o
    àý°j³g  ã                   @   sž  d dl mZ d dl mZ d dlZd dlZd dlmZ d dlmZ d dl	Z	d dl
mZ d dlmZmZ d dlmZ d d	lmZmZ d
Zd ZdZdZdZdZdZdZG dd„ deƒZG dd„ deƒZG dd„ deƒZG dd„ deƒZG dd„ deƒZ G dd„ deƒZ!G dd„ deƒZ"G dd „ d eƒZ#G d!d"„ d"eƒZ$G d#d$„ d$eƒZ%ee e!e"e#e$d%œZ&G d&d'„ d'eƒZ'G d(d)„ d)e'ƒZ(G d*d+„ d+ƒZ)G d,d-„ d-e'ƒZ*d1d/d0„Z+dS )2é    )Údivision)Úprint_functionN)Ú	unhexlify)Úunpack)Úb)ÚABCÚabstractmethod)ÚLOG)Ú	StructureÚhexdumpé,   é   é   é   é   é   é   c                   @   ó   e Zd ZdZdS )ÚREG_REGF))ÚMagicz"regf©ÚUnknownú<L=0©ÚUnknown2r   ©Ú
lastChangez<Q=0)ÚMajorVersionr   )ÚMinorVersionr   )Ú0r   )Ú11r   )ÚOffsetFirstRecordr   )ÚDataSizer   )Ú1111r   )ÚNamez48s="")Ú
Remaining1z411s=b"")ÚCheckSumz<L=0xffffffff)Ú
Remaining2z	3585s=b""N©Ú__name__Ú
__module__Ú__qualname__Ú	structure© r-   r-   ú‡/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/winregistry.pyr   3   ó    r   c                   @   r   )ÚREG_HBIN))r   z"hbin)ÚOffsetFirstHBinr   )ÚOffsetNextHBinr   )Ú	BlockSizer   Nr(   r-   r-   r-   r.   r0   F   r/   r0   c                   @   r   )ÚREG_HBINBLOCK))ÚDataBlockSizeú<l=0)Ú_Dataú_-Datazself["DataBlockSize"]*(-1)-4©ÚDataú:Nr(   r-   r-   r-   r.   r4   N   r/   r4   c                   @   r   )ÚREG_NK))r   z"nk)ÚTypeú<H=0r   r   )ÚOffsetParentr6   )Ú
NumSubKeysr   r   )ÚOffsetSubKeyLfr6   )ÚUnknown3r   )Ú	NumValuesr   )ÚOffsetValueListr6   )ÚOffsetSkRecordr6   )ÚOffsetClassNamer6   )ÚUnUsedz20s=b""©Ú
NameLengthr>   )ÚClassNameLengthr>   )Ú_KeyNamez	_-KeyNameúself["NameLength"])ÚKeyNamer;   Nr(   r-   r-   r-   r.   r<   U   r/   r<   c                   @   r   )ÚREG_VK)	)r   z"vkrH   )ÚDataLenr6   )Ú
OffsetDatar   )Ú	ValueTyper   )ÚFlagr>   ©rG   r>   )Ú_Namez_-NamerL   )r$   r;   Nr(   r-   r-   r-   r.   rN   k   r/   rN   c                   @   r   )ÚREG_LF))r   z"lf©ÚNumKeysr>   ©ÚHashRecordsr;   Nr(   r-   r-   r-   r.   rU   x   r/   rU   c                   @   r   )ÚREG_LH))r   z"lhrV   rX   Nr(   r-   r-   r-   r.   rZ      r/   rZ   c                   @   r   )ÚREG_RI))r   z"rirV   rX   Nr(   r-   r-   r-   r.   r[   †   r/   r[   c                   @   r   )ÚREG_SK))r   z"skrS   )ÚOffsetPreviousSkr6   )ÚOffsetNextSkr6   )ÚUsageCounterr   )ÚSizeSkr   r9   Nr(   r-   r-   r-   r.   r\   �   r/   r\   c                   @   r   )ÚREG_HASH))ÚOffsetNkr   )rM   z4s=b""Nr(   r-   r-   r-   r.   ra   ˜   r/   ra   )s   nks   vks   lfs   lhs   ris   skc                   @   sr   e Zd Zdd„ Zdd„ Zedd„ ƒZedd„ ƒZed	d
„ ƒZedd„ ƒZ	edd„ ƒZ
eddd„ƒZedd„ ƒZdS )ÚRegistryc                 C   s   t | dƒr| j ¡  d S d S )NÚfd)Úhasattrrd   Úclose©Úselfr-   r-   r.   rf   §   s   
ÿzRegistry.closec                 C   s   |   ¡  d S ©N)rf   rg   r-   r-   r.   Ú__del__«   s   zRegistry.__del__c                 C   ó   d S ri   r-   ©rh   Ú	parentKeyr-   r-   r.   Úwalk®   ó   zRegistry.walkc                 C   rk   ri   r-   ©rh   Úkeyr-   r-   r.   ÚfindKey²   ro   zRegistry.findKeyc                 C   rk   ri   r-   ©rh   Ú	valueTypeÚ	valueDatar-   r-   r.   Ú
printValue¶   ro   zRegistry.printValuec                 C   rk   ri   r-   rl   r-   r-   r.   ÚenumKeyº   ro   zRegistry.enumKeyc                 C   rk   ri   r-   rp   r-   r-   r.   Ú
enumValues¾   ro   zRegistry.enumValuesNc                 C   rk   ri   r-   )rh   ÚkeyValueÚ	valueNamer-   r-   r.   ÚgetValueÂ   ro   zRegistry.getValuec                 C   rk   ri   r-   ©rh   Ú	classNamer-   r-   r.   ÚgetClassÆ   ro   zRegistry.getClassri   )r)   r*   r+   rf   rj   r   rn   rr   rv   rw   rx   r{   r~   r-   r-   r-   r.   rc   ¦   s"    




rc   c                   @   s¸   e Zd Zd-dd„Zdd„ Zdd„ Zdd	„ Zd
d„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zd d!„ Zd"d#„ Zd$d%„ Zd.d'd(„Zd)d*„ Zd+d,„ Zd&S )/ÚsaveRegistryParserFc                 C   s²   || _ |du r| j | _| j  ¡  nt|dƒ| _| j d¡}t|ƒ| _d| _|  ¡ | _| jd u r6t	 
d¡ d S | jd dkrU| jd d	krWt	 d
| jd | jd f ¡ d S d S d S )NTzr+bé   Ú zCan't find root key!r   r   r   é   z4Unsupported version (%d.%d) - things might not work!)Ú_saveRegistryParser__hiverd   ÚopenÚreadr   Ú_saveRegistryParser__regfÚindentÚ _saveRegistryParser__findRootKeyÚrootKeyr	   ÚerrorÚwarning)rh   ÚhiveÚisRemoteÚdatar-   r-   r.   Ú__init__Ë   s   


"ÿzsaveRegistryParser.__init__c              
   C   sÔ   | j  dd¡ | j  d¡}t|ƒdkrhz6t|d d… ƒ}|| j  |d d ¡7 }|dd … }|  |¡}|D ]}t|tƒrG|d tkrG|  W S q5W n t	y[ } zW Y d }~nd }~ww | j  d¡}t|ƒdksd S )Nr   r€   é    r2   r=   )
rd   Úseekr…   Úlenr0   Ú&_saveRegistryParser__processDataBlocksÚ
isinstancer<   ÚROOT_KEYÚ	Exception)rh   rŽ   ÚhbinÚblocksÚblockÚer-   r-   r.   Ú__findRootKeyÛ   s*   


€ý€ÿóz saveRegistryParser.__findRootKeyc                 C   s¦   | j  d| d¡ | j  d¡}|| j  td|ƒd d d ¡ }t|ƒdkr(d S t|ƒ}|d d d… tv rDt|d d d…  |d ƒS t d|d d d…  ¡ |S )	Nr€   r   r   ú<léÿÿÿÿr:   r   zUnknown type 0x%s)	rd   r‘   r…   r   r’   r4   ÚStructMappingsr	   Údebug)rh   ÚoffsetÚ	sizeBytesrŽ   r™   r-   r-   r.   Ú
__getBlockð   s   "zsaveRegistryParser.__getBlockc                 C   sn   g }g }| j  d| d¡ t|ƒD ]}| td| j  d¡ƒd ¡ q|D ]}|dkr4|  |¡}| |¡ q$|S )Nr€   r   rœ   r   )rd   r‘   ÚrangeÚappendr   r…   Ú_saveRegistryParser__getBlock)rh   r    ÚcountÚ	valueListÚresÚiÚvalueOffsetr™   r-   r-   r.   Ú__getValueBlocksÿ   s   

€z#saveRegistryParser.__getValueBlocksc                 C   s&   | j  d| d¡ | j  |¡dd … S )Nr€   r   r   )rd   r‘   r…   )rh   r    r¦   r-   r-   r.   Ú	__getData  s   zsaveRegistryParser.__getDatac                 C   s"   | j  d| d d¡ | j  |¡S )Nr€   r   r   )rd   r‘   Úwrite)rh   r    Úvaluer-   r-   r.   Ú	__setData  s   zsaveRegistryParser.__setDatac                 C   s¸   g }t |ƒdkrZtd|d d… ƒd }tƒ }|dkr(t|jƒ}d|d< t|ƒ|_| |¡ t |ƒ}|d d d… tv rIt|d d d…  |d ƒ}| |¡ ||d … }t |ƒdks|S )Nr   rœ   r   )r7   r8   zself["DataBlockSize"]-4r   r:   r   )	r’   r   r4   Úlistr,   ÚtupleÚ
fromStringrž   r¤   )rh   rŽ   r¨   Ú	blockSizer™   ÚtmpListÚblockLenr-   r-   r.   Ú__processDataBlocks  s    



ðz&saveRegistryParser.__processDataBlocksc                 C   s<   |d dkrdS |d dk r|d S |   |d |d d ¡S )NrO   r   r�   rP   r   )Ú_saveRegistryParser__getData)rh   Úrecr-   r-   r.   Ú__getValueData)  s
   z!saveRegistryParser.__getValueDatac                 C   s\   t |ƒ|d krt d|d t |ƒf ¡ tdƒ‚|d dkr&t d¡ dS |  |d |¡S )NrO   zGInvalid value length received by __setValueData. Expected: %d - Got: %dz=Setting key values with differing lengths is not implemented.r   z+Received 0 length input for __setValueData.rP   )r’   r	   rŸ   ÚNotImplementedErrorÚ_saveRegistryParser__setData)rh   r¸   r®   r-   r-   r.   Ú__setValueData3  s   
z!saveRegistryParser.__setValueDatac                 C   s.   d}|  ¡ D ]}|d9 }|t|ƒ7 }q|d S )Nr   é%   l        )ÚupperÚord)rh   rq   r¨   Úbbr-   r-   r.   Ú__getLhHashD  s
   zsaveRegistryParser.__getLhHashc                 C   sÊ   |dkrt |ƒ}|d  d¡t|d d… ƒkr|d S d S |dkr9t |ƒ}td|d ƒd |  |¡kr7|d S d S |d	krWtd|d d… ƒd }|  |¡}|d |krU|S d S t d
| ¡ t 	d¡ d S )NÚlfrM   ó    r   rb   Úlhú<Lr   ÚrizUNKNOWN Magic %sr   )
ra   Ústripr   r   Ú_saveRegistryParser__getLhHashr¥   r	   ÚcriticalÚsysÚexit)rh   ÚmagicÚhashDatarq   ÚhashRecr    Únkr-   r-   r.   Ú__compareHashK  s&   òö
ý
z saveRegistryParser.__compareHashc                 C   sø   |   |d ¡}|d urz|d }|d dkrFd}t|d ƒD ]&}td|d d… ƒd	 }|   |¡}||d d |d d
 …  }|dd … }q|}t|d ƒD ]-}	|d d
… }
|  |d |
|¡}|d urs|   |¡}|d  d¡|krs|  S |d
d … }qLd S )NrA   rY   r   rÆ   ó    rW   rÅ   r   r   é   r@   rM   úutf-8)r¥   r£   r   Ú _saveRegistryParser__compareHashÚdecode)rh   rm   ÚsubKeyrÂ   rŽ   Úrecordsr©   r    ÚlÚrecordrÎ   r¨   rÏ   r-   r-   r.   Ú__findSubKey`  s(   

zsaveRegistryParser.__findSubKeyc                 C   sF  |   |d ¡}t|tƒr9td| j|d  d¡f ƒ |  jd7  _|d dk r1| jd d… | _d S |   |d ¡}n|}|d	 }|d
 dkrvd}t|d ƒD ]&}td|d d… ƒd }|   |¡}||d	 d |d d …  }|dd … }qM|}t|d ƒD ]}	t|d d… ƒ}
|  	|
¡ |dd … }q|t|tƒr¡| jd d… | _d S d S )Nrb   ú%s%srM   rÓ   ú  rA   r   éþÿÿÿrY   r   rÆ   r�   rW   rÅ   r   rÒ   )
r¥   r”   r<   Úprintr‡   rÕ   r£   r   ra   Ú!_saveRegistryParser__walkSubNodes)rh   r¸   rÏ   rÂ   rŽ   r×   r©   r    rØ   rq   rÎ   r-   r-   r.   Ú__walkSubNodes|  s2   



ÿz!saveRegistryParser.__walkSubNodesc                 C   st   |   |¡}|d u s|d dk rd S |  |d ¡}|d }t|d ƒD ]}t|d d… ƒ}|  |¡ |dd … }q"d S )NrA   r   rY   rW   rÒ   )rr   r¥   r£   ra   rß   )rh   rm   rq   rÂ   rŽ   rÙ   rÎ   r-   r-   r.   rn   œ  s   

ýzsaveRegistryParser.walkc                 C   st   |d dkrt |ƒdkr|dd … }| j}t |ƒdkr8|d dkr8| d¡D ]}|  ||¡}|d ur5|}q& d S |S )Nr   ú\r   )r’   r‰   ÚsplitÚ_saveRegistryParser__findSubKey)rh   rq   rm   rÖ   r¨   r-   r-   r.   rr   ©  s   zsaveRegistryParser.findKeyc                 C   s   |t ttfv rt|tƒrtdƒ d S td| d¡ ƒ d S |tkr-tdƒ t|| j	ƒ d S |t
kr9td| ƒ d S |tkrJtdtd|ƒd  ƒ d S |tkrtzt|ƒdkr`tdƒ t|| j	ƒ ntd	ƒ W d S W d S    td	ƒ Y d S td
| ƒ t|ƒ d S )NÚNULLú%súutf-16ler�   ú%dú<Qr   r   ú NULLúUnknown Type 0x%x!)ÚREG_SZÚREG_EXPAND_SZÚREG_MULTISZr”   ÚintrÞ   rÕ   Ú
REG_BINARYr   r‡   Ú	REG_DWORDÚ	REG_QWORDr   ÚREG_NONEr’   rs   r-   r-   r.   rv   »  s,   
þzsaveRegistryParser.printValuec                 C   sì   g }|d dkrt|   |d ¡}|d }|d dkrJd}t|d ƒD ]&}td	|d d
… ƒd }|   |¡}||d d |d d …  }|d
d … }q!|}t|d ƒD ]#}t|d d… ƒ}	|   |	d ¡}
|dd … }| d|
d  d¡ ¡ qP|S )Nr@   r   rA   rY   r   rÆ   r�   rW   rÅ   r   rÒ   rb   rå   rM   rÓ   )r¥   r£   r   ra   r¤   rÕ   )rh   rm   r¨   rÂ   rŽ   r×   r©   r    rØ   rÎ   rÏ   r-   r-   r.   rw   Õ  s$   
zsaveRegistryParser.enumKeyc                 C   s\   g }|d dkr,|   |d |d d ¡}|D ]}|d dkr&| |d ¡ q| d¡ q|S )NrC   r   rD   r   rR   r$   s   default)Ú#_saveRegistryParser__getValueBlocksr¤   )rh   rq   Úrespr§   r®   r-   r-   r.   rx   î  s   zsaveRegistryParser.enumValuesNc                 C   s¾   |du rt  |¡}t  |¡}n|}|}|  |¡}|du rdS |d dkr]|  |d |d d ¡}|D ]*}|d t|ƒkrG|d |  |¡f  S |dkr\|d	 dkr\|d |  |¡f  S q2dS )
át   returns a tuple with (ValueType, ValueData) for the requested keyValue
            valueName is the name of the value (which can contain '\')
            if valueName is not  given, keyValue must be a string containing the full path to the value
            if valueName is given, keyValue should be the string containing the path to the key containing valueName
        NrC   r   rD   r   r$   rQ   ÚdefaultrR   )ÚntpathÚdirnameÚbasenamerr   ró   r   Ú!_saveRegistryParser__getValueData)rh   ry   rz   ÚregKeyÚregValuerq   r§   r®   r-   r-   r.   r{   ý  s"   

€zsaveRegistryParser.getValuec                 C   s°   t  |¡}t  |¡}|  |¡}|d u rd S |d dkrV|  |d |d d ¡}|D ],}|d t|ƒkr?|d |  ||¡f  S |dkrU|d dkrU|d |  ||¡f  S q)d S )	NrC   r   rD   r   r$   rQ   rö   rR   )r÷   rø   rù   rr   ró   r   Ú!_saveRegistryParser__setValueData)rh   ry   ru   rû   rü   rq   r§   r®   r-   r-   r.   ÚsetValue  s   


€zsaveRegistryParser.setValuec                 C   s<   |   |¡}|d u rd S |d dkr|  |d ¡}|d S d S )NrF   r   r:   )rr   r¥   )rh   r}   rq   r®   r-   r-   r.   r~   /  s   
þzsaveRegistryParser.getClass©Fri   )r)   r*   r+   r�   rˆ   r¥   ró   r·   r»   r“   rú   rý   rÈ   rÔ   rã   rß   rn   rr   rv   rw   rx   r{   rþ   r~   r-   r-   r-   r.   r   Ê   s,    

 
r   c                   @   s   e Zd Zddd„Zdd„ ZdS )ÚRegistryNodeNc                 C   s   || _ || _|| _i | _d S ri   )ÚkeyNameÚnodeNamerŽ   Ú	childKeys)rh   r  r  rŽ   r-   r-   r.   r�   =  s   
zRegistryNode.__init__c                 C   s   | j |B | _ d S ri   )r  )rh   ÚchildKeyr-   r-   r.   ÚaddChildNodeC  s   zRegistryNode.addChildNoderi   )r)   r*   r+   r�   r  r-   r-   r-   r.   r   <  s    
r   c                   @   s†   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zd dd„Zdd„ ZdS )!ÚexportRegistryParserc                 C   s&   d| _ || _t|dd�| _|  ¡  d S )Nr�   ræ   )Úencoding)r‡   Ú_exportRegistryParser__hiver„   rd   Ú(_exportRegistryParser__buildRegistryTree)rh   rŒ   r-   r-   r.   r�   H  s   zexportRegistryParser.__init__c                 C   sb   |dkrt S |dkrtS |dkrtS |dkrtS |dkrtS |dkr$tS t| dd¡ d	d
¡dƒS )Nzhex(0)zhex(2)ÚhexÚdwordzhex(7)zhex(b)zhex(Ú0xú)r�   é   )rò   rì   rï   rð   rí   rñ   rî   Úreplace)rh   rQ   r-   r-   r.   Ú__parseTypeN  s   z exportRegistryParser.__parseTypec                 C   s"   |  | jj› d�d¡ d¡ d¡S )Nrá   r�   )r  ÚregistryTreer  rÇ   râ   rp   r-   r-   r.   Ú__keyToNodePath^  s   "z$exportRegistryParser.__keyToNodePathc                 C   s8   | j }z|dgkr|D ]}|j| }q|W S    Y d S )Nr�   )r  r  )rh   ÚnodePathÚnodeÚtempNoder-   r-   r.   Ú
__findNodea  s   
zexportRegistryParser.__findNodec                 C   sò   |sdt dgiS i }t d¡}t d¡}t dtj¡}| |¡}|D ]T}| |¡rB| |¡d }t }	|d }
|d r=d}n1|d }n,| |¡d }|  |d ¡}	|d	  d
¡ dd¡ dd¡ dd¡}
|d rjd}n|d }|||	|
giB }q"|S )Nrö   r�   z^(?:"(.*)"|(@))="(.*)"$z^(?:"(.*)"|(@))=(.*):([\S\s]*)$z^([\S\s]*?)$(?<!\\)r   r   r   r   Ú
ú,ú z\
)	rë   ÚreÚcompileÚ	MULTILINEÚfindallÚsearchÚ _exportRegistryParser__parseTyperÇ   r  )rh   Úregkey_valuesrŽ   Úpattern_regszÚpattern_otherÚpattern_split_valuesÚvaluesr®   ÚmatchrQ   Ú	ValueDataÚ	ValueNamer-   r-   r.   Ú__extractDatak  s.   




&z"exportRegistryParser.__extractDatac                 C   s6   d  | d¡dd … ¡}|  |¡}|t|||ƒi}|S )Nr�   rá   r�   )Újoinrâ   Ú"_exportRegistryParser__extractDatar   )rh   r  r   r  rŽ   r  r-   r-   r.   Ú__buildChildNodeŠ  s   
z%exportRegistryParser.__buildChildNodec                 C   s¶   t  dt j¡}| j ¡ }d}| |¡D ]E}|d }|d  d¡}|du r?|  |¡}d | 	d¡dd … ¡}t
|||ƒ| _d	}q|  |¡d d… }	|  ||¡}
|  |	¡}| |
¡ qd S )
Nz^\[(.*?)\]\n([\S\s]*?)?^\nTr   r   r  r�   rá   r�   F)r  r  r  rd   r…   r  rÇ   r*  r)  râ   r   r  Ú$_exportRegistryParser__keyToNodePathÚ%_exportRegistryParser__buildChildNodeÚ_exportRegistryParser__findNoder  )rh   ÚpatternÚfiler‰   r%  r  r   rŽ   r  Ú
parentPathr  Ú
parentNoder-   r-   r.   Ú__buildRegistryTree‘  s    


óz(exportRegistryParser.__buildRegistryTreec                 C   sr   t d| j|jf ƒ |  jd7  _|ji kr | jd d… | _d S t|j ¡ ƒD ]}|  |¡ q'| jd d… | _d S )NrÛ   rÜ   rÝ   )rÞ   r‡   r  r  r°   r$  Ú#_exportRegistryParser__walkSubNodes)rh   r  ÚsubNoder-   r-   r.   rà   ¤  s   
z#exportRegistryParser.__walkSubNodesc                 C   sB   |   |¡}|  |¡}|d u rd S t|j ¡ ƒD ]}|  |¡ qd S ri   )r,  r.  r°   r  r$  r4  )rh   rm   Úpathr  r5  r-   r-   r.   rn   °  s   

ÿzexportRegistryParser.walkc                 C   s  |t ttfv r |dks|dkrtdƒ d S td| d¡ ƒ d S |tkr0tdƒ t|| jƒ d S |tkrG|dkr>tdƒ d S tt	 
|¡ƒ d S |tkrXtdtd	|ƒd  ƒ d S |tkr‚zt|ƒd
krntdƒ t|| jƒ ntdƒ W d S W d S    tdƒ Y d S td| ƒ t|ƒ d S )NrÑ   s     rä   rå   ræ   r�   r   rç   rè   r   ré   rê   )rë   rì   rí   rÞ   rÕ   rï   r   r‡   rð   rî   Ú
from_bytesrñ   r   rò   r’   rs   r-   r-   r.   rv   º  s0   þzexportRegistryParser.printValuec                 C   s   |dkrdS d  |  |¡¡S )Nrá   )r)  r,  rp   r-   r-   r.   rr   ×  s   zexportRegistryParser.findKeyc                 C   s"   |   |¡}|  |¡}t|j ¡ ƒS ri   )r,  r.  r°   r  Úkeys)rh   rq   r6  r  r-   r-   r.   rw   Ý  s   

zexportRegistryParser.enumKeyc                 C   s8   |   |¡}|  |¡}|sd S t|j ¡ ƒ}dd„ |D ƒS )Nc                 S   s   g | ]}|  d ¡‘qS )rÓ   )Úencode)Ú.0Úsr-   r-   r.   Ú
<listcomp>é  s    z3exportRegistryParser.enumValues.<locals>.<listcomp>)r,  r.  r°   rŽ   r8  )rh   rq   r6  r  r$  r-   r-   r.   rx   â  s   

zexportRegistryParser.enumValuesNc           	      C   sˆ   |   |¡}|du r|dd… }d |dd… ¡}n|}|}z |  |¡}|j| \}}|tfv r7|| d¡fW S |t|ƒfW S    Y dS )rõ   Nr�   r�   ræ   )r,  r)  r.  rŽ   rë   r9  r   )	rh   ry   rz   r6  ÚkeyPathrü   r  rQ   r&  r-   r-   r.   r{   ë  s   


zexportRegistryParser.getValuec                 C   rk   ri   r-   r|   r-   r-   r.   r~     ro   zexportRegistryParser.getClassri   )r)   r*   r+   r�   r  r,  r.  r*  r-  r	  r4  rn   rv   rr   rw   rx   r{   r~   r-   r-   r-   r.   r  G  s     


	r  Fc                 C   s¸   t | dƒo	t | dƒ}|rt| |ƒS t| dƒ�}| d¡}W d  ƒ n1 s&w   Y  |dd… dkr8t| |ƒS z| d¡}d	|v sFd
|v rKt| ƒW S W tdƒ‚ ty[   Y tdƒ‚w )a)  
    Factory function to instantiate the correct registry parser by auto-detecting the hive format.
    :param hive: Path to the registry hive file (str) or file-like object
    :param isRemote: Whether the hive is remote
    :return: An instance of saveRegistryParser or exportRegistryParser
    r…   r‘   Úrbé@   Nr   s   regfræ   zWindows Registry EditorÚREGEDITzFCould not determine registry hive format (not a binary hive or export))re   r   r„   r…   rÕ   r  r–   Ú
ValueError)rŒ   r�   Úis_file_objectrd   rŽ   Úheaderr-   r-   r.   Úget_registry_parser  s$   	
ÿ


ÿýýrD  rÿ   ),Ú
__future__r   r   rÊ   r  Úbinasciir   Ústructr   r÷   Úsixr   Úabcr   r   Úimpacketr	   Úimpacket.structurer
   r   r•   rò   rë   rì   rï   rð   rí   rñ   r   r0   r4   r<   rN   rU   rZ   r[   r\   ra   rž   rc   r   r   r  rD  r-   r-   r-   r.   Ú<module>   sX   û$  t B