C++ (Cpp) WSET_LH Examples

Example #1

File: ncpsign_kernel.c Project: chinnyannieb/empeg-hijack

static inline void
DSET_LH(__u8 * buf, int pos, __u32 val)
{
	WSET_LH(buf, pos, val & 0xffff);
	WSET_LH(buf, pos + 2, val >> 16);
}

Example #2

File: dslist.c Project: AsylumCorp/dsploit

static NWDSCCODE __NWDSListV2(
		NWDSContextHandle ctx,
		NWCONN_HANDLE conn,
		NWObjectID objectID,
		nuint32 qflags,
		nuint32* iterHandle,
		nuint32 dsiflags,
		Buf_T* nameb,
		const TimeStamp_T* ts,
		Buf_T* buffer
) {
	NWDSCCODE err;
	NW_FRAGMENT rq_frag[3];
	NW_FRAGMENT rp_frag[2];
	nuint8 rq_b[20];
	nuint8 rq_b2[8];
	nuint8 rp_b[4];
	nuint32 ctxflags;
		
	err = NWDSGetContext(ctx, DCK_FLAGS, &ctxflags);
	if (err)
		return err;
	if (ctxflags & DCV_TYPELESS_NAMES)
		qflags |= 0x0001;
	if (ctxflags & DCV_DEREF_BASE_CLASS) {
		qflags |= 0x0040;
		dsiflags |= DSI_DEREFERENCE_BASE_CLASS;
	}
	qflags |= ctx->dck.name_form << 1;

	DSET_LH(rq_b, 0, 2); 		/* version */
	DSET_LH(rq_b, 4, qflags);	/* ctxflag */
	DSET_LH(rq_b, 8, *iterHandle);	/* iterhandle */
	DSET_HL(rq_b, 12, objectID);
	DSET_LH(rq_b, 16, dsiflags);
	
	DSET_LH(rq_b2, 0, ts->wholeSeconds);
	WSET_LH(rq_b2, 4, ts->replicaNum);
	WSET_LH(rq_b2, 6, ts->eventID);

	rq_frag[0].fragAddr.ro = rq_b;
	rq_frag[0].fragSize = 20;
	rq_frag[1].fragAddr.ro = NWDSBufRetrieve(nameb, &rq_frag[1].fragSize);
	rq_frag[2].fragAddr.ro = rq_b2;
	rq_frag[2].fragSize = 8;

	NWDSBufStartPut(buffer, DSV_LIST);
	NWDSBufSetDSIFlags(buffer, dsiflags);
	
	rp_frag[0].fragAddr.rw = rp_b;
	rp_frag[0].fragSize = 4;
	rp_frag[1].fragAddr.rw = NWDSBufPutPtrLen(buffer, &rp_frag[1].fragSize);
	err = NWCFragmentRequest(conn, DSV_LIST, 3, rq_frag, 2, rp_frag,
		NULL);
	if (err)
		return err;
	if (rp_frag[0].fragSize < 4)
		return ERR_INVALID_SERVER_RESPONSE;
	NWDSBufPutSkip(buffer, rp_frag[1].fragSize);
	NWDSBufFinishPut(buffer);
	*iterHandle = DVAL_LH(rp_b, 0);
	return err;
}

Example #3

File: setkeys.c Project: AsylumCorp/dsploit

static NWDSCCODE __NWDSChangeObjectPasswordStep2(
		NWCONN_HANDLE conn,
		NWObjectID objectID,
		NWObjectID pseudoID,
		nuint8 rndseed[4],
		nuint8 *connPublicKey,
		const char* oldPassword,
		const char* newPassword
) {
	nuint8* privateKey;
	size_t privateKeyLen;
	nuint8 ec_newpwd[4096];
	size_t ec_newpwd_len;
	nuint8 oldPwdHash[16];
	nuint8 newPwdHash[16];
	NWDSCCODE err;
	NWDSCCODE gpk_err;
	size_t di;
	Buf_T *ib;
	Buf_T *ob;
	nuint8 tmpID[4];
	
	DSET_HL(tmpID, 0, pseudoID);
	shuffle(tmpID, oldPassword, strlen(oldPassword), oldPwdHash);
	shuffle(tmpID, newPassword, strlen(newPassword), newPwdHash);
	
	err = __NWDSGetPrivateKey(conn, connPublicKey, rndseed, objectID, oldPwdHash, NULL, &privateKey, &privateKeyLen);
	if (err != 0 && err != NWE_PASSWORD_EXPIRED)
		goto quit;
	if (privateKeyLen < 10) {
		err = ERR_INVALID_SERVER_RESPONSE;
		goto free_privkey;
	}
	DSET_LH(privateKey, 2, 1);
	WSET_LH(privateKey, 6, 2);

	gpk_err = err;
	ec_newpwd_len = sizeof(ec_newpwd);
	err = __NWEncryptWithSK(newPwdHash, 16, privateKey + 2, privateKeyLen - 2, ec_newpwd, &ec_newpwd_len);
	if (err)
		goto free_privkey;
	di = ec_newpwd_len + 0x34;
	
	err = NWDSAllocBuf(di + 8, &ib);
	if (err)
		goto free_privkey_ecnewpwd;
	NWDSBufPut(ib, rndseed, 4);
	NWDSBufPutBuffer(ib, oldPwdHash, 16);
	NWDSBufPutLE32(ib, strlen(newPassword));
	NWDSBufPutBuffer(ib, newPwdHash, 16);
	NWDSBufPutBuffer(ib, ec_newpwd, ec_newpwd_len);
	
	err = NWDSAllocBuf(di + 256, &ob);
	if (err)
		goto free_privkey_ecnewpwd_ib;
	err = rsa_crypt2(connPublicKey, ib, ob);
	if (err)
		goto free_privkey_ecnewpwd_ib_ob;
	err = __NWDSChangePasswordV0(conn, objectID, ob);
	if (!err)
		err = gpk_err;
free_privkey_ecnewpwd_ib_ob:;
	NWDSClearFreeBuf(ob);
free_privkey_ecnewpwd_ib:;
	NWDSClearFreeBuf(ib);
free_privkey_ecnewpwd:;
	memset(ec_newpwd, 0, sizeof(ec_newpwd));
free_privkey:;
	memset(privateKey, 0, privateKeyLen);
	free(privateKey);
quit:;
	memset(oldPwdHash, 0, sizeof(oldPwdHash));
	memset(newPwdHash, 0, sizeof(newPwdHash));
	return err;
}