o
    jy                     @   s   d dl mZmZmZ d dlmZmZmZmZm	Z	m
Z
mZmZmZ d dlmZ G dd deZG dd deZG dd	 d	ZG d
d deZG dd dZG dd deZG dd dZG dd deZG dd dZdS )    )KatzSystemArchitectureWindowsMinBuildWindowsBuild)	ULONGLUIDKIWI_GENERIC_PRIMARY_CREDENTIALPOINTERDWORDPVOIDPSIDGUIDDWORD64)PackageTemplatec                       (   e Zd Z fddZedd Z  ZS )CloudapTemplatec                    s"   t  d d | _d | _d | _d S )NCloudap)super__init__	signaturefirst_entry_offset
list_entryself	__class__ /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/alsadecryptor/packages/cloudap/templates.pyr      s   
zCloudapTemplate.__init__c                 C   s   t  }| jtjjkrd S | jtjkr&d|_d|_	t
|_| jtjjkr%t|_n| jtjkr6d|_d|_	t
|_n
td| j| jf |d|j |S )Ns   DD9Bis   19ruizECould not identify template! Architecture: %s sysinfo.buildnumber: %sr   )r   buildnumberr   WIN_10_1903valuearchitecturer   X64r   r   PKIWI_CLOUDAP_LOGON_LIST_ENTRYr   #PKIWI_CLOUDAP_LOGON_LIST_ENTRY_21H2X86	Exceptionlog_template)sysinfotemplater   r   r   get_template   s"   zCloudapTemplate.get_template)__name__
__module____qualname__r   staticmethodr)   __classcell__r   r   r   r   r      s    r   c                       r   )PKIWI_CLOUDAP_CACHE_UNKc                       t    d S Nr   r   r   r   r   r   r   %      z PKIWI_CLOUDAP_CACHE_UNK.__init__c                    ,   t  }|  |_|  I d H |_t|_|S r1   )r/   telllocation	read_uintr   KIWI_CLOUDAP_CACHE_UNK	finaltypereaderpr   r   r   load(      
zPKIWI_CLOUDAP_CACHE_UNK.loadr*   r+   r,   r   r-   r=   r.   r   r   r   r   r/   $       r/   c                   @       e Zd Zdd Zedd ZdS )r8   c                 C   s(   d | _ d | _d | _d | _d | _d | _d S r1   )unk0unk1unk2unkSizeguidunkr   r   r   r   r   1   s   
zKIWI_CLOUDAP_CACHE_UNK.__init__c                    sx   t  }t| I d H |_t| I d H |_t| I d H |_t| I d H |_t| I d H |_	| 
dI d H |_|S )N@   )r8   r	   r=   rB   rC   rD   	loadvaluerE   r   rF   readrG   r;   resr   r   r   r=   9   s   zKIWI_CLOUDAP_CACHE_UNK.loadNr*   r+   r,   r   r-   r=   r   r   r   r   r8   0   s    r8   c                       r   )PKIWI_CLOUDAP_CACHE_LIST_ENTRYc                    r0   r1   r2   r   r   r   r   r   F   r3   z'PKIWI_CLOUDAP_CACHE_LIST_ENTRY.__init__c                    r4   r1   )rN   r5   r6   r7   r   KIWI_CLOUDAP_CACHE_LIST_ENTRYr9   r:   r   r   r   r=   I   r>   z#PKIWI_CLOUDAP_CACHE_LIST_ENTRY.loadr?   r   r   r   r   rN   E   r@   rN   c                   @   rA   )rO   c                 C   s   d | _ d | _d | _d | _d | _d | _d | _d | _d | _d | _	d | _
d | _d | _d | _d | _d | _d | _d | _d | _d | _d | _d | _d | _d | _d | _d S r1   )FlinkBlinkrB   LockListrC   rD   unk3unk4unk5unk6unk7unk8unk9	unkLogin0	unkLogin1tonameSidunk10unk11unk12unk13toDetermineunk14cbPRTPRTr   r   r   r   r   R   s2   
z&KIWI_CLOUDAP_CACHE_LIST_ENTRY.__init__c                    s  t  }t| I d H |_t| I d H |_t| I d H |_|  I d H  t| I d H |_	t| I d H |_
t| I d H |_t| I d H |_t| I d H |_t| I d H |_t| I d H |_t| I d H |_t| I d H |_t| I d H |_t| I d H |_t| I d H |_| dI d H |_|  I d H  t| I d H |_t| I d H |_t| I d H |_t| I d H |_t| I d H |_t| I d H |_t| I d H |_ t| I d H |_!|  I d H  t| I d H |_"|S )N   )#rO   rN   r=   rP   rQ   r	   rB   alignr
   rR   rC   rD   rS   rT   rU   rV   rW   rX   rY   rZ   r[   rJ   r\   r   rI   r]   r^   r_   r`   ra   r/   rb   rc   rd   re   rK   r   r   r   r=   m   s>   z"KIWI_CLOUDAP_CACHE_LIST_ENTRY.loadNrM   r   r   r   r   rO   Q   s    rO   c                       r   )r"   c                    r0   r1   r2   r   r   r   r   r      r3   z'PKIWI_CLOUDAP_LOGON_LIST_ENTRY.__init__c                    r4   r1   )r"   r5   r6   r7   r   KIWI_CLOUDAP_LOGON_LIST_ENTRYr9   r:   r   r   r   r=      r>   z#PKIWI_CLOUDAP_LOGON_LIST_ENTRY.loadr?   r   r   r   r   r"      r@   r"   c                   @   rA   )rh   c                 C   s4   d | _ d | _d | _d | _d | _d | _d | _d | _d S r1   )rP   rQ   rB   rC   LocallyUniqueIdentifierrD   rS   
cacheEntryr   r   r   r   r      s   
z&KIWI_CLOUDAP_LOGON_LIST_ENTRY.__init__c                    s   t  }t| I d H |_t| I d H |_t| I d H |_t| I d H |_t	| I d H |_
t| I d H |_t| I d H |_t| I d H |_|S r1   )rh   r"   r=   rP   rQ   r	   rB   rC   r   rI   ri   r   rD   rS   rN   rj   rK   r   r   r   r=      s   z"KIWI_CLOUDAP_LOGON_LIST_ENTRY.loadNrM   r   r   r   r   rh      s    
rh   c                       r   )r#   c                    r0   r1   r2   r   r   r   r   r      r3   z,PKIWI_CLOUDAP_LOGON_LIST_ENTRY_21H2.__init__c                    r4   r1   )r#   r5   r6   r7   r   "KIWI_CLOUDAP_LOGON_LIST_ENTRY_21H2r9   r:   r   r   r   r=      r>   z(PKIWI_CLOUDAP_LOGON_LIST_ENTRY_21H2.loadr?   r   r   r   r   r#      r@   r#   c                   @   rA   )rk   c                 C   s@   d | _ d | _d | _d | _d | _d | _d | _d | _d | _d | _	d S r1   )
rP   rQ   rB   rC   rD   ri   rS   rT   rU   rj   r   r   r   r   r      s   
z+KIWI_CLOUDAP_LOGON_LIST_ENTRY_21H2.__init__c                    s   t  }t| I d H |_t| I d H |_t| I d H |_t| I d H |_t| I d H |_t	
| I d H |_t| I d H |_|  I d H  t| I d H |_t| I d H |_t| I d H |_|S r1   )rk   r#   r=   rP   rQ   r	   rB   rC   rD   r   rI   ri   rS   rg   r   rT   rU   rN   rj   rK   r   r   r   r=      s   z'KIWI_CLOUDAP_LOGON_LIST_ENTRY_21H2.loadNrM   r   r   r   r   rk      s    rk   N)pypykatz.commons.commonr   r   r   $pypykatz.alsadecryptor.win_datatypesr   r   r   r   r	   r
   r   r   r   &pypykatz.alsadecryptor.package_commonsr   r   r/   r8   rN   rO   r"   rh   r#   rk   r   r   r   r   <module>   s    ,=