o
    j                 
   @   s  d Z ddlT ddlT dZee  ZdZdZdZ	dZ
dZd	Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!dZ"d Z#d!Z$d"Z%d#Z&d$Z'd%Z(d&Z)d'Z*d(Z+d)Z,d*Z-d+Z.d,Z/d-Z0d.Z1d/Z2d0Z3d1Z4d2Z5d3Z6d4Z7d5Z8d6Z9d7Z:d8Z;d9Z<d:Z=d;Z>d<Z?d=Z@d>ZAd?ZBd@ZCdAZDdBZEdCZFdDZGdEZHdFZIdGZJdHZKdZLd'ZMd)ZNdIZOdEZPdZQd'ZRdZSd'ZTd)ZUd-ZVd5ZWdEZPdJZXdKZYdLZZe[eVB Z\e]eSB eTB eUB eVB eWB ePB eXB eYB eZB Z^dIZ_dMZ`dNZadOZbdPZcdQZddRZedEZfd)Zgd-ZhdSZid5ZjdZkdSZld'ZmdTZndLZodUZpdVZqdZrd'Zsd(Ztd)ZueuZvd*Zwd+Zxd,Zyd-Zzd.Z{d/Z|d0Z}e}Z~G dWdX dXeZeeZG dYdZ dZeZG d[d\ d\eZeeZejZdZd'Zd(Zd)Zd*Zd+Zd,Zd-Zd.Zd/Zd0Zd1Zd2Zd3Zd4Zd5Zd6Zd7Zd8Zd9Zd:Zd;Zd<Zd=Zd>Zd?Zd@ZdAZdBZdCZdDZdEZdFZdGZdHZd]Zd^Zd_Zd`ZdaZdbZejZeeZdZd'ZdZd'Zd(ZejZeeZdVZdZd'Zd(ZejZeeZG dcdd ddeZeeZG dedf dfeZeeÃZG dgdh dheZeeŃZG didj djeZeeǃZG dkdl dleZeeɃZG dmdn dneZee˃ZG dodp dpeZee̓ZG dqdr dreZeeσZG dsdt dteZeeуZdZd'Zd(Zd)Zd*Zd+Zd,Zd-Zd.Zd/Zd5ZdKZdZeZdZd'Zd)ZeeB eB ZeZeZdZd'Zd(Zd)Zd*Zd+Zd,Zd-Zd.Zd/Zd0ZeZdZd'Zd(Zd)Zd*Zd+Zd,Zd-Zd.Zd/Zd0ZG dudv dveZ G dwdx dxeZG dydz dzeZG d{d| d|eZeeZG d}d~ d~eZG dd deZ	eZ
dZd'ZdZdVZdZdZdZdZeZdZd'Zd(Zd)Zd*ZdZd'Zd)Zd-Zd4ZeZdZdZ dZ!dZ"dZ#dZ$dZ%ejZ&dVZ'ejZ(dVZ)dZ*dZ+d'Z,d)Z-d-Z.d5Z/dEZ0dJZ1dKZ2dLZ3dRZ4dZ5d'Z6d)Z7d-Z8d5Z9dEZ:dVZ;dZ<d'Z=d(Z>d)Z?dVZ@dZAd'ZBd(ZCdZDd'ZEd(ZFdZGd'ZHd)ZId-ZJd5ZKdEZLdLZMd0ZNdZOdZPd'ZQd(ZRd)ZSd*ZTd+ZUd,ZVdZWd'ZXd)ZYd-ZZd5Z[dEZ\dJZ]dKZ^dLZ_dZ`dZad'Zbd(Zcd)Zdd*Zed+Zfd,Zgd-Zhd.Zid/Zjd0Zkd1Zld2Zmd3ZndZWd'ZXd)ZYd-ZZd5Z[dEZ\dJZ]dKZ^dLZ_dTZodZpdZqdVZrdZsd'Ztd(ZudZvd'ZwG dd deZxeexZyG dd deZzeezZ{G dd deZ|G dd deZ}ee|Z~ee}ZG dd deZG dd deZeeZeeZG dd deZG dd deZG dd deZG dd deZG dd deZG dd deZG dd deZG dd deZG dd deZdd Zdd ZeeeZdd Zdd ZeeeZdd Zdd ZeeeZdd Zdd ZeeeZdd Zdd ZeeeZdd Zdd ZddĄ ZddƄ ZddȄ Ze^fddʄZdwdd̈́ZefddτZe^deefddфZddӄ ZddՄ Zddׄ ZeeeZddل Zddۄ ZeeeZdxddބZdd Zdd Zdd ZdyddZeeZeeeZdzddZeeZeeeZd{ddZd{ddZeeeZeeeeeeeZd|ddZdedefddZdd ZĐeedVfddZŐd}ddZdd Zǐd~ddZȐeȐZdd Zdeafdd ZdeafddZ̐eeːẽZeadfddZeadfddZϐeeΐeσZeadfddZeadfd	d
ZҐeeѐe҃ZeadeefddZeadeefddZՐeeԐeՃZeefddZeefddZؐdddZِdddZڐeeِeڃZېdddZܐdd ZݐdddZސdddZߐeeސe߃Zddd Ze ZZd!d" Zd#d$ ZeeeZdwd%d&Zdwd'd(Zdwd)d*ZeeeZdd+d,Zdd-d.ZeeeZdd/d0Zdd1d2ZeeeZdd3d4Zdd5d6ZeeeZdenfd7d8Zdenfd9d:ZeeeZd;d< Zd=d> ZeeeZdd?d@ZddAdBZeeeZdCdD ZdEdF Zdde4fdGdHZdde4fdIdJZ eee Ze*fdKdLZe*fdMdNZeeeZde*eKe>eAdddddf
dOdPZde*eKe>eAdddddf
dQdRZeeeZdSdT ZdUdV Z	dWdX Z
ee	e
ZdYdZ Zd[d\ ZeeeZdd]d^Zdd_d`ZeeeZdadb Zdcdd Ze'fdedfZeNeOB eFfdgdhZeNeOB eFfdidjZeeeZe)eNeOB eFdfdkdlZe)eNeOB eFdfdmdnZeeeZddodpZdqdr Zd}dsdtZee  eZdudv eD Ze   dS (  z%
Wrapper for advapi32.dll in ctypes.
   )*NSeAssignPrimaryTokenPrivilegeSeAuditPrivilegeSeBackupPrivilegeSeChangeNotifyPrivilegeSeCreateGlobalPrivilegeSeCreatePagefilePrivilegeSeCreatePermanentPrivilegeSeCreateSymbolicLinkPrivilegeSeCreateTokenPrivilegeSeDebugPrivilegeSeEnableDelegationPrivilegeSeImpersonatePrivilegeSeIncreaseBasePriorityPrivilegeSeIncreaseQuotaPrivilegeSeIncreaseWorkingSetPrivilegeSeLoadDriverPrivilegeSeLockMemoryPrivilegeSeMachineAccountPrivilegeSeManageVolumePrivilegeSeProfileSingleProcessPrivilegeSeRelabelPrivilegeSeRemoteShutdownPrivilegeSeRestorePrivilegeSeSecurityPrivilegeSeShutdownPrivilegeSeSyncAgentPrivilegeSeSystemEnvironmentPrivilegeSeSystemProfilePrivilegeSeSystemtimePrivilegeSeTakeOwnershipPrivilegeSeTcbPrivilegeSeTimeZonePrivilegeSeTrustedCredManAccessPrivilegeSeUndockPrivilegeSeUnsolicitedInputPrivilege                     	   
                                                                      !   "   #   l        @         l       l       l       l       l       i?  i     i      c                   @      e Zd ZdefdefgZdS )LUIDLowPartHighPartN)__name__
__module____qualname__DWORDLONG_fields_ rW   rW   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/winapi/local/function_defs/advapi32.pyrN          rN   c                   @   rM   )LUID_AND_ATTRIBUTESLuid
AttributesN)rQ   rR   rS   rN   rT   rV   rW   rW   rW   rX   rZ      rY   rZ   c                   @   rM   )TOKEN_PRIVILEGESPrivilegeCount
PrivilegesN)rQ   rR   rS   rT   rZ   rV   rW   rW   rW   rX   r]      s    r]   $   %   &   '   (   )   c                   @   rM   )SID_AND_ATTRIBUTESSidr\   N)rQ   rR   rS   PSIDrT   rV   rW   rW   rW   rX   rf   g  rY   rf   c                   @      e Zd ZdefgZdS )
TOKEN_USERUserNrQ   rR   rS   rf   rV   rW   rW   rW   rX   rj   q      rj   c                   @   ri   )TOKEN_MANDATORY_LABELLabelNrl   rW   rW   rW   rX   rn   z  rm   rn   c                   @   ri   )TOKEN_OWNEROwnerNrQ   rR   rS   rh   rV   rW   rW   rW   rX   rp     rm   rp   c                   @   ri   )TOKEN_PRIMARY_GROUPPrimaryGroupNrr   rW   rW   rW   rX   rs     rm   rs   c                   @   ri   )TOKEN_APPCONTAINER_INFORMATIONTokenAppContainerNrr   rW   rW   rW   rX   ru     rm   ru   c                   @   ri   )TOKEN_ORIGINOriginatingLogonSessionN)rQ   rR   rS   rN   rV   rW   rW   rW   rX   rw     rm   rw   c                   @   ri   )TOKEN_LINKED_TOKENLinkedTokenN)rQ   rR   rS   HANDLErV   rW   rW   rW   rX   ry     rm   ry   c                   @   sL   e Zd Zdefdefdefdefdefdefdefdefd	efd
efg
ZdS )TOKEN_STATISTICSTokenIdAuthenticationIdExpirationTime	TokenTypeImpersonationLevelDynamicChargedDynamicAvailable
GroupCountr^   
ModifiedIdN)	rQ   rR   rS   rN   LONGLONG
TOKEN_TYPESECURITY_IMPERSONATION_LEVELrT   rV   rW   rW   rW   rX   r|     s    r|   c                   @   s&   e Zd Zdee fdefdefgZdS )_WAITCHAIN_NODE_INFO_STRUCT_1
ObjectNameTimeout	AlertableN)rQ   rR   rS   WCHARWCT_OBJNAME_LENGTHr   BOOLrV   rW   rW   rW   rX   r   ;  s
    
r   c                   @   s(   e Zd ZdefdefdefdefgZdS )_WAITCHAIN_NODE_INFO_STRUCT_2	ProcessIdThreadIdWaitTimeContextSwitchesNrQ   rR   rS   rT   rV   rW   rW   rW   rX   r   B  s    r   c                   @   rM   )_WAITCHAIN_NODE_INFO_UNION
LockObjectThreadObjectN)rQ   rR   rS   r   r   rV   rW   rW   rW   rX   r   J  rY   r   c                   @   s"   e Zd ZdefdefdefgZdS )WAITCHAIN_NODE_INFO
ObjectTypeObjectStatusuN)rQ   rR   rS   WCT_OBJECT_TYPEWCT_OBJECT_STATUSr   rV   rW   rW   rW   rX   r   P  
    r   c                   @      e Zd ZdZdd ZdS )WaitChainNodeInfoa  
	Represents a node in the wait chain.

	It's a wrapper on the L{WAITCHAIN_NODE_INFO} structure.

	The following members are defined only
	if the node is of L{WctThreadType} type:
	 - C{ProcessId}
	 - C{ThreadId}
	 - C{WaitTime}
	 - C{ContextSwitches}

	@see: L{GetThreadWaitChain}

	@type ObjectName: unicode
	@ivar ObjectName: Object name. May be an empty string.

	@type ObjectType: int
	@ivar ObjectType: Object type.
		Should be one of the following values:
		 - L{WctCriticalSectionType}
		 - L{WctSendMessageType}
		 - L{WctMutexType}
		 - L{WctAlpcType}
		 - L{WctComType}
		 - L{WctThreadWaitType}
		 - L{WctProcessWaitType}
		 - L{WctThreadType}
		 - L{WctComActivationType}
		 - L{WctUnknownType}

	@type ObjectStatus: int
	@ivar ObjectStatus: Wait status.
		Should be one of the following values:
		 - L{WctStatusNoAccess} I{(ACCESS_DENIED for this object)}
		 - L{WctStatusRunning} I{(Thread status)}
		 - L{WctStatusBlocked} I{(Thread status)}
		 - L{WctStatusPidOnly} I{(Thread status)}
		 - L{WctStatusPidOnlyRpcss} I{(Thread status)}
		 - L{WctStatusOwned} I{(Dispatcher object status)}
		 - L{WctStatusNotOwned} I{(Dispatcher object status)}
		 - L{WctStatusAbandoned} I{(Dispatcher object status)}
		 - L{WctStatusUnknown} I{(All objects)}
		 - L{WctStatusError} I{(All objects)}

	@type ProcessId: int
	@ivar ProcessId: Process global ID.

	@type ThreadId: int
	@ivar ThreadId: Thread global ID.

	@type WaitTime: int
	@ivar WaitTime: Wait time.

	@type ContextSwitches: int
	@ivar ContextSwitches: Number of context switches.
	c                 C   sf   |j | _ |j| _| j tkr*|jjj| _|jjj| _|jjj| _|jjj| _d| _	d S |jj
j	j| _	d S N )r   r   WctThreadTyper   r   r   r   r   r   r   r   value)self
aStructurerW   rW   rX   __init__  s   

zWaitChainNodeInfo.__init__NrQ   rR   rS   __doc__r   rW   rW   rW   rX   r   Y  s    Br   c                       sT   e Zd ZdZd fdd	Zdd Zdd Zdd	d
Zedd Z	edd Z
  ZS )ThreadWaitChainSessionHANDLEzd
	Thread wait chain session handle.

	Returned by L{OpenThreadWaitChainSession}.

	@see: L{HANDLE}
	Nc                    s   t t| j|dd dS )z?
		@type  aHANDLE: int
		@param aHANDLE: Win32 handle value.
		T
bOwnershipN)superr   r   )r   aHANDLE	__class__rW   rX   r     s   
z%ThreadWaitChainSessionHANDLE.__init__c                 C   s    | j d u r	tdt| j  d S )NzHANDLE was already closed!)r   
ValueErrorCloseThreadWaitChainSessionr   rW   rW   rX   _close  s   
z#ThreadWaitChainSessionHANDLE._closec                 C      t  NNotImplementedErrorr   rW   rW   rX   dup     z ThreadWaitChainSessionHANDLE.dupc                 C   r   r   r   )r   dwMillisecondsrW   rW   rX   wait  r   z!ThreadWaitChainSessionHANDLE.waitc                 C      dS NFrW   r   rW   rW   rX   inherit     z$ThreadWaitChainSessionHANDLE.inheritc                 C   r   r   rW   r   rW   rW   rX   protectFromClose  r   z-ThreadWaitChainSessionHANDLE.protectFromCloser   )rQ   rR   rS   r   r   r   r   r   propertyr   r   __classcell__rW   rW   r   rX   r     s    

r   i      i   i   ServicesActiveServicesFailed+l    i 0      i   c                   @   s:   e Zd ZdefdefdefdefdefdefdefgZdS )	SERVICE_STATUSdwServiceTypedwCurrentStatedwControlsAccepteddwWin32ExitCodedwServiceSpecificExitCodedwCheckPoint
dwWaitHintNr   rW   rW   rW   rX   r   ~  s    r   c                   @   s"   e Zd Zejdefdefg ZdS )SERVICE_STATUS_PROCESSdwProcessIddwServiceFlagsN)rQ   rR   rS   r   rV   rT   rW   rW   rW   rX   r     s
    
r   c                   @   "   e Zd ZdefdefdefgZdS )ENUM_SERVICE_STATUSAlpServiceNamelpDisplayNameServiceStatusN)rQ   rR   rS   LPSTRr   rV   rW   rW   rW   rX   r     r   r   c                   @   r   )ENUM_SERVICE_STATUSWr   r   r   N)rQ   rR   rS   LPWSTRr   rV   rW   rW   rW   rX   r     r   r   c                   @   r   )ENUM_SERVICE_STATUS_PROCESSAr   r   ServiceStatusProcessN)rQ   rR   rS   r   r   rV   rW   rW   rW   rX   r     r   r   c                   @   r   )ENUM_SERVICE_STATUS_PROCESSWr   r   r   N)rQ   rR   rS   r   r   rV   rW   rW   rW   rX   r     r   r   c                   @   r   )r   z0
	Wrapper for the L{SERVICE_STATUS} structure.
	c                 C   s<   |j | _|j| _|j| _|j| _|j| _	|j
| _|j| _dS )z]
		@type  raw: L{SERVICE_STATUS}
		@param raw: Raw structure for this service status data.
		N)r   ServiceTyper   CurrentStater   ControlsAcceptedr   Win32ExitCoder   ServiceSpecificExitCoder   
CheckPointr   WaitHintr   rawrW   rW   rX   r     s   zServiceStatus.__init__Nr   rW   rW   rW   rX   r         r   c                   @   r   )r   z8
	Wrapper for the L{SERVICE_STATUS_PROCESS} structure.
	c                 C   sL   |j | _|j| _|j| _|j| _|j| _	|j
| _|j| _|j| _|j| _dS )ze
		@type  raw: L{SERVICE_STATUS_PROCESS}
		@param raw: Raw structure for this service status data.
		N)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   ServiceFlagsr   rW   rW   rX   r     s   zServiceStatusProcess.__init__Nr   rW   rW   rW   rX   r     r   r   c                   @       e Zd ZdZdd Zdd ZdS )ServiceStatusEntryz;
	Service status entry returned by L{EnumServicesStatus}.
	c                 C   sZ   |j | _|j| _|jj| _|jj| _|jj	| _
|jj| _|jj| _|jj| _|jj| _dS )z
		@type  raw: L{ENUM_SERVICE_STATUSA} or L{ENUM_SERVICE_STATUSW}
		@param raw: Raw structure for this service status entry.
		N)r   ServiceNamer   DisplayNamer   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   rW   rW   rX   r     s   





zServiceStatusEntry.__init__c                 C   s   g }| j t@ r|d n|d | jr!|d| j| jf  n|d| j  | jtkr4|d nA| jtkr?|d n6| jtkrJ|d n+| jt	krU|d n | jt
kr`|d	 n| jtkrk|d
 n
| jtkru|d d|S )NzInteractive serviceService	"%s" (%s)"%s"zis about to continue.zis pausing.z
is paused.zis running.zis starting.zis stopping.zis stopped. )r   SERVICE_INTERACTIVE_PROCESSappendr   r   r   SERVICE_CONTINUE_PENDINGSERVICE_PAUSE_PENDINGSERVICE_PAUSEDSERVICE_RUNNINGSERVICE_START_PENDINGSERVICE_STOP_PENDINGSERVICE_STOPPEDjoinr   outputrW   rW   rX   __str__  s,   










zServiceStatusEntry.__str__NrQ   rR   rS   r   r   r   rW   rW   rW   rX   r     s    r   c                   @   r   )ServiceStatusProcessEntryz=
	Service status entry returned by L{EnumServicesStatusEx}.
	c                 C   sn   |j | _|j| _|jj| _|jj| _|jj	| _
|jj| _|jj| _|jj| _|jj| _|jj| _|jj| _dS )z
		@type  raw: L{ENUM_SERVICE_STATUS_PROCESSA} or L{ENUM_SERVICE_STATUS_PROCESSW}
		@param raw: Raw structure for this service status entry.
		N)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   rW   rW   rX   r     s   







z"ServiceStatusProcessEntry.__init__c                 C   s  g }| j t@ r|d n|d | jr!|d| j| jf  n|d| j  | jtkr4|d nA| jtkr?|d n6| jtkrJ|d n+| jt	krU|d n | jt
kr`|d	 n| jtkrk|d
 n
| jtkru|d | jr|d| j  |d d|S )NzInteractive service zService r   r   z is about to continuez is pausingz
 is pausedz is runningz is startingz is stoppingz is stoppedz at process %d.r   )r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   rW   rW   rX   r   .  s2   











z!ServiceStatusProcessEntry.__str__Nr  rW   rW   rW   rX   r    s    r  c                   @   s   e Zd ZdZdS )TokenHandlez*
	Access token handle.

	@see: L{HANDLE}
	N)rQ   rR   rS   r   rW   rW   rW   rX   r  N  s    r  c                   @      e Zd ZdZeZdd ZdS )RegistryKeyHandlez
	Registry key handle.
	c                 C      t | j d S r   )RegCloseKeyr   r   rW   rW   rX   r   ]     zRegistryKeyHandle._closeN)rQ   rR   rS   r   HKEY_TYPEr   rW   rW   rW   rX   r  V  s    r  c                   @   r  )SaferLevelHandlez_
	Safer level handle.

	@see: U{http://msdn.microsoft.com/en-us/library/ms722425(VS.85).aspx}
	c                 C   r  r   )SaferCloseLevelr   r   rW   rW   rX   r   i  r	  zSaferLevelHandle._closeN)rQ   rR   rS   r   SAFER_LEVEL_HANDLEr  r   rW   rW   rW   rX   r  `      r  c                   @   r  )ServiceHandlezm
	Service handle.

	@see: U{http://msdn.microsoft.com/en-us/library/windows/desktop/ms684330(v=vs.85).aspx}
	c                 C   r  r   CloseServiceHANDLEr   r   rW   rW   rX   r   u  r	  zServiceHandle._closeNrQ   rR   rS   r   	SC_HANDLEr  r   rW   rW   rW   rX   r  l  r  r  c                   @   r  )ServiceControlManagerHandlez
	Service Control Manager (SCM) handle.

	@see: U{http://msdn.microsoft.com/en-us/library/windows/desktop/ms684323(v=vs.85).aspx}
	c                 C   r  r   r  r   rW   rW   rX   r     r	  z"ServiceControlManagerHandle._closeNr  rW   rW   rW   rX   r  x  r  r  c                  C   x   t jj} ttg| _t| _td}| d t	| t
 }|tkr#t|td|jd }| |t	|}|s9t |jS NrL   r   r   )windlladvapi32GetUserNameAr   LPDWORDargtypesboolrestyperT   byrefGetLastErrorERROR_INSUFFICIENT_BUFFERctypesWinErrorcreate_string_bufferr   )_GetUserNameAnSizeerrorlpBuffersuccessrW   rW   rX   r       

r  c                  C   r  r  )r  r  GetUserNameWr   r  r  r  r  rT   r  r   r!  r"  r#  create_unicode_bufferr   )_GetUserNameWr&  r'  r(  r)  rW   rW   rX   r+    r*  r+  c              	   C   s   t jj}tttttttg|_t|_t	d}t	d}t	d}|| |d t
|d t
|t
| t }|tkr9t|td|j}tt|t}td|jd }	|| ||t
||	t
|t
|}
|
sht ||	j|jfS r  )r  r  LookupAccountNameAr   rh   r  r  r   r  rT   r  r   r!  r"  r#  r$  r   castpointer)lpSystemNamelpAccountName_LookupAccountNameAcbSidcchReferencedDomainNamepeUser'  sidpsidlpReferencedDomainNamer)  rW   rW   rX   r.    "    
 r.  c              	   C   s   t jj}tttttttg|_t|_t	d}t	d}t	d}|| |d t
|d t
|t
| t }|tkr9t|td|j}tt|t}td|jd }	|| ||t
||	t
|t
|}
|
sht ||	j|jfS r  )r  r  LookupAccountNameWr   rh   r  r  r   r  rT   r  r   r!  r"  r#  r$  r   r/  r0  r,  )r1  r2  _LookupAccountNameWr4  r5  r6  r'  r7  r8  r9  r)  rW   rW   rX   r;    r:  r;  c           
   	   C   s   t jj}tttttttg|_t|_t	d}t	d}t	d}|| |d t
|d t
|t
| t }|tkr9t|td|d }td|d }|| ||t
||t
|t
|}	|	s_t |j|j|jfS r  )r  r  LookupAccountSidAr   rh   r  r  r  r  rT   r  r   r!  r"  r#  r$  r   )
r1  lpSid_LookupAccountSidAcchNamer5  r6  r'  lpNamer9  r)  rW   rW   rX   r=    s     
 r=  c           
   	   C   s   t jj}tttttttg|_t|_	t
d}t
d}t
d}|| |d t|d t|t| t }|tkr9t|td|jd }td|jd }|| ||t||t|t|}	|	sat |j|j|jfS r  )r  r  LookupAccountSidWr   rh   r   r  r  r  r  rT   r  r   r!  r"  r#  r,  r   )
r1  r>  _LookupAccountSidWr@  r5  r6  r'  rA  r9  r)  rW   rW   rX   rB    s     
 rB  c                 C   sZ   t jj}tttg|_t|_t	|_
t }|| t| z|j}W t| | S t| w r   )r  r  ConvertSidToStringSidArh   POINTERr   r  r  r  RaiseIfZeroerrcheckr  r   	LocalFreedecode)rg   _ConvertSidToStringSidA
pStringSid	StringSidrW   rW   rX   rD    s   
rD  c                 C   sV   t jj}tttg|_t|_t	|_
t }|| t| z
|j}W t| |S t| w r   )r  r  ConvertSidToStringSidWrh   rE  r   r  r  r  rF  rG  r  r   rH  )rg   _ConvertSidToStringSidWrK  rL  rW   rW   rX   rM  "  s   
rM  c                 C   :   t jj}ttg|_t|_t|_	t }|| t
| |jS r   )r  r  ConvertStringSidToSidAr   PVOIDr  r  r  rF  rG  r"  r0  r   )rL  _ConvertStringSidToSidArg   rW   rW   rX   rP  6     
rP  c                 C   rO  r   )r  r  ConvertStringSidToSidWr   rQ  r  r  r  rF  rG  r"  r0  r   )rL  _ConvertStringSidToSidWrg   rW   rW   rX   rT  @  rS  rT  c                 C      t jj}tg|_t|_|| S r   )r  r  
IsValidSidrh   r  r  r  )pSid_IsValidSidrW   rW   rX   rW  O     rW  c                 C   s"   t jj}ttg|_t|_|| |S r   )r  r  EqualSidrh   r  r  r  )pSid1pSid2	_EqualSidrW   rW   rX   r[  Y  s   

r[  c                 C   rV  r   )r  r  GetLengthSidrh   r  rT   r  )rX  _GetLengthSidrW   rW   rX   r_  b  rZ  r_  c                 C   s^   t jj}tttg|_t|_t	|_
t| }td|}tt|t}||||  t|tS r   )r  r  CopySidrT   rQ  rh   r  r  r  rF  rG  r_  r"  r$  r/  r0  )
pSourceSid_CopySidnDestinationSidLengthDestinationSidpDestinationSidrW   rW   rX   ra  m  s   ra  c                 C   s(   t jj}tg|_t|_t|_||  d S r   )r  r  FreeSidrh   r  r  RaiseIfNotZerorG  )rX  _FreeSidrW   rW   rX   rg  |  
   rg  c                 C   B   t jj}tttg|_t|_t	|_
tt}|| |t| t|jS r   )r  r  OpenProcessTokenr{   rT   PHANDLEr  r  r  rF  rG  INVALID_HANDLE_VALUEr  r  r   )ProcessHANDLEDesiredAccess_OpenProcessTokenNewTokenHandlerW   rW   rX   rl       
rl  Tc                 C   sF   t jj}ttttg|_t|_	t
|_tt}|| ||t| t|jS r   )r  r  OpenThreadTokenr{   rT   r   rm  r  r  r  rF  rG  rn  r  r  r   )ThreadHANDLErp  
OpenAsSelf_OpenThreadTokenrr  rW   rW   rX   rt       
rt  c                 C   rk  r   )r  r  DuplicateTokenr{   r   rm  r  r  r  rF  rG  rn  r  r  r   )ExistingTokenHandler   _DuplicateTokenDuplicateTokenHandlerW   rW   rX   ry    rs  ry  c                 C   sN   t jj}ttttttg|_	t
|_t|_tt}|| ||||t| t|jS r   )r  r  DuplicateTokenExr{   rT   LPSECURITY_ATTRIBUTESr   r   rm  r  r  r  rF  rG  rn  r  r  r   )hExistingTokendwDesiredAccesslpTokenAttributesr   r   _DuplicateTokenExr|  rW   rW   rX   r}    s   
r}  c                 C   s,   t jj}tg|_t|_t|_t	t
 || S r   )r  r  IsTokenRestrictedr{   r  r  r  RaiseIfNotErrorSuccessrG  SetLastErrorERROR_SUCCESS)hTokenHandle_IsTokenRestrictedrW   rW   rX   r    s   r  c                 C   B   t jj}tttg|_t|_t|_	t
 }| sd } || |t| |S r   )r  r  LookupPrivilegeValueAr   PLUIDr  r  r  rF  rG  rN   r  )r1  rA  _LookupPrivilegeValueAlpLuidrW   rW   rX   r       r  c                 C   r  r   )r  r  LookupPrivilegeValueWr   r  r  r  r  rF  rG  rN   r  )r1  rA  _LookupPrivilegeValueWr  rW   rW   rX   r    r  r  c                 C   n   t jj}ttttg|_t|_t	|_
td}|| t|tt| td|j}|| t|t|t| |jS NrL   r   )r  r  LookupPrivilegeNameAr   r  r  r  r  r  rF  rG  rT   r  NULLr"  r$  r   )r1  r  _LookupPrivilegeNameAr@  rA  rW   rW   rX   r       r  c                 C   r  r  )r  r  LookupPrivilegeNameWr   r  r  r  r  r  rF  rG  rT   r  r  r"  r,  r   )r1  r  _LookupPrivilegeNameWr@  rA  rW   rW   rX   r    r  r  rW   c           
      C   s   t jj}ttttttg|_t|_	|s t
|_|| ttdtt d S d}d}|D ]C\}}t|ts4tt|}|dkr;t}n|dkrBt}n	|d krId}n|}t||}td|}	|| tt|	t|	ttdkrid}t }q&|sqt|d S )NrL   TFr   )r  r  AdjustTokenPrivilegesr{   r   LPVOIDrT   r  r  r  rF  rG  TRUEr  
isinstancerN   LookupPrivilegeValueSE_PRIVILEGE_ENABLEDSE_PRIVILEGE_REMOVEDrZ   r]   FALSEr  sizeofr   r"  r#  )
r  NewState_AdjustTokenPrivilegesr)  errcode	privilegeenabledflagslaatprW   rW   rX   r    s6   




r  c                 C   s  |dks|t krtd| |tkr t }t| || |jjjS |tkr1t	 }t| || |j
jS |tkrBt }t| || |jjS |tkrSt }t| || |jjS |tkrit }t| || |jjj|jjfS |tkryt }t| || |jS |tkrtd}t| || |jS |tkrtd}t| || |jS |tkrtd}t| || |jS |ttfv rtd}t| || |jS |tt t!t"t#fv rtd}t| || t$|jS |t%krt&d}t| || t'|j(jddS |t)krt* }t| || |S t+d| )NrL   z,Invalid value for TokenInformationClass (%i)Tr   z,TokenInformationClass(%i) not yet supported!),MaxTokenInfoClassr   	TokenUserrj   _internal_GetTokenInformationrk   rg   r   
TokenOwnerrp   rq   rs   rt   TokenAppContainerSidru   rv   TokenIntegrityLevelrn   ro   r\   TokenOriginrw   rx   r   r   TokenElevationTOKEN_ELEVATIONr   TokenSessionIdTokenAppContainerNumberrT   TokenSandBoxInertTokenHasRestrictionsTokenUIAccessTokenVirtualizationAllowedTokenVirtualizationEnabledr  TokenLinkedTokenry   r  rz   TokenStatisticsr|   r   )r  TokenInformationClassTokenInformationrW   rW   rX   GetTokenInformationB  sr   

r  c                 C   sd   t jj}tttttg|_t	|_
t|_td}t|}|| |t||t| |j|kr0tt|S NrL   )r  r  r  r{   TOKEN_INFORMATION_CLASSr  rT   PDWORDr  r  r  rF  rG  r  r  r   r"  r#  r!  )r  r  r  _GetTokenInformationReturnLengthTokenInformationLengthrW   rW   rX   r    s   

r  c              
   C   s   t jj}tttttg|_t	|_
t|_td}z|| dd|t| W n ty4 } zW Y d}~nd}~ww |j}td}t|  }|| dt||t| |j|krWttt|ttj}|jjS )zP
	The original function wasn't working. this one returns the SID for the token
	rL   r   N)r  r  r  r{   r  r  rT   r  r  r  r  rF  rG  r  	Exceptionr   BYTEr"  r#  r!  r/  rE  rj   contentsrk   rg   )r  r  r  er  titrW   rW   rX   GetTokenInformation_sid  s&   


r  c
                 C   s  t jj}
tttttttttttg|
_t|
_	t
|
_| sd } |s d }|s$d }|s(d }|s-d }nt|ttt|d }|s?d }nt|}|sHd }|	sdt }	tt|	_d|	_d|	_d|	_d|	_d|	_d|	_t }t|_t|_d|_d|_|
| ||||||||t |	t | |S Nr   rL   )!r  r  CreateProcessWithLogonWr   rT   r  LPPROCESS_INFORMATIONr  r  r  rF  rG  r"  r,  maxMAX_PATHlenSTARTUPINFOWr  cb
lpReserved	lpDesktoplpTitledwFlagscbReserved2lpReserved2PROCESS_INFORMATIONrn  hProcesshThreadr   
dwThreadIdr  )
lpUsernamelpDomain
lpPassworddwLogonFlagslpApplicationNamelpCommandLinedwCreationFlagslpEnvironmentlpCurrentDirectorylpStartupInfo_CreateProcessWithLogonWlpProcessInformationrW   rW   rX   r    sH   

$r  c           
      C   s   t jj}tttttttttg	|_t	|_
t|_| sd } |sd }|s#d }nt|ttt|d }|s5d }nt|}|s>d }|sZt }tt|_d|_d|_d|_d|_d|_d|_t }	t|	_t|	_d|	_d|	_ || ||||||t!|t!|		 |	S r  )"r  r  CreateProcessWithTokenWr{   rT   r   r  r  r  r  r  rF  rG  r"  r,  r  r  r  r  r  r  r  r  r  r  r  r  r  rn  r  r  r   r  r  )
hTokenr  r  r  r  r  r  r  _CreateProcessWithTokenWr  rW   rW   rX   r    s@   

 r  Fc
                 C   s*  t jj}
ttttttttttt	g|
_
t|
_t|
_|sd }|s!d }nt|dttt|d }|s6d }nt|d}|sBd }|sGd }nt|}|sPd }nt|}|	spt }	tt|	_d|	_d|	_d|	_d|	_d|	_d|	_t }t |_!t |_"d|_#d|_$|
| ||||t||||t|	t| |S )Nasciir   rL   )%r  r  CreateProcessAsUserAr{   r   r~  r   rT   r  r  r  r  r  rF  rG  r"  r$  encoder  r  r  r  STARTUPINFOr  r  r  r  r  r  r  r  r  rn  r  r  r   r  )r  r  r  lpProcessAttributeslpThreadAttributesbInheritHANDLEsr  r  r  r  _CreateProcessAsUserAr  rW   rW   rX   r  B  sH    
(r  c
                 C   s  t jj}
ttttttttttt	g|
_
t|
_t|
_|sd }|s!d }nt|ttt|d }|s3d }nt|}|s<d }|sAd }nt|}|sJd }nt|}|	sjt }	tt|	_d|	_d|	_d|	_d|	_d|	_d|	_t }t|_ t|_!d|_"d|_#|
| ||||t||||t|	t| |S r  )$r  r  CreateProcessAsUserWr{   r   r~  r   rT   r  r  r  r  r  rF  rG  r"  r,  r  r  r  r  r  r  r  r  r  r  r  r  r  r  rn  r  r  r   r  )r  r  r  r  r  r  r  r  r  r  _CreateProcessAsUserWr  rW   rW   rX   r  m  sH   

(r  c                 C   s@   t jj}ttg|_t|_t|_	|d urt
|}|| |}t|S r   )r  r  OpenThreadWaitChainSessionrT   rQ  r  HWCTr  rF  rG  PWAITCHAINCALLBACKr   )Flagscallback_OpenThreadWaitChainSessionr   rW   rW   rX   r    s   

r  c                    s   t jj}tttttttg|_t	|_
t|_t|}t|   td}|| |||t|tt tt| |j|kr]|j}t|   || |||t|tt tt| |j|ks; fddt|jD t	|jfS )NrL   c                    s   g | ]}t  | qS rW   )r   ).0indexNodeInfoArrayrW   rX   
<listcomp>  s    z&GetThreadWaitChain.<locals>.<listcomp>)r  r  GetThreadWaitChainr  r  rT   PWAITCHAIN_NODE_INFOLPBOOLr  r  r  rF  rG  r   r   r  r"  r/  r0  r   xrange)	WctHANDLEContextr  r   	NodeCount_GetThreadWaitChaindwNodeCountIsCyclerW   r   rX   r    s    
*

*
r  c                 C   s   t jj}tg|_||  d S r   )r  r  r   r  r  )r  _CloseThreadWaitChainSessionrW   rW   rX   r     s   r   c                 C   sN   t jj}ttttttg|_t|_	t
|_tt}|| ||t|d  t|jS r   )r  r  SaferCreateLevelrT   rE  r  r  r  r   r  rF  rG  rn  r  SaferLevelHANDLEr   )	dwScopeId	dwLevelId	OpenFlags_SaferCreateLevelhLevelHANDLErW   rW   rX   r    s   
r  c                 C   s\   t jj}tttttg|_t	|_
t|_tt}td}|| |t||t| t|j|jfS r  )r  r  SaferComputeTokenFromLevelr  r{   rm  rT   r  r  r   r  rF  rG  rn  r  r  r   )LevelHANDLEInAccessTokenr  _SaferComputeTokenFromLevelOutAccessTokenr  rW   rW   rX   r    s   r  c                 C   s@   t jj}tg|_t|_t|_t	| dr|| j
 d S ||  d S Nr   )r  r  r  r  r  r   r  rF  rG  hasattrr   )r  _SaferCloseLevelrW   rW   rX   r    s   
r  c                 C   s8   t jj}ttg|_t|_t|_	t
t t|t| |S r   )r  r  SaferiIsExecutableFileTyper   BOOLEANr  r   r  RaiseIfLastErrorrG  r  r  r  unicode)
szFullPathbFromShellExecute_SaferiIsExecutableFileTyperW   rW   rX   r    s   
r  c                 C   sV   t | dr	| j}n| }|ttttttfv rd S tj	j
}tg|_t|_t|_||  d S r  )r  r   HKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINE
HKEY_USERSHKEY_PERFORMANCE_DATAHKEY_CURRENT_CONFIGr  r  r  r
  r  rU   r  r  rG  )hKeyr   _RegCloseKeyrW   rW   rX   r  &  s"   
r  c                 C   B   t jj}tttg|_t|_t	|_
tt}|| |t| t|jS r   )r  r  RegConnectRegistryAr   r
  PHKEYr  rU   r  r  rG  rn  r  RegistryKeyHANDLEr   )lpMachineNamer*  _RegConnectRegistryAhkResultrW   rW   rX   r-  A  rs  r-  c                 C   r,  r   )r  r  RegConnectRegistryWr   r
  r.  r  rU   r  r  rG  rn  r  r/  r   )r0  r*  _RegConnectRegistryWr2  rW   rW   rX   r3  K  rs  r3  c                 C   rk  r   )r  r  RegCreateKeyAr
  r   r.  r  rU   r  r  rG  rn  r  r/  r   )r*  lpSubKey_RegCreateKeyAr2  rW   rW   rX   r5  \  rs  r5  c                 C   rk  r   )r  r  RegCreateKeyWr
  r   r.  r  rU   r  r  rG  rn  r  r/  r   )r*  r6  _RegCreateKeyWr2  rW   rW   rX   r8  f  rs  r8  c                 C   rk  r   )r  r  RegOpenKeyAr
  r   r.  r  rU   r  r  rG  rn  r  r/  r   )r*  r6  _RegOpenKeyAr2  rW   rW   rX   r:    rs  r:  c                 C   rk  r   )r  r  RegOpenKeyWr
  r   r.  r  rU   r  r  rG  rn  r  r/  r   )r*  r6  _RegOpenKeyWr2  rW   rW   rX   r<    rs  r<  c                 C   J   t jj}tttttg|_t	|_
t|_tt}|| |d|t| t|jS r  )r  r  RegOpenKeyExAr
  r   rT   REGSAMr.  r  rU   r  r  rG  rn  r  r/  r   )r*  r6  
samDesired_RegOpenKeyExAr2  rW   rW   rX   r?       
r?  c                 C   r>  r  )r  r  RegOpenKeyExWr
  r   rT   r@  r.  r  rU   r  r  rG  rn  r  r/  r   )r*  r6  rA  _RegOpenKeyExWr2  rW   rW   rX   rD    rC  rD  c                 C   s>   t jj}ttg|_t|_t|_	t
t}|| t| t|jS r   )r  r  RegOpenCurrentUserr@  r.  r  rU   r  r  rG  r
  rn  r  r/  r   )rA  _RegOpenCurrentUserr2  rW   rW   rX   rF    s   

rF  c                 C   sF   t jj}ttttg|_t|_	t
|_tt}|| d|t| t|jS r  )r  r  RegOpenUserClassesRootr{   rT   r@  r.  r  rU   r  r  rG  r
  rn  r  r/  r   )r  rA  _RegOpenUserClassesRootr2  rW   rW   rX   rH    rx  rH  c                 C   s`   t jj}ttttg|_t|_	t
|_td}|| |d t| t|j}|| ||t| |jS r  )r  r  RegQueryValueAr
  r   r  PLONGr  rU   r  r  rG  r  r"  r$  r   )r*  r6  _RegQueryValueAcbValuelpValuerW   rW   rX   rJ    s   rJ  c                 C   sh   t jj}ttttg|_t|_	t
|_td}|| |d t| t|jtt }|| ||t| |jS r  )r  r  RegQueryValueWr
  r   r  rK  r  rU   r  r  rG  r  r"  r,  r   r  r   )r*  r6  _RegQueryValueWrM  rN  rW   rW   rX   rO    s   rO  c                 C   s  t | }td}td}|||d t|d t| |j}|s#|j|fS |ttfv rK|jdkr5td|j td}|||d d t|t| |j|fS |tkrq|jdkr[td|j td}	|||d d t|	t| |	j|fS |t	t
fv r| rt|j}
nt|j}
|||d d t|
t| |
j|fS |tkr| rt|j}
nt|j}
|||d d t|
t| |
d d  }| r|d}n|d}dd	 |D }||fS |tkrt|j}
|||d d t|
t| |
j|fS t|j}
|||d d t|
t| |
j|fS )
NrL   r  r(   REG_DWORD value of size %dr,   REG_QWORD value of size %d c                 S      g | ]}|r|qS rW   rW   r  tokenrW   rW   rX   r  *	      z-_internal_RegQueryValueEx.<locals>.<listcomp>)_caller_RegQueryValueExrT   r  r   	REG_DWORDREG_DWORD_BIG_ENDIANr   	REG_QWORDQWORDREG_SZREG_EXPAND_SZr"  r$  r,  REG_MULTI_SZsplitREG_LINKr   )ansir*  lpValueNamebGetData_RegQueryValueExcbDatadwTypeTypedwDataqwDataszDataDataaDatarW   rW   rX   _internal_RegQueryValueEx  sV   








rn  c                 C   sJ   | rt jj}ttttttg|_nt jj}tt	ttttg|_t
|_t|_|S r   )r  r  RegQueryValueExAr
  r   r  r  r  RegQueryValueExWr   rU   r  r  rG  )rb  re  rW   rW   rX   rX  7	  s   rX  c                 C      t d| ||S NTrn  r*  rc  rd  rW   rW   rX   ro  C	  r	  ro  c                 C   rq  r   rs  rt  rW   rW   rX   rp  G	  r	  rp  c           	      C   s  |d u rt |tjrd}n*t |tjrd}n!tjtjk}nt |tjr&d}nt |tjr/d}ntdt| |d u rm|d u rBt}n+|d u rIt}n$t |tjrRt}nt |tjr[t}nt |t	rct
}n
t |trkt}nt}|r}tjj}ttttttg|_ntjj}ttttttg|_t|_t|_|d u rd }d}n[|t
tfv rt|}nH|tkrt|}n?|ttfv r|rt |}n1t!|}n+|t"kr|rt d#|d }nt!d#|d }n|t$krt!|}nt |}t%|}t&|}|| |d||| d S )NTFzString expected, got %s insteadrL   rS  z  )'r  GuessStringTypet_ansi	t_unicode	t_default	TypeErrortyper]  REG_NONEintrY  longr[  
REG_BINARYr  r  RegSetValueExAr
  r   rT   r  r  RegSetValueExWr   rU   r  r  rG  rZ  r\  r^  r"  r$  r,  r_  r   ra  r  r  )	r*  rc  lpDatarg  rb  _RegSetValueExDataRefDataSizerl  rW   rW   rX   RegSetValueExT	  sj   




r  c                 C   s   t jj}ttttg|_t|_d}	 t	
|}|| |||}|tkr"n|d }|dkr/t	|q|tkr6d S |tkr?t	||jS )Nr   Tr   )r  r  RegEnumKeyAr
  rT   r   r  rU   r  r"  r$  ERROR_MORE_DATAr#  ERROR_NO_MORE_ITEMSr  r   )r*  dwIndex_RegEnumKeyAr@  rA  r  rW   rW   rX   r  	  s$   


r  c                 C   s   t jj}ttttg|_t|_d}	 t	
|}|| |||d }|tkr$n|d }|dkr1t	|q|tkr8d S |tkrAt	||jS )NrK   Tr&   i   )r  r  RegEnumKeyWr
  rT   r   r  rU   r  r"  r,  r  r#  r  r  r   )r*  r  _RegEnumKeyWr@  rA  r  rW   rW   rX   r  	  s$   


r  c              	   C   s  | rt jj}ttttttttg|_nt jj	}ttt
tttttg|_t|_td}td}t|}t|}| r=t|j}	nt|j}	|rNtd}
t|
}nd }d }||||	|d |||}|tksg|r|tkr| rx|jtt |_t|j}	n|jtt |_t|j}	|r|j}|ttfv r|
jttkrtd|
j td}n?|tkr|
jttkrtd|
j td}n(|tttfv r| rt|
j}nt|
j}n|tkrt|
j}nt|
j}t|}||||	|d |||}|t krd S |s|	j|jfS |ttttttfv r|	j|j|jfS |tkr<|d d  }~| r)|!d}n|!d}dd |D }|	j|j|fS |	j|j|j"fS )	Nr   r  rL   rQ  rR  rS  c                 S   rT  rW   rW   rU  rW   rW   rX   r  8
  rW  z*_internal_RegEnumValue.<locals>.<listcomp>)#r  r  RegEnumValueAr
  rT   r   r  r  r  RegEnumValueWr   rU   r  r  r"  r$  r   r,  r  r  r  CHARr   rY  rZ  r   r[  r\  r]  r^  r_  ra  r  r`  r   )rb  r*  r  rd  _RegEnumValuecchValueNamerg  lpcchValueNamelpTyperc  rf  lpcbDatar  r  rh  rl  sDatarm  rW   rW   rX   _internal_RegEnumValue	  sv   




r  c                 C   rq  rr  r  r*  r  rd  rW   rW   rX   r  >
  r	  r  c                 C   rq  r   r  r  rW   rW   rX   r  A
  r	  r  c                 C   ,   t jj}ttg|_t|_t|_	|| | d S r   )
r  r  RegDeleteValueAr
  r   r  rU   r  r  rG  )hKeySrcrc  _RegDeleteValueArW   rW   rX   r  a
  
   
r  c                 C   r  r   )
r  r  RegDeleteValueWr
  r   r  rU   r  r  rG  )r  rc  _RegDeleteValueWrW   rW   rX   r  g
  r  r  c                 C   0   t jj}tttg|_t|_t|_	|| || d S r   )
r  r  RegDeleteKeyValueAr
  r   r  rU   r  r  rG  )r  r6  rc  _RegDeleteKeyValueArW   rW   rX   r  t
  
   r  c                 C   r  r   )
r  r  RegDeleteKeyValueWr
  r   r  rU   r  r  rG  )r  r6  rc  _RegDeleteKeyValueWrW   rW   rX   r  z
  r  r  c                 C   r  r   )
r  r  RegDeleteKeyAr
  r   r  rU   r  r  rG  )r  r6  _RegDeleteKeyArW   rW   rX   r  
  r  r  c                 C   r  r   )
r  r  RegDeleteKeyWr
  r   r  rU   r  r  rG  )r  r6  _RegDeleteKeyWrW   rW   rX   r  
  r  r  c                 C   4   t jj}ttttg|_t|_	t
|_|| ||d d S r  )r  r  RegDeleteKeyExAr
  r   r@  rT   r  rU   r  r  rG  )r  r6  rA  _RegDeleteKeyExArW   rW   rX   r  
  
   r  c                 C   r  r  )r  r  RegDeleteKeyExWr
  r   r@  rT   r  rU   r  r  rG  )r  r6  rA  _RegDeleteKeyExWrW   rW   rX   r  
  r  r  c                 C   0   t jj}tttg|_t|_t|_	|| || d S r   )
r  r  RegCopyTreeAr
  r   r  rU   r  r  rG  )r  r6  hKeyDest_RegCopyTreeArW   rW   rX   r  
  r  r  c                 C   r  r   )
r  r  RegCopyTreeWr
  r   r  rU   r  r  rG  )r  r6  r  _RegCopyTreeWrW   rW   rX   r  
  r  r  c                 C   r  r   )
r  r  RegDeleteTreeAr
  r   r  rU   r  r  rG  )r*  r6  _RegDeleteTreeArW   rW   rX   r  
  r  r  c                 C   r  r   )
r  r  RegDeleteTreeWr
  r   r  rU   r  r  rG  )r*  r6  _RegDeleteTreeWrW   rW   rX   r  
  r  r  c                 C   (   t jj}tg|_t|_t|_||  d S r   )	r  r  RegFlushKeyr
  r  rU   r  r  rG  )r*  _RegFlushKeyrW   rW   rX   r  
  rj  r  c                 C   s>   t jj}tg|_t|_t|_t	| t
r|   d S ||  d S r   )r  r  r  r  r  r  r  rF  rG  r  r{   close)	hSCObject_CloseServiceHANDLErW   rW   rX   r  
  s   
r  c                 C   s4   t jj}tttg|_t|_t|_	|| ||}t
|S r   )r  r  OpenSCManagerAr   rT   r  r  r  rF  rG  ServiceControlManagerHANDLE)r0  lpDatabaseNamer  _OpenSCManagerAr  rW   rW   rX   r  
  s   r  c                 C   s0   t jj}tttg|_t|_t|_	|| ||}|S r   )
r  r  OpenSCManagerWr   rT   r  r  r  rF  rG  )r0  r  r  _OpenSCManagerWr  rW   rW   rX   r    s   r  c                 C   0   t jj}tttg|_t|_t|_	t
|| ||S r   )r  r  OpenServiceAr  r   rT   r  r  rF  rG  ServiceHANDLE)
hSCManagerr   r  _OpenServiceArW   rW   rX   r    r  r  c                 C   r  r   )r  r  OpenServiceWr  r   rT   r  r  rF  rG  r  )r  r   r  _OpenServiceWrW   rW   rX   r    r  r  c                 C   l   t jj}tttttttttttttg|_t|_t	|_
td}|| |||||||t||	|
|}t||jfS r  )r  r  CreateServiceAr  r   rT   r  r  r  rF  rG  r  r  r   )r  r   r   r  r   dwStartTypedwErrorControllpBinaryPathNamelpLoadOrderGrouplpDependencieslpServiceStartNamer  _CreateServiceAdwTagIdhServicerW   rW   rX   r  2      "r  c                 C   r  r  )r  r  CreateServiceWr  r   rT   r  r  r  rF  rG  r  r  r   )r  r   r   r  r   r  r  r  r  r  r  r  _CreateServiceWr  r  rW   rW   rX   r  G  r  r  c                 C   r  r   )	r  r  DeleteServicer  r  r  r  rF  rG  )r  _DeleteServicerW   rW   rX   r  a  rj  r  c                 C      t jj}ttttg|_t|_t	d}|| |d t
| |jdkr$t t|jd }t||_|| ||t
|}|s@t |jS NrL   r   )r  r  GetServiceKeyNameAr  r   r  r  r  r  rT   r  r   r"  r#  r$  r  )r  r   _GetServiceKeyNameA	cchBufferr   r)  rW   rW   rX   r  n     

r  c                 C   r  NrL   r&   )r  r  GetServiceKeyNameWr  r   r  r  r  r  rT   r  r   r"  r#  r,  r  )r  r   _GetServiceKeyNameWr  r   r)  rW   rW   rX   r  ~  r  r  c                 C   r  r  )r  r  GetServiceDisplayNameAr  r   r  r  r  r  rT   r  r   r"  r#  r$  r  )r  r   _GetServiceDisplayNameAr  r   r)  rW   rW   rX   r    r  r  c                 C   r  r  )r  r  GetServiceDisplayNameWr  r   r  r  r  r  rT   r  r   r"  r#  r,  r  )r  r   _GetServiceDisplayNameWr  r   r)  rW   rW   rX   r    r  r  c                 C   \   t jj}tttg|_t|_t	|_
|r"t|}t| | }t|}nd}d }|| || d S r  )r  r  StartServiceAr  rT   r  r  r  r  rF  rG  r  r   r"  r0  )r  ServiceArgVectors_StartServiceAdwNumServiceArgsCServiceArgVectorslpServiceArgVectorsrW   rW   rX   r       r  c                 C   r  r  )r  r  StartServiceWr  rT   r  r  r  r  rF  rG  r  r   r"  r0  )r  r  _StartServiceWr  r  r  rW   rW   rX   r    r  r  c                 C   s>   t jj}tttg|_t|_t	|_
t }|| |t| t|S r   )r  r  ControlServicer  rT   LPSERVICE_STATUSr  r  r  rF  rG  r   r  r   )r  	dwControl_ControlServicerawServiceStatusrW   rW   rX   r    s   r  c                 C   s:   t jj}ttg|_t|_t|_	t
 }|| t| t|S r   )r  r  QueryServiceStatusr  r  r  r  r  rF  rG  r   r  r   )r  _QueryServiceStatusr  rW   rW   rX   r  ,  s   
r  c                 C   sh   |t krt tjj}ttttt	g|_
t|_t|_t }tt|}|| |t|t|t| t|S r   )SC_STATUS_PROCESS_INFOr   r  r  QueryServiceStatusExr  SC_STATUS_TYPEr  rT   r  r  r  r  rF  rG  r   r  r  r   )r  	InfoLevel_QueryServiceStatusExr(  cbBytesNeededrW   rW   rX   r  =  s   r  c              
   C   s6  t jj}ttttttttg|_t|_	td}td}td}|| ||d dt
|t
|t
| g }d}t tkr|jttk r@nStd|j}	|| ||t
|	t|	t
|t
|t
|}t|	tt|j k rkt ttt|	tjt}
td|jD ]}|t|
|  q|rnt tks8|st |S NrL   Fr   )r  r  EnumServicesStatusAr  rT   r  r  r  r  r  r  r   r  r   r  r   r"  r$  r#  r/  r0  c_void_pLPENUM_SERVICE_STATUSAr  r   r   )r  r   dwServiceState_EnumServicesStatusAr   ServicesReturnedResumeHANDLEServicesr)  ServicesBufferlpServicesArrayr  rW   rW   rX   r  V  s0   "
*
r  c              
   C   s2  t jj}ttttttttg|_t|_	td}td}td}|| ||d dt
|t
|t
| g }d}t tkr|jttk r@nQtd|j}	|| ||t
|	t|	t
|t
|t
|}t|	tt|j k rkt ttt|	tjt}
td|jD ]	}||
|  q|rnt tks8|st |S NrL   F    )r  r  EnumServicesStatusWr  rT   r  r  r  r  r  r  r   r  r   r  r   r"  r$  r#  r/  r0  r  LPENUM_SERVICE_STATUSWranger   )r  r   r  _EnumServicesStatusWr   r  r  r	  r)  r
  r  r  rW   rW   rX   r  s  s0   "
*
r  c                 C   sP  |t krt tjj}ttttttt	t	t	t
g
|_t|_td}td}td}|| |||d dt|t|t||
 g }	d}
t tkr|jttk rKnUtd|j}|| |||t|t|t|t|t||
}
t|tt|j k rxt ttt|tjt}td|jD ]}|	t||  q|
rnt tksC|
st |	S r  )SC_ENUM_PROCESS_INFOr   r  r  EnumServicesStatusExAr  SC_ENUM_TYPErT   r  r  r   r  r  r  r  r   r  r   r  r   r"  r$  r#  r/  r0  r  LPENUM_SERVICE_STATUS_PROCESSAr  r   r  )r  r  r   r  pszGroupName_EnumServicesStatusExAr   r  r  r	  r)  r
  r  r  rW   rW   rX   r    s4   &
.
r  c                 C   sL  t jj}ttttttttttg
|_	t
|_|tkrt td}td}td}|| |||d dt|t|t||
 g }	d}
t tkr|jttk rKnStd|j}|| |||t|t|t|t|t||
}
t|tt|j k rxt ttt|tjt}td|jD ]	}|	||  q|
rnt tksC|
st |	S r  )r  r  EnumServicesStatusExWr  r  rT   r  r  r   r  r  r  r  r   r  r   r  r   r  r   r"  r$  r#  r/  r0  r  LPENUM_SERVICE_STATUS_PROCESSWr  r   )r  r  r   r  r  _EnumServicesStatusExWr   r  r  r	  r)  r
  r  r  rW   rW   rX   r    s4   &
.
r  c                 C   s,   t jj}ttg|_t|_t|_	|||  d S r   )
r  r  SetThreadTokenrm  r{   r  r  r  rF  rG  )token_handlethread_handle_SetThreadTokenrW   rW   rX   r    s
   
r  c                  C   s$   t jj} g | _t| _t| _|   d S r   )r  r  RevertToSelfr  r  r  rF  rG  )_RevertToSelfrW   rW   rX   r    s
   
r  c           	      C   s~   t jj}tttttg|_t|_	t
|}d }td}|d ur/t
|d}tt|d}|| ||||}|s=t
 |S )NrL   z	utf-16-le)r  r  CredBackupCredentialsr{   r   rQ  rT   r  r  r  r"  r,  r$  r  r  r#  )	rV  pathpasswordr  _CredBackupCredentialsppath	ppasswordppasswordlenr)  rW   rW   rX   r!    s   
r!  c                 C   s   g | ]	}| d s|qS )_)
startswith)r  _xrW   rW   rX   r    s    r  )T)rW   )
NNNrL   NNrL   NNN)NrL   NNrL   NNN)
NNNNNFrL   NNN)rL   Nr  )Fr   rr  )NNN)NN(!  r   defineskernel32_allsetvarskeysSE_ASSIGNPRIMARYTOKEN_NAMESE_AUDIT_NAMESE_BACKUP_NAMESE_CHANGE_NOTIFY_NAMESE_CREATE_GLOBAL_NAMESE_CREATE_PAGEFILE_NAMESE_CREATE_PERMANENT_NAMESE_CREATE_SYMBOLIC_LINK_NAMESE_CREATE_TOKEN_NAMESE_DEBUG_NAMESE_ENABLE_DELEGATION_NAMESE_IMPERSONATE_NAMESE_INC_BASE_PRIORITY_NAMESE_INCREASE_QUOTA_NAMESE_INC_WORKING_SET_NAMESE_LOAD_DRIVER_NAMESE_LOCK_MEMORY_NAMESE_MACHINE_ACCOUNT_NAMESE_MANAGE_VOLUME_NAMESE_PROF_SINGLE_PROCESS_NAMESE_RELABEL_NAMESE_REMOTE_SHUTDOWN_NAMESE_RESTORE_NAMESE_SECURITY_NAMESE_SHUTDOWN_NAMESE_SYNC_AGENT_NAMESE_SYSTEM_ENVIRONMENT_NAMESE_SYSTEM_PROFILE_NAMESE_SYSTEMTIME_NAMESE_TAKE_OWNERSHIP_NAMESE_TCB_NAMESE_TIME_ZONE_NAMESE_TRUSTED_CREDMAN_ACCESS_NAMESE_UNDOCK_NAMESE_UNSOLICITED_INPUT_NAMESE_CREATE_TOKENSE_ASSIGNPRIMARYTOKENSE_LOCK_MEMORYSE_INCREASE_QUOTASE_UNSOLICITED_INPUTSE_TCBSE_SECURITYSE_TAKE_OWNERSHIPSE_LOAD_DRIVERSE_SYSTEM_PROFILESE_SYSTEMTIMESE_PROF_SINGLE_PROCESSSE_INC_BASE_PRIORITYSE_CREATE_PAGEFILESE_CREATE_PERMANENT	SE_BACKUP
SE_RESTORESE_SHUTDOWNSE_DEBUGSE_AUDITSE_SYSTEM_ENVIRONMENTSE_CHANGE_NOTIFYSE_REMOTE_SHUTDOWN	SE_UNDOCKSE_SYNC_AGENTSE_ENABLE_DELEGATIONSE_MANAGE_VOLUMESE_IMPERSONATESE_CREATE_GLOBALSE_TRUSTED_CREDMAN_ACCESS
SE_RELABELSE_INC_WORKING_SETSE_TIME_ZONESE_CREATE_SYMBOLIC_LINKSE_PRIVILEGE_ENABLED_BY_DEFAULTr  r  SE_PRIVILEGE_USED_FOR_ACCESSTOKEN_ADJUST_PRIVILEGESLOGON_WITH_PROFILELOGON_NETCREDENTIALS_ONLYTOKEN_ASSIGN_PRIMARYTOKEN_DUPLICATETOKEN_IMPERSONATETOKEN_QUERYTOKEN_QUERY_SOURCETOKEN_ADJUST_GROUPSTOKEN_ADJUST_DEFAULTTOKEN_ADJUST_SESSIONIDSTANDARD_RIGHTS_READ
TOKEN_READSTANDARD_RIGHTS_REQUIREDTOKEN_ALL_ACCESSr$  r%  r&  r'  r(  r)  KEY_ALL_ACCESSKEY_CREATE_LINKKEY_CREATE_SUB_KEYKEY_ENUMERATE_SUB_KEYSKEY_EXECUTE
KEY_NOTIFYKEY_QUERY_VALUEKEY_READKEY_SET_VALUEKEY_WOW64_32KEYKEY_WOW64_64KEY	KEY_WRITEr{  r]  r^  r~  rY  REG_DWORD_LITTLE_ENDIANrZ  ra  r_  REG_RESOURCE_LISTREG_FULL_RESOURCE_DESCRIPTORREG_RESOURCE_REQUIREMENTS_LISTr[  REG_QWORD_LITTLE_ENDIAN	StructurerN   rE  r  rZ   r]   PTOKEN_PRIVILEGESr"  c_intr  r  TokenGroupsTokenPrivilegesr  TokenPrimaryGroupTokenDefaultDaclTokenSourcer   TokenImpersonationLevelr  TokenRestrictedSidsr  TokenGroupsAndPrivilegesTokenSessionReferencer  TokenAuditPolicyr  TokenElevationTyper  r  r  TokenAccessInformationr  r  r  r  TokenMandatoryPolicyTokenLogonSidTokenIsAppContainerTokenCapabilitiesr  r  TokenUserClaimAttributesTokenDeviceClaimAttributes"TokenRestrictedUserClaimAttributes$TokenRestrictedDeviceClaimAttributesTokenDeviceGroupsTokenRestrictedDeviceGroupsTokenSecurityAttributesTokenIsRestrictedr  r   PTOKEN_TYPETokenPrimaryTokenImpersonationTokenElevationTypeDefaultTokenElevationTypeFullTokenElevationTypeLimitedTOKEN_ELEVATION_TYPEPTOKEN_ELEVATION_TYPESecurityAnonymousSecurityIdentificationSecurityImpersonationSecurityDelegationr   PSECURITY_IMPERSONATION_LEVELrf   PSID_AND_ATTRIBUTESrj   PTOKEN_USERrn   PTOKEN_MANDATORY_LABELrp   PTOKEN_OWNERrs   PTOKEN_PRIMARY_GROUPru   PTOKEN_APPCONTAINER_INFORMATIONrw   PTOKEN_ORIGINry   PTOKEN_LINKED_TOKENr|   PTOKEN_STATISTICSSidTypeUserSidTypeGroupSidTypeDomainSidTypeAliasSidTypeWellKnownGroupSidTypeDeletedAccountSidTypeInvalidSidTypeUnknownSidTypeComputerSidTypeLabelWCT_MAX_NODE_COUNTr   WCT_ASYNC_OPEN_FLAGWCTP_OPEN_ALL_FLAGSWCT_OUT_OF_PROC_FLAGWCT_OUT_OF_PROC_COM_FLAGWCT_OUT_OF_PROC_CS_FLAGWCTP_GETINFO_ALL_FLAGSr  r  rT   r   WctCriticalSectionTypeWctSendMessageTypeWctMutexTypeWctAlpcType
WctComTypeWctThreadWaitTypeWctProcessWaitTyper   WctComActivationTypeWctUnknownType
WctMaxTyper   WctStatusNoAccessWctStatusRunningWctStatusBlockedWctStatusPidOnlyWctStatusPidOnlyRpcssWctStatusOwnedWctStatusNotOwnedWctStatusAbandonedWctStatusUnknownWctStatusErrorWctStatusMaxr   r   Unionr   r   r  objectr   r{   r   r  SAFER_SCOPEID_MACHINESAFER_SCOPEID_USERSAFER_LEVEL_OPENSAFER_LEVELID_DISALLOWEDSAFER_LEVELID_UNTRUSTEDSAFER_LEVELID_CONSTRAINEDSAFER_LEVELID_NORMALUSERSAFER_LEVELID_FULLYTRUSTEDSAFER_POLICY_INFO_CLASSSaferPolicyLevelList'SaferPolicyEnableTransparentEnforcementSaferPolicyDefaultLevelSaferPolicyEvaluateUserScopeSaferPolicyScopeFlagsSAFER_TOKEN_NULL_IF_EQUALSAFER_TOKEN_COMPARE_ONLYSAFER_TOKEN_MAKE_INERTSAFER_TOKEN_WANT_FLAGSSAFER_TOKEN_MASKr  SERVICES_ACTIVE_DATABASEWSERVICES_FAILED_DATABASEWSERVICES_ACTIVE_DATABASEASERVICES_FAILED_DATABASEASC_GROUP_IDENTIFIERWSC_GROUP_IDENTIFIERASERVICE_NO_CHANGEr  r  r  r  SERVICE_ALL_ACCESSSERVICE_QUERY_CONFIGSERVICE_CHANGE_CONFIGSERVICE_QUERY_STATUSSERVICE_ENUMERATE_DEPENDENTSSERVICE_STARTSERVICE_STOPSERVICE_PAUSE_CONTINUESERVICE_INTERROGATESERVICE_USER_DEFINED_CONTROLSC_MANAGER_ALL_ACCESSSC_MANAGER_CONNECTSC_MANAGER_CREATE_SERVICESC_MANAGER_ENUMERATE_SERVICESC_MANAGER_LOCKSC_MANAGER_QUERY_LOCK_STATUSSC_MANAGER_MODIFY_BOOT_CONFIGSERVICE_BOOT_STARTSERVICE_SYSTEM_STARTSERVICE_AUTO_STARTSERVICE_DEMAND_STARTSERVICE_DISABLEDSERVICE_ERROR_IGNORESERVICE_ERROR_NORMALSERVICE_ERROR_SEVERESERVICE_ERROR_CRITICALSERVICE_ACTIVESERVICE_INACTIVESERVICE_STATE_ALLSERVICE_KERNEL_DRIVERSERVICE_FILE_SYSTEM_DRIVERSERVICE_ADAPTERSERVICE_RECOGNIZER_DRIVERSERVICE_WIN32_OWN_PROCESSSERVICE_WIN32_SHARE_PROCESSr   SERVICE_DRIVERSERVICE_WIN32r   r   r   r   r   r   r   SERVICE_ACCEPT_STOPSERVICE_ACCEPT_PAUSE_CONTINUESERVICE_ACCEPT_SHUTDOWNSERVICE_ACCEPT_PARAMCHANGESERVICE_ACCEPT_NETBINDCHANGE$SERVICE_ACCEPT_HARDWAREPROFILECHANGESERVICE_ACCEPT_POWEREVENTSERVICE_ACCEPT_SESSIONCHANGESERVICE_ACCEPT_PRESHUTDOWNSERVICE_RUNS_IN_SYSTEM_PROCESSSERVICE_CONTROL_STOPSERVICE_CONTROL_PAUSESERVICE_CONTROL_CONTINUESERVICE_CONTROL_INTERROGATESERVICE_CONTROL_SHUTDOWNSERVICE_CONTROL_PARAMCHANGESERVICE_CONTROL_NETBINDADDSERVICE_CONTROL_NETBINDREMOVESERVICE_CONTROL_NETBINDENABLESERVICE_CONTROL_NETBINDDISABLESERVICE_CONTROL_DEVICEEVENT%SERVICE_CONTROL_HARDWAREPROFILECHANGESERVICE_CONTROL_POWEREVENTSERVICE_CONTROL_SESSIONCHANGESERVICE_ACCEPT_TIMECHANGESERVICE_ACCEPT_TRIGGEREVENTSERVICE_ACCEPT_USERMODEREBOOTSC_ACTION_NONESC_ACTION_RESTARTSC_ACTION_REBOOTSC_ACTION_RUN_COMMANDSERVICE_CONFIG_DESCRIPTIONSERVICE_CONFIG_FAILURE_ACTIONSr   r  r   LPSERVICE_STATUS_PROCESSr   r   r  r  r   r   r  r  r   r   r   r  r  UserModeHandler  r  r  r  r  r+  DefaultStringTypeGetUserNamer.  r;  ru  LookupAccountNamer=  rB  LookupAccountSidrD  rM  ConvertSidToStringSidrP  rT  ConvertStringSidToSidrW  r[  r_  ra  rg  rl  rt  ry  r}  r  r  r  r  r  r  LookupPrivilegeNamer  r  r  r  r  MakeANSIVersionCreateProcessWithLogonACreateProcessWithLogonr  CreateProcessWithTokenACreateProcessWithTokenr  r  CreateProcessAsUserWINFUNCTYPE	DWORD_PTRr  r  r  r  r  r   r  r  r  r  SaferIsExecutableFileTyper  r-  r3  RegConnectRegistryr5  r8  RegCreateKeyr:  r<  
RegOpenKeyr?  rD  RegOpenKeyExrF  rH  rJ  rO  RegQueryValuern  rX  ro  rp  RegQueryValueExr  r  r  r  r  
RegEnumKeyr  r  r  RegEnumValuer  r  RegDeleteValuer  r  RegDeleteKeyValuer  r  RegDeleteKeyr  r  RegDeleteKeyExr  r  RegCopyTreer  r  RegDeleteTreer  r  r  r  OpenSCManagerr  r  OpenServicer  r  CreateServicer  r  r  GetServiceKeyNamer  r  GetServiceDisplayNamer  r  StartServicer  r  r  r  r  EnumServicesStatusr  r  EnumServicesStatusExr  r  r!  
difference__all__sortrW   rW   rW   rX   <module>   sr  	0	Q&
.6
















	





	


+
V
0)%++










	


9
KV			2$$! 