o
    Žõ±jÌ$  ã                   @   sœ   d dl Z d dlZd dlmZ d dlmZ G dd„ dƒZG dd„ dƒZG dd	„ d	ƒZG d
d„ dƒZ	G dd„ dƒZ
G dd„ dƒZG dd„ dƒZG dd„ dƒZdS )é    N)ÚGUID)Ú
DPAPI_BLOBc                   @   ó4   e Zd Zdd„ Zedd„ ƒZedd„ ƒZdd„ Zd	S )
ÚVAULT_ATTRIBUTE_MAP_ENTRYc                 C   s   d | _ d | _d | _d S ©N)ÚidÚoffsetÚunk0©Úself© r   ú’/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/dpapi/structures/vault.pyÚ__init__   s   
z"VAULT_ATTRIBUTE_MAP_ENTRY.__init__c                 C   ó   t  t | ¡¡S r   )r   Úfrom_bufferÚioÚBytesIO©Údatar   r   r   Ú
from_bytes   ó   z$VAULT_ATTRIBUTE_MAP_ENTRY.from_bytesc                 C   sR   t ƒ }tj|  d¡ddd�|_tj|  d¡ddd�|_tj|  d¡ddd�|_|S ©Né   ÚlittleF©Úsigned)r   Úintr   Úreadr   r   r	   ©ÚbuffÚskr   r   r   r      s
   z%VAULT_ATTRIBUTE_MAP_ENTRY.from_bufferc                 C   ón   d}| j D ]/}t| j | tƒr't| j | ƒD ]\}}|d||t|ƒf 7 }qq|d|t| j | ƒf 7 }q|S )Nz!== VAULT_ATTRIBUTE_MAP_ENTRY ==
ú   %s: %s: %sú	%s: %s 
©Ú__dict__Ú
isinstanceÚlistÚ	enumerateÚstr©r   ÚtÚkÚiÚitemr   r   r   Ú__str__   ó   
ÿz!VAULT_ATTRIBUTE_MAP_ENTRY.__str__N©Ú__name__Ú
__module__Ú__qualname__r   Ústaticmethodr   r   r/   r   r   r   r   r      s    

r   c                   @   r   )
ÚVAULT_ATTRIBUTEc                 C   óF   d | _ d | _d | _d | _d | _d | _d | _d | _d | _d | _	d | _
d S r   )r   r	   Úunk1Úunk2ÚpaddingÚunk3ÚsizeÚ
iv_presentÚiv_sizeÚivr   r
   r   r   r   r   )   s   
zVAULT_ATTRIBUTE.__init__c                 C   r   r   )r6   r   r   r   r   r   r   r   r   8   r   zVAULT_ATTRIBUTE.from_bytesc                 C   s|  |   ¡ }|  dd¡ |   ¡ | }|  |d¡ tƒ }tj|  d¡ddd�|_tj|  d¡ddd�|_tj|  d¡ddd�|_tj|  d¡ddd�|_	|dkru|   ¡ }|  d	¡}|d
kr^||_
n|  |d¡ |jdkrutj|  d¡ddd�|_|dkr¼tj|  d¡ddd�|_t|  d¡d ƒ|_|jr³tj|  d¡ddd�|_|  |j¡|_|  |j|jd  ¡|_|S |  |jd ¡|_|S )Néÿÿÿÿé   r   r   r   Fr   é   é   s         éd   é   é   é   )ÚtellÚseekr6   r   r   r   r   r	   r8   r9   r:   r;   r<   Úboolr=   r>   r?   r   )r   Úposr<   r    Útestr   r   r   r   <   s6   

þzVAULT_ATTRIBUTE.from_bufferc                 C   r!   )Nz== VAULT_ATTRIBUTE ==
r"   r#   r$   r*   r   r   r   r/   `   r0   zVAULT_ATTRIBUTE.__str__Nr1   r   r   r   r   r6   (   s    

#r6   c                   @   s8   e Zd ZdZdd„ Zedd„ ƒZedd„ ƒZdd	„ Zd
S )Ú
VAULT_VCRDz
	c                 C   sF   d | _ d | _d | _d | _d | _d | _d | _d | _d | _g | _	g | _
d S r   )Úschema_guidr	   Úlast_writtenr8   r9   Úfriendlyname_lengthÚfriendlynameÚattribute_maps_lengthÚattribute_mapsÚvamesÚ
attributesr
   r   r   r   r   n   s   
zVAULT_VCRD.__init__c                 C   r   r   )rM   r   r   r   r   r   r   r   r   |   r   zVAULT_VCRD.from_bytesc                 C   s´  t ƒ }t| ƒj|_tj|  d¡ddd�|_tj|  d¡ddd�|_tj|  d¡ddd�|_	tj|  d¡ddd�|_
tj|  d¡ddd�|_|  |j¡|_|jdkr_z	|j d¡|_W n   Y tj|  d¡ddd�|_|  |j¡|_g |_t |j¡}t|jd ƒD ]}t |¡}|j |¡ q‚d}|t|jƒd	 k rÍ|  |j| j¡ |  |j|d	  j|j| j ¡}t |¡}|j |¡ |d	7 }|t|jƒd	 k s›t | ¡}|j |¡ |S )
Nr   r   Fr   é   r   z	utf-16-leé   rF   )rM   r   ÚvaluerN   r   r   r   r	   rO   r8   r9   rP   rQ   ÚdecoderR   rS   rU   r   r   Úranger   r   rT   ÚappendÚlenrI   r   r6   )r   r    ÚdbÚ_Úvamer-   r   Úvar   r   r   r   €   s>   

"
û
zVAULT_VCRD.from_bufferc                 C   r!   )Nz== VAULT_VCRD ==
r"   r#   r$   r*   r   r   r   r/   ¤   r0   zVAULT_VCRD.__str__N)	r2   r3   r4   Ú__doc__r   r5   r   r   r/   r   r   r   r   rM   k   s    

#rM   c                   @   r   )
Ú
VAULT_VPOLc                 C   r7   r   )ÚversionÚguidÚdescription_lengthÚdescriptionr	   r<   Úguid2Úguid3Úkey_sizeÚblobÚblobdatar
   r   r   r   r   ¯   s   
zVAULT_VPOL.__init__c                 C   r   r   )rb   r   r   r   r   r   r   r   r   ¼   r   zVAULT_VPOL.from_bytesc                 C   sÄ   t ƒ }tj|  d¡ddd�|_t| ƒj|_tj|  d¡ddd�|_|  |j¡|_	|  d¡|_
tj|  d¡ddd�|_t| ƒj|_t| ƒj|_tj|  d¡ddd�|_|  |j¡|_t |j¡|_|S )Nr   r   Fr   rW   )rb   r   r   r   rc   r   rX   rd   re   rf   r	   r<   rg   rh   ri   rk   r   rj   r   r   r   r   r   À   s   zVAULT_VPOL.from_bufferc                 C   r!   )Nz== VAULT_VPOL ==
r"   r#   r$   r*   r   r   r   r/   Ñ   r0   zVAULT_VPOL.__str__Nr1   r   r   r   r   rb   ®   s    

rb   c                   @   r   )
ÚVAULT_VPOL_KEYSc                 C   s   d | _ d | _d S r   )Úkey1Úkey2r
   r   r   r   r   Ü   s   
zVAULT_VPOL_KEYS.__init__c                 C   r   r   )rl   r   r   r   r   r   r   r   r   à   r   zVAULT_VPOL_KEYS.from_bytesc                 C   sx   t ƒ }g }tdƒD ]&}|  d¡}|  dd¡ |dks|dkr'| t | ¡¡ q	| t | ¡¡ q	|d |_|d |_	|S )NrA   rF   r@   ó   $ó   4r   )
rl   rZ   r   rI   r[   ÚKDBMr   ÚKSSMrm   rn   )r   r    Úresr^   rL   r   r   r   r   ä   s   


zVAULT_VPOL_KEYS.from_bufferc                 C   r!   )Nz== VAULT_VPOL_KEYS ==
r"   r#   r$   r*   r   r   r   r/   ó   r0   zVAULT_VPOL_KEYS.__str__Nr1   r   r   r   r   rl   Û   s    

rl   c                   @   ó<   e Zd Zdd„ Zdd„ Zedd„ ƒZedd„ ƒZd	d
„ ZdS )rq   c                 C   ó   d | _ d | _d | _d | _d S r   ©r<   rc   r	   Úkeyblobr
   r   r   r   r   þ   ó   
zKDBM.__init__c                 C   s   | j jS r   )rw   Úkeyr
   r   r   r   Úget_key  s   zKDBM.get_keyc                 C   r   r   )rq   r   r   r   r   r   r   r   r     r   zKDBM.from_bytesc                 C   sv   ddl m} tƒ }tj|  d¡ddd�|_tj|  d¡ddd�|_tj|  d¡ddd�|_t	 |  |jd ¡¡|_
|S )Nr   )Úhexdumpr   r   Fr   rV   )Úpypykatz.commons.commonr{   rq   r   r   r   r<   rc   r	   ÚBCRYPT_KEY_DATA_BLOB_HEADERrw   )r   r{   r    r   r   r   r     s   zKDBM.from_bufferc                 C   r!   )Nz== KDBM ==
r"   r#   r$   r*   r   r   r   r/     r0   zKDBM.__str__N©	r2   r3   r4   r   rz   r5   r   r   r/   r   r   r   r   rq   ý   ó    

	rq   c                   @   rt   )rr   c                 C   ru   r   rv   r
   r   r   r   r      rx   zKSSM.__init__c                 C   s   | j S r   )rw   r
   r   r   r   rz   &  s   zKSSM.get_keyc                 C   r   r   )rr   r   r   r   r   r   r   r   r   )  r   zKSSM.from_bytesc                 C   sd   t ƒ }tj|  d¡ddd�|_tj|  d¡ddd�|_tj|  d¡ddd�|_|  |jd ¡|_|S )Nr   r   Fr   rV   )rr   r   r   r   r<   rc   r	   rw   r   r   r   r   r   -  s   zKSSM.from_bufferc                 C   r!   )Nz== KSSM ==
r"   r#   r$   r*   r   r   r   r/   7  r0   zKSSM.__str__Nr~   r   r   r   r   rr     r   rr   c                   @   r   )
r}   c                 C   ru   r   )Úmagicrc   Úkey_datary   r
   r   r   r   r   B  rx   z$BCRYPT_KEY_DATA_BLOB_HEADER.__init__c                 C   r   r   )r}   r   r   r   r   r   r   r   r   H  r   z&BCRYPT_KEY_DATA_BLOB_HEADER.from_bytesc                 C   s`   t ƒ }tj|  d¡ddd�|_tj|  d¡ddd�|_tj|  d¡ddd�|_|  |j¡|_|S r   )r}   r   r   r   r€   rc   r�   ry   r   r   r   r   r   L  s   z'BCRYPT_KEY_DATA_BLOB_HEADER.from_bufferc                 C   r!   )Nz#== BCRYPT_KEY_DATA_BLOB_HEADER ==
r"   r#   r$   r*   r   r   r   r/   V  r0   z#BCRYPT_KEY_DATA_BLOB_HEADER.__str__Nr1   r   r   r   r   r}   A  s    

	r}   )r   ÚenumÚpypykatz.commons.win_datatypesr   Úpypykatz.dpapi.structures.blobr   r   r6   rM   rb   rl   rq   rr   r}   r   r   r   r   Ú<module>   s   CC-"""