pysap.SAPSSFS module

class pysap.SAPSSFS.SAPSSFSData(_pkt, /, *, records=[])[source]

Bases: Packet

SAP SSFS Data file format packet.

aliastypes = [<class 'pysap.SAPSSFS.SAPSSFSData'>, <class 'scapy.packet.Packet'>]
fields_desc: List[AnyField] = [<PacketListField (SAPSSFSData).records>]
get_record(key_name)[source]

Returns the first record with the given key name.

Parameters:

key_name (string) – the name of the key to look for

Returns:

the record with key_name

Return type:

SAPSSFSDataRecord

get_records(key_name)[source]

Generator to retrieve records with the given key name.

Parameters:

key_name (string) – the name of the key to look for

Returns:

the record with key_name

Return type:

SAPSSFSDataRecord

get_value(key_name, key=None)[source]

Returns the value with the given key name.

Parameters:

  • key_name (string) – the name of the key to look for

  • key (SAPSSFSKey) – the encryption key

Returns:

the value with key_name

Return type:

bytes

has_record(key_name)[source]

Returns if the data file contains a record with a given key name.

Parameters:

key_name (string) – the name of the key to look for

Returns:

if the data file contains the record with key_name

Return type:

bool

class pysap.SAPSSFS.SAPSSFSDataRecord(_pkt, /, *, preamble=b'RSecSSFsData', length=176, type=1, filler1=None, key_name=None, timestamp=None, user=None, host=None, is_deleted=0, is_stored_as_plaintext=0, is_binary_data=0, filler2=None, hmac=None, data=b'')[source]

Bases: PacketNoPadded

SAP SSFS Data Record.

The Data Record is comprised of a record header of 24 bytes and a data header of 152 bytes followed by the actual data.

aliastypes = [<class 'pysap.SAPSSFS.SAPSSFSDataRecord'>, <class 'pysap.utils.fields.PacketNoPadded'>, <class 'scapy.packet.Packet'>]
decrypt_data(key)[source]
property deleted

Returns whether the HMAC-SHA1 value has been deleted

fields_desc: List[AnyField] = [<StrFixedLenField (SAPSSFSDataRecord).preamble>, <LenField (SAPSSFSDataRecord).length>, <ByteField (SAPSSFSDataRecord).type>, <StrFixedLenField (SAPSSFSDataRecord).filler1>, <StrFixedLenPaddedField (SAPSSFSDataRecord).key_name>, <TimestampField (SAPSSFSDataRecord).timestamp>, <StrFixedLenPaddedField (SAPSSFSDataRecord).user>, <StrFixedLenPaddedField (SAPSSFSDataRecord).host>, <YesNoByteField (SAPSSFSDataRecord).is_deleted>, <YesNoByteField (SAPSSFSDataRecord).is_stored_as_plaintext>, <YesNoByteField (SAPSSFSDataRecord).is_binary_data>, <StrFixedLenField (SAPSSFSDataRecord).filler2>, <StrFixedLenField (SAPSSFSDataRecord).hmac>, <StrFixedLenField (SAPSSFSDataRecord).data>]
get_plain_data(key=None)[source]
property valid

Returns whether the HMAC-SHA1 value is valid for the given payload

class pysap.SAPSSFS.SAPSSFSDecryptedPayload(_pkt, /, *, preamble=b'\x00\x00\x00\x00\x00\x00\x00\x00', length=0, hash=None, data=None, padd=None)[source]

Bases: PacketNoPadded

SAP SSFS Decrypted Payload.

This represents a payload after decryption.

aliastypes = [<class 'pysap.SAPSSFS.SAPSSFSDecryptedPayload'>, <class 'pysap.utils.fields.PacketNoPadded'>, <class 'scapy.packet.Packet'>]
fields_desc: List[AnyField] = [<StrFixedLenField (SAPSSFSDecryptedPayload).preamble>, <LenField (SAPSSFSDecryptedPayload).length>, <StrFixedLenField (SAPSSFSDecryptedPayload).hash>, <StrFixedLenField (SAPSSFSDecryptedPayload).data>, <StrField (SAPSSFSDecryptedPayload).padd>]
property valid

Returns whether the SHA1 value is valid for the given payload

class pysap.SAPSSFS.SAPSSFSKey(_pkt, /, *, preamble=b'RSecSSFsKey', type=1, key=None, timestamp=None, user=None, host=None)[source]

Bases: Packet

SAP SSFS Key file format packet.

Key file length is 0x5c

aliastypes = [<class 'pysap.SAPSSFS.SAPSSFSKey'>, <class 'scapy.packet.Packet'>]
fields_desc: List[AnyField] = [<StrFixedLenField (SAPSSFSKey).preamble>, <ByteField (SAPSSFSKey).type>, <StrFixedLenField (SAPSSFSKey).key>, <TimestampField (SAPSSFSKey).timestamp>, <StrFixedLenPaddedField (SAPSSFSKey).user>, <StrFixedLenPaddedField (SAPSSFSKey).host>]
class pysap.SAPSSFS.SAPSSFSKeyE(_pkt, /, *, preamble=b'RSecSSFsKey', type=None, timestamp=None, user=None, host=None, unknown=None, key_enc=None)[source]

Bases: Packet

SAP SSFS Key (encrypted) file format packet.

Key file length is 0xbb

aliastypes = [<class 'pysap.SAPSSFS.SAPSSFSKeyE'>, <class 'scapy.packet.Packet'>]
fields_desc: List[AnyField] = [<StrFixedLenField (SAPSSFSKeyE).preamble>, <ByteField (SAPSSFSKeyE).type>, <TimestampField (SAPSSFSKeyE).timestamp>, <StrFixedLenPaddedField (SAPSSFSKeyE).user>, <StrFixedLenPaddedField (SAPSSFSKeyE).host>, <StrFixedLenField (SAPSSFSKeyE).unknown>, <StrFixedLenField (SAPSSFSKeyE).key_enc>]
property key
class pysap.SAPSSFS.SAPSSFSLKY(_pkt, /, *, preamble=b'RSecSSFsLKY')[source]

Bases: Packet

SAP SSFS LKY file format packet.

aliastypes = [<class 'pysap.SAPSSFS.SAPSSFSLKY'>, <class 'scapy.packet.Packet'>]
fields_desc: List[AnyField] = [<StrFixedLenField (SAPSSFSLKY).preamble>]
class pysap.SAPSSFS.SAPSSFSLock(_pkt, /, *, preamble=b'RSecSSFsLock', file_type=0, type=0, timestamp=None, user=None, host=None)[source]

Bases: Packet

SAP SSFS Lock file format packet.

aliastypes = [<class 'pysap.SAPSSFS.SAPSSFSLock'>, <class 'scapy.packet.Packet'>]
fields_desc: List[AnyField] = [<StrFixedLenField (SAPSSFSLock).preamble>, <ByteField (SAPSSFSLock).file_type>, <ByteField (SAPSSFSLock).type>, <TimestampField (SAPSSFSLock).timestamp>, <StrFixedLenPaddedField (SAPSSFSLock).user>, <StrFixedLenPaddedField (SAPSSFSLock).host>]
pysap.SAPSSFS.ssfs_hmac_key_unobscured = b'\xe3\xa0a\x11\x85Ah\x99\xf3\x0e\xda\x87z\x80\xcci'

Fixed key embedded in rsecssfx binaries for validating integrity of records