scapy.contrib.dce_rpc

A basic dissector for DCE/RPC. Isn’t reliable for all packets and for building

class scapy.contrib.dce_rpc.DceRpc

Bases: scapy.packet.Packet

DCE/RPC packet

aliastypes

fields_desc

DceRpc fields

version	ByteField	4
type	ByteEnumField	0
flags1	FlagsField (8 bits)	<Flag 0 ()>
flags2	FlagsField (8 bits)	<Flag 0 ()>
endianness	BitEnumField (4 bits)	0
encoding	BitEnumField (4 bits)	0
float	ByteEnumField	0
DataRepr_reserved	ByteField	0
serial_high	XByteField	0
object_uuid	EndiannessField	None
interface_uuid	EndiannessField	None
activity	EndiannessField	None
boot_time	EndiannessField	0
interface_version	EndiannessField	1
sequence_num	EndiannessField	0
opnum	EndiannessField	0
interface_hint	EndiannessField	65535
activity_hint	EndiannessField	65535
frag_len	EndiannessField	None
frag_num	EndiannessField	0
auth	ByteEnumField	0
serial_low	XByteField	0

payload_guess

Possible sublayers: DceRpcPayload

class scapy.contrib.dce_rpc.DceRpcPayload

Bases: scapy.packet.Packet

Dummy class which use the dispatch_hook to find the payload class

aliastypes

classmethod dispatch_hook(_pkt, _underlayer=None, *args, **kargs)

dispatch_hook to choose among different registered payloads

classmethod register_possible_payload(pay)

Method to call from possible DCE/RPC endpoint to register it as possible payload

class scapy.contrib.dce_rpc.EndiannessField(fld, endianess_from)

Bases: object

Field which change the endianness of a sub-field

addfield(pkt, buf, val)

add the field with endianness to the buffer

endianess_from

fld

getfield(pkt, buf)

retrieve the field with endianness

set_endianess(pkt)

Add the endianness to the format

scapy.contrib.dce_rpc.dce_rpc_endianess(pkt)

Determine the right endianness sign for a given DCE/RPC packet