o
    j                     @   s   d dl Z d dlZd dlmZ d dlZd dlT d dlmZ d dlm	Z	 G dd dZ
edkr?ed	Ze
eZeee dS dS )
    N)sha1)*)GUID)unpadc                   @   s>   e Zd Zdd Zedd Zedd Zddd	Zd
d ZdS )
DPAPI_BLOBc                 C   sv   d | _ d | _d | _d | _d | _d | _d | _d | _d | _d | _	d | _
d | _d | _d | _d | _d | _d | _d | _d | _d S N)versioncredential_guidmasterkey_versionmasterkey_guidflagsdescription_lengthdescriptioncrypto_algorithmcrypto_algorithm_lengthsalt_lengthsaltHMAC_key_lengthHMAC_keyhash_algorithmHMACdata_lengthdatasignature_length	signature)self r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/dpapi/structures/blob.py__init__   s&   
zDPAPI_BLOB.__init__c                 C   s   t t| S r   )r   from_bufferioBytesIO)r   r   r   r   
from_bytes)   s   zDPAPI_BLOB.from_bytesc                 C   s  t  }tj| dddd|_| d|_|  }tj| dddd|_t| j	|_
ttj| dddd|_tj| dddd|_| |j|_ttj| dddd|_tj| dddd|_tj| dddd|_| |j|_tj| dddd|_| |j|_ttj| dddd|_tj| dddd|_tj| dddd|_| |j|_tj| dddd|_| |j|_|  }| |d | || |_tj| dddd|_| |j|_|S )N   littleF)signed   r   ) r   intr"   readr   r	   tellr
   r   valuer   FLAGSr   r   r   
ALGORITHMSr   r   r   r   r   r   r   hash_algorithm_lengthHMAC_lengthr   r   r   seekto_signr   r   )buffsksignature_start_possignature_end_posr   r   r   r   -   s6   zDPAPI_BLOB.from_bufferNc                 C   s  dd }t | }t|| jt| j d }|d ur || | }t|t| j d kr>tj|t| j d d }n|}t|t| j	 d k r|dt| j d  7 }t
dd	 t
|D d t| j d  }t
d
d	 t
|D d t| j d  }	t| j d | t| j d |	  }||}t| j	 d |d t| j	 d  t| j	 d dt| j	 d  d}
t|
| jt| j	 d }t| j d }|d|  }t
dd	 t
|D d | }t
dd	 t
|D d | }	t| j d |}|| j t| j d |	}||  |d ur|| || j t|| jt| j d }|d ur8|| || j | | jksN| | jkrP|S d S )Nc                 S   s   d}t t| D ]@}t| | dd  dd}|d d dd dkr7|t|d d d ddd	7 }q|t|d d d ddd	7 }q|S )
N          0   1r      big)rangelenbinrjustcountr'   to_bytes)deskeytempitr   r   r   	fixparityL   s   $$z%DPAPI_BLOB.decrypt.<locals>.fixparityr;   r#   )	digestmodr       c                 S      g | ]}|d A qS 6   r   .0rE   r   r   r   
<listcomp>e       z&DPAPI_BLOB.decrypt.<locals>.<listcomp>c                 S   rJ   \   r   rM   r   r   r   rO   f   rP   r6      )modeIVc                 S   rJ   rK   r   rM   r   r   r   rO   r   rP   c                 S   rJ   rQ   r   rM   r   r   r   rO   s   rP   )r   digesthmacnewr   ALGORITHMS_DATAr   updater>   r   	bytearrayr   decryptr   r   r0   r   )r   keyentropyrG   key_hashsession_key_ctxsession_keyderived_keyipadopadcipher	cleartexthash_block_size
key_hash_2ahmac_calculated_1hmac_calculated_3r   r   r   r\   K   sN   

(( 



 zDPAPI_BLOB.decryptc                 C   sn   d}| j D ]/}t| j | tr't| j | D ]\}}|d||t|f 7 }qq|d|t| j | f 7 }q|S )Nz== DPAPI_BLOB ==
z   %s: %s: %sz	%s: %s 
)__dict__
isinstancelist	enumeratestr)r   rF   krE   itemr   r   r   __str__   s   
zDPAPI_BLOB.__str__r   )	__name__
__module____qualname__r   staticmethodr"   r   r\   rs   r   r   r   r   r      s    


Gr   __main__4  01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dc64974c99aa6c43bb30ff39b3dd407c0000000002000000000003660000c000000010000000f1af675a51c8283cf81abb6fb600110f0000000004800000a0000000100000009bf4e56d6c32dd59bce655496a94444c1000000088438c8f61d966ac220b4ca50933c8ee14000000314eaa780e358e70c586fb47bee0e27549be480e)r    enumhashlibr   rW   pypykatz.dpapi.constantspypykatz.commons.win_datatypesr   %unicrypto.backends.pure.padding.pkcs7r   r   rt   bytesfromhexr   r"   dbprintrp   r   r   r   r   <module>   s    


