o ji@sddlZddlmZddlTddlTGdddZGdddZed krcejej d d Z ee Z e e j jd ee Ze ejee eZeZejD] Ze eejeqQe d dSdS)N)pypykatz)*c@s eZdZddZeddZdS) RekallModulecCsd|_d|_d|_d|_dSN)name start_addrend_addrsizeselfr /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/readers/rekall/rekallreader.py__init__s zRekallModule.__init__cCs@t}t|j|_t|j|_t|j|_ |j|j |_ |Sr) rstr BaseDllNamelowerrintDllBaser SizeOfImager r )modulermr r r from_modules   zRekallModule.from_moduleN)__name__ __module__ __qualname__r staticmethodrr r r rrsrc@seZdZd)ddZddZed)ddZed)dd Zd d Zd d Z d*ddZ ddZ ddZ ddZ ddZddZddZddZddZd d!Zd"d#Zd$d%Zd+d'd(ZdS), RekallReaderNcCs@d|_d|_d|_d|_d|_i|_||_d|_||_d|_ dS)z Timestamp override will change the msv_dll_timestamp value. If None > no change If 0 > it disables the ANIT_MIMIKATZ structs on certain builds If 1 > it enforces to use the ANTI_MIMIKATZ structs on certain builds N) session lsass_taskcctask_ascur_posmodulestimestamp_overrideprocessor_architecture BuildNumbermsv_dll_timestamp)r r$ buildnumberr r rr"s zRekallReader.__init__cCsp|jj|_||j|_||_|j s| |_ |j r2|j dkr*dt _ n|j dkr2dt _ |dS)NriGSriHS)rpluginsr search_lsassrget_process_address_spacer!get_archr%r&get_buildnumberr$sysinfor' load_modulesr r r rsetup8s      zRekallReader.setupcCs@td|tj|gdtdddddgd}t|||S) NzInvoking recall on file %s)rsdspewindows_kernel_filerfulll z4https://github.com/google/rekall-profiles/raw/masterz#http://profiles.rekall-forensic.com)filename autodetectloggerautodetect_build_localautodetect_scan_length profile_path)logginginforSession getLoggerr from_session) memory_filer$r(rsessionr r rfrom_memory_fileHs zRekallReader.from_memory_filecCst||}||_||Sr)rrr0)rr$r(rrr r rr?Ws zRekallReader.from_sessioncCst|jjjSr)rrPeb OSBuildNumberr r r rr-^szRekallReader.get_buildnumbercCs&|jjddddkrtjStjS)Narch64)rprofilemetadataKatzSystemArchitectureX64X86r r r rr,aszRekallReader.get_archcCsN|dur|jtjkr d}nd}|j|}|dkrdS|||}||dS)zD Repositions the current reader to match architecture alignment Nr)r%rKrLr"read)r alignmentoffsetoffset_to_alignedr r ralignfs    zRekallReader.aligncCs|jS)z) Returns the current virtual address r"r r r rtellvszRekallReader.tellcC8|jtjkrtj|ddddStj|ddddS)z Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian singed int on 32 bit arch Reads an 8 byte small-endian singed int on 64 bit arch rNlittleT byteordersignedrOr%rKrLr from_bytesrPr r r rread_int| zRekallReader.read_intcCrW)z Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian unsinged int on 32 bit arch Reads an 8 byte small-endian unsinged int on 64 bit arch rNrXFrYrOr\r r r r read_uintr_zRekallReader.read_uintcCs|||Sr)mover`r posr r rget_ptrs zRekallReader.get_ptrcCsJ|jtjkr||tj|dddd}|d|S|||S)NrOrXTrY)r%rKrLrarr]rPr`)r rcptrr r rget_ptr_with_offsets    z RekallReader.get_ptr_with_offsetcCs ||_dSrrUrbr r rras zRekallReader.movecCs"|j|j|}|j|7_|Srr!rPr")r r datar r rrPszRekallReader.readcCs|j|j|Srrg)r r r r rpeekszRekallReader.peekcCsv|j|_|jD]-}t||jt|j <t|j dkr8t |j |_ |j dkr8|j jdd|_ q dS)Nz msv1_0.dllrzWARNING! msv.dll timestamp not found! This could cause errors with older windows builds. You might need to specify it manually for anti_mimikatz structs!)rr+r!get_load_modulesrrr#rrrr TimeDateStampr'rr;r<)r rr r rr/s   zRekallReader.load_modulescCs|jjdg}|jjjddD]}||qt|dkr(|jjdt|dkr2td|d|_ |j |j dS)NzSearching LSASS processz lsass.exe) proc_regexrzAWARNING! Multiple processes matched the filter!! Using first one!rzLSASS.exe not found!) rr;r<r)pslistfilter_processesappendlen Exceptionrr SwitchProcessContext)r taskstaskr r rr*s    zRekallReader.search_lsasscCs\|jD]&}|j|jj}|std|t|j|kr!q|j j d|SdS)NzCant get module! %sz Found module!) rrjr!vtop obj_offsetrqrrrrr;r<)r module_namerprocess_offsetr r r load_modules zRekallReader.load_moduleFc Cs||jvr td||j|}g}tjj|g|jd}|jj d|j |jt |j t |j dD] \}} |t |q9|S)Nz'Module is not in lsass emmory space! %s)needles address_spacezmodule.start_addr %s)rRmaxlen)rr#rqrekallscanMultiStringScannerrr+rr;r<rrr ro) r rwpattern find_first reverse_orderrresscannerhit_r r rfind_in_modules "zRekallReader.find_in_module)NNr)FF)rrrrr0rrBr?r-r,rTrVr^r`rdrfrarPrir/r*ryrr r r rr!s,         r__main__)levelz memory.dmprFzDone!)r;pypykatz.pypykatzrpypykatz.commons.commonrrr basicConfigDEBUGr@readerprintrrIrJKatzSystemInfofrom_rekallreaderr. architecturepstartmimilogon_sessionsluidrr r r rs( ?