Generated from Manticore v1.1.5 • 201 packages. View on pkg.go.dev

structures

import "github.com/TheManticoreProject/Manticore/network/dcerpc/interfaces/e1af8308-5d1f-11c9-91a4-08002b14a0fa/3.0/structures"

Index

Constants

Floor protocol identifier bytes, the first octet of a floor’s LHS ([C706] Appendix I).

const (
    // FloorProtoUUID marks a floor whose LHS is a UUID plus a 16-bit major version (the
    // interface-identifier and transfer-syntax floors). The RHS holds the 16-bit minor
    // version.
    FloorProtoUUID = 0x0D
    // FloorProtoNCACN identifies the connection-oriented RPC protocol (major v5).
    FloorProtoNCACN = 0x0B
    // FloorProtoNCADG identifies the connectionless RPC protocol (major v4).
    FloorProtoNCADG = 0x0A
    // FloorProtoTCP identifies the DOD TCP floor; its RHS is a 16-bit port in big-endian
    // order. This is the transport floor of an ncacn_ip_tcp tower.
    FloorProtoTCP = 0x07
    // FloorProtoUDP identifies the DOD UDP floor; its RHS is a 16-bit port in big-endian
    // order.
    FloorProtoUDP = 0x08
    // FloorProtoIP identifies the DOD IP floor; its RHS is a 4-octet IPv4 address in
    // big-endian order.
    FloorProtoIP = 0x09
    // FloorProtoNamedPipe identifies the named-pipe floor of an ncacn_np tower; its RHS
    // is the NUL-terminated pipe name (e.g. "\PIPE\srvsvc").
    FloorProtoNamedPipe = 0x0F
    // FloorProtoNetBIOS identifies the NetBIOS host-name floor (the address floor of an
    // ncacn_np tower); its RHS is the NUL-terminated host name.
    FloorProtoNetBIOS = 0x11
    // FloorProtoLRPC identifies the local-RPC (ncalrpc) endpoint floor; its RHS is the
    // NUL-terminated local port name (e.g. "WindowsShutdown"). It is the transport/endpoint
    // floor of an ncalrpc tower, accompanied by the 0x0C protocol-identifier floor
    // (FloorProtoLRPCAssoc). This is the most common transport in a real Windows endpoint
    // map ([C706] Appendix I; [MS-RPCE] 2.2.1.2 protocol identifiers).
    FloorProtoLRPC = 0x10
    // FloorProtoLRPCAssoc is the protocol-identifier floor that accompanies an ncalrpc
    // endpoint floor (its RHS is empty). The endpoint name lives on the 0x10 floor.
    FloorProtoLRPCAssoc = 0x0C
    // FloorProtoHTTP identifies the RPC-over-HTTP floor of an ncacn_http tower; its RHS is
    // a 16-bit port in big-endian order.
    FloorProtoHTTP = 0x1F
)

AnnotationMaxSize is ept_max_annotation_size, the fixed bound of the annotation array.

const AnnotationMaxSize = 64

ContextHandleSize is the wire size of an ept_lookup_handle_t / ndr_context_handle: a 4-octet attributes field plus a 16-octet UUID ([C706] section 4.2.16.6).

const ContextHandleSize = 20

type Annotation

Annotation is the [string] char annotation[ept_max_annotation_size] field of an ept_entry_t ([C706] Appendix O, ept_max_annotation_size = 64): a human-readable label the endpoint mapper stores with each registration (e.g. “Messenger Service”).

A fixed-bound [string] array is encoded in NDR as a *varying* array — an offset and an actual_count (number of characters, including the NUL terminator) followed by that many octets, with no maximum_count. That two-count framing differs from the codec’s general conformant-varying string handling, so Annotation marshals itself.

type Annotation string

func (*Annotation) AlignmentNDR

func (*Annotation) AlignmentNDR() int

AlignmentNDR reports the 4-octet alignment of the leading offset/actual_count words.

func (*Annotation) MarshalNDR

func (a *Annotation) MarshalNDR(e *ndr.Encoder) error

MarshalNDR writes the annotation as a varying char array: offset 0, actual_count (string length plus the NUL terminator), then the bytes and the terminator.

func (*Annotation) UnmarshalNDR

func (a *Annotation) UnmarshalNDR(d *ndr.Decoder) error

UnmarshalNDR reads a varying char array (offset, actual_count, octets) and stores it with the trailing NUL removed.

type Binding

Binding is a tower decoded into the components of a DCE string binding (protseq:network_address[endpoint]).

type Binding struct {
    Kind BindingKind
    // ProtSeq is the protocol sequence, e.g. "ncacn_ip_tcp" or "ncacn_np".
    ProtSeq string
    // NetworkAddress is the host: an IPv4 address (ncacn_ip_tcp/http, ncadg_ip_udp) or a
    // NetBIOS host name (ncacn_np). It may be empty if the tower carries no address floor.
    NetworkAddress string
    // Endpoint is the per-transport endpoint: a decimal port (TCP/UDP/HTTP) or a pipe name
    // (named pipe).
    Endpoint string
}

func (Binding) String

func (b Binding) String() string

String renders the canonical DCE string binding, protseq:network_address[endpoint] (e.g. “ncacn_ip_tcp:10.0.0.1[49664]”, “ncacn_np:HOST[\\PIPE\\srvsvc]”).

type BindingKind

BindingKind identifies the transport (protocol sequence) a tower describes.

type BindingKind uint8
const (
    // BindingUnknown marks a tower with no recognized transport/endpoint floor.
    BindingUnknown BindingKind = iota
    // BindingTCP is ncacn_ip_tcp (RPC over TCP).
    BindingTCP
    // BindingUDP is ncadg_ip_udp (connectionless RPC over UDP).
    BindingUDP
    // BindingNamedPipe is ncacn_np (RPC over an SMB named pipe).
    BindingNamedPipe
    // BindingHTTP is ncacn_http (RPC over HTTP / RPC proxy).
    BindingHTTP
    // BindingLRPC is ncalrpc (local RPC over an ALPC port). Its endpoint is the local port
    // name and it has no network address.
    BindingLRPC
)

type ContextHandle

ContextHandle models the ept_lookup_handle_t context handle. A context handle is transmitted inline as its 20 octets (not as an NDR pointer referent) and aligned to 4 octets; it is a Marshaler so the codec applies that alignment ahead of the handle regardless of how the preceding tower octet string padded out. The zero value is the null handle used on the first ept_map call.

type ContextHandle [ContextHandleSize]byte

func (*ContextHandle) AlignmentNDR

func (*ContextHandle) AlignmentNDR() int

AlignmentNDR reports the 4-octet alignment of a context handle (its first field is the 4-octet attributes word).

func (ContextHandle) IsNull

func (h ContextHandle) IsNull() bool

IsNull reports whether the handle is the null context handle, i.e. its 16-octet UUID (the octets after the 4-octet attributes word) is all zero. ept_lookup signals the end of a paged enumeration by returning a null entry handle.

func (*ContextHandle) MarshalNDR

func (h *ContextHandle) MarshalNDR(e *ndr.Encoder) error

MarshalNDR writes the 20 octets of the context handle.

func (*ContextHandle) UnmarshalNDR

func (h *ContextHandle) UnmarshalNDR(d *ndr.Decoder) error

UnmarshalNDR reads the 20 octets of the context handle.

type Endpoint

Endpoint is a resolved transport endpoint extracted from a tower.

type Endpoint struct {
    IP   net.IP
    Port uint16
}

func (Endpoint) String

func (e Endpoint) String() string

String renders the endpoint as host:port.

type EptEntry

EptEntry models ept_entry_t ([C706] Appendix O):

typedef struct {
    uuid_t  object;
    twr_p_t tower;
    [string] char annotation[ept_max_annotation_size];
} ept_entry_t;

Object is the object UUID (often nil/zero), Tower is a unique/full pointer to the twr_t describing the binding, and Annotation is the registration’s label. It is the element type of ept_lookup’s [out] entries array; use DecodeTower to obtain the decoded protocol Tower (and Tower.Binding for a string binding).

type EptEntry struct {
    Object     EptUUID
    Tower      *Twr `ndr:"ptr"`
    Annotation Annotation
}

func (EptEntry) DecodeTower

func (e EptEntry) DecodeTower() (Tower, error)

DecodeTower decodes the entry’s twr_t into a protocol Tower. It errors if the entry has no tower (a null pointer on the wire).

type EptUUID

EptUUID models the uuid_t referent of ept_map’s optional [in] object pointer (uuid_p_t). Octets holds the 16-octet UUID exactly as it appears on the wire (Data1/2/3 little-endian, Data4 big-endian), which the codec emits verbatim as the referent body of the full pointer. It is a fixed-octet struct rather than an ndr.Marshaler so the codec applies its normal pointer handling (a NULL referent id when the field is nil); a Marshaler is intercepted before that and would be dereferenced even when nil. guid.GUID is not used directly because its Go layout (a trailing uint64) does not map to 16 contiguous octets under reflection.

type EptUUID struct {
    Octets [16]byte
}

func NewEptUUID

func NewEptUUID(g guid.GUID) EptUUID

NewEptUUID converts a GUID to its uuid_t octet form.

func (EptUUID) GUID

func (u EptUUID) GUID() guid.GUID

GUID converts the octets back to a guid.GUID.

type Floor

Floor is one floor of a protocol tower: a length-prefixed left-hand side (protocol identifier and associated data) and a length-prefixed right-hand side (addressing or version data).

type Floor struct {
    LHS []byte
    RHS []byte
}

func HTTPFloor

func HTTPFloor(port uint16) Floor

HTTPFloor builds the RPC-over-HTTP floor; the RHS is the 16-bit port in big-endian order.

func IPFloor

func IPFloor(ip net.IP) Floor

IPFloor builds the DOD IP floor; the RHS is the 4-octet IPv4 address in big-endian (network) order.

func InterfaceFloor

func InterfaceFloor(iface guid.GUID, major, minor uint16) Floor

InterfaceFloor builds the interface-identifier floor (floor 1).

func NamedPipeFloor

func NamedPipeFloor(name string) Floor

NamedPipeFloor builds the named-pipe floor of an ncacn_np tower; the RHS is the NUL-terminated pipe name (e.g. “\PIPE\srvsvc”).

func NetBIOSFloor

func NetBIOSFloor(host string) Floor

NetBIOSFloor builds the NetBIOS host-name floor; the RHS is the NUL-terminated host name.

func TCPFloor

func TCPFloor(port uint16) Floor

TCPFloor builds the DOD TCP floor; the RHS is the 16-bit port in big-endian order.

func TransferSyntaxFloor

func TransferSyntaxFloor() Floor

TransferSyntaxFloor builds the NDR transfer-syntax floor (floor 2).

func (Floor) Marshal

func (f Floor) Marshal() []byte

Marshal serializes the floor: uint16 LHS length, LHS, uint16 RHS length, RHS (all lengths little-endian).

func (Floor) Protocol

func (f Floor) Protocol() byte

Protocol returns the floor’s protocol identifier byte (the first LHS octet), or 0 if the LHS is empty.

type RpcIfID

RpcIfID models RPC_IF_ID ([C706] Appendix O / [MS-RPCE] 2.2.1.2.4): an interface identifier (UUID + 16-bit major/minor version). It is the referent of ept_lookup’s optional [in, ptr] Ifid parameter, used to filter the endpoint map by interface.

UUID is the EptUUID octet form (the same fixed-octet UUID used by ept_map’s object pointer) so the codec emits it verbatim as part of the referent body.

type RpcIfID struct {
    UUID      EptUUID
    VersMajor uint16
    VersMinor uint16
}

func NewRpcIfID

func NewRpcIfID(iface guid.GUID, major, minor uint16) RpcIfID

NewRpcIfID builds an RpcIfID from a GUID and an interface major/minor version.

type Tower

Tower is an ordered list of floors describing an interface-over-transport binding.

type Tower struct {
    Floors []Floor
}

func BuildMapTowerTCP

func BuildMapTowerTCP(iface guid.GUID, ifMajor, ifMinor uint16) Tower

BuildMapTowerTCP builds the 5-floor ncacn_ip_tcp tower used as the ept_map input: the interface and NDR transfer-syntax floors describe what is wanted, and the connection-oriented/TCP/IP floors with a zero port and address request that the endpoint mapper fill in the bound endpoint.

func UnmarshalTower

func UnmarshalTower(data []byte) (Tower, error)

UnmarshalTower parses a tower octet string.

func (Tower) Binding

func (t Tower) Binding() (Binding, error)

Binding decodes the tower’s transport and address floors into a Binding. It supports ncacn_ip_tcp, ncadg_ip_udp, ncacn_np, ncacn_http, and ncalrpc. ok-style failure is reported as an error when no recognized transport (endpoint) floor is present.

func (Tower) Endpoint

func (t Tower) Endpoint() (ep Endpoint, ok bool)

Endpoint extracts the TCP port and IPv4 address from the tower’s transport floors. ok is false unless a TCP floor is present; the IP is left zero if the tower carries no IP floor. It is the ncacn_ip_tcp fast path used by ept_map’s Map; for any other transport use Binding.

func (Tower) Marshal

func (t Tower) Marshal() []byte

Marshal serializes the tower: a little-endian uint16 floor count followed by each floor.

type Twr

Twr models twr_t ([C706] Appendix O):

typedef struct {
    unsigned32 tower_length;
    [size_is(tower_length)] byte tower_octet_string[];
} twr_t;

It is a conformant structure: the NDR codec hoists the array’s maximum_count to the front of the structure and derives TowerLength from the octet-string length, so callers set only TowerOctetString. The octet string itself is a protocol tower (see Tower); use NewTwr / DecodeTower to convert between the two.

type Twr struct {
    TowerLength      uint32
    TowerOctetString []byte `ndr:"conformant,size_is=TowerLength"`
}

func NewTwr

func NewTwr(tower Tower) Twr

NewTwr wraps a protocol tower’s octet-string encoding in a twr_t.

func (Twr) DecodeTower

func (t Twr) DecodeTower() (Tower, error)

DecodeTower parses the twr_t’s octet string back into a protocol tower.