Class: RubySMB::Dcerpc::Response

Inherits:
BinData::Record
  • Object
show all
Defined in:
lib/ruby_smb/dcerpc/response.rb

Overview

The Response PDU as defined in The response PDU

Constant Summary collapse

PTYPE = 
PTypes::RESPONSE

Instance Method Summary collapse

Instance Method Details

#calculate_padding_size ⇒ Object

Per the spec (MS_RPCE 2.2.2.11): start of the trailer should be a multiple of 16 bytes offset from the start of the stub



30
31
32
 
# File 'lib/ruby_smb/dcerpc/response.rb', line 30

def calculate_padding_size
  (16 - (stub.num_bytes % 16)) % 16
end

#has_auth_verifier? ⇒ Boolean

Returns:

  • (Boolean) 


39
40
41
 
# File 'lib/ruby_smb/dcerpc/response.rb', line 39

def has_auth_verifier?
  self.pdu_header.auth_length > 0
end

#initialize_instance ⇒ Object 



34
35
36
37
 
# File 'lib/ruby_smb/dcerpc/response.rb', line 34

def initialize_instance
  super
  pdu_header.ptype = PTYPE
end

#read(io) ⇒ Object 



54
55
56
57
58
59
60
61
62
63
64
 
# File 'lib/ruby_smb/dcerpc/response.rb', line 54

def read(io)
  super
  if has_auth_verifier? && sec_trailer.auth_pad_length > 0
    # At this point, auth_pad is at the end of the stub. We need to move
    # it to the correct field. It is now possible since we know its
    # length from the sec_trailer auth_pad_length field.
    pad = stub[-(sec_trailer.auth_pad_length)..-1]
    stub.assign(stub[0...-(sec_trailer.auth_pad_length)])
    auth_pad.assign(pad)
  end
end

#stub_length ⇒ Object 



43
44
45
46
47
48
49
50
51
52
 
# File 'lib/ruby_smb/dcerpc/response.rb', line 43

def stub_length
  stub_length = pdu_header.frag_length - stub.rel_offset
  if has_auth_verifier?
    # Note that the resulting stub length includes auth_pad. We will be
    # able to separate the auth_pad from the stub once the sec_trailer
    # structure is read.
    stub_length -= (sec_trailer.num_bytes + pdu_header.auth_length)
  end
  stub_length
end