1#@!#!123s

: / usr / share / nmap / nselib /
Filename : smb.lua
back
---
-- Implements functionality related to Server Message Block (SMB, an extension 
-- of CIFS) traffic, which is a Windows protocol.
--
-- SMB traffic is normally sent to/from ports 139 or 445 of Windows systems. Other systems
-- implement SMB as well, including Samba and a lot of embedded devices. Some of them implement
-- it properly and many of them not. Although the protocol has been documented decently 
-- well by Samba and others, many 3rd party implementations are broken or make assumptions. 
-- Even Samba's and Windows' implementations aren't completely compatible. As a result, 
-- creating an implementation that accepts everything is a bit of a minefield. Microsoft's
-- extensive documentation is available at the following URLs:
-- * SMB: http://msdn.microsoft.com/en-us/library/cc246231(v=prot.13).aspx
-- * CIFS: http://msdn.microsoft.com/en-us/library/ee442092(v=prot.13).aspx
--
-- Where possible, this implementation, since it's intended for scanning, will attempt to 
-- accept any invalid implementations it can, and fail gracefully if it can't. This has
-- been tested against a great number of weird implementations, and it now works against 
-- all of them. 
--
-- The intention of this library is to eventually handle all aspects of the SMB protocol.
-- That being said, I'm only implementing the pieces that I (Ron Bowes) need. If you 
-- require something more, let me know and I'll put it on my todo list. 
--
-- A programmer using this library should already have some knowledge of the SMB protocol, 
-- although a lot isn't necessary. You can pick up a lot by looking at the code. The basic
-- login/logoff is this:
--
-- <code>
-- [connect]
-- C->S SMB_COM_NEGOTIATE
-- S->C SMB_COM_NEGOTIATE
-- C->S SMB_COM_SESSION_SETUP_ANDX
-- S->C SMB_COM_SESSION_SETUP_ANDX
-- C->S SMB_COM_TREE_CONNECT_ANDX
-- S->C SMB_COM_TREE_CONNECT_ANDX
-- ...
-- C->S SMB_COM_TREE_DISCONNECT
-- S->C SMB_COM_TREE_DISCONNECT
-- C->S SMB_COM_LOGOFF_ANDX
-- S->C SMB_COM_LOGOFF_ANDX
-- [disconnect]
-- </code>
--
-- In terms of functions here, the protocol is:
--
-- <code>
-- status, smbstate = smb.start(host)
-- status, err      = smb.negotiate_protocol(smbstate, {})
-- status, err      = smb.start_session(smbstate, {})
-- status, err      = smb.tree_connect(smbstate, path, {})
-- ...
-- status, err      = smb.tree_disconnect(smbstate)
-- status, err      = smb.logoff(smbstate)
-- status, err      = smb.stop(smbstate)
-- </code>
--
-- The <code>stop</code> function will automatically call tree_disconnect and logoff, 
-- cleaning up the session, if it hasn't been done already.
-- 
-- To initially begin the connection, there are two options:
--
-- 1) Attempt to start a raw session over 445, if it's open.
--
-- 2) Attempt to start a NetBIOS session over 139. Although the 
--    protocol's the same, it requires a <code>session request</code> packet. 
--    That packet requires the computer's name, which is requested
--    using a NBSTAT probe over UDP port 137. 
--
-- Once it's connected, a <code>SMB_COM_NEGOTIATE</code> packet is sent, requesting the protocol 
-- "NT LM 0.12", which is the most commonly supported one. Among other things, the server's 
-- response contains the host's security level, the system time, and the computer/domain name. 
-- Some systems will refuse to use that protocol and return "-1" or "1" instead of 0. If that's 
-- detected, we kill the connection (because the protocol following won't work). 
--
-- If that's successful, <code>SMB_COM_SESSION_SETUP_ANDX</code> is sent. It is essentially the logon
-- packet, where the username, domain, and password are sent to the server for verification. 
-- The username and password are generally picked up from the program parameters, which are
-- set when running a script, or from the registry where it can be set by other scripts (for 
-- example, <code>smb-brute.nse</code>). However, they can also be passed as parameters to the 
-- function, which will override any other username/password set. 
--
-- If a username and password are set, they are used for the first login attempt. If a login fails,
-- or they weren't set, a connection as the 'GUEST' account with a blank password is attempted. If
-- that fails, then a NULL session is established, which should always work. The username/password
-- will give the highest access level, GUEST will give lower access, and NULL will give the lowest
-- (often, NULL will give no access). 
--
-- The actual login protocol used by <code>SMB_COM_SESSION_SETUP_ANDX</code> is explained in detail
-- in <code>smbauth.lua</code>. 
--
-- Thanks go to Christopher R. Hertel and his book Implementing CIFS, which 
-- taught me everything I know about Microsoft's protocols. Additionally, I used Samba's
-- list of error codes for my constants. Although I don't believe they would be covered
-- by GPL, since they're public now anyways, but I'm not a lawyer and, if somebody feels
-- differently, let me know and we can sort this out. 
--
-- Scripts that use this module can use the script arguments listed below
-- example of using these script arguments:
-- <code>
-- nmap --script=smb-<script>.nse --script-args=smbuser=ron,smbpass=iagotest2k3,smbbasic=1,smbsign=force <host>
-- </code>
-- 
-- @args  smbbasic    Forces the authentication to use basic security, as opposed to "extended security". 
--                   Against most modern systems, extended security should work, but there may be cases
--                   where you want to force basic. There's a chance that you'll get better results for 
--                   enumerating users if you turn on basic authentication. 
-- @args smbsign      Controls whether or not server signatures are checked in SMB packets. By default, on Windows,
--                   server signatures aren't enabled or required. By default, this library will always sign 
--                   packets if it knows how, and will check signatures if the server says to. Possible values are:
-- * <code>force</code>:      Always check server signatures, even if server says it doesn't support them (will 
--                           probably fail, but is technically more secure). 
-- * <code>negotiate</code>: [default] Use signatures if server supports them. 
-- * <code>ignore</code>:    Never check server signatures. Not recommended. 
-- * <code>disable</code>:   Don't send signatures, at all, and don't check the server's. not recommended. 
--                   More information on signatures can be found in <code>smbauth.lua</code>.
-- @args smbport      Override the default port choice. If <code>smbport</code> is open, it's used. It's assumed
--                   to be the same protocol as port 445, not port 139. Since it probably isn't possible to change
--                   Windows' ports normally, this is mostly useful if you're bouncing through a relay or something. 
-- @args randomseed   Set to a value to change the filenames/service names that are randomly generated. 
--                   
-- @author Ron Bowes <ron@skullsecurity.net>
-- @copyright Same as Nmap--See http://nmap.org/book/man-legal.html
-----------------------------------------------------------------------
local asn1 = require "asn1"
local bin = require "bin"
local bit = require "bit"
local coroutine = require "coroutine"
local io = require "io"
local math = require "math"
local match = require "match"
local netbios = require "netbios"
local nmap = require "nmap"
local os = require "os"
local smbauth = require "smbauth"
local stdnse = require "stdnse"
local string = require "string"
local table = require "table"
_ENV = stdnse.module("smb", stdnse.seeall)

-- These arrays are filled in with constants at the bottom of this file
command_codes = {}
command_names = {}
status_codes = {}
status_names = {}
filetype_codes = {}
filetype_names = {}

local TIMEOUT = 10000

---Wrapper around <code>smbauth.add_account</code>.
function add_account(host, username, domain, password, password_hash, hash_type, is_admin)
	smbauth.add_account(host, username, domain, password, password_hash, hash_type, is_admin)
end

---Wrapper around <code>smbauth.get_account</code>. 
function get_account(host)
	return smbauth.get_account(host)
end
---Create an 'overrides' table
function get_overrides(username, domain, password, password_hash, hash_type, overrides)
	if(not(overrides)) then
		return {username=username, domain=domain, password=password, password_hash=password_hash, hash_type=hash_type}
	else
		overrides['username'] = username
		overrides['domain'] = domain
		overrides['password'] = password
		overrides['password_hash'] = password_hash
		overrides['hash_type'] = hash_type
	end
end

---Get an 'overrides' table for the anonymous user
--
--@param overrides [optional] A base table of overrides. The appropriate fields will be added. 
function get_overrides_anonymous(overrides)
	if(not(overrides)) then
		return {username='', domain='', password='', password_hash=nil, hash_type='none'}
	else
		overrides['username'] = ''
		overrides['domain'] = ''
		overrides['password'] = ''
		overrides['password_hash'] = ''
		overrides['hash_type'] = 'none'
	end
end

---Convert a status number from the SMB header into a status name, returning an error message (not nil) if 
-- it wasn't found. 
--
--@param status The numerical status. 
--@return A string representing the error. Never nil. 
function get_status_name(status)

	if(status_names[status] == nil) then
		-- If the name wasn't found in the array, do a linear search on it
		for i, v in pairs(status_names) do
			if(v == status) then
				return i
			end
		end

		return string.format("NT_STATUS_UNKNOWN (0x%08x)", status)
	else
		return status_names[status]
	end
end


--- Determines whether or not SMB checks are possible on this host, and, if they are, 
--  which port is best to use. This is how it decides:
--
-- * If port tcp/445 is open, use it for a raw connection
-- * Otherwise, if ports tcp/139 and udp/137 are open, do a NetBIOS connection. Since UDP scanning isn't default, we're also ok with udp/137 in an unknown state. 
--
--@param host The host object. 
--@return The port number to use, or nil if we don't have an SMB port
function get_port(host)
	local port_u137 = nmap.get_port_state(host, {number=137, protocol="udp"})
	local port_t139 = nmap.get_port_state(host, {number=139, protocol="tcp"})
	local port_t445 = nmap.get_port_state(host, {number=445, protocol="tcp"})
	local custom_port = nil

	if(nmap.registry.args.smbport ~= nil) then
		custom_port = nmap.get_port_state(host, {number=tonumber(nmap.registry.args.smbport), protocol="tcp"})
	end

	-- Try a user-defined port first
	if(custom_port ~= nil and custom_port.state == "open") then
		return custom_port.number
	end

	if(port_t445 ~= nil and port_t445.state == "open") then
		 -- tcp/445 is open, we're good
		 return 445
	end

	if(port_t139 ~= nil and port_t139.state == "open") then
		 -- tcp/139 is open, check uf udp/137 is open or unknown
		 if(port_u137 == nil or port_u137.state == "open" or port_u137.state == "open|filtered") then
			  return 139
		 end
	end

	return nil
end

---Turn off extended security negotiations for this connection. There are a few reasons you might want to
-- do that, the main ones being that extended security is going to be marginally slower and it's not going
-- to give the same level of information in some cases (namely, it doesn't present the server's name). 
--@param smb The SMB state table. 
function disable_extended(smb)
	smb['extended_security'] = false
end

--- Begins a SMB session, automatically determining the best way to connect. 
--
-- @param host The host object
-- @return (status, smb) if the status is true, result is the newly crated smb object; 
--         otherwise, socket is the error message. 
function start(host)
	local port = get_port(host)
	local status, result
	local state = {}

	state['uid']      = 0
	state['tid']      = 0
	state['mid']      = 1
	state['pid']      = math.random(32766) + 1
	state['host']     = host
	state['ip']       = host.ip
	state['sequence'] = -1

	-- Check whether or not the user requested basic authentication
	if(stdnse.get_script_args( "smbbasic" )) then
		state['extended_security'] = false
	else
		state['extended_security'] = true
	end

	-- Store the name of the server
	local nbcache_mutex = nmap.mutex("Netbios lookup mutex")
	nbcache_mutex "lock"
	if ( not(host.registry['netbios_name']) ) then
		status, result = netbios.get_server_name(host.ip)
		if(status == true) then
			host.registry['netbios_name'] = result
			state['name'] = result
		end
	else
		stdnse.print_debug(2, "SMB: Resolved netbios name from cache")
		state['name'] = host.registry['netbios_name']
	end
	nbcache_mutex "done"
	
	stdnse.print_debug(2, "SMB: Starting SMB session for %s (%s)", host.name, host.ip)

	if(port == nil) then
		return false, "SMB: Couldn't find a valid port to check"
	end

	-- Initialize the accounts for logging on
	smbauth.init_account(host)

	if(port ~= 139) then
		status, state['socket'] = start_raw(host, port)
		state['port'] = port

		if(status == false) then
			return false, state['socket']
		end
		return true, state

	else
		status, state['socket'] = start_netbios(host, port)
		state['port'] = port
		if(status == false) then
			return false, state['socket']
		end
		return true, state

	end

	return false, "SMB: Couldn't find a valid port to check"
end

---Initiates a SMB connection over whichever port it can, then optionally sends the common
-- initialization packets. Note that each packet depends on the previous one, so if you want
-- to go all the way up to create_file, you have to set all parameters. 
--
-- If anything fails, we back out of the connection and return an error, so the calling function
-- doesn't have to call smb.stop(). 
--
--@param host               The host object. 
--@param bool_negotiate_protocol [optional] If 'true', send the protocol negotiation. Default: false. 
--@param bool_start_session      [optional] If 'true', start the session. Default: false. 
--@param str_tree_connect       [optional] The tree to connect to, if given (eg. "IPC$" or "C$"). If not given, 
--                          packet isn't sent. 
--@param str_create_file        [optional] The path and name of the file (or pipe) that's created, if given. If 
--                          not given, packet isn't sent. 
--@param overrides          [optional] A table of overrides (for, for example, username, password, etc.) to pass 
--                          to all functions. 
--@param bool_disable_extended   [optional] If set to true, disables extended security negotiations. 
function start_ex(host, bool_negotiate_protocol, bool_start_session, str_tree_connect, str_create_file, bool_disable_extended, overrides)
	local smbstate
	local status, err

	-- Make sure we have overrides
	overrides = overrides or {}

	-- Begin the SMB session
	status, smbstate = start(host)
	if(status == false) then
		return false, smbstate
	end

	-- Disable extended security if it was requested
	if(bool_disable_extended == true) then
		disable_extended(smbstate)
	end

	if(bool_negotiate_protocol == true) then
		-- Negotiate the protocol
		status, err = negotiate_protocol(smbstate, overrides)
		if(status == false) then
			stop(smbstate)
			return false, err
		end

		if(bool_start_session == true) then	
			-- Start up a session
			status, err = start_session(smbstate, overrides)
			if(status == false) then
				stop(smbstate)
				return false, err
			end

			if(str_tree_connect ~= nil) then
				-- Connect to share
				status, err = tree_connect(smbstate, str_tree_connect, overrides)
				if(status == false) then
					stop(smbstate)
					return false, err
				end

				if(str_create_file ~= nil) then
					-- Try to connect to requested pipe
					status, err = create_file(smbstate, str_create_file, overrides)
					if(status == false) then
						stop(smbstate)
						return false, err
					end
				end
			end
		end
	end

	-- Return everything
	return true, smbstate
end

--- Kills the SMB connection and closes the socket. 
--
--  In addition to killing the connection, this function will log off the user and disconnect
--  the connected tree, if possible.
--
--@param smb    The SMB object associated with the connection
--@return (status, result) If status is false, result is an error message. Otherwise, result
--        is undefined. 
function stop(smb) 

	if(smb['tid'] ~= 0) then
		tree_disconnect(smb)
	end

	if(smb['uid'] ~= 0) then
		logoff(smb)
	end

	stdnse.print_debug(2, "SMB: Closing socket")
	if(smb['socket'] ~= nil) then
		local status, err = smb['socket']:close()

		if(status == false) then
			return false, "SMB: Failed to close socket: " .. err
		end
	end

	return true
end

--- Begins a raw SMB session, likely over port 445. Since nothing extra is required, this
--  function simply makes a connection and returns the socket. 
-- 
--@param host The host object to check. 
--@param port The port to use (most likely 445).
--@return (status, socket) if status is true, result is the newly created socket. 
--        Otherwise, socket is the error message. 
function start_raw(host, port)
	local status, err
	local socket = nmap.new_socket()

	socket:set_timeout(TIMEOUT)
	status, err = socket:connect(host, port, "tcp")

	if(status == false) then
		return false, "SMB: Failed to connect to host: " .. err
	end

	return true, socket
end

--- This function will take a string like "a.b.c.d" and return "a", "a.b", "a.b.c", and "a.b.c.d". 
--  This is used for discovering NetBIOS names. If a NetBIOS name is unknown, the substrings of the 
--  DNS name can be used in this way. 
--
--@param name The name to take apart
--@return An array of the sub names
local function get_subnames(name)
	local i = -1
	local list = {}

	repeat
		local subname = name

		i = string.find(name, "[.]", i + 1)
		if(i ~= nil) then
			subname = string.sub(name, 1, i - 1)
		end

		list[#list + 1] = string.upper(subname)

	until i == nil

	return list
end

--- Begins a SMB session over NetBIOS. This requires a NetBIOS Session Start message to 
--  be sent first, which in turn requires the NetBIOS name. The name can be provided as
--  a parameter, or it can be automatically determined. 
--
-- Automatically determining the name is interesting, to say the least. Here are the names
-- it tries, and the order it tries them in:
-- * The name the user provided, if present
-- * The name pulled from NetBIOS (udp/137), if possible
-- * The generic name "*SMBSERVER"
-- * Each subset of the domain name (for example, scanme.insecure.org would attempt "scanme",
--    "scanme.insecure", and "scanme.insecure.org")
--
-- This whole sequence is a little hackish, but it's the standard way of doing it. 
--
--@param host The host object to check. 
--@param port The port to use (most likely 139).
--@param name [optional] The NetBIOS name of the host. Will attempt to automatically determine
--            if it isn't given. 
--@return (status, socket) if status is true, result is the port
--        Otherwise, socket is the error message. 
function start_netbios(host, port, name)
	local i
	local status, err
	local pos, result, flags, length
	local socket = nmap.new_socket()

	-- First, populate the name array with all possible names, in order of significance
	local names = {}

	-- Use the name parameter
	if(name ~= nil) then
		names[#names + 1] = name
	end

	-- Get the name of the server from NetBIOS
	status, name = netbios.get_server_name(host.ip)
	if(status == true) then
		names[#names + 1] = name
	end

	-- "*SMBSERVER" is a special name that any server should respond to
	names[#names + 1] = "*SMBSERVER"

	-- If all else fails, use each substring of the DNS name (this is a HUGE hack, but is actually
	-- a recommended way of doing this!)
	if(host.name ~= nil and host.name ~= "") then
		local new_names = get_subnames(host.name)
		for i = 1, #new_names, 1 do
			names[#names + 1] = new_names[i]
		end
	end

	-- This loop will try all the NetBIOS names we've collected, hoping one of them will work. Yes,
	-- this is a hackish way, but it's actually the recommended way. 
	i = 1
	repeat

		-- Use the current name
		name = names[i]

		-- Some debug information
		stdnse.print_debug(1, "SMB: Trying to start NetBIOS session with name = '%s'", name)
		-- Request a NetBIOS session
		local session_request = bin.pack(">CCSzz", 
					0x81,                        -- session request
					0x00,                        -- flags
					0x44,                        -- length
					netbios.name_encode(name),   -- server name
					netbios.name_encode("NMAP")  -- client name
				);

		stdnse.print_debug(3, "SMB: Connecting to %s", host.ip)
		socket:set_timeout(TIMEOUT)
		status, err = socket:connect(host, port, "tcp")
		if(status == false) then
			socket:close()
			return false, "SMB: Failed to connect: " .. err
		end

		-- Send the session request
		stdnse.print_debug(3, "SMB: Sending NetBIOS session request with name %s", name)
		status, err = socket:send(session_request)
		if(status == false) then
			socket:close()
			return false, "SMB: Failed to send: " .. err
		end
		socket:set_timeout(TIMEOUT)
	
		-- Receive the session response
		stdnse.print_debug(3, "SMB: Receiving NetBIOS session response")
		status, result = socket:receive_buf(match.numbytes(4), true);
		if(status == false) then
			socket:close()
			return false, "SMB: Failed to close socket: " .. result
		end
		pos, result, flags, length = bin.unpack(">CCS", result)
		if(result == nil or length == nil) then
			return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [1]"
		end
	
		-- Check for a positive session response (0x82)
		if result == 0x82 then
			stdnse.print_debug(3, "SMB: Successfully established NetBIOS session with server name %s", name)
			return true, socket
		end

		-- If the session failed, close the socket and try the next name
		stdnse.print_debug(1, "SMB: Session request failed, trying next name")
		socket:close()
	
		-- Try the next name
		i = i + 1

	until i > #names

	-- We reached the end of our names list
	stdnse.print_debug(1, "SMB: None of the NetBIOS names worked!")
	return false, "SMB: Couldn't find a NetBIOS name that works for the server. Sorry!"
end

--- Creates a string containing a SMB packet header. The header looks like this:
-- 
--<code>
-- --------------------------------------------------------------------------------------------------
-- | 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9  8  7  6  5  4  3  2  1  0 |
-- --------------------------------------------------------------------------------------------------
-- |         0xFF           |          'S'          |        'M'            |         'B'           |
-- --------------------------------------------------------------------------------------------------
-- |        Command         |                             Status...                                 |
-- --------------------------------------------------------------------------------------------------
-- |    ...Status           |        Flags          |                    Flags2                     |
-- --------------------------------------------------------------------------------------------------
-- |                    PID_high                    |                  Signature.....               |
-- --------------------------------------------------------------------------------------------------
-- |                                        ....Signature....                                       |
-- --------------------------------------------------------------------------------------------------
-- |              ....Signature                     |                    Unused                     |
-- --------------------------------------------------------------------------------------------------
-- |                      TID                       |                     PID                       |
-- --------------------------------------------------------------------------------------------------
-- |                      UID                       |                     MID                       |
-- ------------------------------------------------------------------------------------------------- 
--</code>
--
-- All fields are, incidentally, encoded in little endian byte order.
--
-- For the purposes here, the program doesn't care about most of the fields so they're given default 
-- values. The "command" field is the only one we ever have to set manually, in my experience. The TID
-- and UID need to be set, but those are stored in the smb state and don't require user intervention. 
--
--@param smb     The smb state table. 
--@param command The command to use.
--@param overrides The overrides table. Keep in mind that overriding things like flags is generally a very bad idea, unless you know what you're doing. 
--@return A binary string containing the packed packet header. 
function smb_encode_header(smb, command, overrides)
	-- Make sure we have an overrides array
	overrides = overrides or {}

	-- Used for the header
	local sig = string.char(0xFF) .. "SMB"

	-- Pretty much every flags is deprecated. We set these two because they're required to be on. 
	local flags  = bit.bor(0x10, 0x08) -- SMB_FLAGS_CANONICAL_PATHNAMES | SMB_FLAGS_CASELESS_PATHNAMES
	-- These flags are less deprecated. We negotiate 32-bit status codes and long names. We also don't include Unicode, which tells
	-- the server that we deal in ASCII. 
	local flags2 = bit.bor(0x4000, 0x2000, 0x0040, 0x0001) -- SMB_FLAGS2_32BIT_STATUS | SMB_FLAGS2_EXECUTE_ONLY_READS | SMB_FLAGS2_IS_LONG_NAME | SMB_FLAGS2_KNOWS_LONG_NAMES

	-- Unless the user's disabled the security signature, add it
	if(nmap.registry.args.smbsign ~= "disable") then
		flags2 = bit.bor(flags2, 0x0004) -- SMB_FLAGS2_SECURITY_SIGNATURE
	end
	

	if(smb['extended_security'] == true) then
		flags2 = bit.bor(flags2, 0x0800) -- SMB_EXTENDED_SECURITY
	end

	-- TreeID should never ever be 'nil', but it seems to happen once in awhile so print an error
	if(smb['tid'] == nil) then
		return false, string.format("SMB: ERROR: TreeID value was set to nil on host %s", smb['ip'])
	end

	local header = bin.pack("<CCCCCICSSLSSSSS",
				sig:byte(1),  -- Header
				sig:byte(2),  -- Header
				sig:byte(3),  -- Header
				sig:byte(4),  -- Header
				command,      -- Command
				(overrides['status'] or 0),        -- status
				(overrides['flags'] or flags),     -- flags
				(overrides['flags2'] or flags2),   -- flags2
				(overrides['pid_high'] or 0),      -- extra (pid_high)
				(overrides['signature'] or 0),     -- extra (signature)
				(overrides['extra'] or 0),         -- extra (unused)
				(overrides['tid'] or smb['tid']),  -- tid
				(overrides['pid'] or smb['pid']),  -- pid
				(overrides['uid'] or smb['uid']),  -- uid
				(overrides['mid'] or smb['mid'])   -- mid
			)

	return header
end

--- Converts a string containing the parameters section into the encoded parameters string. 
-- The encoding is simple:
-- * (1 byte)   The number of 2-byte values in the parameters section
-- * (variable) The parameter section
-- This is automatically done by <code>smb_send</code>. 
-- 
-- @param parameters The parameters section. 
-- @param overrides The overrides table. The only thing possible to override here is the length. 
-- @return The encoded parameters. 
local function smb_encode_parameters(parameters, overrides)
	-- Make sure we have an overrides array
	overrides = overrides or {}
	
	return bin.pack("<CA", (overrides['parameters_length'] or (#parameters / 2)), parameters)
end

--- Converts a string containing the data section into the encoded data string. 
-- The encoding is simple:
-- * (2 bytes)  The number of bytes in the data section
-- * (variable) The data section
-- This is automatically done by <code>smb_send</code>. 
--
-- @param data The data section. 
-- @param overrides The overrides table. The only thing possible to override here is the length. 
-- @return The encoded data.
local function smb_encode_data(data, overrides)
	-- Make sure we have an overrides array
	overrides = overrides or {}

	return bin.pack("<SA", (overrides['data_length'] or #data), data)
end

---Sign the message, if possible. This is done by replacing the signature with the sequence
-- number, creating a hash, then putting that hash in the signature location. 
--@param smb  The smb state object.
--@param body The body of the packet that's being signed.
--@return The body of the packet, with the signature in place.
local function message_sign(smb, body)
	smb['sequence'] = smb['sequence'] + 1

	if(smb['mac_key'] == nil) then
		stdnse.print_debug(3, "SMB: Not signing message (missing mac_key)")
		return body
	elseif(nmap.registry.args.smbsign == "disable") then
		stdnse.print_debug(3, "SMB: Not signing message (disabled by user)")

		return body
	end

	-- Convert the sequence number to a string
	local sequence = bin.pack("<L", smb['sequence'])
	-- Create a new string, with the sequence number in place
	local new_packet = string.sub(body, 1, 14) .. sequence .. string.sub(body, 23)
	-- Calculate the signature
	local signature = smbauth.calculate_signature(smb['mac_key'], new_packet)

	return string.sub(body, 1, 14) .. signature .. string.sub(body, 23)
end

---Check the signature of the message. This is the opposite of <code>message_sign</code>, 
-- and works the same way (replaces the signature with the sequence number, calculates
-- hash, checks)
--@param smb  The smb state object.
--@param body The body of the packet that's being checked. 
--@return A true/false value -- true if the packet was signed properly, false if it wasn't. 
local function message_check_signature(smb, body)
	smb['sequence'] = smb['sequence'] + 1

	if(smb['mac_key'] == nil) then
		stdnse.print_debug(3, "SMB: Not signing message (missing mac_key)")
		return true
	elseif(nmap.registry.args.smbsign ~= "force" and bit.band(smb['security_mode'], 0x0A) ~= 0) then
		stdnse.print_debug(3, "SMB: Not signing message (server doesn't support it -- default)")
		return true
	elseif(nmap.registry.args.smbsign == "disable" or nmap.registry.args.smbsign == "ignore") then
		stdnse.print_debug(3, "SMB: Not signing message (disabled by user)")
		return true
	end

	-- Pull out the signature that they used
	local signature  = string.sub(body, 15, 22)

	-- Turn the sequence into a string
	local sequence   = bin.pack("<L", smb['sequence'])
	-- Create a new string, with the sequence number in place
	local new_packet = string.sub(body, 1, 14) .. sequence .. string.sub(body, 23)

	-- Calculate the proper signature
	local real_signature = smbauth.calculate_signature(smb['mac_key'], new_packet)

	-- Validate the signature
	return signature == real_signature
end

--- Prepends the NetBIOS header to the packet, which is essentially the length, encoded
--  in 4 bytes of big endian, and sends it out. The length field is actually 17 or 24 bits 
--  wide, depending on whether or not we're using raw, but that shouldn't matter. 
--
--@param smb        The SMB object associated with the connection
--@param header     The header, encoded with <code>smb_get_header</code>.
--@param parameters The parameters.
--@param data       The data.
--@param overrides  Overrides table. 
--@return (result, err) If result is false, err is the error message. Otherwise, err is
--        undefined
function smb_send(smb, header, parameters, data, overrides)
	overrides = overrides or {}

    local encoded_parameters = smb_encode_parameters(parameters, overrides)
    local encoded_data       = smb_encode_data(data, overrides)
	local body               = header .. encoded_parameters .. encoded_data
	local attempts           = 5
	local status, err

	-- Calculate the message signature
	body = message_sign(smb, body)

    local out = bin.pack(">I<A", #body, body)


	repeat
		attempts = attempts - 1
		stdnse.print_debug(3, "SMB: Sending SMB packet (len: %d, attempts remaining: %d)", #out, attempts)
		status, err = smb['socket']:send(out)
	until(status or (attempts == 0))

	if(attempts == 0) then
		stdnse.print_debug(1, "SMB: Sending packet failed after 5 tries! Giving up.")
	end

	return status, err
end

--- Reads the next packet from the socket, and parses it into the header, parameters, 
--  and data.
--
--@param smb The SMB object associated with the connection
--@param read_data [optional] This function will read the data section if and only if
--       this value is true. This is a workaround for a bug in the tree connect packet,
--       where the length is set incorrectly. Default: true. 
--@return (status, header, parameters, data) If status is true, the header, 
--        parameters, and data are all the raw arrays (with the lengths already
--        removed). If status is false, header contains an error message and parameters/
--        data are undefined. 
function smb_read(smb, read_data)
	local status
	local pos, netbios_data, netbios_length, length, header, parameter_length, parameters, data_length, data
	local attempts = 5

	stdnse.print_debug(3, "SMB: Receiving SMB packet")

	-- Receive the response -- we make sure to receive at least 4 bytes, the length of the NetBIOS length
	smb['socket']:set_timeout(TIMEOUT)

	-- perform 5 attempt to read the Netbios header
	local netbios
	repeat
		attempts = attempts - 1
		status, netbios_data = smb['socket']:receive_buf(match.numbytes(4), true);
		
		if ( not(status) and netbios_data == "EOF" ) then
			stdnse.print_debug(1, "SMB: ERROR: Server disconnected the connection")
			return false, "SMB: ERROR: Server disconnected the connection"
		end
	until(status or (attempts == 0))

	-- Make sure the connection is still alive
	if(status ~= true) then
		return false, "SMB: Failed to receive bytes after 5 attempts: " .. netbios_data
	end

	-- The length of the packet is 4 bytes of big endian (for our purposes).
	-- The NetBIOS header is 24 bits, big endian
	pos, netbios_length   = bin.unpack(">I", netbios_data)
	if(netbios_length == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [2]"
	end
	-- Make the length 24 bits
	netbios_length = bit.band(netbios_length, 0x00FFFFFF)

	-- The total length is the netbios_length, plus 4 (for the length itself)
	length = netbios_length + 4

	local attempts = 5
	local smb_data
	repeat
		attempts = attempts - 1
		status, smb_data = smb['socket']:receive_buf(match.numbytes(netbios_length), true)
	until(status or (attempts == 0))

	-- Make sure the connection is still alive
	if(status ~= true) then
		return false, "SMB: Failed to receive bytes after 5 attempts: " .. smb_data
	end
	
	local result = netbios_data .. smb_data
	if(#result ~= length) then
		stdnse.print_debug(1, "SMB: ERROR: Received wrong number of bytes, there will likely be issues (recieved %d, expected %d)", #result, length)
		return false, string.format("SMB: ERROR: Didn't receive the expected number of bytes; recieved %d, expected %d. This will almost certainly cause some errors.", #result, length)
	end

	-- Check the message signature (ignoring the first four bytes, which are the netbios header)
	local good_signature = message_check_signature(smb, string.sub(result, 5))
	if(good_signature == false) then
		return false, "SMB: ERROR: Server returned invalid signature"
	end

	-- The header is 32 bytes.
	pos, header   = bin.unpack("<A32", result, pos)
	if(header == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [3]"
	end

	-- The parameters length is a 1-byte value.
	pos, parameter_length = bin.unpack("<C",     result, pos)
	if(parameter_length == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [4]"
	end

	-- Double the length parameter, since parameters are two-byte values. 
	pos, parameters       = bin.unpack(string.format("<A%d", parameter_length*2), result, pos)
	if(parameters == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [5]"
	end

	-- The data length is a 2-byte value. 
	pos, data_length      = bin.unpack("<S",     result, pos)
	if(data_length == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [6]"
	end

	-- Read that many bytes of data.
	if(read_data == nil or read_data == true) then
		pos, data             = bin.unpack(string.format("<A%d", data_length),        result, pos)
		if(data == nil) then
			return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [7]"
		end
	else
		data = nil
	end

	stdnse.print_debug(3, "SMB: Received %d bytes", #result)
	return true, header, parameters, data
end

--- Sends out <code>SMB_COM_NEGOTIATE</code>, which is typically the first SMB packet sent out. 
-- Sends the following:
-- * List of known protocols
--
-- Receives:
-- * The preferred dialect
-- * The security mode
-- * Max number of multiplexed connections, virtual circuits, and buffer sizes
-- * The server's system time and timezone
-- * The "encryption key" (aka, the server challenge)
-- * The capabilities
-- * The server and domain names
--
--@param smb       The SMB object associated with the connection
--@param overrides [optional] Overrides for various fields
--@return (status, result) If status is false, result is an error message. Otherwise, result is
--        nil and the following elements are added to <code>smb</code>:
--      * 'security_mode'    Whether or not to use cleartext passwords, message signatures, etc.
--      * 'max_mpx'          Maximum number of multiplexed connections
--      * 'max_vc'           Maximum number of virtual circuits
--      * 'max_buffer'       Maximum buffer size
--      * 'max_raw_buffer'   Maximum buffer size for raw connections (considered obsolete)
--      * 'session_key'      A value that's basically just echoed back
--      * 'capabilities'     The server's capabilities
--      * 'time'             The server's time (in UNIX-style seconds since 1970)
--      * 'date'             The server's date in a user-readable format
--      * 'timezone'         The server's timezone, in hours from UTC
--      * 'timezone_str'     The server's timezone, as a string
--      * 'server_challenge' A random string used for challenge/response
--      * 'domain'           The server's primary domain or workgroup
--      * 'server'           The server's name
function negotiate_protocol(smb, overrides)
	local header, parameters, data
	local pos
	local header1, header2, header3, ehader4, command, status, flags, flags2, pid_high, signature, unused, pid, mid

	header     = smb_encode_header(smb, command_codes['SMB_COM_NEGOTIATE'], overrides)

	-- Make sure we have overrides
	overrides = overrides or {}

	-- Parameters are blank
	parameters = ""

	-- Data is a list of strings, terminated by a blank one. 
	if(overrides['dialects'] == nil) then
		data       = bin.pack("<CzCz", 2, (overrides['dialect'] or "NT LM 0.12"), 2, "")
	else
		data = ""
		for _, v in ipairs(overrides['dialects']) do
			data = data .. bin.pack("<Cz", 2, v)
		end
		data = data .. bin.pack("Cz", 2, "")
	end

	-- Send the negotiate request
	stdnse.print_debug(2, "SMB: Sending SMB_COM_NEGOTIATE")
	local result, err = smb_send(smb, header, parameters, data, overrides)
	if(status == false) then
		return false, err
	end

	-- Read the result
	status, header, parameters, data = smb_read(smb)
	if(status ~= true) then
		return false, header
	end

	-- Parse out the header
    local uid, tid, header4
	pos, header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid = bin.unpack("<CCCCCICSSlSSSSS", header)

	-- Get the protocol version
	local protocol_version = string.char(header1, header2, header3, header4)
	if(protocol_version == (string.char(0xFE) .. "SMB")) then
		return false, "SMB: Server returned a SMBv2 packet, don't know how to handle"
	end

	-- Check if we fell off the packet (if that happened, the last parameter will be nil)
	if(header1 == nil or mid == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [8]"
	end

	-- Since this is the first response seen, check any necessary flags here
	if(bit.band(flags2, 0x0800) ~= 0x0800) then
		smb['extended_security'] = false
	end

	-- Parse the parameter section
	pos, smb['dialect'] = bin.unpack("<S", parameters)
	if(smb['dialect'] == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [9]"
	end

	-- Check if we ran off the packet
	if(smb['dialect'] == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [10]"
	end
	-- Check if the server didn't like our requested protocol
	if(smb['dialect'] ~= 0) then
		return false, string.format("Server negotiated an unknown protocol (#%d) -- aborting", smb['dialect'])
	end

	pos, smb['security_mode'], smb['max_mpx'], smb['max_vc'], smb['max_buffer'], smb['max_raw_buffer'], smb['session_key'], smb['capabilities'], smb['time'], smb['timezone'], smb['key_length'] = bin.unpack("<CSSIIIILsC", parameters, pos)
	if(smb['security_mode'] == nil or smb['capabilities'] == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [11]"
	end
	-- Some broken implementations of SMB don't send these variables
	if(smb['time'] == nil) then
		smb['time'] = 0
	end
	if(smb['timezone'] == nil) then
		smb['timezone'] = 0
	end
	if(smb['key_length'] == nil) then
		smb['key_length'] = 0
	end
	if(smb['byte_count'] == nil) then
		smb['byte_count'] = 0
	end

	-- Convert the time and timezone to more useful values
	smb['time'] = (smb['time'] / 10000000) - 11644473600
	smb['date'] = os.date("%Y-%m-%d %H:%M:%S", smb['time'])
	smb['timezone'] = -(smb['timezone'] / 60)
	if(smb['timezone'] == 0) then
		smb['timezone_str'] = "UTC+0"
	elseif(smb['timezone'] < 0) then
		smb['timezone_str'] = "UTC-" .. math.abs(smb['timezone'])
	else
		smb['timezone_str'] = "UTC+" .. smb['timezone']
	end

	-- Data section
	if(smb['extended_security'] == true) then
		pos, smb['server_challenge'] = bin.unpack(string.format("<A%d", smb['key_length']), data)
		if(smb['server_challenge'] == nil) then
			return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [12]"
		end

		pos, smb['server_guid'] = bin.unpack("<A16", data, pos)
		if(smb['server_guid'] == nil) then
			return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [12]"
		end

		-- do we have a security blob?
		if ( #data - pos > 0 ) then
			pos, smb['security_blob'] = bin.unpack("<A" .. #data - pos, data, pos )
		end
	else
		pos, smb['server_challenge'] = bin.unpack(string.format("<A%d", smb['key_length']), data)
		if(smb['server_challenge'] == nil) then
			return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [12]"
		end
	
		-- Get the domain as a Unicode string
		local ch, dummy
		smb['domain'] = ""
		smb['server'] = ""
	
		pos, ch, dummy = bin.unpack("<CC", data, pos)
--		if(dummy == nil) then
--			return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [13]"
--		end
		while ch ~= nil and ch ~= 0 do
			smb['domain'] = smb['domain'] .. string.char(ch)
			pos, ch, dummy = bin.unpack("<CC", data, pos)
			if(ch == nil or dummy == nil) then
				return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [14]"
			end
		end
	
		-- Get the server name as a Unicode string
		-- Note: This can be nil, Samba leaves this off
		pos, ch, dummy = bin.unpack("<CC", data, pos)
		while ch ~= nil and ch ~= 0 do
			smb['server'] = smb['server'] .. string.char(ch)
			pos, ch, dummy = bin.unpack("<CC", data, pos)
		end
	end

	return true
end


--- This is an internal function and should not be called externally. Use
--  the start_session() function instead.
local function start_session_basic(smb, log_errors, overrides)
	local i, err
	local status, result
	local header, parameters, data, domain
	local pos
	local header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid 
	local andx_command, andx_reserved, andx_offset, action
	local os, lanmanager
	local username, domain, password, password_hash, hash_type
	local busy_count = 0

	header = smb_encode_header(smb, command_codes['SMB_COM_SESSION_SETUP_ANDX'], overrides)

	-- Get the first account, unless they overrode it
	if(overrides ~= nil and overrides['username'] ~= nil) then
		result = true
		username      = overrides['username']
		domain        = overrides['domain']
		password      = overrides['password']
		password_hash = overrides['password_hash']
		hash_type     = overrides['hash_type']
	else
		result, username, domain, password, password_hash, hash_type = smbauth.get_account(smb['host'])
	end
		
	while result ~= false do
		local lanman, ntlm

		lanman, ntlm, smb['mac_key'] = smbauth.get_password_response(smb['ip'], username, domain, password, password_hash, hash_type, smb['server_challenge'], false)

		-- Parameters
		parameters = bin.pack("<CCSSSSISSII", 
					0xFF,               -- ANDX -- no further commands
					0x00,               -- ANDX -- Reserved (0)
					0x0000,             -- ANDX -- next offset
					0xFFFF,             -- Max buffer size
					0x0001,             -- Max multiplexes
					0x0001,             -- Virtual circuit num
					smb['session_key'], -- The session key
					#lanman,            -- ANSI/Lanman password length
					#ntlm,              -- Unicode/NTLM password length
					0x00000000,         -- Reserved
	                0x00000050          -- Capabilities
				)

		-- Data is a list of strings, terminated by a blank one. 
		data       = bin.pack("<AAzzzz", 
					lanman,                 -- ANSI/Lanman password
					ntlm,                   -- Unicode/NTLM password
					username,               -- Account
					domain,                 -- Domain
					"Nmap",                 -- OS
					"Native Lanman"         -- Native LAN Manager
				)

		-- Send the session setup request
		stdnse.print_debug(2, "SMB: Sending SMB_COM_SESSION_SETUP_ANDX")
		result, err = smb_send(smb, header, parameters, data, overrides)
		if(result == false) then
			return false, err
		end
	
		-- Read the result
		status, header, parameters, data = smb_read(smb)
		if(status ~= true) then
			return false, header
		end
	
		-- Check if we were allowed in
		pos, header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid = bin.unpack("<CCCCCICSSlSSSSS", header)

		if(header1 == nil or mid == nil) then
			return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [17]"
		end

		-- Check if we're successful
		if(status == 0) then

			-- Parse the parameters
			pos, andx_command, andx_reserved, andx_offset, action = bin.unpack("<CCSS", parameters)
			if(andx_command == nil or action == nil) then
				return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [18]"
			end

			-- Parse the data
			pos, os, lanmanager, domain = bin.unpack("<zzz", data)
			if(os == nil or domain == nil) then
				return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [19]"
			end
		
			-- Fill in the smb object and smb string
			smb['uid']        = uid
			smb['is_guest']   = bit.band(action, 1)
			smb['os']         = os
			smb['lanmanager'] = lanmanager

			-- Check if they're using an un-supported system
			if(os == nil or lanmanager == nil or domain == nil) then
				stdnse.print_debug(1, "SMB: WARNING: the server is using a non-standard SMB implementation; your mileage may vary (%s)", smb['ip'])
			elseif(os == "Unix" or string.sub(lanmanager, 1, 5) == "Samba") then
				stdnse.print_debug(1, "SMB: WARNING: the server appears to be Unix; your mileage may vary.")
			end

			-- Check if they were logged in as a guest
			if(log_errors == nil or log_errors == true) then
				if(smb['is_guest'] == 1) then
					stdnse.print_debug(1, "SMB: Login as %s\\%s failed, but was given guest access (username may be wrong, or system may only allow guest)", domain, stdnse.string_or_blank(username))
				else
					stdnse.print_debug(2, "SMB: Login as %s\\%s succeeded", domain, stdnse.string_or_blank(username))
				end
			end

			-- Set the initial sequence number
			smb['sequence'] = 1

			return true

		else
			-- Check if we got the error NT_STATUS_REQUEST_NOT_ACCEPTED
			if(status == 0xc00000d0) then
				busy_count = busy_count + 1

				if(busy_count > 9) then
					return false, "SMB: ERROR: Server has too many active connections; giving up."
				end

				local backoff = math.random() * 10
				stdnse.print_debug(1, "SMB: Server has too many active connections; pausing for %s seconds.", math.floor(backoff * 100) / 100)
				stdnse.sleep(backoff)
			else
				-- This username failed, print a warning and keep going
				if(log_errors == nil or log_errors == true) then
					stdnse.print_debug(1, "SMB: Login as %s\\%s failed (%s)", domain, stdnse.string_or_blank(username), get_status_name(status))
				end

				-- Go to the next account
				if(overrides == nil or overrides['username'] == nil) then
					smbauth.next_account(smb['host'])
					result, username, domain, password, password_hash, hash_type = smbauth.get_account(smb['host'])
				else
					result = false
				end
			end
		end
	end

	if(log_errors ~= false) then
		stdnse.print_debug(1, "SMB: ERROR: %s", username)
	end

	if (status ~= nil) then
		return false, get_status_name(status)
	else
		return false, username
	end
end

--- This is an internal function and should not be called externally. Use
--  the start_session() function instead.
local function start_session_extended(smb, log_errors, overrides)
	local i
	local status, status_name, result, err
	local header, parameters, data
	local pos
	local header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid 
	local andx_command, andx_reserved, andx_offset, action, security_blob_length
	local os, lanmanager
	local username, domain, password, password_hash, hash_type
	local busy_count = 0

	-- Set a default status_name, in case everything fails
	status_name = "An unknown error has occurred"

	-- Get the first account, unless they overrode it
	if(overrides ~= nil and overrides['username'] ~= nil) then
		result = true
		username      = overrides['username']
		domain        = overrides['domain']
		password      = overrides['password']
		password_hash = overrides['password_hash']
		hash_type     = overrides['hash_type']
	else
		result, username, domain, password, password_hash, hash_type = smbauth.get_account(smb['host'])
		if(not(result)) then
			return result, username
		end
	end
	
	-- check what kind of security blob we were given in the negotiate protocol request
	local sp_nego = false
	if ( smb['security_blob'] and #smb['security_blob'] > 11 ) then
		local pos, oid = bin.unpack(">A6", smb['security_blob'], 5)
		sp_nego = ( oid == "\x2b\x06\x01\x05\x05\x02" ) -- check for SPNEGO OID 1.3.6.1.5.5.2
	end
	
	while result ~= false do
		-- These are loop variables
		local security_blob = nil
		local security_blob_length = 0

		-- This loop takes care of the multiple packets that "extended security" requires
		repeat
			-- Get the new security blob, passing the old security blob as a parameter. If there was no previous security blob, then nil is passed, which creates a new one
			if ( not(security_blob) ) then
				status, security_blob, smb['mac_key'] = smbauth.get_security_blob(security_blob, smb['ip'], username, domain, password, password_hash, hash_type, (sp_nego and 0x00088215))

				if ( sp_nego ) then
					local enc = asn1.ASN1Encoder:new()
					local mechtype = enc:encode( { type = 'A0', value = enc:encode( { type = '30', value = enc:encode( { type = '06', value = bin.pack("H", "2b06010401823702020a") } ) } ) } )
					local oid = enc:encode( { type = '06', value = bin.pack("H", "2b0601050502") } )
					
					security_blob = enc:encode(security_blob)
					security_blob = enc:encode( { type = 'A2', value = security_blob } )
					security_blob = mechtype .. security_blob
					security_blob = enc:encode( { type = '30', value = security_blob } )
					security_blob = enc:encode( { type = 'A0', value = security_blob } )
					security_blob = oid .. security_blob
					security_blob = enc:encode( { type = '60', value = security_blob } )
				end
			else
				if ( sp_nego ) then
					if ( smb['domain'] or smb['server'] and ( not(domain) or #domain == 0 ) ) then
						domain = smb['domain'] or smb['server']
					end
					hash_type = "ntlm"
				end
				
				status, security_blob, smb['mac_key'] = smbauth.get_security_blob(security_blob, smb['ip'], username, domain, password, password_hash, hash_type, (sp_nego and 0x00088215))
				
				if ( sp_nego ) then
					local enc = asn1.ASN1Encoder:new()
					security_blob = enc:encode(security_blob)
					security_blob = enc:encode( { type = 'A2', value = security_blob } )
					security_blob = enc:encode( { type = '30', value = security_blob } )
					security_blob = enc:encode( { type = 'A1', value = security_blob } )
				end
				
			end

			-- There was an error processing the security blob	
			if(status == false) then
				return false, string.format("SMB: ERROR: Security blob: %s", security_blob)
			end
	
			header     = smb_encode_header(smb, command_codes['SMB_COM_SESSION_SETUP_ANDX'], overrides)

			-- Data is a list of strings, terminated by a blank one. 
			data = bin.pack("<Azzz", 
						security_blob,         -- Security blob
						"Nmap",                -- OS
						"Native Lanman",       -- Native LAN Manager
						""                     -- Primary domain
			)
	
			-- Parameters
			parameters = bin.pack("<CCSSSSISII", 
						0xFF,               -- ANDX -- no further commands
						0x00,               -- ANDX -- Reserved (0)
						#data + 24 + #header + 3, -- ANDX -- next offset
						0xFFFF,             -- Max buffer size
						0x0001,             -- Max multiplexes
						0x0001,             -- Virtual circuit num
						smb['session_key'], -- The session key
						#security_blob,     -- Security blob length
						0x00000000,         -- Reserved
						0x80000050          -- Capabilities
					)
			
			-- Send the session setup request
			stdnse.print_debug(2, "SMB: Sending SMB_COM_SESSION_SETUP_ANDX")
			result, err = smb_send(smb, header, parameters, data, overrides)
			if(result == false) then
				return false, err
			end
		
			-- Read the result
			status, header, parameters, data = smb_read(smb)
			if(status ~= true) then
				return false, header
			end
		
			-- Check if we were allowed in
			pos, header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid = bin.unpack("<CCCCCICSSlSSSSS", header)
			if(header1 == nil or mid == nil) then
				return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [17]"
				end
			smb['uid'] = uid

			-- Get a human readable name
			status_name = get_status_name(status)
	
			-- Only parse the parameters if it's ok or if we're going to keep going
			if(status_name == "NT_STATUS_SUCCESS" or status_name == "NT_STATUS_MORE_PROCESSING_REQUIRED") then
				-- Parse the parameters
				pos, andx_command, andx_reserved, andx_offset, action, security_blob_length = bin.unpack("<CCSSS", parameters)
				if(andx_command == nil or security_blob_length == nil) then
					return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [18]"
				end
				smb['is_guest']   = bit.band(action, 1)
		
				-- Parse the data
				pos, security_blob, os, lanmanager = bin.unpack(string.format("<A%dzz", security_blob_length), data)

				if ( status_name == "NT_STATUS_MORE_PROCESSING_REQUIRED" and sp_nego ) then
					local start = security_blob:find("NTLMSSP")
					security_blob = security_blob:sub(start)
				end
				
				if(security_blob == nil or lanmanager == nil) then
					return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [19]"
				end
				smb['os']         = os
				smb['lanmanager'] = lanmanager
				
				local host_info = smbauth.get_host_info_from_security_blob(security_blob)
				if ( host_info ) then
					smb['fqdn'] = host_info['fqdn']
					smb['domain_dns'] = host_info['dns_domain_name']
					smb['forest_dns'] = host_info['dns_forest_name']
					smb['server'] = host_info['netbios_computer_name']
					smb['domain'] = host_info['netbios_domain_name']
				end
				
	
				-- If it's ok, do a cleanup and return true
				if(status_name == "NT_STATUS_SUCCESS") then
					-- Check if they're using an un-supported system
					if(os == nil or lanmanager == nil) then
						stdnse.print_debug(1, "SMB: WARNING: the server is using a non-standard SMB implementation; your mileage may vary (%s)", smb['ip'])
					elseif(os == "Unix" or string.sub(lanmanager, 1, 5) == "Samba") then
						stdnse.print_debug(1, "SMB: WARNING: the server appears to be Unix; your mileage may vary.")
					end
				
					-- Check if they were logged in as a guest
					if(log_errors == nil or log_errors == true) then
						if(smb['is_guest'] == 1) then
							stdnse.print_debug(1, string.format("SMB: Extended login to %s as %s\\%s failed, but was given guest access (username may be wrong, or system may only allow guest)", smb['ip'], domain, stdnse.string_or_blank(username)))
						else
							stdnse.print_debug(2, string.format("SMB: Extended login to %s as %s\\%s succeeded", smb['ip'], domain, stdnse.string_or_blank(username)))
						end
					end
	
					-- Set the initial sequence number
					smb['sequence'] = 1

					return true
				end -- Status is ok
			end -- Should we parse the parameters/data?
		until status_name ~= "NT_STATUS_MORE_PROCESSING_REQUIRED"

		-- Check if we got the error NT_STATUS_REQUEST_NOT_ACCEPTED
		if(status == 0xc00000d0) then
			busy_count = busy_count + 1

			if(busy_count > 9) then
				return false, "SMB: ERROR: Server has too many active connections; giving up."
			end

			local backoff = math.random() * 10
			stdnse.print_debug(1, "SMB: Server has too many active connections; pausing for %s seconds.", math.floor(backoff * 100) / 100)
			stdnse.sleep(backoff)
		else
			-- Display a message to the user, and try the next account
			if(log_errors == nil or log_errors == true) then
				stdnse.print_debug(1, "SMB: Extended login to %s as %s\\%s failed (%s)", smb['ip'], domain, stdnse.string_or_blank(username), status_name)
			end

			-- Go to the next account
			if(overrides == nil or overrides['username'] == nil) then
				smbauth.next_account(smb['host'])
				result, username, domain, password, password_hash, hash_type = smbauth.get_account(smb['host'])
				if(not(result)) then
					return false, username
				end
			else
				result = false
			end
		end

		-- Reset the user id
		smb['uid'] = 0

	end -- Loop over the accounts
	
	if(log_errors == nil or log_errors == true) then
		stdnse.print_debug(1, "SMB: ERROR: All logins failed, sorry it didn't work out!")
	end

	return false, status_name
end

--- Sends out SMB_COM_SESSION_SETUP_ANDX, which attempts to log a user in. 
-- Sends the following:
-- * Negotiated parameters (multiplexed connections, virtual circuit, capabilities)
-- * Passwords (plaintext, unicode, lanman, ntlm, lmv2, ntlmv2, etc)
-- * Account name
-- * OS (I just send "Nmap")
-- * Native LAN Manager (no clue what that is, but it seems to be ignored)
--
-- Receives the following:
-- * User ID
-- * Server OS
--
--@param smb          The SMB object associated with the connection
--@param overrides    [optional] A table of overrides for username, domain, password, password_hash, and hash_type. 
--                    If any of these are given, it's used first. If they aren't, then Nmap parameters, Nmap registry entries, 
--                    guest, and NULL sessions are used. 
--@param log_errors   [optional] If set, will display login. Default: true. 
--@return (status, result) If status is false, result is an error message. Otherwise, result is nil and the following
--        elements are added to the smb table:
--    *  'uid'         The UserID for the session
--    *  'is_guest'    If set, the username wasn't found so the user was automatically logged in as the guest account
--    *  'os'          The operating system
--    *  'lanmanager'  The servers's LAN Manager
function start_session(smb, overrides, log_errors)
	-- Use a mutex to avoid some issues (see http://seclists.org/nmap-dev/2011/q1/464)
	local smb_auth_mutex = nmap.mutex( "SMB Authentication Mutex" )
	smb_auth_mutex( "lock" )
	
	local status, result
	if(smb['extended_security'] == true) then
		status, result = start_session_extended(smb, log_errors, overrides)
	else
		status, result = start_session_basic(smb, log_errors, overrides)
	end
	
	smb_auth_mutex( "done" )
	return status, result
end
 
--- Sends out <code>SMB_COM_SESSION_TREE_CONNECT_ANDX</code>, which attempts to connect to a share. 
-- Sends the following:
-- * Password (for share-level security, which we don't support)
-- * Share name
-- * Share type (or "?????" if it's unknown, that's what we do)
--
-- Receives the following:
-- * Tree ID
--
--@param smb       The SMB object associated with the connection
--@param path      The path to connect (eg, <code>"\\servername\C$"</code>)
--@param overrides [optional] Overrides for various fields
--@return (status, result) If status is false, result is an error message. Otherwise, result is a 
--        table with the following elements:
--      * 'tid'         The TreeID for the session
function tree_connect(smb, path, overrides)
	local header, parameters, data, err, result
	local pos
	local header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, pid, mid 
	local andx_command, andx_reserved, andx_offset, action

	-- Make sure we have overrides
	overrides = overrides or {}

	header = smb_encode_header(smb, command_codes['SMB_COM_TREE_CONNECT_ANDX'], overrides)
	parameters = bin.pack("<CCSSS", 
					0xFF,   -- ANDX no further commands
					0x00,   -- ANDX reserved
					0x0000, -- ANDX offset
					(overrides['tree_connect_flags'] or 0x0000), -- flags
					0x0000 -- password length (for share-level security)
				)
	data = bin.pack("zz", 
					        -- Share-level password
					path,   -- Path
					(overrides['tree_type'] or "?????") -- Type of tree ("?????" = any)
				)

	-- Send the tree connect request
	stdnse.print_debug(2, "SMB: Sending SMB_COM_TREE_CONNECT_ANDX")
	result, err = smb_send(smb, header, parameters, data, overrides)
	if(result == false) then
		return false, err
	end

	-- Read the result
	status, header, parameters, data = smb_read(smb)
	if(status ~= true) then
		return false, header
	end

	-- Check if we were allowed in
    local uid, tid
	pos, header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid = bin.unpack("<CCCCCICSSlSSSSS", header)
	if(header1 == nil or mid == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [20]"
	end

	if(status ~= 0) then
		return false, get_status_name(status)
	end

	if(tid == 0 or tonumber(tid) == 0) then
		return false, "SMB: ERROR: Server didn't establish a proper tree connection (likely an embedded system)"
	end

	smb['tid'] = tid

	return true
	
end

--- Disconnects a tree session. Should be called before logging off and disconnecting. 
--@param smb    The SMB object associated with the connection
--@param overrides THe overrides table
--@return (status, result) If status is false, result is an error message. If status is true, 
--              the disconnect was successful. 
function tree_disconnect(smb, overrides)
	overrides = overrides or {}
	local header
	local header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, pid, mid 

	header = smb_encode_header(smb, command_codes['SMB_COM_TREE_DISCONNECT'], overrides)

	-- Send the tree disconnect request
	stdnse.print_debug(2, "SMB: Sending SMB_COM_TREE_DISCONNECT")
	local result, err = smb_send(smb, header, "", "", overrides)
	if(result == false) then
		return false, err
	end

	-- Read the result
	local status, header, parameters, data = smb_read(smb)
	if(status ~= true) then
		return false, header
	end

	-- Check if there was an error
    local uid, tid, pos
	pos, header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid = bin.unpack("<CCCCCICSSlSSSSS", header)
	if(header1 == nil or mid == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [21]"
	end
	if(status ~= 0) then
		return false, get_status_name(status)
	end

	smb['tid'] = 0

	return true
	
end

---Logs off the current user. Strictly speaking this isn't necessary, but it's the polite thing to do. 
--
--@param smb    The SMB object associated with the connection
--@param overrides THe overrides table
--@return (status, result) If status is false, result is an error message. If status is true, 
--              the logoff was successful. 
function logoff(smb, overrides)
	overrides = overrides or {}
	local header, parameters, data
	local header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, pid, mid 

	header = smb_encode_header(smb, command_codes['SMB_COM_LOGOFF_ANDX'], overrides)

	-- Parameters are a blank ANDX block
	parameters = bin.pack("<CCS", 
					0xFF,   -- ANDX no further commands
					0x00,   -- ANDX reserved
					0x0000  -- ANDX offset
	             )

	-- Send the tree disconnect request
	stdnse.print_debug(2, "SMB: Sending SMB_COM_LOGOFF_ANDX")
	local result, err = smb_send(smb, header, parameters, "", overrides)
	if(result == false) then
		return false, err
	end

	-- Read the result
	status, header, parameters, data = smb_read(smb)
	if(status ~= true) then
		return false, header
	end

	-- Reset session variables (note: this has to come after the smb_read(), otherwise the message signatures cause a problem
	smb['uid']      = 0
	smb['sequence'] = -1
	smb['mac_key']  = nil

	-- Check if there was an error
    local uid, tid, pos
	pos, header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid = bin.unpack("<CCCCCICSSlSSSSS", header)
	if(header1 == nil or mid == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [22]"
	end

	if(status == 0xc0000022) then
		stdnse.print_debug(1, "SMB: ERROR: Access was denied in 'logoff', indicating a problem with your message signatures")
		return false, "SMB: ERROR: Access was denied in 'logoff', indicating a problem with your message signatures"
	end
	if(status ~= 0) then
		return false, get_status_name(status)
	end

	return true
	
end

--- This sends a SMB request to open or create a file. 
--  Most of the parameters I pass here are used directly from a packetlog, especially the various permissions fields and flags. 
--  I might make this more adjustable in the future, but this has been working for me. 
--
--@param smb       The SMB object associated with the connection
--@param path      The path of the file or pipe to open
--@param overrides [optional] Overrides for various fields
--@return (status, result) If status is false, result is an error message. Otherwise, result is a table
--        containing a lot of different elements, the most important one being 'fid', the handle to the opened file. 
function create_file(smb, path, overrides)
	local header, parameters, data
	local pos
	local header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, pid, mid 
	local andx_command, andx_reserved, andx_offset
	local oplock_level, fid, create_action, created, last_access, last_write, last_change, attributes, allocation_size, end_of_file, filetype, ipc_state, is_directory
	local error_count = 0

	repeat
		local mutex = nmap.mutex(smb['host'])
		mutex "lock"
	
		-- Make sure we have overrides
		overrides = overrides or {}
	
		header = smb_encode_header(smb, command_codes['SMB_COM_NT_CREATE_ANDX'], overrides)
		parameters = bin.pack("<CCSCSIIILIIIIIC", 
						0xFF,   -- ANDX no further commands
						0x00,   -- ANDX reserved
						0x0000, -- ANDX offset
						0x00,   -- Reserved
						#path, -- Path length
						(overrides['file_create_flags']            or 0x00000016),         -- Create flags
						(overrides['file_create_root_fid']         or 0x00000000),         -- Root FID
						(overrides['file_create_access_mask']      or 0x02000000),         -- Access mask
						(overrides['file_create_allocation_size']  or 0x0000000000000000), -- Allocation size
						(overrides['file_create_attributes']       or 0x00000000),         -- File attributes
						(overrides['file_create_share_attributes'] or 0x00000007),         -- Share attributes
						(overrides['file_create_disposition']      or 0x00000000),         -- Disposition
						(overrides['file_create_options']          or 0x00000000),         -- Create options
						(overrides['file_create_impersonation']    or 0x00000002),         -- Impersonation
						(overrides['file_create_security_flags']   or 0x01)                -- Security flags
					)
	
		data = bin.pack("z", path)
	
		-- Send the create file
		stdnse.print_debug(2, "SMB: Sending SMB_COM_NT_CREATE_ANDX")
		local result, err = smb_send(smb, header, parameters, data, overrides)
		if(result == false) then
			mutex "done"
			return false, err
		end
	
		-- Read the result
		status, header, parameters, data = smb_read(smb, false)
		mutex "done"
		if(status ~= true) then
			return false, header
		end

		-- Check if we were allowed in
	    local uid, tid
		pos, header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid = bin.unpack("<CCCCCICSSlSSSSS", header)
		if(header1 == nil or mid == nil) then
			return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [23]"
		end
		if(status == 0xc00000ac) then
			error_count = error_count + 1
			if(error_count > 10) then
				return false, "SMB: ERROR: Server returned NT_STATUS_PIPE_NOT_AVAILABLE too many times; giving up."
			end
			stdnse.print_debug(1, "WARNING: Server refused connection with NT_STATUS_PIPE_NOT_AVAILABLE; trying again")
			stdnse.sleep(.2)
		end
	until (status ~= 0xc00000ac)

	if(status ~= 0) then
		return false, get_status_name(status)
	end

	-- Parse the parameters
	pos, andx_command, andx_reserved, andx_offset, oplock_level, fid, create_action, created, last_access, last_write, last_change, attributes, allocation_size, end_of_file, filetype, ipc_state, is_directory = bin.unpack("<CCSCSILLLLILLSSC", parameters)
	if(andx_command == nil or is_directory == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [24]"
	end

	-- Fill in the smb table
	smb['oplock_level']    = oplock_level
	smb['fid']             = fid
	smb['create_action']   = create_action
	smb['created']         = created
	smb['last_access']     = last_access
	smb['last_write']      = last_write
	smb['last_change']     = last_change
	smb['attributes']      = attributes
	smb['allocation_size'] = allocation_size
	smb['end_of_file']     = end_of_file
	smb['filetype']        = filetype
	smb['ipc_state']       = ipc_state
	smb['is_directory']    = is_directory
	
	return true
end

--- This sends a SMB request to read from a file (or a pipe). 
--
--@param smb    The SMB object associated with the connection
--@param offset The offset to read from (ignored if it's a pipe)
--@param count  The maximum number of bytes to read
--@param overrides The overrides table
--@return (status, result) If status is false, result is an error message. Otherwise, result is a table
--        containing a lot of different elements. 
function read_file(smb, offset, count, overrides)
	overrides = overrides or {}
	local header, parameters, data
	local pos
	local header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, pid, mid 
	local andx_command, andx_reserved, andx_offset
	local remaining, data_compaction_mode, reserved_1, data_length_low, data_offset, data_length_high, reserved_2, reserved_3
	local response = {}

	header = smb_encode_header(smb, command_codes['SMB_COM_READ_ANDX'], overrides)
	parameters = bin.pack("<CCSSISSISI",
					0xFF,   -- ANDX no further commands
					0x00,   -- ANDX reserved
					0x0000, -- ANDX offset
					smb['fid'], -- FID
					offset,     -- Offset
					count,      -- Max count low
					count,      -- Min count
					0xFFFFFFFF, -- Reserved
					0,          -- Remaining
					0x00000000  -- High offset
				)

	data = ""

	-- Send the create file
	stdnse.print_debug(2, "SMB: Sending SMB_COM_READ_ANDX")
	local result, err = smb_send(smb, header, parameters, data, overrides)
	if(result == false) then
		return false, err
	end

	-- Read the result
	status, header, parameters, data = smb_read(smb)
	if(status ~= true) then
		return false, header
	end

	-- Check if we were allowed in
    local uid, tid
	pos, header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid = bin.unpack("<CCCCCICSSlSSSSS", header)
	
	if(header1 == nil or mid == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [25]"
	end
	if(status ~= 0 and 
		(status ~= status_codes.NT_STATUS_BUFFER_OVERFLOW and (smb['filetype'] == filetype_codes.FILE_TYPE_BYTE_MODE_PIPE or
																smb['filetype'] == filetype_codes.FILE_TYPE_MESSAGE_MODE_PIPE) ) ) then
		return false, get_status_name(status)
	end

	-- Parse the parameters
	pos, andx_command, andx_reserved, andx_offset, remaining, data_compaction_mode, reserved_1, data_length_low, data_offset, data_length_high, reserved_2, reserved_3 = bin.unpack("<CCSSSSSSISI", parameters)
	if(andx_command == nil or reserved_3 == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [26]"
	end

	response['remaining']   = remaining
	response['data_length'] = bit.bor(data_length_low, bit.lshift(data_length_high, 16))
	response['status']      = status


	-- data_start is the offset of the beginning of the data section -- we use this to calculate where the read data lives
	if(response['data_length'] == 0) then
		response['data'] = 0
	else
		local data_start = #header + 1 + #parameters + 2 
		if(data_offset < data_start) then
			return false, "SMB: Start of data isn't in data section"
		end
	
		-- Figure out the offset into the data section
		data_offset = data_offset - data_start
	
		-- Make sure we don't run off the edge of the packet
		if(data_offset + response['data_length'] > #data) then
			return false, "SMB: Data returned runs off the end of the packet"
		end
	
		-- Pull the data string out of the data
		response['data'] = string.sub(data, data_offset + 1, data_offset + response['data_length'])
	end

	return true, response
end

--- This sends a SMB request to write to a file (or a pipe). 
--
--@param smb        The SMB object associated with the connection
--@param write_data The data to write
--@param offset     The offset to write it to (ignored for pipes)
--@param overrides  The overrides table
--@return (status, result) If status is false, result is an error message. Otherwise, result is a table
--        containing a lot of different elements, the most important one being 'fid', the handle to the opened file. 
function write_file(smb, write_data, offset, overrides)
	overrides = overrides or {}
	local header, parameters, data
	local pos
	local header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, pid, mid 
	local andx_command, andx_reserved, andx_offset
	local response = {}

	header = smb_encode_header(smb, command_codes['SMB_COM_WRITE_ANDX'], overrides)
	parameters = bin.pack("<CCSSIISSSSSI",
					0xFF,   -- ANDX no further commands
					0x00,   -- ANDX reserved
					0x0000, -- ANDX offset
					smb['fid'], -- FID
					offset,     -- Offset
					0xFFFFFFFF, -- Reserved
					0x0008,     -- Write mode (Message start, don't write raw, don't return remaining, don't write through
					#write_data,-- Remaining
					0x0000,     -- Data length high
					#write_data,-- Data length low -- TODO: set this properly (to the 2-byte value)
					0x003F,     -- Data offset
					0x00000000  -- Data offset high
				)

	data = write_data

	-- Send the create file
	stdnse.print_debug(2, "SMB: Sending SMB_COM_WRITE_ANDX")
	local result, err = smb_send(smb, header, parameters, data, overrides)
	if(result == false) then
		return false, err
	end


	-- Read the result
	status, header, parameters, data = smb_read(smb)
	if(status ~= true) then
		return false, header
	end

    local uid, tid
	-- Check if we were allowed in
	pos, header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid = bin.unpack("<CCCCCICSSlSSSSS", header)
	if(header1 == nil or mid == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [27]"
	end
	if(status ~= 0) then
		return false, get_status_name(status)
	end

	-- Parse the parameters
    local count_reserved, count_high, remaining, count_low
	pos, andx_command, andx_reserved, andx_offset, count_low, remaining, count_high, count_reserved  = bin.unpack("<CCSSSSS", parameters)
	if(count_reserved == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [28]"
	end

	response['count_low']  = count_low
	response['remaining']  = remaining
	response['count_high'] = count_high
	response['reserved']   = count_reserved

	return true, response
end

--- This sends a SMB request to close a file (or a pipe). 
--
--@param smb        The SMB object associated with the connection
--@param overrides  The overrides table
--@return (status, result) If status is false, result is an error message. Otherwise, result is undefined. 
function close_file(smb, overrides)
	overrides = overrides or {}
	local header, parameters, data
	local pos
	local header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, pid, mid 
	local andx_command, andx_reserved, andx_offset
	local response = {}

	header = smb_encode_header(smb, command_codes['SMB_COM_CLOSE'], overrides)
	parameters = bin.pack("<SI",
					smb['fid'], -- FID
					0xFFFFFFFF  -- Last write (unspecified)
				)

	data = ""

	-- Send the close file
	stdnse.print_debug(2, "SMB: Sending SMB_CLOSE")
	local result, err = smb_send(smb, header, parameters, data, overrides)
	if(result == false) then
		return false, err
	end

	-- Read the result
	status, header, parameters, data = smb_read(smb)
	if(status ~= true) then
		return false, header
	end

	-- Check if the close was successful
    local uid, tid
	pos, header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid = bin.unpack("<CCCCCICSSlSSSSS", header)
	if(header1 == nil or mid == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [27]"
	end
	if(status ~= 0) then
		return false, get_status_name(status)
	end

	-- Close response has no parameters or data
	return true, response
end

--- This sends a SMB request to delete a file (or a pipe). 
--
--@param smb    The SMB object associated with the connection
--@param path   The path of the file to delete
--@param overrides The overrides table
--@return (status, result) If status is false, result is an error message. Otherwise, result is undefined. 
function delete_file(smb, path, overrides)
	overrides = overrides or {}
	local header, parameters, data
	local pos
	local header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, pid, mid 
	local andx_command, andx_reserved, andx_offset

	header = smb_encode_header(smb, command_codes['SMB_COM_DELETE'], overrides)
	parameters = bin.pack("<S",
					0x0027 -- Search attributes (0x27 = include read only, hidden, system, and archive)
				)

	data = bin.pack("<Cz", 
					0x04, -- Ascii formatted filename
					path)

	-- Send the close file
	stdnse.print_debug(2, "SMB: Sending SMB_CLOSE")
	local result, err = smb_send(smb, header, parameters, data, overrides)
	if(result == false) then
		return false, err
	end

	-- Read the result
	status, header, parameters, data = smb_read(smb)
	if(status ~= true) then
		return false, header
	end

	-- Check if the close was successful
    local uid, tid
	pos, header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid = bin.unpack("<CCCCCICSSlSSSSS", header)
	if(header1 == nil or mid == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [27]"
	end
	if(status ~= 0) then
		return false, get_status_name(status)
	end

	-- Close response has no parameters or data
	return true
end

---
-- Implements SMB_COM_TRANSACTION2 to support the find_files function
-- This function has not been extensively tested
--
--@param smb                  The SMB object associated with the connection
--@param sub_command          The SMB_COM_TRANSACTION2 sub command
--@param function_parameters  The parameter data to pass to the function. This is untested, since none of the
--                            transactions I've done have required parameters. 
--@param function_data        The data to send with the packet. This is basically the next protocol layer
--@param overrides            The overrides table
--@return (status, result) If status is false, result is an error message. Otherwise, result is a table 
--        containing 'parameters' and 'data', representing the parameters and data returned by the server. 
local function send_transaction2(smb, sub_command, function_parameters, function_data, overrides)
	overrides = overrides or {}
	local header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, pid, mid 
	local header, parameters, data
	local parameter_offset = 0
	local parameter_size   = 0
	local data_offset      = 0
	local data_size        = 0
	local total_word_count, total_data_count, reserved1, parameter_count, parameter_displacement, data_count, data_displacement, setup_count, reserved2
	local response = {}

	-- Header is 0x20 bytes long (not counting NetBIOS header).
	header = smb_encode_header(smb, command_codes['SMB_COM_TRANSACTION2'], overrides) -- 0x32 = SMB_COM_TRANSACTION2

	if(function_parameters) then
		parameter_offset = 0x44
		parameter_size = #function_parameters
		data_offset = #function_parameters + 33 + 32
	end
	
	-- Parameters are 0x20 bytes long. 
	parameters = bin.pack("<SSSSCCSISSSSSCCS",
					parameter_size,                  -- Total parameter count. 
					data_size,                       -- Total data count. 
					0x000a,                          -- Max parameter count.
					0x3984,                          -- Max data count.
					0x00,                            -- Max setup count.
					0x00,                            -- Reserved.
					0x0000,                          -- Flags (0x0000 = 2-way transaction, don't disconnect TIDs).
					0x00001388,                      -- Timeout (0x00000000 = return immediately).
					0x0000,                          -- Reserved.
					parameter_size,                  -- Parameter bytes.
					parameter_offset,                -- Parameter offset.
					data_size,                       -- Data bytes.
					data_offset,                     -- Data offset.
					0x01,                            -- Setup Count
					0x00,                            -- Reserved
					sub_command                      -- Sub command
	)

	local data = "\0\0\0" .. (function_parameters or '')
	data = data .. (function_data or '')

	-- Send the transaction request
	stdnse.print_debug(2, "SMB: Sending SMB_COM_TRANSACTION2")
	local result, err = smb_send(smb, header, parameters, data, overrides)
	if(result == false) then
		return false, err
	end

	return true
end

local function receive_transaction2(smb)
	
	-- Read the result
	local status, header, parameters, data = smb_read(smb)
	if(status ~= true) then
		return false, header
	end

	-- Check if it worked
	local pos, header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid = bin.unpack("<CCCCCICSSlSSSSS", header)
	if(header1 == nil or mid == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [29]"
	end
	if(status ~= 0) then
		if(status_names[status] == nil) then
			return false, string.format("Unknown SMB error: 0x%08x\n", status)
		else
			return false, status_names[status]
		end
	end

	-- Parse the parameters
	local pos, total_word_count, total_data_count, reserved1, parameter_count, parameter_offset, parameter_displacement, data_count, data_offset, data_displacement, setup_count, reserved2 = bin.unpack("<SSSSSSSSSCC", parameters)
	if(total_word_count == nil or reserved2 == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [30]"
	end

	-- Convert the parameter/data offsets into something more useful (the offset into the data section)
	-- - 0x20 for the header, - 0x01 for the length. 
	parameter_offset = parameter_offset - 0x20 - 0x01 - #parameters - 0x02;
	-- - 0x20 for the header, - 0x01 for parameter length, the parameter length, and - 0x02 for the data length. 
	data_offset = data_offset - 0x20 - 0x01 - #parameters - 0x02;

	-- I'm not sure I entirely understand why the '+1' is here, but I think it has to do with the string starting at '1' and not '0'.
	local function_parameters = string.sub(data, parameter_offset + 1, parameter_offset + parameter_count)
	local function_data       = string.sub(data, data_offset      + 1, data_offset      + data_count)

	local response = {}
	response['parameters'] = function_parameters
	response['data']       = function_data
	
	return true, response	
end
	


---This is the core of making MSRPC calls. It sends out a MSRPC packet with the given parameters and data. 
-- Don't confuse these parameters and data with SMB's concepts of parameters and data -- they are completely
-- different. In fact, these parameters and data are both sent in the SMB packet's 'data' section.
--
-- It is probably best to think of this as another protocol layer. This function will wrap SMB stuff around a 
-- MSRPC call, make the call, then unwrap the SMB stuff from it before returning. 
--
--@param smb                  The SMB object associated with the connection
--@param function_parameters  The parameter data to pass to the function. This is untested, since none of the
--                            transactions I've done have required parameters. 
--@param function_data        The data to send with the packet. This is basically the next protocol layer
--@param pipe [optional]      The pipe to transact on. Default: "\PIPE\". 
--@param no_setup [optional]  If set, the 'setup' is set to 0 and some parameters are left off. This occurs while
--                            using the LANMAN Remote API. Default: false. 
--@param overrides            The overrides table
--@return (status, result) If status is false, result is an error message. Otherwise, result is a table 
--        containing 'parameters' and 'data', representing the parameters and data returned by the server. 
function send_transaction_named_pipe(smb, function_parameters, function_data, pipe, no_setup, overrides)
	overrides = overrides or {}
	local header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, pid, mid 
	local header, parameters, data
	local parameter_offset = 0
	local parameter_size   = 0
	local data_offset      = 0
	local data_size        = 0
	local total_word_count, total_data_count, reserved1, parameter_count, parameter_displacement, data_count, data_displacement, setup_count, reserved2
	local response = {}

	if(pipe == nil) then
		pipe = "\\PIPE\\"
	end

	-- Header is 0x20 bytes long (not counting NetBIOS header).
	header = smb_encode_header(smb, command_codes['SMB_COM_TRANSACTION'], overrides) -- 0x25 = SMB_COM_TRANSACTION

	-- 0x20 for SMB header, 0x01 for parameters header, 0x20 for parameters length, 0x02 for data header, 0x07 for "\PIPE\"
	if(function_parameters) then
		parameter_offset = 0x20 + 0x01 + 0x20 + 0x02 + (#pipe + 1)
		parameter_size = #function_parameters
	end

	if(function_data) then
		data_offset       = 0x20 + 0x01 + 0x20 + 0x02 + (#pipe + 1) + parameter_size
		data_size         = #function_data
	end

	-- Parameters are 0x20 bytes long. 
	parameters = bin.pack("<SSSSCCSISSSSS",
					parameter_size,                  -- Total parameter count. 
					data_size,                       -- Total data count. 
					0x0008,                          -- Max parameter count.
					0x3984,                          -- Max data count.
					0x00,                            -- Max setup count.
					0x00,                            -- Reserved.
					0x0000,                          -- Flags (0x0000 = 2-way transaction, don't disconnect TIDs).
					0x00001388,                      -- Timeout (0x00000000 = return immediately).
					0x0000,                          -- Reserved.
					parameter_size,                  -- Parameter bytes.
					parameter_offset,                -- Parameter offset.
					data_size,                       -- Data bytes.
					data_offset                      -- Data offset.
	)

	if(no_setup) then
		parameters = parameters .. bin.pack("<CC", 
						0x00,                            -- Number of 'setup' words (none)
						0x00                             -- Reserved.
					)
	else
		parameters = parameters .. bin.pack("<CCSS",
						0x02,                            -- Number of 'setup' words
						0x00,                            -- Reserved.
						0x0026,                          -- Function to call.
						smb['fid']                       -- Handle to open file
					)
	end

	data = bin.pack("<z", pipe)
	data = data .. bin.pack("<I", 0) -- Padding

	data = data .. (function_parameters or '')
	data = data .. (function_data or '')

	-- Send the transaction request
	stdnse.print_debug(2, "SMB: Sending SMB_COM_TRANSACTION")
	local result, err = smb_send(smb, header, parameters, data, overrides)
	if(result == false) then
		return false, err
	end

	-- Read the result
	status, header, parameters, data = smb_read(smb)
	if(status ~= true) then
		return false, header
	end

	-- Check if it worked
    local uid, tid, pos
	pos, header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid = bin.unpack("<CCCCCICSSlSSSSS", header)
	if(header1 == nil or mid == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [29]"
	end
	if(status ~= 0) then
		if(status_names[status] == nil) then
			return false, string.format("Unknown SMB error: 0x%08x\n", status)
		else
			return false, status_names[status]
		end
	end

	-- Parse the parameters
	pos, total_word_count, total_data_count, reserved1, parameter_count, parameter_offset, parameter_displacement, data_count, data_offset, data_displacement, setup_count, reserved2 = bin.unpack("<SSSSSSSSSCC", parameters)
	if(total_word_count == nil or reserved2 == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [30]"
	end

	-- Convert the parameter/data offsets into something more useful (the offset into the data section)
	-- - 0x20 for the header, - 0x01 for the length. 
	parameter_offset = parameter_offset - 0x20 - 0x01 - #parameters - 0x02;
	-- - 0x20 for the header, - 0x01 for parameter length, the parameter length, and - 0x02 for the data length. 
	data_offset = data_offset - 0x20 - 0x01 - #parameters - 0x02;

	-- I'm not sure I entirely understand why the '+1' is here, but I think it has to do with the string starting at '1' and not '0'.
	function_parameters = string.sub(data, parameter_offset + 1, parameter_offset + parameter_count)
	function_data       = string.sub(data, data_offset      + 1, data_offset      + data_count)

	response['parameters'] = function_parameters
	response['data']       = function_data

	return true, response
end

function send_transaction_waitnamedpipe(smb, priority, pipe, overrides)
	overrides = overrides or {}
	local header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, pid, mid 
	local header, parameters, data
	local parameter_offset, data_offset
	local total_word_count, total_data_count, reserved1, parameter_count, parameter_offset, parameter_displacement, data_count, data_offset, data_displacement, setup_count, reserved2
	local response = {}
	local padding = ""

	-- Header is 0x20 bytes long (not counting NetBIOS header).
	header = smb_encode_header(smb, command_codes['SMB_COM_TRANSACTION'], overrides) -- 0x25 = SMB_COM_TRANSACTION

	-- Parameters are 0x20 bytes long. 
	parameters = bin.pack("<SSSSCCSISSSSSCCSS",
					0,                               -- Total parameter count. 
					0,                               -- Total data count. 
					0x000,                           -- Max parameter count.
					0x400,                           -- Max data count.
					0x00,                            -- Max setup count.
					0x00,                            -- Reserved.
					0x0000,                          -- Flags (0x0000 = 2-way transaction, don't disconnect TIDs).
					30,                              -- Timeout (0x00000000 = return immediately).
					0x0000,                          -- Reserved.
					0,                               -- Parameter bytes.
					0,                               -- Parameter offset.
					0,                               -- Data bytes.
					0,                               -- Data offset.
					0x02,                            -- Number of 'setup' words (only ever seen '2').
					0x00,                            -- Reserved.
					0x0053,                          -- Function to call.
					priority                         -- Handle to open file
				)

	while(((#pipe + 1 + #padding) % 4) ~= 0) do
		padding = padding .. string.char(0)
	end
	data = bin.pack("<zA", pipe, padding);

	-- Send the transaction request
	stdnse.print_debug(2, "SMB: Sending SMB_COM_TRANSACTION (WaitNamedPipe)")
	local result, err = smb_send(smb, header, parameters, data, overrides)
	if(result == false) then
		return false, err
	end

	-- Read the result
	status, header, parameters, data = smb_read(smb)
	if(status ~= true) then
		return false, header
	end

	-- Check if it worked
    local uid, tid, pos
	pos, header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid = bin.unpack("<CCCCCICSSlSSSSS", header)
	if(header1 == nil or mid == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [31]"
	end
	if(status ~= 0) then
		if(status_names[status] == nil) then
			return false, string.format("Unknown SMB error: 0x%08x\n", status)
		else
			return false, status_names[status]
		end
	end

	-- Parse the parameters
	pos, total_word_count, total_data_count, reserved1, parameter_count, parameter_offset, parameter_displacement, data_count, data_offset, data_displacement, setup_count, reserved2 = bin.unpack("<SSSSSSSSSCC", parameters)
	if(total_word_count == nil or reserved2 == nil) then
		return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [32]"
	end

	return true, response
end

---Upload a file from the local machine to the remote machine, on the given share. 
-- 
--@param host       The host object
--@param localfile  The file on the local machine, relative to the nmap path
--@param share      The share to upload it to (eg, C$). 
--@param remotefile The remote file on the machine. It is relative to the share's root. 
--@param overrides  A table of override values that's passed to the smb functions. 
--@param encoded    Set to 'true' if the file is encoded (xor'ed with 0xFF), It will be decoded before upload. Default: false
--@return (status, err) If status is false, err is an error message. Otherwise, err is undefined. 
function file_upload(host, localfile, share, remotefile, overrides, encoded)
	local status, err, smbstate
	local chunk = 1024

	-- Attempt to open a handle to the file without adding a path to it
	local handle = io.open(localfile, "r")

	-- If the open failed, try to search for the file
	if(not(handle)) then
		stdnse.print_debug(1, "Couldn't open %s directly, searching Nmap's paths...", localfile)
		local filename = nmap.fetchfile(localfile)

		-- Check if it was found
		if(filename == nil) then
			return false, string.format("Couldn't find the file to upload (%s)", localfile)
		end
		handle = io.open(filename, "r")
	end

	-- Create the SMB session
	status, smbstate = start_ex(host, true, true, share, remotefile, nil, overrides)
	if(status == false) then
		return false, smbstate
	end


	local i = 0
	local data = handle:read(chunk)
	while(data ~= nil and #data > 0) do

		if(encoded) then
			local new_data = ""
			for j = 1, #data, 1 do
				new_data = new_data .. string.char(bit.bxor(0xFF, string.byte(data, j)))
			end
			data = new_data
		end
	
		status, err = write_file(smbstate, data, i)
		if(status == false) then
			stop(smbstate)
			return false, err
		end

		data = handle:read(chunk)
		i = i + chunk
	end
	
	handle:close()
	status, err = close_file(smbstate)
	if(status == false) then
		stop(smbstate)
		return false, err
	end

	-- Stop the session
	stop(smbstate)

	return true
end

---Write given data to the remote machine on the given share. This is similar to <code>file_upload</code>, except the 
-- data is given as a string, not a file. 
--
--@param host          The host object
--@param share         The share to upload it to (eg, C$). 
--@param remotefile    The remote file on the machine. It is relative to the share's root. 
--@param use_anonymous [optional] If set to 'true', test is done by the anonymous user rather than the current user. 
--@return (status, err) If status is false, err is an error message. Otherwise, err is undefined. 
function file_write(host, data, share, remotefile, use_anonymous)
	local status, err, smbstate
	local chunk = 1024
	local overrides = nil

	-- If anonymous is being used, create some overrides
	if(use_anonymous) then
		overrides = get_overrides_anonymous()
	end

	-- Create the SMB sessioan
	status, smbstate = start_ex(host, true, true, share, remotefile, nil, overrides)

	if(status == false) then
		return false, smbstate
	end

	local i = 1
	while(i <= #data) do
		local chunkdata = string.sub(data, i, i + chunk - 1)
		status, err = write_file(smbstate, chunkdata, i - 1)
		if(status == false) then
			stop(smbstate)
			return false, err
		end

		i = i + chunk
	end
	
	status, err = close_file(smbstate)
	if(status == false) then
		stop(smbstate)
		return false, err
	end

	-- Stop the session
	stop(smbstate)

	return true
end

---Write given data to the remote machine on the given share. This is similar to <code>file_upload</code>, except the 
-- data is given as a string, not a file. 
--
--@param host          The host object
--@param share         The share to read it from (eg, C$). 
--@param remotefile    The remote file on the machine. It is relative to the share's root. 
--@param use_anonymous [optional] If set to 'true', test is done by the anonymous user rather than the current user. 
--@param overrides     [optional] Override various fields in the SMB packets. 
--@return (status, err) If status is false, err is an error message. Otherwise, err is undefined. 
function file_read(host, share, remotefile, use_anonymous, overrides)
	local status, err, smbstate
	local result
	local chunk = 1024
	local read = ""

	-- Make sure we got overrides
	overrides = overrides or {}

	-- If anonymous is being used, create some overrides
	if(use_anonymous) then
		overrides = get_overrides_anonymous(overrides)
	end

	-- Create the SMB sessioan
	status, smbstate = start_ex(host, true, true, share, remotefile, nil, overrides)

	if(status == false) then
		return false, smbstate
	end

	local i = 1
	while true do
		status, result = read_file(smbstate, i - 1, chunk)
		if(status == false) then
			stop(smbstate)
			return false, result
		end

		if(result['data_length'] == 0) then
			break
		end

		read = read .. result['data']
		i = i + chunk
	end
	
	status, err = close_file(smbstate)
	if(status == false) then
		stop(smbstate)
		return false, err
	end

	-- Stop the session
	stop(smbstate)
	return true, read
end

---Check how many files, in a given list, exist on the given share. 
--
--@param host          The host object
--@param share         The share to read it from (eg, C$). 
--@param files         A list of files to look for; it is relative to the share's root.
--@param overrides     [optional] Override various fields in the SMB packets. 
--@return status: A true/false value indicating success
--@return count:  The number of files that existed, or an error message if status is 'false'
--@return files:  A list of the files that existed.
function files_exist(host, share, files, overrides)
	local status, smbstate, result, err

	-- Make sure we got overrides
	overrides = overrides or {}

	-- We don't wan to be creating the files
	overrides['file_create_disposition'] = 1

	-- Create the SMB sessioan
	status, smbstate = start_ex(host, true, true, share, nil, nil, overrides)

	if(status == false) then
		return false, smbstate
	end

	local exist = 0
	local list  = {}

	for _, file in ipairs(files) do
		-- Try and open the file
		status, result = create_file(smbstate, file, overrides)

		-- If there was an error other than 'file already exists', return an error
		if(not(status) and result ~= 'NT_STATUS_OBJECT_NAME_NOT_FOUND') then
			return false, result
		end

		-- If the file existed, count it and close it
		if(status) then
			exist = exist + 1
			table.insert(list, file)
			status, err = close_file(smbstate)
			if(status == false) then
				stop(smbstate)
				return false, err
			end
		end
	end
	
	-- Stop the session
	stop(smbstate)
	return true, exist, list
end

---Delete a file from the remote machine
-- 
--@param host       The host object
--@param share      The share to upload it to (eg, C$). 
--@param remotefile The remote file on the machine. It is relative to the share's root. It can be a string, or an array. 
--@return (status, err) If status is false, err is an error message. Otherwise, err is undefined. 
function file_delete(host, share, remotefile)
	local status, smbstate, err

	-- Create the SMB session
	status, smbstate = start_ex(host, true, true, share)
	if(status == false) then
		return false, smbstate
	end

	-- Make sure the remotefile is always a table, to save on duplicate code
	if(type(remotefile) ~= "table") then
		remotefile = {remotefile}
	end


	for _, file in ipairs(remotefile) do
		status, err = delete_file(smbstate, file)
		if(status == false) then
			stdnse.print_debug(1, "SMB: Couldn't delete %s\\%s: %s", share, file, err)
			if(err ~= 'NT_STATUS_OBJECT_NAME_NOT_FOUND') then
				stop(smbstate)
				return false, err
			end
		end
	end

	-- Stop the session
	stop(smbstate)

	return true
end

---
-- List files based on a pattern withing a given share and directory
--
-- @param smbstate the SMB object associated with the connection
-- @param fname filename to search for, relative to share path
-- @param options table containing none or more of the following
--        <code>srch_attrs</code> table containing one or more of the following boolean attributes:
--              <code>ro</code> - find read only files
--              <code>hidden</code> - find hidden files
--              <code>system</code> - find system files
--              <code>volid</code> - include volume ids in result
--              <code>dir</code> - find directories
--              <code>archive</code> - find archived files
-- @return iterator function retreiving the next result
function find_files(smbstate, fname, options)
	local TRANS2_FIND_FIRST2, TRANS2_FIND_NEXT2 = 1, 2
	options = options or {}

	if (not(options.srch_attrs)) then
		options.srch_attrs = { ro = true, hidden = true, system = true, dir = true}
	end
	
	local nattrs = ( options.srch_attrs.ro and 1 or 0 ) + ( options.srch_attrs.hidden and 2 or 0 ) +
			( options.srch_attrs.hidden and 2 or 0 ) + ( options.srch_attrs.system and 4 or 0 ) +
			( options.srch_attrs.volid and 8 or 0 ) + ( options.srch_attrs.dir and 16 or 0 ) +
			( options.srch_attrs.archive and 32 or 0 )

	if ( not(fname) ) then
		fname = '\\*'
	elseif( fname:sub(1,1) ~= '\\' ) then
		fname = '\\' .. fname
	end
	
	fname = fname .. '\0'
			
	-- Sends the request and takes care of short/fragmented responses
	local function send_and_receive_find_request(smbstate, trans_type, function_parameters)
		
		local status, err = send_transaction2(smbstate, trans_type, function_parameters, "")
		if ( not(status) ) then
			return false, "Failed to send data to server: send_transaction2"
		end
				
		local status, response = receive_transaction2(smbstate)
		if ( not(status) ) then
			return false, "Failed to receive data from server: receive_transaction2"
		end
	
		local pos = ( TRANS2_FIND_FIRST2 == trans_type and 9 or 7 )
		local last_name_offset = select(2, bin.unpack("<S", response.parameters, pos))

		if ( not(last_name_offset) ) then
			return false, "Could not determine last_name_offset"
		end

		-- check if we need more packets to reassemble this transaction
		local NE_UP_TO_FNAME_SIZE = 94
		while ( last_name_offset > ( #response.data - NE_UP_TO_FNAME_SIZE ) ) do
			local status, tmp = receive_transaction2(smbstate)
			if ( not(status) ) then
				return false, "Failed to receive data from receive_transaction2"
			end
			response.data = response.data .. tmp.data			
		end
		
		return true, response
	end

	local srch_count = 173 -- picked up by wireshark
	local flags = 6 -- Return RESUME keys, close search if END OF SEARCH is reached
	local loi   = 260 -- Level of interest, return SMB_FIND_FILE_BOTH_DIRECTORY_INFO
	local storage_type = 0 -- despite the documentation of having to be either 0x01 or 0x40, wireshark reports 0
		
	local function_parameters = bin.pack("<SSSSIA", nattrs, srch_count, flags, loi, storage_type, fname)
	
	-- SMB header: 32
	-- trans2 header: 36
	-- FIND_FIRST2 parameters: #function_parameters
	local pad = ( 32 + 36 + #function_parameters ) % 4
	if ( pad > 0 ) then
		for i=1, ( 4-pad ) do
			function_parameters = function_parameters .. "\0"
		end
	end
	

	local function next_item()

		local status, response = send_and_receive_find_request(smbstate, TRANS2_FIND_FIRST2, function_parameters)
		if ( not(status) ) then
			return
		end
		
		local srch_id = select(2, bin.unpack("<S", response.parameters))
		local stop_loop = ( select(2, bin.unpack("<S", response.parameters, 5)) ~= 0 )
		local first = true
		local last_name

		repeat
			local pos = 1	
			if ( not(first) ) then
				local function_parameters = bin.pack("<SSSISA", srch_id, srch_count, loi, 0, flags, last_name .. "\0")
				status, response = send_and_receive_find_request(smbstate, TRANS2_FIND_NEXT2, function_parameters)
				if ( not(status) ) then
					return
				end

				-- check whether END-OF-SEARCH was set
				stop_loop = ( select(2, bin.unpack(">S", response.parameters, 3)) ~= 0 )
			end
	
			-- parse response, based on LOI == 260
			repeat
				local fe, last_pos, ne, f_len, ea_len, sf_len, _ = {}, pos
				
				pos, ne, fe.fi, fe.created, fe.accessed, fe.write, fe.change,
				fe.eof, fe.alloc_size, fe.attrs, f_len, ea_len, sf_len, _ = bin.unpack("<IILLLLLLIIICC", response.data, pos)
				pos, fe.s_fname = bin.unpack("A24", response.data, pos)

				local time = fe.created
				time = (time / 10000000) - 11644473600
				fe.created = os.date("%Y-%m-%d %H:%M:%S", time)

				-- TODO: cleanup fe.s_fname
				pos, fe.fname = bin.unpack("A" .. f_len, response.data, pos)
				pos = last_pos + ne

				-- removing trailing zero bytes from file name
				fe.fname = fe.fname:sub(1, -2)
				last_name = fe.fname

				coroutine.yield(fe)
			until ( ne == 0 )
			first = false
		until(stop_loop)
		return			
	end
	return coroutine.wrap(next_item)
end

---Determine whether or not the anonymous user has write access on the share. This is done by creating then 
-- deleting a file. 
--
--@param host     The host object
--@param share    The share to test
--@return (status, result) If status is false, result is an error message. The error message 'NT_STATUS_OBJECT_NAME_NOT_FOUND'
--        should be handled gracefully; it indicates that the share isn't a fileshare. Otherwise, result is a boolean value: 
--        true if the file was successfully written, false if it was not. 
function share_anonymous_can_write(host, share)
	local filename, status, err

	-- First, choose a filename. This should be random. 
	filename = "nmap-test-file"

	-- Next, attempt to write to that file
	status, err = file_write(host, string.rep("ABCDEFGHIJKLMNOPQRSTUVWXYZ", 10), share, filename, true)
	if(status == false) then
		if(err == "NT_STATUS_OBJECT_NAME_NOT_FOUND") then
			return false, err
		end

		if(err == "NT_STATUS_ACCESS_DENIED" or err == "NT_STATUS_INVALID_PARAMETER") then
			return true, false
		end

		return false, "Error writing test file to disk as anonymous: " .. err
	end

	-- Now the important part: delete it
	status, err = file_delete(host, share, filename)
	if(status == false) then
		return false, "Error deleting test file as anonymous: " .. err
	end

	return true, true
end


---Determine whether or not the current user has read or read/write access on the share. This is done by creating then 
-- deleting a file. 
--
--@param host     The host object
--@param share    The share to test
--@return (status, result) If status is false, result is an error message. The error message 'NT_STATUS_OBJECT_NAME_NOT_FOUND'
--        should be handled gracefully; it indicates that the share isn't a fileshare. Otherwise, result is a boolean value: 
--        true if the file was successfully written, false if it was not. 
function share_user_can_write(host, share)

	local filename, status, err

	-- First, choose a filename. This should be random. 
	filename = "nmap-test-file"

	-- Next, attempt to write to that file
	status, err = file_write(host, string.rep("ABCDEFGHIJKLMNOPQRSTUVWXYZ", 10), share, filename)
	if(status == false) then
		if(err == "NT_STATUS_OBJECT_NAME_NOT_FOUND") then
			return false, err
		end

		if(err == "NT_STATUS_ACCESS_DENIED" or err == "NT_STATUS_INVALID_PARAMETER") then
			return true, false
		end

		return false, "Error writing test file to disk as user: " .. err
	end

	-- Now the important part: delete it
	status, err = file_delete(host, share, filename)
	if(status == false) then
		return false, "Error deleting test file as user: " .. err
	end

	return true, true
end

---Check whether or not a share is accessible by the anonymous user. Assumes that <code>share_host_returns_proper_error</code>
-- has been called and returns <code>true</code>. 
--
--@param host     The host object
--@param share    The share to test
--@return (status, result) If status is false, result is an error message. Otherwise, result is a boolean value: 
--        true if anonymous access is permitted, false otherwise. 
function share_anonymous_can_read(host, share)
	local status, smbstate, err
	local overrides = get_overrides_anonymous()

	-- Begin the SMB session
	status, smbstate = start(host)
	if(status == false) then
		return false, smbstate
	end

	-- Negotiate the protocol
	status, err = negotiate_protocol(smbstate, overrides)
	if(status == false) then
		stop(smbstate) 
		return false, err
	end

	-- Start up a null session
	status, err = start_session(smbstate, overrides)

	if(status == false) then
		stop(smbstate) 
		return false, err
	end

	-- Attempt a connection to the share
	status, err = tree_connect(smbstate, share, overrides)
	if(status == false) then

		-- Stop the session
		stop(smbstate)

		-- ACCESS_DENIED is the expected error: it tells us that the connection failed
		if(err == 0xc0000022 or err == 'NT_STATUS_ACCESS_DENIED') then
			return true, false
		else
			return false, err
		end
	end



	stop(smbstate) 
	return true, true
end

---Check whether or not a share is accessible by the current user. Assumes that <code>share_host_returns_proper_error</code>
-- has been called and returns <code>true</code>. 
--
--@param host     The host object
--@param share    The share to test
--@return (status, result) If status is false, result is an error message. Otherwise, result is a boolean value: 
--        true if anonymous access is permitted, false otherwise. 
function share_user_can_read(host, share)
	local status, smbstate, err
	local overrides = {}

	-- Begin the SMB session
	status, smbstate = start(host)
	if(status == false) then
		return false, smbstate
	end

	-- Negotiate the protocol
	status, err = negotiate_protocol(smbstate, overrides)
	if(status == false) then
		stop(smbstate) 
		return false, err
	end

	-- Start up a null session
	status, err = start_session(smbstate, overrides)
	if(status == false) then
		stop(smbstate) 
		return false, err
	end

	-- Attempt a connection to the share
	status, err = tree_connect(smbstate, share, overrides)
	if(status == false) then

		-- Stop the session
		stop(smbstate)

		-- ACCESS_DENIED is the expected error: it tells us that the connection failed
		if(err == 0xc0000022 or err == 'NT_STATUS_ACCESS_DENIED') then
			return true, false
		else
			return false, err
		end
	end

	stop(smbstate) 
	return true, true
end

---Determine whether or not a host will accept any share name (I've seen this on certain systems; it's 
-- bad, because it means we cannot tell whether or not a share exists). 
--
--@param host     The host object
--@param use_anonymous [optional] If set to 'true', test is done by the anonymous user rather than the current user. 
--@return (status, result) If status is false, result is an error message. Otherwise, result is a boolean value: 
--        true if the file was successfully written, false if it was not. 
function share_host_returns_proper_error(host, use_anonymous)
	local status, smbstate, err
	local share = "nmap-share-test"
	local overrides
	
	if ( use_anonymous ) then
		overrides = get_overrides_anonymous()
	end

	-- Begin the SMB session
	status, smbstate = start(host)
	if(status == false) then
		return false, smbstate
	end

	-- Negotiate the protocol
	status, err = negotiate_protocol(smbstate, overrides)
	if(status == false) then
		stop(smbstate) 
		return false, err
	end

	-- Start up a null session
	status, err = start_session(smbstate, overrides)
	if(status == false) then
		stop(smbstate) 
		return false, err
	end

	-- Connect to the share
	stdnse.print_debug(1, "SMB: Trying a random share to see if server responds properly: %s", share)
	status, err = tree_connect(smbstate, share, overrides)

	if(status == false) then
		-- If the error is NT_STATUS_ACCESS_DENIED (0xc0000022), that's bad -- we don't want non-existent shares
		-- showing up as 'access denied'. Any other error is ok. 
		if(err == 0xc0000022 or err == 'NT_STATUS_ACCESS_DENIED') then
			stdnse.print_debug(1, "SMB: Server doesn't return proper value for non-existent shares (returns ACCESS_DENIED)")
			stop(smbstate)
			return true, false
		end
	else
		-- If we were actually able to connect to this share, then there's probably a serious issue
		stdnse.print_debug(1, "SMB: Server doesn't return proper value for non-existent shares (accepts the connection)")
		stop(smbstate)
		return true, false
	end

	stop(smbstate)
	return true, true
end

---Get all the details we can about the share. These details are stored in a table and returned. 
--
--@param host   The host object.
--@param share An array of shares to check.
--@return (status, result) If status is false, result is an error message. Otherwise, result is a boolean value: 
--        true if the file was successfully written, false if it was not. 
function share_get_details(host, share)
	local msrpc = require "msrpc" -- avoid require cycle
    local smbstate, status, result
    local i
	local details = {}

	-- Save the name
	details['name'] = share

	-- Check if the current user can read the share
	stdnse.print_debug(1, "SMB: Checking if share %s can be read by the current user", share)
	status, result = share_user_can_read(host, share)
	if(status == false) then
		return false, result
	end
	details['user_can_read'] = result

	-- Check if the anonymous reader can read the share
	stdnse.print_debug(1, "SMB: Checking if share %s can be read by the anonymous user", share)
	status, result = share_anonymous_can_read(host, share)
	if(status == true) then
		details['anonymous_can_read'] = result
	end
	
	-- Check if the current user can write to the share
	stdnse.print_debug(1, "SMB: Checking if share %s can be written by the current user", share)
	status, result = share_user_can_write(host, share)
	if(status == false) then
		if(result == "NT_STATUS_OBJECT_NAME_NOT_FOUND") then
			details['user_can_write'] = "NT_STATUS_OBJECT_NAME_NOT_FOUND"
		else
			return false, result
		end
	end
	details['user_can_write'] = result

	-- Check if the anonymous user can write to the share
	stdnse.print_debug(1, "SMB: Checking if share %s can be written by the anonymous user", share)
	status, result = share_anonymous_can_write(host, share)
	if(status == false and result == "NT_STATUS_OBJECT_NAME_NOT_FOUND") then
		details['anonymous_can_write'] = "NT_STATUS_OBJECT_NAME_NOT_FOUND"
	elseif( status == true ) then
		details['anonymous_can_write'] = result
	end

	-- Try and get full details about the share
	status, result = msrpc.get_share_info(host, share)
	if(status == false) then
		-- We don't stop for this error (it's pretty common since administive privileges are required here)
		stdnse.print_debug(1, "SMB: Failed to get share info for %s: %s", share, result)
		details['details'] = result
	else
		-- Process the result a bit
		result = result['info']
		if(result['max_users'] == 0xFFFFFFFF) then
			result['max_users'] = "<unlimited>"
		end
		details['details'] = result
	end
	
    return true, details
end

---Retrieve a list of fileshares, along with any details that could be pulled. This is the core of smb-enum-shares.nse, but
-- can also be used by any script that needs to find an open share. 
--
-- In the best care, the shares are determined by calling <code>msrpc.enum_shares</code>, and information is gathered by calling 
-- <code>msrpc.get_share_info</code>. These require a certain level of access, though, so as a fallback, a pre-programmed list of
-- shares is used, and these are verified by attempting a connection. 
--
--@param host The host object. 
--@return (status, result, extra) If status is false, result is an error message. Otherwise, result is an array of shares with as much
--        detail as we could get. If extra isn't nil, it is set to extra information that should be displayed (such as a warning). 
function share_get_list(host)
	local msrpc = require "msrpc" -- avoid require cycle
	local status, result
	local enum_status
	local extra = ""
	local shares = {}
	local share_details = {}

	-- Try and do this the good way, make a MSRPC call to get the shares
	stdnse.print_debug(1, "SMB: Attempting to log into the system to enumerate shares")
	enum_status, shares = msrpc.enum_shares(host)

	-- If that failed, try doing it with brute force. This almost certainly won't find everything, but it's the
	-- best we can do. 
	if(enum_status == false) then
		stdnse.print_debug(1, "SMB: Enumerating shares failed, guessing at common ones (%s)", shares)
		extra = string.format("ERROR: Enumerating shares failed, guessing at common ones (%s)", shares)

		-- Take some common share names I've seen (thanks to Brandon Enright for most of these, except the last few)
		shares = {"ADMIN", "BACKUP", "DATA", "DESKTOP", "DOCS", "FILES", "GROUPS", "HD", "HOME", "INFO", "IPC", "MEDIA", "MY DOCUMENTS", "NETLOGON", "PICTURES", "PORN", "PR0N", "PRINT", "PROGRAMS", "PRON", "PUBLIC", "SHARE", "SHARED", "SOFTWARE", "STMP", "TEMP", "TEST", "TMP", "USERS", "WEB DOCUMENTS","WEBSERVER", "WWW", "XSERVE" }

		-- Try every alphabetic share
		for i = string.byte("A", 1), string.byte("Z", 1), 1 do
			shares[#shares + 1] = string.char(i)
		end
		
		-- For each share, add one with the same name and a trailing '$'
		local sharesLength = #shares
		for shareItr = 1, sharesLength, 1 do
			shares[ sharesLength + shareItr ] = shares[ shareItr ] .. '$'
		end
	else
		stdnse.print_debug(1, "SMB: Found %d shares, will attempt to find more information", #shares)
	end

	-- Sort the shares
	table.sort(shares)

	-- Ensure that the server returns the proper error message
	-- first try anonymously, then using a user account (in case anonymous connections are not supported)
	for _, anon in ipairs({true, false}) do
		status, result = share_host_returns_proper_error(host)
	
		if(status == true and result == false) then
			return false, "Server doesn't return proper value for non-existent shares; can't enumerate shares"
		end
	end
	
	if(status == false) then
		return false, result
	end
	
	-- Get more information on each share
	for i = 1, #shares, 1 do
		local status, result
		stdnse.print_debug(1, "SMB: Getting information for share: %s", shares[i])
		status, result = share_get_details(host, shares[i])
		if(status == false and result == 'NT_STATUS_BAD_NETWORK_NAME') then
			stdnse.print_debug(1, "SMB: Share doesn't exist: %s", shares[i])
		elseif(status == false) then
			stdnse.print_debug(1, "SMB: Error while getting share details: %s", result)
			return false, result
		else
			-- Save the share details
			table.insert(share_details, result)
		end
	end

	return true, share_details, extra
end

---Find a share that the current user can write to. Return it, along with its path. If no share could be found, 
-- an error is returned. If the path cannot be determined, the returned path is nil. 
--
--@param host The host object. 
--@return (status, name, path, names) If status is false, result is an error message. Otherwise, name is the name of the share, 
--        path is its path, if it could be determined, and names is a list of all writable shares. 
function share_find_writable(host)
	local i
	local status, shares
	local main_name, main_path
	local names = {}
	local writable = {}

	status, shares = share_get_list(host)
	if(status == false) then
		return false, shares
	end

	for i = 1, #shares, 1 do
		if(shares[i]['user_can_write'] == true) then
			if(main_name == nil) then
				main_name = shares[i]['name']

				if(shares[i]['details'] ~= nil) then
					main_path = shares[i]['details']['path']
				end
			end

			table.insert(names, shares[i]['name'])
		end
	end

	if(main_name == nil) then
		return false, "Couldn't find a writable share!"
	else
		return true, main_name, main_path, names
	end
end

--- Converts numbered Windows version strings (<code>"Windows 5.0"</code>, <code>"Windows 5.1"</code>) to names (<code>"Windows 2000"</code>, <code>"Windows XP"</code>). 
--@param os The numbered OS version.
--@return The actual name of the OS (or the same as the <code>os</code> parameter if no match was found).
function get_windows_version(os)

	if(os == "Windows 5.0") then
		return "Windows 2000"
	elseif(os == "Windows 5.1")then
		return "Windows XP"
	end

	return os

end

---Retrieve information about the host's operating system. This should always be possible to call, as long as there isn't already
-- a SMB session established. 
--
-- The returned table has the following keys (shown here with sample values).
-- * <code>os</code>: <code>"Windows 7 Professional 7601 Service Pack 1"</code>
-- * <code>lanmanager</code>: <code>"Windows 7 Professional 6.1"</code>
-- * <code>domain</code>: <code>"WORKGROUP"</code>
-- * <code>server</code>: <code>"COMPUTERNAME"</code>
-- * <code>time</code>: <code>1347121470.0462</code>
-- * <code>date</code>: <code>"2012-09-08 09:24:30"</code>
-- * <code>timezone</code>: <code>-7</code>
-- * <code>timezone_str</code>: <code>UTC-7</code>
-- The table may also contain these additional keys:
-- * <code>fqdn</code>: <code>"Sql2008.lab.test.local"</code>
-- * <code>domain_dns</code>: <code>"lab.test.local"</code>
-- * <code>forest_dns</code>: <code>"test.local"</code>
-- * <code>workgroup</code>
--
--@param host The host object
--@return (status, data) If status is true, data is a table of values; otherwise, data is an error message. 
function get_os(host)
    local state
    local status, smbstate

	local response = {}

    -- Start up SMB
    status, smbstate = start_ex(host, true, true, nil, nil, true)
    if(status == false) then
		return false, smbstate
    end

	-- See if we actually got something
    if(smbstate['os'] == nil and smbstate['lanmanager'] == nil) then
		return false, "Server didn't return OS details"
	end

	response['os']           = smbstate['os']
	response['lanmanager']   = smbstate['lanmanager']
	response['domain']       = smbstate['domain']
	response['server']       = smbstate['server']
	response['date']         = smbstate['date']
	response['time']         = smbstate['time']
	response['timezone_str'] = smbstate['timezone_str']
	response['timezone']     = smbstate['timezone']
	
    -- Kill SMB
    stop(smbstate)
    
    
    -- Start another session with extended security. This will allow us to get
    -- additional information about the target.
    status, smbstate = start_ex(host, true, true, nil, nil, false)
    if(status == true) then
		-- See if we actually got something
		if (smbstate['fqdn'] or smbstate['domain_dns'] or smbstate['forest_dns']) then
			response['fqdn']         = smbstate['fqdn']
			response['domain_dns']   = smbstate['domain_dns']
			response['forest_dns']   = smbstate['forest_dns']
			-- After a non-extended security negotiation, smbstate['domain'] will
			-- contain the NetBIOS domain name, or the workgroup name. However,
			-- after an extended-security session setup, smbstate['domain'] will
			-- contain the NetBIOS domain name. For hosts in a workgroup, Windows
			-- uses the NetBIOS hostname as the NetBIOS domain name. Comparing the
			-- two will reveal whether the target is in a domain or a workgroup.
			if ( smbstate['domain'] ~= nil and response['domain'] ~= smbstate['domain'] ) then
				response['workgroup']    = response['domain']
				response['domain']       = nil
			end
		end
		
	    -- Kill SMB again
	    stop(smbstate)
	end

	return true, response
end

---Basically a wrapper around <code>socket:get_info</code>, except that it also makes a SMB connection before calling the
-- <code>get_info</code> function. Returns the mac address as well, for convenience. 
--
--@param host The host object
--@return status: true for successful, false otherwise.
--@return If status is true, the local ip address; otherwise, an error message. 
--@return The local port (not really meaningful, since it'll change next time).
--@return The remote ip address.
--@return The report port.
--@return The mac address, if possible; nil otherwise.
function get_socket_info(host)
	local status, lhost, lport, rhost, rport
	local smbstate, socket

	-- Start SMB (we need a socket to get the proper local ip
	status, smbstate = start_ex(host)
    if(status == false) then
		return false, smbstate
    end

	socket = smbstate['socket']
	status, lhost, lport, rhost, rport = socket:get_info()
		if(status == false) then
		return false, lhost
	end

	-- Stop SMB
	stop(smbstate)

	-- Get the mac in hex format, if possible
	local lmac = nil
	if(host.mac_addr_src) then
		lmac = stdnse.tohex(host.mac_addr_src, {separator = ":"})
	end

	return true, lhost, lport, rhost, rport, lmac
end

---Generate a string that's somewhat unique, but is based on factors that won't change on a host. At the moment, this is a very simple
-- hash based on the IP address. This hash is *very* likely to have collisions, and that's by design -- while it should be somewhat unique, 
-- I don't want it to be trivial to uniquely determine who it originated from. 
--
-- TODO: At some point, I should re-do this function properly, with a method of hashing that's somewhat proven. 
--
--@param host      The host object
--@param extension [optional] The extension to add on the end of the file. Default: none. 
--@param seed      [optional] Some randomness on which to base the name. If you want to do multiple files, each with its 
--                 own uniqueish name, this can be used. 
--@return (status, data) If status is true, data is a table of values; otherwise, data is an error message. Can be any kind of string. 
function get_uniqueish_name(host, extension, seed)

	local status
	local lhost, lport, rhost, rport
	if(type(host) == "table") then
		status, lhost = get_socket_info(host)
	else
		lhost = host
	end

	-- Create our ultra-weak hash by using a simple xor/shift algorithm
	-- I tested this, and in 255 tests, there were roughly 10 collisions. That's about what I'm looking for. 
	local hash = 0
	local i
	local str = lhost .. (seed or "") .. (extension or "") .. (nmap.registry.args.randomseed or "")

	for i = 1, #str, 1 do
		local chr = string.byte(string.sub(str, i, i), 1)
		hash = bit.bxor(hash, chr)
		hash = bit.bor(bit.lshift(hash, 3), bit.rshift(hash, 29))
		hash = bit.bxor(hash, 3)
		hash = bit.band(hash, 0xFFFFFFFF)
	end

	local response
	if(extension) then
		response = string.format("%x.%s", hash, extension)
	else
		response = string.format("%x", hash)
	end

	return true, response
end

---Determines, as accurately as possible, whether or not an account is an administrator. If there is an error, 
-- 'false' is simply returned. 
function is_admin(host, username, domain, password, password_hash, hash_type)
	local msrpc = require "msrpc" -- avoid require cycle
	local status, smbstate, err, result
	local overrides = get_overrides(username, domain, password, password_hash, hash_type)

	stdnse.print_debug("SMB: Checking if %s is an administrator", username)

	status, smbstate = start(host)
	if(status == false) then
		stdnse.print_debug("SMB; is_admin: Failed to start SMB: %s [%s]", smbstate, username)
		stop(smbstate)
		return false
	end

	status, err      = negotiate_protocol(smbstate, overrides)
	if(status == false) then
		stdnse.print_debug("SMB; is_admin: Failed to negotiatie protocol: %s [%s]", err, username)
		stop(smbstate)
		return false
	end

	status, err      = start_session(smbstate, overrides)
	if(status == false) then
		stdnse.print_debug("SMB; is_admin: Failed to start session %s [%s]", err, username)
		stop(smbstate)
		return false
	end

	status, err      = tree_connect(smbstate, "IPC$", overrides)
	if(status == false) then
		stdnse.print_debug("SMB; is_admin: Failed to connect tree: %s [%s]", err, username)
		stop(smbstate)
		return false
	end

	status, err      = create_file(smbstate, msrpc.SRVSVC_PATH, overrides)
	if(status == false) then
		stdnse.print_debug("SMB; is_admin: Failed to create file: %s [%s]", err, username)
		stop(smbstate)
		return false
	end

	status, err      = msrpc.bind(smbstate, msrpc.SRVSVC_UUID, msrpc.SRVSVC_VERSION, nil)
	if(status == false) then
		stdnse.print_debug("SMB; is_admin: Failed to bind: %s [%s]", err, username)
		stop(smbstate)
		return false
	end
  
	-- Call netservergetstatistics for 'server'
	status, err = msrpc.srvsvc_netservergetstatistics(smbstate, host.ip)
	if(status == false) then
		stdnse.print_debug("SMB; is_admin: Couldn't get server stats (may be normal): %s [%s]", err, username)
		stop(smbstate)
		return false
	end

	stop(smbstate)

	return true
end

command_codes = 
{
	SMB_COM_CREATE_DIRECTORY          = 0x00,
	SMB_COM_DELETE_DIRECTORY          = 0x01,
	SMB_COM_OPEN                      = 0x02,
	SMB_COM_CREATE                    = 0x03,
	SMB_COM_CLOSE                     = 0x04,
	SMB_COM_FLUSH                     = 0x05,
	SMB_COM_DELETE                    = 0x06,
	SMB_COM_RENAME                    = 0x07,
	SMB_COM_QUERY_INFORMATION         = 0x08,
	SMB_COM_SET_INFORMATION           = 0x09,
	SMB_COM_READ                      = 0x0A,
	SMB_COM_WRITE                     = 0x0B,
	SMB_COM_LOCK_BYTE_RANGE           = 0x0C,
	SMB_COM_UNLOCK_BYTE_RANGE         = 0x0D,
	SMB_COM_CREATE_TEMPORARY          = 0x0E,
	SMB_COM_CREATE_NEW                = 0x0F,
	SMB_COM_CHECK_DIRECTORY           = 0x10,
	SMB_COM_PROCESS_EXIT              = 0x11,
	SMB_COM_SEEK                      = 0x12,
	SMB_COM_LOCK_AND_READ             = 0x13,
	SMB_COM_WRITE_AND_UNLOCK          = 0x14,
	SMB_COM_READ_RAW                  = 0x1A,
	SMB_COM_READ_MPX                  = 0x1B,
	SMB_COM_READ_MPX_SECONDARY        = 0x1C,
	SMB_COM_WRITE_RAW                 = 0x1D,
	SMB_COM_WRITE_MPX                 = 0x1E,
	SMB_COM_WRITE_MPX_SECONDARY       = 0x1F,
	SMB_COM_WRITE_COMPLETE            = 0x20,
	SMB_COM_QUERY_SERVER              = 0x21,
	SMB_COM_SET_INFORMATION2          = 0x22,
	SMB_COM_QUERY_INFORMATION2        = 0x23,
	SMB_COM_LOCKING_ANDX              = 0x24,
	SMB_COM_TRANSACTION               = 0x25,
	SMB_COM_TRANSACTION_SECONDARY     = 0x26,
	SMB_COM_IOCTL                     = 0x27,
	SMB_COM_IOCTL_SECONDARY           = 0x28,
	SMB_COM_COPY                      = 0x29,
	SMB_COM_MOVE                      = 0x2A,
	SMB_COM_ECHO                      = 0x2B,
	SMB_COM_WRITE_AND_CLOSE           = 0x2C,
	SMB_COM_OPEN_ANDX                 = 0x2D,
	SMB_COM_READ_ANDX                 = 0x2E,
	SMB_COM_WRITE_ANDX                = 0x2F,
	SMB_COM_NEW_FILE_SIZE             = 0x30,
	SMB_COM_CLOSE_AND_TREE_DISC       = 0x31,
	SMB_COM_TRANSACTION2              = 0x32,
	SMB_COM_TRANSACTION2_SECONDARY    = 0x33,
	SMB_COM_FIND_CLOSE2               = 0x34,
	SMB_COM_FIND_NOTIFY_CLOSE         = 0x35,
	SMB_COM_TREE_CONNECT              = 0x70,
	SMB_COM_TREE_DISCONNECT           = 0x71,
	SMB_COM_NEGOTIATE                 = 0x72,
	SMB_COM_SESSION_SETUP_ANDX        = 0x73,
	SMB_COM_LOGOFF_ANDX               = 0x74,
	SMB_COM_TREE_CONNECT_ANDX         = 0x75,
	SMB_COM_QUERY_INFORMATION_DISK    = 0x80,
	SMB_COM_SEARCH                    = 0x81,
	SMB_COM_FIND                      = 0x82,
	SMB_COM_FIND_UNIQUE               = 0x83,
	SMB_COM_FIND_CLOSE                = 0x84,
	SMB_COM_NT_TRANSACT               = 0xA0,
	SMB_COM_NT_TRANSACT_SECONDARY     = 0xA1,
	SMB_COM_NT_CREATE_ANDX            = 0xA2,
	SMB_COM_NT_CANCEL                 = 0xA4,
	SMB_COM_NT_RENAME                 = 0xA5,
	SMB_COM_OPEN_PRINT_FILE           = 0xC0,
	SMB_COM_WRITE_PRINT_FILE          = 0xC1,
	SMB_COM_CLOSE_PRINT_FILE          = 0xC2,
	SMB_COM_GET_PRINT_QUEUE           = 0xC3,
	SMB_COM_READ_BULK                 = 0xD8,
	SMB_COM_WRITE_BULK                = 0xD9,
	SMB_COM_WRITE_BULK_DATA           = 0xDA,
	SMB_NO_FURTHER_COMMANDS           = 0xFF
}

for i, v in pairs(command_codes) do
	command_names[v] = i
end


-- see http://msdn.microsoft.com/en-us/library/cc231196(v=prot.10).aspx
status_codes = 
{
	NT_STATUS_SUCCESS 							= 0x00000000,
	NT_STATUS_WERR_BADFILE                      = 0x00000002,
	NT_STATUS_WERR_ACCESS_DENIED                = 0x00000005,
	NT_STATUS_WERR_INVALID_PARAMETER            = 0x00000057,
	NT_STATUS_WERR_INVALID_NAME                 = 0x0000007b,
	NT_STATUS_WERR_UNKNOWN_LEVEL                = 0x0000007c,
	NT_STATUS_WERR_MORE_DATA                    = 0x000000ea,
	NT_STATUS_NO_MORE_ITEMS                     = 0x00000103,
	NT_STATUS_MORE_ENTRIES                      = 0x00000105,
	NT_STATUS_SOME_NOT_MAPPED                   = 0x00000107,
	NT_STATUS_SERVICE_REQUEST_TIMEOUT           = 0x0000041D,
	NT_STATUS_SERVICE_NO_THREAD                 = 0x0000041E,
	NT_STATUS_SERVICE_DATABASE_LOCKED           = 0x0000041F,
	NT_STATUS_SERVICE_ALREADY_RUNNING           = 0x00000420,
	NT_STATUS_INVALID_SERVICE_ACCOUNT           = 0x00000421,
	NT_STATUS_SERVICE_DISABLED                  = 0x00000422,
	NT_STATUS_CIRCULAR_DEPENDENCY               = 0x00000423,
	NT_STATUS_SERVICE_DOES_NOT_EXIST            = 0x00000424,
	NT_STATUS_SERVICE_CANNOT_ACCEPT_CTRL        = 0x00000425,
	NT_STATUS_SERVICE_NOT_ACTIVE                = 0x00000426,
	NT_STATUS_FAILED_SERVICE_CONTROLLER_CONNECT = 0x00000427,
	NT_STATUS_EXCEPTION_IN_SERVICE              = 0x00000428,
	NT_STATUS_DATABASE_DOES_NOT_EXIST           = 0x00000429,
	NT_STATUS_SERVICE_SPECIFIC_ERROR            = 0x0000042a,
	NT_STATUS_PROCESS_ABORTED                   = 0x0000042b,
	NT_STATUS_SERVICE_DEPENDENCY_FAIL           = 0x0000042c,
	NT_STATUS_SERVICE_LOGON_FAILED              = 0x0000042d,
	NT_STATUS_SERVICE_START_HANG                = 0x0000042e,
	NT_STATUS_INVALID_SERVICE_LOCK              = 0x0000042f,
	NT_STATUS_SERVICE_MARKED_FOR_DELETE         = 0x00000430,
	NT_STATUS_SERVICE_EXISTS                    = 0x00000431,
	NT_STATUS_ALREADY_RUNNING_LKG               = 0x00000432,
	NT_STATUS_SERVICE_DEPENDENCY_DELETED        = 0x00000433,
	NT_STATUS_BOOT_ALREADY_ACCEPTED             = 0x00000434,
	NT_STATUS_SERVICE_NEVER_STARTED             = 0x00000435,
	NT_STATUS_DUPLICATE_SERVICE_NAME            = 0x00000436,
	NT_STATUS_DIFFERENT_SERVICE_ACCOUNT         = 0x00000437,
	NT_STATUS_CANNOT_DETECT_DRIVER_FAILURE      = 0x00000438,
	DOS_STATUS_UNKNOWN_ERROR                    = 0x00010001,
	DOS_STATUS_NONSPECIFIC_ERROR                = 0x00010002,
	DOS_STATUS_DIRECTORY_NOT_FOUND              = 0x00030001,
	DOS_STATUS_ACCESS_DENIED                    = 0x00050001,
	DOS_STATUS_INVALID_FID                      = 0x00060001,
	DOS_STATUS_INVALID_NETWORK_NAME             = 0x00060002,
	NT_STATUS_BUFFER_OVERFLOW = 0x80000005,
	NT_STATUS_UNSUCCESSFUL = 0xc0000001,
	NT_STATUS_NOT_IMPLEMENTED = 0xc0000002,
	NT_STATUS_INVALID_INFO_CLASS = 0xc0000003,
	NT_STATUS_INFO_LENGTH_MISMATCH = 0xc0000004,
	NT_STATUS_ACCESS_VIOLATION = 0xc0000005,
	NT_STATUS_IN_PAGE_ERROR = 0xc0000006,
	NT_STATUS_PAGEFILE_QUOTA = 0xc0000007,
	NT_STATUS_INVALID_HANDLE = 0xc0000008,
	NT_STATUS_BAD_INITIAL_STACK = 0xc0000009,
	NT_STATUS_BAD_INITIAL_PC = 0xc000000a,
	NT_STATUS_INVALID_CID = 0xc000000b,
	NT_STATUS_TIMER_NOT_CANCELED = 0xc000000c,
	NT_STATUS_INVALID_PARAMETER = 0xc000000d,
	NT_STATUS_NO_SUCH_DEVICE = 0xc000000e,
	NT_STATUS_NO_SUCH_FILE = 0xc000000f,
	NT_STATUS_INVALID_DEVICE_REQUEST = 0xc0000010,
	NT_STATUS_END_OF_FILE = 0xc0000011,
	NT_STATUS_WRONG_VOLUME = 0xc0000012,
	NT_STATUS_NO_MEDIA_IN_DEVICE = 0xc0000013,
	NT_STATUS_UNRECOGNIZED_MEDIA = 0xc0000014,
	NT_STATUS_NONEXISTENT_SECTOR = 0xc0000015,
	NT_STATUS_MORE_PROCESSING_REQUIRED = 0xc0000016,
	NT_STATUS_NO_MEMORY = 0xc0000017,
	NT_STATUS_CONFLICTING_ADDRESSES = 0xc0000018,
	NT_STATUS_NOT_MAPPED_VIEW = 0xc0000019,
	NT_STATUS_UNABLE_TO_FREE_VM = 0xc000001a,
	NT_STATUS_UNABLE_TO_DELETE_SECTION = 0xc000001b,
	NT_STATUS_INVALID_SYSTEM_SERVICE = 0xc000001c,
	NT_STATUS_ILLEGAL_INSTRUCTION = 0xc000001d,
	NT_STATUS_INVALID_LOCK_SEQUENCE = 0xc000001e,
	NT_STATUS_INVALID_VIEW_SIZE = 0xc000001f,
	NT_STATUS_INVALID_FILE_FOR_SECTION = 0xc0000020,
	NT_STATUS_ALREADY_COMMITTED = 0xc0000021,
	NT_STATUS_ACCESS_DENIED = 0xc0000022,
	NT_STATUS_BUFFER_TOO_SMALL = 0xc0000023,
	NT_STATUS_OBJECT_TYPE_MISMATCH = 0xc0000024,
	NT_STATUS_NONCONTINUABLE_EXCEPTION = 0xc0000025,
	NT_STATUS_INVALID_DISPOSITION = 0xc0000026,
	NT_STATUS_UNWIND = 0xc0000027,
	NT_STATUS_BAD_STACK = 0xc0000028,
	NT_STATUS_INVALID_UNWIND_TARGET = 0xc0000029,
	NT_STATUS_NOT_LOCKED = 0xc000002a,
	NT_STATUS_PARITY_ERROR = 0xc000002b,
	NT_STATUS_UNABLE_TO_DECOMMIT_VM = 0xc000002c,
	NT_STATUS_NOT_COMMITTED = 0xc000002d,
	NT_STATUS_INVALID_PORT_ATTRIBUTES = 0xc000002e,
	NT_STATUS_PORT_MESSAGE_TOO_LONG = 0xc000002f,
	NT_STATUS_INVALID_PARAMETER_MIX = 0xc0000030,
	NT_STATUS_INVALID_QUOTA_LOWER = 0xc0000031,
	NT_STATUS_DISK_CORRUPT_ERROR = 0xc0000032,
	NT_STATUS_OBJECT_NAME_INVALID = 0xc0000033,
	NT_STATUS_OBJECT_NAME_NOT_FOUND = 0xc0000034,
	NT_STATUS_OBJECT_NAME_COLLISION = 0xc0000035,
	NT_STATUS_HANDLE_NOT_WAITABLE = 0xc0000036,
	NT_STATUS_PORT_DISCONNECTED = 0xc0000037,
	NT_STATUS_DEVICE_ALREADY_ATTACHED = 0xc0000038,
	NT_STATUS_OBJECT_PATH_INVALID = 0xc0000039,
	NT_STATUS_OBJECT_PATH_NOT_FOUND = 0xc000003a,
	NT_STATUS_OBJECT_PATH_SYNTAX_BAD = 0xc000003b,
	NT_STATUS_DATA_OVERRUN = 0xc000003c,
	NT_STATUS_DATA_LATE_ERROR = 0xc000003d,
	NT_STATUS_DATA_ERROR = 0xc000003e,
	NT_STATUS_CRC_ERROR = 0xc000003f,
	NT_STATUS_SECTION_TOO_BIG = 0xc0000040,
	NT_STATUS_PORT_CONNECTION_REFUSED = 0xc0000041,
	NT_STATUS_INVALID_PORT_HANDLE = 0xc0000042,
	NT_STATUS_SHARING_VIOLATION = 0xc0000043,
	NT_STATUS_QUOTA_EXCEEDED = 0xc0000044,
	NT_STATUS_INVALID_PAGE_PROTECTION = 0xc0000045,
	NT_STATUS_MUTANT_NOT_OWNED = 0xc0000046,
	NT_STATUS_SEMAPHORE_LIMIT_EXCEEDED = 0xc0000047,
	NT_STATUS_PORT_ALREADY_SET = 0xc0000048,
	NT_STATUS_SECTION_NOT_IMAGE = 0xc0000049,
	NT_STATUS_SUSPEND_COUNT_EXCEEDED = 0xc000004a,
	NT_STATUS_THREAD_IS_TERMINATING = 0xc000004b,
	NT_STATUS_BAD_WORKING_SET_LIMIT = 0xc000004c,
	NT_STATUS_INCOMPATIBLE_FILE_MAP = 0xc000004d,
	NT_STATUS_SECTION_PROTECTION = 0xc000004e,
	NT_STATUS_EAS_NOT_SUPPORTED = 0xc000004f,
	NT_STATUS_EA_TOO_LARGE = 0xc0000050,
	NT_STATUS_NONEXISTENT_EA_ENTRY = 0xc0000051,
	NT_STATUS_NO_EAS_ON_FILE = 0xc0000052,
	NT_STATUS_EA_CORRUPT_ERROR = 0xc0000053,
	NT_STATUS_FILE_LOCK_CONFLICT = 0xc0000054,
	NT_STATUS_LOCK_NOT_GRANTED = 0xc0000055,
	NT_STATUS_DELETE_PENDING = 0xc0000056,
	NT_STATUS_CTL_FILE_NOT_SUPPORTED = 0xc0000057,
	NT_STATUS_UNKNOWN_REVISION = 0xc0000058,
	NT_STATUS_REVISION_MISMATCH = 0xc0000059,
	NT_STATUS_INVALID_OWNER = 0xc000005a,
	NT_STATUS_INVALID_PRIMARY_GROUP = 0xc000005b,
	NT_STATUS_NO_IMPERSONATION_TOKEN = 0xc000005c,
	NT_STATUS_CANT_DISABLE_MANDATORY = 0xc000005d,
	NT_STATUS_NO_LOGON_SERVERS = 0xc000005e,
	NT_STATUS_NO_SUCH_LOGON_SESSION = 0xc000005f,
	NT_STATUS_NO_SUCH_PRIVILEGE = 0xc0000060,
	NT_STATUS_PRIVILEGE_NOT_HELD = 0xc0000061,
	NT_STATUS_INVALID_ACCOUNT_NAME = 0xc0000062,
	NT_STATUS_USER_EXISTS = 0xc0000063,
	NT_STATUS_NO_SUCH_USER = 0xc0000064,
	NT_STATUS_GROUP_EXISTS = 0xc0000065,
	NT_STATUS_NO_SUCH_GROUP = 0xc0000066,
	NT_STATUS_MEMBER_IN_GROUP = 0xc0000067,
	NT_STATUS_MEMBER_NOT_IN_GROUP = 0xc0000068,
	NT_STATUS_LAST_ADMIN = 0xc0000069,
	NT_STATUS_WRONG_PASSWORD = 0xc000006a,
	NT_STATUS_ILL_FORMED_PASSWORD = 0xc000006b,
	NT_STATUS_PASSWORD_RESTRICTION = 0xc000006c,
	NT_STATUS_LOGON_FAILURE = 0xc000006d,
	NT_STATUS_ACCOUNT_RESTRICTION = 0xc000006e,
	NT_STATUS_INVALID_LOGON_HOURS = 0xc000006f,
	NT_STATUS_INVALID_WORKSTATION = 0xc0000070,
	NT_STATUS_PASSWORD_EXPIRED = 0xc0000071,
	NT_STATUS_ACCOUNT_DISABLED = 0xc0000072,
	NT_STATUS_NONE_MAPPED = 0xc0000073,
	NT_STATUS_TOO_MANY_LUIDS_REQUESTED = 0xc0000074,
	NT_STATUS_LUIDS_EXHAUSTED = 0xc0000075,
	NT_STATUS_INVALID_SUB_AUTHORITY = 0xc0000076,
	NT_STATUS_INVALID_ACL = 0xc0000077,
	NT_STATUS_INVALID_SID = 0xc0000078,
	NT_STATUS_INVALID_SECURITY_DESCR = 0xc0000079,
	NT_STATUS_PROCEDURE_NOT_FOUND = 0xc000007a,
	NT_STATUS_INVALID_IMAGE_FORMAT = 0xc000007b,
	NT_STATUS_NO_TOKEN = 0xc000007c,
	NT_STATUS_BAD_INHERITANCE_ACL = 0xc000007d,
	NT_STATUS_RANGE_NOT_LOCKED = 0xc000007e,
	NT_STATUS_DISK_FULL = 0xc000007f,
	NT_STATUS_SERVER_DISABLED = 0xc0000080,
	NT_STATUS_SERVER_NOT_DISABLED = 0xc0000081,
	NT_STATUS_TOO_MANY_GUIDS_REQUESTED = 0xc0000082,
	NT_STATUS_GUIDS_EXHAUSTED = 0xc0000083,
	NT_STATUS_INVALID_ID_AUTHORITY = 0xc0000084,
	NT_STATUS_AGENTS_EXHAUSTED = 0xc0000085,
	NT_STATUS_INVALID_VOLUME_LABEL = 0xc0000086,
	NT_STATUS_SECTION_NOT_EXTENDED = 0xc0000087,
	NT_STATUS_NOT_MAPPED_DATA = 0xc0000088,
	NT_STATUS_RESOURCE_DATA_NOT_FOUND = 0xc0000089,
	NT_STATUS_RESOURCE_TYPE_NOT_FOUND = 0xc000008a,
	NT_STATUS_RESOURCE_NAME_NOT_FOUND = 0xc000008b,
	NT_STATUS_ARRAY_BOUNDS_EXCEEDED = 0xc000008c,
	NT_STATUS_FLOAT_DENORMAL_OPERAND = 0xc000008d,
	NT_STATUS_FLOAT_DIVIDE_BY_ZERO = 0xc000008e,
	NT_STATUS_FLOAT_INEXACT_RESULT = 0xc000008f,
	NT_STATUS_FLOAT_INVALID_OPERATION = 0xc0000090,
	NT_STATUS_FLOAT_OVERFLOW = 0xc0000091,
	NT_STATUS_FLOAT_STACK_CHECK = 0xc0000092,
	NT_STATUS_FLOAT_UNDERFLOW = 0xc0000093,
	NT_STATUS_INTEGER_DIVIDE_BY_ZERO = 0xc0000094,
	NT_STATUS_INTEGER_OVERFLOW = 0xc0000095,
	NT_STATUS_PRIVILEGED_INSTRUCTION = 0xc0000096,
	NT_STATUS_TOO_MANY_PAGING_FILES = 0xc0000097,
	NT_STATUS_FILE_INVALID = 0xc0000098,
	NT_STATUS_ALLOTTED_SPACE_EXCEEDED = 0xc0000099,
	NT_STATUS_INSUFFICIENT_RESOURCES = 0xc000009a,
	NT_STATUS_DFS_EXIT_PATH_FOUND = 0xc000009b,
	NT_STATUS_DEVICE_DATA_ERROR = 0xc000009c,
	NT_STATUS_DEVICE_NOT_CONNECTED = 0xc000009d,
	NT_STATUS_DEVICE_POWER_FAILURE = 0xc000009e,
	NT_STATUS_FREE_VM_NOT_AT_BASE = 0xc000009f,
	NT_STATUS_MEMORY_NOT_ALLOCATED = 0xc00000a0,
	NT_STATUS_WORKING_SET_QUOTA = 0xc00000a1,
	NT_STATUS_MEDIA_WRITE_PROTECTED = 0xc00000a2,
	NT_STATUS_DEVICE_NOT_READY = 0xc00000a3,
	NT_STATUS_INVALID_GROUP_ATTRIBUTES = 0xc00000a4,
	NT_STATUS_BAD_IMPERSONATION_LEVEL = 0xc00000a5,
	NT_STATUS_CANT_OPEN_ANONYMOUS = 0xc00000a6,
	NT_STATUS_BAD_VALIDATION_CLASS = 0xc00000a7,
	NT_STATUS_BAD_TOKEN_TYPE = 0xc00000a8,
	NT_STATUS_BAD_MASTER_BOOT_RECORD = 0xc00000a9,
	NT_STATUS_INSTRUCTION_MISALIGNMENT = 0xc00000aa,
	NT_STATUS_INSTANCE_NOT_AVAILABLE = 0xc00000ab,
	NT_STATUS_PIPE_NOT_AVAILABLE = 0xc00000ac,
	NT_STATUS_INVALID_PIPE_STATE = 0xc00000ad,
	NT_STATUS_PIPE_BUSY = 0xc00000ae,
	NT_STATUS_ILLEGAL_FUNCTION = 0xc00000af,
	NT_STATUS_PIPE_DISCONNECTED = 0xc00000b0,
	NT_STATUS_PIPE_CLOSING = 0xc00000b1,
	NT_STATUS_PIPE_CONNECTED = 0xc00000b2,
	NT_STATUS_PIPE_LISTENING = 0xc00000b3,
	NT_STATUS_INVALID_READ_MODE = 0xc00000b4,
	NT_STATUS_IO_TIMEOUT = 0xc00000b5,
	NT_STATUS_FILE_FORCED_CLOSED = 0xc00000b6,
	NT_STATUS_PROFILING_NOT_STARTED = 0xc00000b7,
	NT_STATUS_PROFILING_NOT_STOPPED = 0xc00000b8,
	NT_STATUS_COULD_NOT_INTERPRET = 0xc00000b9,
	NT_STATUS_FILE_IS_A_DIRECTORY = 0xc00000ba,
	NT_STATUS_NOT_SUPPORTED = 0xc00000bb,
	NT_STATUS_REMOTE_NOT_LISTENING = 0xc00000bc,
	NT_STATUS_DUPLICATE_NAME = 0xc00000bd,
	NT_STATUS_BAD_NETWORK_PATH = 0xc00000be,
	NT_STATUS_NETWORK_BUSY = 0xc00000bf,
	NT_STATUS_DEVICE_DOES_NOT_EXIST = 0xc00000c0,
	NT_STATUS_TOO_MANY_COMMANDS = 0xc00000c1,
	NT_STATUS_ADAPTER_HARDWARE_ERROR = 0xc00000c2,
	NT_STATUS_INVALID_NETWORK_RESPONSE = 0xc00000c3,
	NT_STATUS_UNEXPECTED_NETWORK_ERROR = 0xc00000c4,
	NT_STATUS_BAD_REMOTE_ADAPTER = 0xc00000c5,
	NT_STATUS_PRINT_QUEUE_FULL = 0xc00000c6,
	NT_STATUS_NO_SPOOL_SPACE = 0xc00000c7,
	NT_STATUS_PRINT_CANCELLED = 0xc00000c8,
	NT_STATUS_NETWORK_NAME_DELETED = 0xc00000c9,
	NT_STATUS_NETWORK_ACCESS_DENIED = 0xc00000ca,
	NT_STATUS_BAD_DEVICE_TYPE = 0xc00000cb,
	NT_STATUS_BAD_NETWORK_NAME = 0xc00000cc,
	NT_STATUS_TOO_MANY_NAMES = 0xc00000cd,
	NT_STATUS_TOO_MANY_SESSIONS = 0xc00000ce,
	NT_STATUS_SHARING_PAUSED = 0xc00000cf,
	NT_STATUS_REQUEST_NOT_ACCEPTED = 0xc00000d0,
	NT_STATUS_REDIRECTOR_PAUSED = 0xc00000d1,
	NT_STATUS_NET_WRITE_FAULT = 0xc00000d2,
	NT_STATUS_PROFILING_AT_LIMIT = 0xc00000d3,
	NT_STATUS_NOT_SAME_DEVICE = 0xc00000d4,
	NT_STATUS_FILE_RENAMED = 0xc00000d5,
	NT_STATUS_VIRTUAL_CIRCUIT_CLOSED = 0xc00000d6,
	NT_STATUS_NO_SECURITY_ON_OBJECT = 0xc00000d7,
	NT_STATUS_CANT_WAIT = 0xc00000d8,
	NT_STATUS_PIPE_EMPTY = 0xc00000d9,
	NT_STATUS_CANT_ACCESS_DOMAIN_INFO = 0xc00000da,
	NT_STATUS_CANT_TERMINATE_SELF = 0xc00000db,
	NT_STATUS_INVALID_SERVER_STATE = 0xc00000dc,
	NT_STATUS_INVALID_DOMAIN_STATE = 0xc00000dd,
	NT_STATUS_INVALID_DOMAIN_ROLE = 0xc00000de,
	NT_STATUS_NO_SUCH_DOMAIN = 0xc00000df,
	NT_STATUS_DOMAIN_EXISTS = 0xc00000e0,
	NT_STATUS_DOMAIN_LIMIT_EXCEEDED = 0xc00000e1,
	NT_STATUS_OPLOCK_NOT_GRANTED = 0xc00000e2,
	NT_STATUS_INVALID_OPLOCK_PROTOCOL = 0xc00000e3,
	NT_STATUS_INTERNAL_DB_CORRUPTION = 0xc00000e4,
	NT_STATUS_INTERNAL_ERROR = 0xc00000e5,
	NT_STATUS_GENERIC_NOT_MAPPED = 0xc00000e6,
	NT_STATUS_BAD_DESCRIPTOR_FORMAT = 0xc00000e7,
	NT_STATUS_INVALID_USER_BUFFER = 0xc00000e8,
	NT_STATUS_UNEXPECTED_IO_ERROR = 0xc00000e9,
	NT_STATUS_UNEXPECTED_MM_CREATE_ERR = 0xc00000ea,
	NT_STATUS_UNEXPECTED_MM_MAP_ERROR = 0xc00000eb,
	NT_STATUS_UNEXPECTED_MM_EXTEND_ERR = 0xc00000ec,
	NT_STATUS_NOT_LOGON_PROCESS = 0xc00000ed,
	NT_STATUS_LOGON_SESSION_EXISTS = 0xc00000ee,
	NT_STATUS_INVALID_PARAMETER_1 = 0xc00000ef,
	NT_STATUS_INVALID_PARAMETER_2 = 0xc00000f0,
	NT_STATUS_INVALID_PARAMETER_3 = 0xc00000f1,
	NT_STATUS_INVALID_PARAMETER_4 = 0xc00000f2,
	NT_STATUS_INVALID_PARAMETER_5 = 0xc00000f3,
	NT_STATUS_INVALID_PARAMETER_6 = 0xc00000f4,
	NT_STATUS_INVALID_PARAMETER_7 = 0xc00000f5,
	NT_STATUS_INVALID_PARAMETER_8 = 0xc00000f6,
	NT_STATUS_INVALID_PARAMETER_9 = 0xc00000f7,
	NT_STATUS_INVALID_PARAMETER_10 = 0xc00000f8,
	NT_STATUS_INVALID_PARAMETER_11 = 0xc00000f9,
	NT_STATUS_INVALID_PARAMETER_12 = 0xc00000fa,
	NT_STATUS_REDIRECTOR_NOT_STARTED = 0xc00000fb,
	NT_STATUS_REDIRECTOR_STARTED = 0xc00000fc,
	NT_STATUS_STACK_OVERFLOW = 0xc00000fd,
	NT_STATUS_NO_SUCH_PACKAGE = 0xc00000fe,
	NT_STATUS_BAD_FUNCTION_TABLE = 0xc00000ff,
	NT_STATUS_DIRECTORY_NOT_EMPTY = 0xc0000101,
	NT_STATUS_FILE_CORRUPT_ERROR = 0xc0000102,
	NT_STATUS_NOT_A_DIRECTORY = 0xc0000103,
	NT_STATUS_BAD_LOGON_SESSION_STATE = 0xc0000104,
	NT_STATUS_LOGON_SESSION_COLLISION = 0xc0000105,
	NT_STATUS_NAME_TOO_LONG = 0xc0000106,
	NT_STATUS_FILES_OPEN = 0xc0000107,
	NT_STATUS_CONNECTION_IN_USE = 0xc0000108,
	NT_STATUS_MESSAGE_NOT_FOUND = 0xc0000109,
	NT_STATUS_PROCESS_IS_TERMINATING = 0xc000010a,
	NT_STATUS_INVALID_LOGON_TYPE = 0xc000010b,
	NT_STATUS_NO_GUID_TRANSLATION = 0xc000010c,
	NT_STATUS_CANNOT_IMPERSONATE = 0xc000010d,
	NT_STATUS_IMAGE_ALREADY_LOADED = 0xc000010e,
	NT_STATUS_ABIOS_NOT_PRESENT = 0xc000010f,
	NT_STATUS_ABIOS_LID_NOT_EXIST = 0xc0000110,
	NT_STATUS_ABIOS_LID_ALREADY_OWNED = 0xc0000111,
	NT_STATUS_ABIOS_NOT_LID_OWNER = 0xc0000112,
	NT_STATUS_ABIOS_INVALID_COMMAND = 0xc0000113,
	NT_STATUS_ABIOS_INVALID_LID = 0xc0000114,
	NT_STATUS_ABIOS_SELECTOR_NOT_AVAILABLE = 0xc0000115,
	NT_STATUS_ABIOS_INVALID_SELECTOR = 0xc0000116,
	NT_STATUS_NO_LDT = 0xc0000117,
	NT_STATUS_INVALID_LDT_SIZE = 0xc0000118,
	NT_STATUS_INVALID_LDT_OFFSET = 0xc0000119,
	NT_STATUS_INVALID_LDT_DESCRIPTOR = 0xc000011a,
	NT_STATUS_INVALID_IMAGE_NE_FORMAT = 0xc000011b,
	NT_STATUS_RXACT_INVALID_STATE = 0xc000011c,
	NT_STATUS_RXACT_COMMIT_FAILURE = 0xc000011d,
	NT_STATUS_MAPPED_FILE_SIZE_ZERO = 0xc000011e,
	NT_STATUS_TOO_MANY_OPENED_FILES = 0xc000011f,
	NT_STATUS_CANCELLED = 0xc0000120,
	NT_STATUS_CANNOT_DELETE = 0xc0000121,
	NT_STATUS_INVALID_COMPUTER_NAME = 0xc0000122,
	NT_STATUS_FILE_DELETED = 0xc0000123,
	NT_STATUS_SPECIAL_ACCOUNT = 0xc0000124,
	NT_STATUS_SPECIAL_GROUP = 0xc0000125,
	NT_STATUS_SPECIAL_USER = 0xc0000126,
	NT_STATUS_MEMBERS_PRIMARY_GROUP = 0xc0000127,
	NT_STATUS_FILE_CLOSED = 0xc0000128,
	NT_STATUS_TOO_MANY_THREADS = 0xc0000129,
	NT_STATUS_THREAD_NOT_IN_PROCESS = 0xc000012a,
	NT_STATUS_TOKEN_ALREADY_IN_USE = 0xc000012b,
	NT_STATUS_PAGEFILE_QUOTA_EXCEEDED = 0xc000012c,
	NT_STATUS_COMMITMENT_LIMIT = 0xc000012d,
	NT_STATUS_INVALID_IMAGE_LE_FORMAT = 0xc000012e,
	NT_STATUS_INVALID_IMAGE_NOT_MZ = 0xc000012f,
	NT_STATUS_INVALID_IMAGE_PROTECT = 0xc0000130,
	NT_STATUS_INVALID_IMAGE_WIN_16 = 0xc0000131,
	NT_STATUS_LOGON_SERVER_CONFLICT = 0xc0000132,
	NT_STATUS_TIME_DIFFERENCE_AT_DC = 0xc0000133,
	NT_STATUS_SYNCHRONIZATION_REQUIRED = 0xc0000134,
	NT_STATUS_DLL_NOT_FOUND = 0xc0000135,
	NT_STATUS_OPEN_FAILED = 0xc0000136,
	NT_STATUS_IO_PRIVILEGE_FAILED = 0xc0000137,
	NT_STATUS_ORDINAL_NOT_FOUND = 0xc0000138,
	NT_STATUS_ENTRYPOINT_NOT_FOUND = 0xc0000139,
	NT_STATUS_CONTROL_C_EXIT = 0xc000013a,
	NT_STATUS_LOCAL_DISCONNECT = 0xc000013b,
	NT_STATUS_REMOTE_DISCONNECT = 0xc000013c,
	NT_STATUS_REMOTE_RESOURCES = 0xc000013d,
	NT_STATUS_LINK_FAILED = 0xc000013e,
	NT_STATUS_LINK_TIMEOUT = 0xc000013f,
	NT_STATUS_INVALID_CONNECTION = 0xc0000140,
	NT_STATUS_INVALID_ADDRESS = 0xc0000141,
	NT_STATUS_DLL_INIT_FAILED = 0xc0000142,
	NT_STATUS_MISSING_SYSTEMFILE = 0xc0000143,
	NT_STATUS_UNHANDLED_EXCEPTION = 0xc0000144,
	NT_STATUS_APP_INIT_FAILURE = 0xc0000145,
	NT_STATUS_PAGEFILE_CREATE_FAILED = 0xc0000146,
	NT_STATUS_NO_PAGEFILE = 0xc0000147,
	NT_STATUS_INVALID_LEVEL = 0xc0000148,
	NT_STATUS_WRONG_PASSWORD_CORE = 0xc0000149,
	NT_STATUS_ILLEGAL_FLOAT_CONTEXT = 0xc000014a,
	NT_STATUS_PIPE_BROKEN = 0xc000014b,
	NT_STATUS_REGISTRY_CORRUPT = 0xc000014c,
	NT_STATUS_REGISTRY_IO_FAILED = 0xc000014d,
	NT_STATUS_NO_EVENT_PAIR = 0xc000014e,
	NT_STATUS_UNRECOGNIZED_VOLUME = 0xc000014f,
	NT_STATUS_SERIAL_NO_DEVICE_INITED = 0xc0000150,
	NT_STATUS_NO_SUCH_ALIAS = 0xc0000151,
	NT_STATUS_MEMBER_NOT_IN_ALIAS = 0xc0000152,
	NT_STATUS_MEMBER_IN_ALIAS = 0xc0000153,
	NT_STATUS_ALIAS_EXISTS = 0xc0000154,
	NT_STATUS_LOGON_NOT_GRANTED = 0xc0000155,
	NT_STATUS_TOO_MANY_SECRETS = 0xc0000156,
	NT_STATUS_SECRET_TOO_LONG = 0xc0000157,
	NT_STATUS_INTERNAL_DB_ERROR = 0xc0000158,
	NT_STATUS_FULLSCREEN_MODE = 0xc0000159,
	NT_STATUS_TOO_MANY_CONTEXT_IDS = 0xc000015a,
	NT_STATUS_LOGON_TYPE_NOT_GRANTED = 0xc000015b,
	NT_STATUS_NOT_REGISTRY_FILE = 0xc000015c,
	NT_STATUS_NT_CROSS_ENCRYPTION_REQUIRED = 0xc000015d,
	NT_STATUS_DOMAIN_CTRLR_CONFIG_ERROR = 0xc000015e,
	NT_STATUS_FT_MISSING_MEMBER = 0xc000015f,
	NT_STATUS_ILL_FORMED_SERVICE_ENTRY = 0xc0000160,
	NT_STATUS_ILLEGAL_CHARACTER = 0xc0000161,
	NT_STATUS_UNMAPPABLE_CHARACTER = 0xc0000162,
	NT_STATUS_UNDEFINED_CHARACTER = 0xc0000163,
	NT_STATUS_FLOPPY_VOLUME = 0xc0000164,
	NT_STATUS_FLOPPY_ID_MARK_NOT_FOUND = 0xc0000165,
	NT_STATUS_FLOPPY_WRONG_CYLINDER = 0xc0000166,
	NT_STATUS_FLOPPY_UNKNOWN_ERROR = 0xc0000167,
	NT_STATUS_FLOPPY_BAD_REGISTERS = 0xc0000168,
	NT_STATUS_DISK_RECALIBRATE_FAILED = 0xc0000169,
	NT_STATUS_DISK_OPERATION_FAILED = 0xc000016a,
	NT_STATUS_DISK_RESET_FAILED = 0xc000016b,
	NT_STATUS_SHARED_IRQ_BUSY = 0xc000016c,
	NT_STATUS_FT_ORPHANING = 0xc000016d,
	NT_STATUS_PARTITION_FAILURE = 0xc0000172,
	NT_STATUS_INVALID_BLOCK_LENGTH = 0xc0000173,
	NT_STATUS_DEVICE_NOT_PARTITIONED = 0xc0000174,
	NT_STATUS_UNABLE_TO_LOCK_MEDIA = 0xc0000175,
	NT_STATUS_UNABLE_TO_UNLOAD_MEDIA = 0xc0000176,
	NT_STATUS_EOM_OVERFLOW = 0xc0000177,
	NT_STATUS_NO_MEDIA = 0xc0000178,
	NT_STATUS_NO_SUCH_MEMBER = 0xc000017a,
	NT_STATUS_INVALID_MEMBER = 0xc000017b,
	NT_STATUS_KEY_DELETED = 0xc000017c,
	NT_STATUS_NO_LOG_SPACE = 0xc000017d,
	NT_STATUS_TOO_MANY_SIDS = 0xc000017e,
	NT_STATUS_LM_CROSS_ENCRYPTION_REQUIRED = 0xc000017f,
	NT_STATUS_KEY_HAS_CHILDREN = 0xc0000180,
	NT_STATUS_CHILD_MUST_BE_VOLATILE = 0xc0000181,
	NT_STATUS_DEVICE_CONFIGURATION_ERROR = 0xc0000182,
	NT_STATUS_DRIVER_INTERNAL_ERROR = 0xc0000183,
	NT_STATUS_INVALID_DEVICE_STATE = 0xc0000184,
	NT_STATUS_IO_DEVICE_ERROR = 0xc0000185,
	NT_STATUS_DEVICE_PROTOCOL_ERROR = 0xc0000186,
	NT_STATUS_BACKUP_CONTROLLER = 0xc0000187,
	NT_STATUS_LOG_FILE_FULL = 0xc0000188,
	NT_STATUS_TOO_LATE = 0xc0000189,
	NT_STATUS_NO_TRUST_LSA_SECRET = 0xc000018a,
	NT_STATUS_NO_TRUST_SAM_ACCOUNT = 0xc000018b,
	NT_STATUS_TRUSTED_DOMAIN_FAILURE = 0xc000018c,
	NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE = 0xc000018d,
	NT_STATUS_EVENTLOG_FILE_CORRUPT = 0xc000018e,
	NT_STATUS_EVENTLOG_CANT_START = 0xc000018f,
	NT_STATUS_TRUST_FAILURE = 0xc0000190,
	NT_STATUS_MUTANT_LIMIT_EXCEEDED = 0xc0000191,
	NT_STATUS_NETLOGON_NOT_STARTED = 0xc0000192,
	NT_STATUS_ACCOUNT_EXPIRED = 0xc0000193,
	NT_STATUS_POSSIBLE_DEADLOCK = 0xc0000194,
	NT_STATUS_NETWORK_CREDENTIAL_CONFLICT = 0xc0000195,
	NT_STATUS_REMOTE_SESSION_LIMIT = 0xc0000196,
	NT_STATUS_EVENTLOG_FILE_CHANGED = 0xc0000197,
	NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT = 0xc0000198,
	NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT = 0xc0000199,
	NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT = 0xc000019a,
	NT_STATUS_DOMAIN_TRUST_INCONSISTENT = 0xc000019b,
	NT_STATUS_FS_DRIVER_REQUIRED = 0xc000019c,
	NT_STATUS_NO_USER_SESSION_KEY = 0xc0000202,
	NT_STATUS_USER_SESSION_DELETED = 0xc0000203,
	NT_STATUS_RESOURCE_LANG_NOT_FOUND = 0xc0000204,
	NT_STATUS_INSUFF_SERVER_RESOURCES = 0xc0000205,
	NT_STATUS_INVALID_BUFFER_SIZE = 0xc0000206,
	NT_STATUS_INVALID_ADDRESS_COMPONENT = 0xc0000207,
	NT_STATUS_INVALID_ADDRESS_WILDCARD = 0xc0000208,
	NT_STATUS_TOO_MANY_ADDRESSES = 0xc0000209,
	NT_STATUS_ADDRESS_ALREADY_EXISTS = 0xc000020a,
	NT_STATUS_ADDRESS_CLOSED = 0xc000020b,
	NT_STATUS_CONNECTION_DISCONNECTED = 0xc000020c,
	NT_STATUS_CONNECTION_RESET = 0xc000020d,
	NT_STATUS_TOO_MANY_NODES = 0xc000020e,
	NT_STATUS_TRANSACTION_ABORTED = 0xc000020f,
	NT_STATUS_TRANSACTION_TIMED_OUT = 0xc0000210,
	NT_STATUS_TRANSACTION_NO_RELEASE = 0xc0000211,
	NT_STATUS_TRANSACTION_NO_MATCH = 0xc0000212,
	NT_STATUS_TRANSACTION_RESPONDED = 0xc0000213,
	NT_STATUS_TRANSACTION_INVALID_ID = 0xc0000214,
	NT_STATUS_TRANSACTION_INVALID_TYPE = 0xc0000215,
	NT_STATUS_NOT_SERVER_SESSION = 0xc0000216,
	NT_STATUS_NOT_CLIENT_SESSION = 0xc0000217,
	NT_STATUS_CANNOT_LOAD_REGISTRY_FILE = 0xc0000218,
	NT_STATUS_DEBUG_ATTACH_FAILED = 0xc0000219,
	NT_STATUS_SYSTEM_PROCESS_TERMINATED = 0xc000021a,
	NT_STATUS_DATA_NOT_ACCEPTED = 0xc000021b,
	NT_STATUS_NO_BROWSER_SERVERS_FOUND = 0xc000021c,
	NT_STATUS_VDM_HARD_ERROR = 0xc000021d,
	NT_STATUS_DRIVER_CANCEL_TIMEOUT = 0xc000021e,
	NT_STATUS_REPLY_MESSAGE_MISMATCH = 0xc000021f,
	NT_STATUS_MAPPED_ALIGNMENT = 0xc0000220,
	NT_STATUS_IMAGE_CHECKSUM_MISMATCH = 0xc0000221,
	NT_STATUS_LOST_WRITEBEHIND_DATA = 0xc0000222,
	NT_STATUS_CLIENT_SERVER_PARAMETERS_INVALID = 0xc0000223,
	NT_STATUS_PASSWORD_MUST_CHANGE = 0xc0000224,
	NT_STATUS_NOT_FOUND = 0xc0000225,
	NT_STATUS_NOT_TINY_STREAM = 0xc0000226,
	NT_STATUS_RECOVERY_FAILURE = 0xc0000227,
	NT_STATUS_STACK_OVERFLOW_READ = 0xc0000228,
	NT_STATUS_FAIL_CHECK = 0xc0000229,
	NT_STATUS_DUPLICATE_OBJECTID = 0xc000022a,
	NT_STATUS_OBJECTID_EXISTS = 0xc000022b,
	NT_STATUS_CONVERT_TO_LARGE = 0xc000022c,
	NT_STATUS_RETRY = 0xc000022d,
	NT_STATUS_FOUND_OUT_OF_SCOPE = 0xc000022e,
	NT_STATUS_ALLOCATE_BUCKET = 0xc000022f,
	NT_STATUS_PROPSET_NOT_FOUND = 0xc0000230,
	NT_STATUS_MARSHALL_OVERFLOW = 0xc0000231,
	NT_STATUS_INVALID_VARIANT = 0xc0000232,
	NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND = 0xc0000233,
	NT_STATUS_ACCOUNT_LOCKED_OUT = 0xc0000234,
	NT_STATUS_HANDLE_NOT_CLOSABLE = 0xc0000235,
	NT_STATUS_CONNECTION_REFUSED = 0xc0000236,
	NT_STATUS_GRACEFUL_DISCONNECT = 0xc0000237,
	NT_STATUS_ADDRESS_ALREADY_ASSOCIATED = 0xc0000238,
	NT_STATUS_ADDRESS_NOT_ASSOCIATED = 0xc0000239,
	NT_STATUS_CONNECTION_INVALID = 0xc000023a,
	NT_STATUS_CONNECTION_ACTIVE = 0xc000023b,
	NT_STATUS_NETWORK_UNREACHABLE = 0xc000023c,
	NT_STATUS_HOST_UNREACHABLE = 0xc000023d,
	NT_STATUS_PROTOCOL_UNREACHABLE = 0xc000023e,
	NT_STATUS_PORT_UNREACHABLE = 0xc000023f,
	NT_STATUS_REQUEST_ABORTED = 0xc0000240,
	NT_STATUS_CONNECTION_ABORTED = 0xc0000241,
	NT_STATUS_BAD_COMPRESSION_BUFFER = 0xc0000242,
	NT_STATUS_USER_MAPPED_FILE = 0xc0000243,
	NT_STATUS_AUDIT_FAILED = 0xc0000244,
	NT_STATUS_TIMER_RESOLUTION_NOT_SET = 0xc0000245,
	NT_STATUS_CONNECTION_COUNT_LIMIT = 0xc0000246,
	NT_STATUS_LOGIN_TIME_RESTRICTION = 0xc0000247,
	NT_STATUS_LOGIN_WKSTA_RESTRICTION = 0xc0000248,
	NT_STATUS_IMAGE_MP_UP_MISMATCH = 0xc0000249,
	NT_STATUS_INSUFFICIENT_LOGON_INFO = 0xc0000250,
	NT_STATUS_BAD_DLL_ENTRYPOINT = 0xc0000251,
	NT_STATUS_BAD_SERVICE_ENTRYPOINT = 0xc0000252,
	NT_STATUS_LPC_REPLY_LOST = 0xc0000253,
	NT_STATUS_IP_ADDRESS_CONFLICT1 = 0xc0000254,
	NT_STATUS_IP_ADDRESS_CONFLICT2 = 0xc0000255,
	NT_STATUS_REGISTRY_QUOTA_LIMIT = 0xc0000256,
	NT_STATUS_PATH_NOT_COVERED = 0xc0000257,
	NT_STATUS_NO_CALLBACK_ACTIVE = 0xc0000258,
	NT_STATUS_LICENSE_QUOTA_EXCEEDED = 0xc0000259,
	NT_STATUS_PWD_TOO_SHORT = 0xc000025a,
	NT_STATUS_PWD_TOO_RECENT = 0xc000025b,
	NT_STATUS_PWD_HISTORY_CONFLICT = 0xc000025c,
	NT_STATUS_PLUGPLAY_NO_DEVICE = 0xc000025e,
	NT_STATUS_UNSUPPORTED_COMPRESSION = 0xc000025f,
	NT_STATUS_INVALID_HW_PROFILE = 0xc0000260,
	NT_STATUS_INVALID_PLUGPLAY_DEVICE_PATH = 0xc0000261,
	NT_STATUS_DRIVER_ORDINAL_NOT_FOUND = 0xc0000262,
	NT_STATUS_DRIVER_ENTRYPOINT_NOT_FOUND = 0xc0000263,
	NT_STATUS_RESOURCE_NOT_OWNED = 0xc0000264,
	NT_STATUS_TOO_MANY_LINKS = 0xc0000265,
	NT_STATUS_QUOTA_LIST_INCONSISTENT = 0xc0000266,
	NT_STATUS_FILE_IS_OFFLINE = 0xc0000267,
	NT_STATUS_DS_NO_MORE_RIDS = 0xc00002a8,
	NT_STATUS_NOT_A_REPARSE_POINT = 0xc0000275,
	NT_STATUS_NO_SUCH_JOB = 0xc000EDE
}

for i, v in pairs(status_codes) do
	status_names[v] = i
end


local NP_LIBRARY_NAME = "PIPE"

namedpipes =
{		
	get_pipe_subpath = function( pipeName, writeToDebugLog )
		local status, pipeSubPath
		if not pipeName then return false end

		local _, _, match = pipeName:match( "^(\\+)(.-)\\pipe(\\.-)$" )
		if match then
			pipeSubPath = match
			status = true
			if writeToDebugLog then
				stdnse.print_debug( 2, "%s: Converting %s to subpath %s", NP_LIBRARY_NAME, pipeName, match )
			end
		else
			status = false
			pipeSubPath = pipeName
		end

		return status, pipeSubPath
	end,


	make_pipe_name = function( hostnameOrIp, pipeSubPath )
		if pipeSubPath:sub(1,1) ~= "\\" then
			pipeSubPath = "\\" .. pipeSubPath
		end

		return string.format( "\\\\%s\\pipe%s", hostnameOrIp, pipeSubPath )
	end,


	named_pipe = {

		_smbstate = nil,
		_host = nil,
		_pipeSubPath = nil,
		_overrides = nil,
		name = nil,

		new = function(self,o)
			o = o or {}
	        setmetatable(o, self)
	        self.__index = self
			return o
	    end,


	    connect = function( self, host, pipeSubPath, overrides )

			stdnse.print_debug( 2, "%s: connect() called with %s", NP_LIBRARY_NAME, tostring( pipeSubPath ) )
			self._overrides = overrides or {}
			self._host = host
			self._pipeSubPath = pipeSubPath
			if not host and not host.ip then return false, "host table is required" end
			if not pipeSubPath then return false, "pipeSubPath is required" end

			-- If we got a full pipe name, not a sub-path, fix it
			if ( pipeSubPath:match( "^\\\\(.-)$" ) ) then
				local status
				status, self._pipeSubPath = namedpipes.get_pipe_subpath( self._pipeSubPath, true )
				if ( not status ) then
					stdnse.print_debug( 1, "%s: Attempt to connect to invalid pipe name: %s", NP_LIBRARY_NAME, tostring( pipeSubPath ) )
					return false, "Invalid pipe name"
				end
			end
			self.name = namedpipes.make_pipe_name( self._host.ip, self._pipeSubPath )

			stdnse.print_debug( 2, "%s: Connecting to named pipe: %s", NP_LIBRARY_NAME, self.name )
			local status, result, errorMessage
			local bool_negotiate_protocol, bool_start_session, bool_disable_extended = true, true, false
			status, result = start_ex( self._host, bool_negotiate_protocol, bool_start_session,
				"IPC$", self._pipeSubPath, bool_disable_extended, self._overrides )

			if status then
				self._smbstate = result
			else
				errorMessage = string.format( "Connection failed: %s", result )
				stdnse.print_debug( 2, "%s: Connection to named pipe (%s) failed: %s",
					NP_LIBRARY_NAME, self.name, errorMessage )
			end

			return status, errorMessage, result
		end,


		disconnect = function( self )
			if ( self._smbstate ) then
				stdnse.print_debug( 2, "%s: Disconnecting named pipe: %s", NP_LIBRARY_NAME, self.name )
				return stop( self._smbstate )
			else
				stdnse.print_debug( 2, "%s: disconnect() called, but SMB connection is already closed: %s", NP_LIBRARY_NAME, self.name )
			end
		end,


		send = function( self, messageData )
			if not self._smbstate then
				stdnse.print_debug( 2, "%s: send() called on closed pipe (%s)", NP_LIBRARY_NAME, self.name )
				return false, "Failed to send message on named pipe"
			end

			local offset = 0 -- offset is actually ignored for named pipes, but we'll define the argument for clarity
			local status, result, errorMessage

			status, result = write_file( self._smbstate, messageData, offset, self._overrides )

			-- if status is true, result is data that we don't need to pay attention to
			if not status then
				stdnse.print_debug( 2, "%s: Write to named pipe (%s) failed: %s",
					NP_LIBRARY_NAME, self.name, result )
				errorMessage = "Failed to send message on named pipe", result
			end

			return status, errorMessage
		end,


		receive = function( self )
			if not self._smbstate then
				stdnse.print_debug( 2, "%s: receive() called on closed pipe (%s)", NP_LIBRARY_NAME, self.name )
				return false, "Failed to read from named pipe"
			end

			local status, result, messageData
			-- Packet header values
			local offset = 0 -- offset is actually ignored for named pipes, but we'll define the argument for clarity
			local MAX_BYTES_PER_READ = 4096

			status, result = read_file( self._smbstate, offset, MAX_BYTES_PER_READ, self._overrides )

			if status and result.data then
				messageData = result.data
			else
				stdnse.print_debug( 2, "%s: Read from named pipe (%s) failed: %s",
					NP_LIBRARY_NAME, self.name, result )
				return false, "Failed to read from named pipe", result
			end

			while (result["status"] == status_codes.NT_STATUS_BUFFER_OVERFLOW) do
				status, result = read_file( self._smbstate, offset, MAX_BYTES_PER_READ, self._overrides )

				if status and result.data then
					messageData = messageData .. result.data
				else
					stdnse.print_debug( 2, "%s: Read additional data from named pipe (%s) failed: %s",
						NP_LIBRARY_NAME, self.name, result )
					return false, "Failed to read from named pipe", result
				end
			end

			return status, messageData
		end,
	}
	
}

filetype_codes = 
{
	FILE_TYPE_DISK              = 0x00,
	FILE_TYPE_BYTE_MODE_PIPE    = 0x01,
	FILE_TYPE_MESSAGE_MODE_PIPE = 0x02,
	FILE_TYPE_PRINTER           = 0x03,
	FILE_TYPE_UNKNOWN           = 0xFF
}

for i, v in pairs(filetype_codes) do
	filetype_names[v] = i
end

return _ENV;