0x3F
|
||
|
|
|
||
|
|
#define MSRPC_P_CONTEXT_ELEM 0x40
|
||
|
|
#define MSRPC_NUM_TRANSFER_SYNTAX 0x41
|
||
|
|
#define MSRPC_ABSTRACT_IF_UUID 0x42
|
||
|
|
#define MSRPC_ABSTRACT_IF_VERSION 0x43
|
||
|
|
#define MSRPC_TRANSFER_IF_UUID 0x44
|
||
|
|
#define MSRPC_TRANSFER_IF_VERSION 0x45
|
||
|
|
#define MSRPC_BIND_FRAME_NUMBER 0x46
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
// MSRPC PDU TYPES
|
||
|
|
|
||
|
|
#define MSRPC_PDU_REQUEST 0
|
||
|
|
#define MSRPC_PDU_PING 1
|
||
|
|
#define MSRPC_PDU_RESPONSE 2
|
||
|
|
#define MSRPC_PDU_FAULT 3
|
||
|
|
#define MSRPC_PDU_WORKING 4
|
||
|
|
#define MSRPC_PDU_NOCALL 5
|
||
|
|
#define MSRPC_PDU_REJECT 6
|
||
|
|
#define MSRPC_PDU_ACK 7
|
||
|
|
#define MSRPC_PDU_CL_CANCEL 8
|
||
|
|
#define MSRPC_PDU_FACK 9
|
||
|
|
#define MSRPC_PDU_CANCEL_ACK 10
|
||
|
|
#define MSRPC_PDU_BIND 11
|
||
|
|
#define MSRPC_PDU_BIND_ACK 12
|
||
|
|
#define MSRPC_PDU_BIND_NAK 13
|
||
|
|
#define MSRPC_PDU_ALTER_CONTEXT 14
|
||
|
|
#define MSRPC_PDU_ALTER_CONTEXT_RESP 15
|
||
|
|
#define MSRPC_PDU_SHUTDOWN 17
|
||
|
|
#define MSRPC_PDU_CO_CANCEL 18
|
||
|
|
#define MSRPC_PDU_ORPHANED 19
|
||
|
|
|
||
|
|
|
||
|
|
// MSRPC PDU FLAGS - 1st Set
|
||
|
|
|
||
|
|
#define MSRPC_PDU_FLAG_1_RESERVED_01 0x01
|
||
|
|
#define MSRPC_PDU_FLAG_1_LASTFRAG 0x02
|
||
|
|
#define MSRPC_PDU_FLAG_1_FRAG 0x04
|
||
|
|
#define MSRPC_PDU_FLAG_1_NOFACK 0x08
|
||
|
|
#define MSRPC_PDU_FLAG_1_MAYBE 0x10
|
||
|
|
#define MSRPC_PDU_FLAG_1_IDEMPOTENT 0x20
|
||
|
|
#define MSRPC_PDU_FLAG_1_BROADCAST 0x40
|
||
|
|
#define MSRPC_PDU_FLAG_1_RESERVED_80 0x80
|
||
|
|
|
||
|
|
|
||
|
|
// MSRPC PDU FLAGS - 2nd Set
|
||
|
|
|
||
|
|
#define MSRPC_PDU_FLAG_2_RESERVED_01 0x01
|
||
|
|
#define MSRPC_PDU_FLAG_2_CANCEL_PEND 0x02
|
||
|
|
#define MSRPC_PDU_FLAG_2_RESERVED_04 0x04
|
||
|
|
#define MSRPC_PDU_FLAG_2_RESERVED_08 0x08
|
||
|
|
#define MSRPC_PDU_FLAG_2_RESERVED_10 0x10
|
||
|
|
#define MSRPC_PDU_FLAG_2_RESERVED_20 0x20
|
||
|
|
#define MSRPC_PDU_FLAG_2_RESERVED_40 0x40
|
||
|
|
#define MSRPC_PDU_FLAG_2_RESERVED_80 0x80
|
||
|
|
|
||
|
|
|
||
|
|
// Data Structures of a MSRPC protocol frame
|
||
|
|
|
||
|
|
typedef struct _ALTER_CONTEXT
|
||
|
|
{
|
||
|
|
WORD MaxXmitFrag;
|
||
|
|
WORD MaxRecvFrag;
|
||
|
|
DWORD AssocGroupId;
|
||
|
|
BYTE PContextElem[];
|
||
|
|
} ALTER_CONTEXT;
|
||
|
|
|
||
|
|
typedef struct _ALTER_CONTEXT_RESP
|
||
|
|
{
|
||
|
|
WORD MaxXmitFrag;
|
||
|
|
WORD MaxRecvFrag;
|
||
|
|
DWORD AssocGroupId;
|
||
|
|
BYTE SecAddr[];
|
||
|
|
} ALTER_CONTEXT_RESP;
|
||
|
|
|
||
|
|
typedef struct _BIND
|
||
|
|
{
|
||
|
|
WORD MaxXmitFrag;
|
||
|
|
WORD MaxRecvFrag;
|
||
|
|
DWORD AssocGroupId;
|
||
|
|
BYTE PContextElem[];
|
||
|
|
} BIND;
|
||
|
|
|
||
|
|
typedef struct _BIND_ACK
|
||
|
|
{
|
||
|
|
WORD MaxXmitFrag;
|
||
|
|
WORD MaxRecvFrag;
|
||
|
|
DWORD AssocGroupId;
|
||
|
|
BYTE SecAddr[];
|
||
|
|
} BIND_ACK;
|
||
|
|
|
||
|
|
typedef struct _BIND_NAK
|
||
|
|
{
|
||
|
|
WORD RejectReason;
|
||
|
|
BYTE Versions[];
|
||
|
|
} BIND_NAK;
|
||
|
|
|
||
|
|
typedef struct _CO_CANCEL
|
||
|
|
{
|
||
|
|
BYTE AuthTrailer[];
|
||
|
|
} CO_CANCEL;
|
||
|
|
|
||
|
|
typedef struct _FAULT
|
||
|
|
{
|
||
|
|
union
|
||
|
|
{
|
||
|
|
DWORD AllocHint;
|
||
|
|
DWORD StatusCode;
|
||
|
|
};
|
||
|
|
WORD PContId;
|
||
|
|
BYTE CancelCount;
|
||
|
|
BYTE Reserved;
|
||
|
|
DWORD Status;
|
||
|
|
BYTE Reserved2[4];
|
||
|
|
BYTE Data[];
|
||
|
|
} FAULT;
|
||
|
|
|
||
|
|
typedef struct _ORPHANED
|
||
|
|
{
|
||
|
|
BYTE AuthTrailer[];
|
||
|
|
} ORPHANED;
|
||
|
|
|
||
|
|
typedef struct _REQUEST
|
||
|
|
{
|
||
|
|
DWORD AllocHint;
|
||
|
|
WORD PContId;
|
||
|
|
WORD OpNum;
|
||
|
|
BYTE Object[16];
|
||
|
|
BYTE Data[];
|
||
|
|
} REQUEST;
|
||
|
|
|
||
|
|
typedef struct _RESPONSE
|
||
|
|
{
|
||
|
|
DWORD AllocHint;
|
||
|
|
WORD PContId;
|
||
|
|
BYTE CancelCount;
|
||
|
|
BYTE Reserved;
|
||
|
|
BYTE Data[];
|
||
|
|
} RESPONSE;
|
||
|
|
|
||
|
|
typedef struct _SHUTDOWN
|
||
|
|
{
|
||
|
|
BYTE Data[];
|
||
|
|
} SHUTDOWN;
|
||
|
|
|
||
|
|
typedef struct _MSRPCCO
|
||
|
|
{
|
||
|
|
BYTE Version;
|
||
|
|
BYTE VersionMinor;
|
||
|
|
BYTE PType;
|
||
|
|
BYTE PFCFlags;
|
||
|
|
BYTE PackedDrep[4];
|
||
|
|
WORD FragLength;
|
||
|
|
WORD AuthLength;
|
||
|
|
DWORD CallID;
|
||
|
|
union
|
||
|
|
{
|
||
|
|
ALTER_CONTEXT AlterContext;
|
||
|
|
ALTER_CONTEXT_RESP AlterContextResp;
|
||
|
|
BIND Bind;
|
||
|
|
BIND_ACK BindAck;
|
||
|
|
BIND_NAK BindNak;
|
||
|
|
CO_CANCEL COCancel;
|
||
|
|
FAULT Fault;
|
||
|
|
ORPHANED Orphaned;
|
||
|
|
REQUEST Request;
|
||
|
|
RESPONSE Response;
|
||
|
|
SHUTDOWN Shutdown;
|
||
|
|
};
|
||
|
|
} MSRPCCO;
|
||
|
|
|
||
|
|
typedef MSRPCCO UNALIGNED * LPMSRPCCO;
|
||
|
|
|
||
|
|
|
||
|
|
typedef struct _CL_REQUEST
|
||
|
|
{
|
||
|
|
BYTE Data[];
|
||
|
|
} CL_REQUEST;
|
||
|
|
|
||
|
|
typedef struct _PING
|
||
|
|
{
|
||
|
|
BYTE Data[];
|
||
|
|
} PING;
|
||
|
|
|
||
|
|
typedef struct _CL_RESPONSE
|
||
|
|
{
|
||
|
|
BYTE Data[];
|
||
|
|
} CL_RESPONSE;
|
||
|
|
|
||
|
|
typedef struct _WORKING
|
||
|
|
{
|
||
|
|
BYTE Data[];
|
||
|
|
} WORKING;
|
||
|
|
|
||
|
|
typedef struct _NOCALL
|
||
|
|
{
|
||
|
|
BYTE Vers;
|
||
|
|
BYTE Pad1;
|
||
|
|
WORD WindowSize;
|
||
|
|
DWORD MaxTPDU;
|
||
|
|
DWORD MaxPathTPDU;
|
||
|
|
WORD SerialNumber;
|
||
|
|
WORD SelAckLen;
|
||
|
|
DWORD SelAck[];
|
||
|
|
} NOCALL;
|
||
|
|
|
||
|
|
typedef struct _REJECT
|
||
|
|
{
|
||
|
|
DWORD StatusCode;
|
||
|
|
} REJECT;
|
||
|
|
|
||
|
|
typedef struct _ACK
|
||
|
|
{
|
||
|
|
BYTE Data[];
|
||
|
|
} ACK;
|
||
|
|
|
||
|
|
typedef struct _CL_CANCEL
|
||
|
|
{
|
||
|
|
DWORD Vers;
|
||
|
|
DWORD CancelId;
|
||
|
|
} CL_CANCEL;
|
||
|
|
|
||
|
|
typedef struct _FACK
|
||
|
|
{
|
||
|
|
BYTE Vers;
|
||
|
|
BYTE Pad1;
|
||
|
|
WORD WindowSize;
|
||
|
|
DWORD MaxTPDU;
|
||
|
|
DWORD MaxPathTPDU;
|
||
|
|
WORD SerialNumber;
|
||
|
|
WORD SelAckLen;
|
||
|
|
DWORD SelAck[];
|
||
|
|
} FACK;
|
||
|
|
|
||
|
|
typedef struct _CANCEL_ACK
|
||
|
|
{
|
||
|
|
DWORD Vers;
|
||
|
|
DWORD CancelId;
|
||
|
|
DWORD ServerIsAccepting;
|
||
|
|
} CANCEL_ACK;
|
||
|
|
|
||
|
|
|
||
|
|
typedef struct _MSRPCCL
|
||
|
|
{
|
||
|
|
BYTE Version;
|
||
|
|
BYTE PType;
|
||
|
|
BYTE PFCFlags1;
|
||
|
|
BYTE PFCFlags2;
|
||
|
|
BYTE PackedDrep[3];
|
||
|
|
BYTE SerialNumHi;
|
||
|
|
BYTE ObjectId[16];
|
||
|
|
BYTE InterfaceId[16];
|
||
|
|
BYTE ActivityId[16];
|
||
|
|
DWORD ServerBootTime;
|
||
|
|
DWORD InterfaceVersion;
|
||
|
|
DWORD SeqNum;
|
||
|
|
WORD OpNum;
|
||
|
|
WORD InterfaceHint;
|
||
|
|
WORD ActivityHint;
|
||
|
|
WORD Length;
|
||
|
|
WORD FragNum;
|
||
|
|
BYTE AuthProtoId;
|
||
|
|
BYTE SerialNumLo;
|
||
|
|
union
|
||
|
|
{
|
||
|
|
CL_REQUEST Request;
|
||
|
|
PING Ping;
|
||
|
|
CL_RESPONSE Response;
|
||
|
|
FAULT Fault;
|
||
|
|
WORKING Working;
|
||
|
|
NOCALL NoCall;
|
||
|
|
REJECT Reject;
|
||
|
|
ACK Ack;
|
||
|
|
CL_CANCEL CLCancel;
|
||
|
|
FACK Fack;
|
||
|
|
CANCEL_ACK CancelAck;
|
||
|
|
};
|
||
|
|
} MSRPCCL;
|
||
|
|
|
||
|
|
typedef MSRPCCL UNALIGNED * LPMSRPCCL;
|
||
|
|
|
||
|
|
|
||
|
|
typedef unsigned short p_context_id_t;
|
||
|
|
|
||
|
|
typedef struct
|
||
|
|
{
|
||
|
|
GUID if_uuid;
|
||
|
|
unsigned long if_version;
|
||
|
|
} p_syntax_id_t;
|
||
|
|
|
||
|
|
typedef struct
|
||
|
|
{
|
||
|
|
p_context_id_t p_cont_id;
|
||
|
|
unsigned char n_transfer_syn;
|
||
|
|
unsigned char reserved;
|
||
|
|
p_syntax_id_t abstract_syntax;
|
||
|
|
p_syntax_id_t transfer_syntaxes[1];
|
||
|
|
} p_cont_elem_t;
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
// Table for tracking IIDs
|
||
|
|
|
||
|
|
typedef struct _IID_HANDOFF
|
||
|
|
{
|
||
|
|
union
|
||
|
|
{
|
||
|
|
BYTE ByteRep[16];
|
||
|
|
DWORD DwordRep[4];
|
||
|
|
};
|
||
|
|
HPROTOCOL hNext;
|
||
|
|
} IID_HANDOFF;
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
// We are going to store the BIND frames in a database so that at attach time, we
|
||
|
|
// can point to who is the BIND frame on requests and responses. CCHeapAlloc routines
|
||
|
|
// will be used to store the data.
|
||
|
|
|
||
|
|
|
||
|
|
enum BINDTABLESTATE
|
||
|
|
{
|
||
|
|
UNINITED,
|
||
|
|
NORMAL,
|
||
|
|
FULL
|
||
|
|
};
|
||
|
|
|
||
|
|
typedef struct _BINDENTRY
|
||
|
|
{
|
||
|
|
DWORD nFrame;
|
||
|
|
HFRAME hBindFrame;
|
||
|
|
} BINDENTRY;
|
||
|
|
|
||
|
|
typedef BINDENTRY * LPBINDENTRY;
|
||
|
|
|
||
|
|
|
||
|
|
typedef struct _BINDTABLE
|
||
|
|
{
|
||
|
|
DWORD nEntries;
|
||
|
|
DWORD nAllocated;
|
||
|
|
DWORD State;
|
||
|
|
BOOL fCurrentlyLookingBack;
|
||
|
|
BINDENTRY BindEntry[1];
|
||
|
|
|
||
|
|
} BINDTABLE;
|
||
|
|
|
||
|
|
typedef BINDTABLE * LPBINDTABLE;
|
||
|
|
|
||
|
|
#define BINDTABLEHEADERSIZE (sizeof(BINDTABLE)-sizeof(BINDENTRY))
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
// Defintions for MSRPC protocol parser entry point functions
|
||
|
|
|
||
|
|
VOID WINAPI MSRPC_Register( HPROTOCOL hMSRPC );
|
||
|
|
|
||
|
|
VOID WINAPI MSRPC_Deregister( HPROTOCOL hMSRPC );
|
||
|
|
|
||
|
|
LPBYTE WINAPI MSRPC_RecognizeFrame( HFRAME hFrame,
|
||
|
|
LPBYTE lpStartFrame,
|
||
|
|
LPBYTE lpStartMSRPC,
|
||
|
|
DWORD MacType,
|
||
|
|
DWORD BytesLeft,
|
||
|
|
HPROTOCOL hPreviousProtocol,
|
||
|
|
DWORD nPreviousProtocolOffset,
|
||
|
|
LPDWORD ProtocolStatusCode,
|
||
|
|
LPHPROTOCOL hNextProtocol,
|
||
|
|
LPDWORD lpInstData );
|
||
|
|
|
||
|
|
LPBYTE WINAPI MSRPC_AttachProperties( HFRAME hFrame,
|
||
|
|
LPBYTE lpStartFrame,
|
||
|
|
LPBYTE lpStartMSRPC,
|
||
|
|
DWORD MacType,
|
||
|
|
DWORD BytesLeft,
|
||
|
|
HPROTOCOL hPreviousProtocol,
|
||
|
|
DWORD nPreviousProtocolOffset,
|
||
|
|
DWORD InstData );
|
||
|
|
|
||
|
|
DWORD WINAPI MSRPC_FormatProperties( HFRAME hFrame,
|
||
|
|
LPBYTE MacFrame,
|
||
|
|
LPBYTE ProtocolFrame,
|
||
|
|
DWORD nPropertyInsts,
|
||
|
|
LPPROPERTYINST p );
|
||
|
|
|
||
|
|
VOID WINAPIV MSRPC_FmtSummary( LPPROPERTYINST lpPropertyInst );
|
||
|
|
|
||
|
|
|