smb_packets.h 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551
  1. /*****************************************************************************
  2. * __________________ _________ _____ _____ .__ ._.
  3. * \______ \______ \ / _____/ / \ / _ \ |__| ____ | |
  4. * | | _/| | \ \_____ \ / \ / \ / /_\ \| _/ __ \ | |
  5. * | | \| ` \/ / Y \ / | | \ ___/ \|
  6. * |______ /_______ /_______ \____|__ / /\ \____|__ |__|\___ | __
  7. * \/ \/ \/ \/ )/ \/ \/ \/
  8. *
  9. * This file is part of liBDSM. Copyright © 2014-2015 VideoLabs SAS
  10. *
  11. * Author: Julien 'Lta' BALLET <contact@lta.io>
  12. *
  13. * liBDSM is released under LGPLv2.1 (or later) and is also available
  14. * under a commercial license.
  15. *****************************************************************************
  16. * This program is free software; you can redistribute it and/or modify it
  17. * under the terms of the GNU Lesser General Public License as published by
  18. * the Free Software Foundation; either version 2.1 of the License, or
  19. * (at your option) any later version.
  20. *
  21. * This program is distributed in the hope that it will be useful,
  22. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  23. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  24. * GNU Lesser General Public License for more details.
  25. *
  26. * You should have received a copy of the GNU Lesser General Public License
  27. * along with this program; if not, write to the Free Software Foundation,
  28. * Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301, USA.
  29. *****************************************************************************/
  30. #ifndef _SMB_PACKETS_H_
  31. #define _SMB_PACKETS_H_
  32. #include <stdint.h>
  33. #include "bdsm_common.h"
  34. #define SMB_ANDX_MEMBERS \
  35. uint8_t andx; /* 0xff when no other command (do this :)*/ \
  36. uint8_t andx_reserved; /* 0x00 */ \
  37. uint16_t andx_offset; /* 0x00 when no other command */
  38. ////////////////////////////////////////////////////////////////////////////////
  39. // Main structures for holding packet data and building packets
  40. typedef struct
  41. {
  42. uint8_t magic[4]; // { 0xff, 0x53, 0x4d, 0x42 } "\xffSMB"
  43. uint8_t command; // The actual SMB command
  44. uint32_t status; // 'NT Status'
  45. uint8_t flags; // Packet flags
  46. uint16_t flags2; // More flags ? (lol)
  47. uint16_t pid_high; // Unused ?
  48. uint64_t signature; // Unused ?
  49. uint16_t reserved; // More usuned bit (we have so much BW :)
  50. uint16_t tid; // A kind of fd for share. (tree_connect)
  51. uint16_t pid; // Process ID.
  52. uint16_t uid; // User ID.
  53. uint16_t mux_id; // Multiplex ID. Increment it sometimes.
  54. } SMB_PACKED_STRUCT smb_header;
  55. typedef struct
  56. {
  57. smb_header header; // A packet header full of gorgeous goodness.
  58. uint8_t payload[]; // Ze yummy data inside. Eat 5 fruits/day !
  59. } SMB_PACKED_STRUCT smb_packet;
  60. ////////////////////////////////////////////////////////////////////////////////
  61. // Individual SMB command payload description
  62. // Simple structure used for several requests/responses
  63. typedef struct
  64. {
  65. uint8_t wct; // 0
  66. uint16_t bct;
  67. } SMB_PACKED_STRUCT smb_simple_struct;
  68. //-> Negotiate Protocol
  69. typedef struct
  70. {
  71. uint8_t wct; // zero
  72. uint16_t bct;
  73. char dialects[];
  74. } SMB_PACKED_STRUCT smb_nego_req;
  75. #define SMB_NEGO_RESP_COMMON \
  76. uint8_t wct; /* +-17 :) */ \
  77. uint16_t dialect_index; \
  78. uint8_t security_mode; /* Share/User. Plaintext/Challenge */ \
  79. uint32_t diplodocus; \
  80. uint32_t max_bufsize; /* Max buffer size requested by server. */ \
  81. uint32_t max_rawbuffer; /* Max raw buffer size requested by serv. */ \
  82. uint32_t session_key; /* 'MUST' be returned to server */ \
  83. uint32_t caps; \
  84. uint64_t ts; /* I don't give a fuck (or do i?) */ \
  85. uint16_t tz; /* Even less fuck given */ \
  86. uint8_t key_length; /* Size of challenge key // GSS blob */ \
  87. uint16_t bct;
  88. //<- Negotiate Protocol
  89. typedef struct
  90. {
  91. SMB_NEGO_RESP_COMMON
  92. uint64_t challenge; // Normally 8 bytes, if not then wtf monkey
  93. uint8_t payload[]; // The rest isn't really meaningfull for us
  94. } SMB_PACKED_STRUCT smb_nego_resp;
  95. //<- Negotiate Protocol
  96. typedef struct
  97. {
  98. SMB_NEGO_RESP_COMMON
  99. uint8_t srv_guid[16];
  100. uint8_t gssapi[];
  101. } SMB_PACKED_STRUCT smb_nego_xsec_resp;
  102. #define SMB_SESSION_REQ_COMMON \
  103. uint8_t wct; /* +-13 :) */ \
  104. SMB_ANDX_MEMBERS \
  105. uint16_t max_buffer; /* Maximum size we can receive */ \
  106. uint16_t mpx_count; /* maximum multiplexed session */ \
  107. uint16_t vc_count; /* Virtual ciruits -> 1! */ \
  108. uint32_t session_key; /* 0x00000000 */
  109. //-> Session Setup
  110. typedef struct
  111. {
  112. SMB_SESSION_REQ_COMMON
  113. uint16_t oem_pass_len; // Length of LM2 response
  114. uint16_t uni_pass_len; // Length of NTLM2 response
  115. uint32_t reserved2; // 0x00000000
  116. uint32_t caps; // Capabilities
  117. uint16_t payload_size;
  118. uint8_t payload[];
  119. } SMB_PACKED_STRUCT smb_session_req;
  120. //-> Session Setup
  121. typedef struct
  122. {
  123. SMB_SESSION_REQ_COMMON
  124. uint16_t xsec_blob_size; // Length of GSSAPI/SPNEGO blob
  125. uint32_t reserved2; // 0x00000000
  126. uint32_t caps; // Capabilities
  127. uint16_t payload_size;
  128. uint8_t payload[];
  129. } SMB_PACKED_STRUCT smb_session_xsec_req;
  130. //<- Session Setup
  131. typedef struct
  132. {
  133. uint8_t wct;
  134. SMB_ANDX_MEMBERS
  135. uint16_t action;
  136. uint16_t bct;
  137. uint8_t bullshit[];
  138. } SMB_PACKED_STRUCT smb_session_resp;
  139. typedef struct
  140. {
  141. uint8_t wct;
  142. SMB_ANDX_MEMBERS
  143. uint16_t action;
  144. uint16_t xsec_blob_size;
  145. uint16_t payload_size;
  146. uint8_t payload[];
  147. } SMB_PACKED_STRUCT smb_session_xsec_resp;
  148. //-> Tree Connect
  149. typedef struct
  150. {
  151. uint8_t wct; // 4
  152. SMB_ANDX_MEMBERS
  153. uint16_t flags;
  154. uint16_t passwd_len; // 1 if not used. Used in Share Level Auth
  155. uint16_t bct;
  156. uint8_t payload[]; // Password | Path | Service
  157. } SMB_PACKED_STRUCT smb_tree_connect_req;
  158. //<- Tree Connect
  159. typedef struct
  160. {
  161. uint8_t wct; // 7
  162. SMB_ANDX_MEMBERS
  163. uint16_t opt_support;
  164. uint32_t max_rights;
  165. uint32_t guest_rights;
  166. uint16_t bct;
  167. uint8_t payload[];
  168. } SMB_PACKED_STRUCT smb_tree_connect_resp;
  169. //-> Tree Disconnect / <- Tree Disconnect
  170. typedef smb_simple_struct smb_tree_disconnect_req;
  171. typedef smb_simple_struct smb_tree_disconnect_resp;
  172. //-> Create File
  173. typedef struct
  174. {
  175. uint8_t wct; // 24
  176. SMB_ANDX_MEMBERS
  177. uint8_t reserved2;
  178. uint16_t path_length;
  179. uint32_t flags;
  180. uint32_t root_fid;
  181. uint32_t access_mask;
  182. uint64_t alloc_size;
  183. uint32_t file_attr;
  184. uint32_t share_access;
  185. uint32_t disposition;
  186. uint32_t create_opts;
  187. uint32_t impersonation;
  188. uint8_t security_flags;
  189. uint16_t bct;
  190. uint8_t path[]; // UTF16 Path, starting with '\'
  191. } SMB_PACKED_STRUCT smb_create_req;
  192. //<- Create File
  193. typedef struct
  194. {
  195. uint8_t wct; // 34
  196. SMB_ANDX_MEMBERS
  197. uint8_t oplock_level;
  198. uint16_t fid;
  199. uint32_t action;
  200. uint64_t created; // File creation time
  201. uint64_t accessed; // File last access time
  202. uint64_t written; // File last write time
  203. uint64_t changed; // File last modification time
  204. uint32_t attr;
  205. uint64_t alloc_size;
  206. uint64_t size;
  207. uint16_t filetype;
  208. uint16_t ipc_state;
  209. uint8_t is_dir;
  210. uint16_t bct; // 0
  211. } SMB_PACKED_STRUCT smb_create_resp;
  212. //-> Close File
  213. typedef struct
  214. {
  215. uint8_t wct; // 3
  216. uint16_t fid;
  217. uint32_t last_write; // Not defined == 0xffffffff
  218. uint16_t bct; // 0
  219. } SMB_PACKED_STRUCT smb_close_req;
  220. //-> Read File
  221. typedef struct
  222. {
  223. uint8_t wct; // 12
  224. SMB_ANDX_MEMBERS
  225. uint16_t fid;
  226. uint32_t offset;
  227. uint16_t max_count;
  228. uint16_t min_count;
  229. uint32_t max_count_high; // Continuation of max_count field
  230. uint16_t remaining;
  231. uint32_t offset_high; // Continuation of offset field'
  232. uint16_t bct; // 0
  233. } SMB_PACKED_STRUCT smb_read_req;
  234. //<- Read File
  235. typedef struct
  236. {
  237. uint8_t wct; // 12
  238. SMB_ANDX_MEMBERS
  239. uint16_t remaining;
  240. uint16_t compact_mode;
  241. uint16_t reserved;
  242. uint16_t data_len;
  243. uint16_t data_offset;
  244. uint32_t data_len_high;
  245. uint32_t reserved2;
  246. uint16_t reserved3;
  247. uint16_t bct;
  248. } SMB_PACKED_STRUCT smb_read_resp;
  249. //-> Write File
  250. typedef struct
  251. {
  252. uint8_t wct; // 14
  253. SMB_ANDX_MEMBERS
  254. uint16_t fid;
  255. uint32_t offset;
  256. uint32_t timeout;
  257. uint16_t write_mode;
  258. uint16_t remaining;
  259. uint16_t reserved;
  260. uint16_t data_len;
  261. uint16_t data_offset;
  262. uint32_t offset_high; // Continuation of offset field'
  263. uint16_t bct;
  264. uint8_t padding;
  265. } SMB_PACKED_STRUCT smb_write_req;
  266. //<- Write File
  267. typedef struct
  268. {
  269. uint8_t wct; // 6
  270. SMB_ANDX_MEMBERS
  271. uint16_t data_len;
  272. uint16_t available;
  273. uint32_t reserved;
  274. uint16_t bct;
  275. } SMB_PACKED_STRUCT smb_write_resp;
  276. //-> Remove File
  277. typedef struct
  278. {
  279. uint8_t wct; // 0x01
  280. uint16_t search_attributes; // 0x0000 for "normal" (not hidden/ystem) files
  281. uint16_t bct; // >= 2
  282. uint8_t buffer_format; // 0x04
  283. } SMB_PACKED_STRUCT smb_file_rm_req;
  284. //<- Remove File
  285. typedef struct
  286. {
  287. uint8_t wct; // 0x00
  288. uint16_t bct; // 0x0000
  289. } SMB_PACKED_STRUCT smb_file_rm_resp;
  290. //-> Remove Directory
  291. typedef struct
  292. {
  293. uint8_t wct; // 0x00
  294. uint16_t bct; // >= 2
  295. uint8_t buffer_format; // 0x04
  296. } SMB_PACKED_STRUCT smb_directory_rm_req;
  297. //<- Remove Directory
  298. typedef struct
  299. {
  300. uint8_t wct; // 0x00
  301. uint16_t bct; // 0x0000
  302. } SMB_PACKED_STRUCT smb_directory_rm_resp;
  303. //-> Move File
  304. typedef struct
  305. {
  306. uint8_t wct; // 0x01
  307. uint16_t search_attributes; // 0x0000 for "normal" (not hidden/ystem) files
  308. uint16_t bct; // >= 2
  309. } SMB_PACKED_STRUCT smb_file_mv_req;
  310. //<- Move File
  311. typedef smb_simple_struct smb_file_mv_resp;
  312. //-> Create Directory
  313. typedef struct
  314. {
  315. uint8_t wct; // 0x00
  316. uint16_t bct; // >= 2
  317. uint8_t buffer_format; // 0x04
  318. } SMB_PACKED_STRUCT smb_directory_mk_req;
  319. //<- Create Directory
  320. typedef smb_simple_struct smb_directory_mk_resp;
  321. //-> Trans
  322. typedef struct
  323. {
  324. uint8_t wct; // 16
  325. uint16_t total_param_count;
  326. uint16_t total_data_count;
  327. uint16_t max_param_count;
  328. uint16_t max_data_count;
  329. uint8_t max_setup_count;
  330. uint8_t reserved;
  331. uint16_t flags;
  332. uint32_t timeout;
  333. uint16_t reserved2;
  334. uint16_t param_count;
  335. uint16_t param_offset;
  336. uint16_t data_count;
  337. uint16_t data_offset;
  338. uint8_t setup_count;
  339. uint8_t reserved3;
  340. uint16_t pipe_function;
  341. uint16_t fid;
  342. uint16_t bct;
  343. uint8_t payload[];
  344. } SMB_PACKED_STRUCT smb_trans_req;
  345. //-> Trans2
  346. typedef struct
  347. {
  348. uint8_t wct; // 15
  349. uint16_t total_param_count;
  350. uint16_t total_data_count;
  351. uint16_t max_param_count;
  352. uint16_t max_data_count;
  353. uint8_t max_setup_count;
  354. uint8_t reserved;
  355. uint16_t flags;
  356. uint32_t timeout;
  357. uint16_t reserve2;
  358. uint16_t param_count;
  359. uint16_t param_offset;
  360. uint16_t data_count;
  361. uint16_t data_offset;
  362. uint8_t setup_count;
  363. uint8_t reserved3;
  364. uint16_t cmd;
  365. uint16_t bct;
  366. uint8_t padding[3];
  367. uint8_t payload[];
  368. } SMB_PACKED_STRUCT smb_trans2_req;
  369. //// -> Trans2|FindFirst2
  370. typedef struct
  371. {
  372. uint16_t attrs; // Search attributes
  373. uint16_t count; // Search count
  374. uint16_t flags;
  375. uint16_t interest; // What kind of info do we want ?
  376. uint32_t storage; // ? => 0
  377. uint8_t pattern[]; // The queried pattern "\\folder\\*"
  378. } SMB_PACKED_STRUCT smb_tr2_findfirst2;
  379. //// -> Trans2|FindNext2
  380. typedef struct
  381. {
  382. uint16_t sid; // Search handle
  383. uint16_t count; // Search count
  384. uint16_t interest; // What kind of info do we want ?
  385. uint32_t resume_key; // Value returned by previous find2 call
  386. uint16_t flags;
  387. uint8_t pattern[]; // The queried pattern "\\folder\\*"
  388. } SMB_PACKED_STRUCT smb_tr2_findnext2;
  389. //// -> Trans2|QueryPathInfo
  390. typedef struct
  391. {
  392. uint16_t interest;
  393. uint32_t reserved;
  394. uint8_t path[];
  395. } SMB_PACKED_STRUCT smb_tr2_query;
  396. //<- Trans2
  397. typedef struct
  398. {
  399. uint8_t wct; // 10
  400. uint16_t total_param_count;
  401. uint16_t total_data_count;
  402. uint16_t reserved;
  403. uint16_t param_count;
  404. uint16_t param_offset;
  405. uint16_t param_displacement; // ??
  406. uint16_t data_count;
  407. uint16_t data_offset;
  408. uint16_t data_displacement; // ??
  409. uint8_t setup_count;
  410. uint8_t reserved2;
  411. uint16_t bct;
  412. uint8_t padding;
  413. uint8_t payload[];
  414. } SMB_PACKED_STRUCT smb_trans2_resp;
  415. //// <- Trans2|FindFirst2Params
  416. typedef struct
  417. {
  418. uint16_t id;
  419. uint16_t count;
  420. uint16_t eos;
  421. uint16_t ea_error_offset;
  422. uint16_t last_name_offset;
  423. uint16_t padding;
  424. } SMB_PACKED_STRUCT smb_tr2_findfirst2_params;
  425. //// <- Trans2|FindNext2Params
  426. typedef struct
  427. {
  428. uint16_t count;
  429. uint16_t eos;
  430. uint16_t ea_error_offset;
  431. uint16_t last_name_offset;
  432. } SMB_PACKED_STRUCT smb_tr2_findnext2_params;
  433. //// <- Trans2|FindFirst2FileInfo
  434. typedef struct
  435. {
  436. uint32_t next_entry;
  437. uint32_t index;
  438. uint64_t created; // File creation time
  439. uint64_t accessed; // File last access time
  440. uint64_t written; // File last write time
  441. uint64_t changed; // File last modification time
  442. uint64_t size;
  443. uint64_t alloc_size;
  444. uint32_t attr;
  445. uint32_t name_len;
  446. uint32_t ea_list_len;
  447. uint8_t short_name_len;
  448. uint8_t reserved;
  449. uint8_t short_name[24];
  450. uint8_t name[];
  451. } SMB_PACKED_STRUCT smb_tr2_find2_entry;
  452. //// <- Trans2|QueryPathInfo
  453. typedef struct
  454. {
  455. uint64_t created;
  456. uint64_t accessed;
  457. uint64_t written;
  458. uint64_t changed;
  459. uint32_t attr;
  460. uint32_t reserved;
  461. uint64_t alloc_size;
  462. uint64_t size;
  463. uint32_t link_count;
  464. uint8_t rm_pending;
  465. uint8_t is_dir;
  466. uint16_t reserved2;
  467. uint32_t ea_list_len;
  468. uint32_t name_len;
  469. uint8_t name[];
  470. } SMB_PACKED_STRUCT smb_tr2_path_info;
  471. //-> Example
  472. typedef struct
  473. {
  474. uint8_t wct; // ??
  475. SMB_ANDX_MEMBERS
  476. // Fill me
  477. uint16_t bct;
  478. //uint8_t padding;
  479. uint8_t file[];
  480. } SMB_PACKED_STRUCT smb_example_t;
  481. #endif