@@ -28,7 +28,18 @@ def initialize(info = {})
2828 )
2929 end
3030
31- class UnicodeString < BinData ::Record
31+ class WindowsFileSystemString16 < BinData ::String
32+ def assign ( val )
33+ super ( val . encode ( 'utf-16le' ) )
34+ end
35+
36+ def snapshot
37+ super . force_encoding ( 'utf-16le' )
38+ end
39+ end
40+
41+ class WindowsFileSystemUnicodeString < BinData ::Record
42+ search_prefix :windows_file_system
3243 endian :little
3344
3445 uint16 :str_length
@@ -40,7 +51,8 @@ class UnicodeString < BinData::Record
4051 end
4152 end
4253
43- class ObjectAttributes < BinData ::Record
54+ class WindowsFileSystemObjectAttributes < BinData ::Record
55+ search_prefix :windows_file_system
4456 #
4557 # Valid values for the Attributes field
4658 OBJ_INHERIT = 0x00000002
@@ -79,7 +91,7 @@ class ObjectAttributes < BinData::Record
7991 end
8092 end
8193
82- class Guid < BinData ::Record
94+ class WindowsFileSystemGuid < BinData ::Record
8395 endian :little
8496
8597 uint32 :data1 , initial_value : 0
@@ -88,7 +100,8 @@ class Guid < BinData::Record
88100 string :data4 , length : 8 , initial_value : "\x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 "
89101 end
90102
91- class ReparseGuidDataBuffer < BinData ::Record
103+ class WindowsFileSystemReparseGuidDataBuffer < BinData ::Record
104+ search_prefix :windows_file_system
92105 endian :little
93106
94107 uint32 :reparse_tag
@@ -98,8 +111,11 @@ class ReparseGuidDataBuffer < BinData::Record
98111 string :reparse_data
99112 end
100113
101- class ReparseDataBuffer < BinData ::Record
102- class ReparseBuffer < BinData ::Record
114+ class WindowsFileSystemReparseDataBuffer < BinData ::Record
115+ search_prefix :windows_file_system
116+
117+ class WindowsFileSystemReparseBuffer < BinData ::Record
118+ search_prefix :windows_file_system
103119 endian :little
104120
105121 uint16 :substitute_name_offset
@@ -108,14 +124,14 @@ class ReparseBuffer < BinData::Record
108124 uint16 :print_name_length
109125 end
110126
111- class SymbolicLinkReparseBuffer < ReparseBuffer
127+ class WindowsFileSystemSymbolicLinkReparseBuffer < WindowsFileSystemReparseBuffer
112128 endian :little
113129
114130 uint32 :flags
115131 string16 :path_buffer
116132 end
117133
118- class MountPointReparseBuffer < ReparseBuffer
134+ class WindowsFileSystemMountPointReparseBuffer < WindowsFileSystemReparseBuffer
119135 endian :little
120136
121137 string16 :path_buffer
@@ -130,8 +146,8 @@ class MountPointReparseBuffer < ReparseBuffer
130146 uint16 :reparse_data_length
131147 uint16 :reserved , initial_value : 0
132148 choice :reparse_data , selection : -> { @obj . parent . get_parameter ( :type ) || -1 } do
133- symbolic_link_reparse_buffer SYMBOLIC_LINK
134- mount_point_reparse_buffer MOUNT_POINT
149+ windows_file_system_symbolic_link_reparse_buffer SYMBOLIC_LINK
150+ windows_file_system_mount_point_reparse_buffer MOUNT_POINT
135151 string :default
136152 end
137153 end
@@ -346,19 +362,19 @@ def write_to_memory(process, str)
346362 end
347363
348364 def build_object_attributes ( p_unicode_buf )
349- object_attributes = ObjectAttributes . new (
365+ object_attributes = WindowsFileSystemObjectAttributes . new (
350366 arch : client . native_arch
351367 )
352368 object_attributes . p_root_directory = 0 # root argument is nil, otherwise, we need to get a valid handle to root (TODO later)
353- object_attributes . attributes = ObjectAttributes ::OBJ_CASE_INSENSITIVE
369+ object_attributes . attributes = WindowsFileSystemObjectAttributes ::OBJ_CASE_INSENSITIVE
354370 object_attributes . p_security_descriptor = 0
355371 object_attributes . p_security_quality_of_service = 0
356372 object_attributes . p_object_name = p_unicode_buf
357373 object_attributes
358374 end
359375
360376 def build_reparse_data_buffer ( target , print_name )
361- buffer = ReparseDataBuffer . new ( type : ReparseDataBuffer ::MOUNT_POINT )
377+ buffer = WindowsFileSystemReparseDataBuffer . new ( type : WindowsFileSystemReparseDataBuffer ::MOUNT_POINT )
362378 target_byte_size = target . size * 2
363379 print_name_byte_size = print_name . size * 2
364380 path_buffer_size = target_byte_size + print_name_byte_size + 8 + 4
@@ -374,7 +390,7 @@ def build_reparse_data_buffer(target, print_name)
374390 end
375391
376392 def build_unicode_string ( str_byte_size , p_buffer )
377- unicode_str = UnicodeString . new (
393+ unicode_str = WindowsFileSystemUnicodeString . new (
378394 arch : client . native_arch
379395 )
380396 unicode_str . str_length = str_byte_size - 2
0 commit comments