catalog
import "github.com/TheManticoreProject/Manticore/network/dcerpc/interfaces/catalog"
Package catalog is a database of well-known DCE/RPC interfaces: it maps an interface UUID (and version) to human-readable metadata — a short name, a title, a description, the executable or DLL that implements the server, the hosting Windows service, the MS-* protocol document, and the well-known named pipe(s). It lets tooling label the raw UUIDs returned by ept_lookup / ept_map (e.g. 12345678-1234-abcd-ef00-0123456789ab v1.0 -> “spoolss”, MS-RPRN, spoolsv.exe, Spooler service).
The catalog is a pure data table, independent of which interfaces have a client implementation under network/dcerpc/interfaces. Look entries up through the package-level helpers (which use the built-in Default database) or build a custom Database with New.
Index
- type Database
- func Default() *Database
- func New(entries []Interface) (*Database, error)
- func (db *Database) All() []Interface
- func (db *Database) Lookup(uuid guid.GUID, major, minor uint16) (Interface, bool)
- func (db *Database) LookupUUID(uuid guid.GUID) []Interface
- func (db *Database) Resolve(uuid guid.GUID, major, minor uint16) (Interface, bool)
- func (db *Database) Search(substr string) []Interface
- func (db *Database) SearchByExecutable(exe string) []Interface
- func (db *Database) SearchByName(name string) []Interface
- func (db *Database) SearchByPipe(pipe string) []Interface
- func (db *Database) SearchByProtocol(protocol string) []Interface
- func (db *Database) SearchByService(service string) []Interface
- type Interface
- func All() []Interface
- func Lookup(uuid guid.GUID, major, minor uint16) (Interface, bool)
- func LookupUUID(uuid guid.GUID) []Interface
- func Resolve(uuid guid.GUID, major, minor uint16) (Interface, bool)
- func Search(substr string) []Interface
- func SearchByExecutable(exe string) []Interface
- func SearchByName(name string) []Interface
- func SearchByPipe(pipe string) []Interface
- func SearchByProtocol(protocol string) []Interface
- func SearchByService(service string) []Interface
- func (i Interface) String() string
- type Version
type Database
Database is an indexed, read-only collection of catalog entries.
type Database struct {
// contains filtered or unexported fields
}
func Default
func Default() *Database
Default returns the built-in catalog of well-known interfaces: the curated builtin table plus the local/host-service table. It panics if the seed is malformed (a programmer error caught by the package tests).
func New
func New(entries []Interface) (*Database, error)
New builds a Database from entries, constructing the lookup indexes. It errors on a malformed catalog: an entry with an empty Name, a zero UUID, or a duplicate (UUID, version).
func (*Database) All
func (db *Database) All() []Interface
All returns every entry, sorted by name then version.
func (*Database) Lookup
func (db *Database) Lookup(uuid guid.GUID, major, minor uint16) (Interface, bool)
Lookup returns the entry for an exact (UUID, version), reporting whether it is in the catalog.
func (*Database) LookupUUID
func (db *Database) LookupUUID(uuid guid.GUID) []Interface
LookupUUID returns every known version of a UUID, or nil if the UUID is unknown. Results are sorted by version.
func (*Database) Resolve
func (db *Database) Resolve(uuid guid.GUID, major, minor uint16) (Interface, bool)
Resolve labels a UUID/version seen on the wire: it returns the exact (UUID, version) entry when present, otherwise falls back to any known version of the same UUID (the lowest version, for determinism). ok is false only when the UUID is entirely unknown. Use it to annotate ept_lookup results, where the reported version may not be one the catalog enumerates explicitly.
func (*Database) Search
func (db *Database) Search(substr string) []Interface
Search returns every entry whose Name, Title, Description, Protocol, Executable, Service, or one of its Pipes contains the given substring (case-insensitive). An empty query matches nothing.
func (*Database) SearchByExecutable
func (db *Database) SearchByExecutable(exe string) []Interface
SearchByExecutable returns the entries implemented by the given image (case-insensitive), e.g. “spoolsv.exe”.
func (*Database) SearchByName
func (db *Database) SearchByName(name string) []Interface
SearchByName returns the entries whose short Name matches (case-insensitive).
func (*Database) SearchByPipe
func (db *Database) SearchByPipe(pipe string) []Interface
SearchByPipe returns the entries reachable over the given named pipe (case-insensitive), e.g. `\pipe\spoolss`.
func (*Database) SearchByProtocol
func (db *Database) SearchByProtocol(protocol string) []Interface
SearchByProtocol returns the entries for the given MS-* protocol document (case-insensitive), e.g. “MS-RPRN”.
func (*Database) SearchByService
func (db *Database) SearchByService(service string) []Interface
SearchByService returns the entries hosted by the given Windows service (case-insensitive), e.g. “Spooler”.
type Interface
Interface is one catalog entry: a specific interface UUID + version and the metadata known about it. Executable is the image that implements the RPC server (an .exe or a .dll loaded into a host process), e.g. “spoolsv.exe” or “srvsvc.dll”; Service is the hosting Windows service name where applicable, e.g. “Spooler”. Fields that are not known are left empty.
type Interface struct {
UUID guid.GUID
Version Version
Name string // short handle, e.g. "spoolss"
Title string // human title, e.g. "Print System Remote Protocol"
Description string // one-line summary
Executable string // implementing image, e.g. "spoolsv.exe" / "srvsvc.dll"
Service string // hosting Windows service, e.g. "Spooler"
Protocol string // MS-* document id, e.g. "MS-RPRN"
Pipes []string // well-known named pipe(s), e.g. `\pipe\spoolss`
}
func All
func All() []Interface
All is Default().All.
func Lookup
func Lookup(uuid guid.GUID, major, minor uint16) (Interface, bool)
Lookup is Default().Lookup.
func LookupUUID
func LookupUUID(uuid guid.GUID) []Interface
LookupUUID is Default().LookupUUID.
func Resolve
func Resolve(uuid guid.GUID, major, minor uint16) (Interface, bool)
Resolve is Default().Resolve.
func Search
func Search(substr string) []Interface
Search is Default().Search.
func SearchByExecutable
func SearchByExecutable(exe string) []Interface
SearchByExecutable is Default().SearchByExecutable.
func SearchByName
func SearchByName(name string) []Interface
SearchByName is Default().SearchByName.
func SearchByPipe
func SearchByPipe(pipe string) []Interface
SearchByPipe is Default().SearchByPipe.
func SearchByProtocol
func SearchByProtocol(protocol string) []Interface
SearchByProtocol is Default().SearchByProtocol.
func SearchByService
func SearchByService(service string) []Interface
SearchByService is Default().SearchByService.
func (Interface) String
func (i Interface) String() string
String renders a compact one-line label, e.g. “spoolss v1.0 (MS-RPRN) [spoolsv.exe]”.
type Version
Version is a DCE/RPC interface version (major.minor).
type Version struct {
Major uint16
Minor uint16
}
func (Version) String
func (v Version) String() string
String renders the version as “major.minor”.