/// <summary>
        /// Parse the ExtendedBuffer. 
        /// </summary>
        /// <param name="s">An stream of the extended buffers.</param>
        public override void Parse(Stream s)
        {
            base.Parse(s);

            this.RPC_HEADER_EXT = new RPC_HEADER_EXT();
            this.RPC_HEADER_EXT.Parse(s);

            if (this.RPC_HEADER_EXT.Size > 0)
            {
                byte[] payloadBytes = ReadBytes((int)this.RPC_HEADER_EXT.Size);
                bool isCompressedXOR = false;
                if (((ushort)RPC_HEADER_EXT.Flags & (ushort)RpcHeaderFlags.XorMagic) == (ushort)RpcHeaderFlags.XorMagic)
                {
                    payloadBytes = CompressionAndObfuscationAlgorithm.XOR(payloadBytes);
                    isCompressedXOR = true;
                }

                if (((ushort)RPC_HEADER_EXT.Flags & (ushort)RpcHeaderFlags.Compressed) == (ushort)RpcHeaderFlags.Compressed)
                {
                    payloadBytes = CompressionAndObfuscationAlgorithm.LZ77Decompress(payloadBytes, (int)RPC_HEADER_EXT.SizeActual);
                    isCompressedXOR = true;
                }

                if (isCompressedXOR)
                {
                    MapiInspector.MAPIInspector.auxPayLoadCompresssedXOR = payloadBytes;
                }
                Stream stream = new MemoryStream(payloadBytes);

                List<AuxiliaryBufferPayload> payload = new List<AuxiliaryBufferPayload>();
                for (int length = 0; length < RPC_HEADER_EXT.Size; )
                {
                    AuxiliaryBufferPayload buffer = new AuxiliaryBufferPayload();
                    buffer.Parse(stream);
                    payload.Add(buffer);
                    length += buffer.AUX_HEADER.Size;
                }
                this.Payload = payload.ToArray();
            }
        }
        /// <summary>
        /// Parse the rgbOutputBuffer. 
        /// </summary>
        /// <param name="s">An stream containing the rgbOutputBuffer.</param>
        public override void Parse(Stream s)
        {
            base.Parse(s);

            this.RPC_HEADER_EXT = new RPC_HEADER_EXT();
            this.RPC_HEADER_EXT.Parse(s);
            if (this.RPC_HEADER_EXT.Size > 0)
            {
                byte[] payloadBytes = ReadBytes((int)this.RPC_HEADER_EXT.Size);
                bool isCompressedXOR = false;
                if (((ushort)RPC_HEADER_EXT.Flags & (ushort)RpcHeaderFlags.XorMagic) == (ushort)RpcHeaderFlags.XorMagic)
                {
                    payloadBytes = CompressionAndObfuscationAlgorithm.XOR(payloadBytes);
                    isCompressedXOR = true;
                }

                if (((ushort)RPC_HEADER_EXT.Flags & (ushort)RpcHeaderFlags.Compressed) == (ushort)RpcHeaderFlags.Compressed)
                {
                    payloadBytes = CompressionAndObfuscationAlgorithm.LZ77Decompress(payloadBytes, (int)RPC_HEADER_EXT.SizeActual);
                    isCompressedXOR = true;
                }

                if (isCompressedXOR)
                {
                    MapiInspector.MAPIInspector.payLoadCompresssedXOR = payloadBytes;
                }
                Stream stream = new MemoryStream(payloadBytes);
                this.Payload = new ROPOutputBuffer();
                this.Payload.Parse(stream);
            }
        }
Exemple #3
0
        /// <summary>
        /// Parse the ExtendedBuffer. 
        /// </summary>
        /// <param name="s">A stream of the extended buffers.</param>
        public override void Parse(Stream s)
        {
            base.Parse(s);

            this.RPC_HEADER_EXT = new RPC_HEADER_EXT();
            this.RPC_HEADER_EXT.Parse(s);
            List<AuxiliaryBufferPayload> payload = new List<AuxiliaryBufferPayload>();
            for (int length = 0; length < RPC_HEADER_EXT.Size; )
            {
                AuxiliaryBufferPayload buffer = new AuxiliaryBufferPayload();
                buffer.Parse(s);
                payload.Add(buffer);
                length += buffer.AUX_HEADER.Size;
            }
            this.Payload = payload.ToArray();
        }