Coverage for /root/GitHubProjects/impacket/impacket/dcerpc/v5/scmr.py : 88%

Hot-keys on this page
r m x p toggle line displays
j k next/prev highlighted chunk
0 (zero) top of page
1 (one) first highlighted chunk
1# Impacket - Collection of Python classes for working with network protocols.
2#
3# SECUREAUTH LABS. Copyright (C) 2019 SecureAuth Corporation. All rights reserved.
4#
5# This software is provided under a slightly modified version
6# of the Apache Software License. See the accompanying LICENSE file
7# for more information.
8#
9# Description:
10# [MS-SCMR] Interface implementation
11#
12# Best way to learn how to use these calls is to grab the protocol standard
13# so you understand what the call does, and then read the test case located
14# at https://github.com/SecureAuthCorp/impacket/tree/master/tests/SMB_RPC
15#
16# Some calls have helper functions, which makes it even easier to use.
17# They are located at the end of this file.
18# Helper functions start with "h"<name of the call>.
19# There are test cases for them too.
20#
21# Author:
22# Alberto Solino (@agsolino)
23#
25from impacket import system_errors
26from impacket.dcerpc.v5.dtypes import NULL, DWORD, LPWSTR, ULONG, BOOL, LPBYTE, ULONGLONG, PGUID, USHORT, LPDWORD, WSTR, \
27 GUID, PBOOL, WIDESTR
28from impacket.dcerpc.v5.ndr import NDRCALL, NDR, NDRSTRUCT, NDRPOINTER, NDRPOINTERNULL, NDRUniConformantArray, NDRUNION
29from impacket.dcerpc.v5.rpcrt import DCERPCException
30from impacket.uuid import uuidtup_to_bin
32MSRPC_UUID_SCMR = uuidtup_to_bin(('367ABB81-9844-35F1-AD32-98F038001003', '2.0'))
34class DCERPCSessionError(DCERPCException):
35 def __init__(self, error_string=None, error_code=None, packet=None):
36 DCERPCException.__init__(self, error_string, error_code, packet)
38 def __str__( self ):
39 key = self.error_code
40 if key in system_errors.ERROR_MESSAGES: 40 ↛ 45line 40 didn't jump to line 45, because the condition on line 40 was never false
41 error_msg_short = system_errors.ERROR_MESSAGES[key][0]
42 error_msg_verbose = system_errors.ERROR_MESSAGES[key][1]
43 return 'SCMR SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
44 else:
45 return 'SCMR SessionError: unknown error code: 0x%x' % self.error_code
47################################################################################
48# CONSTANTS
49################################################################################
51# Access codes
52SERVICE_ALL_ACCESS = 0X000F01FF
53SERVICE_CHANGE_CONFIG = 0X00000002
54SERVICE_ENUMERATE_DEPENDENTS = 0X00000008
55SERVICE_INTERROGATE = 0X00000080
56SERVICE_PAUSE_CONTINUE = 0X00000040
57SERVICE_QUERY_CONFIG = 0X00000001
58SERVICE_QUERY_STATUS = 0X00000004
59SERVICE_START = 0X00000010
60SERVICE_STOP = 0X00000020
61SERVICE_USER_DEFINED_CTRL = 0X00000100
62SERVICE_SET_STATUS = 0X00008000
64# Specific Access for SCM
65SC_MANAGER_LOCK = 0x00000008
66SC_MANAGER_CREATE_SERVICE = 0x00000002
67SC_MANAGER_ENUMERATE_SERVICE = 0x00000004
68SC_MANAGER_CONNECT = 0x00000001
69SC_MANAGER_QUERY_LOCK_STATUS = 0x00000010
70SC_MANAGER_MODIFY_BOOT_CONFIG = 0x00000020
72# Service Types
73SERVICE_KERNEL_DRIVER = 0x00000001
74SERVICE_FILE_SYSTEM_DRIVER = 0x00000002
75SERVICE_WIN32_OWN_PROCESS = 0x00000010
76SERVICE_WIN32_SHARE_PROCESS = 0x00000020
77SERVICE_INTERACTIVE_PROCESS = 0x00000100
78SERVICE_NO_CHANGE = 0xffffffff
80# Start Types
81SERVICE_BOOT_START = 0x00000000
82SERVICE_SYSTEM_START = 0x00000001
83SERVICE_AUTO_START = 0x00000002
84SERVICE_DEMAND_START = 0x00000003
85SERVICE_DISABLED = 0x00000004
86SERVICE_NO_CHANGE = 0xffffffff
88# Error Control
89SERVICE_ERROR_IGNORE = 0x00000000
90SERVICE_ERROR_NORMAL = 0x00000001
91SERVICE_ERROR_SEVERE = 0x00000002
92SERVICE_ERROR_CRITICAL = 0x00000003
93SERVICE_NO_CHANGE = 0xffffffff
95# Service Control Codes
96SERVICE_CONTROL_CONTINUE = 0x00000003
97SERVICE_CONTROL_INTERROGATE = 0x00000004
98SERVICE_CONTROL_PARAMCHANGE = 0x00000006
99SERVICE_CONTROL_PAUSE = 0x00000002
100SERVICE_CONTROL_STOP = 0x00000001
101SERVICE_CONTROL_NETBINDADD = 0x00000007
102SERVICE_CONTROL_NETBINDREMOVE = 0x00000008
103SERVICE_CONTROL_NETBINDENABLE = 0x00000009
104SERVICE_CONTROL_NETBINDDISABLE= 0x0000000A
106# Service State
107SERVICE_ACTIVE = 0x00000001
108SERVICE_INACTIVE = 0x00000002
109SERVICE_STATE_ALL = 0x00000003
111# Current State
112SERVICE_CONTINUE_PENDING = 0x00000005
113SERVICE_PAUSE_PENDING = 0x00000006
114SERVICE_PAUSED = 0x00000007
115SERVICE_RUNNING = 0x00000004
116SERVICE_START_PENDING = 0x00000002
117SERVICE_STOP_PENDING = 0x00000003
118SERVICE_STOPPED = 0x00000001
120# Controls Accepted
121SERVICE_ACCEPT_PARAMCHANGE = 0x00000008
122SERVICE_ACCEPT_PAUSE_CONTINUE = 0x00000002
123SERVICE_ACCEPT_SHUTDOWN = 0x00000004
124SERVICE_ACCEPT_STOP = 0x00000001
125SERVICE_ACCEPT_HARDWAREPROFILECHANGE = 0x00000020
126SERVICE_ACCEPT_POWEREVENT = 0x00000040
127SERVICE_ACCEPT_SESSIONCHANGE = 0x00000080
128SERVICE_ACCEPT_PRESHUTDOWN = 0x00000100
129SERVICE_ACCEPT_TIMECHANGE = 0x00000200
130ERVICE_ACCEPT_TRIGGEREVENT = 0x00000400
132# Security Information
133DACL_SECURITY_INFORMATION = 0x4
134GROUP_SECURITY_INFORMATION = 0x2
135OWNER_SECURITY_INFORMATION = 0x1
136SACL_SECURITY_INFORMATION = 0x8
138# Service Config2 Info Levels
139SERVICE_CONFIG_DESCRIPTION = 0x00000001
140SERVICE_CONFIG_FAILURE_ACTIONS = 0x00000002
141SERVICE_CONFIG_DELAYED_AUTO_START_INFO = 0x00000003
142SERVICE_CONFIG_FAILURE_ACTIONS_FLAG = 0x00000004
143SERVICE_CONFIG_SERVICE_SID_INFO = 0x00000005
144SERVICE_CONFIG_REQUIRED_PRIVILEGES_INFO = 0x00000006
145SERVICE_CONFIG_PRESHUTDOWN_INFO = 0x00000007
146SERVICE_CONFIG_PREFERRED_NODE = 0x00000009
147SERVICE_CONFIG_RUNLEVEL_INFO = 0x0000000A
149# SC_ACTIONS Types
150SC_ACTION_NONE = 0
151SC_ACTION_RESTART = 1
152SC_ACTION_REBOOT = 2
153SC_ACTION_RUN_COMMAND = 3
155# SERVICE_SID_INFO types
156SERVICE_SID_TYPE_NONE = 0x00000000
157SERVICE_SID_TYPE_RESTRICTED = 0x00000003
158SERVICE_SID_TYPE_UNRESTRICTED = 0x00000001
160# SC_STATUS_TYPE types
161SC_STATUS_PROCESS_INFO = 0
163# Notify Mask
164SERVICE_NOTIFY_CREATED = 0x00000080
165SERVICE_NOTIFY_CONTINUE_PENDING = 0x00000010
166SERVICE_NOTIFY_DELETE_PENDING = 0x00000200
167SERVICE_NOTIFY_DELETED = 0x00000100
168SERVICE_NOTIFY_PAUSE_PENDING = 0x00000020
169SERVICE_NOTIFY_PAUSED = 0x00000040
170SERVICE_NOTIFY_RUNNING = 0x00000008
171SERVICE_NOTIFY_START_PENDING = 0x00000002
172SERVICE_NOTIFY_STOP_PENDING = 0x00000004
173SERVICE_NOTIFY_STOPPED = 0x00000001
175# SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW Reasons
176SERVICE_STOP_CUSTOM = 0x20000000
177SERVICE_STOP_PLANNED = 0x40000000
178SERVICE_STOP_UNPLANNED = 0x10000000
180# SERVICE_TRIGGER triggers
181SERVICE_TRIGGER_TYPE_DEVICE_INTERFACE_ARRIVAL = 0x00000001
182SERVICE_TRIGGER_TYPE_IP_ADDRESS_AVAILABILITY = 0x00000002
183SERVICE_TRIGGER_TYPE_DOMAIN_JOIN = 0x00000003
184SERVICE_TRIGGER_TYPE_FIREWALL_PORT_EVENT = 0x00000004
185SERVICE_TRIGGER_TYPE_GROUP_POLICY = 0x00000005
186SERVICE_TRIGGER_TYPE_CUSTOM = 0x00000020
188# SERVICE_TRIGGER actions
189SERVICE_TRIGGER_ACTION_SERVICE_START = 0x00000001
190SERVICE_TRIGGER_ACTION_SERVICE_STOP = 0x00000002
192# SERVICE_TRIGGER subTypes
193DOMAIN_JOIN_GUID = '1ce20aba-9851-4421-9430-1ddeb766e809'
194DOMAIN_LEAVE_GUID = 'ddaf516e-58c2-4866-9574-c3b615d42ea1'
195FIREWALL_PORT_OPEN_GUID = 'b7569e07-8421-4ee0-ad10-86915afdad09'
196FIREWALL_PORT_CLOSE_GUID = 'a144ed38-8e12-4de4-9d96-e64740b1a524'
197MACHINE_POLICY_PRESENT_GUID = '659FCAE6-5BDB-4DA9-B1FF-CA2A178D46E0'
198NETWORK_MANAGER_FIRST_IP_ADDRESS_ARRIVAL_GUID = '4f27f2de-14e2-430b-a549-7cd48cbc8245'
199NETWORK_MANAGER_LAST_IP_ADDRESS_REMOVAL_GUID = 'cc4ba62a-162e-4648-847a-b6bdf993e335'
200USER_POLICY_PRESENT_GUID = '54FB46C8-F089-464C-B1FD-59D1B62C3B50'
202# SERVICE_TRIGGER_SPECIFIC_DATA_ITEM dataTypes
203SERVICE_TRIGGER_DATA_TYPE_BINARY = 0x00000001
204SERVICE_TRIGGER_DATA_TYPE_STRING = 0x00000002
206################################################################################
207# STRUCTURES
208################################################################################
210class BYTE_ARRAY(NDRUniConformantArray):
211 item = 'c'
213class SC_RPC_HANDLE(NDRSTRUCT):
214 structure = (
215 ('Data','20s=""'),
216 )
217 def getAlignment(self):
218 return 1
220SC_NOTIFY_RPC_HANDLE = SC_RPC_HANDLE
222class SERVICE_STATUS(NDRSTRUCT):
223 structure = (
224 ('dwServiceType',DWORD),
225 ('dwCurrentState',DWORD),
226 ('dwControlsAccepted',DWORD),
227 ('dwWin32ExitCode',DWORD),
228 ('dwServiceSpecificExitCode',DWORD),
229 ('dwCheckPoint',DWORD),
230 ('dwWaitHint',DWORD),
231 )
233class QUERY_SERVICE_CONFIGW(NDRSTRUCT):
234 structure = (
235 ('dwServiceType',DWORD),
236 ('dwStartType',DWORD),
237 ('dwErrorControl',DWORD),
238 ('lpBinaryPathName', LPWSTR),
239 ('lpLoadOrderGroup',LPWSTR),
240 ('dwTagId',DWORD),
241 ('lpDependencies',LPWSTR),
242 ('lpServiceStartName',LPWSTR),
243 ('lpDisplayName',LPWSTR),
244 )
246class SC_RPC_LOCK(NDRSTRUCT):
247 structure = (
248 ('Data','20s=""'),
249 )
250 def getAlignment(self):
251 return 1
253class LPSERVICE_STATUS(NDRPOINTER):
254 referent = (
255 ('Data',SERVICE_STATUS),
256 )
258SECURITY_INFORMATION = ULONG
260BOUNDED_DWORD_256K = DWORD
262class LPBOUNDED_DWORD_256K(NDRPOINTER):
263 referent = (
264 ('Data', BOUNDED_DWORD_256K),
265 )
267SVCCTL_HANDLEW = LPWSTR
269class ENUM_SERVICE_STATUSW(NDRSTRUCT):
270 structure = (
271 ('lpServiceName',LPWSTR),
272 ('lpDisplayName',LPWSTR),
273 ('ServiceStatus',SERVICE_STATUS),
274 )
276class LPQUERY_SERVICE_CONFIGW(NDRPOINTER):
277 referent = (
278 ('Data', QUERY_SERVICE_CONFIGW),
279 )
281BOUNDED_DWORD_8K = DWORD
282BOUNDED_DWORD_4K = DWORD
284class STRING_PTRSW(NDRSTRUCT):
285 structure = (
286 ('Data',NDRUniConformantArray),
287 )
288 def __init__(self, data = None, isNDR64 = False):
289 NDR.__init__(self,None,isNDR64)
290 self.fields['Data'].item = LPWSTR
291 if data is not None: 291 ↛ 292line 291 didn't jump to line 292, because the condition on line 291 was never true
292 self.fromString(data)
294class UNIQUE_STRING_PTRSW(NDRPOINTER):
295 referent = (
296 ('Data', STRING_PTRSW),
297 )
299class QUERY_SERVICE_LOCK_STATUSW(NDRSTRUCT):
300 structure = (
301 ('fIsLocked',DWORD),
302 ('lpLockOwner',LPWSTR),
303 ('dwLockDuration',DWORD),
304 )
306class SERVICE_DESCRIPTION_WOW64(NDRSTRUCT):
307 structure = (
308 ('dwDescriptionOffset', DWORD),
309 )
311class SERVICE_DESCRIPTIONW(NDRSTRUCT):
312 structure = (
313 ('lpDescription', LPWSTR),
314 )
316class LPSERVICE_DESCRIPTIONW(NDRPOINTER):
317 referent = (
318 ('Data', SERVICE_DESCRIPTIONW),
319 )
321class SERVICE_FAILURE_ACTIONS_WOW64(NDRSTRUCT):
322 structure = (
323 ('dwResetPeriod', DWORD),
324 ('dwRebootMsgOffset', DWORD),
325 ('dwCommandOffset', DWORD),
326 ('cActions', DWORD),
327 ('dwsaActionsOffset', DWORD),
328 )
330class SC_ACTION(NDRSTRUCT):
331 structure = (
332 ('Type', DWORD),
333 ('Delay', DWORD) ,
334 )
336class SC_ACTIONS(NDRSTRUCT):
337 structure = (
338 ('Data', NDRUniConformantArray),
339 )
340 def __init__(self, data = None, isNDR64 = False):
341 NDR.__init__(self,None,isNDR64)
342 self.fields['Data'].item = SC_ACTION
343 if data is not None:
344 self.fromString(data)
346class SERVICE_FAILURE_ACTIONSW(NDRSTRUCT):
347 structure = (
348 ('dwResetPeriod', DWORD),
349 ('lpRebootMsg', LPWSTR) ,
350 ('lpCommand', LPWSTR) ,
351 ('cActions', DWORD) ,
352 ('lpsaActions', SC_ACTIONS) ,
353 )
355class LPSERVICE_FAILURE_ACTIONSW(NDRPOINTER):
356 referent = (
357 ('Data', SERVICE_FAILURE_ACTIONSW),
358 )
360class SERVICE_FAILURE_ACTIONS_FLAG(NDRSTRUCT):
361 structure = (
362 ('fFailureActionsOnNonCrashFailures', BOOL),
363 )
365class LPSERVICE_FAILURE_ACTIONS_FLAG(NDRPOINTER):
366 referent = (
367 ('Data', SERVICE_FAILURE_ACTIONS_FLAG),
368 )
370class SERVICE_DELAYED_AUTO_START_INFO(NDRSTRUCT):
371 structure = (
372 ('fDelayedAutostart', BOOL),
373 )
375class LPSERVICE_DELAYED_AUTO_START_INFO(NDRPOINTER):
376 referent = (
377 ('Data', SERVICE_DELAYED_AUTO_START_INFO),
378 )
380class SERVICE_SID_INFO(NDRSTRUCT):
381 structure = (
382 ('dwServiceSidType', DWORD),
383 )
385class LPSERVICE_SID_INFO(NDRPOINTER):
386 referent = (
387 ('Data', SERVICE_SID_INFO),
388 )
391class SERVICE_RPC_REQUIRED_PRIVILEGES_INFO(NDRSTRUCT):
392 structure = (
393 ('cbRequiredPrivileges',DWORD),
394 ('pRequiredPrivileges',LPBYTE),
395 )
396 def getData(self, soFar = 0):
397 self['cbRequiredPrivileges'] = len(self['pRequiredPrivileges'])
398 return NDR.getData(self, soFar = 0)
401class LPSERVICE_RPC_REQUIRED_PRIVILEGES_INFO(NDRPOINTER):
402 referent = (
403 ('Data', SERVICE_RPC_REQUIRED_PRIVILEGES_INFO),
404 )
406class SERVICE_REQUIRED_PRIVILEGES_INFO_WOW64(NDRSTRUCT):
407 structure = (
408 ('dwRequiredPrivilegesOffset', DWORD),
409 )
411class SERVICE_PRESHUTDOWN_INFO(NDRSTRUCT):
412 structure = (
413 ('dwPreshutdownTimeout', DWORD),
414 )
416class LPSERVICE_PRESHUTDOWN_INFO(NDRPOINTER):
417 referent = (
418 ('Data', SERVICE_PRESHUTDOWN_INFO),
419 )
421class SERVICE_STATUS_PROCESS(NDRSTRUCT):
422 structure = (
423 ('dwServiceType', DWORD),
424 ('dwCurrentState', DWORD),
425 ('dwControlsAccepted', DWORD),
426 ('dwWin32ExitCode', DWORD),
427 ('dwServiceSpecificExitCode', DWORD),
428 ('dwCheckPoint', DWORD),
429 ('dwWaitHint', DWORD),
430 ('dwProcessId', DWORD),
431 ('dwServiceFlags', DWORD),
432 )
434class UCHAR_16(NDRSTRUCT):
435 structure = (
436 ('Data', '16s=""'),
437 )
438 def getAlignment(self):
439 return 1
441class SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1(NDRSTRUCT):
442 structure = (
443 ('ullThreadId',ULONGLONG),
444 ('dwNotifyMask',DWORD),
445 ('CallbackAddressArray',UCHAR_16),
446 ('CallbackParamAddressArray',UCHAR_16),
447 ('ServiceStatus', SERVICE_STATUS_PROCESS),
448 ('dwNotificationStatus',DWORD),
449 ('dwSequence',DWORD),
450 )
452class SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2(NDRSTRUCT):
453 structure = (
454 ('ullThreadId',ULONGLONG),
455 ('dwNotifyMask',DWORD),
456 ('CallbackAddressArray',UCHAR_16),
457 ('CallbackParamAddressArray',UCHAR_16),
458 ('ServiceStatus',SERVICE_STATUS_PROCESS),
459 ('dwNotificationStatus',DWORD),
460 ('dwSequence',DWORD),
461 ('dwNotificationTriggered',DWORD),
462 ('pszServiceNames',LPWSTR),
463 )
465class PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1(NDRPOINTER):
466 referent = (
467 ('Data', SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1),
468 )
470class PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2(NDRPOINTER):
471 referent = (
472 ('Data', SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2),
473 )
475class SC_RPC_NOTIFY_PARAMS(NDRUNION):
476 union = {
477 1: ('pStatusChangeParam1', PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1),
478 2: ('pStatusChangeParams', PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2),
479 }
481class SC_RPC_NOTIFY_PARAMS_ARRAY(NDRUniConformantArray):
482 item = SC_RPC_NOTIFY_PARAMS
484class PSC_RPC_NOTIFY_PARAMS_LIST(NDRSTRUCT):
485 structure = (
486 ('cElements',BOUNDED_DWORD_4K),
487 ('NotifyParamsArray', SC_RPC_NOTIFY_PARAMS_ARRAY),
488 )
490class SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW(NDRSTRUCT):
491 structure = (
492 ('dwReason', DWORD),
493 ('pszComment', LPWSTR),
494 )
496class SERVICE_TRIGGER_SPECIFIC_DATA_ITEM(NDRSTRUCT):
497 structure = (
498 ('dwDataType',DWORD ),
499 ('cbData',DWORD),
500 ('pData', LPBYTE),
501 )
502 def getData(self, soFar = 0):
503 if self['pData'] != 0:
504 self['cbData'] = len(self['pData'])
505 return NDR.getData(self, soFar)
507class SERVICE_TRIGGER_SPECIFIC_DATA_ITEM_ARRAY(NDRUniConformantArray):
508 item = SERVICE_TRIGGER_SPECIFIC_DATA_ITEM
510class PSERVICE_TRIGGER_SPECIFIC_DATA_ITEM(NDRPOINTER):
511 referent = (
512 ('Data', SERVICE_TRIGGER_SPECIFIC_DATA_ITEM_ARRAY),
513 )
515class SERVICE_TRIGGER(NDRSTRUCT):
516 structure = (
517 ('dwTriggerType', DWORD),
518 ('dwAction', DWORD),
519 ('pTriggerSubtype', PGUID),
520 ('cDataItems', DWORD),
521 ('pDataItems', PSERVICE_TRIGGER_SPECIFIC_DATA_ITEM),
522 )
523 def getData(self, soFar = 0):
524 if self['pDataItems'] != 0:
525 self['cDataItems'] = len(self['pDataItems'])
526 return NDR.getData(self, soFar)
528class SERVICE_TRIGGER_ARRAY(NDRUniConformantArray):
529 item = SERVICE_TRIGGER
531class PSERVICE_TRIGGER(NDRPOINTER):
532 referent = (
533 ('Data', SERVICE_TRIGGER_ARRAY),
534 )
536class SERVICE_CONTROL_STATUS_REASON_OUT_PARAMS(NDRSTRUCT):
537 structure = (
538 ('ServiceStatus', SERVICE_STATUS_PROCESS),
539 )
541class SERVICE_TRIGGER_INFO(NDRSTRUCT):
542 structure = (
543 ('cTriggers', DWORD),
544 ('pTriggers', PSERVICE_TRIGGER),
545 ('pReserved', NDRPOINTERNULL ),
546 )
547 def getData(self, soFar = 0):
548 if self['pTriggers'] != 0:
549 self['cTriggers'] = len(self['pTriggers'])
550 return NDR.getData(self, soFar)
552class PSERVICE_TRIGGER_INFO(NDRPOINTER):
553 referent = (
554 ('Data', SERVICE_TRIGGER_INFO),
555 )
557class SERVICE_PREFERRED_NODE_INFO(NDRSTRUCT):
558 structure = (
559 ('usPreferredNode', USHORT),
560 ('fDelete', BOOL),
561 )
563class LPSERVICE_PREFERRED_NODE_INFO(NDRPOINTER):
564 referent = (
565 ('Data', SERVICE_PREFERRED_NODE_INFO),
566 )
568class SERVICE_RUNLEVEL_INFO(NDRSTRUCT):
569 structure = (
570 ('eLowestRunLevel', DWORD),
571 )
573class PSERVICE_RUNLEVEL_INFO(NDRPOINTER):
574 referent = (
575 ('Data', SERVICE_RUNLEVEL_INFO),
576 )
578class SERVICE_MANAGEDACCOUNT_INFO(NDRSTRUCT):
579 structure = (
580 ('fIsManagedAccount', DWORD),
581 )
583class PSERVICE_MANAGEDACCOUNT_INFO(NDRPOINTER):
584 referent = (
585 ('Data', SERVICE_MANAGEDACCOUNT_INFO),
586 )
588class SC_RPC_CONFIG_INFOW_UNION(NDRUNION):
589 commonHdr = (
590 ('tag', ULONG),
591 )
593 union = {
594 1: ('psd', LPSERVICE_DESCRIPTIONW),
595 2: ('psfa',LPSERVICE_FAILURE_ACTIONSW ),
596 3: ('psda',LPSERVICE_DELAYED_AUTO_START_INFO),
597 4: ('psfaf',LPSERVICE_FAILURE_ACTIONS_FLAG),
598 5: ('pssid',LPSERVICE_SID_INFO),
599 6: ('psrp',LPSERVICE_RPC_REQUIRED_PRIVILEGES_INFO),
600 7: ('psps',LPSERVICE_PRESHUTDOWN_INFO),
601 8: ('psti',PSERVICE_TRIGGER_INFO),
602 9: ('pspn',LPSERVICE_PREFERRED_NODE_INFO),
603 10: ('psri',PSERVICE_RUNLEVEL_INFO),
604 11: ('psma',PSERVICE_MANAGEDACCOUNT_INFO),
605 }
607class SC_RPC_CONFIG_INFOW(NDRSTRUCT):
608 structure = (
609 ('dwInfoLevel', DWORD),
610 ('Union', SC_RPC_CONFIG_INFOW_UNION),
611 )
613################################################################################
614# RPC CALLS
615################################################################################
617class RCloseServiceHandle(NDRCALL):
618 opnum = 0
619 structure = (
620 ('hSCObject',SC_RPC_HANDLE),
621 )
623class RCloseServiceHandleResponse(NDRCALL):
624 structure = (
625 ('hSCObject',SC_RPC_HANDLE),
626 ('ErrorCode', DWORD),
627 )
629class RControlService(NDRCALL):
630 opnum = 1
631 structure = (
632 ('hService',SC_RPC_HANDLE),
633 ('dwControl',DWORD),
634 )
636class RControlServiceResponse(NDRCALL):
637 structure = (
638 ('lpServiceStatus',SERVICE_STATUS),
639 ('ErrorCode', DWORD),
640 )
642class RDeleteService(NDRCALL):
643 opnum = 2
644 structure = (
645 ('hService',SC_RPC_HANDLE),
646 )
648class RDeleteServiceResponse(NDRCALL):
649 structure = (
650 ('ErrorCode', DWORD),
651 )
653class RLockServiceDatabase(NDRCALL):
654 opnum = 3
655 structure = (
656 ('hSCManager',SC_RPC_HANDLE),
657 )
659class RLockServiceDatabaseResponse(NDRCALL):
660 structure = (
661 ('lpLock',SC_RPC_LOCK),
662 ('ErrorCode', DWORD),
663 )
665class RQueryServiceObjectSecurity(NDRCALL):
666 opnum = 4
667 structure = (
668 ('hService',SC_RPC_HANDLE),
669 ('dwSecurityInformation',SECURITY_INFORMATION),
670 ('cbBufSize',DWORD),
671 )
673class RQueryServiceObjectSecurityResponse(NDRCALL):
674 structure = (
675 ('lpSecurityDescriptor', BYTE_ARRAY),
676 ('pcbBytesNeeded',BOUNDED_DWORD_256K),
677 ('ErrorCode', DWORD),
678 )
680class RSetServiceObjectSecurity(NDRCALL):
681 opnum = 5
682 structure = (
683 ('hService',SC_RPC_HANDLE),
684 ('dwSecurityInformation',SECURITY_INFORMATION),
685 ('lpSecurityDescriptor',LPBYTE),
686 ('cbBufSize',DWORD),
687 )
689class RSetServiceObjectSecurityResponse(NDRCALL):
690 structure = (
691 ('ErrorCode', DWORD),
692 )
694class RQueryServiceStatus(NDRCALL):
695 opnum = 6
696 structure = (
697 ('hService',SC_RPC_HANDLE),
698 )
700class RQueryServiceStatusResponse(NDRCALL):
701 structure = (
702 ('lpServiceStatus',SERVICE_STATUS),
703 ('ErrorCode', DWORD),
704 )
706class RSetServiceStatus(NDRCALL):
707 opnum = 7
708 structure = (
709 ('hServiceStatus',SC_RPC_HANDLE),
710 ('lpServiceStatus',SERVICE_STATUS),
711 )
713class RSetServiceStatusResponse(NDRCALL):
714 structure = (
715 ('ErrorCode', DWORD),
716 )
718class RUnlockServiceDatabase(NDRCALL):
719 opnum = 8
720 structure = (
721 ('Lock',SC_RPC_LOCK),
722 )
724class RUnlockServiceDatabaseResponse(NDRCALL):
725 structure = (
726 ('Lock',SC_RPC_LOCK),
727 ('ErrorCode', DWORD),
728 )
730class RNotifyBootConfigStatus(NDRCALL):
731 opnum = 9
732 structure = (
733 ('lpMachineName',SVCCTL_HANDLEW),
734 ('BootAcceptable',DWORD),
735 )
737class RNotifyBootConfigStatusResponse(NDRCALL):
738 structure = (
739 ('ErrorCode', DWORD),
740 )
742class RChangeServiceConfigW(NDRCALL):
743 opnum = 11
744 structure = (
745 ('hService',SC_RPC_HANDLE),
746 ('dwServiceType',DWORD),
747 ('dwStartType',DWORD),
748 ('dwErrorControl',DWORD),
749 ('lpBinaryPathName',LPWSTR),
750 ('lpLoadOrderGroup',LPWSTR),
751 ('lpdwTagId',LPDWORD),
752 ('lpDependencies',LPBYTE),
753 ('dwDependSize',DWORD),
754 ('lpServiceStartName',LPWSTR),
755 ('lpPassword',LPBYTE),
756 ('dwPwSize',DWORD),
757 ('lpDisplayName',LPWSTR),
758 )
760class RChangeServiceConfigWResponse(NDRCALL):
761 structure = (
762 ('lpdwTagId',LPDWORD),
763 ('ErrorCode', DWORD),
764 )
766class RCreateServiceW(NDRCALL):
767 opnum = 12
768 structure = (
769 ('hSCManager',SC_RPC_HANDLE),
770 ('lpServiceName',WSTR),
771 ('lpDisplayName',LPWSTR),
772 ('dwDesiredAccess',DWORD),
773 ('dwServiceType',DWORD),
774 ('dwStartType',DWORD),
775 ('dwErrorControl',DWORD),
776 ('lpBinaryPathName',WSTR),
777 ('lpLoadOrderGroup',LPWSTR),
778 ('lpdwTagId',LPDWORD),
779 ('lpDependencies',LPBYTE),
780 ('dwDependSize',DWORD),
781 ('lpServiceStartName',LPWSTR),
782 ('lpPassword',LPBYTE),
783 ('dwPwSize',DWORD),
784 )
786class RCreateServiceWResponse(NDRCALL):
787 structure = (
788 ('lpdwTagId',LPWSTR),
789 ('lpServiceHandle',SC_RPC_HANDLE),
790 ('ErrorCode', DWORD),
791 )
793class REnumDependentServicesW(NDRCALL):
794 opnum = 13
795 structure = (
796 ('hService',SC_RPC_HANDLE),
797 ('dwServiceState',DWORD),
798 ('cbBufSize',DWORD),
799 )
801class REnumDependentServicesWResponse(NDRCALL):
802 structure = (
803 ('lpServices',NDRUniConformantArray),
804 ('pcbBytesNeeded',BOUNDED_DWORD_256K),
805 ('lpServicesReturned',BOUNDED_DWORD_256K),
806 ('ErrorCode', DWORD),
807 )
809class REnumServicesStatusW(NDRCALL):
810 opnum = 14
811 structure = (
812 ('hSCManager',SC_RPC_HANDLE),
813 ('dwServiceType',DWORD),
814 ('dwServiceState',DWORD),
815 ('cbBufSize',DWORD),
816 ('lpResumeIndex',LPBOUNDED_DWORD_256K),
817 )
819class REnumServicesStatusWResponse(NDRCALL):
820 structure = (
821 ('lpBuffer',NDRUniConformantArray),
822 ('pcbBytesNeeded',BOUNDED_DWORD_256K),
823 ('lpServicesReturned',BOUNDED_DWORD_256K),
824 ('lpResumeIndex',LPBOUNDED_DWORD_256K),
825 ('ErrorCode', DWORD),
826 )
828class ROpenSCManagerW(NDRCALL):
829 opnum = 15
830 structure = (
831 ('lpMachineName',SVCCTL_HANDLEW),
832 ('lpDatabaseName',LPWSTR),
833 ('dwDesiredAccess',DWORD),
834 )
836class ROpenSCManagerWResponse(NDRCALL):
837 structure = (
838 ('lpScHandle',SC_RPC_HANDLE),
839 ('ErrorCode', DWORD),
840 )
842class ROpenServiceW(NDRCALL):
843 opnum = 16
844 structure = (
845 ('hSCManager',SC_RPC_HANDLE),
846 ('lpServiceName',WSTR),
847 ('dwDesiredAccess',DWORD),
848 )
850class ROpenServiceWResponse(NDRCALL):
851 structure = (
852 ('lpServiceHandle',SC_RPC_HANDLE),
853 ('ErrorCode', DWORD),
854 )
856class RQueryServiceConfigW(NDRCALL):
857 opnum = 17
858 structure = (
859 ('hService',SC_RPC_HANDLE),
860 ('cbBufSize',DWORD),
861 )
863class RQueryServiceConfigWResponse(NDRCALL):
864 structure = (
865 ('lpServiceConfig',QUERY_SERVICE_CONFIGW),
866 ('pcbBytesNeeded',BOUNDED_DWORD_8K),
867 ('ErrorCode', DWORD),
868 )
870class RQueryServiceLockStatusW(NDRCALL):
871 opnum = 18
872 structure = (
873 ('hSCManager',SC_RPC_HANDLE),
874 ('cbBufSize',DWORD),
875 )
877class RQueryServiceLockStatusWResponse(NDRCALL):
878 structure = (
879 ('lpLockStatus',QUERY_SERVICE_LOCK_STATUSW),
880 ('pcbBytesNeeded',BOUNDED_DWORD_4K),
881 ('ErrorCode', DWORD),
882 )
884class RStartServiceW(NDRCALL):
885 opnum = 19
886 structure = (
887 ('hService',SC_RPC_HANDLE),
888 ('argc',DWORD),
889 ('argv',UNIQUE_STRING_PTRSW),
890 )
892class RStartServiceWResponse(NDRCALL):
893 structure = (
894 ('ErrorCode', DWORD),
895 )
897class RGetServiceDisplayNameW(NDRCALL):
898 opnum = 20
899 structure = (
900 ('hSCManager',SC_RPC_HANDLE),
901 ('lpServiceName',WSTR),
902 ('lpcchBuffer',DWORD),
903 )
905class RGetServiceDisplayNameWResponse(NDRCALL):
906 structure = (
907 ('lpDisplayName',WSTR),
908 ('lpcchBuffer',DWORD),
909 ('ErrorCode', DWORD),
910 )
912class RGetServiceKeyNameW(NDRCALL):
913 opnum = 21
914 structure = (
915 ('hSCManager',SC_RPC_HANDLE),
916 ('lpDisplayName',WSTR),
917 ('lpcchBuffer',DWORD),
918 )
920class RGetServiceKeyNameWResponse(NDRCALL):
921 structure = (
922 ('lpDisplayName',WSTR),
923 ('lpcchBuffer',DWORD),
924 ('ErrorCode', DWORD),
925 )
927class REnumServiceGroupW(NDRCALL):
928 opnum = 35
929 structure = (
930 ('hSCManager',SC_RPC_HANDLE),
931 ('dwServiceType',DWORD),
932 ('dwServiceState',DWORD),
933 ('cbBufSize',DWORD),
934 ('lpResumeIndex',LPBOUNDED_DWORD_256K),
935 ('pszGroupName',LPWSTR),
936 )
938class REnumServiceGroupWResponse(NDRCALL):
939 structure = (
940 ('lpBuffer',LPBYTE),
941 ('pcbBytesNeeded',BOUNDED_DWORD_256K),
942 ('lpServicesReturned',BOUNDED_DWORD_256K),
943 ('lpResumeIndex',BOUNDED_DWORD_256K),
944 ('ErrorCode', DWORD),
945 )
947class RChangeServiceConfig2W(NDRCALL):
948 opnum = 37
949 structure = (
950 ('hService',SC_RPC_HANDLE),
951 ('Info',SC_RPC_CONFIG_INFOW),
952 )
954class RChangeServiceConfig2WResponse(NDRCALL):
955 structure = (
956 ('ErrorCode', DWORD),
957 )
959class RQueryServiceConfig2W(NDRCALL):
960 opnum = 39
961 structure = (
962 ('hService',SC_RPC_HANDLE),
963 ('dwInfoLevel',DWORD),
964 ('cbBufSize',DWORD),
965 )
967class RQueryServiceConfig2WResponse(NDRCALL):
968 structure = (
969 ('lpBuffer',NDRUniConformantArray),
970 ('pcbBytesNeeded',BOUNDED_DWORD_8K),
971 ('ErrorCode', DWORD),
972 )
974class RQueryServiceStatusEx(NDRCALL):
975 opnum = 40
976 structure = (
977 ('hService',SC_RPC_HANDLE),
978 ('InfoLevel',DWORD),
979 ('cbBufSize',DWORD),
980 )
982class RQueryServiceStatusExResponse(NDRCALL):
983 structure = (
984 ('lpBuffer',NDRUniConformantArray),
985 ('pcbBytesNeeded',BOUNDED_DWORD_8K),
986 ('ErrorCode', DWORD),
987 )
989class REnumServicesStatusExW(NDRCALL):
990 opnum = 42
991 structure = (
992 ('hSCManager',SC_RPC_HANDLE),
993 ('InfoLevel',DWORD),
994 ('dwServiceType',DWORD),
995 ('dwServiceState',DWORD),
996 ('cbBufSize',DWORD),
997 ('lpResumeIndex',LPBOUNDED_DWORD_256K),
998 ('pszGroupName',LPWSTR),
999 )
1001class REnumServicesStatusExWResponse(NDRCALL):
1002 structure = (
1003 ('lpBuffer',NDRUniConformantArray),
1004 ('pcbBytesNeeded',BOUNDED_DWORD_256K),
1005 ('lpServicesReturned',BOUNDED_DWORD_256K),
1006 ('lpResumeIndex',BOUNDED_DWORD_256K),
1007 ('ErrorCode', DWORD),
1008 )
1010class RCreateServiceWOW64W(NDRCALL):
1011 opnum = 45
1012 structure = (
1013 ('hSCManager',SC_RPC_HANDLE),
1014 ('lpServiceName',WSTR),
1015 ('lpDisplayName',LPWSTR),
1016 ('dwDesiredAccess',DWORD),
1017 ('dwServiceType',DWORD),
1018 ('dwStartType',DWORD),
1019 ('dwErrorControl',DWORD),
1020 ('lpBinaryPathName',WSTR),
1021 ('lpLoadOrderGroup',LPWSTR),
1022 ('lpdwTagId',LPDWORD),
1023 ('lpDependencies',LPBYTE),
1024 ('dwDependSize',DWORD),
1025 ('lpServiceStartName',LPWSTR),
1026 ('lpPassword',LPBYTE),
1027 ('dwPwSize',DWORD),
1028 )
1030class RCreateServiceWOW64WResponse(NDRCALL):
1031 structure = (
1032 ('lpdwTagId',LPWSTR),
1033 ('lpServiceHandle',SC_RPC_HANDLE),
1034 ('ErrorCode', DWORD),
1035 )
1037# Still not working, for some reason something changes in the way the pointer inside SC_RPC_NOTIFY_PARAMS is marshalled here
1038class RNotifyServiceStatusChange(NDRCALL):
1039 opnum = 47
1040 structure = (
1041 ('hService',SC_RPC_HANDLE),
1042 ('NotifyParams',SC_RPC_NOTIFY_PARAMS),
1043 ('pClientProcessGuid',GUID),
1044 )
1046class RNotifyServiceStatusChangeResponse(NDRCALL):
1047 structure = (
1048 ('pSCMProcessGuid',GUID),
1049 ('pfCreateRemoteQueue',PBOOL),
1050 ('phNotify',SC_NOTIFY_RPC_HANDLE),
1051 ('ErrorCode', DWORD),
1052 )
1054# Not working, until I don't fix the previous one
1055class RGetNotifyResults(NDRCALL):
1056 opnum = 48
1057 structure = (
1058 ('hNotify',SC_NOTIFY_RPC_HANDLE),
1059 )
1061class RGetNotifyResultsResponse(NDRCALL):
1062 structure = (
1063 ('ppNotifyParams',PSC_RPC_NOTIFY_PARAMS_LIST),
1064 ('ErrorCode', DWORD),
1065 )
1067# Not working, until I don't fix the previous ones
1068class RCloseNotifyHandle(NDRCALL):
1069 opnum = 49
1070 structure = (
1071 ('phNotify',SC_NOTIFY_RPC_HANDLE),
1072 )
1074class RCloseNotifyHandleResponse(NDRCALL):
1075 structure = (
1076 ('phNotify',SC_NOTIFY_RPC_HANDLE),
1077 ('pfApcFired',PBOOL),
1078 ('ErrorCode', DWORD),
1079 )
1081# Not working, returning bad_stub_data
1082class RControlServiceExW(NDRCALL):
1083 opnum = 51
1084 structure = (
1085 ('hService',SC_RPC_HANDLE),
1086 ('dwControl',DWORD),
1087 ('dwInfoLevel',DWORD),
1088 ('pControlInParams',SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW),
1089 )
1091class RControlServiceExWResponse(NDRCALL):
1092 structure = (
1093 ('pControlOutParams',SERVICE_CONTROL_STATUS_REASON_OUT_PARAMS),
1094 ('ErrorCode', DWORD),
1095 )
1097class RQueryServiceConfigEx(NDRCALL):
1098 opnum = 56
1099 structure = (
1100 ('hService',SC_RPC_HANDLE),
1101 ('dwInfoLevel',DWORD),
1102 )
1104class RQueryServiceConfigExResponse(NDRCALL):
1105 structure = (
1106 ('pInfo',SC_RPC_CONFIG_INFOW),
1107 ('ErrorCode', DWORD),
1108 )
1110################################################################################
1111# OPNUMs and their corresponding structures
1112################################################################################
1113OPNUMS = {
1114 0 : (RCloseServiceHandle, RCloseServiceHandleResponse),
1115 1 : (RControlService, RControlServiceResponse),
1116 2 : (RDeleteService, RDeleteServiceResponse),
1117 3 : (RLockServiceDatabase, RLockServiceDatabaseResponse),
1118 4 : (RQueryServiceObjectSecurity, RQueryServiceObjectSecurityResponse),
1119 5 : (RSetServiceObjectSecurity, RSetServiceObjectSecurityResponse),
1120 6 : (RQueryServiceStatus, RQueryServiceStatusResponse),
1121 7 : (RSetServiceStatus, RSetServiceStatusResponse),
1122 8 : (RUnlockServiceDatabase, RUnlockServiceDatabaseResponse),
1123 9 : (RNotifyBootConfigStatus, RNotifyBootConfigStatusResponse),
112411 : (RChangeServiceConfigW, RChangeServiceConfigWResponse),
112512 : (RCreateServiceW, RCreateServiceWResponse),
112613 : (REnumDependentServicesW, REnumDependentServicesWResponse),
112714 : (REnumServicesStatusW, REnumServicesStatusWResponse),
112815 : (ROpenSCManagerW, ROpenSCManagerWResponse),
112916 : (ROpenServiceW, ROpenServiceWResponse),
113017 : (RQueryServiceConfigW, RQueryServiceConfigWResponse),
113118 : (RQueryServiceLockStatusW, RQueryServiceLockStatusWResponse),
113219 : (RStartServiceW, RStartServiceWResponse),
113320 : (RGetServiceDisplayNameW, RGetServiceDisplayNameWResponse),
113421 : (RGetServiceKeyNameW, RGetServiceKeyNameWResponse),
113535 : (REnumServiceGroupW, REnumServiceGroupWResponse),
113637 : (RChangeServiceConfig2W, RChangeServiceConfig2WResponse),
113739 : (RQueryServiceConfig2W, RQueryServiceConfig2WResponse),
113840 : (RQueryServiceStatusEx, RQueryServiceStatusExResponse),
113942 : (REnumServicesStatusExW, REnumServicesStatusExWResponse),
114045 : (RCreateServiceWOW64W, RCreateServiceWOW64WResponse),
114147 : (RNotifyServiceStatusChange, RNotifyServiceStatusChangeResponse),
114248 : (RGetNotifyResults, RGetNotifyResultsResponse),
114349 : (RCloseNotifyHandle, RCloseNotifyHandleResponse),
114451 : (RControlServiceExW, RControlServiceExWResponse),
114556 : (RQueryServiceConfigEx, RQueryServiceConfigExResponse),
1146}
1148################################################################################
1149# HELPER FUNCTIONS
1150################################################################################
1151def checkNullString(string):
1152 if string == NULL:
1153 return string
1155 if string[-1:] != '\x00':
1156 return string + '\x00'
1157 else:
1158 return string
1160def hRCloseServiceHandle(dce, hSCObject):
1161 request = RCloseServiceHandle()
1162 request['hSCObject'] = hSCObject
1163 return dce.request(request)
1165def hRControlService(dce, hService, dwControl):
1166 request = RControlService()
1167 request['hService'] = hService
1168 request['dwControl'] = dwControl
1169 return dce.request(request)
1171def hRDeleteService(dce, hService):
1172 request = RDeleteService()
1173 request ['hService'] = hService
1174 return dce.request(request)
1176def hRLockServiceDatabase(dce, hSCManager):
1177 request = RLockServiceDatabase()
1178 request['hSCManager'] = hSCManager
1179 return dce.request(request)
1182def hRQueryServiceObjectSecurity(dce, hService, dwSecurityInformation, cbBufSize=0):
1183 request = RQueryServiceObjectSecurity()
1184 request['hService'] = hService
1185 request['dwSecurityInformation'] = dwSecurityInformation
1186 request['cbBufSize'] = cbBufSize
1187 try:
1188 resp = dce.request(request)
1189 except DCERPCSessionError as e:
1190 if e.get_error_code() == system_errors.ERROR_INSUFFICIENT_BUFFER:
1191 resp = e.get_packet()
1192 request['cbBufSize'] = resp['pcbBytesNeeded']
1193 resp = dce.request(request)
1194 else:
1195 raise
1196 return resp
1198def hRSetServiceObjectSecurity(dce, hService, dwSecurityInformation, lpSecurityDescriptor, cbBufSize ):
1199 request = RSetServiceObjectSecurity()
1200 request['hService'] = hService
1201 request['dwSecurityInformation'] = dwSecurityInformation
1202 request['cbBufSize'] = cbBufSize
1203 return dce.request(request)
1205def hRQueryServiceStatus(dce, hService ):
1206 request = RQueryServiceStatus()
1207 request['hService'] = hService
1208 return dce.request(request)
1210def hRSetServiceStatus(dce, hServiceStatus, lpServiceStatus ):
1211 request = RSetServiceStatus()
1212 request['hServiceStatus'] = hServiceStatus
1213 request['lpServiceStatus'] = lpServiceStatus
1214 return dce.request(request)
1216def hRUnlockServiceDatabase(dce, Lock ):
1217 request = RUnlockServiceDatabase()
1218 request['Lock'] = Lock
1219 return dce.request(request)
1221def hRNotifyBootConfigStatus(dce, lpMachineName, BootAcceptable ):
1222 request = RNotifyBootConfigStatus()
1223 request['lpMachineName'] = lpMachineName
1224 request['BootAcceptable'] = BootAcceptable
1225 return dce.request(request)
1227def hRChangeServiceConfigW(dce, hService, dwServiceType=SERVICE_NO_CHANGE, dwStartType=SERVICE_NO_CHANGE, dwErrorControl=SERVICE_NO_CHANGE, lpBinaryPathName=NULL, lpLoadOrderGroup=NULL, lpdwTagId=NULL, lpDependencies=NULL, dwDependSize=0, lpServiceStartName=NULL, lpPassword=NULL, dwPwSize=0, lpDisplayName=NULL):
1228 changeServiceConfig = RChangeServiceConfigW()
1229 changeServiceConfig['hService'] = hService
1230 changeServiceConfig['dwServiceType'] = dwServiceType
1231 changeServiceConfig['dwStartType'] = dwStartType
1232 changeServiceConfig['dwErrorControl'] = dwErrorControl
1233 changeServiceConfig['lpBinaryPathName'] = checkNullString(lpBinaryPathName)
1234 changeServiceConfig['lpLoadOrderGroup'] = checkNullString(lpLoadOrderGroup)
1235 changeServiceConfig['lpdwTagId'] = lpdwTagId
1236 changeServiceConfig['lpDependencies'] = lpDependencies
1237 # Strings MUST be NULL terminated for lpDependencies
1238 changeServiceConfig['dwDependSize'] = dwDependSize
1239 changeServiceConfig['lpServiceStartName'] = checkNullString(lpServiceStartName)
1240 changeServiceConfig['lpPassword'] = lpPassword
1241 changeServiceConfig['dwPwSize'] = dwPwSize
1242 changeServiceConfig['lpDisplayName'] = checkNullString(lpDisplayName)
1243 return dce.request(changeServiceConfig)
1245def hRCreateServiceW(dce, hSCManager, lpServiceName, lpDisplayName, dwDesiredAccess=SERVICE_ALL_ACCESS, dwServiceType=SERVICE_WIN32_OWN_PROCESS, dwStartType=SERVICE_AUTO_START, dwErrorControl=SERVICE_ERROR_IGNORE, lpBinaryPathName=NULL, lpLoadOrderGroup=NULL, lpdwTagId=NULL, lpDependencies=NULL, dwDependSize=0, lpServiceStartName=NULL, lpPassword=NULL, dwPwSize=0):
1246 createService = RCreateServiceW()
1247 createService['hSCManager'] = hSCManager
1248 createService['lpServiceName'] = checkNullString(lpServiceName)
1249 createService['lpDisplayName'] = checkNullString(lpDisplayName)
1250 createService['dwDesiredAccess'] = dwDesiredAccess
1251 createService['dwServiceType'] = dwServiceType
1252 createService['dwStartType'] = dwStartType
1253 createService['dwErrorControl'] = dwErrorControl
1254 createService['lpBinaryPathName'] = checkNullString(lpBinaryPathName)
1255 createService['lpLoadOrderGroup'] = checkNullString(lpLoadOrderGroup)
1256 createService['lpdwTagId'] = lpdwTagId
1257 # Strings MUST be NULL terminated for lpDependencies
1258 createService['lpDependencies'] = lpDependencies
1259 createService['dwDependSize'] = dwDependSize
1260 createService['lpServiceStartName'] = checkNullString(lpServiceStartName)
1261 createService['lpPassword'] = lpPassword
1262 createService['dwPwSize'] = dwPwSize
1263 return dce.request(createService)
1265def hREnumDependentServicesW(dce, hService, dwServiceState, cbBufSize ):
1266 enumDependentServices = REnumDependentServicesW()
1267 enumDependentServices['hService'] = hService
1268 enumDependentServices['dwServiceState'] = dwServiceState
1269 enumDependentServices['cbBufSize'] = cbBufSize
1270 return dce.request(enumDependentServices)
1272def hREnumServicesStatusW(dce, hSCManager, dwServiceType=SERVICE_WIN32_OWN_PROCESS|SERVICE_KERNEL_DRIVER|SERVICE_FILE_SYSTEM_DRIVER|SERVICE_WIN32_SHARE_PROCESS|SERVICE_INTERACTIVE_PROCESS, dwServiceState=SERVICE_STATE_ALL):
1273 class ENUM_SERVICE_STATUSW2(NDRSTRUCT):
1274 # This is a little trick, since the original structure is slightly different
1275 # but instead of parsing the LPBYTE buffer at hand, we just do it with the aid
1276 # of the NDR library, although the pointers are swapped from the original specification.
1277 # Why is this? Well.. since we're getting an LPBYTE back, it's just a copy of the remote's memory
1278 # where the pointers are actually POINTING to the data.
1279 # Sadly, the pointers are not aligned based on the services records, so we gotta do this
1280 # It should be easier in C of course.
1281 class STR(NDRPOINTER):
1282 referent = (
1283 ('Data', WIDESTR),
1284 )
1285 structure = (
1286 ('lpServiceName',STR),
1287 ('lpDisplayName',STR),
1288 ('ServiceStatus',SERVICE_STATUS),
1289 )
1291 enumServicesStatus = REnumServicesStatusW()
1292 enumServicesStatus['hSCManager'] = hSCManager
1293 enumServicesStatus['dwServiceType'] = dwServiceType
1294 enumServicesStatus['dwServiceState'] = dwServiceState
1295 enumServicesStatus['cbBufSize'] = 0
1296 enumServicesStatus['lpResumeIndex'] = NULL
1298 try:
1299 resp = dce.request(enumServicesStatus)
1300 except DCERPCSessionError as e:
1301 if e.get_error_code() == system_errors.ERROR_MORE_DATA: 1301 ↛ 1306line 1301 didn't jump to line 1306, because the condition on line 1301 was never false
1302 resp = e.get_packet()
1303 enumServicesStatus['cbBufSize'] = resp['pcbBytesNeeded']
1304 resp = dce.request(enumServicesStatus)
1305 else:
1306 raise
1308 # Now we're supposed to have all services returned. Now we gotta parse them
1310 enumArray = NDRUniConformantArray()
1311 enumArray.item = ENUM_SERVICE_STATUSW2
1313 enumArray.setArraySize(resp['lpServicesReturned'])
1315 data = b''.join(resp['lpBuffer'])
1316 enumArray.fromString(data)
1317 data = data[4:]
1318 # Since the pointers here are pointing to the actual data, we have to reparse
1319 # the referents
1320 for record in enumArray['Data']:
1321 offset = record.fields['lpDisplayName'].fields['ReferentID']-4
1322 name = WIDESTR(data[offset:])
1323 record['lpDisplayName'] = name['Data']
1324 offset = record.fields['lpServiceName'].fields['ReferentID']-4
1325 name = WIDESTR(data[offset:])
1326 record['lpServiceName'] = name['Data']
1328 return enumArray['Data']
1330def hROpenSCManagerW(dce, lpMachineName='DUMMY\x00', lpDatabaseName='ServicesActive\x00', dwDesiredAccess=SERVICE_START | SERVICE_STOP | SERVICE_CHANGE_CONFIG | SERVICE_QUERY_CONFIG | SERVICE_QUERY_STATUS | SERVICE_ENUMERATE_DEPENDENTS | SC_MANAGER_ENUMERATE_SERVICE):
1331 openSCManager = ROpenSCManagerW()
1332 openSCManager['lpMachineName'] = checkNullString(lpMachineName)
1333 openSCManager['lpDatabaseName'] = checkNullString(lpDatabaseName)
1334 openSCManager['dwDesiredAccess'] = dwDesiredAccess
1335 return dce.request(openSCManager)
1337def hROpenServiceW(dce, hSCManager, lpServiceName, dwDesiredAccess= SERVICE_ALL_ACCESS):
1338 openService = ROpenServiceW()
1339 openService['hSCManager'] = hSCManager
1340 openService['lpServiceName'] = checkNullString(lpServiceName)
1341 openService['dwDesiredAccess'] = dwDesiredAccess
1342 return dce.request(openService)
1344def hRQueryServiceConfigW(dce, hService):
1345 queryService = RQueryServiceConfigW()
1346 queryService['hService'] = hService
1347 queryService['cbBufSize'] = 0
1348 try:
1349 resp = dce.request(queryService)
1350 except DCERPCSessionError as e:
1351 if e.get_error_code() == system_errors.ERROR_INSUFFICIENT_BUFFER: 1351 ↛ 1356line 1351 didn't jump to line 1356, because the condition on line 1351 was never false
1352 resp = e.get_packet()
1353 queryService['cbBufSize'] = resp['pcbBytesNeeded']
1354 resp = dce.request(queryService)
1355 else:
1356 raise
1358 return resp
1360def hRQueryServiceLockStatusW(dce, hSCManager, cbBufSize ):
1361 queryServiceLock = RQueryServiceLockStatusW()
1362 queryServiceLock['hSCManager'] = hSCManager
1363 queryServiceLock['cbBufSize'] = cbBufSize
1364 return dce.request(queryServiceLock)
1366def hRStartServiceW(dce, hService, argc=0, argv=NULL ):
1367 startService = RStartServiceW()
1368 startService['hService'] = hService
1369 startService['argc'] = argc
1370 if argc == 0:
1371 startService['argv'] = NULL
1372 else:
1373 for item in argv:
1374 itemn = LPWSTR()
1375 itemn['Data'] = checkNullString(item)
1376 startService['argv'].append(itemn)
1377 return dce.request(startService)
1379def hRGetServiceDisplayNameW(dce, hSCManager, lpServiceName, lpcchBuffer ):
1380 getServiceDisplay = RGetServiceDisplayNameW()
1381 getServiceDisplay['hSCManager'] = hSCManager
1382 getServiceDisplay['lpServiceName'] = checkNullString(lpServiceName)
1383 getServiceDisplay['lpcchBuffer'] = lpcchBuffer
1384 return dce.request(getServiceDisplay)
1386def hRGetServiceKeyNameW(dce, hSCManager, lpDisplayName, lpcchBuffer ):
1387 getServiceKeyName = RGetServiceKeyNameW()
1388 getServiceKeyName['hSCManager'] = hSCManager
1389 getServiceKeyName['lpDisplayName'] = checkNullString(lpDisplayName)
1390 getServiceKeyName['lpcchBuffer'] = lpcchBuffer
1391 return dce.request(getServiceKeyName)
1393def hREnumServiceGroupW(dce, hSCManager, dwServiceType, dwServiceState, cbBufSize, lpResumeIndex = NULL, pszGroupName = NULL ):
1394 enumServiceGroup = REnumServiceGroupW()
1395 enumServiceGroup['hSCManager'] = hSCManager
1396 enumServiceGroup['dwServiceType'] = dwServiceType
1397 enumServiceGroup['dwServiceState'] = dwServiceState
1398 enumServiceGroup['cbBufSize'] = cbBufSize
1399 enumServiceGroup['lpResumeIndex'] = lpResumeIndex
1400 enumServiceGroup['pszGroupName'] = pszGroupName
1401 return dce.request(enumServiceGroup)