private void SwitchToResponseAndParseResult(TransactionNode resp, List<PacketSlice> slices,
out UInt32 retVal, out UInt32 lastError,
bool formatRetVal)
{
stream = session.GetNextStreamDirection();
UInt32 msgLen = stream.ReadU32LE(slices);
resp.AddField("MessageLength", Convert.ToString(msgLen),
"Length of the RAPI response.", slices);
lastError = stream.ReadU32LE(slices);
resp.AddField("LastError", String.Format("0x{0:x8}", lastError),
"Last error on the CE device.", slices);
retVal = stream.ReadU32LE(slices);
resp.AddField("ReturnValue", (formatRetVal) ? StaticUtils.FormatRetVal(retVal) : StaticUtils.FormatValue(retVal),
"Return value.", slices);
}
private void HandleRapiSession()
{
List<PacketSlice> slices = new List<PacketSlice>();
TransactionNode node, req, resp;
string str;
UInt32 val, retVal, lastError;
while (stream.GetBytesAvailable() > 0)
{
UInt32 msgLen, msgType;
List<PacketSlice> msgLenSlices = new List<PacketSlice>(1);
List<PacketSlice> msgTypeSlices = new List<PacketSlice>(1);
// Message length
msgLen = stream.ReadU32LE(msgLenSlices);
if (msgLen == 5)
{
node = new TransactionNode("RAPINotification");
node.Description = node.Name;
node.AddField("MessageType", "RAPI_NOTIFICATION", "Message type.", msgLenSlices);
val = stream.ReadU32LE(slices);
node.AddField("NotificationType", (val == 4) ? "REQUEST_NEW_CONNECTION" : StaticUtils.FormatFlags(val), "Notification type.", slices);
val = stream.ReadU32LE(slices);
node.AddField("Argument", val, "Argument.", slices);
session.AddNode(node);
if (stream.GetBytesAvailable() < 4)
break;
else
continue;
}
else if (msgLen == 1)
{
node = new TransactionNode("RAPIKeepalive");
node.Description = node.Name;
req = new TransactionNode(node, "Request");
req.AddField("MessageType", "RAPI_PING", "Message type.", msgLenSlices);
stream = session.GetNextStreamDirection();
if (stream.GetBytesAvailable() < 4)
break;
stream.ReadU32LE(slices);
resp = new TransactionNode(node, "Response");
resp.AddField("MessageType", "RAPI_PONG", "Message type.", slices);
session.AddNode(node);
stream = session.GetNextStreamDirection();
if (stream.GetBytesAvailable() < 4)
break;
else
continue;
}
// Message type
msgType = stream.ReadU32LE(msgTypeSlices);
if (msgType >= rapiCallNames.Length)
{
logger.AddMessage("Unknown call name: {0:x8}", msgType);
return;
}
string name = rapiCallNames[msgType];
RAPICallNode call = new RAPICallNode(name);
call.Description = call.Name;
req = call.Request;
resp = call.Response;
req.AddField("MessageLength", msgLen, "Length of the RAPI request.", msgLenSlices);
req.AddField("MessageType", String.Format("{0} (0x{1:x2})", name, msgType), "Type of the RAPI request.", msgTypeSlices);
if (name == "CeRegOpenKeyEx")
{
val = stream.ReadU32LE(slices);
req.AddField("hKey", StaticUtils.FormatRegKey(val),
"Handle to a currently open key or one of the following predefined reserved handle values:\n" +
"HKEY_CLASSES_ROOT\nHKEY_CURRENT_USER\nHKEY_LOCAL_MACHINE\nHKEY_USERS",
slices);
str = stream.ReadRAPIString(slices);
req.AddField("szSubKey", str,
"A null-terminated string containing the name of the subkey to open.",
slices);
req.Summary = String.Format("{0}, \"{1}\"", StaticUtils.FormatRegKey(val, true), str);
SwitchToResponseAndParseResult(resp, slices, out retVal, out lastError);
val = stream.ReadU32LE(slices);
string result = String.Format("0x{0:x8}", val);
resp.AddField("hkResult", result, "Handle to the opened key.", slices);
if (retVal == Constants.ERROR_SUCCESS)
resp.Summary = String.Format("{0}, {1}", StaticUtils.FormatRetVal(retVal, true), result);
else
resp.Summary = StaticUtils.FormatRetVal(retVal, true);
}
else if (name == "CeRegCreateKeyEx")
{
val = stream.ReadU32LE(slices);
req.AddField("hKey", StaticUtils.FormatRegKey(val),
"Handle to a currently open key or one of the following predefined reserved handle values:\n" +
"HKEY_CLASSES_ROOT\nHKEY_CURRENT_USER\nHKEY_LOCAL_MACHINE\nHKEY_USERS", slices);
string szSubKey = stream.ReadRAPIString(slices);
req.AddField("szSubKey", (szSubKey != null) ? szSubKey : "(null)",
"A null-terminated string specifying the name of a subkey that this function opens or creates. " +
"The subkey specified must be a subkey of the key identified by the hKey parameter. This subkey " +
"must not begin with the backslash character (\\). If the parameter is NULL, then RegCreateKeyEx " +
"behaves like RegOpenKey, where it opens the key specified by hKey.", slices);
string szClass = stream.ReadRAPIString(slices);
req.AddField("szClass", (szClass != null) ? szClass : "(null)",
"A null-terminated string that specifies the class (object type) of this key. This parameter is " +
"ignored if the key already exists.", slices);
req.Summary = String.Format("{0}, {1}, {2}",
StaticUtils.FormatRegKey(val, true),
StaticUtils.FormatStringArgument(szSubKey),
StaticUtils.FormatStringArgument(szClass));
SwitchToResponseAndParseResult(resp, slices, out retVal, out lastError);
string result = String.Format("0x{0:x8}", stream.ReadU32LE(slices));
resp.AddField("hkResult", result, "Handle to the opened key.", slices);
UInt32 disposition = stream.ReadU32LE(slices);
resp.AddField("dwDisposition", StaticUtils.FormatRegDisposition(disposition),
"Receives one of REG_CREATED_NEW_KEY and REG_OPENED_EXISTING_KEY.",
slices);
if (retVal == Constants.ERROR_SUCCESS)
resp.Summary = String.Format("{0}, {1}, {2}",
StaticUtils.FormatRetVal(retVal, true), result, StaticUtils.FormatRegDisposition(disposition, true));
else
resp.Summary = StaticUtils.FormatRetVal(retVal, true);
}
else if (name == "CeRegCloseKey")
{
val = stream.ReadU32LE(slices);
req.AddField("hKey", StaticUtils.FormatRegKey(val),
"Handle to the open key to close.", slices);
req.Summary = StaticUtils.FormatRegKey(val, true);
SwitchToResponseAndParseResult(resp, slices, out retVal, out lastError);
resp.Summary = StaticUtils.FormatRetVal(retVal, true);
}
else if (name == "CeRegQueryValueEx")
{
val = stream.ReadU32LE(slices);
req.AddField("hKey", StaticUtils.FormatRegKey(val),
"Handle to a currently open key or any of the following predefined reserved handle values:\n" +
"HKEY_CLASSES_ROOT\nHKEY_CURRENT_USER\nHKEY_LOCAL_MACHINE\nHKEY_USERS", slices);
string szValueName = stream.ReadRAPIString(slices);
req.AddField("szValueName", szValueName,
"A string containing the name of the value to query.", slices);
UInt32 cbData = stream.ReadU32LE(slices);
req.AddField("cbData", cbData,
"A variable that specifies the maximum number of bytes to return.", slices);
req.Summary = String.Format("{0}, {1}, {2}",
StaticUtils.FormatRegKey(val, true),
StaticUtils.FormatStringArgument(szValueName),
cbData);
SwitchToResponseAndParseResult(resp, slices, out retVal, out lastError);
UInt32 dwType = stream.ReadU32LE(slices);
resp.AddField("dwType", StaticUtils.FormatRegType(dwType),
"The type of data associated with the specified value.",
slices);
cbData = stream.ReadU32LE(slices);
resp.AddField("cbData", Convert.ToString(cbData),
"The size of the data returned.", slices);
str = ReadAndFormatDataForRegType(dwType, cbData, slices);
if (str == null)
str = "NULL";
resp.AddField("Data", str, "The data returned.", slices);
resp.Summary = StaticUtils.FormatRetVal(retVal, true);
}
else if (name == "CeRegSetValueEx")
{
UInt32 key = stream.ReadU32LE(slices);
req.AddField("hKey", StaticUtils.FormatRegKey(key),
"Handle to a currently open key or any of the following predefined reserved handle values:\n" +
"HKEY_CLASSES_ROOT\nHKEY_CURRENT_USER\nHKEY_LOCAL_MACHINE\nHKEY_USERS", slices);
string szValueName = stream.ReadRAPIString(slices);
req.AddField("szValueName", szValueName,
"String containing the name of the value to set. If a value with this name is not already " +
"present in the key, the function adds it to the key. If this parameter is NULL or an empty " +
"string, the function sets the type and data for the key's unnamed value. Registry keys do " +
"not have default values, but they can have one unnamed value, which can be of any type.",
slices);
UInt32 dwType = stream.ReadU32LE(slices);
req.AddField("dwType", StaticUtils.FormatRegType(dwType),
"Type of information to be stored as the value's data.",
slices);
UInt32 cbData = stream.ReadU32LE(slices);
req.AddField("cbData", Convert.ToString(cbData),
"Specifies the size, in bytes, of the information passed in the the Data field.",
slices);
str = ReadAndFormatDataForRegType(dwType, cbData, slices);
if (str == null)
str = "NULL";
req.AddField("Data", str, "Buffer containing the data to be stored with the specified value name.",
slices);
string dataSummary;
if (dwType == Constants.REG_DWORD || dwType == Constants.REG_DWORD_BIG_ENDIAN)
{
dataSummary = str;
}
else
dataSummary = String.Format("[{0} bytes]", cbData);
req.Summary = String.Format("{0}, {1}, {2}, {3}",
StaticUtils.FormatRegKey(key), StaticUtils.FormatStringArgument(szValueName), StaticUtils.FormatRegType(dwType), dataSummary);
SwitchToResponseAndParseResult(resp, slices, out retVal, out lastError);
resp.Summary = StaticUtils.FormatRetVal(retVal, true);
}
else if (name == "CeProcessConfig")
{
str = stream.ReadRAPIString(slices);
req.AddXMLField("szRequest", str, "Config request.", slices);
UInt32 flags = stream.ReadU32LE(slices);
req.AddField("dwFlags", StaticUtils.FormatFlags(flags), "Flags.", slices);
req.Summary = String.Format("[{0} bytes], 0x{1:x8}",
str.Length, flags);
SwitchToResponseAndParseResult(resp, slices, out retVal, out lastError);
str = stream.ReadRAPIString(slices);
resp.AddXMLField("szResponse", str, "Config response.", slices);
if (retVal == Constants.ERROR_SUCCESS)
resp.Summary = String.Format("{0}, [{1} bytes]",
StaticUtils.FormatRetVal(retVal, true), (str != null) ? str.Length : 0);
else
resp.Summary = StaticUtils.FormatRetVal(retVal, true);
}
else if (name == "CeGetDesktopDeviceCaps")
{
string caps = FormatDeviceCaps(stream.ReadU32LE(slices));
req.AddField("nIndex", caps, "The item to return.", slices);
req.Summary = caps;
SwitchToResponseAndParseResult(resp, slices, out retVal, out lastError, false);
resp.Summary = StaticUtils.FormatValue(retVal);
}
else if (name == "CeSyncStart")
{
string xml = stream.ReadRAPIString(slices);
req.AddXMLField("szXML", (xml != null) ? xml : "(null)",
"Optional message.", slices);
if (xml != null)
req.Summary = String.Format("[{0} bytes]", xml.Length);
else
req.Summary = "NULL";
SwitchToResponseAndParseResult(resp, slices, out retVal, out lastError);
resp.Summary = StaticUtils.FormatRetVal(retVal, true);
}
else if (name == "CeSyncResume" || name == "CeSyncPause")
{
req.Summary = "";
SwitchToResponseAndParseResult(resp, slices, out retVal, out lastError, false);
resp.Summary = StaticUtils.FormatRetVal(retVal, true);
}
else if (name == "CeStartReplication")
{
req.Summary = "";
SwitchToResponseAndParseResult(resp, slices, out retVal, out lastError, false);
resp.Summary = StaticUtils.FormatBool(retVal);
}
else if (name == "CeGetFileAttributes")
{
string fileName = stream.ReadRAPIString(slices);
req.AddXMLField("szFileName", fileName,
"Name of a file or directory.", slices);
req.Summary = String.Format("\"{0}\"", fileName);
SwitchToResponseAndParseResult(resp, slices, out retVal, out lastError, false);
resp.Summary = StaticUtils.FormatValue(retVal);
}
else
{
if (msgLen > 4)
{
byte[] bytes = stream.ReadBytes((int)msgLen - 4, slices);
req.AddField("UnparsedData", StaticUtils.FormatByteArray(bytes), "Unparsed data.", slices);
}
req.Summary = "[not yet parsed]";
SwitchToResponseAndParseResult(resp, slices, out retVal, out lastError, false);
resp.Summary = "[not yet parsed]";
}
session.AddNode(call);
stream = session.GetNextStreamDirection();
if (stream.GetBytesAvailable() == 0)
break;
}
}
protected void ReadNextP2PMessageChunk(PacketStream stream, TransactionNode parentNode)
{
TransactionNode p2pNode = new TransactionNode(parentNode, "MSNP2PMessageChunk");
// Headers
TransactionNode p2pHeaders = new TransactionNode(p2pNode, "Headers");
List<PacketSlice> slices = new List<PacketSlice>();
UInt32 sessionID = stream.ReadU32LE(slices);
p2pHeaders.AddField("SessionID", sessionID, "Session ID.", slices);
UInt32 messageID = stream.ReadU32LE(slices);
p2pHeaders.AddField("MessageID", messageID, "Message ID.", slices);
UInt64 dataOffset = stream.ReadU64LE(slices);
p2pHeaders.AddField("DataOffset", dataOffset, "Data offset.", slices);
UInt64 dataSize = stream.ReadU64LE(slices);
p2pHeaders.AddField("DataSize", dataSize, "Data size.", slices);
UInt32 chunkSize = stream.ReadU32LE(slices);
p2pHeaders.AddField("ChunkSize", chunkSize, "Chunk size.", slices);
UInt32 flags = stream.ReadU32LE(slices);
p2pHeaders.AddField("Flags", flags, StaticUtils.FormatFlags(flags), "Flags.", slices);
UInt32 ackedMsgID = stream.ReadU32LE(slices);
p2pHeaders.AddField("AckedMsgID", ackedMsgID, "MessageID of the message to be acknowledged.", slices);
UInt32 prevAckedMsgID = stream.ReadU32LE(slices);
p2pHeaders.AddField("PrevAckedMsgID", prevAckedMsgID, "AckedMsgID of the last chunk to ack.", slices);
UInt64 ackedDataSize = stream.ReadU64LE(slices);
p2pHeaders.AddField("AckedDataSize", ackedDataSize, "Acknowledged data size.", slices);
// Body
TransactionNode p2pContent = null;
if (chunkSize > 0)
{
p2pContent = new TransactionNode(p2pNode, "Content");
byte[] bytes = stream.ReadBytes((int)chunkSize, slices);
if (sessionID != 0)
{
p2pContent.AddField("Raw", bytes, StaticUtils.FormatByteArray(bytes), "Raw content.", slices);
}
else
{
p2pContent.AddTextField("MSNSLP", bytes, StaticUtils.DecodeUTF8(bytes), "MSNSLP data.", slices);
}
}
}
private void HandleRapiHandshake()
{
RAPIConnectionState state = RAPIConnectionState.HANDSHAKE;
List<PacketSlice> slices = new List<PacketSlice>();
TransactionNode parentNode, node;
string str;
UInt32 val;
// Read and verify the initial request
UInt32 initialRequest = stream.ReadU32LE(slices);
if (initialRequest != NOTIFY_INITIAL_HANDSHAKE && initialRequest != NOTIFY_CONNECTION_READY)
{
logger.AddMessage("RAPI protocol error, unknown initial request {0}", initialRequest);
return;
}
node = new TransactionNode((initialRequest == 0) ? "RAPIInitialHandshake" : "RAPIConnectionStart");
node.Description = node.Name;
node.AddField("InitialRequest", (initialRequest == NOTIFY_INITIAL_HANDSHAKE) ? "NOTIFY_INITIAL_HANDSHAKE" : "NOTIFY_CONNECTION_READY", "Initial request.", slices);
// Now it's our turn
stream = session.GetNextStreamDirection();
if (initialRequest == NOTIFY_INITIAL_HANDSHAKE)
{
UInt32 firstPing = stream.ReadU32LE(slices);
node.AddField("FirstPing", firstPing, "First ping, should be 3.", slices);
// And the first pong
stream = session.GetNextStreamDirection();
UInt32 firstPong = stream.ReadU32LE(slices);
node.AddField("FirstPong", firstPong, "First pong, should be 4 for older WM5, 6 for newer versions.", slices);
if (firstPong == 6)
{
// Now we're supposed to send 4 DWORDs
stream = session.GetNextStreamDirection();
UInt32 secondPing = stream.ReadU32LE(slices);
node.AddField("SecondPingValue1", secondPing, "Second ping value #1, should be 7.", slices);
secondPing = stream.ReadU32LE(slices);
node.AddField("SecondPingValue2", secondPing, "Second ping value #2, should be 8.", slices);
secondPing = stream.ReadU32LE(slices);
node.AddField("SecondPingValue3", secondPing, "Second ping value #3, should be 4.", slices);
secondPing = stream.ReadU32LE(slices);
node.AddField("SecondPingValue4", secondPing, "Second ping value #4, should be 1.", slices);
// And the device should reply
stream = session.GetNextStreamDirection();
UInt32 secondPong = stream.ReadU32LE(slices);
node.AddField("SecondPong", secondPong, "Second pong, should be 4.", slices);
}
// Got it
session.AddNode(node);
parentNode = new TransactionNode("RAPIDeviceInfo");
parentNode.Description = parentNode.Name;
UInt32 deviceInfoLen = stream.ReadU32LE(slices);
UInt32 remainingDevInfoLen = deviceInfoLen;
parentNode.AddField("Length", deviceInfoLen, "Device info length.", slices);
if (deviceInfoLen > MAX_DEVICE_INFO_LENGTH)
{
logger.AddMessage("RAPI protocol error, length of the device info package should be below {0}, was {1}", MAX_DEVICE_INFO_LENGTH, deviceInfoLen);
return;
}
node = new TransactionNode(parentNode, "DeviceInfo");
Guid guid = new Guid(stream.ReadBytes(16, slices));
str = String.Format("{{0}}", guid.ToString());
node.AddField("DeviceGUID", str, "Device GUID.", slices);
remainingDevInfoLen -= 16;
val = stream.ReadU32LE(slices);
node.AddField("OsVersionMajor", val, "OS version, major.", slices);
remainingDevInfoLen -= 4;
val = stream.ReadU32LE(slices);
node.AddField("OsVersionMinor", val, "OS version, minor.", slices);
remainingDevInfoLen -= 4;
val = stream.ReadU32LE(slices);
node.AddField("DeviceNameLength", val, "Device name length (in characters, not bytes).", slices);
remainingDevInfoLen -= 4;
// calculate the string size in unicode, with terminating NUL word
val = (val + 1) * 2;
str = stream.ReadCStringUnicode((int)val, slices);
node.AddField("DeviceName", str, "Device name.", slices);
remainingDevInfoLen -= val;
val = stream.ReadU32LE(slices);
node.AddField("DeviceVersion", StaticUtils.FormatFlags(val), "Device version.", slices);
remainingDevInfoLen -= 4;
val = stream.ReadU32LE(slices);
node.AddField("DeviceProcessorType", StaticUtils.FormatFlags(val), "Device processor type.", slices);
remainingDevInfoLen -= 4;
val = stream.ReadU32LE(slices);
node.AddField("Unknown1", StaticUtils.FormatFlags(val), "Counter or a flag? ANDed with 0xFFFFFFFE in the code (should take a closer look at this).", slices);
remainingDevInfoLen -= 4;
val = stream.ReadU32LE(slices);
node.AddField("CurrentPartnerId", StaticUtils.FormatFlags(val), "Current partner id.", slices);
remainingDevInfoLen -= 4;
val = stream.ReadU32LE(slices);
node.AddField("DeviceId", StaticUtils.FormatFlags(val), "Current device id. Lives in HKCU\\Software\\Microsoft\\Windows CE Services\\Partners\\<DeviceIdentifier>.", slices);
remainingDevInfoLen -= 4;
/*
dw = stream.ReadU32LE(slices);
node.AddField("PlatformNameLength", dw, "Platform name length.", slices);
remainingDevInfoLen -= 4;*/
// Don't swallow the 4 last
remainingDevInfoLen -= 4;
byte[] bytes = stream.ReadBytes((int)remainingDevInfoLen, slices);
node.AddField("UnknownData1", StaticUtils.FormatByteArray(bytes), "Unknown device info data.", slices);
val = stream.ReadU32LE(slices);
node.AddField("PasswordMask", StaticUtils.FormatFlags(val), "Password mask. Non-zero if a password is set.", slices);
remainingDevInfoLen -= 4;
state = (val != 0) ? RAPIConnectionState.AUTH : RAPIConnectionState.SESSION;
// Now it's our turn
stream = session.GetNextStreamDirection();
node = parentNode;
}
else
{
state = RAPIConnectionState.SESSION;
}
// Add the last node for each case
session.AddNode(node);
while (state == RAPIConnectionState.AUTH)
{
parentNode = new TransactionNode("RAPIAuthAttempt");
parentNode.Description = parentNode.Name;
node = new TransactionNode(parentNode, "Request");
val = stream.ReadU16LE(slices);
node.AddField("Length", val, "Authentication data length.", slices);
byte[] bytes = stream.ReadBytes((int)val, slices);
node.AddField("Data", StaticUtils.FormatByteArray(bytes), "Authentication data.", slices);
stream = session.GetNextStreamDirection();
node = new TransactionNode(parentNode, "Response");
val = stream.ReadU16LE(slices);
node.AddField("Success", (val != 0) ? "TRUE" : "FALSE", "Whether the authentication attempt was successful.", slices);
session.AddNode(parentNode);
stream = session.GetNextStreamDirection();
if (val != 0)
state = RAPIConnectionState.SESSION;
}
}
private TransactionNode ReadNextP2PDirectMessage(PacketStream stream, string name)
{
TransactionNode msgNode = new TransactionNode(name);
msgNode.Description = msgNode.Name;
List<PacketSlice> slices = new List<PacketSlice>(1);
uint len = stream.ReadU32LE(slices);
msgNode.AddField("MSNP2PLength", len, "P2P message chunk length.", slices);
ReadNextP2PMessageChunk(stream, msgNode);
return msgNode;
}
