Skip to content

Conversation

@gpotter2
Copy link
Member

  • Add DCOM support: a DCOM_Client class that can instanciate classes, request interfaces, release them, call methods, etc.
  • Fix various issues with the DCE/RPC client, most notably improvements to the the handling of bindings contexts and better handling of errors in requests
  • Add vt context verifier (like Windows does) to increase security of a DCE/RPC bind
  • Rewrite NDR recursive fields
  • add more typing and docstrings to the DCERPC_Client
  • documentation

@gpotter2 gpotter2 requested a review from Copilot August 14, 2025 08:58
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds comprehensive DCOM (Distributed Component Object Model) support to Scapy's DCE/RPC implementation. The main purpose is to enable Scapy to handle COM object instantiation, interface management, and remote method calls over DCE/RPC.

Key changes include:

  • Implementation of a new DCOM_Client class with full object lifecycle management capabilities
  • Enhanced DCE/RPC client with improved binding contexts, error handling, and security verification
  • Extension of NDR field types and recursive field handling for complex DCOM structures

Reviewed Changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 5 comments.

Show a summary per file
File Description
scapy/packet.py Error message fix for field building operation
scapy/layers/smb2.py Addition of new SMB2 status codes for DCOM compatibility
scapy/layers/ntlm.py Removal of duplicate error handling code
scapy/layers/msrpce/rpcserver.py Import reorganization and typing improvements
scapy/layers/msrpce/rpcclient.py Major enhancements to DCE/RPC client with security verification
scapy/layers/msrpce/raw/ms_dcom.py Complete DCOM interface definitions and packet structures
scapy/layers/msrpce/mseerr.py Error handling fix for extended error information
scapy/layers/msrpce/msdcom.py New comprehensive DCOM client implementation
scapy/layers/msrpce/ept.py Protocol identifier enum consolidation
scapy/layers/dcerpc.py Core DCE/RPC improvements including COM interface support
scapy/fields.py UTF-16 string length calculation fix
scapy/config.py Addition of NDR64 configuration option
doc/scapy/layers/dcom.rst New documentation for DCOM functionality

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.

@codecov
Copy link

codecov bot commented Aug 14, 2025

Codecov Report

❌ Patch coverage is 52.11679% with 328 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.21%. Comparing base (cc8e091) to head (b8b5202).
⚠️ Report is 5 commits behind head on master.

Files with missing lines Patch % Lines
scapy/layers/msrpce/msdcom.py 21.68% 260 Missing ⚠️
scapy/layers/msrpce/rpcclient.py 61.17% 33 Missing ⚠️
scapy/layers/dcerpc.py 77.53% 31 Missing ⚠️
scapy/layers/msrpce/mspac.py 90.00% 1 Missing ⚠️
scapy/layers/msrpce/rpcserver.py 90.00% 1 Missing ⚠️
scapy/layers/smbclient.py 50.00% 1 Missing ⚠️
scapy/modules/ticketer.py 0.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #4815      +/-   ##
==========================================
- Coverage   80.99%   80.21%   -0.78%     
==========================================
  Files         365      348      -17     
  Lines       89112    89348     +236     
==========================================
- Hits        72173    71672     -501     
- Misses      16939    17676     +737     
Files with missing lines Coverage Δ
scapy/config.py 78.90% <100.00%> (-0.76%) ⬇️
scapy/layers/msrpce/ept.py 52.38% <ø> (-1.11%) ⬇️
scapy/layers/msrpce/mseerr.py 100.00% <100.00%> (ø)
scapy/layers/msrpce/raw/ms_dcom.py 100.00% <100.00%> (ø)
scapy/layers/msrpce/raw/ms_eerr.py 100.00% <100.00%> (ø)
scapy/layers/ntlm.py 81.88% <ø> (+0.45%) ⬆️
scapy/layers/smb2.py 88.48% <ø> (-0.02%) ⬇️
scapy/modules/ldaphero.py 0.00% <ø> (ø)
scapy/packet.py 84.54% <ø> (-0.02%) ⬇️
scapy/layers/msrpce/mspac.py 90.74% <90.00%> (+0.97%) ⬆️
... and 6 more

... and 266 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@gpotter2 gpotter2 merged commit b810032 into secdev:master Aug 20, 2025
23 of 24 checks passed
@gpotter2 gpotter2 deleted the dcom branch August 20, 2025 14:23
@gpotter2 gpotter2 added this to the 2.7.0 milestone Nov 2, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant