From a13b287202186f588b30ad083376688a6cb3d352 Mon Sep 17 00:00:00 2001
From: Clement Rouault <project@hakril.net>
Date: Wed, 7 Jun 2017 11:45:11 +0200
Subject: [PATCH] Clean some rpc/alpc code + add ndr.NdrCString

---
 samples/alpc_client_serveur.py | 15 ++++++++-------
 windows/alpc.py                | 16 +++++++++-------
 windows/rpc/client.py          |  8 +++-----
 windows/rpc/ndr.py             | 10 ++++++++++
 4 files changed, 30 insertions(+), 19 deletions(-)

diff --git a/samples/alpc_client_serveur.py b/samples/alpc_client_serveur.py
index 857595d..a06b910 100644
--- a/samples/alpc_client_serveur.py
+++ b/samples/alpc_client_serveur.py
@@ -6,29 +6,30 @@ from windows.generated_def import LPC_CONNECTION_REQUEST, LPC_REQUEST
 PORT_NAME = r"\RPC Control\YOLOPORT"
 
 def alpc_server():
-    server = windows.alpc.AlpcServer(PORT_NAME)
+    server = windows.alpc.AlpcServer(PORT_NAME) # NtAlpcCreatePort
     print("[SERV] PORT CREATED")
-    attrs, msg = server.wait_data()
+    attrs, msg = server.wait_data() # NtAlpcSendWaitReceivePort (send_msg = None)
     print("[SERV] Message type = {0:#x}".format(msg.u2.s2.Type))
     print("[SERV] Received data: <{0}>".format(msg.data))
     if msg.u2.s2.Type & LPC_CONNECTION_REQUEST:
         print("[SERV] Connection request")
         msg.data = "WOKAY"
-        server.accept_connection(msg)
-    attrs, msg = server.wait_data()
+        server.accept_connection(msg) # NtAlpcAcceptConnectPort
+    attrs, msg = server.wait_data() # NtAlpcSendWaitReceivePort (send_msg = None)
     print("[SERV] Received message")
     print("[SERV] Message type = {0:#x}".format(msg.u2.s2.Type))
     if msg.u2.s2.Type & LPC_REQUEST:
         print("[SERV] ALPC request: <{0}>".format(msg.data))
-        server.reply(msg, "REQUEST '{0}' DONE".format(msg.data))
+        # Copy MessageId + NtAlpcSendWaitReceivePort
+        server.reply(msg, "REQUEST '{0}' DONE".format(msg.data)) 
 
 
 def alpc_client():
     client = windows.alpc.AlpcClient()
-    connect_response = client.connect_to_port(PORT_NAME, "COUCOU")
+    connect_response = client.connect_to_port(PORT_NAME, "COUCOU") # NtAlpcConnectPort
     print("[CLIENT] Connected: {0}".format(connect_response.data))
     print("[CLIENT] Send Message <POUET>")
-    attr, response = client.send_receive("POUET")
+    attr, response = client.send_receive("POUET") # NtAlpcSendWaitReceivePort
     print("[CLIENT] Server response: <{0}>".format(response.data))
 
 
diff --git a/windows/alpc.py b/windows/alpc.py
index f78f2dd..4987cd3 100644
--- a/windows/alpc.py
+++ b/windows/alpc.py
@@ -143,13 +143,15 @@ class AlpcClient(object):
 
         port_name = gn.UNICODE_STRING(utf16_len, utf16_len, raw_name)
 
-        obj_attr = gn.OBJECT_ATTRIBUTES()
-        obj_attr.Length = ctypes.sizeof(obj_attr)
-        obj_attr.RootDirectory = None
-        obj_attr.ObjectName = None
-        obj_attr.Attributes = 0
-        obj_attr.SecurityDescriptor = None
-        obj_attr.SecurityQualityOfService = None
+        # obj_attr = gn.OBJECT_ATTRIBUTES()
+        # obj_attr.Length = ctypes.sizeof(obj_attr)
+        # obj_attr.RootDirectory = None
+        # obj_attr.ObjectName = None
+        # obj_attr.Attributes = 0
+        # obj_attr.SecurityDescriptor = None
+        # obj_attr.SecurityQualityOfService = None
+
+        obj_attr = None
 
 
         port_attr = gn.ALPC_PORT_ATTRIBUTES()
diff --git a/windows/rpc/client.py b/windows/rpc/client.py
index 5360185..d9c4389 100644
--- a/windows/rpc/client.py
+++ b/windows/rpc/client.py
@@ -48,8 +48,6 @@ KNOWN_RPC_ERROR_CODE = {
 
 NOT_USED = 0xBAADF00D
 
-# def dword_pack(*args):
-#     return "".join(struct.pack("<I", x) for x in args)
 
 class RPCClient(object):
     REQUEST_IDENTIFIER = 0x11223344
@@ -93,13 +91,13 @@ class RPCClient(object):
 
     def _forge_bind_request(self, rawuuid, syntaxversion, requested_if_nb):
         version_major, version_minor = syntaxversion
-        # TODO: flags
-        data = struct.pack("III16sHHIIIIIIIIII", REQUEST_TYPE_BIND, NOT_USED, NOT_USED, rawuuid, version_major, version_minor, NOT_USED, requested_if_nb, NOT_USED, NOT_USED ,NOT_USED, NOT_USED, NOT_USED, NOT_USED, NOT_USED, NOT_USED) # Fonctionne pour le BIND :D
+        data = struct.pack("III16sHHII8I", REQUEST_TYPE_BIND, NOT_USED, NOT_USED, rawuuid, version_major, version_minor, NOT_USED, requested_if_nb, *[NOT_USED] * 8)
         return data
 
     def _forge_call_request(self, interface_nb, method_offset, params):
         # TODO: differents REQUEST_IDENTIFIER for each req ?
-        request = struct.pack("<16I", REQUEST_TYPE_CALL, NOT_USED, 0, self.REQUEST_IDENTIFIER, interface_nb, method_offset, NOT_USED, NOT_USED, NOT_USED, NOT_USED, NOT_USED, NOT_USED, NOT_USED, NOT_USED, NOT_USED, NOT_USED)
+        # TODO: what is this '0' ? (1 is also accepted) (flags ?)
+        request = struct.pack("<16I", REQUEST_TYPE_CALL, NOT_USED, 0, self.REQUEST_IDENTIFIER, interface_nb, method_offset, *[NOT_USED] * 10)
         request += params
         return request
 
diff --git a/windows/rpc/ndr.py b/windows/rpc/ndr.py
index cb7ffc6..4c39c2f 100644
--- a/windows/rpc/ndr.py
+++ b/windows/rpc/ndr.py
@@ -75,6 +75,16 @@ class NdrWString(object):
         result += data
         return dword_pad(result)
 
+class NdrCString(object):
+    @classmethod
+    def pack(cls, data):
+        if data is None:
+            return None
+        l = len(data)
+        result = struct.pack("<3I", l, 0, l)
+        result += data
+        return dword_pad(result)
+
     # @classmethod
     # def unpack(self, stream):
     #     maxcount, offset, count = stream.partial_unpack("<3I")