o
    j>                     @   s  d dl mZmZmZ d dlmZmZmZ d dlm	Z	 d dl
mZ G dd de	ZG dd dZG d	d
 d
ZG dd dZG dd dZG dd dZG dd dZG dd deZG dd dZG dd deZG dd deZG dd deZG dd deZG dd  d eZG d!d" d"eZG d#d$ d$eZG d%d& d&eZG d'd( d(eZG d)d* d*eZG d+d, d,eZG d-d. d.eZ G d/d0 d0eZ!G d1d2 d2eZ"G d3d4 d4eZ#G d5d6 d6eZ$d7e e e e e e e e e d8	e e e  e! e" e# e$ d9d:iZ%d;S )<    )ULONGPVOIDPOINTER)KatzSystemArchitectureWindowsMinBuildWindowsBuild)PackageTemplate)loggerc                       s4   e Zd Z fddZedd Zedd Z  ZS )LsaTemplate_NT6c                    s.   t  d d | _d | _d | _t| _d| _d S )NzLSA Decryptor6)super__init__key_patternkey_handle_struct
key_structKIWI_HARD_KEYhard_key_structnt_majorself	__class__ /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/lsadecryptor/lsa_template_nt6.pyr      s   
zLsaTemplate_NT6.__init__c                 c   s   | j tjkr>| jtjjkrtd| jtjjkrtddd t	d d D }|j
dd |D ]}t	d d | V  q0d S | j tjkr| jtjjkrOtd| jtjjkrZtddd t	d d	 D }|j
dd |D ]}td
|  t	d d	 | V  qmd S d S )NzNT 5 is not yet supported!c                 S      g | ]}|qS r   r   .0xr   r   r   
<listcomp>       z6LsaTemplate_NT6.get_template_brute.<locals>.<listcomp>nt6x86T)reversec                 S   r   r   r   r   r   r   r   r   *   r   x64zBF: using x64 - %s)architecturer   X86buildnumberr   WIN_XPvalue	ExceptionWIN_2K3	templatessortX64r	   debug)sysinfokeyskeyr   r   r   get_template_brute   s.   z"LsaTemplate_NT6.get_template_brutec                 C   s  t  }td| j  | jtjkr| jtjj	krt
d| jtjj	kr0d|_td d d }ntjj	| j  kr?tjj	k rKn n
td d d }ntjj	| j  krZtjj	k rfn n
td d d }nntjj	| j  krutjj	k rn n
td d d	 }nStjj	| j  krtjj	k rn n
td d d
 }n8tjj	| j  krtjj	krn n
td d d }ntjj	| j  krtjj	k rn n
td d d }ntd d d }n| jtjkr| jtjj	krt
d| jtjj	krt
d| jtjj	k rtd td d d }n| jtjj	k r$td td d d }n| jtjj	k rd| jtjj	k rV| jdk rHtd td d d	 }ntd td d d }n~td td d d
 }np| jtjj	k rztd td d d }nZtjj	| j  krtjj	k rn ntd td d d }n9tjj	| j  krtjj	k rn ntd td d d }ntd td d d }n
t
d| j| jf |d|j |d|j |d|j |S )NzBuildnumber: %szMaybe implemented later5nt5r!   1r    234r   7zusing x64 - 1r#   zusing x64 - 2i   `zusing x64 - 3zusing x64 - 7zusing x64 - 4zusing x64 - 5zusing x64 - 6zusing x64 - 88zusing x64 - 99zEMissing LSA decrpytor template for Architecture: %s , Build number %sr   r   r   )r
   r	   r.   r&   r$   r   r%   r   r'   r(   r)   r*   r   r+   	WIN_VISTAWIN_7WIN_8WIN_BLUEWIN_10r   WIN_10_1507WIN_10_1909r-   msv_dll_timestampWIN_10_1809WIN_11WIN_11_24H2log_templater   r   r   )r/   templater   r   r   get_template1   sr   """"""





&
&

zLsaTemplate_NT6.get_template)__name__
__module____qualname__r   staticmethodr2   rI   __classcell__r   r   r   r   r
      s    	
r
   c                   @      e Zd Zdd ZdS )LSADecyptorKeyPatternc                 C   s"   d | _ d | _d | _d | _d | _d S N)	signatureoffset_to_IV_ptr	IV_lengthoffset_to_AES_key_ptroffset_to_DES_key_ptrr   r   r   r   r      s
   
zLSADecyptorKeyPattern.__init__NrJ   rK   rL   r   r   r   r   r   rP          rP   c                   @   rO   )r   c                 C   s   t |j| _|| j| _d S rQ   )r   r(   cbSecretreaddatar   readerr   r   r   r      s   zKIWI_HARD_KEY.__init__NrW   r   r   r   r   r      rX   r   c                   @      e Zd Zdd Zdd ZdS )KIWI_BCRYPT_KEYc                 C   sV   t |j| _|d| _t |j| _t |j| _t |j| _t |j| _t	|| _
d S N   )r   r(   sizerZ   tagtypeunk0unk1unk2r   hardkeyr\   r   r   r   r      s   zKIWI_BCRYPT_KEY.__init__c                 C   
   | j dkS Ns   KSSMrc   r   r   r   r   verify      
zKIWI_BCRYPT_KEY.verifyNrJ   rK   rL   r   rl   r   r   r   r   r_      s    	r_   c                   @   r^   )KIWI_BCRYPT_KEY8c                 C   sv   t |j| _|d| _t |j| _t |j| _t |j| _t |j| _t |j| _	|
  t|j| _t|| _d S r`   )r   r(   rb   rZ   rc   rd   re   rf   rg   unk3alignr   unk4r   rh   r\   r   r   r   r      s   zKIWI_BCRYPT_KEY8.__init__c                 C   ri   rj   rk   r   r   r   r   rl      rm   zKIWI_BCRYPT_KEY8.verifyNrn   r   r   r   r   ro      s    ro   c                   @   r^   )KIWI_BCRYPT_KEY81c                 C   s   t |j| _|d| _t |j| _t |j| _t |j| _t |j| _t |j| _	t |j| _
|  t|j| _t |j| _t |j| _t |j| _t |j| _t|| _d S r`   )r   r(   rb   rZ   rc   rd   re   rf   rg   rp   rr   rq   r   unk5unk6unk7unk8unk9r   rh   r\   r   r   r   r      s   zKIWI_BCRYPT_KEY81.__init__c                 C   ri   rj   rk   r   r   r   r   rl      rm   zKIWI_BCRYPT_KEY81.verifyNrn   r   r   r   r   rs      s    rs   c                   @   r^   )KIWI_BCRYPT_KEY81_NEWc                 C   s   t |j| _|d| _t |j| _t |j| _t |j| _t |j| _t |j| _	t |j| _
|  t|j| _t |j| _t |j| _t |j| _t |j| _t |j| _t|| _d S r`   )r   r(   rb   rZ   rc   rd   re   rf   rg   rp   rr   rq   r   rt   ru   rv   rw   rx   unk10r   rh   r\   r   r   r   r      s    zKIWI_BCRYPT_KEY81_NEW.__init__c                 C   ri   rj   rk   r   r   r   r   rl      rm   zKIWI_BCRYPT_KEY81_NEW.verifyNrn   r   r   r   r   ry      s    ry   c                       s   e Zd Z fddZ  ZS )PKIWI_BCRYPT_KEYc                    s   t  |t d S rQ   )r   r   r_   r\   r   r   r   r      s   zPKIWI_BCRYPT_KEY.__init__)rJ   rK   rL   r   rN   r   r   r   r   r{      s    r{   c                   @   r^   )KIWI_BCRYPT_HANDLE_KEYc                 C   s>   t |j| _|d| _t|j| _t|| _t|j| _	d S r`   )
r   r(   rb   rZ   rc   r   
hAlgorithmr{   ptr_keyre   r\   r   r   r   r      s
   
zKIWI_BCRYPT_HANDLE_KEY.__init__c                 C   ri   )Ns   RUUUrk   r   r   r   r   rl      rm   zKIWI_BCRYPT_HANDLE_KEY.verifyNrn   r   r   r   r   r|      s    r|   c                   @   rO   )	LSA_x64_1c                 C   J   t |  t | _d| j_d| j_d| j_d| j_d| j_t	| _
t| _d S )N   d$0 DL$HH   ?      r
   r   rP   r   rR   rT   rS   rV   rU   r_   r   r|   r   r   r   r   r   r         

zLSA_x64_1.__init__NrW   r   r   r   r   r      rX   r   c                   @   rO   )	LSA_x64_2c                 C   r   )Nr   r   ;   ir   r   r   r   r   r   r      r   zLSA_x64_2.__init__NrW   r   r   r   r   r      rX   r   c                   @   rO   )	LSA_x64_3c                 C   r   N   d$0 DMHr   >   i   r
   r   rP   r   rR   rT   rS   rV   rU   ro   r   r|   r   r   r   r   r   r   
  r   zLSA_x64_3.__init__NrW   r   r   r   r   r   	  rX   r   c                   @   rO   )	LSA_x64_4c                 C   r   r   r
   r   rP   r   rR   rT   rS   rV   rU   rs   r   r|   r   r   r   r   r   r     r   zLSA_x64_4.__init__NrW   r   r   r   r   r     rX   r   c                   @   rO   )	LSA_x64_5c                 C   J   t |  t | _d| j_d| j_d| j_d| j_d| j_t	| _
t| _d S )N   d$0 HEDMHr   =   ir   r   r   r   r   r   $  r   zLSA_x64_5.__init__NrW   r   r   r   r   r   #  rX   r   c                   @   rO   )	LSA_x64_6c                 C   r   )Nr   r   C   r   r   r   r   r   r   1  r   zLSA_x64_6.__init__NrW   r   r   r   r   r   0  rX   r   c                   @   rO   )	LSA_x64_7c                 C   r   )Nr   r   :   ir   r   r   r   r   r   r   >  r   zLSA_x64_7.__init__NrW   r   r   r   r   r   =  rX   r   c                   @   rO   )	LSA_x64_8c                 C   r   )Nr   r   r   r   r   r   r   r   r   r   K  r   zLSA_x64_8.__init__NrW   r   r   r   r   r   J  rX   r   c                   @   s   e Zd ZdZdd ZdS )	LSA_x64_9z0Same as LSA_x64_8 but with a different IV offsetc                 C   r   )Nr   r   G   r   r   r   r   r   r   r   Y  r   zLSA_x64_9.__init__N)rJ   rK   rL   __doc__r   r   r   r   r   r   W  s    r   c                   @   rO   )	LSA_x86_1c                 C   r   N   jjhr      iir   r   r   r   r   r   f  r   zLSA_x86_1.__init__NrW   r   r   r   r   r   e  rX   r   c                   @   rO   )	LSA_x86_2c                 C   r   r   r   r   r   r   r   r   s  r   zLSA_x86_2.__init__NrW   r   r   r   r   r   r  rX   r   c                   @   rO   )	LSA_x86_3c                 C   r   Nr   r   r   r   ir   r   r   r   r   r     r   zLSA_x86_3.__init__NrW   r   r   r   r   r     rX   r   c                   @   rO   )	LSA_x86_4c                 C   r   r   r   r   r   r   r   r     r   zLSA_x86_4.__init__NrW   r   r   r   r   r     rX   r   c                   @   rO   )	LSA_x86_5c                 C   r   Nr   r   r   iir   r   r   r   r   r     r   zLSA_x86_5.__init__NrW   r   r   r   r   r     rX   r   c                   @   rO   )	LSA_x86_6c                 C   r   r   r   r   r   r   r   r        

zLSA_x86_6.__init__NrW   r   r   r   r   r     rX   r   c                   @   rO   )	LSA_x86_7c                 C   r   r   )r
   r   rP   r   rR   rT   rS   rV   rU   ry   r   r|   r   r   r   r   r   r     r   zLSA_x86_7.__init__NrW   r   r   r   r   r     rX   r   r    )	r5   r6   r7   r8   r3   r   r9   r:   r;   )r5   r6   r7   r8   r3   r   r9   )r#   r!   N)&minidump.win_datatypesr   r   r   pypykatz.commons.commonr   r   r   %pypykatz.lsadecryptor.package_commonsr   pypykatzr	   r
   rP   r   r_   ro   rs   ry   r{   r|   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r+   r   r   r   r   <module>   sd   |