scapy.contrib.dce_rpc

A basic dissector for DCE/RPC. Isn’t reliable for all packets and for building

class scapy.contrib.dce_rpc.DceRpc

Bases: scapy.packet.Packet

DCE/RPC packet

aliastypes
fields_desc
DceRpc fields

version

ByteField

4

type

ByteEnumField

0

flags1

FlagsField (8 bits)

<Flag 0 ()>

flags2

FlagsField (8 bits)

<Flag 0 ()>

endianness

BitEnumField (4 bits)

0

encoding

BitEnumField (4 bits)

0

float

ByteEnumField

0

DataRepr_reserved

ByteField

0

serial_high

XByteField

0

object_uuid

EndiannessField

None

interface_uuid

EndiannessField

None

activity

EndiannessField

None

boot_time

EndiannessField

0

interface_version

EndiannessField

1

sequence_num

EndiannessField

0

opnum

EndiannessField

0

interface_hint

EndiannessField

65535

activity_hint

EndiannessField

65535

frag_len

EndiannessField

None

frag_num

EndiannessField

0

auth

ByteEnumField

0

serial_low

XByteField

0

payload_guess

Possible sublayers: DceRpcPayload

class scapy.contrib.dce_rpc.DceRpcPayload

Bases: scapy.packet.Packet

Dummy class which use the dispatch_hook to find the payload class

aliastypes
classmethod dispatch_hook(_pkt, _underlayer=None, *args, **kargs)

dispatch_hook to choose among different registered payloads

classmethod register_possible_payload(pay)

Method to call from possible DCE/RPC endpoint to register it as possible payload

class scapy.contrib.dce_rpc.EndiannessField(fld, endianess_from)

Bases: object

Field which change the endianness of a sub-field

addfield(pkt, buf, val)

add the field with endianness to the buffer

endianess_from
fld
getfield(pkt, buf)

retrieve the field with endianness

set_endianess(pkt)

Add the endianness to the format

scapy.contrib.dce_rpc.dce_rpc_endianess(pkt)

Determine the right endianness sign for a given DCE/RPC packet