how to decode smb proto with ctypes - from_buffer_copy method? - ctypes

Question

When I try to decode SMB HEADER with ctypes - from_buffer_copy, it gains an error. I've defined a fields (32 bytes), why python shows me ValueError: Buffer size too small (32 instead of at least 40 bytes) ?
CodeLab: Mac OS X 64bit
CodeLab: Linux
# python2.7 smbproto.py
Traceback (most recent call last):
File "smbproto.py", line 77, in <module>
SMB_HEADER(data)
File "smbproto.py", line 39, in __new__
return self.from_buffer_copy(buffer)
ValueError: Buffer size too small (32 instead of at least 40 bytes)
Code here.
#!/usr/bin/python
# -*- coding: utf-8 -*-
from ctypes import *
import logging
logging.basicConfig(level=logging.INFO)
log = logging.getLogger(__file__)
class SMB_HEADER(Structure):
_fields_ = [
("server_component", c_uint32),
("smb_command", c_uint8),
("error_class", c_uint8),
("reserved1", c_uint8),
("error_code", c_uint16),
("flags", c_uint8),
("flags2", c_uint16),
("process_id_high", c_uint16),
("signature", c_uint64),
("reserved2", c_uint16),
("tree_id", c_uint16),
("process_id", c_uint16),
("user_id", c_uint16),
("multiplex_id", c_uint16)
]
def __new__(self, buffer=None):
return self.from_buffer_copy(buffer)
def __init__(self, buffer):
print("%04x" % self.server_component)
print("%01x" % self.smb_command)
print("%01x" % self.error_class)
print("%01x" % self.reserved1)
print("%02x" % self.error_code)
print("%01x" % self.flags)
print("%02x" % self.flags2)
print("%02x" % self.process_id_high)
print("%08x" % self.signature)
print("%02x" % self.reserved2)
print("%02x" % self.tree_id)
print("%02x" % self.process_id)
print("%02x" % self.user_id)
print("%02x" % self.multiplex_id)
if __name__ == '__main__':
data = (
'\xffSMB' # server_component
's' # smb_command
'\x00' # error_class
'\x00' # reserved1
'\x00\x00' # error code
'\x98' # flags
'\x01 ' # flags2
'\x00\x00' # process_id_high
'\x00\x00\x00\x00\x00\x00\x00\x00' # signature
'\x00\x00' # reserved2
'\x00\x00' # tree_id
'/K' # process_id
'\x00\x10' # user_id
'\xc5^' # multiplex_id
)
SMB_HEADER(data)

Answer 1

you got too much in your header struct:
SMB_Header
{
UCHAR Protocol[4];
UCHAR Command;
SMB_ERROR Status;
UCHAR Flags;
USHORT Flags2;
USHORT PIDHigh;
UCHAR SecurityFeatures[8];
USHORT Reserved;
USHORT TID;
USHORT PIDLow;
USHORT UID;
USHORT MID;
}