pysap.SAPSSFS module

class pysap.SAPSSFS.SAPSSFSData(_pkt='', post_transform=None, _internal=0, _underlayer=None, **fields)

Bases: scapy.packet.Packet

SAP SSFS Data file format packet.

aliastypes = [<class 'pysap.SAPSSFS.SAPSSFSData'>, <class 'scapy.packet.Packet'>]

fields_desc = [<Field (SAPSSFSData).records>]

get_record(key_name)

Returns the first record with the given key name.

Parameters:key_name (string) – the name of the key to look for Returns:the record with key_name Return type:SAPSSFSDataRecord

get_records(key_name)

Generator to retrieve records with the given key name.

Parameters:key_name (string) – the name of the key to look for Returns:the record with key_name Return type:SAPSSFSDataRecord

get_value(key_name, key=None)

Returns the value with the given key name.

Parameters:

• key_name (string) – the name of the key to look for
• key (SAPSSFSKey) – the encryption key

Returns:

the value with key_name

Return type:

bytes

has_record(key_name)

Returns if the data file contains a record with a given key name.

Parameters:key_name (string) – the name of the key to look for Returns:if the data file contains the record with key_name Return type:bool

class pysap.SAPSSFS.SAPSSFSDataRecord(_pkt='', post_transform=None, _internal=0, _underlayer=None, **fields)

Bases: pysap.utils.fields.PacketNoPadded

SAP SSFS Data Record.

The Data Record is comprised of a record header of 24 bytes and a data header of 152 bytes followed by the actual data.

aliastypes = [<class 'pysap.SAPSSFS.SAPSSFSDataRecord'>, <class 'pysap.utils.fields.PacketNoPadded'>, <class 'scapy.packet.Packet'>]

decrypt_data(key)

deleted

Returns whether the HMAC-SHA1 value has been deleted

fields_desc = [<Field (SAPSSFSDataRecord).preamble>, <Field (SAPSSFSDataRecord).length>, <Field (SAPSSFSDataRecord).type>, <Field (SAPSSFSDataRecord).filler1>, <Field (SAPSSFSDataRecord).key_name>, <Field (SAPSSFSDataRecord).timestamp>, <Field (SAPSSFSDataRecord).user>, <Field (SAPSSFSDataRecord).host>, <Field (SAPSSFSDataRecord).is_deleted>, <Field (SAPSSFSDataRecord).is_stored_as_plaintext>, <Field (SAPSSFSDataRecord).is_binary_data>, <Field (SAPSSFSDataRecord).filler2>, <Field (SAPSSFSDataRecord).hmac>, <Field (SAPSSFSDataRecord).data>]

get_plain_data(key=None)

valid

Returns whether the HMAC-SHA1 value is valid for the given payload

class pysap.SAPSSFS.SAPSSFSDecryptedPayload(_pkt='', post_transform=None, _internal=0, _underlayer=None, **fields)

Bases: pysap.utils.fields.PacketNoPadded

SAP SSFS Decrypted Payload.

This represents a payload after decryption.

aliastypes = [<class 'pysap.SAPSSFS.SAPSSFSDecryptedPayload'>, <class 'pysap.utils.fields.PacketNoPadded'>, <class 'scapy.packet.Packet'>]

fields_desc = [<Field (SAPSSFSDecryptedPayload).preamble>, <Field (SAPSSFSDecryptedPayload).length>, <Field (SAPSSFSDecryptedPayload).hash>, <Field (SAPSSFSDecryptedPayload).data>, <Field (SAPSSFSDecryptedPayload).padd>]

valid

Returns whether the SHA1 value is valid for the given payload

class pysap.SAPSSFS.SAPSSFSKey(_pkt='', post_transform=None, _internal=0, _underlayer=None, **fields)

Bases: scapy.packet.Packet

SAP SSFS Key file format packet.

Key file length is 0x5c

aliastypes = [<class 'pysap.SAPSSFS.SAPSSFSKey'>, <class 'scapy.packet.Packet'>]

fields_desc = [<Field (SAPSSFSKey).preamble>, <Field (SAPSSFSKey).type>, <Field (SAPSSFSKey).key>, <Field (SAPSSFSKey).timestamp>, <Field (SAPSSFSKey).user>, <Field (SAPSSFSKey).host>]

class pysap.SAPSSFS.SAPSSFSLKY(_pkt='', post_transform=None, _internal=0, _underlayer=None, **fields)

Bases: scapy.packet.Packet

SAP SSFS LKY file format packet.

aliastypes = [<class 'pysap.SAPSSFS.SAPSSFSLKY'>, <class 'scapy.packet.Packet'>]

fields_desc = [<Field (SAPSSFSLKY).preamble>]

class pysap.SAPSSFS.SAPSSFSLock(_pkt='', post_transform=None, _internal=0, _underlayer=None, **fields)

Bases: scapy.packet.Packet

SAP SSFS Lock file format packet.

aliastypes = [<class 'pysap.SAPSSFS.SAPSSFSLock'>, <class 'scapy.packet.Packet'>]

fields_desc = [<Field (SAPSSFSLock).preamble>, <Field (SAPSSFSLock).file_type>, <Field (SAPSSFSLock).type>, <Field (SAPSSFSLock).timestamp>, <Field (SAPSSFSLock).user>, <Field (SAPSSFSLock).host>]

pysap.SAPSSFS.ssfs_hmac_key_unobscured = '\xe3\xa0a\x11\x85Ah\x99\xf3\x0e\xda\x87z\x80\xcci'

Fixed key embedded in rsecssfx binaries for validating integrity of records