rpcinterface_c681d488d85011d08c5200c04fd90f7e_1_0
import "github.com/TheManticoreProject/Manticore/network/dcerpc/interfaces/c681d488-d850-11d0-8c52-00c04fd90f7e/1.0"
Package rpcinterface_c681d488d85011d08c5200c04fd90f7e_1_0 is the descriptor for the efsrpc RPC interface, abstract syntax c681d488-d850-11d0-8c52-00c04fd90f7e version 1.0 ([MS-EFSR]).
Generated by tools/idlgen (descriptor phase) from the IDL, then reviewed: the PipeName, the status-code table, and doc comments are not derivable from the IDL and must be confirmed by hand (see the TODO markers).
Index
Constants
Opnums for the on-the-wire methods. Opnums 10, 14, 17, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44 are “not used on the wire” and are omitted.
const (
OpnumEfsRpcOpenFileRaw uint16 = 0
OpnumEfsRpcReadFileRaw uint16 = 1
OpnumEfsRpcWriteFileRaw uint16 = 2
OpnumEfsRpcCloseRaw uint16 = 3
OpnumEfsRpcEncryptFileSrv uint16 = 4
OpnumEfsRpcDecryptFileSrv uint16 = 5
OpnumEfsRpcQueryUsersOnFile uint16 = 6
OpnumEfsRpcQueryRecoveryAgents uint16 = 7
OpnumEfsRpcRemoveUsersFromFile uint16 = 8
OpnumEfsRpcAddUsersToFile uint16 = 9
OpnumEfsRpcNotSupported uint16 = 11
OpnumEfsRpcFileKeyInfo uint16 = 12
OpnumEfsRpcDuplicateEncryptionInfoFile uint16 = 13
OpnumEfsRpcAddUsersToFileEx uint16 = 15
OpnumEfsRpcFileKeyInfoEx uint16 = 16
OpnumEfsRpcGetEncryptedFileMetadata uint16 = 18
OpnumEfsRpcSetEncryptedFileMetadata uint16 = 19
OpnumEfsRpcFlushEfsCache uint16 = 20
OpnumEfsRpcEncryptFileExSrv uint16 = 21
OpnumEfsRpcQueryProtectors uint16 = 22
)
Status codes returned by efsrpc methods. EFSRPC methods return a Win32 error code (the IDL “long”/DWORD return value), 0 == success ([MS-ERREF] 2.2, [MS-EFSR] 3.1.4). These are the common ones; extend as needed.
const (
StatusSuccess uint32 = 0x00000000 // ERROR_SUCCESS
ErrorFileNotFound uint32 = 0x00000002 // ERROR_FILE_NOT_FOUND
ErrorAccessDenied uint32 = 0x00000005 // ERROR_ACCESS_DENIED
ErrorNotSupported uint32 = 0x00000032 // ERROR_NOT_SUPPORTED
ErrorInvalidParameter uint32 = 0x00000057 // ERROR_INVALID_PARAMETER
ErrorMoreData uint32 = 0x000000EA // ERROR_MORE_DATA
ErrorNoMoreItems uint32 = 0x00000103 // ERROR_NO_MORE_ITEMS
ErrorEncryptionFailed uint32 = 0x00001770 // ERROR_ENCRYPTION_FAILED
ErrorDecryptionFailed uint32 = 0x00001771 // ERROR_DECRYPTION_FAILED
)
PipeName is the IPC$-relative named pipe for the efsrpc interface. EFSRPC is reachable over several pipes (\efsrpc, and historically \lsarpc / \samr / \netlogon / \lsass); \efsrpc is the dedicated endpoint ([MS-EFSR] 1.9 / 2.1).
const PipeName = `\efsrpc`
Variables
NameToOpnum is the reverse of OpnumToName, built at init so the two never drift.
var NameToOpnum = func() map[string]uint16 {
m := make(map[string]uint16, len(OpnumToName))
for op, name := range OpnumToName {
m[name] = op
}
return m
}()
OpnumToName maps each on-the-wire opnum to its method name; the single source of truth.
var OpnumToName = map[uint16]string{
OpnumEfsRpcOpenFileRaw: "EfsRpcOpenFileRaw",
OpnumEfsRpcReadFileRaw: "EfsRpcReadFileRaw",
OpnumEfsRpcWriteFileRaw: "EfsRpcWriteFileRaw",
OpnumEfsRpcCloseRaw: "EfsRpcCloseRaw",
OpnumEfsRpcEncryptFileSrv: "EfsRpcEncryptFileSrv",
OpnumEfsRpcDecryptFileSrv: "EfsRpcDecryptFileSrv",
OpnumEfsRpcQueryUsersOnFile: "EfsRpcQueryUsersOnFile",
OpnumEfsRpcQueryRecoveryAgents: "EfsRpcQueryRecoveryAgents",
OpnumEfsRpcRemoveUsersFromFile: "EfsRpcRemoveUsersFromFile",
OpnumEfsRpcAddUsersToFile: "EfsRpcAddUsersToFile",
OpnumEfsRpcNotSupported: "EfsRpcNotSupported",
OpnumEfsRpcFileKeyInfo: "EfsRpcFileKeyInfo",
OpnumEfsRpcDuplicateEncryptionInfoFile: "EfsRpcDuplicateEncryptionInfoFile",
OpnumEfsRpcAddUsersToFileEx: "EfsRpcAddUsersToFileEx",
OpnumEfsRpcFileKeyInfoEx: "EfsRpcFileKeyInfoEx",
OpnumEfsRpcGetEncryptedFileMetadata: "EfsRpcGetEncryptedFileMetadata",
OpnumEfsRpcSetEncryptedFileMetadata: "EfsRpcSetEncryptedFileMetadata",
OpnumEfsRpcFlushEfsCache: "EfsRpcFlushEfsCache",
OpnumEfsRpcEncryptFileExSrv: "EfsRpcEncryptFileExSrv",
OpnumEfsRpcQueryProtectors: "EfsRpcQueryProtectors",
}
func StatusString
func StatusString(status uint32) string
StatusString returns a mnemonic for the documented status codes, otherwise the hex value.
func SyntaxID
func SyntaxID() syntax.SyntaxID
SyntaxID returns the efsrpc abstract syntax identifier: c681d488-d850-11d0-8c52-00c04fd90f7e, version 1.0.