Packets / Registry / ESE / NTFS
Apart from its Windows session protocols, Impacket has general packet codecs and offline storage parsers.
ImpactPacket — Layered Packets
Section titled “ImpactPacket — Layered Packets”Implementation: ImpactPacket.py and
ImpactDecoder.py.
This is separate from Structure. Each layer is an object with links to
its parent and child, and get_packet() returns the wire bytes.
| Layer | Module / Class |
|---|---|
| Ethernet / Linux SLL | ImpactPacket.Ethernet, etc. |
| IPv4 / TCP / UDP / ICMP / IGMP / ARP | ImpactPacket |
| IPv6 | IP6.py, IP6_Address.py, IP6_Extension_Headers.py |
| ICMPv6 / NDP | ICMP6.py, NDP.py |
| 802.11 / WEP / WPA | dot11.py, Dot11Crypto.py |
| DHCP / DNS / EAP / WPS / HTTP | Individual modules |
| pcap | pcapfile.py, pcap_linktypes.py |
ImpactDecoder builds layers from Ethernet or Linux cooked
(SLL) according to the link type. sniff uses it
through pcapy. sniffer
decodes IP directly from a raw socket.
ping / ping6
do not call the OS ping command. They build headers themselves and pass them to
an IP_HDRINCL raw socket. Impacket calculates the checksums.
No response does not prove that the host is down.
split divides a pcap into files
by IPv4 TCP four-tuple. pcapy is not declared in setup.py.
Tests for 802.11 management and data frames, RadioTap, WEP, and WPA
are under tests/dot11/. There are few CLI examples; this library is
primarily used on its own.
Registry Hives
Section titled “Registry Hives”winregistry.py reads and writes REGF.
get_registry_parser(file, isRemote) is the entry point.
| Operation | Purpose |
|---|---|
findKey / enumKey / enumValues | Search |
getValue / setValue | Read or write values |
getClass | Key class names, required for boot key calculation |
close | Clean up temporary files |
registry-read is the local
read-only CLI, while reg performs
remote operations over rrp RPC and samedit modifies
the SAM hive in place.
A hive is a heap of cells (nk/vk/sk/lf). Do not treat a short read or
corrupt cell as an empty value. A .reg export lacks enough metadata
for boot key or SAM key derivation.
ESE (ESENT)
Section titled “ESE (ESENT)”ese.py implements Extensible Storage Engine parsing.
NTDS (ntds.dit) and some internal Windows databases use this format.
esentutl reads catalogs, raw pages,
and table rows. The offline NTDSHashes path uses the same parser.
Page checksums, long values, and indexes are not fully implemented.
Do not decode unknown page types as ordinary rows.
ntfs-read opens a raw volume or image read-only to browse directories and named streams, dump hex, and extract files. It traverses the MFT but does not write or replay the journal. Support for sparse, compressed, and encrypted ($EFS) data is limited. Do not handle extracted data with the same permissions as ordinary files.
Other Helper Modules
Section titled “Other Helper Modules”| Module | Contents |
|---|---|
uuid.py | RPC UUID binary ↔ string; watch endianness |
nt_errors.py / hresult_errors.py / system_errors.py | Status strings |
helper.py | Small conversions |
version.py | CLI banner |
crypto.py | AES-CMAC, SP 800-108 KDF, encryption and decryption of SAM/LSA secrets |
http.py | Minimal HTTP used by relay and other components |
dhcp.py / dns.py | Packet structures |
Checks When Making Changes
Section titled “Checks When Making Changes”- Preserve ImpactPacket’s parent-child links and checksum offloading
- Check
IP6_Extension_Headerstests for IPv6 extension-header order - Keep read-only hive / ESE / NTFS paths separate from in-place writes
- Related tests:
tests/ImpactPacket/,tests/dot11/,tests/misc/