A class indicates the ROP input buffer, which is sent by the client, includes an array of ROP request buffers to be processed by the server.
Наследование: MAPIInspector.Parsers.BaseStructure
Документация по классу ROPInputBuffer
Пример #1
0
        /// <summary>
        /// Parse the rgbInputBuffer. 
        /// </summary>
        /// <param name="s">An stream containing the rgbInputBuffer.</param>
        public override void Parse(Stream s)
        {
            base.Parse(s);

            this.RPC_HEADER_EXT = new RPC_HEADER_EXT();
            this.RPC_HEADER_EXT.Parse(s);
            if (this.RPC_HEADER_EXT.Size > 0)
            {
                byte[] payloadBytes = ReadBytes((int)this.RPC_HEADER_EXT.Size);
                bool isCompressedXOR = false;
                if (((ushort)RPC_HEADER_EXT.Flags & (ushort)RpcHeaderFlags.XorMagic) == (ushort)RpcHeaderFlags.XorMagic)
                {
                    payloadBytes = CompressionAndObfuscationAlgorithm.XOR(payloadBytes);
                    isCompressedXOR = true;
                }

                if (((ushort)RPC_HEADER_EXT.Flags & (ushort)RpcHeaderFlags.Compressed) == (ushort)RpcHeaderFlags.Compressed)
                {
                    payloadBytes = CompressionAndObfuscationAlgorithm.LZ77Decompress(payloadBytes, (int)RPC_HEADER_EXT.SizeActual);
                    isCompressedXOR = true;
                }

                if (isCompressedXOR)
                {
                    MapiInspector.MAPIInspector.payLoadCompresssedXOR = payloadBytes;
                }
                Stream stream = new MemoryStream(payloadBytes);
                this.Payload = new ROPInputBuffer();
                this.Payload.Parse(stream);
            }
        }