Sha256: 911218002fdfbe5c81c2b37d60aec22fd5137514c36c12cb86ac10ce417a3763
Contents?: true
Size: 1.41 KB
Versions: 32
Compression:
Stored size: 1.41 KB
Contents
module RubySMB
module Dcerpc
module Winreg
# This class represents a BaseRegQueryValue Response Packet as defined in
# [3.1.5.17 BaseRegQueryValue (Opnum 17)](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/8bc10aa3-2f91-44e8-aa33-b3263c49ab9d)
class QueryValueResponse < BinData::Record
attr_reader :opnum
endian :little
ndr_uint32_ptr :lp_type
ndr_byte_array_ptr :lp_data
ndr_uint32_ptr :lpcb_data
ndr_uint32_ptr :lpcb_len
ndr_uint32 :error_status
def initialize_instance
super
@opnum = REG_QUERY_VALUE
end
# Returns the data portion of the registry value formatted according to its type:
# [3.1.1.5 Values](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/3d64dbea-f016-4373-8cac-e43bf343837d)
def data
bytes = lp_data.to_a.pack('C*')
case lp_type
when 1,2
bytes.force_encoding('utf-16le').strip
when 3
bytes
when 4
bytes.unpack('V').first
when 5
bytes.unpack('N').first
when 7
str = bytes.force_encoding('utf-16le')
str.split("\0".encode('utf-16le'))
when 11
bytes.unpack('Q<').first
else
''
end
end
end
end
end
end
Version data entries
32 entries across 32 versions & 1 rubygems