rpcinterface_f6beaff71e194fbb9f8fb89e2018337c_1_0
import "github.com/TheManticoreProject/Manticore/network/dcerpc/interfaces/f6beaff7-1e19-4fbb-9f8f-b89e2018337c/1.0"
Package rpcinterface_f6beaff71e194fbb9f8fb89e2018337c_1_0 is the descriptor for the IEventService RPC interface, abstract syntax f6beaff7-1e19-4fbb-9f8f-b89e2018337c version 1.0 ([MS-EVEN6]).
Generated by tools/idlgen (descriptor phase) from the IDL, then reviewed by hand: the PipeName (from the spec’s Standards Assignments) and the Win32/EVT_* status-code table are not derivable from the IDL and were filled in against [MS-EVEN6]/[MS-ERREF].
Index
Constants
Opnums for the on-the-wire methods.
const (
OpnumEvtRpcRegisterRemoteSubscription uint16 = 0
OpnumEvtRpcRemoteSubscriptionNextAsync uint16 = 1
OpnumEvtRpcRemoteSubscriptionNext uint16 = 2
OpnumEvtRpcRemoteSubscriptionWaitAsync uint16 = 3
OpnumEvtRpcRegisterControllableOperation uint16 = 4
OpnumEvtRpcRegisterLogQuery uint16 = 5
OpnumEvtRpcClearLog uint16 = 6
OpnumEvtRpcExportLog uint16 = 7
OpnumEvtRpcLocalizeExportLog uint16 = 8
OpnumEvtRpcMessageRender uint16 = 9
OpnumEvtRpcMessageRenderDefault uint16 = 10
OpnumEvtRpcQueryNext uint16 = 11
OpnumEvtRpcQuerySeek uint16 = 12
OpnumEvtRpcClose uint16 = 13
OpnumEvtRpcCancel uint16 = 14
OpnumEvtRpcAssertConfig uint16 = 15
OpnumEvtRpcRetractConfig uint16 = 16
OpnumEvtRpcOpenLogHandle uint16 = 17
OpnumEvtRpcGetLogFileInfo uint16 = 18
OpnumEvtRpcGetChannelList uint16 = 19
OpnumEvtRpcGetChannelConfig uint16 = 20
OpnumEvtRpcPutChannelConfig uint16 = 21
OpnumEvtRpcGetPublisherList uint16 = 22
OpnumEvtRpcGetPublisherListForChannel uint16 = 23
OpnumEvtRpcGetPublisherMetadata uint16 = 24
OpnumEvtRpcGetPublisherResourceMetadata uint16 = 25
OpnumEvtRpcGetEventMetadataEnum uint16 = 26
OpnumEvtRpcGetNextEventMetadata uint16 = 27
OpnumEvtRpcGetClassicLogDisplayName uint16 = 28
)
Status codes returned by this interface. Every method returns error_status_t, which the EventLog Remoting Protocol Version 6.0 reports as Win32 error codes ([MS-EVEN6] 3.1.4; [MS-ERREF] 2.2), including the EVT_* range specific to Windows Event Log ([MS-ERREF] 2.2).
const (
StatusSuccess uint32 = 0x00000000 // ERROR_SUCCESS
// General Win32 error codes ([MS-ERREF] 2.2).
ErrorFileNotFound uint32 = 0x00000002 // ERROR_FILE_NOT_FOUND
ErrorPathNotFound uint32 = 0x00000003 // ERROR_PATH_NOT_FOUND
ErrorAccessDenied uint32 = 0x00000005 // ERROR_ACCESS_DENIED
ErrorInvalidHandle uint32 = 0x00000006 // ERROR_INVALID_HANDLE
ErrorNotEnoughMemory uint32 = 0x00000008 // ERROR_NOT_ENOUGH_MEMORY
ErrorInvalidParameter uint32 = 0x00000057 // ERROR_INVALID_PARAMETER
ErrorInsufficientBuffer uint32 = 0x0000007A // ERROR_INSUFFICIENT_BUFFER
ErrorNoMoreItems uint32 = 0x00000103 // ERROR_NO_MORE_ITEMS (enumeration exhausted)
ErrorTimeout uint32 = 0x000005B4 // ERROR_TIMEOUT
ErrorNotFound uint32 = 0x00000490 // ERROR_NOT_FOUND
// Windows Event Log (EVT_*) error codes ([MS-ERREF] 2.2).
ErrorEvtInvalidChannelPath uint32 = 0x00003A98 // ERROR_EVT_INVALID_CHANNEL_PATH (15000)
ErrorEvtInvalidQuery uint32 = 0x00003A99 // ERROR_EVT_INVALID_QUERY (15001)
ErrorEvtPublisherMetadataNotFound uint32 = 0x00003A9A // ERROR_EVT_PUBLISHER_METADATA_NOT_FOUND (15002)
ErrorEvtEventTemplateNotFound uint32 = 0x00003A9B // ERROR_EVT_EVENT_TEMPLATE_NOT_FOUND (15003)
ErrorEvtInvalidPublisherName uint32 = 0x00003A9C // ERROR_EVT_INVALID_PUBLISHER_NAME (15004)
ErrorEvtInvalidEventData uint32 = 0x00003A9D // ERROR_EVT_INVALID_EVENT_DATA (15005)
ErrorEvtChannelNotFound uint32 = 0x00003A9F // ERROR_EVT_CHANNEL_NOT_FOUND (15007)
ErrorEvtMalformedXmlText uint32 = 0x00003AA0 // ERROR_EVT_MALFORMED_XML_TEXT (15008)
ErrorEvtQueryResultStale uint32 = 0x00003AA3 // ERROR_EVT_QUERY_RESULT_STALE (15011)
ErrorEvtMessageNotFound uint32 = 0x00003AB3 // ERROR_EVT_MESSAGE_NOT_FOUND (15027)
ErrorEvtMessageIDNotFound uint32 = 0x00003AB4 // ERROR_EVT_MESSAGE_ID_NOT_FOUND (15028)
ErrorEvtUnresolvedValueInsert uint32 = 0x00003AB5 // ERROR_EVT_UNRESOLVED_VALUE_INSERT (15029)
)
PipeName is the IPC$-relative named pipe for the IEventService interface. [MS-EVEN6]’s Standards Assignments give the RPC endpoint name “Eventlog”; the interface is reached over ncacn_np at \pipe\eventlog (and ncacn_ip_tcp with a dynamic endpoint).
const PipeName = `\eventlog`
Variables
NameToOpnum is the reverse of OpnumToName, built at init so the two never drift.
var NameToOpnum = func() map[string]uint16 {
m := make(map[string]uint16, len(OpnumToName))
for op, name := range OpnumToName {
m[name] = op
}
return m
}()
OpnumToName maps each on-the-wire opnum to its method name; the single source of truth.
var OpnumToName = map[uint16]string{
OpnumEvtRpcRegisterRemoteSubscription: "EvtRpcRegisterRemoteSubscription",
OpnumEvtRpcRemoteSubscriptionNextAsync: "EvtRpcRemoteSubscriptionNextAsync",
OpnumEvtRpcRemoteSubscriptionNext: "EvtRpcRemoteSubscriptionNext",
OpnumEvtRpcRemoteSubscriptionWaitAsync: "EvtRpcRemoteSubscriptionWaitAsync",
OpnumEvtRpcRegisterControllableOperation: "EvtRpcRegisterControllableOperation",
OpnumEvtRpcRegisterLogQuery: "EvtRpcRegisterLogQuery",
OpnumEvtRpcClearLog: "EvtRpcClearLog",
OpnumEvtRpcExportLog: "EvtRpcExportLog",
OpnumEvtRpcLocalizeExportLog: "EvtRpcLocalizeExportLog",
OpnumEvtRpcMessageRender: "EvtRpcMessageRender",
OpnumEvtRpcMessageRenderDefault: "EvtRpcMessageRenderDefault",
OpnumEvtRpcQueryNext: "EvtRpcQueryNext",
OpnumEvtRpcQuerySeek: "EvtRpcQuerySeek",
OpnumEvtRpcClose: "EvtRpcClose",
OpnumEvtRpcCancel: "EvtRpcCancel",
OpnumEvtRpcAssertConfig: "EvtRpcAssertConfig",
OpnumEvtRpcRetractConfig: "EvtRpcRetractConfig",
OpnumEvtRpcOpenLogHandle: "EvtRpcOpenLogHandle",
OpnumEvtRpcGetLogFileInfo: "EvtRpcGetLogFileInfo",
OpnumEvtRpcGetChannelList: "EvtRpcGetChannelList",
OpnumEvtRpcGetChannelConfig: "EvtRpcGetChannelConfig",
OpnumEvtRpcPutChannelConfig: "EvtRpcPutChannelConfig",
OpnumEvtRpcGetPublisherList: "EvtRpcGetPublisherList",
OpnumEvtRpcGetPublisherListForChannel: "EvtRpcGetPublisherListForChannel",
OpnumEvtRpcGetPublisherMetadata: "EvtRpcGetPublisherMetadata",
OpnumEvtRpcGetPublisherResourceMetadata: "EvtRpcGetPublisherResourceMetadata",
OpnumEvtRpcGetEventMetadataEnum: "EvtRpcGetEventMetadataEnum",
OpnumEvtRpcGetNextEventMetadata: "EvtRpcGetNextEventMetadata",
OpnumEvtRpcGetClassicLogDisplayName: "EvtRpcGetClassicLogDisplayName",
}
func StatusString
func StatusString(status uint32) string
StatusString returns a mnemonic for the documented status codes, otherwise the hex value.
func SyntaxID
func SyntaxID() syntax.SyntaxID
SyntaxID returns the IEventService abstract syntax identifier: f6beaff7-1e19-4fbb-9f8f-b89e2018337c, version 1.0.