o j"@s\ddlTddlTGdddZGdddZGdddZGd d d Zd d Zd dZdS))*c@ eZdZddZeddZdS) VOL3SectioncCsd|_d|_d|_dSN)startendsizeselfr /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/readers/volatility3/volreader.py__init__s zVOL3Section.__init__cCs4t}t||_t||_|j|j|_|Sr)rint get_startrget_endrr )vadsr r r from_vads zVOL3Section.from_vadN)__name__ __module__ __qualname__r staticmethodrr r r r rsrc@r) VOL3ModulecCsd|_d|_d|_d|_dSr)name start_addrend_addrr r r r r r!s zVOL3Module.__init__cCs>t}t||_t|j|_t|j|_|j|j|_ |Sr) rstrlowerrrDllBaser SizeOfImager r) BaseDllName FullDllNameentryrmr r r from_module's   zVOL3Module.from_moduleN)rrrrrr%r r r r r src@seZdZddZdS) VOL3SysinfocCs"d|_d|_d|_d|_d|_dSNiHS) architecture buildnumbermsv_dll_timestampoperating_system major_versionr r r r r1s  zVOL3Sysinfo.__init__N)rrrrr r r r r&0s r&c@seZdZddZddZddZddZd d Zd d Zd dZ ddZ d'ddZ ddZ ddZ ddZddZddZddZd d!Zd"d#Zd(d%d&ZdS)) Vol3ReadercCs<||_||_d|_d|_d|_i|_g|_d|_|dSr) vol_objframework_versionproc_layer_name proc_layer lsass_processmodulessectionsprocessor_architecturesetup)r r/r0r r r r9s zVol3Reader.__init__cCs,|||||dSr) find_lsass list_dllsget_buildnumber list_sectionsget_archr r r r r7Es  zVol3Reader.setupcCs,t}|j|_|j|_d|_d|_d|_|Sr')KatzSystemInfor6r)r*r+r,r-)r sysinfor r r get_sysinfoLszVol3Reader.get_sysinfocCs|jdkr|jdkrtdtjdg}|jdkr3|jjd}|jjd}tjj|jj|||d}n|jdkrGtjj|jj|jjd|d }|D]}||_ |j |_ |jjj |j |_ dStd ) Nr(Unsupported Volatility Framework Versionz lsass.exeprimary nt_symbols)context layer_name symbol_table filter_funckernel)rDkernel_module_namerGzLSASS process not found!)r0 ExceptionpslistPsListcreate_name_filterr/configlist_processesrDr3add_process_layerr1layersr2)r rGrErF proc_listprocr r r r8Us0      zVol3Reader.find_lsassc Csh|jD],}t}}z |j}|j}Wn tjy#Ynwt |||}||j |j <qdSr) r3load_order_modules renderersUnreadableValuer! get_stringr" exceptionsInvalidAddressExceptionrr%r4r)r r#r!r"moduler r r r9us  zVol3Reader.list_dllscCs~|jdkr|jjdtjd}n|jdkr(|jjj|jjdjtjd}ntd|jjj ||j |j j d}|j |_dS)NrrC_PEBr@rHrA)rEoffset)r0r/rN constantsBANGrDr4symbol_table_namerJobjectr1r3Peb OSBuildNumberr*)r vol_objectpebr r r r:s  $ zVol3Reader.get_buildnumbercCs*|jD] }|jt|qdSr)r3 get_vad_roottraverser5appendrr)r rr r r r;szVol3Reader.list_sectionscCsx|jdkrt|jj|jjd}n|jdkr*t|jj|jjj|jjdj}ntd|s6t j |_ dSt j |_ dS)NrrCr@rHrA) r0symbolssymbol_table_is_64bitr/rDrNr4r_rJKatzSystemArchitectureX86r6X64)r rir r r r<s  &  zVol3Reader.get_archNcCsN|dur|jtjkr d}nd}|j|}|dkrdS|||}||dS)zD Repositions the current reader to match architecture alignment Nr)r6rjrlcur_posread)r alignmentr\offset_to_alignedr r r aligns    zVol3Reader.aligncCs|jS)z) Returns the current virtual address ror r r r tellszVol3Reader.tellcC8|jtjkrtj|ddddStj|ddddS)z Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian singed int on 32 bit arch Reads an 8 byte small-endian singed int on 64 bit arch rmlittleT byteordersignedrnr6rjrlr from_bytesrpr r r r read_int zVol3Reader.read_intcCrv)z Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian unsinged int on 32 bit arch Reads an 8 byte small-endian unsinged int on 64 bit arch rmrwFrxrnr{r r r r read_uintr~zVol3Reader.read_uintcCs|||Sr)moverr posr r r get_ptrs zVol3Reader.get_ptrcCsJ|jtjkr||tj|dddd}|d|S|||S)NrnrwTrx)r6rjrlrrr|rpr)r rptrr r r get_ptr_with_offsets    zVol3Reader.get_ptr_with_offsetcCs ||_dSrrtrr r r rs zVol3Reader.movecCs&|jj|j|dd}|j|7_|S)NF)padr2rpro)r r datar r r rpszVol3Reader.readcCs|j|j|Srr)r r r r r peekszVol3Reader.peekFc Cs||jvr td||j|}g}t|gd}t|jt|jfg}|jj|j j ||dD] \} } | t| q2|S)Nz'Module is not in lsass memory space! %s)patterns)rDscannerr5) rr4rJMultiStringScannerrrr r2scanr/rDrg) r module_namepattern find_first reverse_orderrZresrr5hit_r r r find_in_modules  zVol3Reader.find_in_moduler)FF)rrrrr7r?r8r9r:r;r<rsrur}rrrrrprrr r r r r.8s&       r.c cs|jD]}|j|D]}d|fVq q|jD]Y}|}|ddkrM|ddurLt|dt|dt|ddddddt|ddg }d|fVq|}t|ddddddt|dt|d t|d dg }d|fVqdS) Nrcredtypedpapipassword domainnameusername masterkeysha1_masterkeykey_guid)logon_sessions to_grep_rowsorphaned_credsto_dictr)mimiluidrowcredtxr r r vol3_generators      8 8 rc CsLtdtfdtfdtfdtfdtfdtfdtfdtfd tfd tfg t|S) NrrrNThashLMHashSHAHashrzmasterkey(sha1)rr)rUTreeGridrr)rr r r vol3_treegrids rN)pypykatz.commons.commonrrrr&r.rrr r r r s A