o
    àý°j¬0  ã                   @   s<  d dl mZ d dl mZ d dlmZmZmZmZmZ d dl	m
Z
mZmZmZmZmZmZmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ ed
ƒZG dd„ deƒZ d Z!dZ"dZ#dZ$dZ%dZ&eZ'dZ(dZ)dZ*dZ+dZ,dZ-dZ.G dd„ deƒZ/G dd„ deƒZ0G dd„ deƒZ1G dd„ deƒZ2G dd„ deƒZ3G dd „ d eƒZ4G d!d"„ d"eƒZ5G d#d$„ d$eƒZ6G d%d&„ d&eƒZ7G d'd(„ d(eƒZ8G d)d*„ d*eƒZ9G d+d,„ d,eƒZ:G d-d.„ d.eƒZ;G d/d0„ d0eƒZ<G d1d2„ d2eƒZ=G d3d4„ d4eƒZ>G d5d6„ d6eƒZ?G d7d8„ d8eƒZ@G d9d:„ d:eƒZAG d;d<„ d<eƒZBG d=d>„ d>eƒZCG d?d@„ d@eƒZDG dAdB„ dBeƒZEG dCdD„ dDeƒZFG dEdF„ dFeƒZGe4e5fe6e7fe8e9fe:e;fe<e=fe>e?fe@eAfeBeCfeDeEfeFeGfdGœ
ZHefdHdI„ZIeefdJdK„ZJdLdM„ ZKeefdNdO„ZLdPe,e-B d e*fdQdR„ZMdPefdSdT„ZNdPefdUdV„ZOdWdX„ ZPdYdZ„ ZQd[S )\é    )Údivision)Úprint_function)ÚNDRCALLÚ	NDRSTRUCTÚNDRÚNDRPOINTERNULLÚNDRUniConformantArray)ÚULONGÚLPWSTRÚRPC_UNICODE_STRINGÚLPSTRÚNTSTATUSÚNULLÚPRPC_UNICODE_STRINGÚPULONGÚUSHORTÚPRPC_SIDÚLPBYTE)ÚPRPC_UNICODE_STRING_ARRAY)Ú	Structure)Ú	nt_errors)Úuuidtup_to_bin)ÚDCERPCException)z$82273FDC-E32A-18C3-3F78-827929DC23EAz0.0c                   @   s   e Zd Zddd„Zdd„ ZdS )ÚDCERPCSessionErrorNc                 C   s   t  | |||¡ d S )N)r   Ú__init__)ÚselfÚerror_stringÚ
error_codeÚpacket© r   úŠ/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/dcerpc/v5/even.pyr   (   s   zDCERPCSessionError.__init__c                 C   sF   | j }|tjv rtj| d }tj| d }d| j ||f S d| j  S )Nr   é   z'EVEN SessionError: code: 0x%x - %s - %sz+EVEN SessionError: unknown error code: 0x%x)r   r   ÚERROR_MESSAGES)r   ÚkeyÚerror_msg_shortÚerror_msg_verboser   r   r    Ú__str__+   s   

zDCERPCSessionError.__str__)NNN)Ú__name__Ú
__module__Ú__qualname__r   r&   r   r   r   r    r   '   s    
r   r!   é   é   é   é   é   iÿÿ iÿÿ c                   @   s   e Zd ZdZdd„ ZdS )ÚIELF_HANDLE))ÚDataz20s=""c                 C   s   dS )Nr!   r   )r   r   r   r    ÚgetAlignmentW   s   zIELF_HANDLE.getAlignmentN)r'   r(   r)   Ú	structurer1   r   r   r   r    r/   S   s    r/   c                   @   s   e Zd ZdZdS )ÚEVENTLOGRECORD))ÚLengthú<L=0)ÚReservedr5   )ÚRecordNumberr5   )ÚTimeGeneratedr5   )ÚTimeWrittenr5   )ÚEventIDr5   )Ú	EventTypeú<H=0)Ú
NumStringsr<   )ÚEventCategoryr<   )ÚReservedFlagsr<   )ÚClosingRecordNumberr5   )ÚStringOffsetr5   )ÚUserSidLengthr5   )ÚUserSidOffsetr5   )Ú
DataLengthr5   )Ú
DataOffsetr5   )Ú
SourceNameÚz)ÚComputernamerG   )ÚUserSidPaddingú:)Ú_UserSidz	_-UserSidzself["UserSidLength"])ÚUserSidrJ   )ÚStringsrJ   )Ú_Dataz_-Datazself["DataLength"])r0   rJ   )ÚPaddingrJ   )ÚLength2r5   N)r'   r(   r)   r2   r   r   r   r    r3   [   s    r3   c                   @   ó   e Zd ZdeffZdS )ÚEVENTLOG_FULL_INFORMATIONÚdwFullN©r'   r(   r)   r	   r2   r   r   r   r    rR   z   ó    ÿrR   c                   @   s   e Zd ZdefdeffZdS )ÚRPC_CLIENT_IDÚUniqueProcessÚUniqueThreadNrT   r   r   r   r    rV   €   ó    þrV   c                   @   s,   e Zd ZdddeffZdd„ Zd
dd	„ZdS )Ú
RPC_STRING)r4   r<   )ÚMaximumLengthr<   r0   c                 C   s<   |dkrt |tƒdu rt|ƒ| d< t|ƒ| d< t | ||¡S )Nr0   Fr4   r[   )Ú
isinstancer   Úlenr   Ú__setitem__)r   r#   Úvaluer   r   r    r^   Ž   s   zRPC_STRING.__setitem__Nr   c                 C   s|   |d u r| j j}|dkrtd| dd� t| jd tƒr$tddd� d S | jd d dkr5tddd� d S | jd  d|¡S )	NÚ z%sú )Úendr0   z NULLÚ
ReferentIDr   )Ú	__class__r'   Úprintr\   Úfieldsr   Údump)r   ÚmsgÚindentr   r   r    rg   ”   s   zRPC_STRING.dump)Nr   )r'   r(   r)   r   r2   r^   rg   r   r   r   r    rZ   ‡   s    ýrZ   c                   @   ó    e Zd ZdZdefdeffZdS )ÚElfrClearELFWr   Ú	LogHandleÚBackupFileNameN)r'   r(   r)   Úopnumr/   r   r2   r   r   r   r    rk   ¤   ó
    þrk   c                   @   rQ   )ÚElfrClearELFWResponseÚ	ErrorCodeN©r'   r(   r)   r   r2   r   r   r   r    rp   «   rU   rp   c                   @   rj   )ÚElfrBackupELFWr!   rl   rm   N)r'   r(   r)   rn   r/   r   r2   r   r   r   r    rs   ±   ro   rs   c                   @   rQ   )ÚElfrBackupELFWResponserq   Nrr   r   r   r   r    rt   ¸   rU   rt   c                   @   ó   e Zd ZdZdeffZdS )ÚElfrCloseELr*   rl   N©r'   r(   r)   rn   r/   r2   r   r   r   r    rv   ¾   ó    ÿrv   c                   @   ó   e Zd ZdefdeffZdS )ÚElfrCloseELResponserl   rq   N©r'   r(   r)   r/   r   r2   r   r   r   r    rz   Ä   rY   rz   c                   @   ru   )ÚElfrNumberOfRecordsr+   rl   Nrw   r   r   r   r    r|   Ë   rx   r|   c                   @   ry   )ÚElfrNumberOfRecordsResponseÚNumberOfRecordsrq   N©r'   r(   r)   r	   r   r2   r   r   r   r    r}   Ñ   rY   r}   c                   @   ru   )ÚElfrOldestRecordé   rl   Nrw   r   r   r   r    r€   Ø   rx   r€   c                   @   ry   )ÚElfrOldestRecordResponseÚOldestRecordNumberrq   Nr   r   r   r   r    r‚   Þ   rY   r‚   c                   @   ó2   e Zd ZdZdefdefdefdefdeffZdS )ÚElfrOpenELWé   ÚUNCServerNameÚ
ModuleNameÚRegModuleNameÚMajorVersionÚMinorVersionN©r'   r(   r)   rn   ÚEVENTLOG_HANDLE_Wr   r	   r2   r   r   r   r    r…   å   ó    ûr…   c                   @   ry   )ÚElfrOpenELWResponserl   rq   Nr{   r   r   r   r    r�   ï   rY   r�   c                   @   r„   )ÚElfrRegisterEventSourceWr,   r‡   rˆ   r‰   rŠ   r‹   NrŒ   r   r   r   r    r�   ö   rŽ   r�   c                   @   ry   )Ú ElfrRegisterEventSourceWResponserl   rq   Nr{   r   r   r   r    r‘      rY   r‘   c                   @   s,   e Zd ZdZdefdefdefdeffZdS )ÚElfrOpenBELWé	   r‡   rm   rŠ   r‹   NrŒ   r   r   r   r    r’     ó    ür’   c                   @   ry   )ÚElfrOpenBELWResponserl   rq   Nr{   r   r   r   r    r•     rY   r•   c                   @   s,   e Zd ZdZdefdefdefdeffZdS )ÚElfrReadELWé
   rl   Ú	ReadFlagsÚRecordOffsetÚNumberOfBytesToReadN)r'   r(   r)   rn   r/   r	   r2   r   r   r   r    r–     r”   r–   c                   @   s(   e Zd ZdefdefdefdeffZdS )ÚElfrReadELWResponseÚBufferÚNumberOfBytesReadÚMinNumberOfBytesNeededrq   N)r'   r(   r)   r   r	   r   r2   r   r   r   r    r›      s    ür›   c                   @   sh   e Zd ZdZdefdefdefdefdefdefdefd	efd
efde	fde
fdefdefdeffZdS )ÚElfrReportEventWé   rl   ÚTimer;   r>   r:   r=   ÚDataSizeÚComputerNameÚUserSIDrM   r0   ÚFlagsr7   r9   N)r'   r(   r)   rn   r/   r	   r   r   r   r   r   r   r2   r   r   r   r    rŸ   )  s"    òrŸ   c                   @   s"   e Zd ZdefdefdeffZdS )ÚElfrReportEventWResponser7   r9   rq   N)r'   r(   r)   r   r   r2   r   r   r   r    r¦   <  s
    ýr¦   )
r   r!   r*   r+   r�   r†   r,   r“   r—   r    c                 C   s0   t ƒ }t|d< ||d< d|d< d|d< |  |¡S )Nr‡   rm   r!   rŠ   r‹   )r’   r   Úrequest)ÚdceÚbackupFileNamer§   r   r   r    ÚhElfrOpenBELWV  s   
rª   c                 C   ó8   t ƒ }t|d< ||d< ||d< d|d< d|d< |  |¡S ©Nr‡   rˆ   r‰   r!   rŠ   r‹   )r…   r   r§   ©r¨   Ú
moduleNameÚregModuleNamer§   r   r   r    ÚhElfrOpenELW^  ó   
r°   c                 C   ó   t ƒ }||d< |  |¡}|S ©Nrl   )rv   r§   ©r¨   Ú	logHandler§   Úrespr   r   r    ÚhElfrCloseELg  ó   
r·   c                 C   r«   r¬   )r�   r   r§   r­   r   r   r    ÚhElfrRegisterEventSourceWm  r±   r¹   r`   c                 C   s0   t ƒ }||d< ||d< ||d< ||d< |  |¡S )Nrl   r˜   r™   rš   )r–   r§   )r¨   rµ   Ú	readFlagsÚrecordOffsetÚnumberOfBytesToReadr§   r   r   r    ÚhElfrReadELWv  s   
r½   c                 C   ó    t ƒ }||d< ||d< |  |¡S ©Nrl   rm   )rk   r§   ©r¨   rµ   r©   r§   r   r   r    ÚhElfrClearELFW  ó   
rÁ   c                 C   r¾   r¿   )rs   r§   rÀ   r   r   r    ÚhElfrBackupELFW…  rÂ   rÃ   c                 C   r²   r³   )r|   r§   r´   r   r   r    ÚhElfrNumberOfRecords‹  r¸   rÄ   c                 C   r²   r³   )r€   r§   r´   r   r   r    ÚhElfrOldestRecordNumber‘  r¸   rÅ   N)RÚ
__future__r   r   Úimpacket.dcerpc.v5.ndrr   r   r   r   r   Úimpacket.dcerpc.v5.dtypesr	   r
   r   r   r   r   r   r   r   r   r   Úimpacket.dcerpc.v5.lsadr   Úimpacket.structurer   Úimpacketr   Úimpacket.uuidr   Úimpacket.dcerpc.v5.rpcrtr   ÚMSRPC_UUID_EVENr   ÚEVENTLOG_SUCCESSÚEVENTLOG_ERROR_TYPEÚEVENTLOG_WARNING_TYPEÚEVENTLOG_INFORMATION_TYPEÚEVENTLOG_AUDIT_SUCCESSÚEVENTLOG_AUDIT_FAILUREr�   ÚMAX_STRINGSÚMAX_SINGLE_EVENTÚMAX_BATCH_BUFFÚEVENTLOG_SEQUENTIAL_READÚEVENTLOG_SEEK_READÚEVENTLOG_FORWARDS_READÚEVENTLOG_BACKWARDS_READr/   r3   rR   rV   rZ   rk   rp   rs   rt   rv   rz   r|   r}   r€   r‚   r…   r�   r�   r‘   r’   r•   r–   r›   rŸ   r¦   ÚOPNUMSrª   r°   r·   r¹   r½   rÁ   rÃ   rÄ   rÅ   r   r   r   r    Ú<module>   s�   4

			ö		
ÿ	