ÿØÿà JFIF    ÿÛ „ !.%+&8&+/1555$;@;4?.451 4,$,44444444444414444444444444444444444444444444444444ÿÀ  á á" ÿÄ     ÿÄ ?    !1AQaq"2‘¡±ÁðBRbrÑá#‚’¢²3S CñÿÄ   ÿÄ !    !1QAa‘2ÿÚ   ? 5˜Z¯V¦cø)›t/? z¨±>Õ5€¶‹Á¤·¼z¼Ü¬+ñ®v¤¨_ˆR­BFn©—˜ý®ç̝P8gýt·ÉSTŦˆìät?þé¼íìN/Þa)ì–í6ô… Ï¿øÃj´¿KÇü]ÿ ªô¹-eKànëÕHTx}ýSÜ›ÿ ”7Ø×&µ<¦  ¥ÑO¶[Ù¯ä¨ÞÃÿ PZ-¬;#õ|•oaÿ ©CìÞz3˜öː/¤­ñTûIØ}š^ mÓ%ªxˆ¥ÉŸu=Z+ISe¿45™¼u;ú&WØ÷€æßQ™®{|íx*TC“#ZŠìZ§²‹ 6pv…³¿¡äª*áZÐ%ÒOáˆo"x«OHk w±æ+¬V(kMúŸ5Vö«$ ÁrÏbàb57/luR ¸ÑÛj Òµì`Ðœq­û žICÀÊ•©4€Âcà¨Ï€O´<èÐ:›ù(Ë^L8þ‘ÍÌ#¸Ð_Ì©ÙK(Öz 4¬û+¸;ü’V’84‘¬ÃŽ:[â‡ÔÌáõp¢~§ªlæ£ö{®G>J¼"°‡7¯ÆÉèßû ‹É‹§ÁòÃýâßî ^ƾÙõ‹×óH#«LP½ïX=xÑÍ$|W?•~• îëÔ©ª‹ {ÝT…Kÿ ”hûâá)J*ö˜–ÔU;iÇ€/ ÆþjóZ\ýwØ=Ìm ºèËL9 ýèÆð/¨’¥öo=nË.%Îì ŽÕ¯È|{Oj²ƒE6e/ßdÄõ²Ìâ1O®ò×TsəԸhOMýíMˆ¿¼H˜l²,7Â¥#MF/Úf°Ö½± ¸–dr‹NýÊ íjqx{œÉ ä-È ¦ øÄër¨q°ð †nцýÑÄÆ’mä…n<0È™;ÁÝá¯ÁZƒ7FÀmì­ É&9ˆîéi¶ùN§Y• ÃZãAâ?•‡©‰ , ó¾IŸŠc1 4â&y­&pŠ­6;M À 0¹qç»p.á …ŸÅáK@%6·y6ƒ‰3?”úºŽ‰éX5ªPT §µ!=Mž«Ú½‹ÅgÂSâÉaþÓoö–¯ÁÔìR>5éÿ üs¶ÆUcÌ kÇR ]ÿ ù¬¼«VŽ;Â|‡~¢¦”ÏÅ°æ {L™Õ°Óv¹ò¸írŽ¡×¢CÃ!íVÕ {¶»sŒNPg/ "uÕbkm²“$ďå¿é¹§°½æz¯6 †s¿!s–wÚÝ“™Œ °.ûj>·+™Òa…©Œ&rÝÎtÛë긪Ît’LAVp%c Úý[ÄzJ¾ÇàXXç@˜ó<êL]·T˜¾¥1Ó©V‡g´æ½¦Ý@¹óø!_@´ÞâSÁ —S3™•& ]@JHÚý©ZŽ €×æÔr»Áf!‡yÞ4Mv*èÓã_{‘åóUuљØ«Oïé*®EvÑ Œ÷‡U \"㪒ÍK+À 4“M¡ï:0¥5í!'<@î´”>Ç»&Z–ïCCV˜Ì5Šo&îhè.žû |ÓK©h$s6KìŒëã)¹hI¦GïOåóI;ììü#É$Š0…Ææ¥TØ.5­¾gn´ “ÂÖ\:hœ89G)J@„}œ:’Ò{/Š"¦_Æ×7Æ3VÇŠÊa]ÚŒÙ€Ä–=®uÁßâACZƒ§§£ Qnâ:«,×{tyø¬iÛcœÜÄ€H½ÄÍCk´÷šß .W'b¤Íåh]÷€=,Žv×cÚEÚHXJX¶îo¨FÒtèöŸ>ªª6[J®Fµ£sGÁeqõfe\íjÒÐïÄÐGˆe1Ø‹.Ø”‘Ëuø Y­ˆÜ ŽG|zùªüMpDnQWÄ”%JŠ™)â*p@Örš«ÕT2Ð%ˆG#ª„ ·¤!°ŸOTÂT¸aÚ%4&h™LµšØüÐ.F¿²ÐÞ_Ç‚¾ÅÃaÜ÷09Æ q€öy˜v‡85õN÷]¬äѼóS{°_MŽ¬úÔ#°Ç¸0åÞè2ëôPcvÆw9®ií1Ä8F™˜à‰´+‰Ik1òÝ7“Ñ×ÒsÝ\x‚h`ÞÑ`ó"|µEcý£n˜h`}GÞ !±ù²Ápü²ß6 0ïi󜵩SÈÇ7˜-ÕURO˜¦´f$ªž-Í6(œ}<„ éc øs]ŽŽ„*—¾ ìdŽ„)méª\¿êÎIg¾ØÞ~I#C/¼¼´EÁÈŽi8“©õådô·>euä ƒ'Ê×लR1ÉJE1ÐAát`t;ÇР%Ý<‡¥„ÍÆ`×Oyó)õiI€ñQaŸ4Ûù\áàaÃÔ¹HÃu¹*k€¦<„e S‡&õÏ B!ŽhüÞ`yj}mªf×\¿ Ç~æ­9‡û\՞Ǖg²1Žû5V7 !àöšm° c`ܬøÇìµÒ'P"?…´Ö,"§^•õŽ¨sÔ)6˜sæéÍR¼ ò|Sl”‹7 nPW Gòú÷½§O¯‡„l¡kSÞŒr½PÊ@æ¢pŽ-mÿ #Ÿ˜Àº¶Áä¦;ïÔæ$1££`“Õ>„—·ž)ßð³ñ#Ï Ô$¶œ‰ÊE‹À;÷º ¯«P:Ñ”8–IÊtpÞ3ª“>ê“þës4ò2OÏÕ­±zô†Õ§‰.÷ä¸;¿˜“'œ›žª}«Œ{ª±Ì 9ÔóÞÕ‡0 $íWV3Üì¬ —@kÝ4@¿r¼±½¬™›?øØæ´'Áé®CË3-g$˜ö‡×auÚi´Žp/êÛ æF›Ú2v‹ã¿¿,nB1̨ƃqÞa5͝@&Æû“él÷ \C²½UÍc ¯k×¢U ÖéQå™—-r wô ÞÏ<Ò=&=ÿ Ôê Òêˈt,i—;LîÜ á¸*ÚÃ1$êL•LÍ <É)ýÐà’ ;F™{ƒ™˜€&'}‚ãÄK`¡ÞT@I;®žZóè‚s’7®°›+§O­Åq©é»²9<Ô J ¼9O’HL»Ùïì¸rk¼Ž_ý‘TŸu[²ßÚŒ·ü÷B%¯E ŸÔX5êO´ Ç•€’I0 ÉJX` ñ¹õ%;µŸD‘«´€àwÒ™U ûئžÖö\×®×´8 ½‡ºÐÆÓ§?Àkmœ=;d5*@-ì0F Rªýš[Ü6âö̃ڸr*KA9· u*µæ£?U¸Âêí†8@¦X4 e-ò„0s{ HâUpU?¼mñRa°®a%Ð'tÉ×’\¾ÊÉ]t›h>·(Ë@R¼¡Ãt h}’O÷au<+nT…Ö…MӐ??Óe95 q>í/;&JSû °¯ÊéÞ øƒ*Ã2½Ài&:nôUl=¾¿5eˆ3”ñc|Ú2V”>„»&eE;«ÚäC p¢Û úy 9š[ŒÌx¼擼A&DåÒ¯ˆ¤ÀÌ;"˜ ÏQä¸åhÊ}Ûq«Û0WžÒ|»€ø®öCm5•\ÇÀ§Pe3£]0ÃàLDÉ‰1øªxjgwT‚÷¿LΨK‹›ùs—xˆÜ±µ kæ¸f‰‰ÜGk/LÛØ6d9ò¶ùA{ƒA3š/¬D¬khÓk‰`˜"㯒r¿±Óã jx‡°e}<Ñø\3y:'À•/h½Í€Ç4~g ?Û(¼]v‘ªlKÎâ~?O‚W%{Ì:“'©úNq¾›úo(X’¥¯ˆ nFê{Ç€ü?º'ë ø‹ì Þ09ŒÌç9Æ —ËC`j@ÓÄ(+a‹un¸#ÂꟋ{K`‘ÑÍÍ'à´»/Û,KW;Þ4²þð ï Nm|~fGÏ(…³Ã)«1ö­Õ ¥‡¨©ƒÃ™ü-s=à=U66Ï«Ýc蓦W¹íž®›nÔ%êÇìŒ<#Ü×84ån®Ð ÒåOC` ñânÑs‡¢ç 1õ%Îhì½Ã½® e:ݼUZo™`  ÅZŸŒÊ«ê1ÏÄo$q¹Þ€©ˆhÐÉä¯ñ[!…Ú˜àJ:x2$Íß&PåT£6ç— ‡Í*4Ýšçjÿ ‰É nófÐ ó(L5C•åÆ\rMÒ@ò }y-W}™üýVù—ú¢=Ù”c®‘< M ž ´Phr ¦©TD ‘ù.$´÷O‡‘V2Æò.=IUŒ=ž‡â¬i™aþÓåÙ?òUø'ØÖ•.~* šTŒ!•-×áºTâ®ä#õü'´ eýlYÅÓeÕKÂrT"CÚ@u!Óxƒ{š3€}1¿(r}%«nËamjÑ%ÑNEò v ˜à  σöK³,*º.àzù¨™Ó ÚçâU¦*¿ 9{%Ö¹ njûdaXöb) kÛƱûÓ\°M7ˆÂ=û›ç¿Ã‚­V»Cg–8ÙêE- j)k$º`Ã-ùEýeBÆÇ]c¡°ñty&Òd0nõ'¡W+ƒ*|–øµFa\GQªEAÔp5\Ǽ·¼Ç8·õ -â§Ú[ ‡ uZeÖ 3}×d'+¹:ð+K†Û®s!Ï$úe€<Û”x)1»a­¡LC]¸µík…ÚàA»AYº{†ªS[¦5HÒ7ù --,ísòDØ€èk ÞÀîÜ ò@â( ËNˆë›4ô½•/¦o‡€Û7 ê•ÆêòðÜy'Án½µ á˜ݦ ndeo…[ì¶Ê,¥R³Ä=À±—–ß;£™´ñSâ*g§”ïaið‘Jå~™ÓÞ ß³Õ¢»8x埒²52>AÊb&-÷\7´éÄù€T˜,w;3{ï˜k…à¹ÄqÀ«œ{€\ ˆ¾[´¨јr &Úé„Ívˆ±8†¿]|¬ņ4I×pÞS1ÈÖz‰#Ìv‡G!YNògñ:màTz¢Ý1ô©^O=~ë|5Bã™ç•¼µõ•bÆ@úÕS¬ÈŒ#¬zünrŸ û” Z²•ï›èðV"ÁHÚý©wÝ €7¼Ìu1hÑa3Éä û f$o¿É ™Ú›ÝçnpÒ3äÌ3†Í§,Äï]$‰/pê †«À¼¸e9­Æê_C]žƒ·ý·frÁN«, E=›Çq -‰öŒ:aÏ¿±í&£Í:-} 84‘ÿ eƒQÑeëSsuiA ³g㟥ú£?ÿ ʼn*”“÷aühe:ÊWa@ÒÞk±eØ] F Ô—r.åä˜ @ö¥ªZoÐýYL·¥S²G/‡ñ <~*ZÆ´è>JlòàÛƽÿ 窘ìGN¢:I®KšJp/`íIÁÀõ#Ä-€ö­šµŒoF4|ÆQØÆ@Ì|£Ô…¢À{9˜è½Üó›€ôYÒÎYsið;ís¤€à²ˆ‚4qÉVŒI$ ‰"° æµ8cXGjœˏ¡Aâý•ËÜ¢ûï e·çLx']á"oÅÎê3¯Ç—¹”ó0nå‚âg{Œñ> S´˜îè°g238‚ãköÝfÚd´6Ò€;ò÷±¢™¼›º ¢Æ'¥Ðx'e¬ç ]bÈÆV¢ó‹kýBO ðÊâ$Ÿ!×T 3Mýמ žìٍàÌü‘8÷€àæØ8æ©6‰©L´«…oãpð„~Çk‰!ñ;‹”ÛžÍ àž±z Ÿôû øŸÝužÏ;ÿ #|u6™Þ¬ÚˆÐõA4¶â|ôl|Ê2ŽÇ¤ÝÅÇY.<#Aí.k§hóF‚”Y; M½Ö4hŸ4&›­¿tès´%FìL¥£Ãk‰ÇT¤haÁ¤ÚxfÉ`ÑìË›>i 3t‚:,–+^÷´–{Û–Nxi"x‘Ûg î¨>¥Õ܁ùZH,2Û“:8xÊ¢Çí9.É-Ìâã-=çjwµS˜dütžçwýGòú®®ûº_ˆýx$–¡ãøO EÚÛÏ÷R„×w+3£Á£öUMyR²¹âŒ°š›¸Ñãò9§Ó_Dl+Ùßc›úšGÅÌc†Ž!Ko=¶.‘Îÿ c²(2®V mª.ÿ ¹B›¹å ù„öŸSV>™ü¯$y:G¢Z×àøúdî¹û­·ýÇ´:•c LÍõi_‹ö+ÎæGÊè>OŠ•äž´§Þ{X}¨1ÚTc›»Qþ•êô°t¿OP?eæ~É{5]•ÙR£r5†nZ\ã@ &îJõ ¾àC°þV>fé¥/ü5ñÊIº_é5 ;e­h<@ Ä&æÃëE%;X,ÒãÆÞ`Oò¦kŸm#˜!ÀyÄ¢| óLšò¥Ä` ¶R=|ÈCâh5ò3DˆïF†ðÒ#ÅìÛœ?¸yhBãœí ZxßÎÄhºRK„`Þödvײ™ÀÈÑÒgŒuY w³%†ƒÓzõ ÖÏp‚dH®¦A´ù§»ÓÇMæ~)ˆð‡û:ù&Ä •vGD´À n ݇¼Ö8Fö óáà£~Ë¥x`oK|Ä?fxiØü%pìR>éò+Û±éÎ>núlFŤ'tq8LZÏvÃ?„¡ß±È⽆¯³íü@x|PöUäèØã¡ð‚ŒAìÏ"vÍwóŸÍ{ ý0.z È•Ö{,N¡£¡ŸKÕÙž>Ýœþ ÍÀ°<×EA!Å‚D™IúOÍ¡>ôG}Â` ÍßkÜL™Ž Þð™ {IøF²¹òQ3&!ÃÂÞz.d&Ï-sH¸,Ôõ˜ŽP€ 77ˆÝ¼ÊëÜw =cÕ Ú,ØÐ5ÎYÐ)ì´öœgŒ[¤ßv㙑8心>h]§µháYš£²ºÑ.{Ï7Sð•?´~×SÃKýJÛ˜ ™Íäiúu<µX¶1õ^kâçIÑ£sZ4h>j*ÔšD:4­¿_ ÷¸ Õxæÿ ¸?Mù _•­ÊÐ ä ÷ý ÑwL œ­ïnTkÛUÍN©ë:¦fV ¶ÜÔÜMªÅâA½–¿R×TXš-%iTÊT•‡Ù‚JôϐZxWÑè‰f‰òG º ×Õû2aZ7OU3[“×AT–ÞŒ…-‘¤”Ì ì&(ˆ¿­•ƒkï’:ðY¦W‘ Å)“†‘˜³Åtcø˜ñTÂwÚÇ4|üLÇªí–v- qˆèU qPE.†â‘˜µ Æ,ÐÅs]8¾„oúÑ i>ÜxxÈó)ƒ ´æÁâØ$À‰vžŸf$Ž |ãw;ÀÁIJ»b` {¦Ó¤Ú$©YÀ‘n@Óïž«9J¼êG m¤ ܯ¹ÌW4€ÐÒÅÛ‡#褕Ÿn-?í|с¥÷Ú¹¬'´ÞÜ9ÓK `hê£SÄSà?7—Wí_´…óB›»:=Ãïq`<8ñÓŒÑlú2d¬ê³£hÖ[l|$vÝro~'R®‰§°ñmY ͧäP |PUª¹·:3Œ[Û{Xÿ ºâ@‚W–Äé u‚ ¯´*=íή.pûÒdt @G‰¬ s¸ ëÉücr ÞæѨÊ@>¤¢Ö±. Þ'¯°ÌME[YéïĵÂCå½ Ué©Áû'Ê9%eÔðNU”ë‘ÌsD3/®+UI˜9h.WC”빓$#:pz:YÓ ¿xž* ³$Í +$kñAŠ‹†¢ Uê>¸)_š¬÷©ßAÂÔb9ÇU ¯¾á•9¯ÏÏ÷O÷¼¼Fähal1‰3Ì[Ïr•´UCksNÐ] R‘¸¥H+§Šé†c©vÖÞ0iÓ76s†î!§=ß ¼~Ô'°Ãmäoäš³ªøi1úÉ)³yV8 CLÄØÁ‘WYïi€H6ÖÑiámø^ÈY´°Ñ7¥Û*—Ñ©L«Qƒï—Ùrÿ ›£Ð*š¸ˆL©ˆ$ˆ ÷¾D§9È®«qbqC)–ˆïv´çñsÑVT­Ø, <àïºÀO«Jý·õ àfPìð .wFšir´þ’2_Y *Æ€x\« ì€9š@ Ž|F⇥ˆkZ@hÖÄ0t¿-<“‹qµ¾*ZL¤Ú)&BJpÓF5=$„at*Zš$’ÑtdûÝRI1 2Ž‰$€$I$#‰SÞ’Hë¬ï;Á$¡t$’`<(ñÇt)$‡Ð.Êf¢X’Kt=Éé$‚ˆªè¢oÝëòI%Rgcª÷ŠyI%¡‰ÿ !ñ)´õ $¤ Ô’IIGÿÙ--- -- This module is designed to parse the PERF_DATA_BLOCK structure, which is -- stored in the registry under HKEY_PERFORMANCE_DATA. By querying this structure, you can -- get a whole lot of information about what's going on. -- -- To use this from a script, see get_performance_data, it is the only -- "public" function in this module. -- -- My primary sources of information were: -- * This 1996 journal by Matt Pietrek: -- * The followup article: -- * The WinPerf.h header file -- -- And my primary inspiration was PsTools, specifically, pstasklist.exe. -- --@author Ron Bowes --@copyright Same as Nmap--See https://nmap.org/book/man-legal.html ----------------------------------------------------------------------- local msrpc = require "msrpc" local msrpctypes = require "msrpctypes" local stdnse = require "stdnse" local string = require "string" _ENV = stdnse.module("msrpcperformance", stdnse.seeall) ---Parses the title database, which is a series of null-terminated string pairs. -- --@param data The data being processed. --@param pos The position within data. --@return (status, pos, result) The status (true if successful), the new position in data (or an error -- message), and a table representing the datatype, if any. local function parse_perf_title_database(data, pos) local result = {} local i = 1 repeat local number, name number, name, pos = string.unpack("= #data return true, pos, result end ---Parses a PERF_DATA_BLOCK, which has the following definition (from "WinPerf.h" on Visual Studio 8): -- -- -- typedef struct _PERF_DATA_BLOCK { -- WCHAR Signature[4]; // Signature: Unicode "PERF" -- DWORD LittleEndian; // 0 = Big Endian, 1 = Little Endian -- DWORD Version; // Version of these data structures -- // starting at 1 -- DWORD Revision; // Revision of these data structures -- // starting at 0 for each Version -- DWORD TotalByteLength; // Total length of data block -- DWORD HeaderLength; // Length of this structure -- DWORD NumObjectTypes; // Number of types of objects -- // being reported -- LONG DefaultObject; // Object Title Index of default -- // object to display when data from -- // this system is retrieved (-1 = -- // none, but this is not expected to -- // be used) -- SYSTEMTIME SystemTime; // Time at the system under -- // measurement -- LARGE_INTEGER PerfTime; // Performance counter value -- // at the system under measurement -- LARGE_INTEGER PerfFreq; // Performance counter frequency -- // at the system under measurement -- LARGE_INTEGER PerfTime100nSec; // Performance counter time in 100 nsec -- // units at the system under measurement -- DWORD SystemNameLength; // Length of the system name -- DWORD SystemNameOffset; // Offset, from beginning of this -- // structure, to name of system -- // being measured -- } PERF_DATA_BLOCK, *PPERF_DATA_BLOCK; -- -- --@param data The data being processed. --@param pos The position within data. --@return (status, pos, result) The status (true if successful), the new position in data (or an error -- message), and a table representing the datatype, if any. local function parse_perf_data_block(data, pos) local result = {} pos, result['Signature'] = msrpctypes.unicode_to_string(data, pos, 4, false) if(result['Signature'] ~= "PERF") then return false, "MSRPC: PERF_DATA_BLOCK signature is missing or incorrect" end pos, result['LittleEndian'] = msrpctypes.unmarshall_int32(data, pos) if(result['LittleEndian'] ~= 1) then return false, "MSRPC: PERF_DATA_BLOCK returned a non-understood endianness" end -- Parse the header pos, result['Version'] = msrpctypes.unmarshall_int32(data, pos) pos, result['Revision'] = msrpctypes.unmarshall_int32(data, pos) pos, result['TotalByteLength'] = msrpctypes.unmarshall_int32(data, pos) pos, result['HeaderLength'] = msrpctypes.unmarshall_int32(data, pos) pos, result['NumObjectTypes'] = msrpctypes.unmarshall_int32(data, pos) pos, result['DefaultObject'] = msrpctypes.unmarshall_int32(data, pos) pos, result['SystemTime'] = msrpctypes.unmarshall_SYSTEMTIME(data, pos) pos, result['PerfTime'] = msrpctypes.unmarshall_int64(data, pos) pos, result['PerfFreq'] = msrpctypes.unmarshall_int64(data, pos) pos, result['PerfTime100nSec'] = msrpctypes.unmarshall_int64(data, pos) pos = pos + 4 -- This value doesn't seem to line up, so add 4 pos, result['SystemNameLength'] = msrpctypes.unmarshall_int32(data, pos) pos, result['SystemNameOffset'] = msrpctypes.unmarshall_int32(data, pos) -- Ensure that the system name is directly after the header. This technically shouldn't matter, but Microsoft's documentation -- (in WinPref.h) says that the actual object comes "after the PERF_DATA_BLOCK", so it doesn't make sense that the SystemName -- could be anywhere else. if(pos ~= result['SystemNameOffset'] + 1) then return false, "MSRPC: PERF_DATA_BLOCK has SystemName in the wrong location" end -- Read the system name from the next location (which happens to be identical to SystemNameOffset, on a proper system) pos, result['SystemName'] = msrpctypes.unicode_to_string(data, pos, result['SystemNameLength'] / 2, true) pos = pos + 4 -- Again, we end up not lined up so here we fix it return true, pos, result end ---Parse a PERF_OBJECT_TYPE structure. From Microsoft's documentation: -- -- -- // -- // The _PERF_DATA_BLOCK structure is followed by NumObjectTypes of -- // data sections, one for each type of object measured. Each object -- // type section begins with a _PERF_OBJECT_TYPE structure. -- // -- typedef struct _PERF_OBJECT_TYPE { -- DWORD TotalByteLength; // Length of this object definition -- // including this structure, the -- // counter definitions, and the -- // instance definitions and the -- // counter blocks for each instance: -- // This is the offset from this -- // structure to the next object, if -- // any -- DWORD DefinitionLength; // Length of object definition, -- // which includes this structure -- // and the counter definition -- // structures for this object: this -- // is the offset of the first -- // instance or of the counters -- // for this object if there is -- // no instance -- DWORD HeaderLength; // Length of this structure: this -- // is the offset to the first -- // counter definition for this -- // object -- DWORD ObjectNameTitleIndex; -- // Index to name in Title Database -- #ifdef _WIN64 -- DWORD ObjectNameTitle; // Should use this as an offset -- #else -- LPWSTR ObjectNameTitle; // Initially NULL, for use by -- // analysis program to point to -- // retrieved title string -- #endif -- DWORD ObjectHelpTitleIndex; -- // Index to Help in Title Database -- #ifdef _WIN64 -- DWORD ObjectHelpTitle; // Should use this as an offset -- #else -- LPWSTR ObjectHelpTitle; // Initially NULL, for use by -- // analysis program to point to -- // retrieved title string -- #endif -- DWORD DetailLevel; // Object level of detail (for -- // controlling display complexity); -- // will be min of detail levels -- // for all this object's counters -- DWORD NumCounters; // Number of counters in each -- // counter block (one counter -- // block per instance) -- LONG DefaultCounter; // Default counter to display when -- // this object is selected, index -- // starting at 0 (-1 = none, but -- // this is not expected to be used) -- LONG NumInstances; // Number of object instances -- // for which counters are being -- // returned from the system under -- // measurement. If the object defined -- // will never have any instance data -- // structures (PERF_INSTANCE_DEFINITION) -- // then this value should be -1, if the -- // object can have 0 or more instances, -- // but has none present, then this -- // should be 0, otherwise this field -- // contains the number of instances of -- // this counter. -- DWORD CodePage; // 0 if instance strings are in -- // UNICODE, else the Code Page of -- // the instance names -- LARGE_INTEGER PerfTime; // Sample Time in "Object" units -- // -- LARGE_INTEGER PerfFreq; // Frequency of "Object" units in -- // counts per second. -- } PERF_OBJECT_TYPE, *PPERF_OBJECT_TYPE; -- -- --@param data The data being processed. --@param pos The position within data. --@return (status, pos, result) The status (true if successful), the new position in data (or an error -- message), and a table representing the datatype, if any. local function parse_perf_object_type(data, pos) local result = {} pos, result['TotalByteLength'] = msrpctypes.unmarshall_int32(data, pos) -- Offset to the next object pos, result['DefinitionLength'] = msrpctypes.unmarshall_int32(data, pos) -- Offset to the first instance (or counter, if no instances) pos, result['HeaderLength'] = msrpctypes.unmarshall_int32(data, pos) -- Offset to the first counter definition pos, result['ObjectNameTitleIndex'] = msrpctypes.unmarshall_int32(data, pos) -- Index in the Title Database pos, result['ObjectNameTitle'] = msrpctypes.unmarshall_int32(data, pos) -- TODO: will this work with 64-bit? pos, result['ObjectHelpTitleIndex'] = msrpctypes.unmarshall_int32(data, pos) -- Index in the Help Database pos, result['ObjectHelpTitle'] = msrpctypes.unmarshall_int32(data, pos) -- TODO: will this workw ith 64-bit? pos, result['DetailLevel'] = msrpctypes.unmarshall_int32(data, pos) pos, result['NumCounters'] = msrpctypes.unmarshall_int32(data, pos) -- The number of counters in each counter block pos, result['DefaultCounter'] = msrpctypes.unmarshall_int32(data, pos) pos, result['NumInstances'] = msrpctypes.unmarshall_int32(data, pos) -- Numer of object instances for which counters are being returned pos, result['CodePage'] = msrpctypes.unmarshall_int32(data, pos) -- 0 if strings are in UNICODE, otherwise the Code Page -- if(result['CodePage'] ~= 0) then -- return false, string.format("Unknown Code Page for data: %d\n", result['CodePage']) -- end pos, result['PerfTime'] = msrpctypes.unmarshall_int64(data, pos) -- Sample time in "Object" units pos, result['PerfFreq'] = msrpctypes.unmarshall_int64(data, pos) -- Frequency of "Object" units in counts/second return true, pos, result end ---Parse a PERF_COUNTER_DEFINITION structure. From Microsoft's documentation: -- -- -- // There is one of the following for each of the -- // PERF_OBJECT_TYPE.NumCounters. The Unicode names in this structure MUST -- // come from a message file. -- typedef struct _PERF_COUNTER_DEFINITION { -- DWORD ByteLength; // Length in bytes of this structure -- DWORD CounterNameTitleIndex; -- // Index of Counter name into -- // Title Database -- #ifdef _WIN64 -- DWORD CounterNameTitle; -- #else -- LPWSTR CounterNameTitle; // Initially NULL, for use by -- // analysis program to point to -- // retrieved title string -- #endif -- DWORD CounterHelpTitleIndex; -- // Index of Counter Help into -- // Title Database -- #ifdef _WIN64 -- DWORD CounterHelpTitle; -- #else -- LPWSTR CounterHelpTitle; // Initially NULL, for use by -- // analysis program to point to -- // retrieved title string -- #endif -- LONG DefaultScale; // Power of 10 by which to scale -- // chart line if vertical axis is 100 -- // 0 ==> 1, 1 ==> 10, -1 ==>1/10, etc. -- DWORD DetailLevel; // Counter level of detail (for -- // controlling display complexity) -- DWORD CounterType; // Type of counter -- DWORD CounterSize; // Size of counter in bytes -- DWORD CounterOffset; // Offset from the start of the -- // PERF_COUNTER_BLOCK to the first -- // byte of this counter -- } PERF_COUNTER_DEFINITION, *PPERF_COUNTER_DEFINITION; -- -- --@param data The data being processed. --@param pos The position within data. --@return (status, pos, result) The status (true if successful), the new position in data (or an error -- message), and a table representing the datatype, if any. local function parse_perf_counter_definition(data, pos) local result = {} local initial_pos = pos pos, result['ByteLength'] = msrpctypes.unmarshall_int32(data, pos) pos, result['CounterNameTitleIndex'] = msrpctypes.unmarshall_int32(data, pos) pos, result['CounterNameTitle'] = msrpctypes.unmarshall_int32(data, pos) pos, result['CounterHelpTitleIndex'] = msrpctypes.unmarshall_int32(data, pos) pos, result['CounterHelpTitle'] = msrpctypes.unmarshall_int32(data, pos) pos, result['DefaultScale'] = msrpctypes.unmarshall_int32(data, pos) pos, result['DetailLevel'] = msrpctypes.unmarshall_int32(data, pos) pos, result['CounterType'] = msrpctypes.unmarshall_int32(data, pos) pos, result['CounterSize'] = msrpctypes.unmarshall_int32(data, pos) pos, result['CounterOffset'] = msrpctypes.unmarshall_int32(data, pos) pos = initial_pos + result['ByteLength'] return true, pos, result end ---Parse the actual counter value. This is a fairly simple function, it takes a counter -- definition and pulls out data based on it. -- -- Note: I don't think this is doing the 8-byte values right, I suspect that they're supposed -- to be doubles. -- --@param data The data being processed. --@param pos The position within data. --@param counter_definition The matching counter_definition. --@return (status, pos, result) The status (true if successful), the new position in data (or an error -- message), and a table representing the datatype, if any. local function parse_perf_counter(data, pos, counter_definition) local result if(counter_definition['CounterSize'] == 4) then pos, result = msrpctypes.unmarshall_int32(data, pos) elseif(counter_definition['CounterSize'] == 8) then pos, result = msrpctypes.unmarshall_int64(data, pos) else pos, result = msrpctypes.unmarshall_raw(data, pos, counter_definition['CounterSize']) end return true, pos, result end ---Parse a PERF_INSTANCE_DEFINITION structure. From Microsoft's documentation: -- -- -- // If (PERF_DATA_BLOCK.NumInstances >= 0) then there will be -- // PERF_DATA_BLOCK.NumInstances of a (PERF_INSTANCE_DEFINITION -- // followed by a PERF_COUNTER_BLOCK followed by the counter data fields) -- // for each instance. -- // -- // If (PERF_DATA_BLOCK.NumInstances < 0) then the counter definition -- // structure above will be followed by only a PERF_COUNTER_BLOCK and the -- // counter data for that COUNTER. -- typedef struct _PERF_INSTANCE_DEFINITION { -- DWORD ByteLength; // Length in bytes of this structure, -- // including the subsequent name -- DWORD ParentObjectTitleIndex; -- // Title Index to name of "parent" -- // object (e.g., if thread, then -- // process is parent object type); -- // if logical drive, the physical -- // drive is parent object type -- DWORD ParentObjectInstance; -- // Index to instance of parent object -- // type which is the parent of this -- // instance. -- LONG UniqueID; // A unique ID used instead of -- // matching the name to identify -- // this instance, -1 = none -- DWORD NameOffset; // Offset from beginning of -- // this struct to the Unicode name -- // of this instance -- DWORD NameLength; // Length in bytes of name; 0 = none -- // this length includes the characters -- // in the string plus the size of the -- // terminating NULL char. It does not -- // include any additional pad bytes to -- // correct structure alignment -- } PERF_INSTANCE_DEFINITION, *PPERF_INSTANCE_DEFINITION; -- -- --@param data The data being processed. --@param pos The position within data. --@return (status, pos, result) The status (true if successful), the new position in data (or an error -- message), and a table representing the datatype, if any. local function parse_perf_instance_definition(data, pos) local result = {} -- Remember where we started. I noticed that where the counter part starts can move around, so we have to -- determine it by adding ByteLength to the initial position local initial_pos = pos pos, result['ByteLength'] = msrpctypes.unmarshall_int32(data, pos) pos, result['ParentObjectTitleIndex'] = msrpctypes.unmarshall_int32(data, pos) pos, result['ParentObjectInstance'] = msrpctypes.unmarshall_int32(data, pos) pos, result['UniqueID'] = msrpctypes.unmarshall_int32(data, pos) pos, result['NameOffset'] = msrpctypes.unmarshall_int32(data, pos) pos, result['NameLength'] = msrpctypes.unmarshall_int32(data, pos) pos, result['InstanceName'] = msrpctypes.unicode_to_string(data, pos, result['NameLength'] / 2, true) pos = initial_pos + result['ByteLength'] return true, pos, result end ---Parse a PERF_COUNTER_BLOCK structure. From Microsoft's documentation: -- -- -- typedef struct _PERF_COUNTER_BLOCK { -- DWORD ByteLength; // Length in bytes of this structure, -- // including the following counters -- } PERF_COUNTER_BLOCK, *PPERF_COUNTER_BLOCK; -- -- -- --@param data The data being processed. --@param pos The position within data. --@return (status, pos, result) The status (true if successful), the new position in data (or an error -- message), and a table representing the datatype, if any. local function parse_perf_counter_block(data, pos) local result = {} pos, result['ByteLength'] = msrpctypes.unmarshall_int32(data, pos) return true, pos, result end ---Retrieve the parsed performance data from the given host for the requested -- object values. -- -- To get a list of possible object values, leave 'objects' blank and look at -- result['title_database'] -- it'll contain a list of indexes -- that can be looked up. These indexes are passed as a string or as a series -- of space-separated strings (eg, "230" for "Process" and "238" for "Process" -- and "Processor"). -- --@param host The host object --@param objects [optional] The space-separated list of object numbers to -- retrieve. Default: only retrieve the database. function get_performance_data(host, objects) -- Create the SMB session local status, smbstate = msrpc.start_smb(host, msrpc.WINREG_PATH) if(status == false) then return false, smbstate end -- Bind to WINREG service local status, bind_result = msrpc.bind(smbstate, msrpc.WINREG_UUID, msrpc.WINREG_VERSION, nil) if(status == false) then msrpc.stop_smb(smbstate) return false, bind_result end -- Open HKEY_PERFORMANCE_DATA local status, openhkpd_result = msrpc.winreg_openhkpd(smbstate) if(status == false) then msrpc.stop_smb(smbstate) return false, openhkpd_result end local status, queryvalue_result = msrpc.winreg_queryvalue(smbstate, openhkpd_result['handle'], "Counter 009") if(status == false) then msrpc.stop_smb(smbstate) return false, queryvalue_result end -- Parse the title database local pos = 1 local status local result = {} status, pos, result['title_database'] = parse_perf_title_database(queryvalue_result['value'], pos) if(status == false) then msrpc.stop_smb(smbstate) return false, pos end result['title_database'][0] = "" if(objects ~= nil and #objects > 0) then -- Query for the objects local status, queryvalue_result = msrpc.winreg_queryvalue(smbstate, openhkpd_result['handle'], objects) if(status == false) then msrpc.stop_smb(smbstate) return false, queryvalue_result end -- Parse the header pos = 1 local status, data_block status, pos, data_block = parse_perf_data_block(queryvalue_result['value'], pos) if(status == false) then msrpc.stop_smb(smbstate) return false, pos end -- Move past the header pos = 1 + data_block['HeaderLength'] -- Parse the data sections for i = 1, data_block['NumObjectTypes'], 1 do local object_start = pos local counter_definitions = {} local object_instances = {} local counter_definitions = {} -- Get the type of the object (this is basically the class definition -- info about the object instances) local status, object_type status, pos, object_type = parse_perf_object_type(queryvalue_result['value'], pos) if(status == false) then msrpc.stop_smb(smbstate) return false, pos end -- Start setting up the result object --stdnse.debug1("Index = %d\n", object_type['ObjectNameTitleIndex']) local object_name = result['title_database'][object_type['ObjectNameTitleIndex']] result[object_name] = {} --stdnse.debug1("\n\nOBJECT: %s\n", object_name) --stdnse.debug1(" Counters: %d\n", object_type['NumCounters']) --stdnse.debug1(" Instances: %d\n", object_type['NumInstances']) --stdnse.debug1("-----------------\n") -- Bring the position to the beginning of the counter definitions pos = object_start + object_type['HeaderLength'] -- Parse the counter definitions for j = 1, object_type['NumCounters'], 1 do status, pos, counter_definitions[j] = parse_perf_counter_definition(queryvalue_result['value'], pos) if(status == false) then msrpc.stop_smb(smbstate) return false, pos end --stdnse.debug1(" Counter definition #%2d: [%d bytes] %s\n", j, counter_definitions[j]['CounterSize'], result['title_database'][counter_definitions[j]['CounterNameTitleIndex']]) end -- Bring the position to the beginning of the instances (or counters) pos = object_start + object_type['DefinitionLength'] -- Check if we have any instances (sometimes we don't -- if we don't, the value returned is a negative) if (object_type['NumInstances'] & 0x80000000) == 0 then -- Parse the object instances and counters for j = 1, object_type['NumInstances'], 1 do local instance_start = pos -- Instance definition local status status, pos, object_instances[j] = parse_perf_instance_definition(queryvalue_result['value'], pos) if(status == false) then msrpc.stop_smb(smbstate) return false, pos end -- Set up the instance array local instance_name = object_instances[j]['InstanceName'] result[object_name][instance_name] = {} -- Bring the pos to the start of the counter block pos = instance_start + object_instances[j]['ByteLength'] --stdnse.debug1("\n INSTANCE: %s\n", instance_name) --stdnse.debug1(" Length: %d\n", object_instances[j]['ByteLength']) --stdnse.debug1(" NameOffset: %d\n", object_instances[j]['NameOffset']) --stdnse.debug1(" NameLength: %d\n", object_instances[j]['NameLength']) --stdnse.debug1(" --------------\n") -- The counter block local status, counter_block status, pos, counter_block = parse_perf_counter_block(queryvalue_result['value'], pos) if(status == false) then msrpc.stop_smb(smbstate) return false, pos end for k = 1, object_type['NumCounters'], 1 do -- Each individual counter local status, counter_result status, pos, counter_result = parse_perf_counter(queryvalue_result['value'], pos, counter_definitions[k]) if(status == false) then msrpc.stop_smb(smbstate) return false, pos end local counter_name = result['title_database'][counter_definitions[k]['CounterNameTitleIndex']] --stdnse.debug1(" %s: %s\n", counter_name, counter_result) -- Save it in the result result[object_name][instance_name][counter_name] = counter_result end -- Bring the pos to the end of the next section pos = instance_start + object_instances[j]['ByteLength'] + counter_block['ByteLength'] end else for k = 1, object_type['NumCounters'], 1 do -- Each individual counter local status, counter_result status, pos, counter_result = parse_perf_counter(queryvalue_result['value'], pos, counter_definitions[k]) if(status == false) then msrpc.stop_smb(smbstate) return false, pos end local counter_name = result['title_database'][counter_definitions[k]['CounterNameTitleIndex']] --stdnse.debug1(" %s: %s\n", counter_name, counter_result) -- Save it in the result result[object_name][counter_name] = counter_result end end end -- Blank out the database result['title_database'] = nil end msrpc.stop_smb(smbstate) return true, result end return _ENV;