ENUM

/* REXX */

/*
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$7'`         `'!$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$7'                  `$$$$$$$$$       $     Y$$   $   $$$   $    YP    $$
$$$$7'              $$$:.   :$$$$$$$$   $$$$$   L  ?$   $   $$$   $   s  s   $$
$$$'                 '7$'    `$$$$$$$      $$   $L  ?   $   $$$   $   $$$$   $$
$$          .4$$$a           :$$$$$$$   $$$$$   $$L     $   Y$P   $   $$$$   $$
$        .4$$$$$$$    $$    .$$$$$$$$       $   $$$L    $L       J$   $$$$   $$
:       :$$$$$$$$'   $$$$     ~'$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
!        '!:$$$7'                 '$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
                                   `+$$$$$$$$$$$P     Y$$$$$P       Y$$$$$$$$$$
.                                    l$$$$$$$$$$  Y$P  $$$$$   $$$   $$$$$$$$$$
::                                .4$$$$$$$$$$$$$$P  S$$$$$$   $$$   $$$$$$$$$$
$$a.             .$             .4$$$$$$$$$$$$$$P  l$$$$$$$$   Y$P   $$$$$$$$$$
$$$$b.          $$$$b.       .4$$$$$$$$$$$$$$$$$       $$  $L       J$$$$$$$$$$
$$$$$$$$A.   .4$$$$$$$A.   .4$$$$$$$$$$$$$$$$$$$$$$$$$$$$ss$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$$$$$$$$.$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$Y'                                                                       '?$$
$$                    z/OS Enumeration Pentesting Tool                       $$
$$                                                                           $$
$$   Arguments: HELP, ALL, APF, CAT, JOB, PATH, SEC, SVC, TSTA, TSOT,        $$
$$              USSU, VERS, WHO                                              $$
$$b.                                                                       .d$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$SoF!
*/

/*------------------------------------------------------------------*\
|* z/OS System Enumeration Tool                                     *|
|*                                                                  *|
|* Description: Enumerates z/OS system information for use in       *|
|*              penetration testing and security assessments.       *|
|*                                                                  *|
|* Arguments:                                                       *|
|*   ALL  - Display all information                                 *|
|*   APF  - APF authorized datasets                                 *|
|*   CAT  - Display master catalog                                  *|
|*   JOB  - Display executing job name                              *|
|*   PATH - Display dataset concatenations                          *|
|*   SEC  - Security manager information                            *|
|*   SVC  - Display SVC information                                 *|
|*   TSTA - Display TESTAUTH authorization                          *|
|*   TSOT - Display TSO AUTHCMD/AUTHPGM tables                      *|
|*   USSU - Display USS/OMVS user list                              *|
|*   VERS - Operating system version info                           *|
|*   WHO  - Currently logged on users (TSO/OMVS)                    *|
|*                                                                  *|
|* Credits: Mark Zelden (IPLINFO), CBT Tape Files 221/496,          *|
|*          Ayoub Elaassal, Jim Taylor, Davide Girardi              *|
\*------------------------------------------------------------------*/

NUMERIC DIGITS 20

/*==================================================================*/
/* EBCDIC-SAFE BRACKET/BRACE PLACEHOLDERS                          */
/*==================================================================*/
/* These placeholders work across all EBCDIC code pages.            */
/* After downloading output, use sed to replace with actual chars:  */
/*                                                                  */
/*   sed 's/<<LB>>/[/g; s/<<RB>>]/]/g; s/<<LC>>/{/g; s/<<RC>>}/}/g' */
/*                                                                  */
/* Or use any find/replace tool:                                    */
/*   <<LB>> -> [    (left square bracket)                           */
/*   <<RB>> -> ]    (right square bracket)                          */
/*   <<LC>> -> {    (left curly brace)                              */
/*   <<RC>> -> }    (right curly brace)                             */
/*==================================================================*/

/* Initialize global assessment variables */
assessMode = 0
findings.0 = 0
findingtemplate.0 = 0
verificationcaption.0 = 0
verificationsteps.0 = 0

/* Global variables for AddToArray */
globalVars = 'tsoUsers. tasks. tasksUsers. omvs. omvsUsers.',
  'jobs. jobsUsers. system.'

/* Global variables for findings */
findingsVars = 'assessMode findings. findingtemplate.',
  'verificationcaption. verificationsteps. ipAddress smfid VSTEP_DELIM'

/* Delimiter for verification steps */
VSTEP_DELIM = '|~~|'

ipAddress = ''
smfid = ''

/* Parse arguments and environment */
PARSE SOURCE s1 s2 prg s3 name s4 s5 space .
PARSE UPPER ARG type restArgs

/* Parse ASSESS subarguments if needed */
IF type == 'ASSESS' THEN DO
  PARSE VAR restArgs ipAddress
  /* Initialize assessment mode */
  assessMode = 1
  findings.0 = 0
  /* Get SMFID from system */
  smfid = GetLparName()
END

/* Adjust for ISPF environment */
IF space == 'ISPF' THEN DO
  SAY ''
  SAY ''
  SAY ''
END

/* Show banner for non-ASSESS modes */
IF type /== 'ASSESS' THEN CALL ShowBanner

/* Set program name based on environment */
IF prg /== '?' & space /== 'OMVS' THEN
  prgname = name||'('||prg||')'
ELSE
  prgname = name

/* Main dispatch logic */
SELECT
  WHEN type == 'APF'  THEN CALL EnumApf
  WHEN type == 'CAT'  THEN CALL EnumCatalog
  WHEN type == 'JOB'  THEN CALL EnumJobname
  WHEN type == 'PATH' THEN DO
    IF space /== 'OMVS' THEN CALL EnumPath
    ELSE SAY 'DDNAME not supported in OMVS'
  END
  WHEN type == 'SEC'  THEN CALL EnumSecurity
  WHEN type == 'SVC'  THEN CALL EnumSvc
  WHEN type == 'TSTA' THEN CALL EnumTestauth
  WHEN type == 'TSOT' THEN CALL EnumTsoTables
  WHEN type == 'USSU' THEN CALL EnumUssUsers
  WHEN type == 'VERS' THEN CALL EnumVersion
  WHEN type == 'WHO'  THEN CALL EnumUsers

  WHEN type == 'ALL'  THEN DO
    CALL PrintBanner 'z/OS System Enumeration'
    SAY 'Executing from:' prgname
    SAY ''
    CALL EnumVersion
    CALL EnumSecurity
    CALL EnumJobname
    CALL EnumUsers
    CALL EnumApf
    CALL EnumSvc
    CALL EnumTestauth
    CALL EnumUssUsers
    CALL EnumTsoTables
    IF space /== 'OMVS' THEN DO
      CALL EnumPath 1
    END
  END

  WHEN type == 'ASSESS' THEN DO
    /* Run all enumeration functions normally */
    CALL PrintSectionBanner 'z/OS System Enumeration (Assessment Mode)'
    SAY 'Executing from:' prgname
    SAY 'Target IP:' ipAddress
    SAY 'SMFID:' smfid
    SAY ''
    CALL EnumVersion
    CALL EnumSecurity
    CALL EnumJobname
    CALL EnumUsers
    CALL EnumApf
    CALL EnumSvc
    CALL EnumTestauth
    CALL EnumUssUsers
    CALL EnumTsoTables
    IF space /== 'OMVS' THEN DO
      CALL EnumPath 1
    END
    /* Output JSON assessment results at the end */
    CALL OutputAssessmentJSON
  END

  OTHERWISE DO
    CALL ShowUsage
    EXIT 8
  END
END

EXIT 0



/*------------------------------------------------------------------*/
/* Display usage information                                        */
/*------------------------------------------------------------------*/

ShowBanner: PROCEDURE
/* credit to https://16colo.rs/pack/sae-006/FMB-SKLL.ASC */
SAY "$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$"||,
"$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$"
SAY "$$$$$$$$$$$7'`         `'!$$$$$$$$$$$$$"||,
"$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$"
SAY "$$$$$$$7'                  `$$$$$$$$$  "||,
"     $     Y$$   $   $$$   $    YP    $$"
SAY "$$$$7'              $$$:.   :$$$$$$$$  "||,
" $$$$$   L  ?$   $   $$$   $   s  s   $$"
SAY "$$$'                 '7$'    `$$$$$$$  "||,
"    $$   $L  ?   $   $$$   $   $$$$   $$"
SAY "$$          .4$$$a           :$$$$$$$  "||,
" $$$$$   $$L     $   Y$P   $   $$$$   $$"
SAY "$        .4$$$$$$$    $$    .$$$$$$$$  "||,
"     $   $$$L    $L       J$   $$$$   $$"
SAY ":       :$$$$$$$$'   $$$$     ~'$$$$$$$"||,
"$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$"
SAY "!        '!:$$$7'                 '$$$$"||,
"$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$"
SAY "                                   `+$$"||,
"$$$$$$$$$P     Y$$$$$P       Y$$$$$$$$$$"
SAY ".                                    l$"||,
"$$$$$$$$$  Y$P  $$$$$   $$$   $$$$$$$$$$"
SAY "::                                .4$$$"||,
"$$$$$$$$$$$P  S$$$$$$   $$$   $$$$$$$$$$"
SAY "$$a.             .$             .4$$$$$"||,
"$$$$$$$$$P  l$$$$$$$$   Y$P   $$$$$$$$$$"
SAY "$$$$b.          $$$$b.       .4$$$$$$$$"||,
"$$$$$$$$$       $$  $L       J$$$$$$$$$$"
SAY "$$$$$$$$A.   .4$$$$$$$A.   .4$$$$$$$$$$"||,
"$$$$$$$$$$$$$$$$$$ss$$$$$$$$$$$$$$$$$$$$"
SAY "$$$$$$$$$$$$$$$$$$$$$$$$$.$$$$$$$$$$$$$"||,
"$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$"
RETURN

ShowUsage: PROCEDURE

SAY "$$Y'                                   "||,
"                                    '?$$"
SAY "$$                    z/OS Enumeration "||,
"Pentesting Tool                       $$"
SAY "$$                                     "||,
"                                      $$"
SAY "$$   Arguments: HELP, ALL, APF, CAT, JO"||,
"B, PATH, SEC, SVC, TSTA, TSOT,        $$"
SAY "$$              USSU, VERS, WHO        "||,
"                                      $$"
SAY "$$b.                                   "||,
"                                    .d$$"
SAY "$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$"||,
"$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$SoF!"
RETURN


ShowHelp: PROCEDURE EXPOSE prgname space
  SAY ''
  SAY 'z/OS Enumeration tool by Soldier of FORTRAN'
  SAY ''
  SAY 'Arguments:'
  SAY "  'HELP' - Display help information"
  SAY "  'ALL'  - Display all information"
  SAY "  'APF'  - Display APF authorized datasets"
  SAY "  'CAT'  - Display master catalog"
  SAY "  'JOB'  - Display executing job name"
  SAY "  'PATH' - Display dataset concatenations"
  SAY "  'SEC'  - Display security manager info"
  SAY "  'SVC'  - Display all SVCs"
  SAY "  'TSTA' - Display TESTAUTH authorization"
  SAY "  'TSOT' - Display TSO AUTHCMD/AUTHPGM tables"
  SAY "  'USSU' - Display USS/OMVS user list"
  SAY "  'VERS' - Display system version information"
  SAY "  'WHO'  - Display logged on TSO/OMVS users"
  SAY "  'ASSESS' - Print the findings"
  SAY ''
  SAY 'Example:'
  IF space /== 'OMVS' THEN SAY prgname "'WHO'"
  ELSE SAY prgname 'WHO'
RETURN

/*------------------------------------------------------------------*/
/* Enumerate executing job name                                     */
/*------------------------------------------------------------------*/
EnumJobname: PROCEDURE

  CALL PrintSectionBanner 'Job Information'
  cvt = GetPtr(16)
  tcbp = GetPtr(cvt)
  tcb = GetPtr(tcbp+4)
  tiot = GetPtr(tcb+12)
  jobname = STRIP(GetStorage(tiot, 8))
  SAY 'Executing Job Name:' jobname
RETURN

/*------------------------------------------------------------------*/
/* Enumerate logged on users (TSO/OMVS/Started Tasks/Jobs)         */
/*------------------------------------------------------------------*/
EnumUsers: PROCEDURE EXPOSE (globalvars)

  CALL PrintSectionBanner 'Logged On Users'
  cvt = GetPtr(16)
  asvt = GetPtr(cvt+556) + 512
  asvtMaxu = GetPtr(asvt+4)

  /* Initialize arrays */
  tsoUsers.0 = 0
  tasks.0 = 0
  tasksUsers.0 = 0
  omvs.0 = 0
  omvsUsers.0 = 0
  jobs.0 = 0
  jobsUsers.0 = 0
  system.0 = 0

  /* Iterate through address spaces */
  DO i = 0 TO asvtMaxu - 1
    ascb = GetStorage(asvt+16+(i*4), 4)

    /* Check if address space is in use */
    IF BITAND(ascb, '80000000'x) == '00000000'x THEN DO
      ascb = C2D(ascb)
      cscb = GetPtr(ascb+56)
      chtrkid = GetStorage(cscb+28, 1)
      ascbjbni = GetPtr(ascb+172)
      ascbjbns = GetPtr(ascb+176)
      asxb = GetPtr(ascb+108)
      ascboucb = GetPtr(ascb+144)
      oucbsubn = GetStorage(ascboucb+176, 4)
      oucbtrxn = GetStorage(ascboucb+200, 8)
      oucbusrd = GetStorage(ascboucb+208, 8)

      /* Started task */
      IF ascbjbns <> 0 & chtrkid == '02'x THEN DO
        usid = GetUserid(ascb)
        CALL AddToArray 'tasks', GetStorage(ascbjbns, 8)
        CALL AddToArray 'tasksUsers', usid
      END

      /* TSO user */
      IF ascbjbns <> 0 & chtrkid == '01'x THEN DO
        CALL AddToArray 'tsoUsers', GetStorage(ascbjbns, 8)
      END

      /* System */
      IF ascbjbns <> 0 & chtrkid == '04'x THEN DO
        CALL AddToArray 'system', GetStorage(ascbjbns, 8)
      END

      /* OMVS user */
      IF STRIP(oucbsubn) == 'OMVS' THEN DO
        CALL AddToArray 'omvs', oucbtrxn
        CALL AddToArray 'omvsUsers', oucbusrd
      END

      /* Batch job */
      IF ascbjbni <> 0 & chtrkid == '03'x THEN DO
        IF STRIP(oucbsubn) == 'OMVS' THEN ITERATE
        usid = GetUserid(ascb)
        CALL AddToArray 'jobs', GetStorage(ascbjbni, 8)
        CALL AddToArray 'jobsUsers', usid
      END
    END
  END

  /* Display results */
  SAY '**** Started Tasks - Owner ****'
  DO i = 1 TO tasks.0
    SAY tasks.i '-' tasksUsers.i
  END

  SAY ''
  SAY '**** TSO Users - Owner ****'
  DO i = 1 TO tsoUsers.0
    SAY tsoUsers.i '-' tsoUsers.i
  END

  SAY ''
  SAY '**** OMVS Users - Owner ****'
  DO i = 1 TO omvs.0
    SAY omvs.i '-' omvsUsers.i
  END

  SAY ''
  SAY '**** Jobs - Owner ****'
  DO i = 1 TO jobs.0
    SAY jobs.i '-' jobsUsers.i
  END
RETURN

/*------------------------------------------------------------------*/
/* Enumerate security manager (RACF/ACF2/Top Secret)               */
/*------------------------------------------------------------------*/
EnumSecurity: PROCEDURE EXPOSE (findingsVars)

  CALL PrintSectionBanner 'Security Settings'

  IF assessMode == 0 THEN SAY 'External Security Manager:'
  ELSE SAY 'External Security Manager:'

  cvt = GetPtr(16)
  cvtrac = GetPtr(cvt+992)
  id = GetStorage(cvtrac, 4)

  SELECT
    WHEN id == 'RCVT' THEN CALL EnumRacf cvtrac
    WHEN id == 'RTSS' THEN CALL EnumTopSecret cvtrac
    OTHERWISE CALL EnumAcf2 cvt
  END
RETURN

/*------------------------------------------------------------------*/
/* Enumerate RACF configuration                                     */
/*------------------------------------------------------------------*/
EnumRacf: PROCEDURE EXPOSE (findingsVars) warningDatasets,
  excessiveUaccDatasets excessiveAccessDatasets
  PARSE ARG rcvt

  racfVrm = GetStorage(rcvt+616, 4)
  rcvtDsdt = GetPtr(rcvt+224)
  dsdtNum = GetPtr(rcvtDsdt+4)
  dsdtPrim = STRIP(GetStorage(rcvtDsdt+177, 44), 'T')
  dsdtBack = STRIP(GetStorage(rcvtDsdt+353, 44), 'T')

  SAY 'Product: RACF'
  SAY 'Version: FMID HRF'racfVrm
  SAY 'Datasets:'
  SAY ''

  /* Always show access since we're on RACF */
  SAY 'UACC | WARN | ACCESS | DATASET'
  SAY '-----|------|--------|' || COPIES('-', 44)

  IF dsdtNum == 1 THEN DO
    /* Check access for primary and backup - READ access is a finding */
    /* Pass empty strings for volume/missing to get simple format */
    outputprim = CheckAndReportDatasetAccess(dsdtPrim, '', '', 1)
    SAY outputprim
    outputback = CheckAndReportDatasetAccess(dsdtBack, '', '', 1)
    SAY outputback
  END
  ELSE DO
    offset = 0
    DO i = 1 TO dsdtNum
      prim = STRIP(GetStorage(rcvtDsdt+177+offset, 44), 'T')
      back = STRIP(GetStorage(rcvtDsdt+353+offset, 44), 'T')
      offset = offset + 352
      /* Check access for primary and backup - READ access is a finding */
      /* Pass empty strings for volume/missing to get simple format */
      outputprim = CheckAndReportDatasetAccess(prim, '', '', 1)
      SAY outputprim
      outputback = CheckAndReportDatasetAccess(back, '', '', 1)
      SAY outputback
    END
  END

  /* Check if we need to add findings for RACF dataset security */
  /* Parse all fields from the output: UACC | WARN | ACCESS | DATASET */
  PARSE VAR outputprim primuacc '|' primwarn '|' primaccess '|' .
  PARSE VAR outputback backuacc '|' backwarn '|' backaccess '|' .
  primuacc = STRIP(primuacc)
  primwarn = STRIP(primwarn)
  primaccess = STRIP(primaccess)
  backuacc = STRIP(backuacc)
  backwarn = STRIP(backwarn)
  backaccess = STRIP(backaccess)

  IF assessMode == 1 THEN DO
    /* Check for user access to RACF datasets */
    IF primaccess \== 'NONE' | backaccess \== 'NONE' THEN DO
      CALL AddFinding 'RACF-DATASET-ACCESS'
      CALL AddVerificationCaption 'Run the REXX script ENUM with the',
        'SEC argument and observe that the testing account has READ or',
        'greater access to the RACF datasets.'
      CALL AddVerificationContent 'UACC | WARN | ACCESS | DATASET'||,
        ' -----|------|--------|---------------------------------'||,
        ' '||outputprim||' '||outputback
    END

    /* Check for excessive UACC on RACF datasets */
    IF primuacc \== 'NONE' | backuacc \== 'NONE' THEN DO
      CALL AddFinding 'RACF-DATASET-EXCESSIVE-UACC'
      CALL AddVerificationCaption 'Run the REXX script ENUM with the',
        'SEC argument and observe that the RACF datasets have a UACC',
        'of READ or greater.'
      CALL AddVerificationContent 'UACC | WARN | ACCESS | DATASET'||,
        ' -----|------|--------|---------------------------------'||,
        ' '||outputprim||' '||outputback
    END

    /* Check for WARNING mode on RACF datasets */
    IF primwarn == 'YES' | backwarn == 'YES' THEN DO
      CALL AddFinding 'RACF-DATASET-WARNING-MODE'
      CALL AddVerificationCaption 'Run the REXX script ENUM with the',
        'SEC argument and observe that the RACF datasets are configured',
        'with WARNING mode enabled.'
      CALL AddVerificationContent 'UACC | WARN | ACCESS | DATASET'||,
        ' -----|------|--------|---------------------------------'||,
        ' '||outputprim||' '||outputback
    END
  END

  SAY ''
  CALL EnumSetropts rcvt
RETURN

/*------------------------------------------------------------------*/
/* Enumerate Top Secret configuration                              */
/*------------------------------------------------------------------*/
EnumTopSecret: PROCEDURE EXPOSE (findingsVars) warningDatasets,
  excessiveUaccDatasets excessiveAccessDatasets
  PARSE ARG cvtrac

  rcvtDsn = STRIP(GetStorage(cvtrac+56, 44))
  SAY 'Product: Top Secret'
  SAY 'Dataset:' rcvtDsn
  SAY ''
  SAY 'Note: Access checking for Top Secret datasets requires'
  SAY '      Top Secret-specific commands (not yet implemented)'
RETURN

/*------------------------------------------------------------------*/
/* Enumerate ACF2 configuration                                     */
/*------------------------------------------------------------------*/
EnumAcf2: PROCEDURE EXPOSE (findingsVars) warningDatasets,
  excessiveUaccDatasets excessiveAccessDatasets
  PARSE ARG cvt

  cvtJesct = GetPtr(cvt+296)
  sscvt = GetPtr(cvtJesct+24)

  DO WHILE sscvt <> 0
    ssctsNam = GetStorage(sscvt+8, 4)

    IF ssctsNam == 'ACF2' THEN DO
      accvt = GetPtr(sscvt+20)
      accpfxp = GetPtr(accvt-4)
      accpidl = C2D(GetStorage(accpfxp+8, 2))
      lenId = accpidl - 4
      accpids = STRIP(GetStorage(accpfxp+12, lenId))
      acf2Dsns = GetPtr(accvt+252)
      acf2Dnum = C2D(GetStorage(acf2Dsns+16, 2))

      SAY 'Product: ACF2'
      SAY 'Version:' accpids
      SAY 'Dataset(s):'

      DO i = 1 TO acf2Dnum
        adsOff = acf2Dsns + 24 + ((i-1)*64)
        acf2Type = GetStorage(adsOff, 8)
        acf2Dsn = GetStorage(adsOff+16, 44)
        SAY ' ' acf2Type '-' acf2Dsn
      END

      SAY ''
      SAY 'Note: Access checking for ACF2 datasets requires'
      SAY '      ACF2-specific commands (not yet implemented)'

      LEAVE
    END

    sscvt = GetPtr(sscvt+4)
  END
RETURN

/*------------------------------------------------------------------*/
/* Enumerate APF authorized libraries                              */
/*------------------------------------------------------------------*/
EnumApf: PROCEDURE EXPOSE space (findingsVars)

  CALL PrintSectionBanner 'APF Authorized Datasets/Libraries'

  IF space == 'OMVS' THEN DO
    SAY '! APF Dataset Checking Not Supported in UNIX'
    missing = '******'
    SAY ''
  END

  /* Check if we're on RACF to determine if we show access columns */
  cvt = GetPtr(16)
  cvtrac = GetPtr(cvt+992)
  id = GetStorage(cvtrac, 4)
  showAccess = (id == 'RCVT')

  /* Initialize finding tracking arrays */
  warningDatasets = ''
  excessiveUaccDatasets = ''
  excessiveAccessDatasets = ''

  IF showAccess THEN DO
    SAY 'VOLUME | EXISTS | UACC | WARN | ACCESS | DATASET'
    SAY '-------|--------|------|------|--------|' || COPIES('-', 20)
  END
  ELSE DO
    SAY 'VOLUME | EXISTS | DATASET'
    SAY '-------|--------|' || COPIES('-', 44)
  END

  cvtAuthl = GetPtr(cvt+484)

  /* Check if APF table is dynamic or static */
  IF cvtAuthl == C2D('7FFFF001'x) THEN DO
    CALL EnumDynamicApf cvt, showAccess
  END
  ELSE DO
    CALL EnumStaticApf cvtAuthl, showAccess
  END

  /* Add findings if any issues were found */
  IF showAccess & assessMode == 1 THEN DO
    IF warningDatasets \== '' THEN DO
      CALL AddFinding 'APF-WARNING-MODE-ENABLED'
      CALL AddVerificationCaption 'Run the REXX script ENUM and observe',
        'that the following datasets were configured with WARNING mode',
        'enabled:'
      CALL AddVerificationContent warningDatasets
    END

    IF excessiveUaccDatasets \== '' THEN DO
      CALL AddFinding 'APF-EXCESSIVE-UACC'
      CALL AddVerificationCaption 'Run the REXX script ENUM and observe',
        'that the following datasets were configured with a UACC of',
        'UPDATE, CONTROL, or ALTER:'
      CALL AddVerificationContent excessiveUaccDatasets
    END

    IF excessiveAccessDatasets \== '' THEN DO
      CALL AddFinding 'APF-EXCESSIVE-USER-ACCESS'
      CALL AddVerificationCaption 'Run the REXX script ENUM and observe',
        'that the testing account had UPDATE, CONTROL, or ALTER access',
        'to the following datasets:'
      CALL AddVerificationContent excessiveAccessDatasets
    END
  END
RETURN

/*------------------------------------------------------------------*/
/* Enumerate dynamic APF table                                      */
/*------------------------------------------------------------------*/
EnumDynamicApf: PROCEDURE EXPOSE space warningDatasets,
  excessiveUaccDatasets excessiveAccessDatasets
  PARSE ARG cvt, showAccess

  cvtEcvt = GetPtr(cvt+140)
  ecvtCsvt = GetPtr(cvtEcvt+228)
  apfPtr = GetPtr(ecvtCsvt+12)
  cur = GetPtr(apfPtr+8)
  last = GetPtr(apfPtr+12)

  DO FOREVER
    dataset = GetStorage(cur+24, 44)
    missing = '  Yes '

    IF SUBSTR(dataset, 1, 1) \== '00'x THEN DO
      volSms = GetStorage(cur+4, 1)

      IF BITAND(volSms, '80'x) == '80'x THEN DO
        volume = 'SMS   '
        IF space /== 'OMVS' THEN
          retcode = LISTDSI("'"STRIP(dataset)"'" norecall)
      END
      ELSE DO
        volume = GetStorage(cur+68, 6)
        IF space /== 'OMVS' THEN
          retcode = LISTDSI("'"STRIP(dataset)"'",
            'volume('STRIP(volume)')' norecall)
      END

      IF retcode <> 0 THEN DO
        IF SYSREASON == 24 THEN missing = '  No  '
        ELSE missing = SPACE(D2C(SYSREASON), 8, ' ')
      END

      /* Check dataset access if on RACF */
      IF showAccess THEN DO
        output = CheckAndReportDatasetAccess(dataset, volume, missing)
        SAY output
      END
      ELSE DO
        SAY LEFT(STRIP(volume),6) '|' STRIP(LEFT(missing,6)),
           '|' STRIP(dataset)
      END
    END

    IF cur == last THEN LEAVE
    cur = GetPtr(cur+8)
  END
RETURN

/*------------------------------------------------------------------*/
/* Enumerate static APF table                                       */
/*------------------------------------------------------------------*/
EnumStaticApf: PROCEDURE EXPOSE warningDatasets,
  excessiveUaccDatasets excessiveAccessDatasets
  PARSE ARG cvtAuthl, showAccess

  numApf = C2D(GetStorage(cvtAuthl, 2))
  len = C2D(GetStorage(cvtAuthl+2, 1))
  cur = cvtAuthl + 3

  DO i = 1 TO numApf
    volume = GetStorage(cur, 6)
    dataset = GetStorage(cur+7, len)
    missing = '  N/A  '

    /* Check dataset access if on RACF */
    IF showAccess THEN DO
      output = CheckAndReportDatasetAccess(dataset, volume, missing)
      SAY output
    END
    ELSE DO
      SAY STRIP(volume) '|' STRIP(dataset)
    END

    cur = cur + len + 1
    len = C2D(GetStorage(cur-1, 1))
  END
RETURN

/*------------------------------------------------------------------*/
/* Enumerate operating system version information                  */
/*------------------------------------------------------------------*/
EnumVersion: PROCEDURE

  CALL PrintSectionBanner 'Operating System Version'

  cvt = GetPtr(16)
  cvtExt2 = GetPtr(cvt+328)
  cvtJesct = GetPtr(cvt+296)
  ecvt = GetPtr(cvt+140)

  /* OS version */
  prodName = GetStorage(cvt-40, 7)
  prodName2 = STRIP(GetStorage(ecvt+496, 16), 'T')
  ver = GetStorage(ecvt+512, 2)
  rel = GetStorage(ecvt+514, 2)
  mod = GetStorage(ecvt+516, 2)
  vrm = ver'.'rel'.'mod
  fmidNum = GetStorage(cvt-32, 7)

  SAY 'The OS version is' prodName2 vrm '- FMID' fmidNum,
    '('prodName').'

  /* LPAR and Processor information */
  csd = GetPtr(cvt+660)
  ecvtHdnm = GetStorage(ecvt+336, 8)  /* Hardware name */
  ecvtLpnm = GetStorage(ecvt+344, 8)  /* LPAR name */

  IF ecvtHdnm \== '        ' & ecvtLpnm \== '        ' THEN DO
    csdPlpn = C2D(GetStorage(csd+252, 1))  /* LPAR number */
    SAY 'The Processor name is' STRIP(ecvtHdnm)'.',
      'The LPAR SMFID is' STRIP(ecvtLpnm) '(LPAR #'csdPlpn').'
  END

  /* TSO version */
  cvtTvt = GetPtr(cvt+156)
  tsvtLver = GetStorage(cvtTvt+100, 1)
  tsvtLrel = GetStorage(cvtTvt+101, 2)
  tsvtLrel = FORMAT(tsvtLrel)
  tsvtLmod = GetStorage(cvtTvt+103, 1)
  tsoLev = tsvtLver'.'tsvtLrel'.'tsvtLmod
  SAY 'TSO:' tsoLev

  /* JES version */
  CALL EnumJes cvtJesct

  /* VTAM version */
  CALL EnumVtam cvtExt2
RETURN

/*------------------------------------------------------------------*/
/* Enumerate JES information                                        */
/*------------------------------------------------------------------*/
EnumJes: PROCEDURE
  PARSE ARG cvtJesct

  jesSsct = GetPtr(cvtJesct+24)
  jesPjesn = GetStorage(cvtJesct+28, 4)
  ssctsNam = GetStorage(jesSsct+8, 4)

  DO UNTIL jesSsct == 0
    IF jesPjesn == ssctsNam THEN DO
      ssctSsvt = GetPtr(jesSsct+16)
      ssctSuse = GetPtr(jesSsct+20)
      ssctSus2 = GetPtr(jesSsct+28)
      LEAVE
    END
    jesSsct = GetPtr(jesSsct+4)
  END

  IF jesPjesn == 'JES3' THEN DO
    jesVers = SYSVAR('SYSJES')
    jesNode = SYSVAR('SYSNODE')
  END
  ELSE IF jesPjesn == 'JES2' THEN DO
    jesVers = STRIP(GetStorage(ssctSuse, 8))
    jesNode = GetJes2Node(jesVers, ssctSus2)
  END

  SAY 'JES:' jesPjesn jesVers 'Node:' jesNode
RETURN

/*------------------------------------------------------------------*/
/* Get JES2 node name based on version                             */
/*------------------------------------------------------------------*/
GetJes2Node: PROCEDURE
  PARSE ARG jesVers, ssctSus2

  prefix = SUBSTR(jesVers, 1, 8)

  SELECT
    WHEN prefix == 'z/OS 2.2' THEN
      jesNode = STRIP(GetStorage(ssctSus2+664, 8))
    WHEN prefix == 'z/OS 2.1' | prefix == 'z/OS1.13' |,
         prefix == 'z/OS1.12' | prefix == 'z/OS1.11' THEN
      jesNode = STRIP(GetStorage(ssctSus2+656, 8))
    WHEN prefix == 'z/OS1.10' | prefix == 'z/OS 1.9' THEN
      jesNode = STRIP(GetStorage(ssctSus2+708, 8))
    WHEN prefix == 'z/OS 1.8' THEN
      jesNode = STRIP(GetStorage(ssctSus2+620, 8))
    WHEN prefix == 'z/OS 1.7' THEN
      jesNode = STRIP(GetStorage(ssctSus2+616, 8))
    WHEN prefix == 'z/OS 1.5' | prefix == 'z/OS 1.4' THEN
      jesNode = STRIP(GetStorage(ssctSus2+532, 8))
    WHEN SUBSTR(jesVers,1,7) == 'OS 2.10' |,
         prefix == 'z/OS 1.2' THEN
      jesNode = STRIP(GetStorage(ssctSus2+452, 8))
    WHEN SUBSTR(jesVers,1,6) == 'OS 1.1' |,
         SUBSTR(jesVers,1,4) == 'SP 5' THEN
      jesNode = STRIP(GetStorage(ssctSus2+336, 8))
    WHEN SUBSTR(jesVers,1,5) == 'OS 1.' |,
         SUBSTR(jesVers,1,5) == 'OS 2.' THEN
      jesNode = STRIP(GetStorage(ssctSus2+372, 8))
    OTHERWISE
      jesNode = SYSVAR('SYSNODE')
  END

RETURN jesNode

/*------------------------------------------------------------------*/
/* Enumerate VTAM information                                       */
/*------------------------------------------------------------------*/
EnumVtam: PROCEDURE
  PARSE ARG cvtExt2

  chkVtAct = GetStorage(cvtExt2+64, 1)

  IF BITAND(chkVtAct, '80'x) == '80'x THEN DO
    cvtAtcvt = C2D(GetStorage(cvtExt2+65, 3))
    istAtcvt = GetPtr(cvtAtcvt)
    atcvtLvl = GetStorage(istAtcvt, 8)
    vtamVer = SUBSTR(atcvtLvl, 3, 1)
    vtamRel = SUBSTR(atcvtLvl, 4, 1)
    vtamMod = SUBSTR(atcvtLvl, 5, 1)

    IF vtamMod == ' ' THEN vtamLev = vtamVer'.'vtamRel
    ELSE vtamLev = vtamVer'.'vtamRel'.'vtamMod

    atcNetid = STRIP(GetStorage(istAtcvt+2080, 8))
    atcNqnam = STRIP(GetStorage(istAtcvt+2412, 17))

    SAY 'VTAM:' vtamLev '(NETID:' atcNetid')',
      '(SSCPNAME:' atcNqnam')'
  END
RETURN

/*------------------------------------------------------------------*/
/* Enumerate SVC table                                              */
/*------------------------------------------------------------------*/
EnumSvc: PROCEDURE EXPOSE (findingsVars)

  CALL PrintSectionBanner 'SVC Table'
  IF assessMode == 0 THEN DO
    SAY 'Installed SVCs (APF authorized only):'
  END
  ELSE DO
    SAY 'Installed SVCs:'
  END
  SAY 'SVCEP    | SVC | HX | TYPE | APF | ESR'
  SAY '---------|-----|----|------|-----|----'

  cvt = GetPtr(16)
  cvtAbend = GetPtr(cvt+200)
  scvtSvct = GetPtr(cvtAbend+132)
  cvtNucmp = GetPtr(cvt+1200)
  nucmAddr = GetPtr(cvtNucmp+8)

  /* Find IGCERROR address */
  nucmap = cvtNucmp + 16
  DO WHILE nucmap <= nucmAddr
    IF GetStorage(nucmap, 8) == 'IGCERROR' THEN DO
      igcError = GetStorage(nucmap+8, 4)
      LEAVE
    END
    nucmap = nucmap + 16
  END

  /* Iterate through SVC table */
  DO i = 0 TO 255
    addr = BITAND(GetStorage(scvtSvct+(i*8), 4), '7FFFFFFF'x)

    IF igcError \== addr THEN DO
      svcType = GetStorage(scvtSvct+(i*8)+4, 1)

      /* Determine type */
      SELECT
        WHEN BITAND(svcType, '80'x) == '80'x THEN type = '2'
        WHEN BITAND(svcType, 'C0'x) == 'C0'x THEN type = '3/4'
        WHEN BITAND(svcType, '20'x) == '20'x THEN type = '6'
        WHEN BITAND(svcType, 'F0'x) == '00'x THEN type = '1'
        OTHERWISE type = '?'
      END

      /* Check APF and ESR flags */
      IF BITAND(svcType, '08'x) == '08'x THEN apf = 'Y'
      ELSE apf = 'N'

      IF BITAND(svcType, '04'x) == '04'x THEN esr = 'Y'
      ELSE esr = 'N'

      /* If not in assess mode, only show APF authorized SVCs */
      IF assessMode == 0 THEN DO
        IF apf == 'Y' THEN DO
          SAY C2X(GetStorage(scvtSvct+(i*8), 4)) '|',
            RIGHT(i, 3, 0) '|' RIGHT(D2X(i), 2, 0) '|',
            type '  |' apf '|' esr
        END
      END
      ELSE DO
        /* In assess mode, show all SVCs */
        SAY C2X(GetStorage(scvtSvct+(i*8), 4)) '|',
          RIGHT(i, 3, 0) '|' RIGHT(D2X(i), 2, 0) '|',
          type '  |' apf '|' esr
      END
    END
  END
RETURN

/*------------------------------------------------------------------*/
/* Enumerate dataset concatenations (PATH)                         */
/*------------------------------------------------------------------*/
EnumPath: PROCEDURE EXPOSE (globalvars)
  PARSE ARG lvl
  
  CALL PrintSectionBanner 'DDNAME Concatenations'

  IF lvl < 1 THEN lvl = 0

  psAlccav = C2D(STORAGE('21C', 4))
  tcbTio = GetPtr(psAlccav+12)
  tiot = tcbTio + 24
  tioElngh = 0
  dd = ''

  IF lvl < 1 THEN DO
    SAY 'Only displaying SYSPROC/SYSEXEC'
    SAY ''
    SAY 'DD       | DATASET Name'
    SAY '---------|' || COPIES('-', 44)
  END
  ELSE DO
    SAY 'DD       | VOLUME | DATASET Name'
    SAY '---------|--------|' || COPIES('-', 44)
  END

  DO FOREVER
    tiot = tiot + tioElngh
    tioElngh = C2D(GetStorage(tiot, 1))
    IF tioElngh == 0 THEN LEAVE

    tioEddnm = GetStorage(tiot+4, 8)
    IF tioEddnm \== '        ' THEN dd = tioEddnm

    dsnAddr = Swareq(GetStorage(tiot+12, 3))
    dataset = STRIP(GetStorage(dsnAddr, 44))
    volume = GetStorage(X2D(dsnAddr)+118, 6)

    IF lvl < 1 THEN DO
      IF dd == 'SYSPROC ' | dd == 'SYSEXEC ' THEN
        SAY dd '|' dataset
    END
    ELSE SAY dd '|' volume '|' dataset
  END
RETURN

/*------------------------------------------------------------------*/
/* Enumerate master catalog                                         */
/*------------------------------------------------------------------*/
EnumCatalog: PROCEDURE
  cvt = GetPtr(16)
  ecvt = GetPtr(cvt+140)
  ecvtIpa = GetPtr(ecvt+392)
  ipaScat = GetStorage(ecvtIpa+224, 63)
  mcatDsn = STRIP(SUBSTR(ipaScat, 11, 44))
  mcatVol = SUBSTR(ipaScat, 1, 6)

  SAY 'Master Catalog:' mcatDsn 'Volume:' mcatVol
RETURN

/*------------------------------------------------------------------*/
/* Test TESTAUTH authorization                                      */
/*------------------------------------------------------------------*/
EnumTestauth: PROCEDURE

  CALL PrintSectionBanner 'TESTAUTH Authorization'
  ADDRESS 'TSO' 'NEWSTACK'
  QUEUE 'END'
  rc = OUTTRAP('out.')
  ADDRESS 'TSO' "TESTAUTH 'SYS1.LINKLIB(ICEPRML)'"
  rc = OUTTRAP('OFF')
  ADDRESS 'TSO' 'DELSTACK'

  IF out.0 == 0 THEN
    SAY 'You ARE authorized to use TESTAUTH <-'
  ELSE
    SAY out.1
RETURN

/*------------------------------------------------------------------*/
/* Enumerate TSO authorized command/program tables                 */
/*------------------------------------------------------------------*/
EnumTsoTables: PROCEDURE EXPOSE (findingsVars)

  CALL PrintSectionBanner 'TSO Authorization Tables'
  cvt = C2X(GetStorage(16, 4))
  tsvt = GetStorageHex(cvt, '9C')
  tpvt = GetStorageHex(tsvt, '4C')
  ctlt = GetStorageHex(tpvt, '14')

  SAY cvt': CVT' tsvt': TSVT' tpvt': TPVT' ctlt': CTLT'

  ctltSize = C2D(GetStorage(X2D(ctlt)+4, 2))

  DO i = 8 TO ctltSize - 5 BY 12
    table = GetStorageHex(ctlt, D2X(i))
    size = C2D(GetStorage(X2D(ctlt)+i+6, 2))
    entries = C2D(GetStorage(X2D(ctlt)+i+8, 2))
    length = C2D(GetStorage(X2D(ctlt)+i+10, 2))
    name = GetStorage(X2D(table), 8)

    SELECT
      WHEN name == 'IKJEFTE2' THEN name = name'/AUTHCMD'
      WHEN name == 'IKJEFTE8' THEN name = name'/AUTHPGM'
      WHEN name == 'IKJEFTNS' THEN name = name'/NOTBKGND'
      WHEN name == 'IKJEFTAP' THEN name = name'/AUTHTSF'
      OTHERWISE name = name'/UNKNOWN'
    END

    /* Determine if we should show this table */
    showTable = 1
    IF assessMode == 0 THEN DO
      /* Not in assess mode - only show AUTHCMD and AUTHTSF (if IDCAMS present) */
      IF POS('AUTHCMD', name) == 0 & POS('AUTHTSF', name) == 0 THEN DO
        showTable = 0
      END
      /* For AUTHTSF, check if IDCAMS is present before showing */
      ELSE IF POS('AUTHTSF', name) > 0 THEN DO
        hasIdcams = 0
        DO j = 2 TO entries
          ent = GetStorage(X2D(table)+(length*j), length)
          IF POS('IDCAMS', ent) > 0 THEN DO
            hasIdcams = 1
            LEAVE
          END
        END
        IF hasIdcams == 0 THEN showTable = 0
      END
    END

    IF showTable == 1 THEN DO
      SAY ''
      SAY name 'ENTRIES:' entries-1
      SAY ''

      output = ''
      idcamsFound = 0
      DO j = 2 TO entries
        ent = GetStorage(X2D(table)+(length*j), length)
        IF ent == ' PARMLIB' THEN ITERATE

        /* Check for IDCAMS in AUTHTSF table */
        IF POS('AUTHTSF', name) > 0 & POS('IDCAMS', ent) > 0 THEN DO
          idcamsFound = 1
        END

        output = output ent

        IF LENGTH(output) > 60 THEN DO
          SAY output
          output = ''
        END
      END

      IF output \== '' THEN SAY output

      /* Add finding if IDCAMS found in AUTHTSF */
      IF idcamsFound == 1 & assessMode == 1 THEN DO
        CALL AddFinding 'TSO-IDCAMS-IN-AUTHTSF'
        CALL AddVerificationCaption 'Using REXX execute the program ENUM',
          'available at http://github.com/mainframed/ and observe that',
          'IDCAMS is present in the IKJEFTAP/AUTHTSF table.'
        CALL AddVerificationContent '(TRUNCATED)/n',
          'IKJEFTAP/AUTHTSF contains IDCAMS/n(TRUNCATED)'
      END
    END
  END
RETURN

/*------------------------------------------------------------------*/
/* Enumerate USS/OMVS users                                         */
/*------------------------------------------------------------------*/
EnumUssUsers: PROCEDURE

  CALL PrintSectionBanner 'z/OS UNIX Users'
  CALL syscalls 'ON'
  ADDRESS syscall

  ucount = 0

  DO FOREVER
    'getpwent pw.'
    IF retval == 0 | retval == -1 THEN LEAVE

    name = STRIP(pw.pw_name)
    uid = STRIP(pw.pw_uid)
    gid = STRIP(pw.pw_gid)
    home = STRIP(pw.pw_dir)
    ucount = ucount + 1
    usr.ucount = LEFT(name, 8) LEFT(gid, 10),
      LEFT(uid, 10) LEFT(home, 48)
    usr.0 = ucount
  END

  SAY 'USS/OMVS user details:'
  SAY COPIES('-', 41)
  SAY LEFT('USER ID', 8) LEFT('GID', 10),
    LEFT('UID', 10) LEFT('HOME', 10)

  DO i = 1 TO usr.0
    SAY usr.i
  END
RETURN

/*------------------------------------------------------------------*/
/* Enumerate RACF SETROPTS settings                                */
/*------------------------------------------------------------------*/
EnumSetropts: PROCEDURE EXPOSE (findingsVars) warningDatasets,
  excessiveUaccDatasets excessiveAccessDatasets
  PARSE ARG rcvt

  cvt = GetPtr(16)
  rcvx = GetPtr(cvt+X2D('3E0'))

  SAY ''
  SAY 'SETROPTS Info:'

  /* UADS dataset */
  rcvtUads = STRIP(GetStorage(rcvt+100, 44))
  SAY ''
  SAY 'UADS Dataset:'
  SAY 'UACC | WARN | ACCESS | DATASET'
  SAY '-----|------|--------|' || COPIES('-', 44)

  /* Check access for UADS dataset - READ access is a finding */
  outputUads = CheckAndReportDatasetAccess(rcvtUads, '', '', 1)
  SAY outputUads

  /* Parse fields for findings */
  PARSE VAR outputUads uadsUacc '|' uadsWarn '|' uadsAccess '|' .
  uadsUacc = STRIP(uadsUacc)
  uadsWarn = STRIP(uadsWarn)
  uadsAccess = STRIP(uadsAccess)

  /* Add findings for UADS dataset */
  IF assessMode == 1 THEN DO
    /* Check for user access to UADS dataset */
    IF uadsAccess \== 'NONE' THEN DO
      CALL AddFinding 'RACF-UADS-DATASET-ACCESS'
      CALL AddVerificationCaption 'Run the REXX script ENUM with the',
        'SEC argument and observe that the testing account has READ or',
        'greater access to the UADS dataset.'
      CALL AddVerificationContent 'UACC | WARN | ACCESS | DATASET'||,
        ' -----|------|--------|---------------------------------'||,
        ' '||outputUads
    END

    /* Check for excessive UACC on UADS dataset */
    IF uadsUacc \== 'NONE' THEN DO
      CALL AddFinding 'RACF-UADS-EXCESSIVE-UACC'
      CALL AddVerificationCaption 'Run the REXX script ENUM with the',
        'SEC argument and observe that the UADS dataset has a UACC',
        'of READ or greater.'
      CALL AddVerificationContent 'UACC | WARN | ACCESS | DATASET'||,
        ' -----|------|--------|---------------------------------'||,
        ' '||outputUads
    END

    /* Check for WARNING mode on UADS dataset */
    IF uadsWarn == 'YES' THEN DO
      CALL AddFinding 'RACF-UADS-WARNING-MODE'
      CALL AddVerificationCaption 'Run the REXX script ENUM with the',
        'SEC argument and observe that the UADS dataset is configured',
        'with WARNING mode enabled.'
      CALL AddVerificationContent 'UACC | WARN | ACCESS | DATASET'||,
        ' -----|------|--------|---------------------------------'||,
        ' '||outputUads
    END
  END
  SAY ''

  /* Get bit flags */
  rcvtPro = rcvx + 393
  rcvtErop = rcvx + 154
  rcvtAuop = rcvx + 151
  rcvtProx = X2B(C2X(GetStorage(rcvtPro, 4)))
  rcvtErox = X2B(C2X(GetStorage(rcvtErop, 4)))
  rcvtAuox = X2B(C2X(GetStorage(rcvtAuop, 8)))

  /* Command violations */
  IF SUBSTR(rcvtErox, 3, 1) == 0 THEN
    SAY 'RACF Command violations are logged'
  ELSE DO
    SAY 'RACF Command violations are not logged'
    IF assessMode == 1 THEN DO
      CALL AddFinding 'RACF-COMMAND-VIOLATIONS-NOT-LOGGED'
      CALL AddVerificationCaption 'Using REXX execute the program ENUM',
        'available at http://github.com/mainframed/ with the argument',
        'SEC and observe that RACF command violations are not logged.'
      CALL AddVerificationContent '(TRUNCATED)/n',
        'RACF Command violations are not logged/n(TRUNCATED)'
    END
  END

  /* PROTECT-ALL */
  IF SUBSTR(rcvtProx, 1, 1) == 1 THEN DO
    SAY 'PROTECT-ALL is on'
    IF SUBSTR(rcvtProx, 2, 1) == 1 THEN DO
      SAY ' PROTECT-ALL WARNING mode'
      IF assessMode == 1 THEN DO
        CALL AddFinding 'RACF-PROTECT-ALL-WARNING-MODE'
        CALL AddVerificationCaption 'Using REXX execute the program ENUM',
          'available at http://github.com/mainframed/ with the argument',
          'SEC and observe that PROTECT-ALL is in WARNING mode.'
        CALL AddVerificationContent '(TRUNCATED)/n',
          'PROTECT-ALL is on/n PROTECT-ALL WARNING mode/n(TRUNCATED)'
      END
    END
    ELSE
      SAY ' PROTECT-ALL FAILURE mode'
  END
  ELSE DO
    SAY 'PROTECT-ALL is off'
    IF assessMode == 1 THEN DO
      CALL AddFinding 'RACF-PROTECT-ALL-DISABLED'
      CALL AddVerificationCaption 'Using REXX execute the program ENUM',
        'available at http://github.com/mainframed/ with the argument',
        'SEC and observe that PROTECT-ALL is disabled.'
      CALL AddVerificationContent '(TRUNCATED)/n',
        'PROTECT-ALL is off/n(TRUNCATED)'
    END
  END

  /* ERASE-ON-SCRATCH */
  IF SUBSTR(rcvtProx, 3, 1) == 1 THEN DO
    SAY 'ERASE-ON-SCRATCH is active, current options:'
    IF SUBSTR(rcvtProx, 4, 1) == 1 THEN
      SAY ' ERASE-ON-SCRATCH BY SECLEVEL is on'
    ELSE
      SAY ' ERASE-ON-SCRATCH BY SECLEVEL is off'
    IF SUBSTR(rcvtProx, 5, 1) == 1 THEN
      SAY ' ERASE-ON-SCRATCH for all datasets is on'
    ELSE
      SAY ' ERASE-ON-SCRATCH for all datasets is off'
  END
  ELSE DO
    SAY 'ERASE-ON-SCRATCH is off'
    IF assessMode == 1 THEN DO
      CALL AddFinding 'RACF-ERASE-ON-SCRATCH-DISABLED'
      CALL AddVerificationCaption 'Using REXX execute the program ENUM',
        'available at http://github.com/mainframed/ with the argument',
        'SEC and observe that ERASE-ON-SCRATCH is disabled.'
      CALL AddVerificationContent '(TRUNCATED)/n',
        'ERASE-ON-SCRATCH is off/n(TRUNCATED)'
    END
  END

  /* Audit settings */
  CALL EnumAuditSettings rcvtAuox, rcvtErox

  /* Password settings */
  CALL EnumPasswordSettings rcvt
RETURN

/*------------------------------------------------------------------*/
/* Enumerate RACF audit settings                                    */
/*------------------------------------------------------------------*/
EnumAuditSettings: PROCEDURE EXPOSE (findingsVars)
  PARSE ARG rcvtAuox, rcvtErox

  IF SUBSTR(rcvtAuox, 2, 1) == 1 THEN
    SAY 'GROUP changes are audited'
  ELSE DO
    SAY 'GROUP changes are not audited'
    IF assessMode == 1 THEN DO
      CALL AddFinding 'RACF-GROUP-CHANGES-NOT-AUDITED'
      CALL AddVerificationCaption 'Using REXX execute the program ENUM',
        'available at http://github.com/mainframed/ with the argument',
        'SEC and observe that RACF GROUP changes are not audited.'
      CALL AddVerificationContent '(TRUNCATED)/n',
        'GROUP changes are not audited/n(TRUNCATED)'
    END
  END

  IF SUBSTR(rcvtAuox, 3, 1) == 1 THEN
    SAY 'USER changes are audited'
  ELSE DO
    SAY 'USER changes are not audited'
    IF assessMode == 1 THEN DO
      CALL AddFinding 'RACF-USER-CHANGES-NOT-AUDITED'
      CALL AddVerificationCaption 'Using REXX execute the program ENUM',
        'available at http://github.com/mainframed/ with the argument',
        'SEC and observe that RACF USER changes are not audited.'
      CALL AddVerificationContent '(TRUNCATED)/n',
        'USER changes are not audited/n(TRUNCATED)'
    END
  END

  IF SUBSTR(rcvtAuox, 4, 1) == 1 THEN
    SAY 'DATASET changes are audited'
  ELSE DO
    SAY 'DATASET changes are not audited'
    IF assessMode == 1 THEN DO
      CALL AddFinding 'RACF-DATASET-CHANGES-NOT-AUDITED'
      CALL AddVerificationCaption 'Using REXX execute the program ENUM',
        'available at http://github.com/mainframed/ with the argument',
        'SEC and observe that RACF DATASET changes are not audited.'
      CALL AddVerificationContent '(TRUNCATED)/n',
        'DATASET changes are not audited/n(TRUNCATED)'
    END
  END

  IF SUBSTR(rcvtAuox, 5, 1) == 1 THEN
    SAY 'DASDVOL changes are audited'
  ELSE DO
    SAY 'DASDVOL changes are not audited'
    IF assessMode == 1 THEN DO
      CALL AddFinding 'RACF-DASDVOL-CHANGES-NOT-AUDITED'
      CALL AddVerificationCaption 'Using REXX execute the program ENUM',
        'available at http://github.com/mainframed/ with the argument',
        'SEC and observe that RACF DASDVOL changes are not audited.'
      CALL AddVerificationContent '(TRUNCATED)/n',
        'DASDVOL changes are not audited/n(TRUNCATED)'
    END
  END

  IF SUBSTR(rcvtAuox, 6, 1) == 1 THEN
    SAY 'TAPEVOL changes are audited'
  ELSE DO
    SAY 'TAPEVOL changes are not audited'
    IF assessMode == 1 THEN DO
      CALL AddFinding 'RACF-TAPEVOL-CHANGES-NOT-AUDITED'
      CALL AddVerificationCaption 'Using REXX execute the program ENUM',
        'available at http://github.com/mainframed/ with the argument',
        'SEC and observe that RACF TAPEVOL changes are not audited.'
      CALL AddVerificationContent '(TRUNCATED)/n',
        'TAPEVOL changes are not audited/n(TRUNCATED)'
    END
  END

  IF SUBSTR(rcvtAuox, 7, 1) == 1 THEN
    SAY 'TERMINAL changes are audited'
  ELSE DO
    SAY 'TERMINAL changes are not audited'
    IF assessMode == 1 THEN DO
      CALL AddFinding 'RACF-TERMINAL-CHANGES-NOT-AUDITED'
      CALL AddVerificationCaption 'Using REXX execute the program ENUM',
        'available at http://github.com/mainframed/ with the argument',
        'SEC and observe that RACF TERMINAL changes are not audited.'
      CALL AddVerificationContent '(TRUNCATED)/n',
        'TERMINAL changes are not audited/n(TRUNCATED)'
    END
  END

  IF SUBSTR(rcvtErox, 4, 1) == 0 THEN
    SAY 'SPECIAL users are audited'
  ELSE DO
    SAY 'SPECIAL users are not audited'
    IF assessMode == 1 THEN DO
      CALL AddFinding 'RACF-SPECIAL-USERS-NOT-AUDITED'
      CALL AddVerificationCaption 'Using REXX execute the program ENUM',
        'available at http://github.com/mainframed/ with the argument',
        'SEC and observe that RACF SPECIAL users are not audited.'
      CALL AddVerificationContent '(TRUNCATED)/n',
        'SPECIAL users are not audited/n(TRUNCATED)'
    END
  END

  IF SUBSTR(rcvtAuox, 8, 1) == 1 THEN
    SAY 'OPERATIONS users are audited'
  ELSE DO
    SAY 'OPERATIONS users are NOT audited'
    IF assessMode == 1 THEN DO
      CALL AddFinding 'RACF-OPERATIONS-USERS-NOT-AUDITED'
      CALL AddVerificationCaption 'Using REXX execute the program ENUM',
        'available at http://github.com/mainframed/ with the argument',
        'SEC and observe that RACF OPERATIONS users are not audited.'
      CALL AddVerificationContent '(TRUNCATED)/n',
        'OPERATIONS users are NOT audited/n(TRUNCATED)'
    END
  END

  SAY ''
RETURN

/*------------------------------------------------------------------*/
/* Enumerate RACF password settings                                */
/*------------------------------------------------------------------*/
EnumPasswordSettings: PROCEDURE EXPOSE (findingsVars)
  PARSE ARG rcvt

  cvt = GetPtr(16)
  rcvx = GetPtr(cvt+X2D('3E0'))

  /* RVARY passwords */
  rcvtSwpw = STRIP(GetStorage(rcvt+440, 8))
  foundSwpw = 0
  foundInpw = 0

  IF C2X(rcvtSwpw) == '0000000000000000' THEN
    SAY 'RVARY SWITCH password is set to default value of YES'
  ELSE DO
    foundSwpw = 1
    SAY 'RVARY SWITCH password DES hash:' C2X(rcvtSwpw)
  END

  rcvtInpw = STRIP(GetStorage(rcvt+448, 8))
  IF C2X(rcvtInpw) == '0000000000000000' THEN
    SAY 'RVARY STATUS password is set to default value of YES'
  ELSE DO
    foundInpw = 1
    SAY 'RVARY STATUS password DES hash:' C2X(rcvtInpw)
  END

  IF foundSwpw == 1 | foundInpw == 1 THEN DO
    SAY 'John the ripper RVARY cracking input:'
    IF foundSwpw == 1 THEN
      SAY 'SWITCH:'||'$rvary$'||C2X(rcvtSwpw)
    IF foundInpw == 1 THEN
      SAY 'STATUS:'||'$rvary$'||C2X(rcvtInpw)
  END
  SAY ''

  /* Password intervals */
  rcvtPinv = C2D(GetStorage(rcvt+155, 1))
  SAY 'Global password change interval:' rcvtPinv 'days'

  rcvtPmin = C2D(GetStorage(rcvt+634, 1))
  SAY 'Minimum password change interval:' rcvtPmin 'days'
  IF rcvtPmin < 1 & assessMode == 1 THEN DO
    CALL AddFinding 'RACF-MIN-PASSWORD-CHANGE-INTERVAL-WEAK'
    CALL AddVerificationCaption 'Using REXX execute the program ENUM',
      'available at http://github.com/mainframed/ with the argument',
      'SEC and observe that the minimum password change interval is less',
      'than 1 day.'
    CALL AddVerificationContent '(TRUNCATED)/n',
      'Minimum password change interval:' rcvtPmin 'days/n(TRUNCATED)'
  END

  /* Password syntax rules */
  CALL EnumPasswordRules rcvt

  /* Password constraints */
  rcvtSlen = C2D(STRIP(GetStorage(rcvt+244, 1)))
  IF rcvtSlen == 0 THEN rcvtSlen = 1
  SAY 'Minimum possible password length:' rcvtSlen
  IF rcvtSlen < 8 & assessMode == 1 THEN DO
    CALL AddFinding 'RACF-MIN-PASSWORD-LENGTH-WEAK'
    CALL AddVerificationCaption 'Using REXX execute the program ENUM',
      'available at http://github.com/mainframed/ with the argument',
      'SEC and observe that the minimum possible password length is less',
      'than 8 characters.'
    CALL AddVerificationContent '(TRUNCATED)/n',
      'Minimum possible password length:' rcvtSlen'/n(TRUNCATED)'
  END

  rcvtElen = C2D(STRIP(GetStorage(rcvt+245, 1)))
  IF rcvtElen == 0 THEN rcvtElen = 8
  SAY 'Maximum possible password length:' rcvtElen

  rcvtRvok = C2D(STRIP(GetStorage(rcvt+241, 1)))
  rcvtRvokNum = rcvtRvok  /* Keep numeric value for comparison */
  IF rcvtRvok == 0 THEN rcvtRvok = 'unlimited'
  SAY 'Invalid logon attempts allowed:' rcvtRvok
  IF (rcvtRvokNum > 5 | rcvtRvokNum == 0) & assessMode == 1 THEN DO
    CALL AddFinding 'RACF-INVALID-LOGON-ATTEMPTS-EXCESSIVE'
    CALL AddVerificationCaption 'Using REXX execute the program ENUM',
      'available at http://github.com/mainframed/ with the argument',
      'SEC and observe that the invalid logon attempts allowed is greater',
      'than 5 or unlimited.'
    CALL AddVerificationContent '(TRUNCATED)/n',
      'Invalid logon attempts allowed:' rcvtRvok'/n(TRUNCATED)'
  END

  rcvtInac = C2D(STRIP(GetStorage(rcvt+243, 1)))
  IF rcvtInac == '0' THEN DO
    SAY 'No inactive interval'
    IF assessMode == 1 THEN DO
      CALL AddFinding 'RACF-NO-INACTIVE-INTERVAL'
      CALL AddVerificationCaption 'Using REXX execute the program ENUM',
        'available at http://github.com/mainframed/ with the argument',
        'SEC and observe that no inactive interval is configured.'
      CALL AddVerificationContent '(TRUNCATED)/n',
        'No inactive interval/n(TRUNCATED)'
    END
  END
  ELSE SAY 'Inactive interval:' rcvtInac 'days'

  rcvtHist = C2D(STRIP(GetStorage(rcvt+240, 1)))
  IF rcvtHist == '0' THEN DO
    SAY 'No password history in use'
    IF assessMode == 1 THEN DO
      CALL AddFinding 'RACF-NO-PASSWORD-HISTORY'
      CALL AddVerificationCaption 'Using REXX execute the program ENUM',
        'available at http://github.com/mainframed/ with the argument',
        'SEC and observe that no password history is configured.'
      CALL AddVerificationContent '(TRUNCATED)/n',
        'No password history in use/n(TRUNCATED)'
    END
  END
  ELSE SAY 'Password history:' rcvtHist 'generations'

  /* Password options */
  CALL EnumPasswordOptions rcvx, rcvt
RETURN

/*------------------------------------------------------------------*/
/* Enumerate RACF password syntax rules                            */
/*------------------------------------------------------------------*/
EnumPasswordRules: PROCEDURE EXPOSE (findingsVars)
  PARSE ARG rcvt

  SAY 'Password syntax rules:'

  hasRules = 0
  DO i = 1 TO 8
    offset = 244 + ((i-1) * 10)
    minLen = GetStorage(rcvt+offset, 1)
    maxLen = GetStorage(rcvt+offset+1, 1)
    rule = STRIP(GetStorage(rcvt+offset+2, 8))

    IF C2X(maxLen) \== '00' THEN DO
      hasRules = 1
      IF C2X(rule) == '0000000000000000' THEN rule = '********'
      SAY ' Rule' i':' rule
      SAY '    Min length:' C2X(minLen)
      SAY '    Max length:' C2X(maxLen)
    END
  END

  IF hasRules == 0 THEN DO
    SAY ' ** No password rules defined! **'
    IF assessMode == 1 THEN DO
      CALL AddFinding 'RACF-NO-PASSWORD-RULES'
      CALL AddVerificationCaption 'Using REXX execute the program ENUM',
        'available at http://github.com/mainframed/ with the argument',
        'SEC and observe that no password syntax rules are defined.'
      CALL AddVerificationContent '(TRUNCATED)/n',
        'Password syntax rules:/n ** No password rules defined! **/n(TRUNCATED)'
    END
  END
  ELSE
    SAY ' LEGEND: A-ALPHA C-CONSONANT L-ALPHANUM N-NUMERIC',
      'V-VOWEL W-NOVOWEL *-ANYTHING c-MIXED CONSONANT',
      'm-MIXED NUMERIC v-MIXED VOWEL $-NATIONAL s-SPECIAL'
RETURN

/*------------------------------------------------------------------*/
/* Enumerate RACF password options and features                    */
/*------------------------------------------------------------------*/
EnumPasswordOptions: PROCEDURE EXPOSE (findingsVars)
  PARSE ARG rcvx, rcvt

  rcvtFlg3 = rcvx + 633
  rcvtFlgx = X2B(C2X(GetStorage(rcvtFlg3, 8)))

  IF SUBSTR(rcvtFlgx, 2, 1) == 1 THEN
    SAY 'Mixed case passwords enabled'
  ELSE DO
    SAY 'Mixed case passwords disabled'
    /* Example: Add finding for mixed case disabled */
    CALL AddFinding 'RACF-MIXED-CASE-DISABLED'
    CALL AddVerificationCaption 'Using REXX execute the program ENUM',
      'available at http://github.com/mainframed/ with the argument',
      'SEC and observe that in RACF mixed case passwords are not enabled.'
    CALL AddVerificationContent '(TRUNCATED)/n',
      'Mixed case passwords disabled/n(TRUNCATED)'

  END

  IF SUBSTR(rcvtFlgx, 5, 1) == 1 THEN
    SAY 'Special characters are allowed in passwords'
  ELSE SAY 'Special characters are not allowed in passwords'

  IF SUBSTR(rcvtFlgx, 6, 1) == 1 THEN
    SAY 'Enhanced password options under OA43999 available'
  ELSE
    SAY 'Enhanced password options under OA43999 not available'

  IF SUBSTR(rcvtFlgx, 7, 1) == 1 THEN
    SAY 'Multi factor auth is available'
  ELSE SAY 'Multi factor auth is not available'

  rcvtFlg4 = rcvx + 640
  rcvtFlgy = X2B(C2X(GetStorage(rcvtFlg4, 8)))

  IF SUBSTR(rcvtFlgy, 2, 1) == 1 THEN
    SAY ' MFA3 is available (OA50930)'
  ELSE SAY ' MFA3 is not available (OA50930)'

  /* Password encryption */
  rcvtPalg = C2D(STRIP(GetStorage(rcvt+635, 1)))
  IF rcvtPalg == '1' THEN SAY 'KDFAES encryption is active'
  ELSE DO
    SAY 'Legacy encryption is active'
    IF assessMode == 1 THEN DO
      CALL AddFinding 'RACF-LEGACY-ENCRYPTION-ACTIVE'
      CALL AddVerificationCaption 'Using REXX execute the program ENUM',
        'available at http://github.com/mainframed/ with the argument',
        'SEC and observe that RACF is using legacy encryption instead of',
        'KDFAES encryption.'
      CALL AddVerificationContent '(TRUNCATED)/n',
        'Legacy encryption is active/n(TRUNCATED)'
    END
  END

  /* Password exit */
  pwx01hex = GetStorage(rcvt+236, 4)
  rcvtPwdx = C2D(BITAND(pwx01hex, '7FFFFFFF'x))

  IF rcvtPwdx == 0 THEN yesOrNo = 'is NOT'
  ELSE yesOrNo = 'IS'

  SAY 'There' yesOrNo 'a new password exit (ICHPWX01)',
    'installed.'
RETURN

/*==================================================================*/
/*                         HELPER FUNCTIONS                         */
/*==================================================================*/

/*------------------------------------------------------------------*/
/* Check dataset access (RACF only)                                */
/* Returns: 'UACC WARNING ACCESS' (e.g., 'NONE NO ALTER')          */
/*          or error message if checks fail                         */
/*------------------------------------------------------------------*/
CheckDatasetAccess: PROCEDURE
  PARSE ARG dataset

  /* First check if we're on RACF */
  cvt = GetPtr(16)
  cvtrac = GetPtr(cvt+992)
  id = GetStorage(cvtrac, 4)

  IF id \== 'RCVT' THEN DO
    RETURN 'ERROR: Not a RACF system'
  END

  /* Check if we can run LISTDSD */
  ADDRESS 'TSO'
  rc = OUTTRAP('checkOut.')
  'LISTDSD'
  rc = OUTTRAP('OFF')

  /* If command not found or not authorized */
  IF checkOut.0 > 0 THEN DO
    DO i = 1 TO checkOut.0
      IF POS('NOT AUTHORIZED', checkOut.i) > 0 |,
         POS('COMMAND NOT FOUND', checkOut.i) > 0 THEN DO
        RETURN 'ERROR: Cannot run LISTDSD command'
      END
    END
  END

  /* Try LISTDSD with the dataset */
  rc = OUTTRAP('out.')
  "LISTDSD da('"||STRIP(dataset)||"')"
  cmdRc = RC
  rc = OUTTRAP('OFF')

  /* Check if we got the "NO RACF DESCRIPTION FOUND" error */
  IF cmdRc \== 0 THEN DO
    foundNoDesc = 0
    DO i = 1 TO out.0
      IF POS('ICH35003I', out.i) > 0 THEN DO
        foundNoDesc = 1
        LEAVE
      END
    END

    /* Try with GENERIC option */
    IF foundNoDesc == 1 THEN DO
      rc = OUTTRAP('out.')
      "LISTDSD da('"||STRIP(dataset)||"') GENERIC"
      cmdRc = RC
      rc = OUTTRAP('OFF')

      /* If still fails, dataset is not RACF protected */
      IF cmdRc \== 0 THEN DO
        RETURN 'ERROR: Dataset not RACF protected'
      END
    END
    ELSE DO
      /* Different error */
      RETURN 'ERROR: LISTDSD command failed'
    END
  END

  /* Parse the output */
  uacc = ''
  warning = ''
  access = ''

  DO i = 1 TO out.0
    /* Look for the LEVEL line with UNIVERSAL ACCESS and WARNING */
    IF POS('UNIVERSAL ACCESS', out.i) > 0 THEN DO
      /* Next line should have the actual values */
      IF i < out.0 THEN DO
        n = i + 2
        nextLine = out.n
        /* Parse: " 00    PHIL            NONE          NO      NO" */
        PARSE VAR nextLine . . uacc warning .
        uacc = STRIP(uacc)
        warning = STRIP(warning)
      END
    END

    /* Look for YOUR ACCESS line */
    IF POS('YOUR ACCESS', out.i) > 0 THEN DO
      /* Next line should have the access value */
      IF i < out.0 THEN DO
        n = i + 2
        nextLine = out.n
        /* Parse: "   ALTER        SYS1           NON-VSAM" */
        PARSE VAR nextLine access .
        access = STRIP(access)
      END
    END
  END

  /* Validate we found all values */
  IF uacc == '' | warning == '' | access == '' THEN DO
    RETURN 'ERROR: Could not parse LISTDSD output'
  END

RETURN uacc || ' ' || warning || ' ' || access

/*------------------------------------------------------------------*/
/* Check dataset access and track findings                          */
/* Returns: formatted output string for display                     */
/* Side effects: Updates warningDatasets, excessiveUaccDatasets,    */
/*               and excessiveAccessDatasets variables              */
/* Parameters:                                                      */
/*   dataset - Dataset name to check                               */
/*   volume  - Volume name for display                             */
/*   missing - Missing status for display                          */
/*   checkRead - If 1, READ access is also a finding (default 0)   */
/*------------------------------------------------------------------*/
CheckAndReportDatasetAccess: PROCEDURE EXPOSE warningDatasets,
  excessiveUaccDatasets excessiveAccessDatasets
  PARSE ARG dataset, volume, missing, checkRead

  /* Default checkRead to 0 if not specified */
  IF checkRead == '' THEN checkRead = 0

  accessInfo = CheckDatasetAccess(STRIP(dataset))

  IF POS('ERROR:', accessInfo) == 0 THEN DO
    /* Parse the result: 'UACC WARNING ACCESS' */
    PARSE VAR accessInfo uacc warning access
    uaccDisp = LEFT(uacc, 4)
    warnDisp = LEFT(warning, 4)
    accessDisp = LEFT(access, 6)

    /* If volume/missing are empty, use simplified format */
    IF volume == '' & missing == '' THEN DO
      output = uaccDisp '|' warnDisp '|' accessDisp '|' STRIP(dataset)
    END
    ELSE DO
      output = LEFT(STRIP(volume),6) '|' STRIP(LEFT(missing,6)),
        '|' uaccDisp '|' warnDisp '|' accessDisp '|' STRIP(dataset)
    END

    /* Track findings */
    dsName = STRIP(dataset)

    /* Check for WARNING mode */
    IF warning == 'YES' THEN DO
      IF warningDatasets == '' THEN
        warningDatasets = ' ' || dsName
      ELSE
        warningDatasets = warningDatasets || ', ' || dsName
    END

    /* Check for excessive UACC - always check UPDATE/CONTROL/ALTER */
    /* For sensitive datasets (checkRead=1), also check READ */
    IF uacc == 'UPDATE' | uacc == 'CONTROL' | uacc == 'ALTER' THEN DO
      IF excessiveUaccDatasets == '' THEN
        excessiveUaccDatasets = ' ' || dsName
      ELSE
        excessiveUaccDatasets = excessiveUaccDatasets || ', ' || dsName
    END
    ELSE IF checkRead == 1 & uacc == 'READ' THEN DO
      IF excessiveUaccDatasets == '' THEN
        excessiveUaccDatasets = ' ' || dsName
      ELSE
        excessiveUaccDatasets = excessiveUaccDatasets || ', ' || dsName
    END

    /* Check for excessive user access */
    IF access == 'UPDATE' | access == 'CONTROL' | access == 'ALTER' THEN DO
      IF excessiveAccessDatasets == '' THEN
        excessiveAccessDatasets = ' ' || dsName
      ELSE
        excessiveAccessDatasets = excessiveAccessDatasets || ', ' || dsName
    END
    ELSE IF checkRead == 1 & access == 'READ' THEN DO
      IF excessiveAccessDatasets == '' THEN
        excessiveAccessDatasets = ' ' || dsName
      ELSE
        excessiveAccessDatasets = excessiveAccessDatasets || ', ' || dsName
    END
  END
  ELSE DO
    /* Error occurred, display placeholder */
    IF volume == '' & missing == '' THEN DO
      output = ' ??  |  ??  |   ??   |' STRIP(dataset)
    END
    ELSE DO
      output = LEFT(STRIP(volume),6) '|' STRIP(LEFT(missing,6)),
        '|  ??  |  ??  |   ??   |' STRIP(dataset)
    END
  END

RETURN output

/*------------------------------------------------------------------*/
/* Get LPAR name (SMFID) from system                               */
/*------------------------------------------------------------------*/
GetLparName: PROCEDURE

  lparName = MVSVAR("SYSNAME")  /* LPAR name */

RETURN lparName

/*------------------------------------------------------------------*/
/* Get pointer from storage                                         */
/*------------------------------------------------------------------*/
GetPtr: PROCEDURE
  PARSE ARG addr
RETURN C2D(STORAGE(D2X(addr), 4))

/*------------------------------------------------------------------*/
/* Get storage at address                                           */
/*------------------------------------------------------------------*/
GetStorage: PROCEDURE
  PARSE ARG addr, len
RETURN STORAGE(D2X(addr), len)

/*------------------------------------------------------------------*/
/* Get storage using hex address                                    */
/*------------------------------------------------------------------*/
GetStorageHex: PROCEDURE
  PARSE ARG addr, disp
RETURN C2X(STORAGE(D2X(X2D(addr)+X2D(disp)), 4))

/*------------------------------------------------------------------*/
/* Get userid from ASCB                                             */
/*------------------------------------------------------------------*/
GetUserid: PROCEDURE
  PARSE ARG ascb

  assb = GetPtr(ascb+336)
  jsab = GetPtr(assb+168)

  IF jsab == 0 THEN usid = ''
  ELSE usid = GetStorage(jsab+44, 8)

RETURN usid

/*------------------------------------------------------------------*/
/* Add element to array                                             */
/*------------------------------------------------------------------*/
AddToArray: PROCEDURE EXPOSE (globalVars)
  PARSE ARG arrayName, value

  INTERPRET 'idx = ' || arrayName || '.0 + 1'
  INTERPRET arrayName || '.' || idx || ' = value'
  INTERPRET arrayName || '.0 = idx'
RETURN

/*------------------------------------------------------------------*/
/* Convert SWA Virtual Address to 31-bit address                    */
/* Credit: Gilbert Saint-Flour                                      */
/*------------------------------------------------------------------*/
Swareq: PROCEDURE
  sva = C2D(ARG(1))
  tcb = C2D(STORAGE('21C', 4))
  jscb = GetPtr(tcb+180)
  qmpl = GetPtr(jscb+244)

  /* Check if QMAT can be above the bar */
  qmsta = C2X(GetStorage(qmpl+16, 1))

  IF SUBSTR(X2B(qmsta), 6, 1) THEN DO
    /* QMAT can be ATB */
    IF RIGHT(X2B(C2X(ARG(1))), 1) \== '1' THEN
      RETURN C2D(ARG(1)) + 16

    qmat = C2D(GetStorage(qmpl+10, 2)) * (2**48) +,
      C2D(GetStorage(qmpl+18, 2)) * (2**32) +,
      GetPtr(qmpl+24)

    RETURN GetPtr(qmat+(sva*12)+64) + 16
  END
  ELSE DO
    /* QMAT is BTB */
    IF RIGHT(C2X(ARG(1)), 1) \== 'F' THEN
      RETURN C2D(ARG(1)) + 16

    qmat = GetPtr(qmpl+24)

    DO WHILE sva > 65536
      qmat = GetPtr(qmat+12)
      sva = sva - 65536
    END

    RETURN GetPtr(qmat+sva+1) + 16
  END

/*------------------------------------------------------------------*/
/* Print section separator                                          */
/*------------------------------------------------------------------*/
PrintSeparator: PROCEDURE
  SAY COPIES('-', 72)
  SAY ''
RETURN

/*------------------------------------------------------------------*/
/* Print section banner with header                                 */
/*------------------------------------------------------------------*/
PrintSectionBanner: PROCEDURE
  PARSE ARG sectionTitle

  SAY ''
  SAY '$$$$$$$$$$$$$$$$$$$$$$$$$'
  SAY '$$Y'''
  SAY '$$'
  SAY '$$' sectionTitle
  SAY '$$'
  SAY '$$b.'
  SAY '$$$$$$$$$$$$$$$$$$$$$$$$$'
  SAY ''
RETURN

/*------------------------------------------------------------------*/
/* Print banner text                                                */
/*------------------------------------------------------------------*/
PrintBanner: PROCEDURE
  PARSE ARG text
  SAY text
RETURN

/*==================================================================*/
/*              ASSESSMENT MODE FUNCTIONS (OSS VERSION)             */
/*==================================================================*/
/*                                                                  */
/* NOTE: This open source version contains simplified examples of  */
/* the assessment mode functions. The actual implementation would   */
/* track and report real security findings discovered during the    */
/* enumeration process.                                             */
/*                                                                  */
/* Example usage pattern for adding findings:                       */
/*                                                                  */
/* 1. Add EXPOSE clause to your enumeration procedure:              */
/*    PROCEDURE EXPOSE (findingsVars)                               */
/*                                                                  */
/* 2. When a security issue is detected, call:                      */
/*    CALL AddFinding 'FINDING-TEMPLATE-ID'                         */
/*    CALL AddVerificationCaption 'Title for verification step'     */
/*    CALL AddVerificationContent 'Detailed evidence and steps'     */
/*                                                                  */
/* 3. You can add multiple verification steps per finding           */
/*==================================================================*/

/*------------------------------------------------------------------*/
/* Add a finding to the assessment results                          */
/*------------------------------------------------------------------*/
AddFinding: PROCEDURE EXPOSE (findingsVars)
  IF assessMode == 0 THEN RETURN  /* Only add findings in assess mode */

  PARSE ARG templateId

  idx = findings.0 + 1
  findingtemplate.idx = templateId
  verificationcaption.idx = ''
  verificationsteps.idx = ''

  findings.0 = idx
  findingtemplate.0 = idx
  verificationcaption.0 = idx
  verificationsteps.0 = idx
RETURN

/*------------------------------------------------------------------*/
/* Add verification caption to the most recent finding              */
/* This is the title/heading for the verification step             */
/*------------------------------------------------------------------*/
AddVerificationCaption: PROCEDURE EXPOSE (findingsVars)
  IF findings.0 == 0 THEN RETURN  /* No findings to add to */

  PARSE ARG caption

  idx = findings.0  /* Get most recent finding */

  /* Append to caption (first one has no delimiter prefix) */
  IF verificationcaption.idx == '' THEN
    verificationcaption.idx = caption
  ELSE
    verificationcaption.idx = verificationcaption.idx||VSTEP_DELIM||caption
RETURN

/*------------------------------------------------------------------*/
/* Add verification content to the most recent finding              */
/* This is the detailed content for the verification step           */
/* Must be called after AddVerificationCaption                      */
/*------------------------------------------------------------------*/
AddVerificationContent: PROCEDURE EXPOSE (findingsVars)
  IF findings.0 == 0 THEN RETURN  /* No findings to add to */

  PARSE ARG content

  idx = findings.0  /* Get most recent finding */

  /* Append to steps (first one has no delimiter prefix) */
  IF verificationsteps.idx == '' THEN
    verificationsteps.idx = content
  ELSE
    verificationsteps.idx = verificationsteps.idx||VSTEP_DELIM||content
RETURN

/*------------------------------------------------------------------*/
/* Output assessment results                                        */
/*------------------------------------------------------------------*/
OutputAssessmentJSON: PROCEDURE EXPOSE (findingsVars)

  CALL PrintSectionBanner 'Assessment Findings'

  DO i = 1 TO findings.0
    templateId = findingtemplate.i

    /* Parse verification captions and steps */
    captions = verificationcaption.i
    steps = verificationsteps.i

    SAY ''
    SAY 'Finding' i||':' templateId
    SAY COPIES('-', 60)

    /* Parse and output verification steps */
    IF captions \== '' THEN DO
      captionPos = 1
      stepPos = 1

      DO WHILE captionPos > 0
        /* Find next delimiter position */
        nextCaptionDelim = POS(VSTEP_DELIM, captions, captionPos)
        nextStepDelim = POS(VSTEP_DELIM, steps, stepPos)

        /* Extract caption */
        IF nextCaptionDelim > 0 THEN DO
          vCaption = SUBSTR(captions, captionPos,,
            nextCaptionDelim - captionPos)
          captionPos = nextCaptionDelim + LENGTH(VSTEP_DELIM)
        END
        ELSE DO
          vCaption = SUBSTR(captions, captionPos)
          captionPos = 0  /* Signal end */
        END

        /* Extract step */
        IF nextStepDelim > 0 THEN DO
          vContent = SUBSTR(steps, stepPos, nextStepDelim - stepPos)
          stepPos = nextStepDelim + LENGTH(VSTEP_DELIM)
        END
        ELSE DO
          vContent = SUBSTR(steps, stepPos)
          stepPos = 0
        END

        /* Output verification caption and content */
        SAY vCaption
        SAY vContent
        SAY ''
      END
    END
  END
RETURN

/*------------------------------------------------------------------*/
/* Escape special characters for JSON strings                       */
/*------------------------------------------------------------------*/
JsonEscape: PROCEDURE
  PARSE ARG text

  /* Replace backslash first */
  text = ReplaceStr(text, '\', '\\')
  /* Replace double quotes */
  text = ReplaceStr(text, '"', '\"')

RETURN text

/*------------------------------------------------------------------*/
/* Return placeholder for open curly brace                         */
/*------------------------------------------------------------------*/
OpenCurly: PROCEDURE
RETURN '<<LC>>'

/*------------------------------------------------------------------*/
/* Return placeholder for close curly brace                        */
/*------------------------------------------------------------------*/
CloseCurly: PROCEDURE
RETURN '<<RC>>'

/*------------------------------------------------------------------*/
/* Return placeholder for open square bracket                      */
/*------------------------------------------------------------------*/
OpenSquare: PROCEDURE
RETURN '<<LB>>'

/*------------------------------------------------------------------*/
/* Return placeholder for close square bracket                     */
/*------------------------------------------------------------------*/
CloseSquare: PROCEDURE
RETURN '<<RB>>'

/*------------------------------------------------------------------*/
/* Replace all occurrences of a string                              */
/*------------------------------------------------------------------*/
ReplaceStr: PROCEDURE
  PARSE ARG text, old, new

  DO WHILE POS(old, text) > 0
    p = POS(old, text)
    text = SUBSTR(text, 1, p-1) || new ||,
      SUBSTR(text, p+LENGTH(old))
  END

RETURN text