Skip to content

Instantly share code, notes, and snippets.

@idiom
Created May 21, 2020 03:11
Show Gist options
  • Save idiom/4d055852a1d89f31c4771fdadf131406 to your computer and use it in GitHub Desktop.
Save idiom/4d055852a1d89f31c4771fdadf131406 to your computer and use it in GitHub Desktop.
Print access mask
import sys
"""
NTCreateFile DesiredAccess Masks
0x120189
0x100181
0x12019f
0x1200a0
"""
AccessMask = {
0x0001: "FILE_READ_DATA",
0x0001: "FILE_LIST_DIRECTORY",
0x0002: "FILE_WRITE_DATA",
0x0002: "FILE_ADD_FILE",
0x0004: "FILE_APPEND_DATA",
0x0004: "FILE_ADD_SUBDIRECTORY",
0x0008: "FILE_READ_EA",
0x0008: "FILE_READ_PROPERTIES",
0x0010: "FILE_WRITE_EA",
0x0010: "FILE_WRITE_PROPERTIES",
0x0020: "FILE_EXECUTE",
0x0020: "FILE_TRAVERSE",
0x0040: "FILE_DELETE_CHILD",
0x0080: "FILE_READ_ATTRIBUTES",
0x0100: "FILE_WRITE_ATTRIBUTES",
0x10000: "DELETE",
0x20000: "READ_CONTROL",
0x40000: "WRITE_DAC",
0x80000: "WRITE_OWNER",
0x100000: "SYNCHRONIZE"
}
try:
input = int(sys.argv[1])
except ValueError:
input = int(sys.argv[1], 16)
for mask in AccessMask:
if input & mask:
print AccessMask[mask]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment