def parseDeviceCreateRequest(self, deviceID: int, fileID: int, completionID: int, minorFunction: int, stream: BytesIO) -> DeviceCreateRequestPDU:
desiredAccess = Uint32LE.unpack(stream)
allocationSize = Uint64LE.unpack(stream)
fileAttributes = FileAttributes(Uint32LE.unpack(stream))
sharedAccess = FileShareAccess(Uint32LE.unpack(stream))
createDisposition = FileCreateDisposition(Uint32LE.unpack(stream))
createOptions = FileCreateOptions(Uint32LE.unpack(stream))
pathLength = Uint32LE.unpack(stream)
path = stream.read(pathLength)
path = decodeUTF16LE(path)[: -1]
return DeviceCreateRequestPDU(
deviceID,
fileID,
completionID,
minorFunction,
desiredAccess,
allocationSize,
fileAttributes,
sharedAccess,
createDisposition,
createOptions,
path
)
def parseFileFullDirectoryInformation(
self, data: bytes) -> List[FileFullDirectoryInformation]:
stream = BytesIO(data)
information: [FileFullDirectoryInformation] = []
while stream.tell() < len(data):
nextEntryOffset = Uint32LE.unpack(stream)
fileIndex = Uint32LE.unpack(stream)
creationTime = Uint64LE.unpack(stream)
lastAccessTime = Uint64LE.unpack(stream)
lastWriteTime = Uint64LE.unpack(stream)
lastChangeTime = Uint64LE.unpack(stream)
endOfFilePosition = Uint64LE.unpack(stream)
allocationSize = Uint64LE.unpack(stream)
fileAttributes = FileAttributes(Uint32LE.unpack(stream))
fileNameLength = Uint32LE.unpack(stream)
eaSize = Uint32LE.unpack(stream)
fileName = stream.read(fileNameLength)
if nextEntryOffset != 0:
stream.read(8 - stream.tell() % 8) # alignment
break
fileName = decodeUTF16LE(fileName)
info = FileFullDirectoryInformation(fileIndex, creationTime,
lastAccessTime, lastWriteTime,
lastChangeTime,
endOfFilePosition,
allocationSize, fileAttributes,
eaSize, fileName)
information.append(info)
return information
def parseFileBothDirectoryInformation(self, data: bytes) -> List[FileBothDirectoryInformation]:
stream = BytesIO(data)
information: [FileBothDirectoryInformation] = []
while stream.tell() < len(data):
nextEntryOffset = Uint32LE.unpack(stream)
fileIndex = Uint32LE.unpack(stream)
creationTime = Uint64LE.unpack(stream)
lastAccessTime = Uint64LE.unpack(stream)
lastWriteTime = Uint64LE.unpack(stream)
lastChangeTime = Uint64LE.unpack(stream)
endOfFilePosition = Uint64LE.unpack(stream)
allocationSize = Uint64LE.unpack(stream)
fileAttributes = FileAttributes(Uint32LE.unpack(stream))
fileNameLength = Uint32LE.unpack(stream)
eaSize = Uint32LE.unpack(stream)
shortNameLength = Uint8.unpack(stream)
# stream.read(1) # reserved (not actually used, WTF Microsoft ????)
shortName = stream.read(24)[: min(24, shortNameLength)]
fileName = stream.read(fileNameLength)
if nextEntryOffset != 0:
stream.read(8 - stream.tell() % 8) # alignment
break
shortName = decodeUTF16LE(shortName)
fileName = decodeUTF16LE(fileName)
info = FileBothDirectoryInformation(
fileIndex,
creationTime,
lastAccessTime,
lastWriteTime,
lastChangeTime,
endOfFilePosition,
allocationSize,
fileAttributes,
eaSize,
shortName,
fileName
)
information.append(info)
return information