| 939 | |
| 940 | |
| 941 | class WINNT_ACE_HEADER(Packet): |
| 942 | fields_desc = [ |
| 943 | ByteEnumField( |
| 944 | "AceType", |
| 945 | 0, |
| 946 | { |
| 947 | 0x00: "ACCESS_ALLOWED", |
| 948 | 0x01: "ACCESS_DENIED", |
| 949 | 0x02: "SYSTEM_AUDIT", |
| 950 | 0x03: "SYSTEM_ALARM", |
| 951 | 0x04: "ACCESS_ALLOWED_COMPOUND", |
| 952 | 0x05: "ACCESS_ALLOWED_OBJECT", |
| 953 | 0x06: "ACCESS_DENIED_OBJECT", |
| 954 | 0x07: "SYSTEM_AUDIT_OBJECT", |
| 955 | 0x08: "SYSTEM_ALARM_OBJECT", |
| 956 | 0x09: "ACCESS_ALLOWED_CALLBACK", |
| 957 | 0x0A: "ACCESS_DENIED_CALLBACK", |
| 958 | 0x0B: "ACCESS_ALLOWED_CALLBACK_OBJECT", |
| 959 | 0x0C: "ACCESS_DENIED_CALLBACK_OBJECT", |
| 960 | 0x0D: "SYSTEM_AUDIT_CALLBACK", |
| 961 | 0x0E: "SYSTEM_ALARM_CALLBACK", |
| 962 | 0x0F: "SYSTEM_AUDIT_CALLBACK_OBJECT", |
| 963 | 0x10: "SYSTEM_ALARM_CALLBACK_OBJECT", |
| 964 | 0x11: "SYSTEM_MANDATORY_LABEL", |
| 965 | 0x12: "SYSTEM_RESOURCE_ATTRIBUTE", |
| 966 | 0x13: "SYSTEM_SCOPED_POLICY_ID", |
| 967 | }, |
| 968 | ), |
| 969 | FlagsField( |
| 970 | "AceFlags", |
| 971 | 0, |
| 972 | 8, |
| 973 | WINNT_ACE_FLAGS, |
| 974 | ), |
| 975 | LenField("AceSize", None, fmt="<H", adjust=lambda x: x + 4), |
| 976 | ] |
| 977 | |
| 978 | def extract_padding(self, p): |
| 979 | return p[: self.AceSize - 4], p[self.AceSize - 4 :] |
| 980 | |
| 981 | # fmt: off |
| 982 | def extractData(self, accessMask=None): |
| 983 | """ |
| 984 | Return the ACE data as usable data. |
| 985 | |
| 986 | :param accessMask: context-specific flags for the ACE Mask. |
| 987 | """ |
| 988 | sid_string = self.payload.Sid.summary() |
| 989 | mask = self.payload.Mask |
| 990 | if accessMask is not None: |
| 991 | mask = FlagValue(mask, FlagsField("", 0, 32, accessMask).names) |
| 992 | ace_flag_string = str( |
| 993 | FlagValue(self.AceFlags, ["OI", "CI", "NP", "IO", "ID", "SA", "FA"]) |
| 994 | ) |
| 995 | object_guid = getattr(self.payload, "ObjectType", "") |
| 996 | inherit_object_guid = getattr(self.payload, "InheritedObjectType", "") |
| 997 | # ApplicationData -> conditional expression |
| 998 | cond_expr = None |
no test coverage detected
searching dependent graphs…