mirror of
https://github.com/samba-team/samba.git
synced 2024-12-24 21:34:56 +03:00
088096d1ba
this should be much more portable
162 lines
4.8 KiB
Python
Executable File
162 lines
4.8 KiB
Python
Executable File
#!/usr/bin/env python
|
|
# -*- coding: utf-8 -*-
|
|
|
|
# Unix SMB/CIFS implementation.
|
|
# Copyright © Jelmer Vernooij <jelmer@samba.org> 2008
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
#
|
|
|
|
import sys
|
|
|
|
MAX_OPNUM = 1000
|
|
MAX_BASE_SIZE = 0x1000
|
|
MAX_IFACE_VERSION = 1000
|
|
|
|
DCERPC_FAULT_OP_RNG_ERROR = 0x1c010002
|
|
DCERPC_FAULT_NDR = 0x6f7
|
|
NT_STATUS_NET_WRITE_FAULT = -1073741614
|
|
|
|
|
|
sys.path.insert(0, "bin/python")
|
|
|
|
from samba.dcerpc import ClientConnection
|
|
|
|
def find_num_funcs(conn):
|
|
for i in xrange(MAX_OPNUM):
|
|
try:
|
|
conn.request(i, "")
|
|
except RuntimeError, (num, msg):
|
|
if num == DCERPC_FAULT_OP_RNG_ERROR:
|
|
return i
|
|
raise Exception("More than %d functions" % MAX_OPNUM)
|
|
|
|
class Function:
|
|
def __init__(self, conn, opnum):
|
|
self.conn = conn
|
|
self.opnum = opnum
|
|
|
|
def request(self, data):
|
|
assert isinstance(data, str)
|
|
self.conn.request(self.opnum, data)
|
|
|
|
def valid_ndr(self, data):
|
|
try:
|
|
self.request(data)
|
|
except RuntimeError, (num, msg):
|
|
if num == DCERPC_FAULT_NDR:
|
|
return False
|
|
return True
|
|
|
|
def find_base_request(self, start=""):
|
|
"""Find the smallest possible request that we can do that is
|
|
valid.
|
|
|
|
This generally means sending all zeroes so we get NULL pointers where
|
|
possible."""
|
|
# TODO: Don't try with just 0's as there may be switch_is() variables
|
|
# for which 0 is not a valid value or variables with range() set
|
|
# See how much input bytes we need
|
|
for i in range(MAX_BASE_SIZE):
|
|
data = start + chr(0) * i
|
|
if self.valid_ndr(data):
|
|
return data
|
|
return None
|
|
|
|
def check_decision_byte(self, base_request, i):
|
|
"""Check whether the specified byte is a possible "decision" byte,
|
|
e.g. a byte that is part of a pointer, array size variable or
|
|
discriminant.
|
|
|
|
Note that this function only checks if a byte is definitely a decision
|
|
byte. It may return False in some cases while the byte is actually
|
|
a decision byte."""
|
|
data = list(base_request)
|
|
data[i] = chr(1)
|
|
return not self.valid_ndr("".join(data))
|
|
|
|
def find_deferrant_data(self, base_request, idx):
|
|
data = list(base_request)
|
|
data[idx*4] = chr(1)
|
|
# Just check that this is a pointer to something non-empty:
|
|
assert not self.valid_ndr("".join(data))
|
|
|
|
newdata = self.find_base_request("".join(data))
|
|
|
|
if newdata is None:
|
|
return None
|
|
|
|
assert newdata.startswith(data)
|
|
|
|
return newdata[len(data):]
|
|
|
|
def find_idl(self):
|
|
base_request = self.find_base_request()
|
|
|
|
if base_request is None:
|
|
raise Exception("Unable to determine base size for opnum %d" % self.opnum)
|
|
|
|
print "\tBase request is %r" % base_request
|
|
|
|
decision_byte_map = map(lambda x: self.check_decision_byte(base_request, x), range(len(base_request)))
|
|
|
|
print decision_byte_map
|
|
|
|
# find pointers
|
|
possible_pointers = map(all,
|
|
[decision_byte_map[i*4:(i+1)*4] for i in range(int(len(base_request)/4))])
|
|
print possible_pointers
|
|
|
|
pointer_deferrant_bases = map(
|
|
lambda x: self.find_deferrant_data(base_request, x) if possible_pointers[x] else None, range(len(possible_pointers)))
|
|
|
|
print pointer_deferrant_bases
|
|
|
|
|
|
if len(sys.argv) < 3:
|
|
print "Usage: autoidl <binding> <UUID> [<version>]"
|
|
sys.exit(1)
|
|
|
|
(binding, uuid) = sys.argv[1:3]
|
|
if len(sys.argv) == 4:
|
|
version = sys.argv[3]
|
|
else:
|
|
version = None
|
|
|
|
if version is None:
|
|
for i in range(MAX_IFACE_VERSION):
|
|
try:
|
|
conn = ClientConnection(binding, (uuid, i))
|
|
except RuntimeError, (num, msg):
|
|
if num == NT_STATUS_NET_WRITE_FAULT:
|
|
continue
|
|
raise
|
|
else:
|
|
break
|
|
else:
|
|
conn = ClientConnection(binding, (uuid, version))
|
|
|
|
print "Figuring out number of connections...",
|
|
num_funcs = find_num_funcs(conn)
|
|
print "%d" % num_funcs
|
|
|
|
# Figure out the syntax for each one
|
|
for i in range(num_funcs):
|
|
print "Function %d" % i
|
|
data = Function(conn, i)
|
|
try:
|
|
data.find_idl()
|
|
except Exception, e:
|
|
print "Error: %r" % e
|