o
    j                     @   s   d dl mZ d dlmZmZ d dlmZ G dd deZG dd dZG dd	 d	Z	G d
d deZ
G dd deZG dd deZdde ide idiZdS )    )POINTER)KatzSystemArchitectureWindowsMinBuild)PackageTemplatec                   @   s,   e Zd Zdd Zedd Zedd ZdS )LsaTemplate_NT5c                 C   s"   d | _ d | _d | _d | _d | _d S N)	signaturefeedbackrandomkey_ptrDESXKey_ptr
key_structself r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/lsadecryptor/lsa_template_nt5.py__init__   s
   
zLsaTemplate_NT5.__init__c                 C   s   t d)Nz+Template guessing is not applicable for NT5)	Exceptionsysinfor   r   r   get_template_brute   s   z"LsaTemplate_NT5.get_template_brutec                 C   sh   | j tjkr| jtjjkrtd d d S td| j tj	kr2| jtjjkr.td d d S tdd S )Nnt5x861zNT 6 is in another castle!x64)
architecturer   X86buildnumberr   	WIN_VISTAvalue	templatesr   X64r   r   r   r   get_template   s   zLsaTemplate_NT5.get_templateN)__name__
__module____qualname__r   staticmethodr   r!   r   r   r   r   r      s    
r   c                   @      e Zd Zdd Zdd ZdS )SYMCRYPT_NT5_DES_EXPANDED_KEYc                 C   sT   g | _ tdD ] }tj|dddd}tj|dddd}| j ||g qd S )N      littleF)signed)roundKeyrangeint
from_bytesreadappend)r   reader_rlr   r   r   r   (   s   z&SYMCRYPT_NT5_DES_EXPANDED_KEY.__init__c                 C   s>   d}t | jD ]\}}|d|t|d t|d f 7 }q|S )NzSYMCRYPT_NT5_DES_EXPANDED_KEY
z%s L: %s R: %s
r      )	enumerater,   hex)r   tixr   r   r   __str__/   s   $z%SYMCRYPT_NT5_DES_EXPANDED_KEY.__str__Nr"   r#   r$   r   r<   r   r   r   r   r'   '   s    r'   c                   @   r&   )SYMCRYPT_NT5_DESX_EXPANDED_KEYc                 C   s&   | d| _| d| _t|| _d S )N   )r0   inputWhiteningoutputWhiteningr'   desKeyr   r2   r   r   r   r   6   s   z'SYMCRYPT_NT5_DESX_EXPANDED_KEY.__init__c                 C   s>   d}|d| j   7 }|d| j  7 }|dt| j 7 }|S )Nz SYMCRYPT_NT5_DESX_EXPANDED_KEY
zinputWhitening : %s
zoutputWhitening : %s
zdesKey : %s
)r@   r8   rA   strrB   )r   r9   r   r   r   r<   ;   s
   z&SYMCRYPT_NT5_DESX_EXPANDED_KEY.__str__Nr=   r   r   r   r   r>   5   s    r>   c                       s   e Zd Z fddZ  ZS )PSYMCRYPT_NT5_DESX_EXPANDED_KEYc                    s   t  |t d S r   )superr   r>   rC   	__class__r   r   r   C   s   z(PSYMCRYPT_NT5_DESX_EXPANDED_KEY.__init__)r"   r#   r$   r   __classcell__r   r   rG   r   rE   B   s    rE   c                   @      e Zd Zdd ZdS )LSA_x64_nt5_1c                 C   >   t |  d| _d| _d| _d| _d| _d| _d| _t	| _
d S )Nr   s
   3ۋH [5iii   )r   r   archr   nt_majorfeedback_ptr_offsetrandomkey_ptr_offsetdesx_key_ptr_offsetold_feedback_offsetrE   key_struct_ptrr   r   r   r   r   G      

zLSA_x64_nt5_1.__init__Nr"   r#   r$   r   r   r   r   r   rK   F       rK   c                   @   rJ   )LSA_x86_nt5_1c                 C   rL   )Nr   rM   s	      jP   	   rN   )r   r   rO   rP   r   rQ   rR   rS   rT   rE   rU   r   r   r   r   r   S   rV   zLSA_x86_nt5_1.__init__NrW   r   r   r   r   rY   R   rX   rY   r   r   )r   r   N)minidump.win_datatypesr   pypykatz.commons.commonr   r   %pypykatz.lsadecryptor.package_commonsr   r   r'   r>   rE   rK   rY   r   r   r   r   r   <module>   s    