dotnet

package
v1.45.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 27, 2025 License: Apache-2.0 Imports: 15 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	LOSFormatter    = "LOSFormatter"
	BinaryFormatter = "BinaryFormatter"
	SOAPFormatter   = "SOAPFormatter"
)

Variables

View Source 
var BinaryTypeEnumerationMap = map[string]int{
	"Primitive":      0,
	"String":         1,
	"Object":         2,
	"SystemClass":    3,
	"Class":          4,
	"ObjectArray":    5,
	"StringArray":    6,
	"PrimitiveArray": 7,
}
View Source 
var PrimitiveTypeEnum = map[string]int{
	"Boolean":  1,
	"Byte":     2,
	"Char":     3,
	"Decimal":  5,
	"Double":   6,
	"Int16":    7,
	"Int32":    8,
	"Int64":    9,
	"SByte":    10,
	"Single":   11,
	"TimeSpan": 12,
	"DateTime": 13,
	"UInt16":   14,
	"UInt32":   15,
	"UInt64":   16,
	"Null":     17,
	"String":   18,
}

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nrbf/4e77849f-89e3-49db-8fb9-e77ee4bc7214

View Source 
var RecordTypeEnumMap = map[string]int{
	"SerializedStreamHeader":         0,
	"ClassWithId":                    1,
	"SystemClassWithMembers":         2,
	"ClassWithMembers":               3,
	"SystemClassWithMembersAndTypes": 4,
	"ClassWithMembersAndTypes":       5,
	"BinaryObjectString":             6,
	"BinaryArray":                    7,
	"MemberPrimitiveTyped":           8,
	"MemberReference":                9,
	"ObjectNull":                     10,
	"MessageEnd":                     11,
	"BinaryLibrary":                  12,
	"ObjectNullMultiple256":          13,
	"ObjectNullMultiple":             14,
	"ArraySinglePrimitive":           15,
	"ArraySingleObject":              16,
	"ArraySingleString":              17,
	"MethodCall":                     21,
	"MethodReturn":                   22,
}

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nrbf/954a0657-b901-4813-9398-4ec732fe8b32

Functions

func CreateClaimsPrincipal added in v1.45.0 

func CreateClaimsPrincipal(program string, args string, formatter string) (string, bool)

func CreateDataSet added in v1.45.0 

func CreateDataSet(program string, args string, formatter string) (string, bool)

func CreateDataSetTypeSpoof added in v1.45.0 

func CreateDataSetTypeSpoof(program string, args string, formatter string) (string, bool)

func CreateObjectDataProvider added in v1.45.0 

func CreateObjectDataProvider(program string, args string, formatter string) (string, bool)

ObjectDataProvider.

func CreateTextFormattingRunProperties added in v1.45.0 

func CreateTextFormattingRunProperties(program string, args string, formatter string) (string, bool)

func CreateTypeConfuseDelegate added in v1.45.0 

func CreateTypeConfuseDelegate(program string, args string, formatter string) (string, bool)

TypeConfuseDelegate.

func CreateVeeamCryptoKeyInfo added in v1.45.0 

func CreateVeeamCryptoKeyInfo(formatter string) (string, bool)

func CreateViewstatePayload added in v1.45.0 

func CreateViewstatePayload(payloadData string, machineKey string, generator string) (string, bool)

Takes payloadData, a machineKey, and a generator (can be empty) and returns a base64 encoded, signed payload. payloadData should be a dotnet serialized payload.

func CreateWindowsIdentity added in v1.45.0 

func CreateWindowsIdentity(program string, args string, formatter string) (string, bool)

func FormatLOS added in v1.45.0 

func FormatLOS(input string) string

func FormatSOAP added in v1.45.0 

func FormatSOAP(records []Record) (string, bool)

func IsValidXML added in v1.45.0 

func IsValidXML(data []byte) bool

func ReadGadget 

func ReadGadget(gadgetName, formatter string) ([]byte, error)

ReadGadget reads a gadget chain file by gadget name and formatter.

func TextFormattingRunPropertiesBinaryFormatter 

func TextFormattingRunPropertiesBinaryFormatter(cmd string) string

TextFormattingRunPropertiesBinaryFormatter serializes a TextFormattingRunProperties gadget chain using the BinaryFormatter formatter.

func Write7BitEncodedInt 

func Write7BitEncodedInt(value int) []byte

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrbf/10b218f5-9b2b-4947-b4b7-07725a2c8127 https://referencesource.microsoft.com/#mscorlib/system/io/binarywriter.cs,2daa1d14ff1877bd

Types

type ArrayInfo added in v1.45.0 

type ArrayInfo struct {
	ObjectID    int
	MemberCount int
}

type ArraySinglePrimitiveRecord added in v1.45.0 

type ArraySinglePrimitiveRecord struct {
	PrimitiveTypeEnum int
	ArrayInfo         ArrayInfo
	Members           string // this will be a hex byte string "\x00\xwhatever"
}

func (ArraySinglePrimitiveRecord) GetRecordType added in v1.45.0 

func (arraySinglePrimitiveRecord ArraySinglePrimitiveRecord) GetRecordType() int

func (ArraySinglePrimitiveRecord) ToRecordBin added in v1.45.0 

func (arraySinglePrimitiveRecord ArraySinglePrimitiveRecord) ToRecordBin() (string, bool)

type ArraySingleStringRecord added in v1.45.0 

type ArraySingleStringRecord struct {
	ArrayInfo ArrayInfo
	Members   []interface{}
}

func (ArraySingleStringRecord) GetRecordType added in v1.45.0 

func (arraySingleStringRecord ArraySingleStringRecord) GetRecordType() int

func (ArraySingleStringRecord) ToRecordBin added in v1.45.0 

func (arraySingleStringRecord ArraySingleStringRecord) ToRecordBin() (string, bool)

type BinaryLibraryRecord added in v1.45.0 

type BinaryLibraryRecord struct {
	ID      int
	Library string
}

func (BinaryLibraryRecord) GetRecordType added in v1.45.0 

func (binaryLibraryRecord BinaryLibraryRecord) GetRecordType() int

func (BinaryLibraryRecord) ToRecordBin added in v1.45.0 

func (binaryLibraryRecord BinaryLibraryRecord) ToRecordBin() (string, bool)

type BinaryObjectRecord added in v1.45.0 

type BinaryObjectRecord struct {
	ObjectID int
	Value    string
}

func (BinaryObjectRecord) GetRecordType added in v1.45.0 

func (binaryObjectRecord BinaryObjectRecord) GetRecordType() int

func (BinaryObjectRecord) ToRecordBin added in v1.45.0 

func (binaryObjectRecord BinaryObjectRecord) ToRecordBin() (string, bool)

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrbf/eb503ca5-e1f6-4271-a7ee-c4ca38d07996

type Body added in v1.45.0 

type Body struct {
	Classes []ClassDataNode
}

type ClassDataNode added in v1.45.0 

type ClassDataNode struct {
	XMLName     xml.Name
	ID          string     `xml:"id,attr"`
	Attrs       []xml.Attr `xml:",attr"`
	Content     string     `xml:",chardata"`
	MemberNodes []MemberNode
}

type ClassInfo added in v1.45.0 

type ClassInfo struct {
	ObjectID    int
	Name        string // Store as just the string, MSUT be made into an LPS when used
	MemberCount int
	MemberNames []string
}

func (ClassInfo) GetBaseClassName added in v1.45.0 

func (classInfo ClassInfo) GetBaseClassName() string

returns only the last item in the class name obj.Name = "Microsoft.VisualStudio.Text.Formatting.TextFormattingRunProperties" obj.GetLeadingClassName(className) == "TextFormattingRunProperties".

func (ClassInfo) GetLeadingClassName added in v1.45.0 

func (classInfo ClassInfo) GetLeadingClassName() string

returns all but the last item in the class name obj.Name = "Microsoft.VisualStudio.Text.Formatting.TextFormattingRunProperties" obj.GetLeadingClassName(className) == "Microsoft.VisualStudio.Text.Formatting".

func (ClassInfo) ToBin added in v1.45.0 

func (classInfo ClassInfo) ToBin() string

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrbf/0a192be0-58a1-41d0-8a54-9c91db0ab7bf

type ClassTypeInfo added in v1.45.0 

type ClassTypeInfo struct {
	TypeName  string
	LibraryID int
}

type ClassWithIDRecord added in v1.45.0 

type ClassWithIDRecord struct {
	ObjectID     int
	MetadataID   int
	MemberValues []interface{}
}

func (ClassWithIDRecord) GetRecordType added in v1.45.0 

func (classWithIDRecord ClassWithIDRecord) GetRecordType() int

func (ClassWithIDRecord) ToRecordBin added in v1.45.0 

func (classWithIDRecord ClassWithIDRecord) ToRecordBin() (string, bool)

type ClassWithMembersAndTypesRecord added in v1.45.0 

type ClassWithMembersAndTypesRecord struct {
	ClassInfo      ClassInfo
	MemberTypeInfo MemberTypeInfo
	LibraryID      int
	MemberValues   []interface{}
	BinaryLibrary  BinaryLibraryRecord // Not _really_ supposed to be here per MSDN but I placed it here for convenience
}

func (ClassWithMembersAndTypesRecord) GetRecordType added in v1.45.0 

func (classWithMembersAndTypesRecord ClassWithMembersAndTypesRecord) GetRecordType() int

func (ClassWithMembersAndTypesRecord) ToRecordBin added in v1.45.0 

func (classWithMembersAndTypesRecord ClassWithMembersAndTypesRecord) ToRecordBin() (string, bool)

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrbf/847b0b6a-86af-4203-8ed0-f84345f845b9

type MemberNode added in v1.45.0 

type MemberNode struct {
	XMLName xml.Name
	ID      string `xml:"id,attr"`
	XMLNS   string `xml:"xmlns,attr"`
	Xsi     string `xml:"xsi:type,attr"`
	Content string `xml:",innerxml"`
}

type MemberReferenceRecord added in v1.45.0 

type MemberReferenceRecord struct {
	IDRef int
}

func (MemberReferenceRecord) GetRecordType added in v1.45.0 

func (memberReferenceRecord MemberReferenceRecord) GetRecordType() int

func (MemberReferenceRecord) ToRecordBin added in v1.45.0 

func (memberReferenceRecord MemberReferenceRecord) ToRecordBin() (string, bool)

type MemberTypeInfo added in v1.45.0 

type MemberTypeInfo struct {
	BinaryTypeEnums []int
	BinaryTypes     []string      // for convenience
	AdditionalInfos []interface{} // NOTE: usage not yet implemented, will do so when needed
}

func (MemberTypeInfo) ToBin added in v1.45.0 

func (memberTypeInfo MemberTypeInfo) ToBin() (string, bool)

type ObjectNullRecord added in v1.45.0 

type ObjectNullRecord struct{}

func (ObjectNullRecord) GetRecordType added in v1.45.0 

func (objectNullRecord ObjectNullRecord) GetRecordType() int

func (ObjectNullRecord) ToRecordBin added in v1.45.0 

func (objectNullRecord ObjectNullRecord) ToRecordBin() (string, bool)

type Primitive added in v1.45.0 

type Primitive interface {
	PrimToString() string
}

type PrimitiveByte added in v1.45.0 

type PrimitiveByte byte

func (PrimitiveByte) PrimToString added in v1.45.0 

func (me PrimitiveByte) PrimToString() string

type PrimitiveInt16 added in v1.45.0 

type PrimitiveInt16 int

func (PrimitiveInt16) PrimToString added in v1.45.0 

func (me PrimitiveInt16) PrimToString() string

type PrimitiveInt32 added in v1.45.0 

type PrimitiveInt32 int

func (PrimitiveInt32) PrimToString added in v1.45.0 

func (me PrimitiveInt32) PrimToString() string

type Record added in v1.45.0 

type Record interface {
	GetRecordType() int
	ToRecordBin() (string, bool)
}

type SOAPEnvelope added in v1.45.0 

type SOAPEnvelope struct {
	XMLName xml.Name `xml:"SOAP-ENV:Envelope"` // Specify the XML name with namespace
	Body    Body     `xml:"SOAP-ENV:Body"`     // Nested struct for Body

	Xsi           string `xml:"xmlns:xsi,attr"`
	Xsd           string `xml:"xmlns:xsd,attr"`
	SoapEnc       string `xml:"xmlns:SOAP-ENC,attr"`
	SoapEnv       string `xml:"xmlns:SOAP-ENV,attr"`
	Clr           string `xml:"xmlns:clr,attr"`
	EncodingStyle string `xml:"SOAP-ENV:encodingStyle,attr"`
}

SOAP Formatter types and funcs.

type SerializationHeaderRecord added in v1.45.0 

type SerializationHeaderRecord struct {
	HeaderID int
	RootID   int
}

func (SerializationHeaderRecord) GetRecordType added in v1.45.0 

func (serializationHeaderRecord SerializationHeaderRecord) GetRecordType() int

func (SerializationHeaderRecord) ToRecordBin added in v1.45.0 

func (serializationHeaderRecord SerializationHeaderRecord) ToRecordBin() (string, bool)

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nrbf/a7e578d3-400a-4249-9424-7529d10d1b3c

type SystemClassWithMembersAndTypesRecord added in v1.45.0 

type SystemClassWithMembersAndTypesRecord struct {
	ClassInfo      ClassInfo
	MemberTypeInfo MemberTypeInfo
	MemberValues   []interface{}
}

func (SystemClassWithMembersAndTypesRecord) GetRecordType added in v1.45.0 

func (systemClassWithMembersAndTypesRecord SystemClassWithMembersAndTypesRecord) GetRecordType() int

func (SystemClassWithMembersAndTypesRecord) ToRecordBin added in v1.45.0 

func (systemClassWithMembersAndTypesRecord SystemClassWithMembersAndTypesRecord) ToRecordBin() (string, bool)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.