o
    j6}                     @   s  d dl mZ d dlmZmZ d dlmZmZmZ d dl	m
Z
mZmZmZmZmZmZmZmZmZmZmZ d dlmZ d dlmZ G dd deZG d	d
 d
ZG dd dZG dd dZG dd dZG dd dZG dd dZG dd dZ G dd deZ!G dd dZ"G dd deZ#G dd deZ$G dd  d Z%G d!d" d"eZ&G d#d$ d$Z'G d%d& d&eZ(G d'd( d(Z)G d)d* d*eZ*G d+d, d,Z+G d-d. d.eZ,G d/d0 d0Z-G d1d2 d2eZ.G d3d4 d4Z/G d5d6 d6eZ0G d7d8 d8Z1G d9d: d:eZ2G d;d< d<Z3G d=d> d>eZ4G d?d@ d@Z5dAdBd dCdAdBdDdCdEdFdBdCdGdHdBdCdIdJdBdCdKdLdMdCdIdLdMdCdIdJdBdCdNdOdBdCdPdOdBdCdIdOdBdCdQdRdBdCdSZ6dTS )U    )logger)BOOLEANHANDLE)KatzSystemArchitectureWindowsMinBuildWindowsBuild)USHORTULONGLSA_UNICODE_STRINGLSAISO_DATA_BLOBBYTEPVOIDWORDDWORDPOINTERLUIDPSIDANSI_STRING)PackageTemplate)hexdumpc                       s(   e Zd Z fddZedd Z  ZS )MsvTemplatec                    s@   t  d d | _d | _d| _d | _d | _d | _d | _d | _	d S )NMsvr   )
super__init__	signaturefirst_entry_offsetfirst_entry_offset_correctionoffset2
list_entry!encrypted_credentials_list_structencrypted_credential_structdecrypted_credential_struct)self	__class__ /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/lsadecryptor/packages/msv/templates.pyr      s   
zMsvTemplate.__init__c                 C   s>  t d| j  t d| j  t }t|_|d|j t|_	|d|j	 | jt
jjk r2t|_n`| jt
jjk r=t|_nU| jt
jjk rHt|_nJ| jt
jjk r\| jdkrXt|_n:t|_n6| jt
jjk rp| jdkrlt|_n&t|_n"| jtjjk r{t|_n| jtjjk r| jdkrt|_nt|_nt|_|d|j | jtjjk rt|_ n$| jtj!jk rt"|_ n| jtj#jk rt$|_ n| jtjjk rt%|_ nt&|_ |d|j  | j't(j)kr^t
j*j| j  krt
jjk rn nd	|_+d
|_,d|_-|S t
jj| j  krt
jjk rn nd	|_+d
|_,d|_-|S t
jj| j  kr!t
jjk r.n nd|_+d|_,d
|_-|S t
jj| j  kr?t
jjk rLn nd|_+d|_,d
|_-|S t
jj| j  kr]t
jjk r~n n| jdkrst|_d|_+d|_,d|_-|S d|_+d|_,d
|_-|S t
jj| j  krtjjk rn nd|_+d|_,d|_-|S tjj| j  krtj.jk rn nd|_+d|_,d
|_-|S tj.j| j  krtj/jk rn nd|_+d|_,d
|_-|S tj/j| j  krtj0jk rn nd|_+d|_,d
|_-|S tj0j| j  krtj1jk rn nd|_+d|_,d
|_-|S tj1j| j  kr%tj2jk r2n nd|_+d|_,d
|_-|S tj2j| j  krCtjjk rPn nd|_+d|_,d
|_-|S d|_+d |_,d!|_-d|_3|S | j't(j4krt
j*j| j  krvt
jjk rn nd"|_+d|_,d|_-|S t
jj| j  krt
jjk rn nd#|_+d$|_,d%|_-|S t
jj| j  krt
jjk rn nd#|_+d$|_,d&|_-|S t
jj| j  krt
jjk rn nd'|_+d(|_,d
|_-|S t
jj| j  krtjjk rn nd)|_+d|_,d
|_-|S | jtjjkrd*|_+d|_,d
|_-|S t5d+| j t5d,| j'| jf )-Nzbuildnumber: %szmsv_dll_timestamp: %sr   r    i  HSl   g" r   r!      LIHLr      3EAu L      3E/L   i   `   H[HH"      3A7LEt   $      3E7HEt      3A7LEt   E4$LEt   s   E7LE   s
   E4$E   is   Ps   q0iiis   EUމ]t   s   MEuts   MEutz4Could not identify template! sysinfo.buildnumber: %dz*Unknown Architecture: %s , Build number %s)6r   debugbuildnumbermsv_dll_timestampr   KIWI_MSV1_0_CREDENTIAL_LISTr   log_template"KIWI_MSV1_0_PRIMARY_CREDENTIAL_ENCr    r   WIN_2K3valuePKIWI_MSV1_0_LIST_51r   	WIN_VISTAPKIWI_MSV1_0_LIST_52WIN_7PKIWI_MSV1_0_LIST_60WIN_8"PKIWI_MSV1_0_LIST_61_ANTI_MIMIKATZPKIWI_MSV1_0_LIST_61WIN_BLUEPKIWI_MSV1_0_LIST_63PKIWI_MSV1_0_LIST_62r   WIN_11_24H2WIN_11_25H2PKIWI_MSV1_0_LIST_65PKIWI_MSV1_0_LIST_64WIN_10_1507MSV1_0_PRIMARY_CREDENTIAL_DECr!   WIN_10_1511$MSV1_0_PRIMARY_CREDENTIAL_10_OLD_DECWIN_10_1607 MSV1_0_PRIMARY_CREDENTIAL_10_DEC%MSV1_0_PRIMARY_CREDENTIAL_10_1607_DEC$MSV1_0_PRIMARY_CREDENTIAL_11_H24_DECarchitecturer   X64WIN_XPr   r   r   WIN_10_1703WIN_10_1803WIN_10_1903WIN_11_2022WIN_11_2023r   X86	Exception)sysinfotemplater%   r%   r&   get_template   s   


"p&k&f&a&YU&P&J&D&>&9&4&/)&#&&&&zMsvTemplate.get_template)__name__
__module____qualname__r   staticmethodrg   __classcell__r%   r%   r#   r&   r      s    r   c                   @   s   e Zd ZdZdd ZdS )%MSV1_0_PRIMARY_CREDENTIAL_STRANGE_DEC`   c                 C   s   t |j| _t |j| _|d| _t|j| _|d t|j| _|d| _	t|j| _
|d| _d | _d | _d | _d | _d | _d | _d S )N   (   r2      )r   rC   unk1unk2readunk_tagr	   unk_remaining_sizeLengthOfNtOwfPasswordNtOwfPasswordLengthOfShaOwfPasswordShaOwPasswordLogonDomainNameUserNameLmOwfPasswordisNtOwfPasswordisLmOwfPasswordisShaOwPasswordr"   readerr%   r%   r&   r      s   

z.MSV1_0_PRIMARY_CREDENTIAL_STRANGE_DEC.__init__N)rh   ri   rj   sizer   r%   r%   r%   r&   rm      s    rm   c                   @      e Zd Zdd ZdS )rT   c                 C   s`   t || _t || _|d| _|d| _|d| _t|j| _	t|j| _
t|j| _d S Nr2   rq   )r
   r{   r|   rt   rx   r}   rz   r   rC   r~   r   r   r   r%   r%   r&   r      s   

z&MSV1_0_PRIMARY_CREDENTIAL_DEC.__init__Nrh   ri   rj   r   r%   r%   r%   r&   rT          rT   c                   @   r   )rV   c                 C   s   t || _t || _t|j| _t|j| _t|j| _t|j| _t	|j| _
t	|j| _|d| _|d| _|d| _d S r   )r
   r{   r|   r   rC   isIsor~   r   r   r   align0align1rt   rx   r}   rz   r   r%   r%   r&   r      s   

z-MSV1_0_PRIMARY_CREDENTIAL_10_OLD_DEC.__init__Nr   r%   r%   r%   r&   rV      r   rV   c                   @   r   )rX   c                 C   s   t || _t || _t|j| _t|j| _t|j| _t|j| _t	|j| _
t	|j| _t	|j| _t	|j| _|d| _|d| _|d| _d S r   )r
   r{   r|   r   rC   r   r~   r   r   r   r   r   align2align3rt   rx   r}   rz   r   r%   r%   r&   r      s   

z)MSV1_0_PRIMARY_CREDENTIAL_10_DEC.__init__Nr   r%   r%   r%   r&   rX      r   rX   c                   @   r   )rY   c                 C   s   t || _t || _t|j| _t|j| _t|j| _t|j| _	t|j| _
t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _|d| _t| jd rb|| j| _d S |d| _|d| _|d| _d S Nrq   r   r2   )r
   r{   r|   r   rC   pNtlmCredIsoInProcr   r   r~   r   r   isDPAPIProtectedr   r   r   r   r   credKeyTyper   isoSizert   DPAPIProtectedboolencryptedBlobrx   r}   rz   r   r%   r%   r&   r     s&   

z.MSV1_0_PRIMARY_CREDENTIAL_10_1607_DEC.__init__Nr   r%   r%   r%   r&   rY     r   rY   c                   @   r   )rZ   c                 C   s   t || _t || _t|j| _t|j| _t|j| _t|j| _	t|j| _
t|j| _t|j| _t|j| _t|j| _t|j| _|d| _t| jd r\|| j| _d S |d| _|d| _|d| _d S r   )r
   r{   r|   r   rC   r   r   r   r~   r   r   r   r   r   r   r   r   r   rt   r   r   r   rx   r}   rz   r   r%   r%   r&   r   '  s$   

z-MSV1_0_PRIMARY_CREDENTIAL_11_H24_DEC.__init__Nr   r%   r%   r%   r&   rZ   &  r   rZ   c                   @   r   )rA   c                 C   s*   t || _t|| _|  t|| _d S N)#PKIWI_MSV1_0_PRIMARY_CREDENTIAL_ENCFlinkr   Primaryalignr
   encrypted_credentialsr   r%   r%   r&   r   ?  s   

z+KIWI_MSV1_0_PRIMARY_CREDENTIAL_ENC.__init__Nr   r%   r%   r%   r&   rA   >  r   rA   c                          e Zd Z fddZ  ZS )r   c                       t  |t d S r   )r   r   rA   r   r#   r%   r&   r   F     z,PKIWI_MSV1_0_PRIMARY_CREDENTIAL_ENC.__init__rh   ri   rj   r   rl   r%   r%   r#   r&   r   E      r   c                   @   r   )r?   c                 C   s,   t || _t|j| _|  t|| _d S r   )PKIWI_MSV1_0_CREDENTIAL_LISTr   r   rC   AuthenticationPackageIdr   r   PrimaryCredentials_ptrr   r%   r%   r&   r   N  s   
z$KIWI_MSV1_0_CREDENTIAL_LIST.__init__Nr   r%   r%   r%   r&   r?   M  r   r?   c                       r   )r   c                    r   r   )r   r   r?   r   r#   r%   r&   r   V  r   z%PKIWI_MSV1_0_CREDENTIAL_LIST.__init__r   r%   r%   r#   r&   r   U  r   r   c                       r   )rD   c                    r   r   )r   r   KIWI_MSV1_0_LIST_51r   r#   r%   r&   r   Z  r   zPKIWI_MSV1_0_LIST_51.__init__r   r%   r%   r#   r&   rD   Y  r   rD   c                   @   r   )r   c                 C   s  t || _t || _t|j| _t|| _t|| _t	|j| _
t	|j| _t|| _t|j| _t|j| _|d tj|dddd| _|  t|| _t|| _t|j| _|  t	|j| _t	|j| _t	|j| _t|j| _|  t	|| _d S N   littleF	byteordersigned)rD   r   Blinkr   rC   LocallyUniqueIdentifierr
   r|   Domainer   unk0rr   r   pSidr	   	LogonTypeSessionr   int
from_bytesrt   	LogonTimeLogonServerr   Credentials_list_ptrunk19unk20unk21unk22unk23CredentialManagerr   r%   r%   r&   r   ^  s.   







zKIWI_MSV1_0_LIST_51.__init__Nr   r%   r%   r%   r&   r   ]  r   r   c                       r   )rF   c                    r   r   )r   r   KIWI_MSV1_0_LIST_52r   r#   r%   r&   r   x  r   zPKIWI_MSV1_0_LIST_52.__init__r   r%   r%   r#   r&   rF   w  r   rF   c                   @   r   )r   c                 C   s   t || _t || _t|j| _t|| _t|| _t	|j| _
t	|j| _t|| _t|j| _t|j| _|d tj|dddd| _t|| _t|| _t|j| _|  t	|j| _t	|j| _t|j| _|  t	|| _d S r   )rF   r   r   r   rC   r   r
   r|   r   r   r   rr   r   r   r	   r   r   r   r   r   rt   r   r   r   r   r   r   r   r   r   r   r%   r%   r&   r   |  s*   







zKIWI_MSV1_0_LIST_52.__init__Nr   r%   r%   r%   r&   r   {  r   r   c                       r   )rH   c                    r   r   )r   r   KIWI_MSV1_0_LIST_60r   r#   r%   r&   r     r   zPKIWI_MSV1_0_LIST_60.__init__r   r%   r%   r#   r&   rH     r   rH   c                   @   r   )r   c                 C   s  t || _t || _|  t|j| _t|j| _|  t|j| _	t|j| _
t|j| _t|j| _|  t|j| _|  t|j| _|  t|j| _|  t|j| _|  t|j| _t|j| _t|j| _|  t|j| _|  tj|dddd| _tj|dddd| _|  t|| _t|| _t|j| _t|j| _t || _!t|j| _"t|j| _#|d tj|dddd| _$t|| _%t&|| _'t|j| _(|  t|j| _)t|j| _*t|j| _+t|j| _,|  t|| _-d S r   ).rH   r   r   r   r   rC   r   r	   rr   rs   unk3unk4unk5r   hSemaphore6unk7hSemaphore8unk9unk10unk11unk12unk13r   r   rt   r    SecondaryLocallyUniqueIdentifierr
   r|   r   unk14unk15r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r%   r%   r&   r     s^   







zKIWI_MSV1_0_LIST_60.__init__Nr   r%   r%   r%   r&   r     r   r   c                       r   )rK   c                    r   r   )r   r   KIWI_MSV1_0_LIST_61r   r#   r%   r&   r     r   zPKIWI_MSV1_0_LIST_61.__init__r   r%   r%   r#   r&   rK     r   rK   c                   @   r   )r   c                 C   s  t || _t || _t|j| _t|j| _|  t|j| _	t|j| _
t|j| _t|j| _|  t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|| _t|| _t|j| _t|j| _t|| _t|j| _ t|j| _!|d t"j#|$dddd| _%t|| _&t'|| _(t|j| _)t|j| _*t|j| _+t|j| _,|  t|| _-d S r   ).rK   r   r   r   rC   r   r	   rr   r   rs   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r
   r|   r   r   r   r   r   r   r   r   r   rt   r   r   r   r   r   r   r   r   r   r   r%   r%   r&   r     sJ   







zKIWI_MSV1_0_LIST_61.__init__Nr   r%   r%   r%   r&   r     r   r   c                       r   )rJ   c                    r   r   )r   r   !KIWI_MSV1_0_LIST_61_ANTI_MIMIKATZr   r#   r%   r&   r     r   z+PKIWI_MSV1_0_LIST_61_ANTI_MIMIKATZ.__init__r   r%   r%   r#   r&   rJ     r   rJ   c                   @   r   )r   c                 C   s  t || _t || _t|j| _t|j| _|  t|j| _	t|j| _
t|j| _t|j| _|  t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _|d| _|  t|| _t|| _t|j| _t|j| _t || _!t|j| _"t|j| _#|d t$j%|dddd| _&t|| _'t(|| _)t|j| _*t|j| _+t|j| _,t|j| _-|  t|| _.d S N   r   r   Fr   )/rJ   r   r   r   rC   r   r	   rr   r   rs   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   rt   wazar
   r|   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r%   r%   r&   r     sN   







z*KIWI_MSV1_0_LIST_61_ANTI_MIMIKATZ.__init__Nr   r%   r%   r%   r&   r     r   r   c                       r   )rN   c                    r   r   )r   r   KIWI_MSV1_0_LIST_62r   r#   r%   r&   r   %  r   zPKIWI_MSV1_0_LIST_62.__init__r   r%   r%   r#   r&   rN   $  r   rN   c                   @   r   )r   c                 C   s  t || _t || _t|j| _t|j| _|  t|j| _	t|j| _
t|j| _t|j| _|  t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|| _t|| _t|j| _t|j| _t|| _t|| _ t|j| _!|  t|j| _"t|j| _#|  t$j%|&dddd| _'t|| _(t)|| _*t|j| _+t|j| _,t|j| _-t|j| _.t|j| _/t|j| _0t|j| _1t|j| _2|  t|j| _3t|j| _4t|j| _5t|| _6d S r   )7rN   r   r   r   rC   r   r	   rr   r   rs   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r
   r|   r   r   r   Typer   r   r   unk18r   r   r   rt   r   r   r   r   r   r   r   r   r   unk24unk25unk26unk27unk28unk29r   r   r%   r%   r&   r   )  s^   







zKIWI_MSV1_0_LIST_62.__init__Nr   r%   r%   r%   r&   r   (  r   r   c                       r   )rM   c                    r   r   )r   r   KIWI_MSV1_0_LIST_63r   r#   r%   r&   r   [  r   zPKIWI_MSV1_0_LIST_63.__init__r   r%   r%   r#   r&   rM   Z  r   rM   c                   @   r   )r   c                 C   s<  t || _t || _t|j| _t|j| _|  t|j| _	t|j| _
t|j| _t|j| _|  t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _|  t|j| _t|j| _|d| _|  t|| _t|| _t|j| _t|j| _t|| _ t!|| _"t|j| _#|  t|j| _$t|j| _%|d t&j'|dddd| _(t|| _)t*|| _+t|j| _,t|j| _-t|j| _.t|j| _/t|j| _0t|j| _1t|j| _2t|j| _3|  t|j| _4t|j| _5t|j| _6t|| _7d S r   )8rM   r   r   r   rC   r   r	   rr   r   rs   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   rt   r   r
   r|   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r%   r%   r&   r   _  sd   








zKIWI_MSV1_0_LIST_63.__init__Nr   r%   r%   r%   r&   r   ^  r   r   c                       r   )rR   c                    r   r   )r   r   KIWI_MSV1_0_LIST_64r   r#   r%   r&   r     r   zPKIWI_MSV1_0_LIST_64.__init__r   r%   r%   r#   r&   rR     r   rR   c                   @   r   )r   c                 C   sH  t || _t || _t|j| _t|j| _|  t|j| _	t|j| _
t|j| _t|j| _|  t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _|  t|j| _t|j| _|d| _|  t|j| _t|| _t|| _t|j| _t|j| _ t|| _!t"|| _#t|j| _$|  t|j| _%t|j| _&|d t'j(|dddd| _)t|| _*t+|| _,t|j| _-t|j| _.t|j| _/t|j| _0t|j| _1t|j| _2t|j| _3t|j| _4|  t|j| _5t|j| _6t|j| _7t|| _8d S r   )9rR   r   r   r   rC   r   r	   rr   r   rs   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   rt   r   r   r
   r|   r   r   unk16r   r   r   r   unk17r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r%   r%   r&   r     sf   








zKIWI_MSV1_0_LIST_64.__init__Nr   r%   r%   r%   r&   r     r   r   c                       r   )rQ   c                    r   r   )r   r   KIWI_MSV1_0_LIST_65r   r#   r%   r&   r     r   zPKIWI_MSV1_0_LIST_65.__init__r   r%   r%   r#   r&   rQ     r   rQ   c                   @   r   )r   c                 C   sT  t || _t || _t|j| _t|j| _|  t|j| _	t|j| _
t|j| _t|j| _|  t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _|  t|j| _t|j| _|d| _|  t|j| _t|j| _t|| _t|| _t|j| _ t|j| _!t|| _"t#|| _$t|j| _%|  t|j| _&t|j| _'|d t(j)|dddd| _*t|| _+t,|| _-t|j| _.t|j| _/t|j| _0t|j| _1t|j| _2t|j| _3t|j| _4t|j| _5|  t|j| _6t|j| _7t|j| _8t|| _9d S r   ):rQ   r   r   r   rC   r   r	   rr   r   rs   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   rt   r   r   r   r
   r|   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r%   r%   r&   r     sh   








zKIWI_MSV1_0_LIST_65.__init__Nr   r%   r%   r%   r&   r     r   r   r'   r(   )r   r   r   r)   r*   r+   r,   r-   r1   r2   r.   r/   r0   r4   r5   r6   r7   r8   )01234567891011N)7pypykatzr   minidump.win_datatypesr   r   pypykatz.commons.commonr   r   r   pypykatz.commons.win_datatypesr   r	   r
   r   r   r   r   r   r   r   r   r   %pypykatz.lsadecryptor.package_commonsr   r   r   rm   rT   rV   rX   rY   rZ   rA   r   r?   r   rD   r   rF   r   rH   r   rK   r   rJ   r   rN   r   rM   r   rR   r   rQ   r   templates_testr%   r%   r%   r&   <module>   s   8 @2)*256<	

	
