Hide keyboard shortcuts

Hot-keys on this page

r m x p   toggle line displays

j k   next/prev highlighted chunk

0   (zero) top of page

1   (one) first highlighted chunk

1# Impacket - Collection of Python classes for working with network protocols. 

2# 

3# SECUREAUTH LABS. Copyright (C) 2019 SecureAuth Corporation. All rights reserved. 

4# 

5# This software is provided under a slightly modified version 

6# of the Apache Software License. See the accompanying LICENSE file 

7# for more information. 

8# 

9# Description: 

10# [MS-SCMR] Interface implementation 

11# 

12# Best way to learn how to use these calls is to grab the protocol standard 

13# so you understand what the call does, and then read the test case located 

14# at https://github.com/SecureAuthCorp/impacket/tree/master/tests/SMB_RPC 

15# 

16# Some calls have helper functions, which makes it even easier to use. 

17# They are located at the end of this file. 

18# Helper functions start with "h"<name of the call>. 

19# There are test cases for them too. 

20# 

21# Author: 

22# Alberto Solino (@agsolino) 

23# 

24 

25from impacket import system_errors 

26from impacket.dcerpc.v5.dtypes import NULL, DWORD, LPWSTR, ULONG, BOOL, LPBYTE, ULONGLONG, PGUID, USHORT, LPDWORD, WSTR, \ 

27 GUID, PBOOL, WIDESTR 

28from impacket.dcerpc.v5.ndr import NDRCALL, NDR, NDRSTRUCT, NDRPOINTER, NDRPOINTERNULL, NDRUniConformantArray, NDRUNION 

29from impacket.dcerpc.v5.rpcrt import DCERPCException 

30from impacket.uuid import uuidtup_to_bin 

31 

32MSRPC_UUID_SCMR = uuidtup_to_bin(('367ABB81-9844-35F1-AD32-98F038001003', '2.0')) 

33 

34class DCERPCSessionError(DCERPCException): 

35 def __init__(self, error_string=None, error_code=None, packet=None): 

36 DCERPCException.__init__(self, error_string, error_code, packet) 

37 

38 def __str__( self ): 

39 key = self.error_code 

40 if key in system_errors.ERROR_MESSAGES: 40 ↛ 45line 40 didn't jump to line 45, because the condition on line 40 was never false

41 error_msg_short = system_errors.ERROR_MESSAGES[key][0] 

42 error_msg_verbose = system_errors.ERROR_MESSAGES[key][1] 

43 return 'SCMR SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose) 

44 else: 

45 return 'SCMR SessionError: unknown error code: 0x%x' % self.error_code 

46 

47################################################################################ 

48# CONSTANTS 

49################################################################################ 

50 

51# Access codes 

52SERVICE_ALL_ACCESS = 0X000F01FF 

53SERVICE_CHANGE_CONFIG = 0X00000002 

54SERVICE_ENUMERATE_DEPENDENTS = 0X00000008 

55SERVICE_INTERROGATE = 0X00000080 

56SERVICE_PAUSE_CONTINUE = 0X00000040 

57SERVICE_QUERY_CONFIG = 0X00000001 

58SERVICE_QUERY_STATUS = 0X00000004 

59SERVICE_START = 0X00000010 

60SERVICE_STOP = 0X00000020 

61SERVICE_USER_DEFINED_CTRL = 0X00000100 

62SERVICE_SET_STATUS = 0X00008000 

63 

64# Specific Access for SCM 

65SC_MANAGER_LOCK = 0x00000008 

66SC_MANAGER_CREATE_SERVICE = 0x00000002 

67SC_MANAGER_ENUMERATE_SERVICE = 0x00000004 

68SC_MANAGER_CONNECT = 0x00000001 

69SC_MANAGER_QUERY_LOCK_STATUS = 0x00000010 

70SC_MANAGER_MODIFY_BOOT_CONFIG = 0x00000020 

71 

72# Service Types 

73SERVICE_KERNEL_DRIVER = 0x00000001 

74SERVICE_FILE_SYSTEM_DRIVER = 0x00000002 

75SERVICE_WIN32_OWN_PROCESS = 0x00000010 

76SERVICE_WIN32_SHARE_PROCESS = 0x00000020 

77SERVICE_INTERACTIVE_PROCESS = 0x00000100 

78SERVICE_NO_CHANGE = 0xffffffff 

79 

80# Start Types 

81SERVICE_BOOT_START = 0x00000000 

82SERVICE_SYSTEM_START = 0x00000001 

83SERVICE_AUTO_START = 0x00000002 

84SERVICE_DEMAND_START = 0x00000003 

85SERVICE_DISABLED = 0x00000004 

86SERVICE_NO_CHANGE = 0xffffffff 

87 

88# Error Control  

89SERVICE_ERROR_IGNORE = 0x00000000 

90SERVICE_ERROR_NORMAL = 0x00000001 

91SERVICE_ERROR_SEVERE = 0x00000002 

92SERVICE_ERROR_CRITICAL = 0x00000003 

93SERVICE_NO_CHANGE = 0xffffffff 

94 

95# Service Control Codes 

96SERVICE_CONTROL_CONTINUE = 0x00000003 

97SERVICE_CONTROL_INTERROGATE = 0x00000004 

98SERVICE_CONTROL_PARAMCHANGE = 0x00000006 

99SERVICE_CONTROL_PAUSE = 0x00000002 

100SERVICE_CONTROL_STOP = 0x00000001 

101SERVICE_CONTROL_NETBINDADD = 0x00000007 

102SERVICE_CONTROL_NETBINDREMOVE = 0x00000008 

103SERVICE_CONTROL_NETBINDENABLE = 0x00000009 

104SERVICE_CONTROL_NETBINDDISABLE= 0x0000000A 

105 

106# Service State 

107SERVICE_ACTIVE = 0x00000001 

108SERVICE_INACTIVE = 0x00000002 

109SERVICE_STATE_ALL = 0x00000003 

110 

111# Current State 

112SERVICE_CONTINUE_PENDING = 0x00000005 

113SERVICE_PAUSE_PENDING = 0x00000006 

114SERVICE_PAUSED = 0x00000007 

115SERVICE_RUNNING = 0x00000004 

116SERVICE_START_PENDING = 0x00000002 

117SERVICE_STOP_PENDING = 0x00000003 

118SERVICE_STOPPED = 0x00000001 

119 

120# Controls Accepted 

121SERVICE_ACCEPT_PARAMCHANGE = 0x00000008 

122SERVICE_ACCEPT_PAUSE_CONTINUE = 0x00000002 

123SERVICE_ACCEPT_SHUTDOWN = 0x00000004 

124SERVICE_ACCEPT_STOP = 0x00000001 

125SERVICE_ACCEPT_HARDWAREPROFILECHANGE = 0x00000020 

126SERVICE_ACCEPT_POWEREVENT = 0x00000040 

127SERVICE_ACCEPT_SESSIONCHANGE = 0x00000080 

128SERVICE_ACCEPT_PRESHUTDOWN = 0x00000100 

129SERVICE_ACCEPT_TIMECHANGE = 0x00000200 

130ERVICE_ACCEPT_TRIGGEREVENT = 0x00000400 

131 

132# Security Information 

133DACL_SECURITY_INFORMATION = 0x4 

134GROUP_SECURITY_INFORMATION = 0x2 

135OWNER_SECURITY_INFORMATION = 0x1 

136SACL_SECURITY_INFORMATION = 0x8 

137 

138# Service Config2 Info Levels 

139SERVICE_CONFIG_DESCRIPTION = 0x00000001 

140SERVICE_CONFIG_FAILURE_ACTIONS = 0x00000002 

141SERVICE_CONFIG_DELAYED_AUTO_START_INFO = 0x00000003 

142SERVICE_CONFIG_FAILURE_ACTIONS_FLAG = 0x00000004 

143SERVICE_CONFIG_SERVICE_SID_INFO = 0x00000005 

144SERVICE_CONFIG_REQUIRED_PRIVILEGES_INFO = 0x00000006 

145SERVICE_CONFIG_PRESHUTDOWN_INFO = 0x00000007 

146SERVICE_CONFIG_PREFERRED_NODE = 0x00000009 

147SERVICE_CONFIG_RUNLEVEL_INFO = 0x0000000A 

148 

149# SC_ACTIONS Types 

150SC_ACTION_NONE = 0 

151SC_ACTION_RESTART = 1 

152SC_ACTION_REBOOT = 2 

153SC_ACTION_RUN_COMMAND = 3 

154 

155# SERVICE_SID_INFO types 

156SERVICE_SID_TYPE_NONE = 0x00000000 

157SERVICE_SID_TYPE_RESTRICTED = 0x00000003 

158SERVICE_SID_TYPE_UNRESTRICTED = 0x00000001 

159 

160# SC_STATUS_TYPE types 

161SC_STATUS_PROCESS_INFO = 0 

162 

163# Notify Mask 

164SERVICE_NOTIFY_CREATED = 0x00000080 

165SERVICE_NOTIFY_CONTINUE_PENDING = 0x00000010 

166SERVICE_NOTIFY_DELETE_PENDING = 0x00000200 

167SERVICE_NOTIFY_DELETED = 0x00000100 

168SERVICE_NOTIFY_PAUSE_PENDING = 0x00000020 

169SERVICE_NOTIFY_PAUSED = 0x00000040 

170SERVICE_NOTIFY_RUNNING = 0x00000008 

171SERVICE_NOTIFY_START_PENDING = 0x00000002 

172SERVICE_NOTIFY_STOP_PENDING = 0x00000004 

173SERVICE_NOTIFY_STOPPED = 0x00000001 

174 

175# SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW Reasons 

176SERVICE_STOP_CUSTOM = 0x20000000 

177SERVICE_STOP_PLANNED = 0x40000000 

178SERVICE_STOP_UNPLANNED = 0x10000000 

179 

180# SERVICE_TRIGGER triggers 

181SERVICE_TRIGGER_TYPE_DEVICE_INTERFACE_ARRIVAL = 0x00000001 

182SERVICE_TRIGGER_TYPE_IP_ADDRESS_AVAILABILITY = 0x00000002 

183SERVICE_TRIGGER_TYPE_DOMAIN_JOIN = 0x00000003 

184SERVICE_TRIGGER_TYPE_FIREWALL_PORT_EVENT = 0x00000004 

185SERVICE_TRIGGER_TYPE_GROUP_POLICY = 0x00000005 

186SERVICE_TRIGGER_TYPE_CUSTOM = 0x00000020 

187 

188# SERVICE_TRIGGER actions 

189SERVICE_TRIGGER_ACTION_SERVICE_START = 0x00000001 

190SERVICE_TRIGGER_ACTION_SERVICE_STOP = 0x00000002 

191 

192# SERVICE_TRIGGER subTypes 

193DOMAIN_JOIN_GUID = '1ce20aba-9851-4421-9430-1ddeb766e809' 

194DOMAIN_LEAVE_GUID = 'ddaf516e-58c2-4866-9574-c3b615d42ea1' 

195FIREWALL_PORT_OPEN_GUID = 'b7569e07-8421-4ee0-ad10-86915afdad09' 

196FIREWALL_PORT_CLOSE_GUID = 'a144ed38-8e12-4de4-9d96-e64740b1a524' 

197MACHINE_POLICY_PRESENT_GUID = '659FCAE6-5BDB-4DA9-B1FF-CA2A178D46E0' 

198NETWORK_MANAGER_FIRST_IP_ADDRESS_ARRIVAL_GUID = '4f27f2de-14e2-430b-a549-7cd48cbc8245' 

199NETWORK_MANAGER_LAST_IP_ADDRESS_REMOVAL_GUID = 'cc4ba62a-162e-4648-847a-b6bdf993e335' 

200USER_POLICY_PRESENT_GUID = '54FB46C8-F089-464C-B1FD-59D1B62C3B50' 

201 

202# SERVICE_TRIGGER_SPECIFIC_DATA_ITEM dataTypes 

203SERVICE_TRIGGER_DATA_TYPE_BINARY = 0x00000001 

204SERVICE_TRIGGER_DATA_TYPE_STRING = 0x00000002 

205 

206################################################################################ 

207# STRUCTURES 

208################################################################################ 

209 

210class BYTE_ARRAY(NDRUniConformantArray): 

211 item = 'c' 

212 

213class SC_RPC_HANDLE(NDRSTRUCT): 

214 structure = ( 

215 ('Data','20s=""'), 

216 ) 

217 def getAlignment(self): 

218 return 1 

219 

220SC_NOTIFY_RPC_HANDLE = SC_RPC_HANDLE 

221 

222class SERVICE_STATUS(NDRSTRUCT): 

223 structure = ( 

224 ('dwServiceType',DWORD), 

225 ('dwCurrentState',DWORD), 

226 ('dwControlsAccepted',DWORD), 

227 ('dwWin32ExitCode',DWORD), 

228 ('dwServiceSpecificExitCode',DWORD), 

229 ('dwCheckPoint',DWORD), 

230 ('dwWaitHint',DWORD), 

231 ) 

232 

233class QUERY_SERVICE_CONFIGW(NDRSTRUCT): 

234 structure = ( 

235 ('dwServiceType',DWORD), 

236 ('dwStartType',DWORD), 

237 ('dwErrorControl',DWORD), 

238 ('lpBinaryPathName', LPWSTR), 

239 ('lpLoadOrderGroup',LPWSTR), 

240 ('dwTagId',DWORD), 

241 ('lpDependencies',LPWSTR), 

242 ('lpServiceStartName',LPWSTR), 

243 ('lpDisplayName',LPWSTR), 

244 ) 

245 

246class SC_RPC_LOCK(NDRSTRUCT): 

247 structure = ( 

248 ('Data','20s=""'), 

249 ) 

250 def getAlignment(self): 

251 return 1 

252 

253class LPSERVICE_STATUS(NDRPOINTER): 

254 referent = ( 

255 ('Data',SERVICE_STATUS), 

256 ) 

257 

258SECURITY_INFORMATION = ULONG 

259 

260BOUNDED_DWORD_256K = DWORD 

261 

262class LPBOUNDED_DWORD_256K(NDRPOINTER): 

263 referent = ( 

264 ('Data', BOUNDED_DWORD_256K), 

265 ) 

266 

267SVCCTL_HANDLEW = LPWSTR 

268 

269class ENUM_SERVICE_STATUSW(NDRSTRUCT): 

270 structure = ( 

271 ('lpServiceName',LPWSTR), 

272 ('lpDisplayName',LPWSTR), 

273 ('ServiceStatus',SERVICE_STATUS), 

274 ) 

275 

276class LPQUERY_SERVICE_CONFIGW(NDRPOINTER): 

277 referent = ( 

278 ('Data', QUERY_SERVICE_CONFIGW), 

279 ) 

280 

281BOUNDED_DWORD_8K = DWORD 

282BOUNDED_DWORD_4K = DWORD 

283 

284class STRING_PTRSW(NDRSTRUCT): 

285 structure = ( 

286 ('Data',NDRUniConformantArray), 

287 ) 

288 def __init__(self, data = None, isNDR64 = False): 

289 NDR.__init__(self,None,isNDR64) 

290 self.fields['Data'].item = LPWSTR 

291 if data is not None: 291 ↛ 292line 291 didn't jump to line 292, because the condition on line 291 was never true

292 self.fromString(data) 

293 

294class UNIQUE_STRING_PTRSW(NDRPOINTER): 

295 referent = ( 

296 ('Data', STRING_PTRSW), 

297 ) 

298 

299class QUERY_SERVICE_LOCK_STATUSW(NDRSTRUCT): 

300 structure = ( 

301 ('fIsLocked',DWORD), 

302 ('lpLockOwner',LPWSTR), 

303 ('dwLockDuration',DWORD), 

304 ) 

305 

306class SERVICE_DESCRIPTION_WOW64(NDRSTRUCT): 

307 structure = ( 

308 ('dwDescriptionOffset', DWORD), 

309 ) 

310 

311class SERVICE_DESCRIPTIONW(NDRSTRUCT): 

312 structure = ( 

313 ('lpDescription', LPWSTR), 

314 ) 

315 

316class LPSERVICE_DESCRIPTIONW(NDRPOINTER): 

317 referent = ( 

318 ('Data', SERVICE_DESCRIPTIONW), 

319 ) 

320 

321class SERVICE_FAILURE_ACTIONS_WOW64(NDRSTRUCT): 

322 structure = ( 

323 ('dwResetPeriod', DWORD), 

324 ('dwRebootMsgOffset', DWORD), 

325 ('dwCommandOffset', DWORD), 

326 ('cActions', DWORD), 

327 ('dwsaActionsOffset', DWORD), 

328 ) 

329 

330class SC_ACTION(NDRSTRUCT): 

331 structure = ( 

332 ('Type', DWORD), 

333 ('Delay', DWORD) , 

334 ) 

335 

336class SC_ACTIONS(NDRSTRUCT): 

337 structure = ( 

338 ('Data', NDRUniConformantArray), 

339 ) 

340 def __init__(self, data = None, isNDR64 = False): 

341 NDR.__init__(self,None,isNDR64) 

342 self.fields['Data'].item = SC_ACTION 

343 if data is not None: 

344 self.fromString(data) 

345 

346class SERVICE_FAILURE_ACTIONSW(NDRSTRUCT): 

347 structure = ( 

348 ('dwResetPeriod', DWORD), 

349 ('lpRebootMsg', LPWSTR) , 

350 ('lpCommand', LPWSTR) , 

351 ('cActions', DWORD) , 

352 ('lpsaActions', SC_ACTIONS) , 

353 ) 

354 

355class LPSERVICE_FAILURE_ACTIONSW(NDRPOINTER): 

356 referent = ( 

357 ('Data', SERVICE_FAILURE_ACTIONSW), 

358 ) 

359 

360class SERVICE_FAILURE_ACTIONS_FLAG(NDRSTRUCT): 

361 structure = ( 

362 ('fFailureActionsOnNonCrashFailures', BOOL), 

363 ) 

364 

365class LPSERVICE_FAILURE_ACTIONS_FLAG(NDRPOINTER): 

366 referent = ( 

367 ('Data', SERVICE_FAILURE_ACTIONS_FLAG), 

368 ) 

369 

370class SERVICE_DELAYED_AUTO_START_INFO(NDRSTRUCT): 

371 structure = ( 

372 ('fDelayedAutostart', BOOL), 

373 ) 

374 

375class LPSERVICE_DELAYED_AUTO_START_INFO(NDRPOINTER): 

376 referent = ( 

377 ('Data', SERVICE_DELAYED_AUTO_START_INFO), 

378 ) 

379 

380class SERVICE_SID_INFO(NDRSTRUCT): 

381 structure = ( 

382 ('dwServiceSidType', DWORD), 

383 ) 

384 

385class LPSERVICE_SID_INFO(NDRPOINTER): 

386 referent = ( 

387 ('Data', SERVICE_SID_INFO), 

388 ) 

389 

390 

391class SERVICE_RPC_REQUIRED_PRIVILEGES_INFO(NDRSTRUCT): 

392 structure = ( 

393 ('cbRequiredPrivileges',DWORD), 

394 ('pRequiredPrivileges',LPBYTE), 

395 ) 

396 def getData(self, soFar = 0): 

397 self['cbRequiredPrivileges'] = len(self['pRequiredPrivileges']) 

398 return NDR.getData(self, soFar = 0) 

399 

400 

401class LPSERVICE_RPC_REQUIRED_PRIVILEGES_INFO(NDRPOINTER): 

402 referent = ( 

403 ('Data', SERVICE_RPC_REQUIRED_PRIVILEGES_INFO), 

404 ) 

405 

406class SERVICE_REQUIRED_PRIVILEGES_INFO_WOW64(NDRSTRUCT): 

407 structure = ( 

408 ('dwRequiredPrivilegesOffset', DWORD), 

409 ) 

410 

411class SERVICE_PRESHUTDOWN_INFO(NDRSTRUCT): 

412 structure = ( 

413 ('dwPreshutdownTimeout', DWORD), 

414 ) 

415 

416class LPSERVICE_PRESHUTDOWN_INFO(NDRPOINTER): 

417 referent = ( 

418 ('Data', SERVICE_PRESHUTDOWN_INFO), 

419 ) 

420 

421class SERVICE_STATUS_PROCESS(NDRSTRUCT): 

422 structure = ( 

423 ('dwServiceType', DWORD), 

424 ('dwCurrentState', DWORD), 

425 ('dwControlsAccepted', DWORD), 

426 ('dwWin32ExitCode', DWORD), 

427 ('dwServiceSpecificExitCode', DWORD), 

428 ('dwCheckPoint', DWORD), 

429 ('dwWaitHint', DWORD), 

430 ('dwProcessId', DWORD), 

431 ('dwServiceFlags', DWORD), 

432 ) 

433 

434class UCHAR_16(NDRSTRUCT): 

435 structure = ( 

436 ('Data', '16s=""'), 

437 ) 

438 def getAlignment(self): 

439 return 1 

440 

441class SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1(NDRSTRUCT): 

442 structure = ( 

443 ('ullThreadId',ULONGLONG), 

444 ('dwNotifyMask',DWORD), 

445 ('CallbackAddressArray',UCHAR_16), 

446 ('CallbackParamAddressArray',UCHAR_16), 

447 ('ServiceStatus', SERVICE_STATUS_PROCESS), 

448 ('dwNotificationStatus',DWORD), 

449 ('dwSequence',DWORD), 

450 ) 

451 

452class SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2(NDRSTRUCT): 

453 structure = ( 

454 ('ullThreadId',ULONGLONG), 

455 ('dwNotifyMask',DWORD), 

456 ('CallbackAddressArray',UCHAR_16), 

457 ('CallbackParamAddressArray',UCHAR_16), 

458 ('ServiceStatus',SERVICE_STATUS_PROCESS), 

459 ('dwNotificationStatus',DWORD), 

460 ('dwSequence',DWORD), 

461 ('dwNotificationTriggered',DWORD), 

462 ('pszServiceNames',LPWSTR), 

463 ) 

464 

465class PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1(NDRPOINTER): 

466 referent = ( 

467 ('Data', SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1), 

468 ) 

469 

470class PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2(NDRPOINTER): 

471 referent = ( 

472 ('Data', SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2), 

473 ) 

474 

475class SC_RPC_NOTIFY_PARAMS(NDRUNION): 

476 union = { 

477 1: ('pStatusChangeParam1', PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1), 

478 2: ('pStatusChangeParams', PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2), 

479 } 

480 

481class SC_RPC_NOTIFY_PARAMS_ARRAY(NDRUniConformantArray): 

482 item = SC_RPC_NOTIFY_PARAMS 

483 

484class PSC_RPC_NOTIFY_PARAMS_LIST(NDRSTRUCT): 

485 structure = ( 

486 ('cElements',BOUNDED_DWORD_4K), 

487 ('NotifyParamsArray', SC_RPC_NOTIFY_PARAMS_ARRAY), 

488 ) 

489 

490class SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW(NDRSTRUCT): 

491 structure = ( 

492 ('dwReason', DWORD), 

493 ('pszComment', LPWSTR), 

494 ) 

495 

496class SERVICE_TRIGGER_SPECIFIC_DATA_ITEM(NDRSTRUCT): 

497 structure = ( 

498 ('dwDataType',DWORD ), 

499 ('cbData',DWORD), 

500 ('pData', LPBYTE), 

501 ) 

502 def getData(self, soFar = 0): 

503 if self['pData'] != 0: 

504 self['cbData'] = len(self['pData']) 

505 return NDR.getData(self, soFar) 

506 

507class SERVICE_TRIGGER_SPECIFIC_DATA_ITEM_ARRAY(NDRUniConformantArray): 

508 item = SERVICE_TRIGGER_SPECIFIC_DATA_ITEM 

509 

510class PSERVICE_TRIGGER_SPECIFIC_DATA_ITEM(NDRPOINTER): 

511 referent = ( 

512 ('Data', SERVICE_TRIGGER_SPECIFIC_DATA_ITEM_ARRAY), 

513 ) 

514 

515class SERVICE_TRIGGER(NDRSTRUCT): 

516 structure = ( 

517 ('dwTriggerType', DWORD), 

518 ('dwAction', DWORD), 

519 ('pTriggerSubtype', PGUID), 

520 ('cDataItems', DWORD), 

521 ('pDataItems', PSERVICE_TRIGGER_SPECIFIC_DATA_ITEM), 

522 ) 

523 def getData(self, soFar = 0): 

524 if self['pDataItems'] != 0: 

525 self['cDataItems'] = len(self['pDataItems']) 

526 return NDR.getData(self, soFar) 

527 

528class SERVICE_TRIGGER_ARRAY(NDRUniConformantArray): 

529 item = SERVICE_TRIGGER 

530 

531class PSERVICE_TRIGGER(NDRPOINTER): 

532 referent = ( 

533 ('Data', SERVICE_TRIGGER_ARRAY), 

534 ) 

535 

536class SERVICE_CONTROL_STATUS_REASON_OUT_PARAMS(NDRSTRUCT): 

537 structure = ( 

538 ('ServiceStatus', SERVICE_STATUS_PROCESS), 

539 ) 

540 

541class SERVICE_TRIGGER_INFO(NDRSTRUCT): 

542 structure = ( 

543 ('cTriggers', DWORD), 

544 ('pTriggers', PSERVICE_TRIGGER), 

545 ('pReserved', NDRPOINTERNULL ), 

546 ) 

547 def getData(self, soFar = 0): 

548 if self['pTriggers'] != 0: 

549 self['cTriggers'] = len(self['pTriggers']) 

550 return NDR.getData(self, soFar) 

551 

552class PSERVICE_TRIGGER_INFO(NDRPOINTER): 

553 referent = ( 

554 ('Data', SERVICE_TRIGGER_INFO), 

555 ) 

556 

557class SERVICE_PREFERRED_NODE_INFO(NDRSTRUCT): 

558 structure = ( 

559 ('usPreferredNode', USHORT), 

560 ('fDelete', BOOL), 

561 ) 

562 

563class LPSERVICE_PREFERRED_NODE_INFO(NDRPOINTER): 

564 referent = ( 

565 ('Data', SERVICE_PREFERRED_NODE_INFO), 

566 ) 

567 

568class SERVICE_RUNLEVEL_INFO(NDRSTRUCT): 

569 structure = ( 

570 ('eLowestRunLevel', DWORD), 

571 ) 

572 

573class PSERVICE_RUNLEVEL_INFO(NDRPOINTER): 

574 referent = ( 

575 ('Data', SERVICE_RUNLEVEL_INFO), 

576 ) 

577 

578class SERVICE_MANAGEDACCOUNT_INFO(NDRSTRUCT): 

579 structure = ( 

580 ('fIsManagedAccount', DWORD), 

581 ) 

582 

583class PSERVICE_MANAGEDACCOUNT_INFO(NDRPOINTER): 

584 referent = ( 

585 ('Data', SERVICE_MANAGEDACCOUNT_INFO), 

586 ) 

587 

588class SC_RPC_CONFIG_INFOW_UNION(NDRUNION): 

589 commonHdr = ( 

590 ('tag', ULONG), 

591 ) 

592 

593 union = { 

594 1: ('psd', LPSERVICE_DESCRIPTIONW), 

595 2: ('psfa',LPSERVICE_FAILURE_ACTIONSW ), 

596 3: ('psda',LPSERVICE_DELAYED_AUTO_START_INFO), 

597 4: ('psfaf',LPSERVICE_FAILURE_ACTIONS_FLAG), 

598 5: ('pssid',LPSERVICE_SID_INFO), 

599 6: ('psrp',LPSERVICE_RPC_REQUIRED_PRIVILEGES_INFO), 

600 7: ('psps',LPSERVICE_PRESHUTDOWN_INFO), 

601 8: ('psti',PSERVICE_TRIGGER_INFO), 

602 9: ('pspn',LPSERVICE_PREFERRED_NODE_INFO), 

603 10: ('psri',PSERVICE_RUNLEVEL_INFO), 

604 11: ('psma',PSERVICE_MANAGEDACCOUNT_INFO), 

605 } 

606 

607class SC_RPC_CONFIG_INFOW(NDRSTRUCT): 

608 structure = ( 

609 ('dwInfoLevel', DWORD), 

610 ('Union', SC_RPC_CONFIG_INFOW_UNION), 

611 ) 

612 

613################################################################################ 

614# RPC CALLS 

615################################################################################ 

616 

617class RCloseServiceHandle(NDRCALL): 

618 opnum = 0 

619 structure = ( 

620 ('hSCObject',SC_RPC_HANDLE), 

621 ) 

622 

623class RCloseServiceHandleResponse(NDRCALL): 

624 structure = ( 

625 ('hSCObject',SC_RPC_HANDLE), 

626 ('ErrorCode', DWORD), 

627 ) 

628 

629class RControlService(NDRCALL): 

630 opnum = 1 

631 structure = ( 

632 ('hService',SC_RPC_HANDLE), 

633 ('dwControl',DWORD), 

634 ) 

635 

636class RControlServiceResponse(NDRCALL): 

637 structure = ( 

638 ('lpServiceStatus',SERVICE_STATUS), 

639 ('ErrorCode', DWORD), 

640 ) 

641 

642class RDeleteService(NDRCALL): 

643 opnum = 2 

644 structure = ( 

645 ('hService',SC_RPC_HANDLE), 

646 ) 

647 

648class RDeleteServiceResponse(NDRCALL): 

649 structure = ( 

650 ('ErrorCode', DWORD), 

651 ) 

652 

653class RLockServiceDatabase(NDRCALL): 

654 opnum = 3 

655 structure = ( 

656 ('hSCManager',SC_RPC_HANDLE), 

657 ) 

658 

659class RLockServiceDatabaseResponse(NDRCALL): 

660 structure = ( 

661 ('lpLock',SC_RPC_LOCK), 

662 ('ErrorCode', DWORD), 

663 ) 

664 

665class RQueryServiceObjectSecurity(NDRCALL): 

666 opnum = 4 

667 structure = ( 

668 ('hService',SC_RPC_HANDLE), 

669 ('dwSecurityInformation',SECURITY_INFORMATION), 

670 ('cbBufSize',DWORD), 

671 ) 

672 

673class RQueryServiceObjectSecurityResponse(NDRCALL): 

674 structure = ( 

675 ('lpSecurityDescriptor', BYTE_ARRAY), 

676 ('pcbBytesNeeded',BOUNDED_DWORD_256K), 

677 ('ErrorCode', DWORD), 

678 ) 

679 

680class RSetServiceObjectSecurity(NDRCALL): 

681 opnum = 5 

682 structure = ( 

683 ('hService',SC_RPC_HANDLE), 

684 ('dwSecurityInformation',SECURITY_INFORMATION), 

685 ('lpSecurityDescriptor',LPBYTE), 

686 ('cbBufSize',DWORD), 

687 ) 

688 

689class RSetServiceObjectSecurityResponse(NDRCALL): 

690 structure = ( 

691 ('ErrorCode', DWORD), 

692 ) 

693 

694class RQueryServiceStatus(NDRCALL): 

695 opnum = 6 

696 structure = ( 

697 ('hService',SC_RPC_HANDLE), 

698 ) 

699 

700class RQueryServiceStatusResponse(NDRCALL): 

701 structure = ( 

702 ('lpServiceStatus',SERVICE_STATUS), 

703 ('ErrorCode', DWORD), 

704 ) 

705 

706class RSetServiceStatus(NDRCALL): 

707 opnum = 7 

708 structure = ( 

709 ('hServiceStatus',SC_RPC_HANDLE), 

710 ('lpServiceStatus',SERVICE_STATUS), 

711 ) 

712 

713class RSetServiceStatusResponse(NDRCALL): 

714 structure = ( 

715 ('ErrorCode', DWORD), 

716 ) 

717 

718class RUnlockServiceDatabase(NDRCALL): 

719 opnum = 8 

720 structure = ( 

721 ('Lock',SC_RPC_LOCK), 

722 ) 

723 

724class RUnlockServiceDatabaseResponse(NDRCALL): 

725 structure = ( 

726 ('Lock',SC_RPC_LOCK), 

727 ('ErrorCode', DWORD), 

728 ) 

729 

730class RNotifyBootConfigStatus(NDRCALL): 

731 opnum = 9 

732 structure = ( 

733 ('lpMachineName',SVCCTL_HANDLEW), 

734 ('BootAcceptable',DWORD), 

735 ) 

736 

737class RNotifyBootConfigStatusResponse(NDRCALL): 

738 structure = ( 

739 ('ErrorCode', DWORD), 

740 ) 

741 

742class RChangeServiceConfigW(NDRCALL): 

743 opnum = 11 

744 structure = ( 

745 ('hService',SC_RPC_HANDLE), 

746 ('dwServiceType',DWORD), 

747 ('dwStartType',DWORD), 

748 ('dwErrorControl',DWORD), 

749 ('lpBinaryPathName',LPWSTR), 

750 ('lpLoadOrderGroup',LPWSTR), 

751 ('lpdwTagId',LPDWORD), 

752 ('lpDependencies',LPBYTE), 

753 ('dwDependSize',DWORD), 

754 ('lpServiceStartName',LPWSTR), 

755 ('lpPassword',LPBYTE), 

756 ('dwPwSize',DWORD), 

757 ('lpDisplayName',LPWSTR), 

758 ) 

759 

760class RChangeServiceConfigWResponse(NDRCALL): 

761 structure = ( 

762 ('lpdwTagId',LPDWORD), 

763 ('ErrorCode', DWORD), 

764 ) 

765 

766class RCreateServiceW(NDRCALL): 

767 opnum = 12 

768 structure = ( 

769 ('hSCManager',SC_RPC_HANDLE), 

770 ('lpServiceName',WSTR), 

771 ('lpDisplayName',LPWSTR), 

772 ('dwDesiredAccess',DWORD), 

773 ('dwServiceType',DWORD), 

774 ('dwStartType',DWORD), 

775 ('dwErrorControl',DWORD), 

776 ('lpBinaryPathName',WSTR), 

777 ('lpLoadOrderGroup',LPWSTR), 

778 ('lpdwTagId',LPDWORD), 

779 ('lpDependencies',LPBYTE), 

780 ('dwDependSize',DWORD), 

781 ('lpServiceStartName',LPWSTR), 

782 ('lpPassword',LPBYTE), 

783 ('dwPwSize',DWORD), 

784 ) 

785 

786class RCreateServiceWResponse(NDRCALL): 

787 structure = ( 

788 ('lpdwTagId',LPWSTR), 

789 ('lpServiceHandle',SC_RPC_HANDLE), 

790 ('ErrorCode', DWORD), 

791 ) 

792 

793class REnumDependentServicesW(NDRCALL): 

794 opnum = 13 

795 structure = ( 

796 ('hService',SC_RPC_HANDLE), 

797 ('dwServiceState',DWORD), 

798 ('cbBufSize',DWORD), 

799 ) 

800 

801class REnumDependentServicesWResponse(NDRCALL): 

802 structure = ( 

803 ('lpServices',NDRUniConformantArray), 

804 ('pcbBytesNeeded',BOUNDED_DWORD_256K), 

805 ('lpServicesReturned',BOUNDED_DWORD_256K), 

806 ('ErrorCode', DWORD), 

807 ) 

808 

809class REnumServicesStatusW(NDRCALL): 

810 opnum = 14 

811 structure = ( 

812 ('hSCManager',SC_RPC_HANDLE), 

813 ('dwServiceType',DWORD), 

814 ('dwServiceState',DWORD), 

815 ('cbBufSize',DWORD), 

816 ('lpResumeIndex',LPBOUNDED_DWORD_256K), 

817 ) 

818 

819class REnumServicesStatusWResponse(NDRCALL): 

820 structure = ( 

821 ('lpBuffer',NDRUniConformantArray), 

822 ('pcbBytesNeeded',BOUNDED_DWORD_256K), 

823 ('lpServicesReturned',BOUNDED_DWORD_256K), 

824 ('lpResumeIndex',LPBOUNDED_DWORD_256K), 

825 ('ErrorCode', DWORD), 

826 ) 

827 

828class ROpenSCManagerW(NDRCALL): 

829 opnum = 15 

830 structure = ( 

831 ('lpMachineName',SVCCTL_HANDLEW), 

832 ('lpDatabaseName',LPWSTR), 

833 ('dwDesiredAccess',DWORD), 

834 ) 

835 

836class ROpenSCManagerWResponse(NDRCALL): 

837 structure = ( 

838 ('lpScHandle',SC_RPC_HANDLE), 

839 ('ErrorCode', DWORD), 

840 ) 

841 

842class ROpenServiceW(NDRCALL): 

843 opnum = 16 

844 structure = ( 

845 ('hSCManager',SC_RPC_HANDLE), 

846 ('lpServiceName',WSTR), 

847 ('dwDesiredAccess',DWORD), 

848 ) 

849 

850class ROpenServiceWResponse(NDRCALL): 

851 structure = ( 

852 ('lpServiceHandle',SC_RPC_HANDLE), 

853 ('ErrorCode', DWORD), 

854 ) 

855 

856class RQueryServiceConfigW(NDRCALL): 

857 opnum = 17 

858 structure = ( 

859 ('hService',SC_RPC_HANDLE), 

860 ('cbBufSize',DWORD), 

861 ) 

862 

863class RQueryServiceConfigWResponse(NDRCALL): 

864 structure = ( 

865 ('lpServiceConfig',QUERY_SERVICE_CONFIGW), 

866 ('pcbBytesNeeded',BOUNDED_DWORD_8K), 

867 ('ErrorCode', DWORD), 

868 ) 

869 

870class RQueryServiceLockStatusW(NDRCALL): 

871 opnum = 18 

872 structure = ( 

873 ('hSCManager',SC_RPC_HANDLE), 

874 ('cbBufSize',DWORD), 

875 ) 

876 

877class RQueryServiceLockStatusWResponse(NDRCALL): 

878 structure = ( 

879 ('lpLockStatus',QUERY_SERVICE_LOCK_STATUSW), 

880 ('pcbBytesNeeded',BOUNDED_DWORD_4K), 

881 ('ErrorCode', DWORD), 

882 ) 

883 

884class RStartServiceW(NDRCALL): 

885 opnum = 19 

886 structure = ( 

887 ('hService',SC_RPC_HANDLE), 

888 ('argc',DWORD), 

889 ('argv',UNIQUE_STRING_PTRSW), 

890 ) 

891 

892class RStartServiceWResponse(NDRCALL): 

893 structure = ( 

894 ('ErrorCode', DWORD), 

895 ) 

896 

897class RGetServiceDisplayNameW(NDRCALL): 

898 opnum = 20 

899 structure = ( 

900 ('hSCManager',SC_RPC_HANDLE), 

901 ('lpServiceName',WSTR), 

902 ('lpcchBuffer',DWORD), 

903 ) 

904 

905class RGetServiceDisplayNameWResponse(NDRCALL): 

906 structure = ( 

907 ('lpDisplayName',WSTR), 

908 ('lpcchBuffer',DWORD), 

909 ('ErrorCode', DWORD), 

910 ) 

911 

912class RGetServiceKeyNameW(NDRCALL): 

913 opnum = 21 

914 structure = ( 

915 ('hSCManager',SC_RPC_HANDLE), 

916 ('lpDisplayName',WSTR), 

917 ('lpcchBuffer',DWORD), 

918 ) 

919 

920class RGetServiceKeyNameWResponse(NDRCALL): 

921 structure = ( 

922 ('lpDisplayName',WSTR), 

923 ('lpcchBuffer',DWORD), 

924 ('ErrorCode', DWORD), 

925 ) 

926 

927class REnumServiceGroupW(NDRCALL): 

928 opnum = 35 

929 structure = ( 

930 ('hSCManager',SC_RPC_HANDLE), 

931 ('dwServiceType',DWORD), 

932 ('dwServiceState',DWORD), 

933 ('cbBufSize',DWORD), 

934 ('lpResumeIndex',LPBOUNDED_DWORD_256K), 

935 ('pszGroupName',LPWSTR), 

936 ) 

937 

938class REnumServiceGroupWResponse(NDRCALL): 

939 structure = ( 

940 ('lpBuffer',LPBYTE), 

941 ('pcbBytesNeeded',BOUNDED_DWORD_256K), 

942 ('lpServicesReturned',BOUNDED_DWORD_256K), 

943 ('lpResumeIndex',BOUNDED_DWORD_256K), 

944 ('ErrorCode', DWORD), 

945 ) 

946 

947class RChangeServiceConfig2W(NDRCALL): 

948 opnum = 37 

949 structure = ( 

950 ('hService',SC_RPC_HANDLE), 

951 ('Info',SC_RPC_CONFIG_INFOW), 

952 ) 

953 

954class RChangeServiceConfig2WResponse(NDRCALL): 

955 structure = ( 

956 ('ErrorCode', DWORD), 

957 ) 

958 

959class RQueryServiceConfig2W(NDRCALL): 

960 opnum = 39 

961 structure = ( 

962 ('hService',SC_RPC_HANDLE), 

963 ('dwInfoLevel',DWORD), 

964 ('cbBufSize',DWORD), 

965 ) 

966 

967class RQueryServiceConfig2WResponse(NDRCALL): 

968 structure = ( 

969 ('lpBuffer',NDRUniConformantArray), 

970 ('pcbBytesNeeded',BOUNDED_DWORD_8K), 

971 ('ErrorCode', DWORD), 

972 ) 

973 

974class RQueryServiceStatusEx(NDRCALL): 

975 opnum = 40 

976 structure = ( 

977 ('hService',SC_RPC_HANDLE), 

978 ('InfoLevel',DWORD), 

979 ('cbBufSize',DWORD), 

980 ) 

981 

982class RQueryServiceStatusExResponse(NDRCALL): 

983 structure = ( 

984 ('lpBuffer',NDRUniConformantArray), 

985 ('pcbBytesNeeded',BOUNDED_DWORD_8K), 

986 ('ErrorCode', DWORD), 

987 ) 

988 

989class REnumServicesStatusExW(NDRCALL): 

990 opnum = 42 

991 structure = ( 

992 ('hSCManager',SC_RPC_HANDLE), 

993 ('InfoLevel',DWORD), 

994 ('dwServiceType',DWORD), 

995 ('dwServiceState',DWORD), 

996 ('cbBufSize',DWORD), 

997 ('lpResumeIndex',LPBOUNDED_DWORD_256K), 

998 ('pszGroupName',LPWSTR), 

999 ) 

1000 

1001class REnumServicesStatusExWResponse(NDRCALL): 

1002 structure = ( 

1003 ('lpBuffer',NDRUniConformantArray), 

1004 ('pcbBytesNeeded',BOUNDED_DWORD_256K), 

1005 ('lpServicesReturned',BOUNDED_DWORD_256K), 

1006 ('lpResumeIndex',BOUNDED_DWORD_256K), 

1007 ('ErrorCode', DWORD), 

1008 ) 

1009 

1010class RCreateServiceWOW64W(NDRCALL): 

1011 opnum = 45 

1012 structure = ( 

1013 ('hSCManager',SC_RPC_HANDLE), 

1014 ('lpServiceName',WSTR), 

1015 ('lpDisplayName',LPWSTR), 

1016 ('dwDesiredAccess',DWORD), 

1017 ('dwServiceType',DWORD), 

1018 ('dwStartType',DWORD), 

1019 ('dwErrorControl',DWORD), 

1020 ('lpBinaryPathName',WSTR), 

1021 ('lpLoadOrderGroup',LPWSTR), 

1022 ('lpdwTagId',LPDWORD), 

1023 ('lpDependencies',LPBYTE), 

1024 ('dwDependSize',DWORD), 

1025 ('lpServiceStartName',LPWSTR), 

1026 ('lpPassword',LPBYTE), 

1027 ('dwPwSize',DWORD), 

1028 ) 

1029 

1030class RCreateServiceWOW64WResponse(NDRCALL): 

1031 structure = ( 

1032 ('lpdwTagId',LPWSTR), 

1033 ('lpServiceHandle',SC_RPC_HANDLE), 

1034 ('ErrorCode', DWORD), 

1035 ) 

1036 

1037# Still not working, for some reason something changes in the way the pointer inside SC_RPC_NOTIFY_PARAMS is marshalled here 

1038class RNotifyServiceStatusChange(NDRCALL): 

1039 opnum = 47 

1040 structure = ( 

1041 ('hService',SC_RPC_HANDLE), 

1042 ('NotifyParams',SC_RPC_NOTIFY_PARAMS), 

1043 ('pClientProcessGuid',GUID), 

1044 ) 

1045 

1046class RNotifyServiceStatusChangeResponse(NDRCALL): 

1047 structure = ( 

1048 ('pSCMProcessGuid',GUID), 

1049 ('pfCreateRemoteQueue',PBOOL), 

1050 ('phNotify',SC_NOTIFY_RPC_HANDLE), 

1051 ('ErrorCode', DWORD), 

1052 ) 

1053 

1054# Not working, until I don't fix the previous one 

1055class RGetNotifyResults(NDRCALL): 

1056 opnum = 48 

1057 structure = ( 

1058 ('hNotify',SC_NOTIFY_RPC_HANDLE), 

1059 ) 

1060 

1061class RGetNotifyResultsResponse(NDRCALL): 

1062 structure = ( 

1063 ('ppNotifyParams',PSC_RPC_NOTIFY_PARAMS_LIST), 

1064 ('ErrorCode', DWORD), 

1065 ) 

1066 

1067# Not working, until I don't fix the previous ones 

1068class RCloseNotifyHandle(NDRCALL): 

1069 opnum = 49 

1070 structure = ( 

1071 ('phNotify',SC_NOTIFY_RPC_HANDLE), 

1072 ) 

1073 

1074class RCloseNotifyHandleResponse(NDRCALL): 

1075 structure = ( 

1076 ('phNotify',SC_NOTIFY_RPC_HANDLE), 

1077 ('pfApcFired',PBOOL), 

1078 ('ErrorCode', DWORD), 

1079 ) 

1080 

1081# Not working, returning bad_stub_data 

1082class RControlServiceExW(NDRCALL): 

1083 opnum = 51 

1084 structure = ( 

1085 ('hService',SC_RPC_HANDLE), 

1086 ('dwControl',DWORD), 

1087 ('dwInfoLevel',DWORD), 

1088 ('pControlInParams',SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW), 

1089 ) 

1090 

1091class RControlServiceExWResponse(NDRCALL): 

1092 structure = ( 

1093 ('pControlOutParams',SERVICE_CONTROL_STATUS_REASON_OUT_PARAMS), 

1094 ('ErrorCode', DWORD), 

1095 ) 

1096 

1097class RQueryServiceConfigEx(NDRCALL): 

1098 opnum = 56 

1099 structure = ( 

1100 ('hService',SC_RPC_HANDLE), 

1101 ('dwInfoLevel',DWORD), 

1102 ) 

1103 

1104class RQueryServiceConfigExResponse(NDRCALL): 

1105 structure = ( 

1106 ('pInfo',SC_RPC_CONFIG_INFOW), 

1107 ('ErrorCode', DWORD), 

1108 ) 

1109 

1110################################################################################ 

1111# OPNUMs and their corresponding structures 

1112################################################################################ 

1113OPNUMS = { 

1114 0 : (RCloseServiceHandle, RCloseServiceHandleResponse), 

1115 1 : (RControlService, RControlServiceResponse), 

1116 2 : (RDeleteService, RDeleteServiceResponse), 

1117 3 : (RLockServiceDatabase, RLockServiceDatabaseResponse), 

1118 4 : (RQueryServiceObjectSecurity, RQueryServiceObjectSecurityResponse), 

1119 5 : (RSetServiceObjectSecurity, RSetServiceObjectSecurityResponse), 

1120 6 : (RQueryServiceStatus, RQueryServiceStatusResponse), 

1121 7 : (RSetServiceStatus, RSetServiceStatusResponse), 

1122 8 : (RUnlockServiceDatabase, RUnlockServiceDatabaseResponse), 

1123 9 : (RNotifyBootConfigStatus, RNotifyBootConfigStatusResponse), 

112411 : (RChangeServiceConfigW, RChangeServiceConfigWResponse), 

112512 : (RCreateServiceW, RCreateServiceWResponse), 

112613 : (REnumDependentServicesW, REnumDependentServicesWResponse), 

112714 : (REnumServicesStatusW, REnumServicesStatusWResponse), 

112815 : (ROpenSCManagerW, ROpenSCManagerWResponse), 

112916 : (ROpenServiceW, ROpenServiceWResponse), 

113017 : (RQueryServiceConfigW, RQueryServiceConfigWResponse), 

113118 : (RQueryServiceLockStatusW, RQueryServiceLockStatusWResponse), 

113219 : (RStartServiceW, RStartServiceWResponse), 

113320 : (RGetServiceDisplayNameW, RGetServiceDisplayNameWResponse), 

113421 : (RGetServiceKeyNameW, RGetServiceKeyNameWResponse), 

113535 : (REnumServiceGroupW, REnumServiceGroupWResponse), 

113637 : (RChangeServiceConfig2W, RChangeServiceConfig2WResponse), 

113739 : (RQueryServiceConfig2W, RQueryServiceConfig2WResponse), 

113840 : (RQueryServiceStatusEx, RQueryServiceStatusExResponse), 

113942 : (REnumServicesStatusExW, REnumServicesStatusExWResponse), 

114045 : (RCreateServiceWOW64W, RCreateServiceWOW64WResponse), 

114147 : (RNotifyServiceStatusChange, RNotifyServiceStatusChangeResponse), 

114248 : (RGetNotifyResults, RGetNotifyResultsResponse), 

114349 : (RCloseNotifyHandle, RCloseNotifyHandleResponse), 

114451 : (RControlServiceExW, RControlServiceExWResponse), 

114556 : (RQueryServiceConfigEx, RQueryServiceConfigExResponse), 

1146} 

1147 

1148################################################################################ 

1149# HELPER FUNCTIONS 

1150################################################################################ 

1151def checkNullString(string): 

1152 if string == NULL: 

1153 return string 

1154 

1155 if string[-1:] != '\x00': 

1156 return string + '\x00' 

1157 else: 

1158 return string 

1159 

1160def hRCloseServiceHandle(dce, hSCObject): 

1161 request = RCloseServiceHandle() 

1162 request['hSCObject'] = hSCObject 

1163 return dce.request(request) 

1164 

1165def hRControlService(dce, hService, dwControl): 

1166 request = RControlService() 

1167 request['hService'] = hService 

1168 request['dwControl'] = dwControl 

1169 return dce.request(request) 

1170 

1171def hRDeleteService(dce, hService): 

1172 request = RDeleteService() 

1173 request ['hService'] = hService 

1174 return dce.request(request) 

1175 

1176def hRLockServiceDatabase(dce, hSCManager): 

1177 request = RLockServiceDatabase() 

1178 request['hSCManager'] = hSCManager 

1179 return dce.request(request) 

1180 

1181 

1182def hRQueryServiceObjectSecurity(dce, hService, dwSecurityInformation, cbBufSize=0): 

1183 request = RQueryServiceObjectSecurity() 

1184 request['hService'] = hService 

1185 request['dwSecurityInformation'] = dwSecurityInformation 

1186 request['cbBufSize'] = cbBufSize 

1187 try: 

1188 resp = dce.request(request) 

1189 except DCERPCSessionError as e: 

1190 if e.get_error_code() == system_errors.ERROR_INSUFFICIENT_BUFFER: 

1191 resp = e.get_packet() 

1192 request['cbBufSize'] = resp['pcbBytesNeeded'] 

1193 resp = dce.request(request) 

1194 else: 

1195 raise 

1196 return resp 

1197 

1198def hRSetServiceObjectSecurity(dce, hService, dwSecurityInformation, lpSecurityDescriptor, cbBufSize ): 

1199 request = RSetServiceObjectSecurity() 

1200 request['hService'] = hService 

1201 request['dwSecurityInformation'] = dwSecurityInformation 

1202 request['cbBufSize'] = cbBufSize 

1203 return dce.request(request) 

1204 

1205def hRQueryServiceStatus(dce, hService ): 

1206 request = RQueryServiceStatus() 

1207 request['hService'] = hService 

1208 return dce.request(request) 

1209 

1210def hRSetServiceStatus(dce, hServiceStatus, lpServiceStatus ): 

1211 request = RSetServiceStatus() 

1212 request['hServiceStatus'] = hServiceStatus 

1213 request['lpServiceStatus'] = lpServiceStatus 

1214 return dce.request(request) 

1215 

1216def hRUnlockServiceDatabase(dce, Lock ): 

1217 request = RUnlockServiceDatabase() 

1218 request['Lock'] = Lock 

1219 return dce.request(request) 

1220 

1221def hRNotifyBootConfigStatus(dce, lpMachineName, BootAcceptable ): 

1222 request = RNotifyBootConfigStatus() 

1223 request['lpMachineName'] = lpMachineName 

1224 request['BootAcceptable'] = BootAcceptable 

1225 return dce.request(request) 

1226 

1227def hRChangeServiceConfigW(dce, hService, dwServiceType=SERVICE_NO_CHANGE, dwStartType=SERVICE_NO_CHANGE, dwErrorControl=SERVICE_NO_CHANGE, lpBinaryPathName=NULL, lpLoadOrderGroup=NULL, lpdwTagId=NULL, lpDependencies=NULL, dwDependSize=0, lpServiceStartName=NULL, lpPassword=NULL, dwPwSize=0, lpDisplayName=NULL): 

1228 changeServiceConfig = RChangeServiceConfigW() 

1229 changeServiceConfig['hService'] = hService 

1230 changeServiceConfig['dwServiceType'] = dwServiceType 

1231 changeServiceConfig['dwStartType'] = dwStartType 

1232 changeServiceConfig['dwErrorControl'] = dwErrorControl 

1233 changeServiceConfig['lpBinaryPathName'] = checkNullString(lpBinaryPathName) 

1234 changeServiceConfig['lpLoadOrderGroup'] = checkNullString(lpLoadOrderGroup) 

1235 changeServiceConfig['lpdwTagId'] = lpdwTagId 

1236 changeServiceConfig['lpDependencies'] = lpDependencies 

1237 # Strings MUST be NULL terminated for lpDependencies 

1238 changeServiceConfig['dwDependSize'] = dwDependSize 

1239 changeServiceConfig['lpServiceStartName'] = checkNullString(lpServiceStartName) 

1240 changeServiceConfig['lpPassword'] = lpPassword 

1241 changeServiceConfig['dwPwSize'] = dwPwSize 

1242 changeServiceConfig['lpDisplayName'] = checkNullString(lpDisplayName) 

1243 return dce.request(changeServiceConfig) 

1244 

1245def hRCreateServiceW(dce, hSCManager, lpServiceName, lpDisplayName, dwDesiredAccess=SERVICE_ALL_ACCESS, dwServiceType=SERVICE_WIN32_OWN_PROCESS, dwStartType=SERVICE_AUTO_START, dwErrorControl=SERVICE_ERROR_IGNORE, lpBinaryPathName=NULL, lpLoadOrderGroup=NULL, lpdwTagId=NULL, lpDependencies=NULL, dwDependSize=0, lpServiceStartName=NULL, lpPassword=NULL, dwPwSize=0): 

1246 createService = RCreateServiceW() 

1247 createService['hSCManager'] = hSCManager 

1248 createService['lpServiceName'] = checkNullString(lpServiceName) 

1249 createService['lpDisplayName'] = checkNullString(lpDisplayName) 

1250 createService['dwDesiredAccess'] = dwDesiredAccess 

1251 createService['dwServiceType'] = dwServiceType 

1252 createService['dwStartType'] = dwStartType 

1253 createService['dwErrorControl'] = dwErrorControl 

1254 createService['lpBinaryPathName'] = checkNullString(lpBinaryPathName) 

1255 createService['lpLoadOrderGroup'] = checkNullString(lpLoadOrderGroup) 

1256 createService['lpdwTagId'] = lpdwTagId 

1257 # Strings MUST be NULL terminated for lpDependencies 

1258 createService['lpDependencies'] = lpDependencies 

1259 createService['dwDependSize'] = dwDependSize 

1260 createService['lpServiceStartName'] = checkNullString(lpServiceStartName) 

1261 createService['lpPassword'] = lpPassword 

1262 createService['dwPwSize'] = dwPwSize 

1263 return dce.request(createService) 

1264 

1265def hREnumDependentServicesW(dce, hService, dwServiceState, cbBufSize ): 

1266 enumDependentServices = REnumDependentServicesW() 

1267 enumDependentServices['hService'] = hService 

1268 enumDependentServices['dwServiceState'] = dwServiceState 

1269 enumDependentServices['cbBufSize'] = cbBufSize 

1270 return dce.request(enumDependentServices) 

1271 

1272def hREnumServicesStatusW(dce, hSCManager, dwServiceType=SERVICE_WIN32_OWN_PROCESS|SERVICE_KERNEL_DRIVER|SERVICE_FILE_SYSTEM_DRIVER|SERVICE_WIN32_SHARE_PROCESS|SERVICE_INTERACTIVE_PROCESS, dwServiceState=SERVICE_STATE_ALL): 

1273 class ENUM_SERVICE_STATUSW2(NDRSTRUCT): 

1274 # This is a little trick, since the original structure is slightly different 

1275 # but instead of parsing the LPBYTE buffer at hand, we just do it with the aid 

1276 # of the NDR library, although the pointers are swapped from the original specification. 

1277 # Why is this? Well.. since we're getting an LPBYTE back, it's just a copy of the remote's memory 

1278 # where the pointers are actually POINTING to the data. 

1279 # Sadly, the pointers are not aligned based on the services records, so we gotta do this 

1280 # It should be easier in C of course. 

1281 class STR(NDRPOINTER): 

1282 referent = ( 

1283 ('Data', WIDESTR), 

1284 ) 

1285 structure = ( 

1286 ('lpServiceName',STR), 

1287 ('lpDisplayName',STR), 

1288 ('ServiceStatus',SERVICE_STATUS), 

1289 ) 

1290 

1291 enumServicesStatus = REnumServicesStatusW() 

1292 enumServicesStatus['hSCManager'] = hSCManager 

1293 enumServicesStatus['dwServiceType'] = dwServiceType 

1294 enumServicesStatus['dwServiceState'] = dwServiceState 

1295 enumServicesStatus['cbBufSize'] = 0 

1296 enumServicesStatus['lpResumeIndex'] = NULL 

1297 

1298 try: 

1299 resp = dce.request(enumServicesStatus) 

1300 except DCERPCSessionError as e: 

1301 if e.get_error_code() == system_errors.ERROR_MORE_DATA: 1301 ↛ 1306line 1301 didn't jump to line 1306, because the condition on line 1301 was never false

1302 resp = e.get_packet() 

1303 enumServicesStatus['cbBufSize'] = resp['pcbBytesNeeded'] 

1304 resp = dce.request(enumServicesStatus) 

1305 else: 

1306 raise 

1307 

1308 # Now we're supposed to have all services returned. Now we gotta parse them 

1309 

1310 enumArray = NDRUniConformantArray() 

1311 enumArray.item = ENUM_SERVICE_STATUSW2 

1312 

1313 enumArray.setArraySize(resp['lpServicesReturned']) 

1314 

1315 data = b''.join(resp['lpBuffer']) 

1316 enumArray.fromString(data) 

1317 data = data[4:] 

1318 # Since the pointers here are pointing to the actual data, we have to reparse 

1319 # the referents 

1320 for record in enumArray['Data']: 

1321 offset = record.fields['lpDisplayName'].fields['ReferentID']-4 

1322 name = WIDESTR(data[offset:]) 

1323 record['lpDisplayName'] = name['Data'] 

1324 offset = record.fields['lpServiceName'].fields['ReferentID']-4 

1325 name = WIDESTR(data[offset:]) 

1326 record['lpServiceName'] = name['Data'] 

1327 

1328 return enumArray['Data'] 

1329 

1330def hROpenSCManagerW(dce, lpMachineName='DUMMY\x00', lpDatabaseName='ServicesActive\x00', dwDesiredAccess=SERVICE_START | SERVICE_STOP | SERVICE_CHANGE_CONFIG | SERVICE_QUERY_CONFIG | SERVICE_QUERY_STATUS | SERVICE_ENUMERATE_DEPENDENTS | SC_MANAGER_ENUMERATE_SERVICE): 

1331 openSCManager = ROpenSCManagerW() 

1332 openSCManager['lpMachineName'] = checkNullString(lpMachineName) 

1333 openSCManager['lpDatabaseName'] = checkNullString(lpDatabaseName) 

1334 openSCManager['dwDesiredAccess'] = dwDesiredAccess 

1335 return dce.request(openSCManager) 

1336 

1337def hROpenServiceW(dce, hSCManager, lpServiceName, dwDesiredAccess= SERVICE_ALL_ACCESS): 

1338 openService = ROpenServiceW() 

1339 openService['hSCManager'] = hSCManager 

1340 openService['lpServiceName'] = checkNullString(lpServiceName) 

1341 openService['dwDesiredAccess'] = dwDesiredAccess 

1342 return dce.request(openService) 

1343 

1344def hRQueryServiceConfigW(dce, hService): 

1345 queryService = RQueryServiceConfigW() 

1346 queryService['hService'] = hService 

1347 queryService['cbBufSize'] = 0 

1348 try: 

1349 resp = dce.request(queryService) 

1350 except DCERPCSessionError as e: 

1351 if e.get_error_code() == system_errors.ERROR_INSUFFICIENT_BUFFER: 1351 ↛ 1356line 1351 didn't jump to line 1356, because the condition on line 1351 was never false

1352 resp = e.get_packet() 

1353 queryService['cbBufSize'] = resp['pcbBytesNeeded'] 

1354 resp = dce.request(queryService) 

1355 else: 

1356 raise 

1357 

1358 return resp 

1359 

1360def hRQueryServiceLockStatusW(dce, hSCManager, cbBufSize ): 

1361 queryServiceLock = RQueryServiceLockStatusW() 

1362 queryServiceLock['hSCManager'] = hSCManager 

1363 queryServiceLock['cbBufSize'] = cbBufSize 

1364 return dce.request(queryServiceLock) 

1365 

1366def hRStartServiceW(dce, hService, argc=0, argv=NULL ): 

1367 startService = RStartServiceW() 

1368 startService['hService'] = hService 

1369 startService['argc'] = argc 

1370 if argc == 0: 

1371 startService['argv'] = NULL 

1372 else: 

1373 for item in argv: 

1374 itemn = LPWSTR() 

1375 itemn['Data'] = checkNullString(item) 

1376 startService['argv'].append(itemn) 

1377 return dce.request(startService) 

1378 

1379def hRGetServiceDisplayNameW(dce, hSCManager, lpServiceName, lpcchBuffer ): 

1380 getServiceDisplay = RGetServiceDisplayNameW() 

1381 getServiceDisplay['hSCManager'] = hSCManager 

1382 getServiceDisplay['lpServiceName'] = checkNullString(lpServiceName) 

1383 getServiceDisplay['lpcchBuffer'] = lpcchBuffer 

1384 return dce.request(getServiceDisplay) 

1385 

1386def hRGetServiceKeyNameW(dce, hSCManager, lpDisplayName, lpcchBuffer ): 

1387 getServiceKeyName = RGetServiceKeyNameW() 

1388 getServiceKeyName['hSCManager'] = hSCManager 

1389 getServiceKeyName['lpDisplayName'] = checkNullString(lpDisplayName) 

1390 getServiceKeyName['lpcchBuffer'] = lpcchBuffer 

1391 return dce.request(getServiceKeyName) 

1392 

1393def hREnumServiceGroupW(dce, hSCManager, dwServiceType, dwServiceState, cbBufSize, lpResumeIndex = NULL, pszGroupName = NULL ): 

1394 enumServiceGroup = REnumServiceGroupW() 

1395 enumServiceGroup['hSCManager'] = hSCManager 

1396 enumServiceGroup['dwServiceType'] = dwServiceType 

1397 enumServiceGroup['dwServiceState'] = dwServiceState 

1398 enumServiceGroup['cbBufSize'] = cbBufSize 

1399 enumServiceGroup['lpResumeIndex'] = lpResumeIndex 

1400 enumServiceGroup['pszGroupName'] = pszGroupName 

1401 return dce.request(enumServiceGroup)