Impacket getArch.py
Back to the category index / Back to the command index
Overview
Section titled “Overview”Infers whether a target host is 32-bit or 64-bit from its response to an RPC Endpoint Mapper connection.
| Item | Details |
|---|---|
| Implementation | examples/getArch.py |
| Category | SMB / MSRPC / NTLM |
| Size | 111 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and input
Section titled “CLI and input”Run python examples/getArch.py -h for the current option definitions.
| Argument | Description |
|---|---|
-target | |
-targets | File listing target systems, one per line, whose architecture to query |
-timeout | Socket connection timeout (default: 2 seconds) |
-debug | Enable debug output |
-ts | Add a timestamp to each log message |
Detailed processing flow
Section titled “Detailed processing flow”The tool creates an EPM transport to TCP port 135 and attempts a bind that includes the NDR64 transfer syntax. It maps a successful bind or specific faults to an architecture estimate, records timeouts and unreachable targets separately, and proceeds to the next target.
How it works
Section titled “How it works”DCE/RPC can negotiate NDR32 and NDR64 transfer syntaxes. This command connects to the Endpoint Mapper on TCP port 135 and infers the target architecture from the response to a bind that includes a transfer syntax available on 64-bit systems. It does not read OS version strings or SMB banners.
Each target is probed with a separate transport and socket. The tool classifies bind acknowledgments, provider rejections, RPC faults, and timeouts. It maps acceptance of the expected syntax or a specific transfer-syntax rejection to a 64-bit or 32-bit result. A closed port, disabled EPM, or response altered by a middlebox leaves the architecture undetermined.
For a batch supplied with -targets, a timeout on one host must not prevent
other targets from being checked; results remain matched to input order. This
estimate depends on RPC runtime behavior, so do not assume CPU, process, and
installed OS architectures are always the same when interpreting the output.
Key implementation elements
Section titled “Key implementation elements”| Symbol | Location | Where to trace its responsibility |
|---|---|---|
TARGETARCH | 39 | __init__(), run() |
Dependencies
Section titled “Dependencies”Within Impacket
Section titled “Within Impacket”| Module | Main names used |
|---|---|
impacket | version |
impacket.examples | logger |
impacket.dcerpc.v5.rpcrt | DCERPCException |
impacket.dcerpc.v5.transport | DCERPCTransportFactory |
impacket.dcerpc.v5.epm | MSRPC_UUID_PORTMAP |
Output, side effects, and required privileges
Section titled “Output, side effects, and required privileges”- The tool primarily makes queries and authentication attempts. Frequent runs can affect audit logs, account lockouts, and target load.
Failure paths and cleanup
Section titled “Failure paths and cleanup”- On failure, use protocol status codes to determine whether name resolution, connection, authentication, service state, or permissions caused the stop.
When changing the implementation
Section titled “When changing the implementation”The code depends on dcerpc.v5.transport, epm, and rpcrt. TARGETARCH.run() owns the target loop and probes. Distinguish network errors from RPC errors indicating an architecture mismatch.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/getArch.py - CLI:
python examples/getArch.py -h - Related test:
tests/SMB_RPC/test_rpcrt.py - Related test:
tests/dcerpc/test_epm.py