# Conformance file for svcctl

HF_FIELD hf_svcctl_service_buffer_size "Buffer Size" "svcctl.services.buffer_size" FT_UINT32 BASE_DEC NULL 0 NULL HFILL
HF_FIELD hf_svcctl_service_referent_id "Referent ID(offset)" "svcctl.ENUM_SERVICE_STATUSW.referent_id" FT_UINT32 BASE_DEC NULL 0 NULL HFILL

MANUAL svcctl_dissect_EnumServicesStatusW_response

ETT_FIELD ett_svcctl_service
ETT_FIELD ett_svcctl_service_name
ETT_FIELD ett_svcctl_display_name

NOEMIT svcctl_dissect_element_EnumServicesStatusW_services
NOEMIT svcctl_dissect_element_EnumServicesStatusW_bytes_needed
NOEMIT svcctl_dissect_element_EnumServicesStatusW_services_returned

CODE START

/*  ENUM_SERVICE_STATUSW Caveats
	https://github.com/fortra/impacket/blob/4888172ce638910104da4bda2c3301c24e17564c/impacket/dcerpc/v5/scmr.py#L1274
*/
static int
svcctl_dissect_struct_ENUM_SERVICE_STATUSW_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, dcerpc_info* di, guint8 *drep, int hf_index, gint starting_offset);
static int
svcctl_dissect_struct_ENUM_SERVICE_STATUSW_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *parent_tree, dcerpc_info* di, guint8 *drep, int hf_index, gint starting_offset)
{
	proto_item *item = NULL;
	proto_tree *tree = NULL;
	proto_tree *tr = NULL;
	int old_offset;
	guint32 _referent_id = 0;

	ALIGN_TO_5_BYTES;

	old_offset = offset;

	if (parent_tree) {
		item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
		tree = proto_item_add_subtree(item, ett_svcctl_ENUM_SERVICE_STATUSW);
	}

	// Service Name
	tr = proto_tree_add_subtree(tree, tvb, offset, 4, ett_svcctl_service_name, NULL, "Pointer to Service Name");
	offset = PIDL_dissect_uint32_val(tvb, offset, pinfo, tr, di, drep, hf_svcctl_service_referent_id, 0, &_referent_id);
	dissect_null_term_wstring(tvb, starting_offset + _referent_id, pinfo, tr, drep, hf_svcctl_ENUM_SERVICE_STATUSW_service_name , 0);

	// Display Name
	tr = proto_tree_add_subtree(tree, tvb, offset, 4, ett_svcctl_display_name, NULL, "Pointer to Display Name");
	offset = PIDL_dissect_uint32_val(tvb, offset, pinfo, tr, di, drep, hf_svcctl_service_referent_id, 0, &_referent_id);
	dissect_null_term_wstring(tvb, starting_offset + _referent_id, pinfo, tr, drep, hf_svcctl_ENUM_SERVICE_STATUSW_display_name , 0);

	// Status
	offset = svcctl_dissect_element_ENUM_SERVICE_STATUSW_status(tvb, offset, pinfo, tree, di, drep);

	proto_item_set_len(item, offset-old_offset);

	if (di->call_data->flags & DCERPC_IS_NDR64) {
		ALIGN_TO_5_BYTES;
	}

	return offset;
}

/*  REnumServicesStatusW
	https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/22b4ff3d-29c6-481f-b598-8ce66a46944a
*/
static int
svcctl_dissect_EnumServicesStatusW_response(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep)
{
	guint32 status;
	guint32 services_returned= 0;
	proto_item *item;
	proto_tree  *tr           = NULL;
	gint        services_buffer_offset;
	gint        payload_starting_offset = offset;
	guint64 buffer_size = 0;

	ALIGN_TO_5_BYTES

	di->dcerpc_procedure_name="EnumServicesStatusW";

	tr = proto_tree_add_subtree(tree, tvb, offset, 0, ett_svcctl_service, &item, "Pointer to Services Status");

	// Services Buffer Size
	offset = dissect_ndr_uint3264(tvb, offset, pinfo, tr, di, drep, hf_svcctl_service_buffer_size, &buffer_size);
	services_buffer_offset = offset;

	offset += (int)buffer_size;

	proto_item_set_len(item, offset-payload_starting_offset);

	ALIGN_TO_4_BYTES

	// Bytes Needed
	offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_svcctl_svcctl_EnumServicesStatusW_bytes_needed, 0);

	// Services Returned
	offset = PIDL_dissect_uint32_val( tvb, offset, pinfo, tree, di, drep
	                                , hf_svcctl_svcctl_EnumServicesStatusW_services_returned
	                                , 0, &services_returned);

	// Services
	if (services_returned > 0){
		payload_starting_offset = services_buffer_offset;
		for(unsigned idx = 0; idx < services_returned ; ++idx){
			services_buffer_offset = svcctl_dissect_struct_ENUM_SERVICE_STATUSW_ptr( tvb, services_buffer_offset
			                                                                       , pinfo, tr, di, drep
			                                                                       , hf_svcctl_svcctl_EnumDependentServicesW_service_status
			                                                                       , payload_starting_offset);
		}
		dissect_deferred_pointers(pinfo, tvb, services_buffer_offset, di, drep);
	}

	// Resume Index
	offset = svcctl_dissect_element_EnumServicesStatusW_resume_index(tvb, offset, pinfo, tree, di, drep);

	offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);

	// Return status
	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_svcctl_werror, &status);

	if (status != 0)
		col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x"));

	return offset;
}

CODE END