Module: RubySMB::Dcerpc::Ndr::StructPlugin

Includes:
ConstructedTypePlugin
Defined in:
lib/ruby_smb/dcerpc/ndr.rb

Overview

Instance Method Summary collapse

Methods included from ConstructedTypePlugin

#defer_ptr, #do_num_bytes_ptr, #get_top_level_constructed_type, #has_deferred_ptrs?, #initialize_instance, #is_deferring, #read_ptr, #write_ptr

Instance Method Details

#bytes_to_align(obj, rel_offset) ⇒ Object



794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
# File 'lib/ruby_smb/dcerpc/ndr.rb', line 794

def bytes_to_align(obj, rel_offset)
  if obj.is_a?(PointerPlugin)
    # Pointers are always 4-bytes aligned
    return (4 - (rel_offset % 4)) % 4
  end
  if obj.is_a?(ConfPlugin)
    # `max_count` should have been handled at the beginning of the structure
    # already. We need to fix `rel_offset` since it includes the
    # `max_count` 4 bytes, plus the possible padding bytes needed to align
    # the structure. This is required because BinData Struct is not
    # aware of `max_count` and consider the first field to be the beginning
    # of the structure instead. We have to make sure the alignment is
    # calculated from the beginning of the structure.
    align = eval_parameter(:byte_align)
    pad_length = (align - (4 % align)) % align
    rel_offset += (4 + pad_length)

    # We need to handle another corner case, which is a Conformant array
    # (not Varying). The size information (max_count) has been place in
    # from of the structure and no other size information is present before
    # the actual elements of the array. Therefore, the alignment must be
    # done according to the rules of the elements. Since a NdrArray has its
    # default :byte_align value set to 4 (:max_count size), we have to make
    # sure the element size is used instead.
    unless obj.is_a?(VarPlugin)
      return obj.align_element_size(rel_offset)
    end
  end
  is_a?(BinData::ByteAlignPlugin) ? super : 0

end

#do_num_bytesObject



770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
# File 'lib/ruby_smb/dcerpc/ndr.rb', line 770

def do_num_bytes
  sum = 0

  if should_process_max_count?
    # count max_count (4 bytes)
    max_count = retrieve_max_count
    sum += 4 if max_count

    if respond_to?(:referent_bytes_align)
      sum += referent_bytes_align(sum)
    elsif has_parameter?(:byte_align)
      sum += bytes_to_align(self, sum)
    end
  end

  sum += super

  if has_deferred_ptrs?
    sum += do_num_bytes_ptr(sum)
  end

  sum
end

#do_read(io) ⇒ Object



733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
# File 'lib/ruby_smb/dcerpc/ndr.rb', line 733

def do_read(io)
  if should_process_max_count?
    max_count = io.readbytes(4).unpack1('L<')
    BinData.trace_message do |tracer|
      tracer.trace_obj("#{debug_name}.max_count", max_count.to_s)
    end
    set_max_count(max_count)

    # Align the structure according to the alignment rules for the structure
    if respond_to?(:referent_bytes_align)
      io.seekbytes(referent_bytes_align(io.offset))
    elsif has_parameter?(:byte_align)
      io.seekbytes(bytes_to_align(self, io.offset))
    end
  end

  super

  if has_deferred_ptrs?
    read_ptr(io)
  end
end

#do_write(io) ⇒ Object



713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
# File 'lib/ruby_smb/dcerpc/ndr.rb', line 713

def do_write(io)
  if should_process_max_count?
    max_count = retrieve_max_count
    io.writebytes([max_count].pack('L<')) if max_count

    # Align the structure according to the alignment rules for the structure
    if respond_to?(:referent_bytes_align)
      io.writebytes("\x00" * referent_bytes_align(io.offset))
    elsif has_parameter?(:byte_align)
      io.writebytes("\x00" * bytes_to_align(self, io.offset))
    end
  end

  super

  if has_deferred_ptrs?
    write_ptr(io)
  end
end

#retrieve_max_countObject



756
757
758
759
760
761
762
763
# File 'lib/ruby_smb/dcerpc/ndr.rb', line 756

def retrieve_max_count
  obj = self[field_names.last]
  return obj.length if obj.is_a?(ConfPlugin)
  return obj.get_max_count(obj) if obj.is_a?(ConfStringPlugin)
  if obj.is_a?(NdrStruct)
    return obj.retrieve_max_count
  end
end

#set_max_count(val) ⇒ Object



765
766
767
768
# File 'lib/ruby_smb/dcerpc/ndr.rb', line 765

def set_max_count(val)
  obj = self[field_names.last]
  obj.set_max_count(val)
end

#should_process_max_count?Boolean

Returns:

  • (Boolean)


684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
# File 'lib/ruby_smb/dcerpc/ndr.rb', line 684

def should_process_max_count?
  # According to the NDR definition for Structures Containing a Conformant
  # Array:
  #
  # "In the NDR representation of a structure that contains a
  # conformant array, the unsigned long integers that give maximum element
  # counts for dimensions of the array are moved to the beginning of the
  # structure, and the array elements appear in place at the end of the
  # structure. If a structure that contains a conformant array itself a
  # member of another structure, the maximum element counts are further
  # moved to the beginning of the containing structure. This construction
  # iterates through all enclosing structures."
  #
  # This only applies if the current object is the top level structure (no
  # parent). Note that if it is a pointer to a structure and the current
  # object is being deferred, :max_count still need to be processed since
  # it had not been moved to the beginning of the parent structure.
  klass = is_a?(PointerPlugin) ? self.class.superclass : self.class
  parent_obj = nil
  # TODO: possible issue: parent can be a BinData::Choice, and won't be
  # detected as a ConstructedTypePlugin, even if the embeding structure is.
  # Check this with a BinData::Choice that points to a structure embedding
  # a conformant structure
  if parent&.is_a?(ConstructedTypePlugin)
    parent_obj = parent.get_top_level_constructed_type
  end
  klass.has_conformant_array && (parent_obj.nil? || parent_obj.is_deferring(self))
end