o
    j                     @   sJ   d dl Z d dlZd dlmZ d dlmZ G dd dZG dd deZdS )    N)PackageDecryptor)DPAPIc                   @   s4   e Zd Zdd Zdd Zdd Zdd Zd	d
 ZdS )CloudapCredentialc                 C   s4   d| _ d | _d | _d | _d | _d | _d | _d | _d S )Ncloudap)credtypeluidsidcachedirPRTkey_guid	dpapi_keydpapi_key_sha1self r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/lsadecryptor/packages/cloudap/decryptor.py__init__   s   
zCloudapCredential.__init__c                 C   sD   i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< |S )Nr   r	   r
   r   r   r   )r   r	   r
   r   r   r   r   tr   r   r   to_dict   s   





zCloudapCredential.to_dictc                 C   s   t |  S N)jsondumpsr   r   r   r   r   to_json   s   zCloudapCredential.to_jsonc                 C   s   t | jtr| j S | jS r   )
isinstancer   byteshexr   r   r   r   get_masterkey_hex   s   z#CloudapCredential.get_masterkey_hexc                 C   sV   d| j  }|d| j 7 }|d| j 7 }|d| j 7 }|d|   7 }|d| j 7 }|S )Nz	== Cloudap [%x]==
z		cachedir %s
z			PRT %s
z		key_guid %s
z		dpapi_key %s
z		dpapi_key_sha1 %s
)r   r	   r
   r   r   r   r   r   r   r   __str__!   s   
zCloudapCredential.__str__N)__name__
__module____qualname__r   r   r   r   r   r   r   r   r   r      s    

r   c                       s4   e Zd Z fddZdd Zdd Zdd Z  ZS )	CloudapDecryptorc                    s"   t  d||| || _g | _d S )NCloudap)superr   decryptor_templatecredentials)r   readerr%   lsa_decryptorsysinfo	__class__r   r   r   +   s   
zCloudapDecryptor.__init__c                 C   s8   |  d| jj}| j|| jj }| j|}||fS )NzcloudAP.dll)find_signaturer%   	signaturer'   get_ptr_with_offsetfirst_entry_offsetget_ptr)r   positionptr_entry_loc	ptr_entryr   r   r   find_first_entry0   s   z!CloudapDecryptor.find_first_entryc              
   C   sZ  zt  }|j|_|jd u s|jjdkrW d S |j| j}|jd	dd|_
|jdkrT|jjdkrT| j|j| j|jddd\}}z| }W n   Y t||_|jdkr}|j| j}|d ur}|jj|_| j|jdd\|_}t|j |_|jd u r|jd u rW d S | j| W d S  ty } z| d	|  W Y d }~d S d }~ww )
Nr   z	utf-16-le  T   )bytes_expectedsegment_size)r8   z&CloudAP entry parsing error! Reason %s)r   LocallyUniqueIdentifierr   
cacheEntryvaluereadr'   tonamedecodereplacer	   cbPRTr
   decrypt_passwordread_rawstrtoDetermineguidr   unkr   hashlibsha1	hexdigestr   r&   append	Exceptionlog)r   cloudap_entrycredcachetempraw_decrG   er   r   r   	add_entry6   s6   "


zCloudapDecryptor.add_entryc              
   C   sr   z|   \}}W n ty" } z| d|  W Y d }~d S d }~ww | j| | j| j}| || j d S )Nz"Failed to find structs! Reason: %s)	r4   rL   rM   r'   mover%   
list_entry	walk_listrT   )r   entry_ptr_valueentry_ptr_locrS   	entry_ptrr   r   r   startW   s   zCloudapDecryptor.start)r   r    r!   r   r4   rT   r[   __classcell__r   r   r*   r   r"   *   s
    !r"   )r   rH   %pypykatz.lsadecryptor.package_commonsr   pypykatz.dpapi.dpapir   r   r"   r   r   r   r   <module>   s    $