Class SMB2_Transform_Header

scapy/layers/smb2.py:4393–4438

class SMB2_Transform_Header(Packet):
    name = "SMB2 Transform Header"
    fields_desc = [
        StrFixedLenField("Start", b"\xfdSMB", 4),
        XStrFixedLenField("Signature", 0, length=16),
        XStrFixedLenField("Nonce", b"", length=16),
        LEIntField("OriginalMessageSize", 0x0),
        LEShortField("Reserved", 0),
        LEShortEnumField(
            "Flags",
            0x1,
            {
                0x0001: "ENCRYPTED",
            },
        ),
        LELongField("SessionId", 0),
    ]

    def decrypt(self, dialect, DecryptionKey, CipherId):
        """
        [MS-SMB2] sect 3.2.5.1.1.1 - Decrypting the Message
        """
        if not isinstance(self.payload, conf.raw_layer):
            raise Exception("No payload to decrypt !")

        if "GCM" in CipherId:
            from cryptography.hazmat.primitives.ciphers.aead import AESGCM

            nonce = self.Nonce[:12]
            cipher = AESGCM(DecryptionKey)
        elif "CCM" in CipherId:
            from cryptography.hazmat.primitives.ciphers.aead import AESCCM

            nonce = self.Nonce[:11]
            cipher = AESCCM(DecryptionKey)
        else:
            raise Exception("Unknown CipherId !")

        # Decrypt the data
        aad = self.self_build()[20:]
        data = cipher.decrypt(
            nonce,
            self.payload.load + self.Signature,
            aad,
        )
        return SMB2_Header(data, _decrypted=True)


bind_layers(SMB2_Transform_Header, conf.raw_layer)