Hide keyboard shortcuts

Hot-keys on this page

r m x p   toggle line displays

j k   next/prev highlighted chunk

0   (zero) top of page

1   (one) first highlighted chunk

1# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved. 

2# 

3# This software is provided under under a slightly modified version 

4# of the Apache Software License. See the accompanying LICENSE file 

5# for more information. 

6# 

7# Author: Alberto Solino (@agsolino) 

8# 

9# Description: 

10# [MS-SCMR] Interface implementation 

11# 

12# Best way to learn how to use these calls is to grab the protocol standard 

13# so you understand what the call does, and then read the test case located 

14# at https://github.com/SecureAuthCorp/impacket/tree/master/tests/SMB_RPC 

15# 

16# Some calls have helper functions, which makes it even easier to use. 

17# They are located at the end of this file.  

18# Helper functions start with "h"<name of the call>. 

19# There are test cases for them too.  

20# 

21 

22from impacket import system_errors 

23from impacket.dcerpc.v5.dtypes import NULL, DWORD, LPWSTR, ULONG, BOOL, LPBYTE, ULONGLONG, PGUID, USHORT, LPDWORD, WSTR, \ 

24 GUID, PBOOL, WIDESTR 

25from impacket.dcerpc.v5.ndr import NDRCALL, NDR, NDRSTRUCT, NDRPOINTER, NDRPOINTERNULL, NDRUniConformantArray, NDRUNION 

26from impacket.dcerpc.v5.rpcrt import DCERPCException 

27from impacket.uuid import uuidtup_to_bin 

28 

29MSRPC_UUID_SCMR = uuidtup_to_bin(('367ABB81-9844-35F1-AD32-98F038001003', '2.0')) 

30 

31class DCERPCSessionError(DCERPCException): 

32 def __init__(self, error_string=None, error_code=None, packet=None): 

33 DCERPCException.__init__(self, error_string, error_code, packet) 

34 

35 def __str__( self ): 

36 key = self.error_code 

37 if key in system_errors.ERROR_MESSAGES: 37 ↛ 42line 37 didn't jump to line 42, because the condition on line 37 was never false

38 error_msg_short = system_errors.ERROR_MESSAGES[key][0] 

39 error_msg_verbose = system_errors.ERROR_MESSAGES[key][1] 

40 return 'SCMR SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose) 

41 else: 

42 return 'SCMR SessionError: unknown error code: 0x%x' % self.error_code 

43 

44################################################################################ 

45# CONSTANTS 

46################################################################################ 

47 

48# Access codes 

49SERVICE_ALL_ACCESS = 0X000F01FF 

50SERVICE_CHANGE_CONFIG = 0X00000002 

51SERVICE_ENUMERATE_DEPENDENTS = 0X00000008 

52SERVICE_INTERROGATE = 0X00000080 

53SERVICE_PAUSE_CONTINUE = 0X00000040 

54SERVICE_QUERY_CONFIG = 0X00000001 

55SERVICE_QUERY_STATUS = 0X00000004 

56SERVICE_START = 0X00000010 

57SERVICE_STOP = 0X00000020 

58SERVICE_USER_DEFINED_CTRL = 0X00000100 

59SERVICE_SET_STATUS = 0X00008000 

60 

61# Specific Access for SCM 

62SC_MANAGER_LOCK = 0x00000008 

63SC_MANAGER_CREATE_SERVICE = 0x00000002 

64SC_MANAGER_ENUMERATE_SERVICE = 0x00000004 

65SC_MANAGER_CONNECT = 0x00000001 

66SC_MANAGER_QUERY_LOCK_STATUS = 0x00000010 

67SC_MANAGER_MODIFY_BOOT_CONFIG = 0x00000020 

68 

69# Service Types 

70SERVICE_KERNEL_DRIVER = 0x00000001 

71SERVICE_FILE_SYSTEM_DRIVER = 0x00000002 

72SERVICE_WIN32_OWN_PROCESS = 0x00000010 

73SERVICE_WIN32_SHARE_PROCESS = 0x00000020 

74SERVICE_INTERACTIVE_PROCESS = 0x00000100 

75SERVICE_NO_CHANGE = 0xffffffff 

76 

77# Start Types 

78SERVICE_BOOT_START = 0x00000000 

79SERVICE_SYSTEM_START = 0x00000001 

80SERVICE_AUTO_START = 0x00000002 

81SERVICE_DEMAND_START = 0x00000003 

82SERVICE_DISABLED = 0x00000004 

83SERVICE_NO_CHANGE = 0xffffffff 

84 

85# Error Control  

86SERVICE_ERROR_IGNORE = 0x00000000 

87SERVICE_ERROR_NORMAL = 0x00000001 

88SERVICE_ERROR_SEVERE = 0x00000002 

89SERVICE_ERROR_CRITICAL = 0x00000003 

90SERVICE_NO_CHANGE = 0xffffffff 

91 

92# Service Control Codes 

93SERVICE_CONTROL_CONTINUE = 0x00000003 

94SERVICE_CONTROL_INTERROGATE = 0x00000004 

95SERVICE_CONTROL_PARAMCHANGE = 0x00000006 

96SERVICE_CONTROL_PAUSE = 0x00000002 

97SERVICE_CONTROL_STOP = 0x00000001 

98SERVICE_CONTROL_NETBINDADD = 0x00000007 

99SERVICE_CONTROL_NETBINDREMOVE = 0x00000008 

100SERVICE_CONTROL_NETBINDENABLE = 0x00000009 

101SERVICE_CONTROL_NETBINDDISABLE= 0x0000000A 

102 

103# Service State 

104SERVICE_ACTIVE = 0x00000001 

105SERVICE_INACTIVE = 0x00000002 

106SERVICE_STATE_ALL = 0x00000003 

107 

108# Current State 

109SERVICE_CONTINUE_PENDING = 0x00000005 

110SERVICE_PAUSE_PENDING = 0x00000006 

111SERVICE_PAUSED = 0x00000007 

112SERVICE_RUNNING = 0x00000004 

113SERVICE_START_PENDING = 0x00000002 

114SERVICE_STOP_PENDING = 0x00000003 

115SERVICE_STOPPED = 0x00000001 

116 

117# Controls Accepted 

118SERVICE_ACCEPT_PARAMCHANGE = 0x00000008 

119SERVICE_ACCEPT_PAUSE_CONTINUE = 0x00000002 

120SERVICE_ACCEPT_SHUTDOWN = 0x00000004 

121SERVICE_ACCEPT_STOP = 0x00000001 

122SERVICE_ACCEPT_HARDWAREPROFILECHANGE = 0x00000020 

123SERVICE_ACCEPT_POWEREVENT = 0x00000040 

124SERVICE_ACCEPT_SESSIONCHANGE = 0x00000080 

125SERVICE_ACCEPT_PRESHUTDOWN = 0x00000100 

126SERVICE_ACCEPT_TIMECHANGE = 0x00000200 

127ERVICE_ACCEPT_TRIGGEREVENT = 0x00000400 

128 

129# Security Information 

130DACL_SECURITY_INFORMATION = 0x4 

131GROUP_SECURITY_INFORMATION = 0x2 

132OWNER_SECURITY_INFORMATION = 0x1 

133SACL_SECURITY_INFORMATION = 0x8 

134 

135# Service Config2 Info Levels 

136SERVICE_CONFIG_DESCRIPTION = 0x00000001 

137SERVICE_CONFIG_FAILURE_ACTIONS = 0x00000002 

138SERVICE_CONFIG_DELAYED_AUTO_START_INFO = 0x00000003 

139SERVICE_CONFIG_FAILURE_ACTIONS_FLAG = 0x00000004 

140SERVICE_CONFIG_SERVICE_SID_INFO = 0x00000005 

141SERVICE_CONFIG_REQUIRED_PRIVILEGES_INFO = 0x00000006 

142SERVICE_CONFIG_PRESHUTDOWN_INFO = 0x00000007 

143SERVICE_CONFIG_PREFERRED_NODE = 0x00000009 

144SERVICE_CONFIG_RUNLEVEL_INFO = 0x0000000A 

145 

146# SC_ACTIONS Types 

147SC_ACTION_NONE = 0 

148SC_ACTION_RESTART = 1 

149SC_ACTION_REBOOT = 2 

150SC_ACTION_RUN_COMMAND = 3 

151 

152# SERVICE_SID_INFO types 

153SERVICE_SID_TYPE_NONE = 0x00000000 

154SERVICE_SID_TYPE_RESTRICTED = 0x00000003 

155SERVICE_SID_TYPE_UNRESTRICTED = 0x00000001 

156 

157# SC_STATUS_TYPE types 

158SC_STATUS_PROCESS_INFO = 0 

159 

160# Notify Mask 

161SERVICE_NOTIFY_CREATED = 0x00000080 

162SERVICE_NOTIFY_CONTINUE_PENDING = 0x00000010 

163SERVICE_NOTIFY_DELETE_PENDING = 0x00000200 

164SERVICE_NOTIFY_DELETED = 0x00000100 

165SERVICE_NOTIFY_PAUSE_PENDING = 0x00000020 

166SERVICE_NOTIFY_PAUSED = 0x00000040 

167SERVICE_NOTIFY_RUNNING = 0x00000008 

168SERVICE_NOTIFY_START_PENDING = 0x00000002 

169SERVICE_NOTIFY_STOP_PENDING = 0x00000004 

170SERVICE_NOTIFY_STOPPED = 0x00000001 

171 

172# SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW Reasons 

173SERVICE_STOP_CUSTOM = 0x20000000 

174SERVICE_STOP_PLANNED = 0x40000000 

175SERVICE_STOP_UNPLANNED = 0x10000000 

176 

177# SERVICE_TRIGGER triggers 

178SERVICE_TRIGGER_TYPE_DEVICE_INTERFACE_ARRIVAL = 0x00000001 

179SERVICE_TRIGGER_TYPE_IP_ADDRESS_AVAILABILITY = 0x00000002 

180SERVICE_TRIGGER_TYPE_DOMAIN_JOIN = 0x00000003 

181SERVICE_TRIGGER_TYPE_FIREWALL_PORT_EVENT = 0x00000004 

182SERVICE_TRIGGER_TYPE_GROUP_POLICY = 0x00000005 

183SERVICE_TRIGGER_TYPE_CUSTOM = 0x00000020 

184 

185# SERVICE_TRIGGER actions 

186SERVICE_TRIGGER_ACTION_SERVICE_START = 0x00000001 

187SERVICE_TRIGGER_ACTION_SERVICE_STOP = 0x00000002 

188 

189# SERVICE_TRIGGER subTypes 

190DOMAIN_JOIN_GUID = '1ce20aba-9851-4421-9430-1ddeb766e809' 

191DOMAIN_LEAVE_GUID = 'ddaf516e-58c2-4866-9574-c3b615d42ea1' 

192FIREWALL_PORT_OPEN_GUID = 'b7569e07-8421-4ee0-ad10-86915afdad09' 

193FIREWALL_PORT_CLOSE_GUID = 'a144ed38-8e12-4de4-9d96-e64740b1a524' 

194MACHINE_POLICY_PRESENT_GUID = '659FCAE6-5BDB-4DA9-B1FF-CA2A178D46E0' 

195NETWORK_MANAGER_FIRST_IP_ADDRESS_ARRIVAL_GUID = '4f27f2de-14e2-430b-a549-7cd48cbc8245' 

196NETWORK_MANAGER_LAST_IP_ADDRESS_REMOVAL_GUID = 'cc4ba62a-162e-4648-847a-b6bdf993e335' 

197USER_POLICY_PRESENT_GUID = '54FB46C8-F089-464C-B1FD-59D1B62C3B50' 

198 

199# SERVICE_TRIGGER_SPECIFIC_DATA_ITEM dataTypes 

200SERVICE_TRIGGER_DATA_TYPE_BINARY = 0x00000001 

201SERVICE_TRIGGER_DATA_TYPE_STRING = 0x00000002 

202 

203################################################################################ 

204# STRUCTURES 

205################################################################################ 

206 

207class BYTE_ARRAY(NDRUniConformantArray): 

208 item = 'c' 

209 

210class SC_RPC_HANDLE(NDRSTRUCT): 

211 structure = ( 

212 ('Data','20s=""'), 

213 ) 

214 def getAlignment(self): 

215 return 1 

216 

217SC_NOTIFY_RPC_HANDLE = SC_RPC_HANDLE 

218 

219class SERVICE_STATUS(NDRSTRUCT): 

220 structure = ( 

221 ('dwServiceType',DWORD), 

222 ('dwCurrentState',DWORD), 

223 ('dwControlsAccepted',DWORD), 

224 ('dwWin32ExitCode',DWORD), 

225 ('dwServiceSpecificExitCode',DWORD), 

226 ('dwCheckPoint',DWORD), 

227 ('dwWaitHint',DWORD), 

228 ) 

229 

230class QUERY_SERVICE_CONFIGW(NDRSTRUCT): 

231 structure = ( 

232 ('dwServiceType',DWORD), 

233 ('dwStartType',DWORD), 

234 ('dwErrorControl',DWORD), 

235 ('lpBinaryPathName', LPWSTR), 

236 ('lpLoadOrderGroup',LPWSTR), 

237 ('dwTagId',DWORD), 

238 ('lpDependencies',LPWSTR), 

239 ('lpServiceStartName',LPWSTR), 

240 ('lpDisplayName',LPWSTR), 

241 ) 

242 

243class SC_RPC_LOCK(NDRSTRUCT): 

244 structure = ( 

245 ('Data','20s=""'), 

246 ) 

247 def getAlignment(self): 

248 return 1 

249 

250class LPSERVICE_STATUS(NDRPOINTER): 

251 referent = ( 

252 ('Data',SERVICE_STATUS), 

253 ) 

254 

255SECURITY_INFORMATION = ULONG 

256 

257BOUNDED_DWORD_256K = DWORD 

258 

259class LPBOUNDED_DWORD_256K(NDRPOINTER): 

260 referent = ( 

261 ('Data', BOUNDED_DWORD_256K), 

262 ) 

263 

264SVCCTL_HANDLEW = LPWSTR 

265 

266class ENUM_SERVICE_STATUSW(NDRSTRUCT): 

267 structure = ( 

268 ('lpServiceName',LPWSTR), 

269 ('lpDisplayName',LPWSTR), 

270 ('ServiceStatus',SERVICE_STATUS), 

271 ) 

272 

273class LPQUERY_SERVICE_CONFIGW(NDRPOINTER): 

274 referent = ( 

275 ('Data', QUERY_SERVICE_CONFIGW), 

276 ) 

277 

278BOUNDED_DWORD_8K = DWORD 

279BOUNDED_DWORD_4K = DWORD 

280 

281class STRING_PTRSW(NDRSTRUCT): 

282 structure = ( 

283 ('Data',NDRUniConformantArray), 

284 ) 

285 def __init__(self, data = None, isNDR64 = False): 

286 NDR.__init__(self,None,isNDR64) 

287 self.fields['Data'].item = LPWSTR 

288 if data is not None: 288 ↛ 289line 288 didn't jump to line 289, because the condition on line 288 was never true

289 self.fromString(data) 

290 

291class UNIQUE_STRING_PTRSW(NDRPOINTER): 

292 referent = ( 

293 ('Data', STRING_PTRSW), 

294 ) 

295 

296class QUERY_SERVICE_LOCK_STATUSW(NDRSTRUCT): 

297 structure = ( 

298 ('fIsLocked',DWORD), 

299 ('lpLockOwner',LPWSTR), 

300 ('dwLockDuration',DWORD), 

301 ) 

302 

303class SERVICE_DESCRIPTION_WOW64(NDRSTRUCT): 

304 structure = ( 

305 ('dwDescriptionOffset', DWORD), 

306 ) 

307 

308class SERVICE_DESCRIPTIONW(NDRSTRUCT): 

309 structure = ( 

310 ('lpDescription', LPWSTR), 

311 ) 

312 

313class LPSERVICE_DESCRIPTIONW(NDRPOINTER): 

314 referent = ( 

315 ('Data', SERVICE_DESCRIPTIONW), 

316 ) 

317 

318class SERVICE_FAILURE_ACTIONS_WOW64(NDRSTRUCT): 

319 structure = ( 

320 ('dwResetPeriod', DWORD), 

321 ('dwRebootMsgOffset', DWORD), 

322 ('dwCommandOffset', DWORD), 

323 ('cActions', DWORD), 

324 ('dwsaActionsOffset', DWORD), 

325 ) 

326 

327class SC_ACTION(NDRSTRUCT): 

328 structure = ( 

329 ('Type', DWORD), 

330 ('Delay', DWORD) , 

331 ) 

332 

333class SC_ACTIONS(NDRSTRUCT): 

334 structure = ( 

335 ('Data', NDRUniConformantArray), 

336 ) 

337 def __init__(self, data = None, isNDR64 = False): 

338 NDR.__init__(self,None,isNDR64) 

339 self.fields['Data'].item = SC_ACTION 

340 if data is not None: 

341 self.fromString(data) 

342 

343class SERVICE_FAILURE_ACTIONSW(NDRSTRUCT): 

344 structure = ( 

345 ('dwResetPeriod', DWORD), 

346 ('lpRebootMsg', LPWSTR) , 

347 ('lpCommand', LPWSTR) , 

348 ('cActions', DWORD) , 

349 ('lpsaActions', SC_ACTIONS) , 

350 ) 

351 

352class LPSERVICE_FAILURE_ACTIONSW(NDRPOINTER): 

353 referent = ( 

354 ('Data', SERVICE_FAILURE_ACTIONSW), 

355 ) 

356 

357class SERVICE_FAILURE_ACTIONS_FLAG(NDRSTRUCT): 

358 structure = ( 

359 ('fFailureActionsOnNonCrashFailures', BOOL), 

360 ) 

361 

362class LPSERVICE_FAILURE_ACTIONS_FLAG(NDRPOINTER): 

363 referent = ( 

364 ('Data', SERVICE_FAILURE_ACTIONS_FLAG), 

365 ) 

366 

367class SERVICE_DELAYED_AUTO_START_INFO(NDRSTRUCT): 

368 structure = ( 

369 ('fDelayedAutostart', BOOL), 

370 ) 

371 

372class LPSERVICE_DELAYED_AUTO_START_INFO(NDRPOINTER): 

373 referent = ( 

374 ('Data', SERVICE_DELAYED_AUTO_START_INFO), 

375 ) 

376 

377class SERVICE_SID_INFO(NDRSTRUCT): 

378 structure = ( 

379 ('dwServiceSidType', DWORD), 

380 ) 

381 

382class LPSERVICE_SID_INFO(NDRPOINTER): 

383 referent = ( 

384 ('Data', SERVICE_SID_INFO), 

385 ) 

386 

387 

388class SERVICE_RPC_REQUIRED_PRIVILEGES_INFO(NDRSTRUCT): 

389 structure = ( 

390 ('cbRequiredPrivileges',DWORD), 

391 ('pRequiredPrivileges',LPBYTE), 

392 ) 

393 def getData(self, soFar = 0): 

394 self['cbRequiredPrivileges'] = len(self['pRequiredPrivileges']) 

395 return NDR.getData(self, soFar = 0) 

396 

397 

398class LPSERVICE_RPC_REQUIRED_PRIVILEGES_INFO(NDRPOINTER): 

399 referent = ( 

400 ('Data', SERVICE_RPC_REQUIRED_PRIVILEGES_INFO), 

401 ) 

402 

403class SERVICE_REQUIRED_PRIVILEGES_INFO_WOW64(NDRSTRUCT): 

404 structure = ( 

405 ('dwRequiredPrivilegesOffset', DWORD), 

406 ) 

407 

408class SERVICE_PRESHUTDOWN_INFO(NDRSTRUCT): 

409 structure = ( 

410 ('dwPreshutdownTimeout', DWORD), 

411 ) 

412 

413class LPSERVICE_PRESHUTDOWN_INFO(NDRPOINTER): 

414 referent = ( 

415 ('Data', SERVICE_PRESHUTDOWN_INFO), 

416 ) 

417 

418class SERVICE_STATUS_PROCESS(NDRSTRUCT): 

419 structure = ( 

420 ('dwServiceType', DWORD), 

421 ('dwCurrentState', DWORD), 

422 ('dwControlsAccepted', DWORD), 

423 ('dwWin32ExitCode', DWORD), 

424 ('dwServiceSpecificExitCode', DWORD), 

425 ('dwCheckPoint', DWORD), 

426 ('dwWaitHint', DWORD), 

427 ('dwProcessId', DWORD), 

428 ('dwServiceFlags', DWORD), 

429 ) 

430 

431class UCHAR_16(NDRSTRUCT): 

432 structure = ( 

433 ('Data', '16s=""'), 

434 ) 

435 def getAlignment(self): 

436 return 1 

437 

438class SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1(NDRSTRUCT): 

439 structure = ( 

440 ('ullThreadId',ULONGLONG), 

441 ('dwNotifyMask',DWORD), 

442 ('CallbackAddressArray',UCHAR_16), 

443 ('CallbackParamAddressArray',UCHAR_16), 

444 ('ServiceStatus', SERVICE_STATUS_PROCESS), 

445 ('dwNotificationStatus',DWORD), 

446 ('dwSequence',DWORD), 

447 ) 

448 

449class SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2(NDRSTRUCT): 

450 structure = ( 

451 ('ullThreadId',ULONGLONG), 

452 ('dwNotifyMask',DWORD), 

453 ('CallbackAddressArray',UCHAR_16), 

454 ('CallbackParamAddressArray',UCHAR_16), 

455 ('ServiceStatus',SERVICE_STATUS_PROCESS), 

456 ('dwNotificationStatus',DWORD), 

457 ('dwSequence',DWORD), 

458 ('dwNotificationTriggered',DWORD), 

459 ('pszServiceNames',LPWSTR), 

460 ) 

461 

462class PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1(NDRPOINTER): 

463 referent = ( 

464 ('Data', SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1), 

465 ) 

466 

467class PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2(NDRPOINTER): 

468 referent = ( 

469 ('Data', SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2), 

470 ) 

471 

472class SC_RPC_NOTIFY_PARAMS(NDRUNION): 

473 union = { 

474 1: ('pStatusChangeParam1', PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1), 

475 2: ('pStatusChangeParams', PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2), 

476 } 

477 

478class SC_RPC_NOTIFY_PARAMS_ARRAY(NDRUniConformantArray): 

479 item = SC_RPC_NOTIFY_PARAMS 

480 

481class PSC_RPC_NOTIFY_PARAMS_LIST(NDRSTRUCT): 

482 structure = ( 

483 ('cElements',BOUNDED_DWORD_4K), 

484 ('NotifyParamsArray', SC_RPC_NOTIFY_PARAMS_ARRAY), 

485 ) 

486 

487class SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW(NDRSTRUCT): 

488 structure = ( 

489 ('dwReason', DWORD), 

490 ('pszComment', LPWSTR), 

491 ) 

492 

493class SERVICE_TRIGGER_SPECIFIC_DATA_ITEM(NDRSTRUCT): 

494 structure = ( 

495 ('dwDataType',DWORD ), 

496 ('cbData',DWORD), 

497 ('pData', LPBYTE), 

498 ) 

499 def getData(self, soFar = 0): 

500 if self['pData'] != 0: 

501 self['cbData'] = len(self['pData']) 

502 return NDR.getData(self, soFar) 

503 

504class SERVICE_TRIGGER_SPECIFIC_DATA_ITEM_ARRAY(NDRUniConformantArray): 

505 item = SERVICE_TRIGGER_SPECIFIC_DATA_ITEM 

506 

507class PSERVICE_TRIGGER_SPECIFIC_DATA_ITEM(NDRPOINTER): 

508 referent = ( 

509 ('Data', SERVICE_TRIGGER_SPECIFIC_DATA_ITEM_ARRAY), 

510 ) 

511 

512class SERVICE_TRIGGER(NDRSTRUCT): 

513 structure = ( 

514 ('dwTriggerType', DWORD), 

515 ('dwAction', DWORD), 

516 ('pTriggerSubtype', PGUID), 

517 ('cDataItems', DWORD), 

518 ('pDataItems', PSERVICE_TRIGGER_SPECIFIC_DATA_ITEM), 

519 ) 

520 def getData(self, soFar = 0): 

521 if self['pDataItems'] != 0: 

522 self['cDataItems'] = len(self['pDataItems']) 

523 return NDR.getData(self, soFar) 

524 

525class SERVICE_TRIGGER_ARRAY(NDRUniConformantArray): 

526 item = SERVICE_TRIGGER 

527 

528class PSERVICE_TRIGGER(NDRPOINTER): 

529 referent = ( 

530 ('Data', SERVICE_TRIGGER_ARRAY), 

531 ) 

532 

533class SERVICE_CONTROL_STATUS_REASON_OUT_PARAMS(NDRSTRUCT): 

534 structure = ( 

535 ('ServiceStatus', SERVICE_STATUS_PROCESS), 

536 ) 

537 

538class SERVICE_TRIGGER_INFO(NDRSTRUCT): 

539 structure = ( 

540 ('cTriggers', DWORD), 

541 ('pTriggers', PSERVICE_TRIGGER), 

542 ('pReserved', NDRPOINTERNULL ), 

543 ) 

544 def getData(self, soFar = 0): 

545 if self['pTriggers'] != 0: 

546 self['cTriggers'] = len(self['pTriggers']) 

547 return NDR.getData(self, soFar) 

548 

549class PSERVICE_TRIGGER_INFO(NDRPOINTER): 

550 referent = ( 

551 ('Data', SERVICE_TRIGGER_INFO), 

552 ) 

553 

554class SERVICE_PREFERRED_NODE_INFO(NDRSTRUCT): 

555 structure = ( 

556 ('usPreferredNode', USHORT), 

557 ('fDelete', BOOL), 

558 ) 

559 

560class LPSERVICE_PREFERRED_NODE_INFO(NDRPOINTER): 

561 referent = ( 

562 ('Data', SERVICE_PREFERRED_NODE_INFO), 

563 ) 

564 

565class SERVICE_RUNLEVEL_INFO(NDRSTRUCT): 

566 structure = ( 

567 ('eLowestRunLevel', DWORD), 

568 ) 

569 

570class PSERVICE_RUNLEVEL_INFO(NDRPOINTER): 

571 referent = ( 

572 ('Data', SERVICE_RUNLEVEL_INFO), 

573 ) 

574 

575class SERVICE_MANAGEDACCOUNT_INFO(NDRSTRUCT): 

576 structure = ( 

577 ('fIsManagedAccount', DWORD), 

578 ) 

579 

580class PSERVICE_MANAGEDACCOUNT_INFO(NDRPOINTER): 

581 referent = ( 

582 ('Data', SERVICE_MANAGEDACCOUNT_INFO), 

583 ) 

584 

585class SC_RPC_CONFIG_INFOW_UNION(NDRUNION): 

586 commonHdr = ( 

587 ('tag', ULONG), 

588 ) 

589 

590 union = { 

591 1: ('psd', LPSERVICE_DESCRIPTIONW), 

592 2: ('psfa',LPSERVICE_FAILURE_ACTIONSW ), 

593 3: ('psda',LPSERVICE_DELAYED_AUTO_START_INFO), 

594 4: ('psfaf',LPSERVICE_FAILURE_ACTIONS_FLAG), 

595 5: ('pssid',LPSERVICE_SID_INFO), 

596 6: ('psrp',LPSERVICE_RPC_REQUIRED_PRIVILEGES_INFO), 

597 7: ('psps',LPSERVICE_PRESHUTDOWN_INFO), 

598 8: ('psti',PSERVICE_TRIGGER_INFO), 

599 9: ('pspn',LPSERVICE_PREFERRED_NODE_INFO), 

600 10: ('psri',PSERVICE_RUNLEVEL_INFO), 

601 11: ('psma',PSERVICE_MANAGEDACCOUNT_INFO), 

602 } 

603 

604class SC_RPC_CONFIG_INFOW(NDRSTRUCT): 

605 structure = ( 

606 ('dwInfoLevel', DWORD), 

607 ('Union', SC_RPC_CONFIG_INFOW_UNION), 

608 ) 

609 

610################################################################################ 

611# RPC CALLS 

612################################################################################ 

613 

614class RCloseServiceHandle(NDRCALL): 

615 opnum = 0 

616 structure = ( 

617 ('hSCObject',SC_RPC_HANDLE), 

618 ) 

619 

620class RCloseServiceHandleResponse(NDRCALL): 

621 structure = ( 

622 ('hSCObject',SC_RPC_HANDLE), 

623 ('ErrorCode', DWORD), 

624 ) 

625 

626class RControlService(NDRCALL): 

627 opnum = 1 

628 structure = ( 

629 ('hService',SC_RPC_HANDLE), 

630 ('dwControl',DWORD), 

631 ) 

632 

633class RControlServiceResponse(NDRCALL): 

634 structure = ( 

635 ('lpServiceStatus',SERVICE_STATUS), 

636 ('ErrorCode', DWORD), 

637 ) 

638 

639class RDeleteService(NDRCALL): 

640 opnum = 2 

641 structure = ( 

642 ('hService',SC_RPC_HANDLE), 

643 ) 

644 

645class RDeleteServiceResponse(NDRCALL): 

646 structure = ( 

647 ('ErrorCode', DWORD), 

648 ) 

649 

650class RLockServiceDatabase(NDRCALL): 

651 opnum = 3 

652 structure = ( 

653 ('hSCManager',SC_RPC_HANDLE), 

654 ) 

655 

656class RLockServiceDatabaseResponse(NDRCALL): 

657 structure = ( 

658 ('lpLock',SC_RPC_LOCK), 

659 ('ErrorCode', DWORD), 

660 ) 

661 

662class RQueryServiceObjectSecurity(NDRCALL): 

663 opnum = 4 

664 structure = ( 

665 ('hService',SC_RPC_HANDLE), 

666 ('dwSecurityInformation',SECURITY_INFORMATION), 

667 ('cbBufSize',DWORD), 

668 ) 

669 

670class RQueryServiceObjectSecurityResponse(NDRCALL): 

671 structure = ( 

672 ('lpSecurityDescriptor', BYTE_ARRAY), 

673 ('pcbBytesNeeded',BOUNDED_DWORD_256K), 

674 ('ErrorCode', DWORD), 

675 ) 

676 

677class RSetServiceObjectSecurity(NDRCALL): 

678 opnum = 5 

679 structure = ( 

680 ('hService',SC_RPC_HANDLE), 

681 ('dwSecurityInformation',SECURITY_INFORMATION), 

682 ('lpSecurityDescriptor',LPBYTE), 

683 ('cbBufSize',DWORD), 

684 ) 

685 

686class RSetServiceObjectSecurityResponse(NDRCALL): 

687 structure = ( 

688 ('ErrorCode', DWORD), 

689 ) 

690 

691class RQueryServiceStatus(NDRCALL): 

692 opnum = 6 

693 structure = ( 

694 ('hService',SC_RPC_HANDLE), 

695 ) 

696 

697class RQueryServiceStatusResponse(NDRCALL): 

698 structure = ( 

699 ('lpServiceStatus',SERVICE_STATUS), 

700 ('ErrorCode', DWORD), 

701 ) 

702 

703class RSetServiceStatus(NDRCALL): 

704 opnum = 7 

705 structure = ( 

706 ('hServiceStatus',SC_RPC_HANDLE), 

707 ('lpServiceStatus',SERVICE_STATUS), 

708 ) 

709 

710class RSetServiceStatusResponse(NDRCALL): 

711 structure = ( 

712 ('ErrorCode', DWORD), 

713 ) 

714 

715class RUnlockServiceDatabase(NDRCALL): 

716 opnum = 8 

717 structure = ( 

718 ('Lock',SC_RPC_LOCK), 

719 ) 

720 

721class RUnlockServiceDatabaseResponse(NDRCALL): 

722 structure = ( 

723 ('Lock',SC_RPC_LOCK), 

724 ('ErrorCode', DWORD), 

725 ) 

726 

727class RNotifyBootConfigStatus(NDRCALL): 

728 opnum = 9 

729 structure = ( 

730 ('lpMachineName',SVCCTL_HANDLEW), 

731 ('BootAcceptable',DWORD), 

732 ) 

733 

734class RNotifyBootConfigStatusResponse(NDRCALL): 

735 structure = ( 

736 ('ErrorCode', DWORD), 

737 ) 

738 

739class RChangeServiceConfigW(NDRCALL): 

740 opnum = 11 

741 structure = ( 

742 ('hService',SC_RPC_HANDLE), 

743 ('dwServiceType',DWORD), 

744 ('dwStartType',DWORD), 

745 ('dwErrorControl',DWORD), 

746 ('lpBinaryPathName',LPWSTR), 

747 ('lpLoadOrderGroup',LPWSTR), 

748 ('lpdwTagId',LPDWORD), 

749 ('lpDependencies',LPBYTE), 

750 ('dwDependSize',DWORD), 

751 ('lpServiceStartName',LPWSTR), 

752 ('lpPassword',LPBYTE), 

753 ('dwPwSize',DWORD), 

754 ('lpDisplayName',LPWSTR), 

755 ) 

756 

757class RChangeServiceConfigWResponse(NDRCALL): 

758 structure = ( 

759 ('lpdwTagId',LPDWORD), 

760 ('ErrorCode', DWORD), 

761 ) 

762 

763class RCreateServiceW(NDRCALL): 

764 opnum = 12 

765 structure = ( 

766 ('hSCManager',SC_RPC_HANDLE), 

767 ('lpServiceName',WSTR), 

768 ('lpDisplayName',LPWSTR), 

769 ('dwDesiredAccess',DWORD), 

770 ('dwServiceType',DWORD), 

771 ('dwStartType',DWORD), 

772 ('dwErrorControl',DWORD), 

773 ('lpBinaryPathName',WSTR), 

774 ('lpLoadOrderGroup',LPWSTR), 

775 ('lpdwTagId',LPDWORD), 

776 ('lpDependencies',LPBYTE), 

777 ('dwDependSize',DWORD), 

778 ('lpServiceStartName',LPWSTR), 

779 ('lpPassword',LPBYTE), 

780 ('dwPwSize',DWORD), 

781 ) 

782 

783class RCreateServiceWResponse(NDRCALL): 

784 structure = ( 

785 ('lpdwTagId',LPWSTR), 

786 ('lpServiceHandle',SC_RPC_HANDLE), 

787 ('ErrorCode', DWORD), 

788 ) 

789 

790class REnumDependentServicesW(NDRCALL): 

791 opnum = 13 

792 structure = ( 

793 ('hService',SC_RPC_HANDLE), 

794 ('dwServiceState',DWORD), 

795 ('cbBufSize',DWORD), 

796 ) 

797 

798class REnumDependentServicesWResponse(NDRCALL): 

799 structure = ( 

800 ('lpServices',NDRUniConformantArray), 

801 ('pcbBytesNeeded',BOUNDED_DWORD_256K), 

802 ('lpServicesReturned',BOUNDED_DWORD_256K), 

803 ('ErrorCode', DWORD), 

804 ) 

805 

806class REnumServicesStatusW(NDRCALL): 

807 opnum = 14 

808 structure = ( 

809 ('hSCManager',SC_RPC_HANDLE), 

810 ('dwServiceType',DWORD), 

811 ('dwServiceState',DWORD), 

812 ('cbBufSize',DWORD), 

813 ('lpResumeIndex',LPBOUNDED_DWORD_256K), 

814 ) 

815 

816class REnumServicesStatusWResponse(NDRCALL): 

817 structure = ( 

818 ('lpBuffer',NDRUniConformantArray), 

819 ('pcbBytesNeeded',BOUNDED_DWORD_256K), 

820 ('lpServicesReturned',BOUNDED_DWORD_256K), 

821 ('lpResumeIndex',LPBOUNDED_DWORD_256K), 

822 ('ErrorCode', DWORD), 

823 ) 

824 

825class ROpenSCManagerW(NDRCALL): 

826 opnum = 15 

827 structure = ( 

828 ('lpMachineName',SVCCTL_HANDLEW), 

829 ('lpDatabaseName',LPWSTR), 

830 ('dwDesiredAccess',DWORD), 

831 ) 

832 

833class ROpenSCManagerWResponse(NDRCALL): 

834 structure = ( 

835 ('lpScHandle',SC_RPC_HANDLE), 

836 ('ErrorCode', DWORD), 

837 ) 

838 

839class ROpenServiceW(NDRCALL): 

840 opnum = 16 

841 structure = ( 

842 ('hSCManager',SC_RPC_HANDLE), 

843 ('lpServiceName',WSTR), 

844 ('dwDesiredAccess',DWORD), 

845 ) 

846 

847class ROpenServiceWResponse(NDRCALL): 

848 structure = ( 

849 ('lpServiceHandle',SC_RPC_HANDLE), 

850 ('ErrorCode', DWORD), 

851 ) 

852 

853class RQueryServiceConfigW(NDRCALL): 

854 opnum = 17 

855 structure = ( 

856 ('hService',SC_RPC_HANDLE), 

857 ('cbBufSize',DWORD), 

858 ) 

859 

860class RQueryServiceConfigWResponse(NDRCALL): 

861 structure = ( 

862 ('lpServiceConfig',QUERY_SERVICE_CONFIGW), 

863 ('pcbBytesNeeded',BOUNDED_DWORD_8K), 

864 ('ErrorCode', DWORD), 

865 ) 

866 

867class RQueryServiceLockStatusW(NDRCALL): 

868 opnum = 18 

869 structure = ( 

870 ('hSCManager',SC_RPC_HANDLE), 

871 ('cbBufSize',DWORD), 

872 ) 

873 

874class RQueryServiceLockStatusWResponse(NDRCALL): 

875 structure = ( 

876 ('lpLockStatus',QUERY_SERVICE_LOCK_STATUSW), 

877 ('pcbBytesNeeded',BOUNDED_DWORD_4K), 

878 ('ErrorCode', DWORD), 

879 ) 

880 

881class RStartServiceW(NDRCALL): 

882 opnum = 19 

883 structure = ( 

884 ('hService',SC_RPC_HANDLE), 

885 ('argc',DWORD), 

886 ('argv',UNIQUE_STRING_PTRSW), 

887 ) 

888 

889class RStartServiceWResponse(NDRCALL): 

890 structure = ( 

891 ('ErrorCode', DWORD), 

892 ) 

893 

894class RGetServiceDisplayNameW(NDRCALL): 

895 opnum = 20 

896 structure = ( 

897 ('hSCManager',SC_RPC_HANDLE), 

898 ('lpServiceName',WSTR), 

899 ('lpcchBuffer',DWORD), 

900 ) 

901 

902class RGetServiceDisplayNameWResponse(NDRCALL): 

903 structure = ( 

904 ('lpDisplayName',WSTR), 

905 ('lpcchBuffer',DWORD), 

906 ('ErrorCode', DWORD), 

907 ) 

908 

909class RGetServiceKeyNameW(NDRCALL): 

910 opnum = 21 

911 structure = ( 

912 ('hSCManager',SC_RPC_HANDLE), 

913 ('lpDisplayName',WSTR), 

914 ('lpcchBuffer',DWORD), 

915 ) 

916 

917class RGetServiceKeyNameWResponse(NDRCALL): 

918 structure = ( 

919 ('lpDisplayName',WSTR), 

920 ('lpcchBuffer',DWORD), 

921 ('ErrorCode', DWORD), 

922 ) 

923 

924class REnumServiceGroupW(NDRCALL): 

925 opnum = 35 

926 structure = ( 

927 ('hSCManager',SC_RPC_HANDLE), 

928 ('dwServiceType',DWORD), 

929 ('dwServiceState',DWORD), 

930 ('cbBufSize',DWORD), 

931 ('lpResumeIndex',LPBOUNDED_DWORD_256K), 

932 ('pszGroupName',LPWSTR), 

933 ) 

934 

935class REnumServiceGroupWResponse(NDRCALL): 

936 structure = ( 

937 ('lpBuffer',LPBYTE), 

938 ('pcbBytesNeeded',BOUNDED_DWORD_256K), 

939 ('lpServicesReturned',BOUNDED_DWORD_256K), 

940 ('lpResumeIndex',BOUNDED_DWORD_256K), 

941 ('ErrorCode', DWORD), 

942 ) 

943 

944class RChangeServiceConfig2W(NDRCALL): 

945 opnum = 37 

946 structure = ( 

947 ('hService',SC_RPC_HANDLE), 

948 ('Info',SC_RPC_CONFIG_INFOW), 

949 ) 

950 

951class RChangeServiceConfig2WResponse(NDRCALL): 

952 structure = ( 

953 ('ErrorCode', DWORD), 

954 ) 

955 

956class RQueryServiceConfig2W(NDRCALL): 

957 opnum = 39 

958 structure = ( 

959 ('hService',SC_RPC_HANDLE), 

960 ('dwInfoLevel',DWORD), 

961 ('cbBufSize',DWORD), 

962 ) 

963 

964class RQueryServiceConfig2WResponse(NDRCALL): 

965 structure = ( 

966 ('lpBuffer',NDRUniConformantArray), 

967 ('pcbBytesNeeded',BOUNDED_DWORD_8K), 

968 ('ErrorCode', DWORD), 

969 ) 

970 

971class RQueryServiceStatusEx(NDRCALL): 

972 opnum = 40 

973 structure = ( 

974 ('hService',SC_RPC_HANDLE), 

975 ('InfoLevel',DWORD), 

976 ('cbBufSize',DWORD), 

977 ) 

978 

979class RQueryServiceStatusExResponse(NDRCALL): 

980 structure = ( 

981 ('lpBuffer',NDRUniConformantArray), 

982 ('pcbBytesNeeded',BOUNDED_DWORD_8K), 

983 ('ErrorCode', DWORD), 

984 ) 

985 

986class REnumServicesStatusExW(NDRCALL): 

987 opnum = 42 

988 structure = ( 

989 ('hSCManager',SC_RPC_HANDLE), 

990 ('InfoLevel',DWORD), 

991 ('dwServiceType',DWORD), 

992 ('dwServiceState',DWORD), 

993 ('cbBufSize',DWORD), 

994 ('lpResumeIndex',LPBOUNDED_DWORD_256K), 

995 ('pszGroupName',LPWSTR), 

996 ) 

997 

998class REnumServicesStatusExWResponse(NDRCALL): 

999 structure = ( 

1000 ('lpBuffer',NDRUniConformantArray), 

1001 ('pcbBytesNeeded',BOUNDED_DWORD_256K), 

1002 ('lpServicesReturned',BOUNDED_DWORD_256K), 

1003 ('lpResumeIndex',BOUNDED_DWORD_256K), 

1004 ('ErrorCode', DWORD), 

1005 ) 

1006 

1007class RCreateServiceWOW64W(NDRCALL): 

1008 opnum = 45 

1009 structure = ( 

1010 ('hSCManager',SC_RPC_HANDLE), 

1011 ('lpServiceName',WSTR), 

1012 ('lpDisplayName',LPWSTR), 

1013 ('dwDesiredAccess',DWORD), 

1014 ('dwServiceType',DWORD), 

1015 ('dwStartType',DWORD), 

1016 ('dwErrorControl',DWORD), 

1017 ('lpBinaryPathName',WSTR), 

1018 ('lpLoadOrderGroup',LPWSTR), 

1019 ('lpdwTagId',LPDWORD), 

1020 ('lpDependencies',LPBYTE), 

1021 ('dwDependSize',DWORD), 

1022 ('lpServiceStartName',LPWSTR), 

1023 ('lpPassword',LPBYTE), 

1024 ('dwPwSize',DWORD), 

1025 ) 

1026 

1027class RCreateServiceWOW64WResponse(NDRCALL): 

1028 structure = ( 

1029 ('lpdwTagId',LPWSTR), 

1030 ('lpServiceHandle',SC_RPC_HANDLE), 

1031 ('ErrorCode', DWORD), 

1032 ) 

1033 

1034# Still not working, for some reason something changes in the way the pointer inside SC_RPC_NOTIFY_PARAMS is marshalled here 

1035class RNotifyServiceStatusChange(NDRCALL): 

1036 opnum = 47 

1037 structure = ( 

1038 ('hService',SC_RPC_HANDLE), 

1039 ('NotifyParams',SC_RPC_NOTIFY_PARAMS), 

1040 ('pClientProcessGuid',GUID), 

1041 ) 

1042 

1043class RNotifyServiceStatusChangeResponse(NDRCALL): 

1044 structure = ( 

1045 ('pSCMProcessGuid',GUID), 

1046 ('pfCreateRemoteQueue',PBOOL), 

1047 ('phNotify',SC_NOTIFY_RPC_HANDLE), 

1048 ('ErrorCode', DWORD), 

1049 ) 

1050 

1051# Not working, until I don't fix the previous one 

1052class RGetNotifyResults(NDRCALL): 

1053 opnum = 48 

1054 structure = ( 

1055 ('hNotify',SC_NOTIFY_RPC_HANDLE), 

1056 ) 

1057 

1058class RGetNotifyResultsResponse(NDRCALL): 

1059 structure = ( 

1060 ('ppNotifyParams',PSC_RPC_NOTIFY_PARAMS_LIST), 

1061 ('ErrorCode', DWORD), 

1062 ) 

1063 

1064# Not working, until I don't fix the previous ones 

1065class RCloseNotifyHandle(NDRCALL): 

1066 opnum = 49 

1067 structure = ( 

1068 ('phNotify',SC_NOTIFY_RPC_HANDLE), 

1069 ) 

1070 

1071class RCloseNotifyHandleResponse(NDRCALL): 

1072 structure = ( 

1073 ('phNotify',SC_NOTIFY_RPC_HANDLE), 

1074 ('pfApcFired',PBOOL), 

1075 ('ErrorCode', DWORD), 

1076 ) 

1077 

1078# Not working, returning bad_stub_data 

1079class RControlServiceExW(NDRCALL): 

1080 opnum = 51 

1081 structure = ( 

1082 ('hService',SC_RPC_HANDLE), 

1083 ('dwControl',DWORD), 

1084 ('dwInfoLevel',DWORD), 

1085 ('pControlInParams',SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW), 

1086 ) 

1087 

1088class RControlServiceExWResponse(NDRCALL): 

1089 structure = ( 

1090 ('pControlOutParams',SERVICE_CONTROL_STATUS_REASON_OUT_PARAMS), 

1091 ('ErrorCode', DWORD), 

1092 ) 

1093 

1094class RQueryServiceConfigEx(NDRCALL): 

1095 opnum = 56 

1096 structure = ( 

1097 ('hService',SC_RPC_HANDLE), 

1098 ('dwInfoLevel',DWORD), 

1099 ) 

1100 

1101class RQueryServiceConfigExResponse(NDRCALL): 

1102 structure = ( 

1103 ('pInfo',SC_RPC_CONFIG_INFOW), 

1104 ('ErrorCode', DWORD), 

1105 ) 

1106 

1107################################################################################ 

1108# OPNUMs and their corresponding structures 

1109################################################################################ 

1110OPNUMS = { 

1111 0 : (RCloseServiceHandle, RCloseServiceHandleResponse), 

1112 1 : (RControlService, RControlServiceResponse), 

1113 2 : (RDeleteService, RDeleteServiceResponse), 

1114 3 : (RLockServiceDatabase, RLockServiceDatabaseResponse), 

1115 4 : (RQueryServiceObjectSecurity, RQueryServiceObjectSecurityResponse), 

1116 5 : (RSetServiceObjectSecurity, RSetServiceObjectSecurityResponse), 

1117 6 : (RQueryServiceStatus, RQueryServiceStatusResponse), 

1118 7 : (RSetServiceStatus, RSetServiceStatusResponse), 

1119 8 : (RUnlockServiceDatabase, RUnlockServiceDatabaseResponse), 

1120 9 : (RNotifyBootConfigStatus, RNotifyBootConfigStatusResponse), 

112111 : (RChangeServiceConfigW, RChangeServiceConfigWResponse), 

112212 : (RCreateServiceW, RCreateServiceWResponse), 

112313 : (REnumDependentServicesW, REnumDependentServicesWResponse), 

112414 : (REnumServicesStatusW, REnumServicesStatusWResponse), 

112515 : (ROpenSCManagerW, ROpenSCManagerWResponse), 

112616 : (ROpenServiceW, ROpenServiceWResponse), 

112717 : (RQueryServiceConfigW, RQueryServiceConfigWResponse), 

112818 : (RQueryServiceLockStatusW, RQueryServiceLockStatusWResponse), 

112919 : (RStartServiceW, RStartServiceWResponse), 

113020 : (RGetServiceDisplayNameW, RGetServiceDisplayNameWResponse), 

113121 : (RGetServiceKeyNameW, RGetServiceKeyNameWResponse), 

113235 : (REnumServiceGroupW, REnumServiceGroupWResponse), 

113337 : (RChangeServiceConfig2W, RChangeServiceConfig2WResponse), 

113439 : (RQueryServiceConfig2W, RQueryServiceConfig2WResponse), 

113540 : (RQueryServiceStatusEx, RQueryServiceStatusExResponse), 

113642 : (REnumServicesStatusExW, REnumServicesStatusExWResponse), 

113745 : (RCreateServiceWOW64W, RCreateServiceWOW64WResponse), 

113847 : (RNotifyServiceStatusChange, RNotifyServiceStatusChangeResponse), 

113948 : (RGetNotifyResults, RGetNotifyResultsResponse), 

114049 : (RCloseNotifyHandle, RCloseNotifyHandleResponse), 

114151 : (RControlServiceExW, RControlServiceExWResponse), 

114256 : (RQueryServiceConfigEx, RQueryServiceConfigExResponse), 

1143} 

1144 

1145################################################################################ 

1146# HELPER FUNCTIONS 

1147################################################################################ 

1148def checkNullString(string): 

1149 if string == NULL: 

1150 return string 

1151 

1152 if string[-1:] != '\x00': 

1153 return string + '\x00' 

1154 else: 

1155 return string 

1156 

1157def hRCloseServiceHandle(dce, hSCObject): 

1158 request = RCloseServiceHandle() 

1159 request['hSCObject'] = hSCObject 

1160 return dce.request(request) 

1161 

1162def hRControlService(dce, hService, dwControl): 

1163 request = RControlService() 

1164 request['hService'] = hService 

1165 request['dwControl'] = dwControl 

1166 return dce.request(request) 

1167 

1168def hRDeleteService(dce, hService): 

1169 request = RDeleteService() 

1170 request ['hService'] = hService 

1171 return dce.request(request) 

1172 

1173def hRLockServiceDatabase(dce, hSCManager): 

1174 request = RLockServiceDatabase() 

1175 request['hSCManager'] = hSCManager 

1176 return dce.request(request) 

1177 

1178 

1179def hRQueryServiceObjectSecurity(dce, hService, dwSecurityInformation, cbBufSize=0): 

1180 request = RQueryServiceObjectSecurity() 

1181 request['hService'] = hService 

1182 request['dwSecurityInformation'] = dwSecurityInformation 

1183 request['cbBufSize'] = cbBufSize 

1184 try: 

1185 resp = dce.request(request) 

1186 except DCERPCSessionError as e: 

1187 if e.get_error_code() == system_errors.ERROR_INSUFFICIENT_BUFFER: 

1188 resp = e.get_packet() 

1189 request['cbBufSize'] = resp['pcbBytesNeeded'] 

1190 resp = dce.request(request) 

1191 else: 

1192 raise 

1193 return resp 

1194 

1195def hRSetServiceObjectSecurity(dce, hService, dwSecurityInformation, lpSecurityDescriptor, cbBufSize ): 

1196 request = RSetServiceObjectSecurity() 

1197 request['hService'] = hService 

1198 request['dwSecurityInformation'] = dwSecurityInformation 

1199 request['cbBufSize'] = cbBufSize 

1200 return dce.request(request) 

1201 

1202def hRQueryServiceStatus(dce, hService ): 

1203 request = RQueryServiceStatus() 

1204 request['hService'] = hService 

1205 return dce.request(request) 

1206 

1207def hRSetServiceStatus(dce, hServiceStatus, lpServiceStatus ): 

1208 request = RSetServiceStatus() 

1209 request['hServiceStatus'] = hServiceStatus 

1210 request['lpServiceStatus'] = lpServiceStatus 

1211 return dce.request(request) 

1212 

1213def hRUnlockServiceDatabase(dce, Lock ): 

1214 request = RUnlockServiceDatabase() 

1215 request['Lock'] = Lock 

1216 return dce.request(request) 

1217 

1218def hRNotifyBootConfigStatus(dce, lpMachineName, BootAcceptable ): 

1219 request = RNotifyBootConfigStatus() 

1220 request['lpMachineName'] = lpMachineName 

1221 request['BootAcceptable'] = BootAcceptable 

1222 return dce.request(request) 

1223 

1224def hRChangeServiceConfigW(dce, hService, dwServiceType=SERVICE_NO_CHANGE, dwStartType=SERVICE_NO_CHANGE, dwErrorControl=SERVICE_NO_CHANGE, lpBinaryPathName=NULL, lpLoadOrderGroup=NULL, lpdwTagId=NULL, lpDependencies=NULL, dwDependSize=0, lpServiceStartName=NULL, lpPassword=NULL, dwPwSize=0, lpDisplayName=NULL): 

1225 changeServiceConfig = RChangeServiceConfigW() 

1226 changeServiceConfig['hService'] = hService 

1227 changeServiceConfig['dwServiceType'] = dwServiceType 

1228 changeServiceConfig['dwStartType'] = dwStartType 

1229 changeServiceConfig['dwErrorControl'] = dwErrorControl 

1230 changeServiceConfig['lpBinaryPathName'] = checkNullString(lpBinaryPathName) 

1231 changeServiceConfig['lpLoadOrderGroup'] = checkNullString(lpLoadOrderGroup) 

1232 changeServiceConfig['lpdwTagId'] = lpdwTagId 

1233 changeServiceConfig['lpDependencies'] = lpDependencies 

1234 # Strings MUST be NULL terminated for lpDependencies 

1235 changeServiceConfig['dwDependSize'] = dwDependSize 

1236 changeServiceConfig['lpServiceStartName'] = checkNullString(lpServiceStartName) 

1237 changeServiceConfig['lpPassword'] = lpPassword 

1238 changeServiceConfig['dwPwSize'] = dwPwSize 

1239 changeServiceConfig['lpDisplayName'] = checkNullString(lpDisplayName) 

1240 return dce.request(changeServiceConfig) 

1241 

1242def hRCreateServiceW(dce, hSCManager, lpServiceName, lpDisplayName, dwDesiredAccess=SERVICE_ALL_ACCESS, dwServiceType=SERVICE_WIN32_OWN_PROCESS, dwStartType=SERVICE_AUTO_START, dwErrorControl=SERVICE_ERROR_IGNORE, lpBinaryPathName=NULL, lpLoadOrderGroup=NULL, lpdwTagId=NULL, lpDependencies=NULL, dwDependSize=0, lpServiceStartName=NULL, lpPassword=NULL, dwPwSize=0): 

1243 createService = RCreateServiceW() 

1244 createService['hSCManager'] = hSCManager 

1245 createService['lpServiceName'] = checkNullString(lpServiceName) 

1246 createService['lpDisplayName'] = checkNullString(lpDisplayName) 

1247 createService['dwDesiredAccess'] = dwDesiredAccess 

1248 createService['dwServiceType'] = dwServiceType 

1249 createService['dwStartType'] = dwStartType 

1250 createService['dwErrorControl'] = dwErrorControl 

1251 createService['lpBinaryPathName'] = checkNullString(lpBinaryPathName) 

1252 createService['lpLoadOrderGroup'] = checkNullString(lpLoadOrderGroup) 

1253 createService['lpdwTagId'] = lpdwTagId 

1254 # Strings MUST be NULL terminated for lpDependencies 

1255 createService['lpDependencies'] = lpDependencies 

1256 createService['dwDependSize'] = dwDependSize 

1257 createService['lpServiceStartName'] = checkNullString(lpServiceStartName) 

1258 createService['lpPassword'] = lpPassword 

1259 createService['dwPwSize'] = dwPwSize 

1260 return dce.request(createService) 

1261 

1262def hREnumDependentServicesW(dce, hService, dwServiceState, cbBufSize ): 

1263 enumDependentServices = REnumDependentServicesW() 

1264 enumDependentServices['hService'] = hService 

1265 enumDependentServices['dwServiceState'] = dwServiceState 

1266 enumDependentServices['cbBufSize'] = cbBufSize 

1267 return dce.request(enumDependentServices) 

1268 

1269def hREnumServicesStatusW(dce, hSCManager, dwServiceType=SERVICE_WIN32_OWN_PROCESS|SERVICE_KERNEL_DRIVER|SERVICE_FILE_SYSTEM_DRIVER|SERVICE_WIN32_SHARE_PROCESS|SERVICE_INTERACTIVE_PROCESS, dwServiceState=SERVICE_STATE_ALL): 

1270 class ENUM_SERVICE_STATUSW2(NDRSTRUCT): 

1271 # This is a little trick, since the original structure is slightly different 

1272 # but instead of parsing the LPBYTE buffer at hand, we just do it with the aid 

1273 # of the NDR library, although the pointers are swapped from the original specification. 

1274 # Why is this? Well.. since we're getting an LPBYTE back, it's just a copy of the remote's memory 

1275 # where the pointers are actually POINTING to the data. 

1276 # Sadly, the pointers are not aligned based on the services records, so we gotta do this 

1277 # It should be easier in C of course. 

1278 class STR(NDRPOINTER): 

1279 referent = ( 

1280 ('Data', WIDESTR), 

1281 ) 

1282 structure = ( 

1283 ('lpServiceName',STR), 

1284 ('lpDisplayName',STR), 

1285 ('ServiceStatus',SERVICE_STATUS), 

1286 ) 

1287 

1288 enumServicesStatus = REnumServicesStatusW() 

1289 enumServicesStatus['hSCManager'] = hSCManager 

1290 enumServicesStatus['dwServiceType'] = dwServiceType 

1291 enumServicesStatus['dwServiceState'] = dwServiceState 

1292 enumServicesStatus['cbBufSize'] = 0 

1293 enumServicesStatus['lpResumeIndex'] = NULL 

1294 

1295 try: 

1296 resp = dce.request(enumServicesStatus) 

1297 except DCERPCSessionError as e: 

1298 if e.get_error_code() == system_errors.ERROR_MORE_DATA: 1298 ↛ 1303line 1298 didn't jump to line 1303, because the condition on line 1298 was never false

1299 resp = e.get_packet() 

1300 enumServicesStatus['cbBufSize'] = resp['pcbBytesNeeded'] 

1301 resp = dce.request(enumServicesStatus) 

1302 else: 

1303 raise 

1304 

1305 # Now we're supposed to have all services returned. Now we gotta parse them 

1306 

1307 enumArray = NDRUniConformantArray() 

1308 enumArray.item = ENUM_SERVICE_STATUSW2 

1309 

1310 enumArray.setArraySize(resp['lpServicesReturned']) 

1311 

1312 data = b''.join(resp['lpBuffer']) 

1313 enumArray.fromString(data) 

1314 data = data[4:] 

1315 # Since the pointers here are pointing to the actual data, we have to reparse 

1316 # the referents 

1317 for record in enumArray['Data']: 

1318 offset = record.fields['lpDisplayName'].fields['ReferentID']-4 

1319 name = WIDESTR(data[offset:]) 

1320 record['lpDisplayName'] = name['Data'] 

1321 offset = record.fields['lpServiceName'].fields['ReferentID']-4 

1322 name = WIDESTR(data[offset:]) 

1323 record['lpServiceName'] = name['Data'] 

1324 

1325 return enumArray['Data'] 

1326 

1327def hROpenSCManagerW(dce, lpMachineName='DUMMY\x00', lpDatabaseName='ServicesActive\x00', dwDesiredAccess=SERVICE_START | SERVICE_STOP | SERVICE_CHANGE_CONFIG | SERVICE_QUERY_CONFIG | SERVICE_QUERY_STATUS | SERVICE_ENUMERATE_DEPENDENTS | SC_MANAGER_ENUMERATE_SERVICE): 

1328 openSCManager = ROpenSCManagerW() 

1329 openSCManager['lpMachineName'] = checkNullString(lpMachineName) 

1330 openSCManager['lpDatabaseName'] = checkNullString(lpDatabaseName) 

1331 openSCManager['dwDesiredAccess'] = dwDesiredAccess 

1332 return dce.request(openSCManager) 

1333 

1334def hROpenServiceW(dce, hSCManager, lpServiceName, dwDesiredAccess= SERVICE_ALL_ACCESS): 

1335 openService = ROpenServiceW() 

1336 openService['hSCManager'] = hSCManager 

1337 openService['lpServiceName'] = checkNullString(lpServiceName) 

1338 openService['dwDesiredAccess'] = dwDesiredAccess 

1339 return dce.request(openService) 

1340 

1341def hRQueryServiceConfigW(dce, hService): 

1342 queryService = RQueryServiceConfigW() 

1343 queryService['hService'] = hService 

1344 queryService['cbBufSize'] = 0 

1345 try: 

1346 resp = dce.request(queryService) 

1347 except DCERPCSessionError as e: 

1348 if e.get_error_code() == system_errors.ERROR_INSUFFICIENT_BUFFER: 1348 ↛ 1353line 1348 didn't jump to line 1353, because the condition on line 1348 was never false

1349 resp = e.get_packet() 

1350 queryService['cbBufSize'] = resp['pcbBytesNeeded'] 

1351 resp = dce.request(queryService) 

1352 else: 

1353 raise 

1354 

1355 return resp 

1356 

1357def hRQueryServiceLockStatusW(dce, hSCManager, cbBufSize ): 

1358 queryServiceLock = RQueryServiceLockStatusW() 

1359 queryServiceLock['hSCManager'] = hSCManager 

1360 queryServiceLock['cbBufSize'] = cbBufSize 

1361 return dce.request(queryServiceLock) 

1362 

1363def hRStartServiceW(dce, hService, argc=0, argv=NULL ): 

1364 startService = RStartServiceW() 

1365 startService['hService'] = hService 

1366 startService['argc'] = argc 

1367 if argc == 0: 

1368 startService['argv'] = NULL 

1369 else: 

1370 for item in argv: 

1371 itemn = LPWSTR() 

1372 itemn['Data'] = checkNullString(item) 

1373 startService['argv'].append(itemn) 

1374 return dce.request(startService) 

1375 

1376def hRGetServiceDisplayNameW(dce, hSCManager, lpServiceName, lpcchBuffer ): 

1377 getServiceDisplay = RGetServiceDisplayNameW() 

1378 getServiceDisplay['hSCManager'] = hSCManager 

1379 getServiceDisplay['lpServiceName'] = checkNullString(lpServiceName) 

1380 getServiceDisplay['lpcchBuffer'] = lpcchBuffer 

1381 return dce.request(getServiceDisplay) 

1382 

1383def hRGetServiceKeyNameW(dce, hSCManager, lpDisplayName, lpcchBuffer ): 

1384 getServiceKeyName = RGetServiceKeyNameW() 

1385 getServiceKeyName['hSCManager'] = hSCManager 

1386 getServiceKeyName['lpDisplayName'] = checkNullString(lpDisplayName) 

1387 getServiceKeyName['lpcchBuffer'] = lpcchBuffer 

1388 return dce.request(getServiceKeyName) 

1389 

1390def hREnumServiceGroupW(dce, hSCManager, dwServiceType, dwServiceState, cbBufSize, lpResumeIndex = NULL, pszGroupName = NULL ): 

1391 enumServiceGroup = REnumServiceGroupW() 

1392 enumServiceGroup['hSCManager'] = hSCManager 

1393 enumServiceGroup['dwServiceType'] = dwServiceType 

1394 enumServiceGroup['dwServiceState'] = dwServiceState 

1395 enumServiceGroup['cbBufSize'] = cbBufSize 

1396 enumServiceGroup['lpResumeIndex'] = lpResumeIndex 

1397 enumServiceGroup['pszGroupName'] = pszGroupName 

1398 return dce.request(enumServiceGroup)