2 # -*- coding: utf-8 -*-
4 # Unix SMB/CIFS implementation.
5 # Copyright © Jelmer Vernooij <jelmer@samba.org> 2008
7 # This program is free software; you can redistribute it and/or modify
8 # it under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # This program is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with this program. If not, see <http://www.gnu.org/licenses/>.
20 from __future__ import print_function
25 MAX_BASE_SIZE = 0x1000
26 MAX_IFACE_VERSION = 1000
28 DCERPC_FAULT_OP_RNG_ERROR = 0x1c010002
29 DCERPC_FAULT_NDR = 0x6f7
30 NT_STATUS_NET_WRITE_FAULT = -1073741614
33 sys.path.insert(0, "bin/python")
35 from samba.dcerpc import ClientConnection
37 def find_num_funcs(conn):
38 for i in xrange(MAX_OPNUM):
41 except RuntimeError as e:
42 if e.args[0] == DCERPC_FAULT_OP_RNG_ERROR:
44 raise Exception("More than %d functions" % MAX_OPNUM)
47 def __init__(self, conn, opnum):
51 def request(self, data):
52 assert isinstance(data, str)
53 self.conn.request(self.opnum, data)
55 def valid_ndr(self, data):
58 except RuntimeError as e:
60 if num == DCERPC_FAULT_NDR:
64 def find_base_request(self, start=""):
65 """Find the smallest possible request that we can do that is
68 This generally means sending all zeroes so we get NULL pointers where
70 # TODO: Don't try with just 0's as there may be switch_is() variables
71 # for which 0 is not a valid value or variables with range() set
72 # See how much input bytes we need
73 for i in range(MAX_BASE_SIZE):
74 data = start + chr(0) * i
75 if self.valid_ndr(data):
79 def check_decision_byte(self, base_request, i):
80 """Check whether the specified byte is a possible "decision" byte,
81 e.g. a byte that is part of a pointer, array size variable or
84 Note that this function only checks if a byte is definitely a decision
85 byte. It may return False in some cases while the byte is actually
87 data = list(base_request)
89 return not self.valid_ndr("".join(data))
91 def find_deferrant_data(self, base_request, idx):
92 data = list(base_request)
94 # Just check that this is a pointer to something non-empty:
95 assert not self.valid_ndr("".join(data))
97 newdata = self.find_base_request("".join(data))
102 assert newdata.startswith(data)
104 return newdata[len(data):]
107 base_request = self.find_base_request()
109 if base_request is None:
110 raise Exception("Unable to determine base size for opnum %d" % self.opnum)
112 print("\tBase request is %r" % base_request)
114 decision_byte_map = map(lambda x: self.check_decision_byte(base_request, x), range(len(base_request)))
116 print(decision_byte_map)
119 possible_pointers = map(all,
120 [decision_byte_map[i*4:(i+1)*4] for i in range(int(len(base_request)/4))])
121 print(possible_pointers)
123 pointer_deferrant_bases = map(
124 lambda x: self.find_deferrant_data(base_request, x) if possible_pointers[x] else None, range(len(possible_pointers)))
126 print(pointer_deferrant_bases)
129 if len(sys.argv) < 3:
130 print("Usage: autoidl <binding> <UUID> [<version>]")
133 (binding, uuid) = sys.argv[1:3]
134 if len(sys.argv) == 4:
135 version = sys.argv[3]
140 for i in range(MAX_IFACE_VERSION):
142 conn = ClientConnection(binding, (uuid, i))
143 except RuntimeError as e:
145 if num == NT_STATUS_NET_WRITE_FAULT:
151 conn = ClientConnection(binding, (uuid, version))
153 print("Figuring out number of connections... ", end='')
154 num_funcs = find_num_funcs(conn)
155 print("%d" % num_funcs)
157 # Figure out the syntax for each one
158 for i in range(num_funcs):
159 print("Function %d" % i)
160 data = Function(conn, i)
163 except Exception as e:
164 print("Error: %r" % e)