o
    jD                     @   s  d dl mZmZmZ d dlmZmZmZ d dlm	Z	 G dd de	Z
G dd dZG dd	 d	ZG d
d dZG dd dZG dd dZG dd dZG dd deZG dd dZG dd de
ZG dd de
ZG dd de
ZG dd de
ZG dd de
ZG d d! d!e
ZG d"d# d#e
ZG d$d% d%e
ZG d&d' d'e
ZG d(d) d)e
ZG d*d+ d+e
ZG d,d- d-e
ZG d.d/ d/e
ZG d0d1 d1e
Z G d2d3 d3e
Z!G d4d5 d5e
Z"d6e e e e e e e e e d7	e e e e e  e! e" d8d9iZ#d:S );    )ULONGPVOIDPOINTER)KatzSystemArchitectureWindowsMinBuildWindowsBuild)PackageTemplatec                       s4   e Zd Z fddZedd Zedd Z  ZS )LsaTemplate_NT6c                    s.   t  d d | _d | _d | _t| _d| _d S )NzLSA Decryptor6)super__init__key_patternkey_handle_struct
key_structKIWI_HARD_KEYhard_key_structnt_majorself	__class__ /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/alsadecryptor/lsa_template_nt6.pyr      s   
zLsaTemplate_NT6.__init__c                 c   s    | j tjkr1| jtjjkrtd| jtjjkrtdt	d d D ]}t	d d | V  q#d S | j tj
kr_| jtjjkrBtd| jtjjkrMtdt	d d D ]}t	d d | V  qSd S d S )NzNT 5 is not yet supported!nt6x86x64)architecturer   X86buildnumberr   WIN_XPvalue	ExceptionWIN_2K3	templatesX64)sysinfokeyr   r   r   get_template_brute   s$   z"LsaTemplate_NT6.get_template_brutec                 C   sf  t  }| jtjkr| jtjjkrtd| jtj	jkr(d|_
td d d }nttjj| j  kr7tjjk rCn n
td d d }nYtjj| j  krRtjjk r^n n
td d d }n>tjj| j  krmtjjk ryn n
td d d }n#tjj| j  krtjjk rn n
td d d	 }ntjj| j  krtjjkrn n	td d d }ntjj| j  krtjjk rn n	td d d
 }ntd d d }n| jtjkr| jtjjkrtd| jtj	jkrtd| jtjjk rtd d d }n| jtjjk rtd d d }n| jtjjk r@| jtjjk r7| jdk r.td d d }nntd d d }netd d d	 }n\| jtjjk rQtd d d }nKtjj| j  krbtjjk rmn n	td d d
 }n/tjj| j  kr~tjjk rn n	td d d }ntd d d }n
td| j| jf |d|j |d|j |d|j |S )NzMaybe implemented later5nt5r   1r   234r
   7r   i   `89zEMissing LSA decrpytor template for Architecture: %s , Build number %sr   r   r   )r	   r   r   r   r   r   r   r    r!   r"   r   r#   	WIN_VISTAWIN_7WIN_8WIN_BLUEWIN_10r   WIN_10_1507WIN_10_1909r$   msv_dll_timestampWIN_10_1809WIN_11WIN_11_24H2log_templater   r   r   )r%   templater   r   r   get_template+   s^   """"""&&zLsaTemplate_NT6.get_template)__name__
__module____qualname__r   staticmethodr'   r>   __classcell__r   r   r   r   r	      s    	
r	   c                   @      e Zd Zdd ZdS )LSADecyptorKeyPatternc                 C   "   d | _ d | _d | _d | _d | _d S N)	signatureoffset_to_IV_ptr	IV_lengthoffset_to_AES_key_ptroffset_to_DES_key_ptrr   r   r   r   r   z   
   
zLSADecyptorKeyPattern.__init__Nr?   r@   rA   r   r   r   r   r   rE   y       rE   c                   @   s    e Zd Zdd Zedd ZdS )r   c                 C   s   d | _ d | _d S rG   )cbSecretdatar   r   r   r   r      s   
zKIWI_HARD_KEY.__init__c                    s2   t  }t| I d H |_| |jI d H |_|S rG   )KIWI_BCRYPT_KEYr   	loadvaluerP   readrQ   readerresr   r   r   load   s
   zKIWI_HARD_KEY.loadN)r?   r@   rA   r   rB   rX   r   r   r   r   r      s    r   c                   @   (   e Zd Zdd Zedd Zdd ZdS )rR   c                 C   s.   d | _ d | _d | _d | _d | _d | _d | _d S rG   )sizetagtypeunk0unk1unk2hardkeyr   r   r   r   r      s   
zKIWI_BCRYPT_KEY.__init__c                    s   t  }t| I d H |_| dI d H |_t| I d H |_t| I d H |_t| I d H |_t| I d H |_	t
| I d H |_|S N   )rR   r   rS   rZ   rT   r[   r\   r]   r^   r_   r   rX   r`   rU   r   r   r   rX      s   zKIWI_BCRYPT_KEY.loadc                 C   
   | j dkS Ns   KSSMr[   r   r   r   r   verify      
zKIWI_BCRYPT_KEY.verifyNr?   r@   rA   r   rB   rX   rf   r   r   r   r   rR      s
    	
rR   c                   @   rY   )KIWI_BCRYPT_KEY8c                 C   s:   d | _ d | _d | _d | _d | _d | _d | _d | _d | _d S rG   )	rZ   r[   r\   r]   r^   r_   unk3unk4r`   r   r   r   r   r      s   
zKIWI_BCRYPT_KEY8.__init__c                    s   t  }t| I d H |_| dI d H |_t| I d H |_t| I d H |_t| I d H |_t| I d H |_	t| I d H |_
|  I d H  t| I d H |_t| I d H |_|S ra   )ri   r   rS   rZ   rT   r[   r\   r]   r^   r_   rj   alignr   rX   rk   r   r`   rU   r   r   r   rX      s   zKIWI_BCRYPT_KEY8.loadc                 C   rc   rd   re   r   r   r   r   rf      rg   zKIWI_BCRYPT_KEY8.verifyNrh   r   r   r   r   ri      s
    
ri   c                   @   rY   )KIWI_BCRYPT_KEY81c                 C   sX   d | _ d | _d | _d | _d | _d | _d | _d | _d | _d | _	d | _
d | _d | _d | _d S rG   )rZ   r[   r\   r]   r^   r_   rj   rk   unk5unk6unk7unk8unk9r`   r   r   r   r   r      s   
zKIWI_BCRYPT_KEY81.__init__c                    s  t  }t| I d H |_| dI d H |_t| I d H |_t| I d H |_t| I d H |_t| I d H |_	t| I d H |_
t| I d H |_|  I d H  t| I d H |_t| I d H |_t| I d H |_t| I d H |_t| I d H |_t| I d H |_|S ra   )rm   r   rS   rZ   rT   r[   r\   r]   r^   r_   rj   rk   rl   r   rX   rn   ro   rp   rq   rr   r   r`   rU   r   r   r   rX      s$   zKIWI_BCRYPT_KEY81.loadc                 C   rc   rd   re   r   r   r   r   rf      rg   zKIWI_BCRYPT_KEY81.verifyNrh   r   r   r   r   rm      s
    
rm   c                   @   rY   )KIWI_BCRYPT_KEY81_NEWc                 C   s^   d | _ d | _d | _d | _d | _d | _d | _d | _d | _d | _	d | _
d | _d | _d | _d | _d S rG   )rZ   r[   r\   r]   r^   r_   rj   rk   rn   ro   rp   rq   rr   unk10r`   r   r   r   r   r      s   
zKIWI_BCRYPT_KEY81_NEW.__init__c                    s(  t  }t| I d H |_| dI d H |_t| I d H |_t| I d H |_t| I d H |_t| I d H |_	t| I d H |_
t| I d H |_|  I d H  t| I d H |_t| I d H |_t| I d H |_t| I d H |_t| I d H |_t| I d H |_t| I d H |_|S ra   )rs   r   rS   rZ   rT   r[   r\   r]   r^   r_   rj   rk   rl   r   rX   rn   ro   rp   rq   rr   rt   r   r`   rU   r   r   r   rX     s&   zKIWI_BCRYPT_KEY81_NEW.loadc                 C   rc   rd   re   r   r   r   r   rf     rg   zKIWI_BCRYPT_KEY81_NEW.verifyNrh   r   r   r   r   rs      s
    
rs   c                       s(   e Zd Z fddZedd Z  ZS )PKIWI_BCRYPT_KEYc                    s   t    d S rG   )r   r   r   r   r   r   r     s   zPKIWI_BCRYPT_KEY.__init__c                    s,   t  }|  |_|  I d H |_t|_|S rG   )r   telllocation	read_uintr    rR   	finaltype)rV   pr   r   r   rX     s   
zPKIWI_BCRYPT_KEY.load)r?   r@   rA   r   rB   rX   rC   r   r   r   r   ru     s    ru   c                   @   rY   )KIWI_BCRYPT_HANDLE_KEYc                 C   rF   rG   )rZ   r[   
hAlgorithmptr_keyr]   r   r   r   r   r   '  rM   zKIWI_BCRYPT_HANDLE_KEY.__init__c                    sf   t  }t| I d H |_| dI d H |_t| I d H |_t	| I d H |_
t| I d H |_|S ra   )r{   r   rS   rZ   rT   r[   r   rX   r|   ru   r}   r]   rU   r   r   r   rX   .  s   zKIWI_BCRYPT_HANDLE_KEY.loadc                 C   rc   )Ns   RUUUre   r   r   r   r   rf   8  rg   zKIWI_BCRYPT_HANDLE_KEY.verifyNrh   r   r   r   r   r{   &  s
    
	r{   c                   @   rD   )	LSA_x64_1c                 C   J   t |  t | _d| j_d| j_d| j_d| j_d| j_t	| _
t| _d S )N   d$0 DL$HH   ?      r	   r   rE   r   rH   rJ   rI   rL   rK   rR   r   r{   r   r   r   r   r   r   <     

zLSA_x64_1.__init__NrN   r   r   r   r   r~   ;  rO   r~   c                   @   rD   )	LSA_x64_2c                 C   r   )Nr   r   ;   ir   r   r   r   r   r   r   I  r   zLSA_x64_2.__init__NrN   r   r   r   r   r   H  rO   r   c                   @   rD   )	LSA_x64_3c                 C   r   N   d$0 DMHr   >   i   r	   r   rE   r   rH   rJ   rI   rL   rK   ri   r   r{   r   r   r   r   r   r   W  r   zLSA_x64_3.__init__NrN   r   r   r   r   r   V  rO   r   c                   @   rD   )	LSA_x64_4c                 C   r   r   r	   r   rE   r   rH   rJ   rI   rL   rK   rm   r   r{   r   r   r   r   r   r   d  r   zLSA_x64_4.__init__NrN   r   r   r   r   r   c  rO   r   c                   @   rD   )	LSA_x64_5c                 C   J   t |  t | _d| j_d| j_d| j_d| j_d| j_t	| _
t| _d S )N   d$0 HEDMHr   =   ir   r   r   r   r   r   q  r   zLSA_x64_5.__init__NrN   r   r   r   r   r   p  rO   r   c                   @   rD   )	LSA_x64_6c                 C   r   )Nr   r   C   r   r   r   r   r   r   ~  r   zLSA_x64_6.__init__NrN   r   r   r   r   r   }  rO   r   c                   @   rD   )	LSA_x64_7c                 C   r   )Nr   r   :   ir   r   r   r   r   r   r     r   zLSA_x64_7.__init__NrN   r   r   r   r   r     rO   r   c                   @   rD   )	LSA_x64_8c                 C   r   )Nr   r   r   r   r   r   r   r   r   r     r   zLSA_x64_8.__init__NrN   r   r   r   r   r     rO   r   c                   @   rD   )	LSA_x64_9c                 C   r   )Nr   r   G   r   r   r   r   r   r   r     r   zLSA_x64_9.__init__NrN   r   r   r   r   r     rO   r   c                   @   rD   )	LSA_x86_1c                 C   r   N   jjhr      iir   r   r   r   r   r     r   zLSA_x86_1.__init__NrN   r   r   r   r   r     rO   r   c                   @   rD   )	LSA_x86_2c                 C   r   r   r   r   r   r   r   r     r   zLSA_x86_2.__init__NrN   r   r   r   r   r     rO   r   c                   @   rD   )	LSA_x86_3c                 C   r   Nr   r   r   r   ir   r   r   r   r   r     r   zLSA_x86_3.__init__NrN   r   r   r   r   r     rO   r   c                   @   rD   )	LSA_x86_4c                 C   r   r   r   r   r   r   r   r     r   zLSA_x86_4.__init__NrN   r   r   r   r   r     rO   r   c                   @   rD   )	LSA_x86_5c                 C   r   Nr   r   r   iir   r   r   r   r   r     r   zLSA_x86_5.__init__NrN   r   r   r   r   r     rO   r   c                   @   rD   )	LSA_x86_6c                 C   r   r   r   r   r   r   r   r        

zLSA_x86_6.__init__NrN   r   r   r   r   r     rO   r   c                   @   rD   )	LSA_x86_7c                 C   r   r   )r	   r   rE   r   rH   rJ   rI   rL   rK   rs   r   r{   r   r   r   r   r   r     r   zLSA_x86_7.__init__NrN   r   r   r   r   r      rO   r   r   )	r*   r+   r,   r-   r(   r
   r.   r/   r0   )r*   r+   r,   r-   r(   r
   r.   )r   r   N)$$pypykatz.alsadecryptor.win_datatypesr   r   r   pypykatz.commons.commonr   r   r   &pypykatz.alsadecryptor.package_commonsr   r	   rE   r   rR   ri   rm   rs   ru   r{   r~   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r#   r   r   r   r   <module>   sb   m*+