o
    j$                     @   s   d dl Z d dlZd dlmZ d dlmZ G dd dZG dd dZG dd	 d	ZG d
d dZ	G dd dZ
G dd dZG dd dZG dd dZdS )    N)GUID)
DPAPI_BLOBc                   @   4   e Zd Zdd Zedd Zedd Zdd Zd	S )
VAULT_ATTRIBUTE_MAP_ENTRYc                 C   s   d | _ d | _d | _d S N)idoffsetunk0self r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/dpapi/structures/vault.py__init__   s   
z"VAULT_ATTRIBUTE_MAP_ENTRY.__init__c                 C      t t| S r   )r   from_bufferioBytesIOdatar   r   r   
from_bytes      z$VAULT_ATTRIBUTE_MAP_ENTRY.from_bytesc                 C   sR   t  }tj| dddd|_tj| dddd|_tj| dddd|_|S N   littleFsigned)r   intr   readr   r   r	   buffskr   r   r   r      s
   z%VAULT_ATTRIBUTE_MAP_ENTRY.from_bufferc                 C   n   d}| j D ]/}t| j | tr't| j | D ]\}}|d||t|f 7 }qq|d|t| j | f 7 }q|S )Nz!== VAULT_ATTRIBUTE_MAP_ENTRY ==
   %s: %s: %s	%s: %s 
__dict__
isinstancelist	enumeratestrr   tkiitemr   r   r   __str__      
z!VAULT_ATTRIBUTE_MAP_ENTRY.__str__N__name__
__module____qualname__r   staticmethodr   r   r/   r   r   r   r   r      s    

r   c                   @   r   )
VAULT_ATTRIBUTEc                 C   F   d | _ d | _d | _d | _d | _d | _d | _d | _d | _d | _	d | _
d S r   )r   r	   unk1unk2paddingunk3size
iv_presentiv_sizeivr   r
   r   r   r   r   )   s   
zVAULT_ATTRIBUTE.__init__c                 C   r   r   )r6   r   r   r   r   r   r   r   r   8   r   zVAULT_ATTRIBUTE.from_bytesc                 C   s|  |   }| dd |   | }| |d t }tj| dddd|_tj| dddd|_tj| dddd|_tj| dddd|_	|dkru|   }| d	}|d
kr^||_
n| |d |jdkrutj| dddd|_|dkrtj| dddd|_t| dd |_|jrtj| dddd|_| |j|_| |j|jd  |_|S | |jd |_|S )N   r   r   r   Fr         s         d            )tellseekr6   r   r   r   r   r	   r8   r9   r:   r;   r<   boolr=   r>   r?   r   )r   posr<   r    testr   r   r   r   <   s6   

zVAULT_ATTRIBUTE.from_bufferc                 C   r!   )Nz== VAULT_ATTRIBUTE ==
r"   r#   r$   r*   r   r   r   r/   `   r0   zVAULT_ATTRIBUTE.__str__Nr1   r   r   r   r   r6   (   s    

#r6   c                   @   s8   e Zd ZdZdd Zedd Zedd Zdd	 Zd
S )
VAULT_VCRDz
	c                 C   sF   d | _ d | _d | _d | _d | _d | _d | _d | _d | _g | _	g | _
d S r   )schema_guidr	   last_writtenr8   r9   friendlyname_lengthfriendlynameattribute_maps_lengthattribute_mapsvames
attributesr
   r   r   r   r   n   s   
zVAULT_VCRD.__init__c                 C   r   r   )rM   r   r   r   r   r   r   r   r   |   r   zVAULT_VCRD.from_bytesc                 C   s  t  }t| j|_tj| dddd|_tj| dddd|_tj| dddd|_	tj| dddd|_
tj| dddd|_| |j|_|jdkr_z	|jd|_W n   Y tj| dddd|_| |j|_g |_t|j}t|jd D ]}t|}|j| qd}|t|jd	 k r| |j| j | |j|d	  j|j| j }t|}|j| |d	7 }|t|jd	 k st| }|j| |S )
Nr   r   Fr      r   z	utf-16-le   rF   )rM   r   valuerN   r   r   r   r	   rO   r8   r9   rP   rQ   decoderR   rS   rU   r   r   ranger   r   rT   appendlenrI   r   r6   )r   r    db_vamer-   r   var   r   r   r      s>   

"

zVAULT_VCRD.from_bufferc                 C   r!   )Nz== VAULT_VCRD ==
r"   r#   r$   r*   r   r   r   r/      r0   zVAULT_VCRD.__str__N)	r2   r3   r4   __doc__r   r5   r   r   r/   r   r   r   r   rM   k   s    

#rM   c                   @   r   )

VAULT_VPOLc                 C   r7   r   )versionguiddescription_lengthdescriptionr	   r<   guid2guid3key_sizeblobblobdatar
   r   r   r   r      s   
zVAULT_VPOL.__init__c                 C   r   r   )rb   r   r   r   r   r   r   r   r      r   zVAULT_VPOL.from_bytesc                 C   s   t  }tj| dddd|_t| j|_tj| dddd|_| |j|_	| d|_
tj| dddd|_t| j|_t| j|_tj| dddd|_| |j|_t|j|_|S )Nr   r   Fr   rW   )rb   r   r   r   rc   r   rX   rd   re   rf   r	   r<   rg   rh   ri   rk   r   rj   r   r   r   r   r      s   zVAULT_VPOL.from_bufferc                 C   r!   )Nz== VAULT_VPOL ==
r"   r#   r$   r*   r   r   r   r/      r0   zVAULT_VPOL.__str__Nr1   r   r   r   r   rb      s    

rb   c                   @   r   )
VAULT_VPOL_KEYSc                 C   s   d | _ d | _d S r   )key1key2r
   r   r   r   r      s   
zVAULT_VPOL_KEYS.__init__c                 C   r   r   )rl   r   r   r   r   r   r   r   r      r   zVAULT_VPOL_KEYS.from_bytesc                 C   sx   t  }g }tdD ]&}| d}| dd |dks|dkr'|t|  q	|t|  q	|d |_|d |_	|S )NrA   rF   r@      $   4r   )
rl   rZ   r   rI   r[   KDBMr   KSSMrm   rn   )r   r    resr^   rL   r   r   r   r      s   


zVAULT_VPOL_KEYS.from_bufferc                 C   r!   )Nz== VAULT_VPOL_KEYS ==
r"   r#   r$   r*   r   r   r   r/      r0   zVAULT_VPOL_KEYS.__str__Nr1   r   r   r   r   rl      s    

rl   c                   @   <   e Zd Zdd Zdd Zedd Zedd Zd	d
 ZdS )rq   c                 C      d | _ d | _d | _d | _d S r   r<   rc   r	   keyblobr
   r   r   r   r         
zKDBM.__init__c                 C   s   | j jS r   )rw   keyr
   r   r   r   get_key  s   zKDBM.get_keyc                 C   r   r   )rq   r   r   r   r   r   r   r   r     r   zKDBM.from_bytesc                 C   sv   ddl m} t }tj| dddd|_tj| dddd|_tj| dddd|_t	| |jd |_
|S )Nr   )hexdumpr   r   Fr   rV   )pypykatz.commons.commonr{   rq   r   r   r   r<   rc   r	   BCRYPT_KEY_DATA_BLOB_HEADERrw   )r   r{   r    r   r   r   r     s   zKDBM.from_bufferc                 C   r!   )Nz== KDBM ==
r"   r#   r$   r*   r   r   r   r/     r0   zKDBM.__str__N	r2   r3   r4   r   rz   r5   r   r   r/   r   r   r   r   rq          

	rq   c                   @   rt   )rr   c                 C   ru   r   rv   r
   r   r   r   r      rx   zKSSM.__init__c                 C   s   | j S r   )rw   r
   r   r   r   rz   &  s   zKSSM.get_keyc                 C   r   r   )rr   r   r   r   r   r   r   r   r   )  r   zKSSM.from_bytesc                 C   sd   t  }tj| dddd|_tj| dddd|_tj| dddd|_| |jd |_|S )Nr   r   Fr   rV   )rr   r   r   r   r<   rc   r	   rw   r   r   r   r   r   -  s   zKSSM.from_bufferc                 C   r!   )Nz== KSSM ==
r"   r#   r$   r*   r   r   r   r/   7  r0   zKSSM.__str__Nr~   r   r   r   r   rr     r   rr   c                   @   r   )
r}   c                 C   ru   r   )magicrc   key_datary   r
   r   r   r   r   B  rx   z$BCRYPT_KEY_DATA_BLOB_HEADER.__init__c                 C   r   r   )r}   r   r   r   r   r   r   r   r   H  r   z&BCRYPT_KEY_DATA_BLOB_HEADER.from_bytesc                 C   s`   t  }tj| dddd|_tj| dddd|_tj| dddd|_| |j|_|S r   )r}   r   r   r   r   rc   r   ry   r   r   r   r   r   L  s   z'BCRYPT_KEY_DATA_BLOB_HEADER.from_bufferc                 C   r!   )Nz#== BCRYPT_KEY_DATA_BLOB_HEADER ==
r"   r#   r$   r*   r   r   r   r/   V  r0   z#BCRYPT_KEY_DATA_BLOB_HEADER.__str__Nr1   r   r   r   r   r}   A  s    

	r}   )r   enumpypykatz.commons.win_datatypesr   pypykatz.dpapi.structures.blobr   r   r6   rM   rb   rl   rq   rr   r}   r   r   r   r   <module>   s   CC-"""