o
    j                     @   sV   d dl Z d dlZd dlmZ d dlmZ d dlmZ G dd dZG dd deZ	dS )	    N)logger)PackageDecryptor)PRTL_AVL_TABLEc                   @   s,   e Zd Zdd Zdd Zdd Zdd Zd	S )
TspkgCredentialc                 C   s(   d| _ d | _d | _d | _d| _d | _d S )Ntspkg    credtypeusername
domainnamepasswordpassword_rawluidself r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/alsadecryptor/packages/tspkg/decryptor.py__init__   s   
zTspkgCredential.__init__c                 C   sD   i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< |S )Nr	   r
   r   r   r   r   r   r   tr   r   r   to_dict   s   





zTspkgCredential.to_dictc                 C   s   t |  S )N)jsondumpsr   r   r   r   r   to_json    s   zTspkgCredential.to_jsonc                 C   sJ   d| j  }|d| j 7 }|d| j 7 }|d| j 7 }|d| j  7 }|S )Nz	== TSPKG [%x]==
z		username %s
z		domainname %s
z		password %s
z		password (hex)%s
)r   r
   r   r   r   hexr   r   r   r   __str__#   s   
zTspkgCredential.__str__N)__name__
__module____qualname__r   r   r   r   r   r   r   r   r      s
    
r   c                       s,   e Zd Z fddZdd Zdd Z  ZS )TspkgDecryptorc                    s"   t  d||| || _g | _d S )NTspkg)superr   decryptor_templatecredentials)r   readerr"   lsa_decryptorsysinfo	__class__r   r   r   ,   s   
zTspkgDecryptor.__init__c                    sL   |  d| jjI d H }| j|| jj I d H }| j|I d H }||fS )Nz	TSpkg.dll)find_signaturer"   	signaturer$   get_ptr_with_offset
avl_offsetget_ptr)r   positionptr_entry_loc	ptr_entryr   r   r   find_first_entry2   s
   zTspkgDecryptor.find_first_entryc              
      s   z|   I d H \}}W n ty& } z| d|  W Y d }~d S d }~ww g }| j|I d H  zt| jI d H }|| jI d H }W n ty` } zt	d|  W Y d }~d S d }~ww | 
|jj|I d H  |D ]}| || jjjI d H  | j|I d H  | jj| jI d H }|j| jI d H }	|	d urt }
|j|
_|	jj| jI d H |
_|	jj| jI d H |
_|	jjjdkr|	jj| jI d H }|
jddu r| j|dd\|
_ |
_!|
j d ur|
j " |
_ n	| |\|
_ |
_!| j#|
 qnd S )Nz"Failed to find structs! Reason: %sz*Failed to prcess TSPKG package! Reason: %sr   $T)bytes_expected)$r1   	Exceptionlogr$   mover   loadreadr   errorwalk_avlBalancedRoot
RightChildlog_ptrr"   credential_structr   
pTsPrimaryr   LocallyUniqueIdentifierr   r#   UserNameread_stringr   Domainer
   PasswordLengthread_maxdataendswithdecrypt_passwordr   r   r   append)r   entry_ptr_valueentry_ptr_loceresult_ptr_listptable
start_nodeptrr>   primary_credentialcenc_datar   r   r   start8   sP   
zTspkgDecryptor.start)r   r   r   r   r1   rT   __classcell__r   r   r'   r   r   +   s    r   )
ior   pypykatzr   &pypykatz.alsadecryptor.package_commonsr   $pypykatz.alsadecryptor.win_datatypesr   r   r   r   r   r   r   <module>   s   