o
    Žõ±j†  ã                   @   s‚   d dl Z d dlZd dlmZ d dlZd dlT d dlmZ d dlm	Z	 G dd„ dƒZ
edkr?e d	¡Ze
 e¡Zeeeƒƒ dS dS )
é    N)Úsha1)Ú*)ÚGUID)Úunpadc                   @   s>   e Zd Zdd„ Zedd„ ƒZedd„ ƒZddd	„Zd
d„ ZdS )Ú
DPAPI_BLOBc                 C   sv   d | _ d | _d | _d | _d | _d | _d | _d | _d | _d | _	d | _
d | _d | _d | _d | _d | _d | _d | _d | _d S ©N)ÚversionÚcredential_guidÚmasterkey_versionÚmasterkey_guidÚflagsÚdescription_lengthÚdescriptionÚcrypto_algorithmÚcrypto_algorithm_lengthÚsalt_lengthÚsaltÚHMAC_key_lengthÚHMAC_keyÚhash_algorithmÚHMACÚdata_lengthÚdataÚsignature_lengthÚ	signature)Úself© r   ú‘/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/dpapi/structures/blob.pyÚ__init__   s&   
zDPAPI_BLOB.__init__c                 C   s   t  t | ¡¡S r   )r   Úfrom_bufferÚioÚBytesIO)r   r   r   r   Ú
from_bytes)   s   zDPAPI_BLOB.from_bytesc                 C   sæ  t ƒ }tj|  d¡ddd�|_|  d¡|_|  ¡ }tj|  d¡ddd�|_t| ƒj	|_
ttj|  d¡ddd�ƒ|_tj|  d¡ddd�|_|  |j¡|_ttj|  d¡ddd�ƒ|_tj|  d¡ddd�|_tj|  d¡ddd�|_|  |j¡|_tj|  d¡ddd�|_|  |j¡|_ttj|  d¡ddd�ƒ|_tj|  d¡ddd�|_tj|  d¡ddd�|_|  |j¡|_tj|  d¡ddd�|_|  |j¡|_|  ¡ }|  |d¡ |  || ¡|_tj|  d¡ddd�|_|  |j¡|_|S )Né   ÚlittleF)Úsignedé   r   ) r   Úintr"   Úreadr   r	   Útellr
   r   Úvaluer   ÚFLAGSr   r   r   Ú
ALGORITHMSr   r   r   r   r   r   r   Úhash_algorithm_lengthÚHMAC_lengthr   r   r   ÚseekÚto_signr   r   )ÚbuffÚskÚsignature_start_posÚsignature_end_posr   r   r   r   -   s6   zDPAPI_BLOB.from_bufferNc                 C   s¤  dd„ }t |ƒ ¡ }t || jt| j d ¡}|d ur | |¡ | ¡ }t|ƒt| j d kr>tj|t| j d d� ¡ }n|}t|ƒt| j	 d k r˜|dt| j d  7 }t
dd	„ t
|ƒD ƒd t| j d … ƒ}t
d
d	„ t
|ƒD ƒd t| j d … ƒ}	t| j d |ƒ ¡ t| j d |	ƒ ¡  }||ƒ}t| j	 d |d t| j	 d … t| j	 d dt| j	 d  d�}
t|
 | j¡t| j	 d ƒ}t| j d }|d|  }t
dd	„ t
|ƒD ƒd |… ƒ}t
dd	„ t
|ƒD ƒd |… ƒ}	t| j d |ƒ}| | j¡ t| j d |	ƒ}| | ¡ ¡ |d u�r| |¡ | | j¡ t || jt| j d ¡}|d u�r8| |¡ | | j¡ | ¡ | jk�sN| ¡ | jk�rP|S d S )Nc                 S   s–   d}t t| ƒƒD ]@}t| | ƒdd …  dd¡}|d d…  d¡d dkr7|t|d d… d dƒ dd	¡7 }q|t|d d… d dƒ dd	¡7 }q|S )
Nó    é   é   Ú0é   Ú1r   é   Úbig)ÚrangeÚlenÚbinÚrjustÚcountr'   Úto_bytes)ÚdeskeyÚtempÚiÚtr   r   r   Ú	fixparityL   s   $$z%DPAPI_BLOB.decrypt.<locals>.fixparityr;   r#   )Ú	digestmodr   ó    c                 S   ó   g | ]}|d A ‘qS ©é6   r   ©Ú.0rE   r   r   r   Ú
<listcomp>e   ó    z&DPAPI_BLOB.decrypt.<locals>.<listcomp>c                 S   rJ   ©é\   r   rM   r   r   r   rO   f   rP   r6   é   )ÚmodeÚIVc                 S   rJ   rK   r   rM   r   r   r   rO   r   rP   c                 S   rJ   rQ   r   rM   r   r   r   rO   s   rP   )r   ÚdigestÚhmacÚnewr   ÚALGORITHMS_DATAr   Úupdater>   r   Ú	bytearrayr   Údecryptr   r   r0   r   )r   ÚkeyÚentropyrG   Úkey_hashÚsession_key_ctxÚsession_keyÚderived_keyÚipadÚopadÚcipherÚ	cleartextÚhash_block_sizeÚ
key_hash_2ÚaÚhmac_calculated_1Úhmac_calculated_3r   r   r   r\   K   sN   

((ÿ ÿ



 zDPAPI_BLOB.decryptc                 C   sn   d}| j D ]/}t| j | tƒr't| j | ƒD ]\}}|d||t|ƒf 7 }qq|d|t| j | ƒf 7 }q|S )Nz== DPAPI_BLOB ==
z   %s: %s: %sz	%s: %s 
)Ú__dict__Ú
isinstanceÚlistÚ	enumerateÚstr)r   rF   ÚkrE   Úitemr   r   r   Ú__str__’   s   
ÿzDPAPI_BLOB.__str__r   )	Ú__name__Ú
__module__Ú__qualname__r   Ústaticmethodr"   r   r\   rs   r   r   r   r   r      s    


Gr   Ú__main__Á4  01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dc64974c99aa6c43bb30ff39b3dd407c0000000002000000000003660000c000000010000000f1af675a51c8283cf81abb6fb600110f0000000004800000a0000000100000009bf4e56d6c32dd59bce655496a94444c1000000088438c8f61d966ac220b4ca50933c8ee14000000314eaa780e358e70c586fb47bee0e27549be480e)r    ÚenumÚhashlibr   rW   Úpypykatz.dpapi.constantsÚpypykatz.commons.win_datatypesr   Ú%unicrypto.backends.pure.padding.pkcs7r   r   rt   ÚbytesÚfromhexr   r"   ÚdbÚprintrp   r   r   r   r   Ú<module>   s    


ý