void Decode(byte[] message, int startIndex, int length)
{
ValidateArguments(message, startIndex, length);
Flags = (NtlmFlags)BitConverterLE.ToUInt32(message, startIndex + 20);
Buffer.BlockCopy(message, startIndex + 24, nonce, 0, 8);
var targetNameLength = BitConverterLE.ToUInt16(message, startIndex + 12);
var targetNameOffset = BitConverterLE.ToUInt16(message, startIndex + 16);
if (targetNameLength > 0)
{
var encoding = (Flags & NtlmFlags.NegotiateOem) != 0 ? Encoding.UTF8 : Encoding.Unicode;
TargetName = encoding.GetString(message, startIndex + targetNameOffset, targetNameLength);
}
// The Target Info block is optional.
if (message.Length >= 48 && targetNameOffset >= 48)
{
var targetInfoLength = BitConverterLE.ToUInt16(message, startIndex + 40);
var targetInfoOffset = BitConverterLE.ToUInt16(message, startIndex + 44);
if (targetInfoLength > 0 && targetInfoOffset < message.Length && targetInfoLength <= (message.Length - targetInfoOffset))
{
TargetInfo = new TargetInfo(message, targetInfoOffset, targetInfoLength, (Flags & NtlmFlags.NegotiateUnicode) != 0);
targetInfo = new byte[targetInfoLength];
Buffer.BlockCopy(message, startIndex + targetInfoOffset, targetInfo, 0, targetInfoLength);
}
}
}
static long DecodeTimestamp(byte[] buffer, ref int index)
{
short nbytes = BitConverterLE.ToInt16(buffer, index);
long lo, hi;
index += 2;
switch (nbytes)
{
case 8:
lo = BitConverterLE.ToUInt32(buffer, index);
index += 4;
hi = BitConverterLE.ToUInt32(buffer, index);
index += 4;
return((hi << 32) | lo);
case 4:
lo = BitConverterLE.ToUInt32(buffer, index);
index += 4;
return(lo);
case 2:
lo = BitConverterLE.ToUInt16(buffer, index);
index += 2;
return(lo);
default:
index += nbytes;
return(0);
}
}
void Decode(byte[] message, int startIndex, int length)
{
int offset, count;
ValidateArguments(message, startIndex, length);
Flags = (NtlmFlags)BitConverterLE.ToUInt32(message, startIndex + 12);
// decode the domain
count = BitConverterLE.ToUInt16(message, startIndex + 16);
offset = BitConverterLE.ToUInt16(message, startIndex + 20);
domain = Encoding.UTF8.GetString(message, startIndex + offset, count);
// decode the workstation/host
count = BitConverterLE.ToUInt16(message, startIndex + 24);
offset = BitConverterLE.ToUInt16(message, startIndex + 28);
host = Encoding.UTF8.GetString(message, startIndex + offset, count);
if (offset == 40)
{
// decode the OS Version
int major = message[startIndex + 32];
int minor = message[startIndex + 33];
int build = BitConverterLE.ToUInt16(message, startIndex + 34);
OSVersion = new Version(major, minor, build);
}
}
void Decode(byte[] message, int startIndex, int length)
{
ValidateArguments(message, startIndex, length);
Flags = (NtlmFlags)BitConverterLE.ToUInt32(message, startIndex + 12);
// decode the domain
var domainLength = BitConverterLE.ToUInt16(message, startIndex + 16);
var domainOffset = BitConverterLE.ToUInt16(message, startIndex + 20);
domain = Encoding.UTF8.GetString(message, startIndex + domainOffset, domainLength);
// decode the workstation/host
var workstationLength = BitConverterLE.ToUInt16(message, startIndex + 24);
var workstationOffset = BitConverterLE.ToUInt16(message, startIndex + 28);
host = Encoding.UTF8.GetString(message, startIndex + workstationOffset, workstationLength);
if ((Flags & NtlmFlags.NegotiateVersion) != 0 && length >= 40)
{
// decode the OS Version
int major = message[startIndex + 32];
int minor = message[startIndex + 33];
int build = BitConverterLE.ToUInt16(message, startIndex + 34);
OSVersion = new Version(major, minor, build);
}
}
static long DecodeTimestamp(byte[] buffer, ref int index, out short size)
{
size = BitConverterLE.ToInt16(buffer, index);
long value;
index += 2;
switch (size)
{
case 8:
long lo = BitConverterLE.ToUInt32(buffer, index);
long hi = BitConverterLE.ToUInt32(buffer, index + 4);
value = (hi << 32) | lo;
break;
case 4: value = BitConverterLE.ToUInt32(buffer, index); break;
case 2: value = BitConverterLE.ToUInt16(buffer, index); break;
default: value = 0; break;
}
index += size;
return(value);
}
void Decode(byte[] message, int startIndex, int length)
{
ValidateArguments(message, startIndex, length);
Password = null;
if (message.Length >= 64)
{
Flags = (NtlmFlags)BitConverterLE.ToUInt32(message, startIndex + 60);
}
else
{
Flags = (NtlmFlags)0x8201;
}
int lmLength = BitConverterLE.ToUInt16(message, startIndex + 12);
int lmOffset = BitConverterLE.ToUInt16(message, startIndex + 16);
LM = new byte[lmLength];
Buffer.BlockCopy(message, startIndex + lmOffset, LM, 0, lmLength);
int ntLength = BitConverterLE.ToUInt16(message, startIndex + 20);
int ntOffset = BitConverterLE.ToUInt16(message, startIndex + 24);
NT = new byte[ntLength];
Buffer.BlockCopy(message, startIndex + ntOffset, NT, 0, ntLength);
int domainLength = BitConverterLE.ToUInt16(message, startIndex + 28);
int domainOffset = BitConverterLE.ToUInt16(message, startIndex + 32);
Domain = DecodeString(message, startIndex + domainOffset, domainLength);
int userLength = BitConverterLE.ToUInt16(message, startIndex + 36);
int userOffset = BitConverterLE.ToUInt16(message, startIndex + 40);
Username = DecodeString(message, startIndex + userOffset, userLength);
int hostLength = BitConverterLE.ToUInt16(message, startIndex + 44);
int hostOffset = BitConverterLE.ToUInt16(message, startIndex + 48);
Host = DecodeString(message, startIndex + hostOffset, hostLength);
// Session key. We don't use it yet.
//int skeyLength = BitConverterLE.ToUInt16 (message, startIndex + 52);
//int skeyOffset = BitConverterLE.ToUInt16 (message, startIndex + 56);
// OSVersion
if ((Flags & NtlmFlags.NegotiateVersion) != 0 && length >= 72)
{
// decode the OS Version
int major = message[startIndex + 64];
int minor = message[startIndex + 65];
int build = BitConverterLE.ToUInt16(message, startIndex + 66);
OSVersion = new Version(major, minor, build);
}
}
bool CheckSignature(byte[] message, int startIndex)
{
for (int i = 0; i < Signature.Length; i++)
{
if (message[startIndex + i] != Signature[i])
{
return(false);
}
}
return(BitConverterLE.ToUInt32(message, startIndex + 8) == Type);
}
bool CheckHeader(byte[] message, int startIndex)
{
for (int i = 0; i < header.Length; i++)
{
if (message[startIndex + i] != header[i])
{
return(false);
}
}
return(BitConverterLE.ToUInt32(message, startIndex + 8) == Type);
}
void Decode(byte[] message, int startIndex, int length)
{
ValidateArguments(message, startIndex, length);
Password = null;
if (message.Length >= 64)
{
Flags = (NtlmFlags)BitConverterLE.ToUInt32(message, startIndex + 60);
}
else
{
Flags = (NtlmFlags)0x8201;
}
int lmLength = BitConverterLE.ToUInt16(message, startIndex + 12);
int lmOffset = BitConverterLE.ToUInt16(message, startIndex + 16);
LM = new byte[lmLength];
Buffer.BlockCopy(message, startIndex + lmOffset, LM, 0, lmLength);
int ntLength = BitConverterLE.ToUInt16(message, startIndex + 20);
int ntOffset = BitConverterLE.ToUInt16(message, startIndex + 24);
NT = new byte[ntLength];
Buffer.BlockCopy(message, startIndex + ntOffset, NT, 0, ntLength);
int domainLength = BitConverterLE.ToUInt16(message, startIndex + 28);
int domainOffset = BitConverterLE.ToUInt16(message, startIndex + 32);
domain = DecodeString(message, startIndex + domainOffset, domainLength);
int userLength = BitConverterLE.ToUInt16(message, startIndex + 36);
int userOffset = BitConverterLE.ToUInt16(message, startIndex + 40);
Username = DecodeString(message, startIndex + userOffset, userLength);
int hostLength = BitConverterLE.ToUInt16(message, startIndex + 44);
int hostOffset = BitConverterLE.ToUInt16(message, startIndex + 48);
host = DecodeString(message, startIndex + hostOffset, hostLength);
// Session key. We don't use it yet.
// int skeyLength = BitConverterLE.ToUInt16 (message, startIndex + 52);
// int skeyOffset = BitConverterLE.ToUInt16 (message, startIndex + 56);
}
void Decode(byte[] message, int startIndex, int length)
{
ValidateArguments(message, startIndex, length);
Flags = (NtlmFlags)BitConverterLE.ToUInt32(message, startIndex + 20);
Buffer.BlockCopy(message, startIndex + 24, nonce, 0, 8);
var targetNameLength = BitConverterLE.ToUInt16(message, startIndex + 12);
var targetNameOffset = BitConverterLE.ToUInt16(message, startIndex + 16);
if (targetNameLength > 0)
{
var encoding = (Flags & NtlmFlags.NegotiateUnicode) != 0 ? Encoding.Unicode : Encoding.UTF8;
TargetName = encoding.GetString(message, startIndex + targetNameOffset, targetNameLength);
}
if ((Flags & NtlmFlags.NegotiateVersion) != 0 && length >= 56)
{
// decode the OS Version
int major = message[startIndex + 48];
int minor = message[startIndex + 49];
int build = BitConverterLE.ToUInt16(message, startIndex + 50);
OSVersion = new Version(major, minor, build);
}
// The Target Info block is optional.
if (length >= 48 && targetNameOffset >= 48)
{
var targetInfoLength = BitConverterLE.ToUInt16(message, startIndex + 40);
var targetInfoOffset = BitConverterLE.ToUInt16(message, startIndex + 44);
if (targetInfoLength > 0 && targetInfoOffset < length && targetInfoLength <= (length - targetInfoOffset))
{
TargetInfo = new TargetInfo(message, startIndex + targetInfoOffset, targetInfoLength, (Flags & NtlmFlags.NegotiateOem) == 0);
targetInfo = new byte[targetInfoLength];
Buffer.BlockCopy(message, startIndex + targetInfoOffset, targetInfo, 0, targetInfoLength);
}
}
}
void Decode(byte[] message, int startIndex, int length)
{
int payloadOffset = length;
int micOffset = 64;
ValidateArguments(message, startIndex, length);
if (message.Length >= 64)
{
Flags = (NtlmFlags)BitConverterLE.ToUInt32(message, startIndex + 60);
}
else
{
Flags = (NtlmFlags)0x8201;
}
int lmLength = BitConverterLE.ToUInt16(message, startIndex + 12);
int lmOffset = BitConverterLE.ToUInt16(message, startIndex + 16);
LmChallengeResponse = new byte[lmLength];
Buffer.BlockCopy(message, startIndex + lmOffset, LmChallengeResponse, 0, lmLength);
payloadOffset = Math.Min(payloadOffset, lmOffset);
int ntLength = BitConverterLE.ToUInt16(message, startIndex + 20);
int ntOffset = BitConverterLE.ToUInt16(message, startIndex + 24);
NtChallengeResponse = new byte[ntLength];
Buffer.BlockCopy(message, startIndex + ntOffset, NtChallengeResponse, 0, ntLength);
payloadOffset = Math.Min(payloadOffset, ntOffset);
int domainLength = BitConverterLE.ToUInt16(message, startIndex + 28);
int domainOffset = BitConverterLE.ToUInt16(message, startIndex + 32);
Domain = DecodeString(message, startIndex + domainOffset, domainLength);
payloadOffset = Math.Min(payloadOffset, domainOffset);
int userLength = BitConverterLE.ToUInt16(message, startIndex + 36);
int userOffset = BitConverterLE.ToUInt16(message, startIndex + 40);
UserName = DecodeString(message, startIndex + userOffset, userLength);
payloadOffset = Math.Min(payloadOffset, userOffset);
int workstationLength = BitConverterLE.ToUInt16(message, startIndex + 44);
int workstationOffset = BitConverterLE.ToUInt16(message, startIndex + 48);
Workstation = DecodeString(message, startIndex + workstationOffset, workstationLength);
payloadOffset = Math.Min(payloadOffset, workstationOffset);
int skeyLength = BitConverterLE.ToUInt16(message, startIndex + 52);
int skeyOffset = BitConverterLE.ToUInt16(message, startIndex + 56);
EncryptedRandomSessionKey = new byte[skeyLength];
Buffer.BlockCopy(message, startIndex + skeyOffset, EncryptedRandomSessionKey, 0, skeyLength);
payloadOffset = Math.Min(payloadOffset, skeyOffset);
// OSVersion
if ((Flags & NtlmFlags.NegotiateVersion) != 0 && length >= 72)
{
// decode the OS Version
int major = message[startIndex + 64];
int minor = message[startIndex + 65];
int build = BitConverterLE.ToUInt16(message, startIndex + 66);
OSVersion = new Version(major, minor, build);
micOffset += 8;
}
// MIC
if (micOffset + 16 <= payloadOffset)
{
Mic = new byte[16];
Buffer.BlockCopy(message, startIndex + micOffset, Mic, 0, Mic.Length);
}
}