class RubySMB::Dcerpc::Winreg::QueryValueResponse

This class represents a BaseRegQueryValue Response Packet as defined in [3.1.5.17 BaseRegQueryValue (Opnum 17)](docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/8bc10aa3-2f91-44e8-aa33-b3263c49ab9d)

Attributes

opnum[R]

Public Instance Methods

data() click to toggle source

Returns the data portion of the registry value formatted according to its type: [3.1.1.5 Values](docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/3d64dbea-f016-4373-8cac-e43bf343837d)

# File lib/ruby_smb/dcerpc/winreg/query_value_response.rb, line 33
def data
  bytes = lp_data.bytes.to_a.pack('C*')
  case lp_type
  when 1,2
    bytes.force_encoding('utf-16le').strip
  when 3
    bytes
  when 4
    bytes.unpack('V').first
  when 5
    bytes.unpack('N').first
  when 7
    str = bytes.force_encoding('utf-16le')
    str.split("\0".encode('utf-16le'))
  when 11
    bytes.unpack('Q<').first
  else
    ""
  end
end
initialize_instance() click to toggle source
Calls superclass method
# File lib/ruby_smb/dcerpc/winreg/query_value_response.rb, line 19
def initialize_instance
  super
  @opnum = REG_QUERY_VALUE
end
pad_length(prev_element) click to toggle source

Determines the correct length for the padding, so that the next field is 4-byte aligned.

# File lib/ruby_smb/dcerpc/winreg/query_value_response.rb, line 26
def pad_length(prev_element)
  offset = (prev_element.abs_offset + prev_element.to_binary_s.length) % 4
  (4 - offset) % 4
end