o
    j                 
   @   s  d Z ddlT ddlT dZee  ZdZdZdZ	dZ
dZd	Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!dZ"d Z#d!Z$d"Z%d#Z&d$Z'd%Z(d&Z)dZ*d'Z+d(Z,d)Z-d*Z.dZ/d'Z0dZ1d'Z2d(Z3d+Z4d,Z5d*Z.d-Z6d.Z7d/Z8e9e4B Z:e;e1B e2B e3B e4B e5B e.B e6B e7B e8B Z<d)Z=d0Z>d1Z?d2Z@d3ZAd4ZBd5ZCd*ZDd(ZEd+ZFd6ZGd,ZHdZId6ZJd'ZKd7ZLd/ZMd8ZNd9ZOdZPd'ZQd:ZRd(ZSeSZTd;ZUd<ZVd=ZWd+ZXd>ZYd?ZZd@Z[e[Z\G dAdB dBe]Z^e_e^Z`G dCdD dDe]ZaG dEdF dFe]Zbe_ebZcedjeZfdZgd'Zhd:Zid(Zjd;Zkd<Zld=Zmd+Znd>Zod?Zpd@ZqdGZrdHZsdIZtdJZud,ZvdKZwdLZxdMZydNZzdOZ{dPZ|dQZ}dRZ~dSZdTZdUZdVZdWZdXZdYZd*ZdZZd[Zd\Zd]Zd^Zd_Zd`ZdaZdbZedjeZe_eZdZd'ZdZd'Zd:ZedjeZe_eZd9ZdZd'Zd:ZedjeZe_eZG dcdd dde]Ze_eZG dedf dfe]Ze_eZG dgdh dhe]Ze_eZG didj dje]Ze_eZG dkdl dle]Ze_eZG dmdn dne]Ze_eZG dodp dpe]Ze_eZG dqdr dre]Ze_eZG dsdt dte]Ze_eZdZd'Zd:Zd(Zd;Zd<Zd=Zd+Zd>Zd?Zd,Zd.ZdZeZdZd'Zd(ZeeB eB ZeZeZdZd'Zd:Zd(Zd;Zd<Zd=Zd+Zd>Zd?Zd@ZeZdZd'Zd:Zd(Zd;Zd<Zd=Zd+Zd>Zd?Zd@ZG dudv dve]ZG dwdx dxe]ZG dydz dzeZG d{d| d|e]Ze_eZG d}d~ d~eZG dd deZeZdZd'ZdZd9ZdZdZdZdZeZdZd'Zd:Zd(Zd;ZdZd'Zd(Zd+ZdJZeZdZdZdZdZ dZdZdZedjeZd9ZedjeZd9ZdZdZ	d'Z
d(Zd+Zd,Zd*Zd-Zd.Zd/Zd5ZdZd'Zd(Zd+Zd,Zd*Zd9ZdZd'Zd:Zd(Zd9ZdZd'Z d:Z!dZ"d'Z#d:Z$dZ%d'Z&d(Z'd+Z(d,Z)d*Z*d/Z+d@Z,dZ-dZ.d'Z/d:Z0d(Z1d;Z2d<Z3d=Z4dZ5d'Z6d(Z7d+Z8d,Z9d*Z:d-Z;d.Z<d/Z=dZ>dZ?d'Z@d:ZAd(ZBd;ZCd<ZDd=ZEd+ZFd>ZGd?ZHd@ZIdGZJdHZKdIZLdZ5d'Z6d(Z7d+Z8d,Z9d*Z:d-Z;d.Z<d/Z=d7ZMdZNdZOd9ZPdZQd'ZRd:ZSdZTd'ZUG dd de]ZVe_eVZWG dd de]ZXe_eXZYG dd de]ZZG dd de]Z[e_eZZ\e_e[Z]G dd de]Z^G dd de]Z_e_e^Z`e_e_ZaG dd deZbG dd deZcG dd deZdG dd deZeG dd deZfG dd degZhG dd degZiG dd degZjG dd degZkdd Zldd ZmenelemZodd Zpdd ZqerepeqZsdd Ztdd ZuereteuZvdd Zwdd ZxenewexZydd Zzdd Z{ereze{Z|dd Z}dd Z~ddĄ ZddƄ ZddȄ Ze<fddʄZdsdd̈́ZefddτZe<deefddфZddӄ ZddՄ Zddׄ ZereeZddل Zddۄ ZereeZdtddބZdd Zdd Zdd ZduddZeeZeneeZdvddZeeZeneeZdwddZdwddZereeZeeĐeeŐeeeZdxddZdedefddZdd Zeed9fddZdyddZdd ZdzddZeZdd Zde?fdd Zde?fddZereeZe?dfddZe?dfddZereeZe?dfddZe?dfd	d
ZereeZe?deCfddZe?deCfddZereeZeCfddZeCfddZd{ddZd{ddZereeZd|ddZdd Zd|ddZd|ddZereeZd}dd Ze ZZd!d" Zd#d$ ZÐeneeÃZĐdsd%d&ZŐdsd'd(ZƐdsd)d*ZǐeneƐeǃZȐd{d+d,Zɐd{d-d.ZʐereɐeʃZːd~d/d0Z̐d~d1d2Z͐ere̐e̓Zΐd{d3d4Zϐd{d5d6ZАereϐeЃZdeLfd7d8ZdeLfd9d:ZӐereҐeӃZԐd;d< ZՐd=d> Z֐ereՐeփZאd{d?d@Zؐd{dAdBZِereؐeكZڐdCdD ZېdEdF ZddefdGdHZddefdIdJZސereݐeރZߐefdKdLZefdMdNZereeZdee)eedddddf
dOdPZdee)eedddddf
dQdRZereeZdSdT ZdUdV ZdWdX ZereeZdYdZ Zd[d\ ZereeZd{d]d^Zd{d_d`ZereeZdadb Zdcdd ZefdedfZe,e-B e$fdgdhZe,e-B e$fdidjZeneeZee,e-B e$dfdkdlZee,e-B e$dfdmdnZeneeZd{dodpZee  eZdqdr eD Ze  dS (  z%
Wrapper for advapi32.dll in ctypes.
   )*NSeAssignPrimaryTokenPrivilegeSeAuditPrivilegeSeBackupPrivilegeSeChangeNotifyPrivilegeSeCreateGlobalPrivilegeSeCreatePagefilePrivilegeSeCreatePermanentPrivilegeSeCreateSymbolicLinkPrivilegeSeCreateTokenPrivilegeSeDebugPrivilegeSeEnableDelegationPrivilegeSeImpersonatePrivilegeSeIncreaseBasePriorityPrivilegeSeIncreaseQuotaPrivilegeSeIncreaseWorkingSetPrivilegeSeLoadDriverPrivilegeSeLockMemoryPrivilegeSeMachineAccountPrivilegeSeManageVolumePrivilegeSeProfileSingleProcessPrivilegeSeRelabelPrivilegeSeRemoteShutdownPrivilegeSeRestorePrivilegeSeSecurityPrivilegeSeShutdownPrivilegeSeSyncAgentPrivilegeSeSystemEnvironmentPrivilegeSeSystemProfilePrivilegeSeSystemtimePrivilegeSeTakeOwnershipPrivilegeSeTcbPrivilegeSeTimeZonePrivilegeSeTrustedCredManAccessPrivilegeSeUndockPrivilegeSeUnsolicitedInputPrivilege      l                  @         l       l       l       l       l       i?  i     i                  	   
      c                   @      e Zd ZdefdefgZdS )LUIDLowPartHighPartN)__name__
__module____qualname__DWORDLONG_fields_ rA   rA   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/readers/local/common/advapi32.pyr8          r8   c                   @   r7   )LUID_AND_ATTRIBUTESLuid
AttributesN)r;   r<   r=   r8   r>   r@   rA   rA   rA   rB   rD      rC   rD   c                   @   r7   )TOKEN_PRIVILEGESPrivilegeCount
PrivilegesN)r;   r<   r=   r>   rD   r@   rA   rA   rA   rB   rG      s    rG                                                            !   "   #   $   %   &   '   (   )   c                   @   r7   )SID_AND_ATTRIBUTESSidrF   N)r;   r<   r=   PSIDr>   r@   rA   rA   rA   rB   rf   D  rC   rf   c                   @      e Zd ZdefgZdS )
TOKEN_USERUserNr;   r<   r=   rf   r@   rA   rA   rA   rB   rj   N      rj   c                   @   ri   )TOKEN_MANDATORY_LABELLabelNrl   rA   rA   rA   rB   rn   W  rm   rn   c                   @   ri   )TOKEN_OWNEROwnerNr;   r<   r=   rh   r@   rA   rA   rA   rB   rp   `  rm   rp   c                   @   ri   )TOKEN_PRIMARY_GROUPPrimaryGroupNrr   rA   rA   rA   rB   rs   i  rm   rs   c                   @   ri   )TOKEN_APPCONTAINER_INFORMATIONTokenAppContainerNrr   rA   rA   rA   rB   ru   r  rm   ru   c                   @   ri   )TOKEN_ORIGINOriginatingLogonSessionN)r;   r<   r=   r8   r@   rA   rA   rA   rB   rw   {  rm   rw   c                   @   ri   )TOKEN_LINKED_TOKENLinkedTokenN)r;   r<   r=   HANDLEr@   rA   rA   rA   rB   ry     rm   ry   c                   @   sL   e Zd Zdefdefdefdefdefdefdefdefd	efd
efg
ZdS )TOKEN_STATISTICSTokenIdAuthenticationIdExpirationTime	TokenTypeImpersonationLevelDynamicChargedDynamicAvailable
GroupCountrH   
ModifiedIdN)	r;   r<   r=   r8   LONGLONG
TOKEN_TYPESECURITY_IMPERSONATION_LEVELr>   r@   rA   rA   rA   rB   r|     s    r|   c                   @   s&   e Zd Zdee fdefdefgZdS )_WAITCHAIN_NODE_INFO_STRUCT_1
ObjectNameTimeout	AlertableN)r;   r<   r=   WCHARWCT_OBJNAME_LENGTHr   BOOLr@   rA   rA   rA   rB   r     s
    
r   c                   @   s(   e Zd ZdefdefdefdefgZdS )_WAITCHAIN_NODE_INFO_STRUCT_2	ProcessIdThreadIdWaitTimeContextSwitchesNr;   r<   r=   r>   r@   rA   rA   rA   rB   r     s    r   c                   @   r7   )_WAITCHAIN_NODE_INFO_UNION
LockObjectThreadObjectN)r;   r<   r=   r   r   r@   rA   rA   rA   rB   r   '  rC   r   c                   @   s"   e Zd ZdefdefdefgZdS )WAITCHAIN_NODE_INFO
ObjectTypeObjectStatusuN)r;   r<   r=   WCT_OBJECT_TYPEWCT_OBJECT_STATUSr   r@   rA   rA   rA   rB   r   -  
    r   c                   @      e Zd ZdZdd ZdS )WaitChainNodeInfoa  
	Represents a node in the wait chain.

	It's a wrapper on the L{WAITCHAIN_NODE_INFO} structure.

	The following members are defined only
	if the node is of L{WctThreadType} type:
	 - C{ProcessId}
	 - C{ThreadId}
	 - C{WaitTime}
	 - C{ContextSwitches}

	@see: L{GetThreadWaitChain}

	@type ObjectName: unicode
	@ivar ObjectName: Object name. May be an empty string.

	@type ObjectType: int
	@ivar ObjectType: Object type.
		Should be one of the following values:
		 - L{WctCriticalSectionType}
		 - L{WctSendMessageType}
		 - L{WctMutexType}
		 - L{WctAlpcType}
		 - L{WctComType}
		 - L{WctThreadWaitType}
		 - L{WctProcessWaitType}
		 - L{WctThreadType}
		 - L{WctComActivationType}
		 - L{WctUnknownType}

	@type ObjectStatus: int
	@ivar ObjectStatus: Wait status.
		Should be one of the following values:
		 - L{WctStatusNoAccess} I{(ACCESS_DENIED for this object)}
		 - L{WctStatusRunning} I{(Thread status)}
		 - L{WctStatusBlocked} I{(Thread status)}
		 - L{WctStatusPidOnly} I{(Thread status)}
		 - L{WctStatusPidOnlyRpcss} I{(Thread status)}
		 - L{WctStatusOwned} I{(Dispatcher object status)}
		 - L{WctStatusNotOwned} I{(Dispatcher object status)}
		 - L{WctStatusAbandoned} I{(Dispatcher object status)}
		 - L{WctStatusUnknown} I{(All objects)}
		 - L{WctStatusError} I{(All objects)}

	@type ProcessId: int
	@ivar ProcessId: Process global ID.

	@type ThreadId: int
	@ivar ThreadId: Thread global ID.

	@type WaitTime: int
	@ivar WaitTime: Wait time.

	@type ContextSwitches: int
	@ivar ContextSwitches: Number of context switches.
	c                 C   sf   |j | _ |j| _| j tkr*|jjj| _|jjj| _|jjj| _|jjj| _d| _	d S |jj
j	j| _	d S N )r   r   WctThreadTyper   r   r   r   r   r   r   r   value)self
aStructurerA   rA   rB   __init__y  s   

zWaitChainNodeInfo.__init__Nr;   r<   r=   __doc__r   rA   rA   rA   rB   r   6  s    Br   c                       sT   e Zd ZdZd fdd	Zdd Zdd Zdd	d
Zedd Z	edd Z
  ZS )ThreadWaitChainSessionHANDLEzd
	Thread wait chain session handle.

	Returned by L{OpenThreadWaitChainSession}.

	@see: L{HANDLE}
	Nc                    s   t t| j|dd dS )z?
		@type  aHANDLE: int
		@param aHANDLE: Win32 handle value.
		T
bOwnershipN)superr   r   )r   aHANDLE	__class__rA   rB   r     s   
z%ThreadWaitChainSessionHANDLE.__init__c                 C   s    | j d u r	tdt| j  d S )NzHANDLE was already closed!)r   
ValueErrorCloseThreadWaitChainSessionr   rA   rA   rB   _close  s   
z#ThreadWaitChainSessionHANDLE._closec                 C      t  NNotImplementedErrorr   rA   rA   rB   dup     z ThreadWaitChainSessionHANDLE.dupc                 C   r   r   r   )r   dwMillisecondsrA   rA   rB   wait  r   z!ThreadWaitChainSessionHANDLE.waitc                 C      dS NFrA   r   rA   rA   rB   inherit     z$ThreadWaitChainSessionHANDLE.inheritc                 C   r   r   rA   r   rA   rA   rB   protectFromClose  r   z-ThreadWaitChainSessionHANDLE.protectFromCloser   )r;   r<   r=   r   r   r   r   r   propertyr   r   __classcell__rA   rA   r   rB   r     s    

r   i      i   i   ServicesActiveServicesFailed+l    i 0      i   c                   @   s:   e Zd ZdefdefdefdefdefdefdefgZdS )	SERVICE_STATUSdwServiceTypedwCurrentStatedwControlsAccepteddwWin32ExitCodedwServiceSpecificExitCodedwCheckPoint
dwWaitHintNr   rA   rA   rA   rB   r   [  s    r   c                   @   s"   e Zd Zejdefdefg ZdS )SERVICE_STATUS_PROCESSdwProcessIddwServiceFlagsN)r;   r<   r=   r   r@   r>   rA   rA   rA   rB   r   r  s
    
r   c                   @   "   e Zd ZdefdefdefgZdS )ENUM_SERVICE_STATUSAlpServiceNamelpDisplayNameServiceStatusN)r;   r<   r=   LPSTRr   r@   rA   rA   rA   rB   r   ~  r   r   c                   @   r   )ENUM_SERVICE_STATUSWr   r   r   N)r;   r<   r=   LPWSTRr   r@   rA   rA   rA   rB   r     r   r   c                   @   r   )ENUM_SERVICE_STATUS_PROCESSAr   r   ServiceStatusProcessN)r;   r<   r=   r   r   r@   rA   rA   rA   rB   r     r   r   c                   @   r   )ENUM_SERVICE_STATUS_PROCESSWr   r   r   N)r;   r<   r=   r   r   r@   rA   rA   rA   rB   r     r   r   c                   @   r   )r   z0
	Wrapper for the L{SERVICE_STATUS} structure.
	c                 C   s<   |j | _|j| _|j| _|j| _|j| _	|j
| _|j| _dS )z]
		@type  raw: L{SERVICE_STATUS}
		@param raw: Raw structure for this service status data.
		N)r   ServiceTyper   CurrentStater   ControlsAcceptedr   Win32ExitCoder   ServiceSpecificExitCoder   
CheckPointr   WaitHintr   rawrA   rA   rB   r     s   zServiceStatus.__init__Nr   rA   rA   rA   rB   r         r   c                   @   r   )r   z8
	Wrapper for the L{SERVICE_STATUS_PROCESS} structure.
	c                 C   sL   |j | _|j| _|j| _|j| _|j| _	|j
| _|j| _|j| _|j| _dS )ze
		@type  raw: L{SERVICE_STATUS_PROCESS}
		@param raw: Raw structure for this service status data.
		N)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   ServiceFlagsr   rA   rA   rB   r     s   zServiceStatusProcess.__init__Nr   rA   rA   rA   rB   r     r   r   c                   @       e Zd ZdZdd Zdd ZdS )ServiceStatusEntryz;
	Service status entry returned by L{EnumServicesStatus}.
	c                 C   sZ   |j | _|j| _|jj| _|jj| _|jj	| _
|jj| _|jj| _|jj| _|jj| _dS )z
		@type  raw: L{ENUM_SERVICE_STATUSA} or L{ENUM_SERVICE_STATUSW}
		@param raw: Raw structure for this service status entry.
		N)r   ServiceNamer   DisplayNamer   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   rA   rA   rB   r     s   





zServiceStatusEntry.__init__c                 C   s   g }| j t@ r|d n|d | jr!|d| j| jf  n|d| j  | jtkr4|d nA| jtkr?|d n6| jtkrJ|d n+| jt	krU|d n | jt
kr`|d	 n| jtkrk|d
 n
| jtkru|d d|S )NzInteractive serviceService	"%s" (%s)"%s"zis about to continue.zis pausing.z
is paused.zis running.zis starting.zis stopping.zis stopped. )r   SERVICE_INTERACTIVE_PROCESSappendr   r   r   SERVICE_CONTINUE_PENDINGSERVICE_PAUSE_PENDINGSERVICE_PAUSEDSERVICE_RUNNINGSERVICE_START_PENDINGSERVICE_STOP_PENDINGSERVICE_STOPPEDjoinr   outputrA   rA   rB   __str__  s,   










zServiceStatusEntry.__str__Nr;   r<   r=   r   r   r   rA   rA   rA   rB   r     s    r   c                   @   r   )ServiceStatusProcessEntryz=
	Service status entry returned by L{EnumServicesStatusEx}.
	c                 C   sn   |j | _|j| _|jj| _|jj| _|jj	| _
|jj| _|jj| _|jj| _|jj| _|jj| _|jj| _dS )z
		@type  raw: L{ENUM_SERVICE_STATUS_PROCESSA} or L{ENUM_SERVICE_STATUS_PROCESSW}
		@param raw: Raw structure for this service status entry.
		N)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   rA   rA   rB   r     s   







z"ServiceStatusProcessEntry.__init__c                 C   s  g }| j t@ r|d n|d | jr!|d| j| jf  n|d| j  | jtkr4|d nA| jtkr?|d n6| jtkrJ|d n+| jt	krU|d n | jt
kr`|d	 n| jtkrk|d
 n
| jtkru|d | jr|d| j  |d d|S )NzInteractive service zService r   r   z is about to continuez is pausingz
 is pausedz is runningz is startingz is stoppingz is stoppedz at process %d.r   )r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   rA   rA   rB   r     s2   











z!ServiceStatusProcessEntry.__str__Nr  rA   rA   rA   rB   r    s    r  c                   @   s   e Zd ZdZdS )TokenHandlez*
	Access token handle.

	@see: L{HANDLE}
	N)r;   r<   r=   r   rA   rA   rA   rB   r  +  s    r  c                   @      e Zd ZdZeZdd ZdS )RegistryKeyHandlez
	Registry key handle.
	c                 C      t | j d S r   )RegCloseKeyr   r   rA   rA   rB   r   :     zRegistryKeyHandle._closeN)r;   r<   r=   r   HKEY_TYPEr   rA   rA   rA   rB   r  3  s    r  c                   @   r  )SaferLevelHandlez_
	Safer level handle.

	@see: U{http://msdn.microsoft.com/en-us/library/ms722425(VS.85).aspx}
	c                 C   r  r   )SaferCloseLevelr   r   rA   rA   rB   r   F  r	  zSaferLevelHandle._closeN)r;   r<   r=   r   SAFER_LEVEL_HANDLEr  r   rA   rA   rA   rB   r  =      r  c                   @   r  )ServiceHandlezm
	Service handle.

	@see: U{http://msdn.microsoft.com/en-us/library/windows/desktop/ms684330(v=vs.85).aspx}
	c                 C   r  r   CloseServiceHANDLEr   r   rA   rA   rB   r   R  r	  zServiceHandle._closeNr;   r<   r=   r   	SC_HANDLEr  r   rA   rA   rA   rB   r  I  r  r  c                   @   r  )ServiceControlManagerHandlez
	Service Control Manager (SCM) handle.

	@see: U{http://msdn.microsoft.com/en-us/library/windows/desktop/ms684323(v=vs.85).aspx}
	c                 C   r  r   r  r   rA   rA   rB   r   ^  r	  z"ServiceControlManagerHandle._closeNr  rA   rA   rA   rB   r  U  r  r  c                  C   x   t jj} ttg| _t| _td}| d t	| t
 }|tkr#t|td|jd }| |t	|}|s9t |jS Nr/   r   r   )windlladvapi32GetUserNameAr   LPDWORDargtypesboolrestyper>   byrefGetLastErrorERROR_INSUFFICIENT_BUFFERctypesWinErrorcreate_string_bufferr   )_GetUserNameAnSizeerrorlpBuffersuccessrA   rA   rB   r  g     

r  c                  C   r  r  )r  r  GetUserNameWr   r  r  r  r  r>   r  r   r!  r"  r#  create_unicode_bufferr   )_GetUserNameWr&  r'  r(  r)  rA   rA   rB   r+  w  r*  r+  c              	   C   s   t jj}tttttttg|_t|_t	d}t	d}t	d}|| |d t
|d t
|t
| t }|tkr9t|td|j}tt|t}td|jd }	|| ||t
||	t
|t
|}
|
sht ||	j|jfS r  )r  r  LookupAccountNameAr   rh   r  r  r   r  r>   r  r   r!  r"  r#  r$  r   castpointer)lpSystemNamelpAccountName_LookupAccountNameAcbSidcchReferencedDomainNamepeUser'  sidpsidlpReferencedDomainNamer)  rA   rA   rB   r.    "    
 r.  c              	   C   s   t jj}tttttttg|_t|_t	d}t	d}t	d}|| |d t
|d t
|t
| t }|tkr9t|td|j}tt|t}td|jd }	|| ||t
||	t
|t
|}
|
sht ||	j|jfS r  )r  r  LookupAccountNameWr   rh   r  r  r   r  r>   r  r   r!  r"  r#  r$  r   r/  r0  r,  )r1  r2  _LookupAccountNameWr4  r5  r6  r'  r7  r8  r9  r)  rA   rA   rB   r;    r:  r;  c           
   	   C   s   t jj}tttttttg|_t|_t	d}t	d}t	d}|| |d t
|d t
|t
| t }|tkr9t|td|d }td|d }|| ||t
||t
|t
|}	|	s_t |j|j|jfS r  )r  r  LookupAccountSidAr   rh   r  r  r  r  r>   r  r   r!  r"  r#  r$  r   )
r1  lpSid_LookupAccountSidAcchNamer5  r6  r'  lpNamer9  r)  rA   rA   rB   r=    s     
 r=  c           
   	   C   s   t jj}tttttttg|_t|_	t
d}t
d}t
d}|| |d t|d t|t| t }|tkr9t|td|jd }td|jd }|| ||t||t|t|}	|	sat |j|j|jfS r  )r  r  LookupAccountSidWr   rh   r   r  r  r  r  r>   r  r   r!  r"  r#  r,  r   )
r1  r>  _LookupAccountSidWr@  r5  r6  r'  rA  r9  r)  rA   rA   rB   rB    s     
 rB  c                 C   sZ   t jj}tttg|_t|_t	|_
t }|| t| z|j}W t| | S t| w r   )r  r  ConvertSidToStringSidArh   POINTERr   r  r  r  RaiseIfZeroerrcheckr  r   	LocalFreedecode)rg   _ConvertSidToStringSidA
pStringSid	StringSidrA   rA   rB   rD    s   
rD  c                 C   sV   t jj}tttg|_t|_t	|_
t }|| t| z
|j}W t| |S t| w r   )r  r  ConvertSidToStringSidWrh   rE  r   r  r  r  rF  rG  r  r   rH  )rg   _ConvertSidToStringSidWrK  rL  rA   rA   rB   rM    s   
rM  c                 C   :   t jj}ttg|_t|_t|_	t }|| t
| |jS r   )r  r  ConvertStringSidToSidAr   PVOIDr  r  r  rF  rG  r"  r0  r   )rL  _ConvertStringSidToSidArg   rA   rA   rB   rP       
rP  c                 C   rO  r   )r  r  ConvertStringSidToSidWr   rQ  r  r  r  rF  rG  r"  r0  r   )rL  _ConvertStringSidToSidWrg   rA   rA   rB   rT    rS  rT  c                 C      t jj}tg|_t|_|| S r   )r  r  
IsValidSidrh   r  r  r  )pSid_IsValidSidrA   rA   rB   rW  ,     rW  c                 C   s"   t jj}ttg|_t|_|| |S r   )r  r  EqualSidrh   r  r  r  )pSid1pSid2	_EqualSidrA   rA   rB   r[  6  s   

r[  c                 C   rV  r   )r  r  GetLengthSidrh   r  r>   r  )rX  _GetLengthSidrA   rA   rB   r_  ?  rZ  r_  c                 C   s^   t jj}tttg|_t|_t	|_
t| }td|}tt|t}||||  t|tS r   )r  r  CopySidr>   rQ  rh   r  r  r  rF  rG  r_  r"  r$  r/  r0  )
pSourceSid_CopySidnDestinationSidLengthDestinationSidpDestinationSidrA   rA   rB   ra  J  s   ra  c                 C   s(   t jj}tg|_t|_t|_||  d S r   )r  r  FreeSidrh   r  r  RaiseIfNotZerorG  )rX  _FreeSidrA   rA   rB   rg  Y  
   rg  c                 C   B   t jj}tttg|_t|_t	|_
tt}|| |t| t|jS r   )r  r  OpenProcessTokenr{   r>   PHANDLEr  r  r  rF  rG  INVALID_HANDLE_VALUEr  r  r   )ProcessHANDLEDesiredAccess_OpenProcessTokenNewTokenHandlerA   rA   rB   rl  e     
rl  Tc                 C   sF   t jj}ttttg|_t|_	t
|_tt}|| ||t| t|jS r   )r  r  OpenThreadTokenr{   r>   r   rm  r  r  r  rF  rG  rn  r  r  r   )ThreadHANDLErp  
OpenAsSelf_OpenThreadTokenrr  rA   rA   rB   rt  u     
rt  c                 C   rk  r   )r  r  DuplicateTokenr{   r   rm  r  r  r  rF  rG  rn  r  r  r   )ExistingTokenHandler   _DuplicateTokenDuplicateTokenHandlerA   rA   rB   ry    rs  ry  c                 C   sN   t jj}ttttttg|_	t
|_t|_tt}|| ||||t| t|jS r   )r  r  DuplicateTokenExr{   r>   LPSECURITY_ATTRIBUTESr   r   rm  r  r  r  rF  rG  rn  r  r  r   )hExistingTokendwDesiredAccesslpTokenAttributesr   r   _DuplicateTokenExr|  rA   rA   rB   r}    s   
r}  c                 C   s,   t jj}tg|_t|_t|_t	t
 || S r   )r  r  IsTokenRestrictedr{   r  r  r  RaiseIfNotErrorSuccessrG  SetLastErrorERROR_SUCCESS)hTokenHandle_IsTokenRestrictedrA   rA   rB   r    s   r  c                 C   B   t jj}tttg|_t|_t|_	t
 }| sd } || |t| |S r   )r  r  LookupPrivilegeValueAr   PLUIDr  r  r  rF  rG  r8   r  )r1  rA  _LookupPrivilegeValueAlpLuidrA   rA   rB   r       r  c                 C   r  r   )r  r  LookupPrivilegeValueWr   r  r  r  r  rF  rG  r8   r  )r1  rA  _LookupPrivilegeValueWr  rA   rA   rB   r    r  r  c                 C   n   t jj}ttttg|_t|_t	|_
td}|| t|tt| td|j}|| t|t|t| |jS Nr/   r   )r  r  LookupPrivilegeNameAr   r  r  r  r  r  rF  rG  r>   r  NULLr"  r$  r   )r1  r  _LookupPrivilegeNameAr@  rA  rA   rA   rB   r       r  c                 C   r  r  )r  r  LookupPrivilegeNameWr   r  r  r  r  r  rF  rG  r>   r  r  r"  r,  r   )r1  r  _LookupPrivilegeNameWr@  rA  rA   rA   rB   r    r  r  rA   c           
      C   s   t jj}ttttttg|_t|_	|s t
|_|| ttdtt d S d}d}|D ]C\}}t|ts4tt|}|dkr;t}n|dkrBt}n	|d krId}n|}t||}td|}	|| tt|	t|	ttdkrid}t }q&|sqt|d S )Nr/   TFr   )r  r  AdjustTokenPrivilegesr{   r   LPVOIDr>   r  r  r  rF  rG  TRUEr  
isinstancer8   LookupPrivilegeValueSE_PRIVILEGE_ENABLEDSE_PRIVILEGE_REMOVEDrD   rG   FALSEr  sizeofr   r"  r#  )
r  NewState_AdjustTokenPrivilegesr)  errcode	privilegeenabledflagslaatprA   rA   rB   r    s6   




r  c                 C   s  |dks|t krtd| |tkr t }t| || |jjjS |tkr1t	 }t| || |j
jS |tkrBt }t| || |jjS |tkrSt }t| || |jjS |tkrit }t| || |jjj|jjfS |tkryt }t| || |jS |tkrtd}t| || |jS |tkrtd}t| || |jS |tkrtd}t| || |jS |ttfv rtd}t| || |jS |tt t!t"t#fv rtd}t| || t$|jS |t%krt&d}t| || t'|j(jddS |t)krt* }t| || |S t+d| )Nr/   z,Invalid value for TokenInformationClass (%i)Tr   z,TokenInformationClass(%i) not yet supported!),MaxTokenInfoClassr   	TokenUserrj   _internal_GetTokenInformationrk   rg   r   
TokenOwnerrp   rq   rs   rt   TokenAppContainerSidru   rv   TokenIntegrityLevelrn   ro   rF   TokenOriginrw   rx   r   r   TokenElevationTOKEN_ELEVATIONr   TokenSessionIdTokenAppContainerNumberr>   TokenSandBoxInertTokenHasRestrictionsTokenUIAccessTokenVirtualizationAllowedTokenVirtualizationEnabledr  TokenLinkedTokenry   r  rz   TokenStatisticsr|   r   )r  TokenInformationClassTokenInformationrA   rA   rB   GetTokenInformation  sr   

r  c                 C   sd   t jj}tttttg|_t	|_
t|_td}t|}|| |t||t| |j|kr0tt|S Nr/   )r  r  r  r{   TOKEN_INFORMATION_CLASSr  r>   PDWORDr  r  r  rF  rG  r  r  r   r"  r#  r!  )r  r  r  _GetTokenInformationReturnLengthTokenInformationLengthrA   rA   rB   r  u  s   

r  c              
   C   s   t jj}tttttg|_t	|_
t|_td}z|| dd|t| W n ty4 } zW Y d}~nd}~ww |j}td}t|  }|| dt||t| |j|krWttt|ttj}|jjS )zP
	The original function wasn't working. this one returns the SID for the token
	r/   r   N)r  r  r  r{   r  r  r>   r  r  r  r  rF  rG  r  	Exceptionr   BYTEr"  r#  r!  r/  rE  rj   contentsrk   rg   )r  r  r  er  titrA   rA   rB   GetTokenInformation_sid  s&   


r  c
                 C   s  t jj}
tttttttttttg|
_t|
_	t
|
_| sd } |s d }|s$d }|s(d }|s-d }nt|ttt|d }|s?d }nt|}|sHd }|	sdt }	tt|	_d|	_d|	_d|	_d|	_d|	_d|	_t }t|_t|_d|_d|_|
| ||||||||t |	t | |S Nr   r/   )!r  r  CreateProcessWithLogonWr   r>   r  LPPROCESS_INFORMATIONr  r  r  rF  rG  r"  r,  maxMAX_PATHlenSTARTUPINFOWr  cb
lpReserved	lpDesktoplpTitledwFlagscbReserved2lpReserved2PROCESS_INFORMATIONrn  hProcesshThreadr   
dwThreadIdr  )
lpUsernamelpDomain
lpPassworddwLogonFlagslpApplicationNamelpCommandLinedwCreationFlagslpEnvironmentlpCurrentDirectorylpStartupInfo_CreateProcessWithLogonWlpProcessInformationrA   rA   rB   r    sH   

$r  c           
      C   s   t jj}tttttttttg	|_t	|_
t|_| sd } |sd }|s#d }nt|ttt|d }|s5d }nt|}|s>d }|sZt }tt|_d|_d|_d|_d|_d|_d|_t }	t|	_t|	_d|	_d|	_ || ||||||t!|t!|		 |	S r  )"r  r  CreateProcessWithTokenWr{   r>   r   r  r  r  r  r  rF  rG  r"  r,  r  r  r  r  r  r  r  r  r  r  r  r  r  rn  r  r  r   r  r  )
hTokenr  r  r  r  r  r  r  _CreateProcessWithTokenWr  rA   rA   rB   r    s@   

 r  Fc
                 C   s*  t jj}
ttttttttttt	g|
_
t|
_t|
_|sd }|s!d }nt|dttt|d }|s6d }nt|d}|sBd }|sGd }nt|}|sPd }nt|}|	spt }	tt|	_d|	_d|	_d|	_d|	_d|	_d|	_t }t |_!t |_"d|_#d|_$|
| ||||t||||t|	t| |S )Nasciir   r/   )%r  r  CreateProcessAsUserAr{   r   r~  r   r>   r  r  r  r  r  rF  rG  r"  r$  encoder  r  r  r  STARTUPINFOr  r  r  r  r  r  r  r  r  rn  r  r  r   r  )r  r  r  lpProcessAttributeslpThreadAttributesbInheritHANDLEsr  r  r  r  _CreateProcessAsUserAr  rA   rA   rB   r    sH    
(r  c
                 C   s  t jj}
ttttttttttt	g|
_
t|
_t|
_|sd }|s!d }nt|ttt|d }|s3d }nt|}|s<d }|sAd }nt|}|sJd }nt|}|	sjt }	tt|	_d|	_d|	_d|	_d|	_d|	_d|	_t }t|_ t|_!d|_"d|_#|
| ||||t||||t|	t| |S r  )$r  r  CreateProcessAsUserWr{   r   r~  r   r>   r  r  r  r  r  rF  rG  r"  r,  r  r  r  r  r  r  r  r  r  r  r  r  r  r  rn  r  r  r   r  )r  r  r  r  r  r  r  r  r  r  _CreateProcessAsUserWr  rA   rA   rB   r  J  sH   

(r  c                 C   s@   t jj}ttg|_t|_t|_	|d urt
|}|| |}t|S r   )r  r  OpenThreadWaitChainSessionr>   rQ  r  HWCTr  rF  rG  PWAITCHAINCALLBACKr   )Flagscallback_OpenThreadWaitChainSessionr   rA   rA   rB   r    s   

r  c                    s   t jj}tttttttg|_t	|_
t|_t|}t|   td}|| |||t|tt tt| |j|kr]|j}t|   || |||t|tt tt| |j|ks; fddt|jD t	|jfS )Nr/   c                    s   g | ]}t  | qS rA   )r   ).0indexNodeInfoArrayrA   rB   
<listcomp>  s    z&GetThreadWaitChain.<locals>.<listcomp>)r  r  GetThreadWaitChainr  r  r>   PWAITCHAIN_NODE_INFOLPBOOLr  r  r  rF  rG  r   r   r  r"  r/  r0  r   xrange)	WctHANDLEContextr  r   	NodeCount_GetThreadWaitChaindwNodeCountIsCyclerA   r   rB   r    s    
*

*
r  c                 C   s   t jj}tg|_||  d S r   )r  r  r   r  r  )r  _CloseThreadWaitChainSessionrA   rA   rB   r     s   r   c                 C   sN   t jj}ttttttg|_t|_	t
|_tt}|| ||t|d  t|jS r   )r  r  SaferCreateLevelr>   rE  r  r  r  r   r  rF  rG  rn  r  SaferLevelHANDLEr   )	dwScopeId	dwLevelId	OpenFlags_SaferCreateLevelhLevelHANDLErA   rA   rB   r    s   
r  c                 C   s\   t jj}tttttg|_t	|_
t|_tt}td}|| |t||t| t|j|jfS r  )r  r  SaferComputeTokenFromLevelr  r{   rm  r>   r  r  r   r  rF  rG  rn  r  r  r   )LevelHANDLEInAccessTokenr  _SaferComputeTokenFromLevelOutAccessTokenr  rA   rA   rB   r    s   r  c                 C   s@   t jj}tg|_t|_t|_t	| dr|| j
 d S ||  d S Nr   )r  r  r  r  r  r   r  rF  rG  hasattrr   )r  _SaferCloseLevelrA   rA   rB   r    s   
r  c                 C   s8   t jj}ttg|_t|_t|_	t
t t|t| |S r   )r  r  SaferiIsExecutableFileTyper   BOOLEANr  r   r  RaiseIfLastErrorrG  r  r  r  unicode)
szFullPathbFromShellExecute_SaferiIsExecutableFileTyperA   rA   rB   r    s   
r  c                 C   sV   t | dr	| j}n| }|ttttttfv rd S tj	j
}tg|_t|_t|_||  d S r  )r  r   HKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINE
HKEY_USERSHKEY_PERFORMANCE_DATAHKEY_CURRENT_CONFIGr  r  r  r
  r  r?   r  r  rG  )hKeyr   _RegCloseKeyrA   rA   rB   r    s"   
r  c                 C   B   t jj}tttg|_t|_t	|_
tt}|| |t| t|jS r   )r  r  RegConnectRegistryAr   r
  PHKEYr  r?   r  r  rG  rn  r  RegistryKeyHANDLEr   )lpMachineNamer*  _RegConnectRegistryAhkResultrA   rA   rB   r-    rs  r-  c                 C   r,  r   )r  r  RegConnectRegistryWr   r
  r.  r  r?   r  r  rG  rn  r  r/  r   )r0  r*  _RegConnectRegistryWr2  rA   rA   rB   r3  (  rs  r3  c                 C   rk  r   )r  r  RegCreateKeyAr
  r   r.  r  r?   r  r  rG  rn  r  r/  r   )r*  lpSubKey_RegCreateKeyAr2  rA   rA   rB   r5  9  rs  r5  c                 C   rk  r   )r  r  RegCreateKeyWr
  r   r.  r  r?   r  r  rG  rn  r  r/  r   )r*  r6  _RegCreateKeyWr2  rA   rA   rB   r8  C  rs  r8  c                 C   rk  r   )r  r  RegOpenKeyAr
  r   r.  r  r?   r  r  rG  rn  r  r/  r   )r*  r6  _RegOpenKeyAr2  rA   rA   rB   r:  b  rs  r:  c                 C   rk  r   )r  r  RegOpenKeyWr
  r   r.  r  r?   r  r  rG  rn  r  r/  r   )r*  r6  _RegOpenKeyWr2  rA   rA   rB   r<  l  rs  r<  c                 C   J   t jj}tttttg|_t	|_
t|_tt}|| |d|t| t|jS r  )r  r  RegOpenKeyExAr
  r   r>   REGSAMr.  r  r?   r  r  rG  rn  r  r/  r   )r*  r6  
samDesired_RegOpenKeyExAr2  rA   rA   rB   r?       
r?  c                 C   r>  r  )r  r  RegOpenKeyExWr
  r   r>   r@  r.  r  r?   r  r  rG  rn  r  r/  r   )r*  r6  rA  _RegOpenKeyExWr2  rA   rA   rB   rD    rC  rD  c                 C   s>   t jj}ttg|_t|_t|_	t
t}|| t| t|jS r   )r  r  RegOpenCurrentUserr@  r.  r  r?   r  r  rG  r
  rn  r  r/  r   )rA  _RegOpenCurrentUserr2  rA   rA   rB   rF    s   

rF  c                 C   sF   t jj}ttttg|_t|_	t
|_tt}|| d|t| t|jS r  )r  r  RegOpenUserClassesRootr{   r>   r@  r.  r  r?   r  r  rG  r
  rn  r  r/  r   )r  rA  _RegOpenUserClassesRootr2  rA   rA   rB   rH    rx  rH  c                 C   s`   t jj}ttttg|_t|_	t
|_td}|| |d t| t|j}|| ||t| |jS r  )r  r  RegQueryValueAr
  r   r  PLONGr  r?   r  r  rG  r  r"  r$  r   )r*  r6  _RegQueryValueAcbValuelpValuerA   rA   rB   rJ    s   rJ  c                 C   sh   t jj}ttttg|_t|_	t
|_td}|| |d t| t|jtt }|| ||t| |jS r  )r  r  RegQueryValueWr
  r   r  rK  r  r?   r  r  rG  r  r"  r,  r   r  r   )r*  r6  _RegQueryValueWrM  rN  rA   rA   rB   rO    s   rO  c                 C   s  t | }td}td}|||d t|d t| |j}|s#|j|fS |ttfv rK|jdkr5td|j td}|||d d t|t| |j|fS |tkrq|jdkr[td|j td}	|||d d t|	t| |	j|fS |t	t
fv r| rt|j}
nt|j}
|||d d t|
t| |
j|fS |tkr| rt|j}
nt|j}
|||d d t|
t| |
d d  }| r|d}n|d}dd	 |D }||fS |tkrt|j}
|||d d t|
t| |
j|fS t|j}
|||d d t|
t| |
j|fS )
Nr/   r  r'   REG_DWORD value of size %dr)   REG_QWORD value of size %d c                 S      g | ]}|r|qS rA   rA   r  tokenrA   rA   rB   r  	      z-_internal_RegQueryValueEx.<locals>.<listcomp>)_caller_RegQueryValueExr>   r  r   	REG_DWORDREG_DWORD_BIG_ENDIANr   	REG_QWORDQWORDREG_SZREG_EXPAND_SZr"  r$  r,  REG_MULTI_SZsplitREG_LINKr   )ansir*  lpValueNamebGetData_RegQueryValueExcbDatadwTypeTypedwDataqwDataszDataDataaDatarA   rA   rB   _internal_RegQueryValueEx  sV   








rn  c                 C   sJ   | rt jj}ttttttg|_nt jj}tt	ttttg|_t
|_t|_|S r   )r  r  RegQueryValueExAr
  r   r  r  r  RegQueryValueExWr   r?   r  r  rG  )rb  re  rA   rA   rB   rX  	  s   rX  c                 C      t d| ||S NTrn  r*  rc  rd  rA   rA   rB   ro   	  r	  ro  c                 C   rq  r   rs  rt  rA   rA   rB   rp  $	  r	  rp  c           	      C   s  |d u rt |tjrd}n*t |tjrd}n!tjtjk}nt |tjr&d}nt |tjr/d}ntdt| |d u rm|d u rBt}n+|d u rIt}n$t |tjrRt}nt |tjr[t}nt |t	rct
}n
t |trkt}nt}|r}tjj}ttttttg|_ntjj}ttttttg|_t|_t|_|d u rd }d}n[|t
tfv rt|}nH|tkrt|}n?|ttfv r|rt |}n1t!|}n+|t"kr|rt d#|d }nt!d#|d }n|t$krt!|}nt |}t%|}t&|}|| |d||| d S )NTFzString expected, got %s insteadr/   rS  z  )'r  GuessStringTypet_ansi	t_unicode	t_default	TypeErrortyper]  REG_NONEintrY  longr[  
REG_BINARYr  r  RegSetValueExAr
  r   r>   r  r  RegSetValueExWr   r?   r  r  rG  rZ  r\  r^  r"  r$  r,  r_  r   ra  r  r  )	r*  rc  lpDatarg  rb  _RegSetValueExDataRefDataSizerl  rA   rA   rB   RegSetValueEx1	  sj   




r  c                 C   s   t jj}ttttg|_t|_d}	 t	
|}|| |||}|tkr"n|d }|dkr/t	|q|tkr6d S |tkr?t	||jS )Nr   Tr   )r  r  RegEnumKeyAr
  r>   r   r  r?   r  r"  r$  ERROR_MORE_DATAr#  ERROR_NO_MORE_ITEMSr  r   )r*  dwIndex_RegEnumKeyAr@  rA  r  rA   rA   rB   r  	  s$   


r  c                 C   s   t jj}ttttg|_t|_d}	 t	
|}|| |||d }|tkr$n|d }|dkr1t	|q|tkr8d S |tkrAt	||jS )Nr.   Tr&   i   )r  r  RegEnumKeyWr
  r>   r   r  r?   r  r"  r,  r  r#  r  r  r   )r*  r  _RegEnumKeyWr@  rA  r  rA   rA   rB   r  	  s$   


r  c              	   C   s  | rt jj}ttttttttg|_nt jj	}ttt
tttttg|_t|_td}td}t|}t|}| r=t|j}	nt|j}	|rNtd}
t|
}nd }d }||||	|d |||}|tksg|r|tkr| rx|jtt |_t|j}	n|jtt |_t|j}	|r|j}|ttfv r|
jttkrtd|
j td}n?|tkr|
jttkrtd|
j td}n(|tttfv r| rt|
j}nt|
j}n|tkrt|
j}nt|
j}t|}||||	|d |||}|t krd S |s|	j|jfS |ttttttfv r|	j|j|jfS |tkr<|d d  }~| r)|!d}n|!d}dd |D }|	j|j|fS |	j|j|j"fS )	Nr   r  r/   rQ  rR  rS  c                 S   rT  rA   rA   rU  rA   rA   rB   r  
  rW  z*_internal_RegEnumValue.<locals>.<listcomp>)#r  r  RegEnumValueAr
  r>   r   r  r  r  RegEnumValueWr   r?   r  r  r"  r$  r   r,  r  r  r  CHARr   rY  rZ  r   r[  r\  r]  r^  r_  ra  r  r`  r   )rb  r*  r  rd  _RegEnumValuecchValueNamerg  lpcchValueNamelpTyperc  rf  lpcbDatar  r  rh  rl  sDatarm  rA   rA   rB   _internal_RegEnumValue	  sv   




r  c                 C   rq  rr  r  r*  r  rd  rA   rA   rB   r  
  r	  r  c                 C   rq  r   r  r  rA   rA   rB   r  
  r	  r  c                 C   ,   t jj}ttg|_t|_t|_	|| | d S r   )
r  r  RegDeleteValueAr
  r   r  r?   r  r  rG  )hKeySrcrc  _RegDeleteValueArA   rA   rB   r  >
  
   
r  c                 C   r  r   )
r  r  RegDeleteValueWr
  r   r  r?   r  r  rG  )r  rc  _RegDeleteValueWrA   rA   rB   r  D
  r  r  c                 C   0   t jj}tttg|_t|_t|_	|| || d S r   )
r  r  RegDeleteKeyValueAr
  r   r  r?   r  r  rG  )r  r6  rc  _RegDeleteKeyValueArA   rA   rB   r  Q
  
   r  c                 C   r  r   )
r  r  RegDeleteKeyValueWr
  r   r  r?   r  r  rG  )r  r6  rc  _RegDeleteKeyValueWrA   rA   rB   r  W
  r  r  c                 C   r  r   )
r  r  RegDeleteKeyAr
  r   r  r?   r  r  rG  )r  r6  _RegDeleteKeyArA   rA   rB   r  c
  r  r  c                 C   r  r   )
r  r  RegDeleteKeyWr
  r   r  r?   r  r  rG  )r  r6  _RegDeleteKeyWrA   rA   rB   r  i
  r  r  c                 C   4   t jj}ttttg|_t|_	t
|_|| ||d d S r  )r  r  RegDeleteKeyExAr
  r   r@  r>   r  r?   r  r  rG  )r  r6  rA  _RegDeleteKeyExArA   rA   rB   r  x
  
   r  c                 C   r  r  )r  r  RegDeleteKeyExWr
  r   r@  r>   r  r?   r  r  rG  )r  r6  rA  _RegDeleteKeyExWrA   rA   rB   r  ~
  r  r  c                 C   0   t jj}tttg|_t|_t|_	|| || d S r   )
r  r  RegCopyTreeAr
  r   r  r?   r  r  rG  )r  r6  hKeyDest_RegCopyTreeArA   rA   rB   r  
  r  r  c                 C   r  r   )
r  r  RegCopyTreeWr
  r   r  r?   r  r  rG  )r  r6  r  _RegCopyTreeWrA   rA   rB   r  
  r  r  c                 C   r  r   )
r  r  RegDeleteTreeAr
  r   r  r?   r  r  rG  )r*  r6  _RegDeleteTreeArA   rA   rB   r  
  r  r  c                 C   r  r   )
r  r  RegDeleteTreeWr
  r   r  r?   r  r  rG  )r*  r6  _RegDeleteTreeWrA   rA   rB   r  
  r  r  c                 C   (   t jj}tg|_t|_t|_||  d S r   )	r  r  RegFlushKeyr
  r  r?   r  r  rG  )r*  _RegFlushKeyrA   rA   rB   r  
  rj  r  c                 C   s>   t jj}tg|_t|_t|_t	| t
r|   d S ||  d S r   )r  r  r  r  r  r  r  rF  rG  r  r{   close)	hSCObject_CloseServiceHANDLErA   rA   rB   r  
  s   
r  c                 C   s4   t jj}tttg|_t|_t|_	|| ||}t
|S r   )r  r  OpenSCManagerAr   r>   r  r  r  rF  rG  ServiceControlManagerHANDLE)r0  lpDatabaseNamer  _OpenSCManagerAr  rA   rA   rB   r  
     r  c                 C   s4   t jj}tttg|_t|_t|_	t
| ||}t|S r   )r  r  OpenSCManagerWr   r>   r  r  r  rF  rG  r  r  )r0  r  r  _OpenSCManagerWr  rA   rA   rB   r  
  r  r  c                 C   0   t jj}tttg|_t|_t|_	t
|| ||S r   )r  r  OpenServiceAr  r   r>   r  r  rF  rG  ServiceHANDLE)
hSCManagerr   r  _OpenServiceArA   rA   rB   r  
  r  r  c                 C   r  r   )r  r  OpenServiceWr  r   r>   r  r  rF  rG  r  )r  r   r  _OpenServiceWrA   rA   rB   r  
  r  r  c                 C   l   t jj}tttttttttttttg|_t|_t	|_
td}|| |||||||t||	|
|}t||jfS r  )r  r  CreateServiceAr  r   r>   r  r  r  rF  rG  r  r  r   )r  r   r   r  r   dwStartTypedwErrorControllpBinaryPathNamelpLoadOrderGrouplpDependencieslpServiceStartNamer  _CreateServiceAdwTagIdhServicerA   rA   rB   r        "r  c                 C   r  r  )r  r  CreateServiceWr  r   r>   r  r  r  rF  rG  r  r  r   )r  r   r   r  r   r  r  r  r  r  r  r  _CreateServiceWr  r  rA   rA   rB   r  $  r  r  c                 C   r  r   )	r  r  DeleteServicer  r  r  r  rF  rG  )r  _DeleteServicerA   rA   rB   r  >  rj  r  c                 C      t jj}ttttg|_t|_t	d}|| |d t
| |jdkr$t t|jd }t||_|| ||t
|}|s@t |jS Nr/   r   )r  r  GetServiceKeyNameAr  r   r  r  r  r  r>   r  r   r"  r#  r$  r  )r  r   _GetServiceKeyNameA	cchBufferr   r)  rA   rA   rB   r  K     

r  c                 C   r  Nr/   r&   )r  r  GetServiceKeyNameWr  r   r  r  r  r  r>   r  r   r"  r#  r,  r  )r  r   _GetServiceKeyNameWr  r   r)  rA   rA   rB   r  [  r  r  c                 C   r  r  )r  r  GetServiceDisplayNameAr  r   r  r  r  r  r>   r  r   r"  r#  r$  r  )r  r   _GetServiceDisplayNameAr  r   r)  rA   rA   rB   r  s  r  r  c                 C   r  r  )r  r  GetServiceDisplayNameWr  r   r  r  r  r  r>   r  r   r"  r#  r,  r  )r  r   _GetServiceDisplayNameWr  r   r)  rA   rA   rB   r    r  r  c                 C   \   t jj}tttg|_t|_t	|_
|r"t|}t| | }t|}nd}d }|| || d S r  )r  r  StartServiceAr  r>   r  r  r  r  rF  rG  r  r   r"  r0  )r  ServiceArgVectors_StartServiceAdwNumServiceArgsCServiceArgVectorslpServiceArgVectorsrA   rA   rB   r       r  c                 C   r  r  )r  r  StartServiceWr  r>   r  r  r  r  rF  rG  r  r   r"  r0  )r  r  _StartServiceWr  r  r  rA   rA   rB   r    r  r  c                 C   s>   t jj}tttg|_t|_t	|_
t }|| |t| t|S r   )r  r  ControlServicer  r>   LPSERVICE_STATUSr  r  r  rF  rG  r   r  r   )r  	dwControl_ControlServicerawServiceStatusrA   rA   rB   r    s   r  c                 C   s:   t jj}ttg|_t|_t|_	t
 }|| t| t|S r   )r  r  QueryServiceStatusr  r  r  r  r  rF  rG  r   r  r   )r  _QueryServiceStatusr  rA   rA   rB   r  	  s   
r  c                 C   sh   |t krt tjj}ttttt	g|_
t|_t|_t }tt|}|| |t|t|t| t|S r   )SC_STATUS_PROCESS_INFOr   r  r  QueryServiceStatusExr  SC_STATUS_TYPEr  r>   r  r  r  r  rF  rG  r   r  r  r   )r  	InfoLevel_QueryServiceStatusExr(  cbBytesNeededrA   rA   rB   r    s   r  c              
   C   6  t jj}ttttttttg|_t|_	td}td}td}|| ||d dt
|t
|t
| g }d}t tkr|jttk r@nStd|j}	|| ||t
|	t|	t
|t
|t
|}t|	tt|j k rkt ttt|	tjt}
td|jD ]}|t|
|  q|rnt tks8|st |S Nr/   Fr   )r  r  EnumServicesStatusAr  r>   r  r  r  r  r  r  r   r  r   r  r   r"  r$  r#  r/  r0  c_void_pLPENUM_SERVICE_STATUSAr  r   r   )r  r   dwServiceState_EnumServicesStatusAr  ServicesReturnedResumeHANDLEServicesr)  ServicesBufferlpServicesArrayr  rA   rA   rB   r  3  0   "
*
r  c              
   C   r  r  )r  r  EnumServicesStatusWr  r>   r  r  r  r  r  r  r   r  r   r  r   r"  r$  r#  r/  r0  r  LPENUM_SERVICE_STATUSWr  r   r   )r  r   r  _EnumServicesStatusWr  r	  r
  r  r)  r  r  r  rA   rA   rB   r  P  r  r  c                 C   sP  |t krt tjj}ttttttt	t	t	t
g
|_t|_td}td}td}|| |||d dt|t|t||
 g }	d}
t tkr|jttk rKnUtd|j}|| |||t|t|t|t|t||
}
t|tt|j k rxt ttt|tjt}td|jD ]}|	t||  q|
rnt tksC|
st |	S r  )SC_ENUM_PROCESS_INFOr   r  r  EnumServicesStatusExAr  SC_ENUM_TYPEr>   r  r  r   r  r  r  r  r   r  r   r  r   r"  r$  r#  r/  r0  r  LPENUM_SERVICE_STATUS_PROCESSAr  r   r  )r  r  r   r  pszGroupName_EnumServicesStatusExAr  r	  r
  r  r)  r  r  r  rA   rA   rB   r  {  s4   &
.
r  c                 C   sP  t jj}ttttttttttg
|_	t
|_|tkrt td}td}td}|| |||d dt|t|t||
 g }	d}
t tkr|jttk rKnUtd|j}|| |||t|t|t|t|t||
}
t|tt|j k rxt ttt|tjt}td|jD ]}|	t||  q|
rnt tksC|
st |	S r  )r  r  EnumServicesStatusExWr  r  r>   r  r  r   r  r  r  r  r   r  r   r  r   r  r   r"  r$  r#  r/  r0  r  LPENUM_SERVICE_STATUS_PROCESSWr  r   r  )r  r  r   r  r  _EnumServicesStatusExWr  r	  r
  r  r)  r  r  r  rA   rA   rB   r    s4   &
.
r  c                 C   s,   t jj}ttg|_t|_t|_	|||  d S r   )
r  r  SetThreadTokenrm  r{   r  r  r  rF  rG  )token_handlethread_handle_SetThreadTokenrA   rA   rB   r    s
   
r  c                 C   s   g | ]	}| d s|qS )_)
startswith)r  _xrA   rA   rB   r    s    r  )T)rA   )
NNNr/   NNr/   NNN)Nr/   NNr/   NNN)
NNNNNFr/   NNN)r/   Nr  )Fr   rr  )NNN)NN(  r   defineskernel32_allsetvarskeysSE_ASSIGNPRIMARYTOKEN_NAMESE_AUDIT_NAMESE_BACKUP_NAMESE_CHANGE_NOTIFY_NAMESE_CREATE_GLOBAL_NAMESE_CREATE_PAGEFILE_NAMESE_CREATE_PERMANENT_NAMESE_CREATE_SYMBOLIC_LINK_NAMESE_CREATE_TOKEN_NAMESE_DEBUG_NAMESE_ENABLE_DELEGATION_NAMESE_IMPERSONATE_NAMESE_INC_BASE_PRIORITY_NAMESE_INCREASE_QUOTA_NAMESE_INC_WORKING_SET_NAMESE_LOAD_DRIVER_NAMESE_LOCK_MEMORY_NAMESE_MACHINE_ACCOUNT_NAMESE_MANAGE_VOLUME_NAMESE_PROF_SINGLE_PROCESS_NAMESE_RELABEL_NAMESE_REMOTE_SHUTDOWN_NAMESE_RESTORE_NAMESE_SECURITY_NAMESE_SHUTDOWN_NAMESE_SYNC_AGENT_NAMESE_SYSTEM_ENVIRONMENT_NAMESE_SYSTEM_PROFILE_NAMESE_SYSTEMTIME_NAMESE_TAKE_OWNERSHIP_NAMESE_TCB_NAMESE_TIME_ZONE_NAMESE_TRUSTED_CREDMAN_ACCESS_NAMESE_UNDOCK_NAMESE_UNSOLICITED_INPUT_NAMESE_PRIVILEGE_ENABLED_BY_DEFAULTr  r  SE_PRIVILEGE_USED_FOR_ACCESSTOKEN_ADJUST_PRIVILEGESLOGON_WITH_PROFILELOGON_NETCREDENTIALS_ONLYTOKEN_ASSIGN_PRIMARYTOKEN_DUPLICATETOKEN_IMPERSONATETOKEN_QUERYTOKEN_QUERY_SOURCETOKEN_ADJUST_GROUPSTOKEN_ADJUST_DEFAULTTOKEN_ADJUST_SESSIONIDSTANDARD_RIGHTS_READ
TOKEN_READSTANDARD_RIGHTS_REQUIREDTOKEN_ALL_ACCESSr$  r%  r&  r'  r(  r)  KEY_ALL_ACCESSKEY_CREATE_LINKKEY_CREATE_SUB_KEYKEY_ENUMERATE_SUB_KEYSKEY_EXECUTE
KEY_NOTIFYKEY_QUERY_VALUEKEY_READKEY_SET_VALUEKEY_WOW64_32KEYKEY_WOW64_64KEY	KEY_WRITEr{  r]  r^  r~  rY  REG_DWORD_LITTLE_ENDIANrZ  ra  r_  REG_RESOURCE_LISTREG_FULL_RESOURCE_DESCRIPTORREG_RESOURCE_REQUIREMENTS_LISTr[  REG_QWORD_LITTLE_ENDIAN	Structurer8   rE  r  rD   rG   PTOKEN_PRIVILEGESr"  c_intr  r  TokenGroupsTokenPrivilegesr  TokenPrimaryGroupTokenDefaultDaclTokenSourcer   TokenImpersonationLevelr  TokenRestrictedSidsr  TokenGroupsAndPrivilegesTokenSessionReferencer  TokenAuditPolicyr  TokenElevationTyper  r  r  TokenAccessInformationr  r  r  r  TokenMandatoryPolicyTokenLogonSidTokenIsAppContainerTokenCapabilitiesr  r  TokenUserClaimAttributesTokenDeviceClaimAttributes"TokenRestrictedUserClaimAttributes$TokenRestrictedDeviceClaimAttributesTokenDeviceGroupsTokenRestrictedDeviceGroupsTokenSecurityAttributesTokenIsRestrictedr  r   PTOKEN_TYPETokenPrimaryTokenImpersonationTokenElevationTypeDefaultTokenElevationTypeFullTokenElevationTypeLimitedTOKEN_ELEVATION_TYPEPTOKEN_ELEVATION_TYPESecurityAnonymousSecurityIdentificationSecurityImpersonationSecurityDelegationr   PSECURITY_IMPERSONATION_LEVELrf   PSID_AND_ATTRIBUTESrj   PTOKEN_USERrn   PTOKEN_MANDATORY_LABELrp   PTOKEN_OWNERrs   PTOKEN_PRIMARY_GROUPru   PTOKEN_APPCONTAINER_INFORMATIONrw   PTOKEN_ORIGINry   PTOKEN_LINKED_TOKENr|   PTOKEN_STATISTICSSidTypeUserSidTypeGroupSidTypeDomainSidTypeAliasSidTypeWellKnownGroupSidTypeDeletedAccountSidTypeInvalidSidTypeUnknownSidTypeComputerSidTypeLabelWCT_MAX_NODE_COUNTr   WCT_ASYNC_OPEN_FLAGWCTP_OPEN_ALL_FLAGSWCT_OUT_OF_PROC_FLAGWCT_OUT_OF_PROC_COM_FLAGWCT_OUT_OF_PROC_CS_FLAGWCTP_GETINFO_ALL_FLAGSr  r  r>   r   WctCriticalSectionTypeWctSendMessageTypeWctMutexTypeWctAlpcType
WctComTypeWctThreadWaitTypeWctProcessWaitTyper   WctComActivationTypeWctUnknownType
WctMaxTyper   WctStatusNoAccessWctStatusRunningWctStatusBlockedWctStatusPidOnlyWctStatusPidOnlyRpcssWctStatusOwnedWctStatusNotOwnedWctStatusAbandonedWctStatusUnknownWctStatusErrorWctStatusMaxr   r   Unionr   r   r  objectr   r{   r   r  SAFER_SCOPEID_MACHINESAFER_SCOPEID_USERSAFER_LEVEL_OPENSAFER_LEVELID_DISALLOWEDSAFER_LEVELID_UNTRUSTEDSAFER_LEVELID_CONSTRAINEDSAFER_LEVELID_NORMALUSERSAFER_LEVELID_FULLYTRUSTEDSAFER_POLICY_INFO_CLASSSaferPolicyLevelList'SaferPolicyEnableTransparentEnforcementSaferPolicyDefaultLevelSaferPolicyEvaluateUserScopeSaferPolicyScopeFlagsSAFER_TOKEN_NULL_IF_EQUALSAFER_TOKEN_COMPARE_ONLYSAFER_TOKEN_MAKE_INERTSAFER_TOKEN_WANT_FLAGSSAFER_TOKEN_MASKr  SERVICES_ACTIVE_DATABASEWSERVICES_FAILED_DATABASEWSERVICES_ACTIVE_DATABASEASERVICES_FAILED_DATABASEASC_GROUP_IDENTIFIERWSC_GROUP_IDENTIFIERASERVICE_NO_CHANGEr  r  r  r  SERVICE_ALL_ACCESSSERVICE_QUERY_CONFIGSERVICE_CHANGE_CONFIGSERVICE_QUERY_STATUSSERVICE_ENUMERATE_DEPENDENTSSERVICE_STARTSERVICE_STOPSERVICE_PAUSE_CONTINUESERVICE_INTERROGATESERVICE_USER_DEFINED_CONTROLSC_MANAGER_ALL_ACCESSSC_MANAGER_CONNECTSC_MANAGER_CREATE_SERVICESC_MANAGER_ENUMERATE_SERVICESC_MANAGER_LOCKSC_MANAGER_QUERY_LOCK_STATUSSC_MANAGER_MODIFY_BOOT_CONFIGSERVICE_BOOT_STARTSERVICE_SYSTEM_STARTSERVICE_AUTO_STARTSERVICE_DEMAND_STARTSERVICE_DISABLEDSERVICE_ERROR_IGNORESERVICE_ERROR_NORMALSERVICE_ERROR_SEVERESERVICE_ERROR_CRITICALSERVICE_ACTIVESERVICE_INACTIVESERVICE_STATE_ALLSERVICE_KERNEL_DRIVERSERVICE_FILE_SYSTEM_DRIVERSERVICE_ADAPTERSERVICE_RECOGNIZER_DRIVERSERVICE_WIN32_OWN_PROCESSSERVICE_WIN32_SHARE_PROCESSr   SERVICE_DRIVERSERVICE_WIN32r   r   r   r   r   r   r   SERVICE_ACCEPT_STOPSERVICE_ACCEPT_PAUSE_CONTINUESERVICE_ACCEPT_SHUTDOWNSERVICE_ACCEPT_PARAMCHANGESERVICE_ACCEPT_NETBINDCHANGE$SERVICE_ACCEPT_HARDWAREPROFILECHANGESERVICE_ACCEPT_POWEREVENTSERVICE_ACCEPT_SESSIONCHANGESERVICE_ACCEPT_PRESHUTDOWNSERVICE_RUNS_IN_SYSTEM_PROCESSSERVICE_CONTROL_STOPSERVICE_CONTROL_PAUSESERVICE_CONTROL_CONTINUESERVICE_CONTROL_INTERROGATESERVICE_CONTROL_SHUTDOWNSERVICE_CONTROL_PARAMCHANGESERVICE_CONTROL_NETBINDADDSERVICE_CONTROL_NETBINDREMOVESERVICE_CONTROL_NETBINDENABLESERVICE_CONTROL_NETBINDDISABLESERVICE_CONTROL_DEVICEEVENT%SERVICE_CONTROL_HARDWAREPROFILECHANGESERVICE_CONTROL_POWEREVENTSERVICE_CONTROL_SESSIONCHANGESERVICE_ACCEPT_TIMECHANGESERVICE_ACCEPT_TRIGGEREVENTSERVICE_ACCEPT_USERMODEREBOOTSC_ACTION_NONESC_ACTION_RESTARTSC_ACTION_REBOOTSC_ACTION_RUN_COMMANDSERVICE_CONFIG_DESCRIPTIONSERVICE_CONFIG_FAILURE_ACTIONSr   r  r   LPSERVICE_STATUS_PROCESSr   r   r  r  r   r   r  r  r   r   r   r  r  UserModeHandler  r  r  r  r  r+  DefaultStringTypeGetUserNamer.  r;  ru  LookupAccountNamer=  rB  LookupAccountSidrD  rM  ConvertSidToStringSidrP  rT  ConvertStringSidToSidrW  r[  r_  ra  rg  rl  rt  ry  r}  r  r  r  r  r  r  LookupPrivilegeNamer  r  r  r  r  MakeANSIVersionCreateProcessWithLogonACreateProcessWithLogonr  CreateProcessWithTokenACreateProcessWithTokenr  r  CreateProcessAsUserWINFUNCTYPE	DWORD_PTRr  r  r  r  r  r   r  r  r  r  SaferIsExecutableFileTyper  r-  r3  RegConnectRegistryr5  r8  RegCreateKeyr:  r<  
RegOpenKeyr?  rD  RegOpenKeyExrF  rH  rJ  rO  RegQueryValuern  rX  ro  rp  RegQueryValueExr  r  r  r  r  
RegEnumKeyr  r  r  RegEnumValuer  r  RegDeleteValuer  r  RegDeleteKeyValuer  r  RegDeleteKeyr  r  RegDeleteKeyExr  r  RegCopyTreer  r  RegDeleteTreer  r  r  r  OpenSCManagerr  r  OpenServicer  r  CreateServicer  r  r  GetServiceKeyNamer  r  GetServiceDisplayNamer  r  StartServicer  r  r  r  r  EnumServicesStatusr  r  EnumServicesStatusExr  
difference__all__sortrA   rA   rA   rB   <module>   s*  	0	Q&
.6
















	





	


+
V
0)%++










	


9
KV			2$$! 
