googleprojectzero / sandbox-attacksurface-analysis-tools

Set of tools to analyze Windows sandboxes for exposed attack surface.
Apache License 2.0
2.05k stars 428 forks source link

Added methods to help decode NDR64 #74

Open hackett92 opened 8 months ago

hackett92 commented 8 months ago

Finished a project where I needed to decode NDR data with x64 bit pointer sizes. Most of the alignment issues could be fixed by consuming irrelevant data from the stream, however, peeking at the data makes things much more efficient and reliable, which explains the PeekBuffer method. This method reads the given length from the stream and puts the position back to where it was.

Another issue was when reading and aligning 64bit data, the size of a property within a struct was put on the _conformancevalues array, but was never read and removed from the stack afterwards. This caused issues when putting new items on the stack, since it performs a check if the stack is empty or not, skipping adding routine if the stack is not empty.

Added two methods:

google-cla[bot] commented 8 months ago

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.