| 3628 | |
| 3629 | |
| 3630 | class SMB2_IOCTL_Request(_SMB2_Payload, _NTLMPayloadPacket): |
| 3631 | name = "SMB2 IOCTL Request" |
| 3632 | Command = 0x000B |
| 3633 | OFFSET = 56 + 64 |
| 3634 | _NTLM_PAYLOAD_FIELD_NAME = "Buffer" |
| 3635 | deprecated_fields = { |
| 3636 | "IntputCount": ("InputLen", "alias"), |
| 3637 | "OutputCount": ("OutputLen", "alias"), |
| 3638 | } |
| 3639 | fields_desc = [ |
| 3640 | XLEShortField("StructureSize", 0x39), |
| 3641 | LEShortField("Reserved", 0), |
| 3642 | LEIntEnumField( |
| 3643 | "CtlCode", |
| 3644 | 0, |
| 3645 | { |
| 3646 | 0x00060194: "FSCTL_DFS_GET_REFERRALS", |
| 3647 | 0x0011400C: "FSCTL_PIPE_PEEK", |
| 3648 | 0x00110018: "FSCTL_PIPE_WAIT", |
| 3649 | 0x0011C017: "FSCTL_PIPE_TRANSCEIVE", |
| 3650 | 0x001440F2: "FSCTL_SRV_COPYCHUNK", |
| 3651 | 0x00144064: "FSCTL_SRV_ENUMERATE_SNAPSHOTS", |
| 3652 | 0x00140078: "FSCTL_SRV_REQUEST_RESUME_KEY", |
| 3653 | 0x001441BB: "FSCTL_SRV_READ_HASH", |
| 3654 | 0x001480F2: "FSCTL_SRV_COPYCHUNK_WRITE", |
| 3655 | 0x001401D4: "FSCTL_LMR_REQUEST_RESILIENCY", |
| 3656 | 0x001401FC: "FSCTL_QUERY_NETWORK_INTERFACE_INFO", |
| 3657 | 0x000900A4: "FSCTL_SET_REPARSE_POINT", |
| 3658 | 0x000601B0: "FSCTL_DFS_GET_REFERRALS_EX", |
| 3659 | 0x00098208: "FSCTL_FILE_LEVEL_TRIM", |
| 3660 | 0x00140204: "FSCTL_VALIDATE_NEGOTIATE_INFO", |
| 3661 | 0x00094264: "FSCTL_OFFLOAD_READ", |
| 3662 | }, |
| 3663 | ), |
| 3664 | PacketField("FileId", SMB2_FILEID(), SMB2_FILEID), |
| 3665 | LEIntField("InputBufferOffset", None), |
| 3666 | LEIntField("InputLen", None), # Called InputCount but it's a length |
| 3667 | LEIntField("MaxInputResponse", 0), |
| 3668 | LEIntField("OutputBufferOffset", None), |
| 3669 | LEIntField("OutputLen", None), # Called OutputCount. |
| 3670 | LEIntField("MaxOutputResponse", 65535), |
| 3671 | FlagsField("Flags", 0, -32, {0x00000001: "SMB2_0_IOCTL_IS_FSCTL"}), |
| 3672 | LEIntField("Reserved2", 0), |
| 3673 | _NTLMPayloadField( |
| 3674 | "Buffer", |
| 3675 | OFFSET, |
| 3676 | [ |
| 3677 | _SMB2_IOCTL_Request_PacketLenField( |
| 3678 | "Input", None, conf.raw_layer, length_from=lambda pkt: pkt.InputLen |
| 3679 | ), |
| 3680 | _SMB2_IOCTL_Request_PacketLenField( |
| 3681 | "Output", |
| 3682 | None, |
| 3683 | conf.raw_layer, |
| 3684 | length_from=lambda pkt: pkt.OutputLen, |
| 3685 | ), |
| 3686 | ], |
| 3687 | ), |
no test coverage detected
searching dependent graphs…