### ms-even.idl
"""
RPC definitions for the following interfaces:
- eventlog (v0.0): 82273FDC-E32A-18C3-3F78-827929DC23EA
This file is auto-generated by midl-to-scapy, do not modify.
"""

import uuid

from scapy.fields import StrFixedLenField
from scapy.layers.dcerpc import (
    NDRPacket,
    DceRpcOp,
    NDRByteField,
    NDRConfFieldListField,
    NDRConfPacketListField,
    NDRConfStrLenField,
    NDRConfVarStrLenField,
    NDRConfVarStrLenFieldUtf16,
    NDRContextHandle,
    NDRFullPointerField,
    NDRIntField,
    NDRPacketField,
    NDRShortField,
    NDRSignedByteField,
    register_dcerpc_interface,
)


class PRPC_UNICODE_STRING(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRShortField("Length", None, size_of="Buffer", adjust=lambda _, x: (x * 2)),
        NDRShortField(
            "MaximumLength", None, size_of="Buffer", adjust=lambda _, x: (x * 2)
        ),
        NDRFullPointerField(
            NDRConfVarStrLenFieldUtf16(
                "Buffer",
                "",
                size_is=lambda pkt: (pkt.MaximumLength // 2),
                length_is=lambda pkt: (pkt.Length // 2),
            ),
            deferred=True,
        ),
    ]


class ElfrClearELFW_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRFullPointerField(
            NDRPacketField("BackupFileName", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING)
        ),
    ]


class ElfrClearELFW_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class ElfrBackupELFW_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("BackupFileName", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING),
    ]


class ElfrBackupELFW_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class ElfrCloseEL_Request(NDRPacket):
    fields_desc = [NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle)]


class ElfrCloseEL_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class ElfrDeregisterEventSource_Request(NDRPacket):
    fields_desc = [NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle)]


class ElfrDeregisterEventSource_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class ElfrNumberOfRecords_Request(NDRPacket):
    fields_desc = [NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle)]


class ElfrNumberOfRecords_Response(NDRPacket):
    fields_desc = [NDRIntField("NumberOfRecords", 0), NDRIntField("status", 0)]


class ElfrOldestRecord_Request(NDRPacket):
    fields_desc = [NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle)]


class ElfrOldestRecord_Response(NDRPacket):
    fields_desc = [NDRIntField("OldestRecordNumber", 0), NDRIntField("status", 0)]


class RPC_CLIENT_ID(NDRPacket):
    ALIGNMENT = (4, 4)
    fields_desc = [NDRIntField("UniqueProcess", 0), NDRIntField("UniqueThread", 0)]


class ElfrChangeNotify_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("ClientId", RPC_CLIENT_ID(), RPC_CLIENT_ID),
        NDRIntField("Event", 0),
    ]


class ElfrChangeNotify_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class ElfrOpenELW_Request(NDRPacket):
    fields_desc = [
        NDRShortField("UNCServerName", 0),
        NDRPacketField("ModuleName", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING),
        NDRPacketField("RegModuleName", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING),
        NDRIntField("MajorVersion", 0),
        NDRIntField("MinorVersion", 0),
    ]


class ElfrOpenELW_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class ElfrRegisterEventSourceW_Request(NDRPacket):
    fields_desc = [
        NDRShortField("UNCServerName", 0),
        NDRPacketField("ModuleName", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING),
        NDRPacketField("RegModuleName", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING),
        NDRIntField("MajorVersion", 0),
        NDRIntField("MinorVersion", 0),
    ]


class ElfrRegisterEventSourceW_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class ElfrOpenBELW_Request(NDRPacket):
    fields_desc = [
        NDRShortField("UNCServerName", 0),
        NDRPacketField("BackupFileName", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING),
        NDRIntField("MajorVersion", 0),
        NDRIntField("MinorVersion", 0),
    ]


class ElfrOpenBELW_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class ElfrReadELW_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("ReadFlags", 0),
        NDRIntField("RecordOffset", 0),
        NDRIntField("NumberOfBytesToRead", 0),
    ]


class ElfrReadELW_Response(NDRPacket):
    fields_desc = [
        NDRConfStrLenField("Buffer", "", size_is=lambda pkt: pkt.NumberOfBytesToRead),
        NDRIntField("NumberOfBytesRead", 0),
        NDRIntField("MinNumberOfBytesNeeded", 0),
        NDRIntField("status", 0),
    ]


class RPC_SID_IDENTIFIER_AUTHORITY(NDRPacket):
    fields_desc = [StrFixedLenField("Value", "", length=6)]


class PRPC_SID(NDRPacket):
    ALIGNMENT = (4, 8)
    DEPORTED_CONFORMANTS = ["SubAuthority"]
    fields_desc = [
        NDRByteField("Revision", 0),
        NDRByteField("SubAuthorityCount", None, size_of="SubAuthority"),
        NDRPacketField(
            "IdentifierAuthority",
            RPC_SID_IDENTIFIER_AUTHORITY(),
            RPC_SID_IDENTIFIER_AUTHORITY,
        ),
        NDRConfFieldListField(
            "SubAuthority",
            [],
            NDRIntField("", 0),
            size_is=lambda pkt: pkt.SubAuthorityCount,
            conformant_in_struct=True,
        ),
    ]


class ElfrReportEventW_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("Time", 0),
        NDRShortField("EventType", 0),
        NDRShortField("EventCategory", 0),
        NDRIntField("EventID", 0),
        NDRShortField("NumStrings", None, size_of="Strings"),
        NDRIntField("DataSize", None, size_of="Data"),
        NDRPacketField("ComputerName", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING),
        NDRFullPointerField(NDRPacketField("UserSID", PRPC_SID(), PRPC_SID)),
        NDRConfPacketListField(
            "Strings",
            [],
            PRPC_UNICODE_STRING,
            size_is=lambda pkt: pkt.NumStrings,
            ptr_pack=True,
        ),
        NDRConfStrLenField("Data", "", size_is=lambda pkt: pkt.DataSize),
        NDRShortField("Flags", 0),
        NDRFullPointerField(NDRIntField("RecordNumber", 0)),
        NDRFullPointerField(NDRIntField("TimeWritten", 0)),
    ]


class ElfrReportEventW_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(NDRIntField("RecordNumber", 0)),
        NDRFullPointerField(NDRIntField("TimeWritten", 0)),
        NDRIntField("status", 0),
    ]


class PRPC_STRING(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRShortField("Length", 0),
        NDRShortField("MaximumLength", None, size_of="Buffer"),
        NDRFullPointerField(
            NDRConfStrLenField("Buffer", "", size_is=lambda pkt: pkt.MaximumLength),
            deferred=True,
        ),
    ]


class ElfrClearELFA_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRFullPointerField(
            NDRPacketField("BackupFileName", PRPC_STRING(), PRPC_STRING)
        ),
    ]


class ElfrClearELFA_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class ElfrBackupELFA_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("BackupFileName", PRPC_STRING(), PRPC_STRING),
    ]


class ElfrBackupELFA_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class ElfrOpenELA_Request(NDRPacket):
    fields_desc = [
        NDRSignedByteField("UNCServerName", 0),
        NDRPacketField("ModuleName", PRPC_STRING(), PRPC_STRING),
        NDRPacketField("RegModuleName", PRPC_STRING(), PRPC_STRING),
        NDRIntField("MajorVersion", 0),
        NDRIntField("MinorVersion", 0),
    ]


class ElfrOpenELA_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class ElfrRegisterEventSourceA_Request(NDRPacket):
    fields_desc = [
        NDRSignedByteField("UNCServerName", 0),
        NDRPacketField("ModuleName", PRPC_STRING(), PRPC_STRING),
        NDRPacketField("RegModuleName", PRPC_STRING(), PRPC_STRING),
        NDRIntField("MajorVersion", 0),
        NDRIntField("MinorVersion", 0),
    ]


class ElfrRegisterEventSourceA_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class ElfrOpenBELA_Request(NDRPacket):
    fields_desc = [
        NDRSignedByteField("UNCServerName", 0),
        NDRPacketField("BackupFileName", PRPC_STRING(), PRPC_STRING),
        NDRIntField("MajorVersion", 0),
        NDRIntField("MinorVersion", 0),
    ]


class ElfrOpenBELA_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class ElfrReadELA_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("ReadFlags", 0),
        NDRIntField("RecordOffset", 0),
        NDRIntField("NumberOfBytesToRead", 0),
    ]


class ElfrReadELA_Response(NDRPacket):
    fields_desc = [
        NDRConfStrLenField("Buffer", "", size_is=lambda pkt: pkt.NumberOfBytesToRead),
        NDRIntField("NumberOfBytesRead", 0),
        NDRIntField("MinNumberOfBytesNeeded", 0),
        NDRIntField("status", 0),
    ]


class ElfrReportEventA_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("Time", 0),
        NDRShortField("EventType", 0),
        NDRShortField("EventCategory", 0),
        NDRIntField("EventID", 0),
        NDRShortField("NumStrings", None, size_of="Strings"),
        NDRIntField("DataSize", None, size_of="Data"),
        NDRPacketField("ComputerName", PRPC_STRING(), PRPC_STRING),
        NDRFullPointerField(NDRPacketField("UserSID", PRPC_SID(), PRPC_SID)),
        NDRConfPacketListField(
            "Strings",
            [],
            PRPC_STRING,
            size_is=lambda pkt: pkt.NumStrings,
            ptr_pack=True,
        ),
        NDRConfStrLenField("Data", "", size_is=lambda pkt: pkt.DataSize),
        NDRShortField("Flags", 0),
        NDRFullPointerField(NDRIntField("RecordNumber", 0)),
        NDRFullPointerField(NDRIntField("TimeWritten", 0)),
    ]


class ElfrReportEventA_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(NDRIntField("RecordNumber", 0)),
        NDRFullPointerField(NDRIntField("TimeWritten", 0)),
        NDRIntField("status", 0),
    ]


class ElfrGetLogInformation_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("InfoLevel", 0),
        NDRIntField("cbBufSize", 0),
    ]


class ElfrGetLogInformation_Response(NDRPacket):
    fields_desc = [
        NDRConfStrLenField("lpBuffer", "", size_is=lambda pkt: pkt.cbBufSize),
        NDRIntField("pcbBytesNeeded", 0),
        NDRIntField("status", 0),
    ]


class ElfrReportEventAndSourceW_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("Time", 0),
        NDRShortField("EventType", 0),
        NDRShortField("EventCategory", 0),
        NDRIntField("EventID", 0),
        NDRPacketField("SourceName", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING),
        NDRShortField("NumStrings", None, size_of="Strings"),
        NDRIntField("DataSize", None, size_of="Data"),
        NDRPacketField("ComputerName", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING),
        NDRFullPointerField(NDRPacketField("UserSID", PRPC_SID(), PRPC_SID)),
        NDRConfPacketListField(
            "Strings",
            [],
            PRPC_UNICODE_STRING,
            size_is=lambda pkt: pkt.NumStrings,
            ptr_pack=True,
        ),
        NDRConfStrLenField("Data", "", size_is=lambda pkt: pkt.DataSize),
        NDRShortField("Flags", 0),
        NDRFullPointerField(NDRIntField("RecordNumber", 0)),
        NDRFullPointerField(NDRIntField("TimeWritten", 0)),
    ]


class ElfrReportEventAndSourceW_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(NDRIntField("RecordNumber", 0)),
        NDRFullPointerField(NDRIntField("TimeWritten", 0)),
        NDRIntField("status", 0),
    ]


class PFILETIME(NDRPacket):
    ALIGNMENT = (4, 4)
    fields_desc = [NDRIntField("dwLowDateTime", 0), NDRIntField("dwHighDateTime", 0)]


class ElfrReportEventExW_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("TimeGenerated", PFILETIME(), PFILETIME),
        NDRShortField("EventType", 0),
        NDRShortField("EventCategory", 0),
        NDRIntField("EventID", 0),
        NDRShortField("NumStrings", None, size_of="Strings"),
        NDRIntField("DataSize", None, size_of="Data"),
        NDRPacketField("ComputerName", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING),
        NDRFullPointerField(NDRPacketField("UserSID", PRPC_SID(), PRPC_SID)),
        NDRConfPacketListField(
            "Strings",
            [],
            PRPC_UNICODE_STRING,
            size_is=lambda pkt: pkt.NumStrings,
            ptr_pack=True,
        ),
        NDRConfStrLenField("Data", "", size_is=lambda pkt: pkt.DataSize),
        NDRShortField("Flags", 0),
        NDRFullPointerField(NDRIntField("RecordNumber", 0)),
    ]


class ElfrReportEventExW_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(NDRIntField("RecordNumber", 0)),
        NDRIntField("status", 0),
    ]


class ElfrReportEventExA_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("LogHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("TimeGenerated", PFILETIME(), PFILETIME),
        NDRShortField("EventType", 0),
        NDRShortField("EventCategory", 0),
        NDRIntField("EventID", 0),
        NDRShortField("NumStrings", None, size_of="Strings"),
        NDRIntField("DataSize", None, size_of="Data"),
        NDRPacketField("ComputerName", PRPC_STRING(), PRPC_STRING),
        NDRFullPointerField(NDRPacketField("UserSID", PRPC_SID(), PRPC_SID)),
        NDRConfPacketListField(
            "Strings",
            [],
            PRPC_STRING,
            size_is=lambda pkt: pkt.NumStrings,
            ptr_pack=True,
        ),
        NDRConfStrLenField("Data", "", size_is=lambda pkt: pkt.DataSize),
        NDRShortField("Flags", 0),
        NDRFullPointerField(NDRIntField("RecordNumber", 0)),
    ]


class ElfrReportEventExA_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(NDRIntField("RecordNumber", 0)),
        NDRIntField("status", 0),
    ]


EVENTLOG_OPNUMS = {
    0: DceRpcOp(ElfrClearELFW_Request, ElfrClearELFW_Response),
    1: DceRpcOp(ElfrBackupELFW_Request, ElfrBackupELFW_Response),
    2: DceRpcOp(ElfrCloseEL_Request, ElfrCloseEL_Response),
    3: DceRpcOp(ElfrDeregisterEventSource_Request, ElfrDeregisterEventSource_Response),
    4: DceRpcOp(ElfrNumberOfRecords_Request, ElfrNumberOfRecords_Response),
    5: DceRpcOp(ElfrOldestRecord_Request, ElfrOldestRecord_Response),
    6: DceRpcOp(ElfrChangeNotify_Request, ElfrChangeNotify_Response),
    7: DceRpcOp(ElfrOpenELW_Request, ElfrOpenELW_Response),
    8: DceRpcOp(ElfrRegisterEventSourceW_Request, ElfrRegisterEventSourceW_Response),
    9: DceRpcOp(ElfrOpenBELW_Request, ElfrOpenBELW_Response),
    10: DceRpcOp(ElfrReadELW_Request, ElfrReadELW_Response),
    11: DceRpcOp(ElfrReportEventW_Request, ElfrReportEventW_Response),
    12: DceRpcOp(ElfrClearELFA_Request, ElfrClearELFA_Response),
    13: DceRpcOp(ElfrBackupELFA_Request, ElfrBackupELFA_Response),
    14: DceRpcOp(ElfrOpenELA_Request, ElfrOpenELA_Response),
    15: DceRpcOp(ElfrRegisterEventSourceA_Request, ElfrRegisterEventSourceA_Response),
    16: DceRpcOp(ElfrOpenBELA_Request, ElfrOpenBELA_Response),
    17: DceRpcOp(ElfrReadELA_Request, ElfrReadELA_Response),
    18: DceRpcOp(ElfrReportEventA_Request, ElfrReportEventA_Response),
    # 19: Opnum19NotUsedOnWire,
    # 20: Opnum20NotUsedOnWire,
    # 21: Opnum21NotUsedOnWire,
    22: DceRpcOp(ElfrGetLogInformation_Request, ElfrGetLogInformation_Response),
    # 23: Opnum23NotUsedOnWire,
    24: DceRpcOp(ElfrReportEventAndSourceW_Request, ElfrReportEventAndSourceW_Response),
    25: DceRpcOp(ElfrReportEventExW_Request, ElfrReportEventExW_Response),
    26: DceRpcOp(ElfrReportEventExA_Request, ElfrReportEventExA_Response),
}
register_dcerpc_interface(
    name="eventlog",
    uuid=uuid.UUID("82273FDC-E32A-18C3-3F78-827929DC23EA"),
    version="0.0",
    opnums=EVENTLOG_OPNUMS,
)
