o
    Žõ±j�  ã                   @   s&   d dl Z d dlmZ G dd„ dƒZdS )é    N)ÚNTRegistryHeadrc                   @   sP   e Zd Zdd„ ZeddeejB defdd„ƒZ	eddeejB defd	d
„ƒZ
dS )Ú	RegFinderc                 C   s   ddg| _ d d d d dœ| _d S )NÚSystem32Úconfig)ÚSAMÚSECURITYÚSYSTEMÚSOFTWARE)ÚstartdirÚentries)Úself© r   ú’/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/dpapi/finders/registry.pyÚ__init__   s   
üzRegFinder.__init__TÚwindirÚraise_errorc                 C   sö   t | tƒrt | ¡ ¡ } |  ¡ st| › d�ƒ‚tƒ }| }|jD ]}|| }| ¡ s7|r2t|› d�ƒ‚|j	  S q| 
¡ D ];}| ¡ rCq<|j ¡  d¡rP||j	d< |j ¡  d¡r]||j	d< |j ¡  d¡rj||j	d< |j ¡  d¡rw||j	d< q<|j	S )zUSearches for the registry hives in the Windows directory. Do not use on live systems.ú is not a directoryz does not existr   r   r   r	   )Ú
isinstanceÚstrÚpathlibÚPathÚabsoluteÚis_dirÚ
ValueErrorr   r
   r   ÚiterdirÚnameÚupperÚendswith)r   r   ÚfinderÚregdirÚ	directoryÚfilepathr   r   r   Úfrom_windir   s4   


ý



€zRegFinder.from_windirÚreg_dirc                 C   s4  t ƒ }t| tƒrt | ¡ ¡ } |  ¡ s|rt| › d�ƒ‚|jS |  	¡ D ]s}| ¡ r*q#zPt
|dƒ�A}t |¡}|j ¡  d¡rC||jd< |j ¡  d¡rP||jd< |j ¡  d¡r]||jd< |j ¡  d¡rj||jd< W d  ƒ n1 stw   Y  W q# ty– } ztd|› d	|› �ƒ W Y d}~q#d}~ww |jS )
z1Searches for the registry hives in the directory.r   Úrbr   r   r   r	   NzError reading z: )r   r   r   r   r   r   r   r   r   r   Úopenr   ÚreadÚ	file_namer   r   Ú	ExceptionÚprint)r#   r   r   r!   ÚfÚheaderÚer   r   r   Úfrom_dir0   s<   





€÷€€þzRegFinder.from_dirN)T)Ú__name__Ú
__module__Ú__qualname__r   Ústaticmethodr   r   r   Úboolr"   r-   r   r   r   r   r      s    	! r   )r   Úaiowinreg.filestruct.headerr   r   r   r   r   r   Ú<module>   s    