o
    j\!                     @   s   d dl Z d dlZd dlmZ d dlmZ d dlmZmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ G dd dZdS )    N)NTRegistryHeadr)NTRegistryHbin)NTRegistryNKNKFlag)NTRegistryCell)	ValueList)NTRegistryHR)NTRegistryLH)NTRegistryRI)REGTYPEc                   @   s   e Zd Zd1dejdedefddZed1de	dedefd	d
Z
ed1dejdedefddZed2dedefddZdd Zdd Zdd Zd3ddZdd Zdd Zd4ddZd4d d!Zd"d# Zd$d% Zd5d&d'Zd4d(d)Zd*d+ Zd6d-d.Zd7d/d0ZdS )8AIOWinRegHiveNTreader	root_hbinis_filec                 C   s>   || _ d | _d | _|| _|| _|d urt | _i | _i | _d S N)r   headerrootr   r   r   _AIOWinRegHive__cells_lookup_AIOWinRegHive__key_lookup)selfr   r   r    r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/aiowinreg/hive.py__init__   s   
zAIOWinRegHive.__init__datac                 C   s   t t| ||dS Nr   r   )r   ioBytesIO)r   r   r   r   r   r   
from_bytes      zAIOWinRegHive.from_bytesbuffc                 C   s   t | ||dS r   )r   )r    r   r   r   r   r   from_buffer!   s   zAIOWinRegHive.from_buffer	file_pathc                 C   s   t t| d|ddS )NrbTr   )r   open)r"   r   r   r   r   	from_file%   r   zAIOWinRegHive.from_filec                 C   s   | j   d S r   )r   closer   r   r   r   r&   )   s   zAIOWinRegHive.closec                 C   s4   | j d u rt| j| _ | jd u r|  | _d S d S r   )r   r   readr   r   search_root_keyr'   r   r   r   setup,   s
   

zAIOWinRegHive.setupc                 C   s   | j sJ| jdd d}d}|dkrF| j|d t| j}|jD ]}t|jtr9t	j
|jjv r9|| _ |j  S q"||j7 }|j}|dkstd| j jD ]}t|jtrbt	j
|jjv rb|j  S qNtd)N   r   zCould not find root key!)r   r   seekr   r(   cells
isinstancer   r   r   ROOTflagsoffset_next	Exception)r   hbin_offsetr2   hbincellr   r   r   r)   2   s.   



zAIOWinRegHive.search_root_keyFc                 C   s4   || j vrtj| j|| jdd}|| j |< | j | S NF
nk_partial)r   r   load_data_from_offsetr   r   )r   offsetr9   r6   r   r   r   __load_cell_from_offsetK   s   


z%AIOWinRegHive.__load_cell_from_offsetc                 C   s   t dD ]A}| j|jdd}t|tr|}qt|ttfr6|jD ]}| ||}|d ur2|    S q  d S |j	
 |
 krC|  S  d S d S )N   Tr8   )range%_AIOWinRegHive__load_cell_from_offset	offset_nkr/   r   r
   r	   hash_records_AIOWinRegHive__find_subkeynameupper)r   hash_reckey_name_subkey	thash_recresr   r   r   __find_subkeyQ   s    

zAIOWinRegHive.__find_subkeyc                 C   s   | j d u r	|   | |j}|d u rd S t|tr.|jD ]}| ||}|d ur-|  S q||D ]}| |}|j	
 |
 krG|  S q3d S r   )r   r*   r?   offset_lf_stabler/   r
   rA   rB   get_key_offsetsrC   rD   )r   parentrF   keyrI   rJ   r;   recr   r   r   find_subkeyb   s"   



zAIOWinRegHive.find_subkeyc                 C   s   | j d u r	|   t|dk r| j S || jvrKd}| j }|dD ]$}| ||}|d u r=|du r:td|||f  d S |d| 7 }|}q!|| j|< | j| S )N    \TzJCould not find subkey! Full path: %s Working path: %s Missing key name: %sz\%s)r   r*   lenr   splitrQ   r3   )r   key_paththrowworking_path
parent_keyrO   skeyr   r   r   find_keyw   s"   



zAIOWinRegHive.find_keyc                 C   sZ   | j d u r	|   g }| ||}|jdkr+| j|jdd}|jD ]	}|| |7 }q!|S )Nr   Fr8   )r   r*   r\   subkey_cnt_stabler?   rL   rA   _AIOWinRegHive__get_name)r   rW   rX   namesrO   rP   rE   r   r   r   enum_key   s   


zAIOWinRegHive.enum_keyc                 C   s   g }t dD ]8}| j|jdd}t|tr|}qt|ttfr/|jD ]	}|| |7 }q" |S |d u r6 |S |	|j
  |S |S )Nr=   Fr8   )r>   r?   r@   r/   r   r
   r	   rA   r^   appendrC   )r   rE   r_   rG   rH   rI   r   r   r   
__get_name   s"   

zAIOWinRegHive.__get_namec                 C   s   | j d u r	|   g }|jdkr|S t| j|j|jd | j}|jD ]"}|dk r*q#| j	|dd}|s4q#|j
dkr?|d q#||j q#|S )Nr      Fr8   s   default)r   r*   	value_cntr   r:   r   offset_value_listr   record_offsetsr?   flagra   rC   )r   rO   valuesvlrecord_offsetblockr   r   r   list_values   s    



zAIOWinRegHive.list_valuesc           	      C   s&  | j d u r	|   |d u r.|ddkr|dd\}}n
t|}t|}| ||}n|}|d u r6d S |jdkr=d S t	
| j|j|jd | j}|jD ]>}|dk rUqN| j|dd}|s_qN|jdkrw|dkrv|j|j| j| jdf  S qN||j kr|j|j| j| jdf  S qNtd	| )
N	r,   rc   r   Fr8   default)r   zCould not find %s)r   r*   findrV   ntpathdirnamebasenamer\   rd   r   r:   r   re   r   rf   r?   rg   
value_type	load_datarC   decoder3   )	r   
value_pathrX   rO   rW   
value_nameri   rj   rk   r   r   r   	get_value   s8   





zAIOWinRegHive.get_valuec                 C   s   | j d u r	|   | ||}|d u rd S |jdkr@| jdu r,| j|jd d d n
| j|jd d | j|j	dS d S )Nr   Tr+      z	utf-16-le)
r   r*   r\   offset_classnamer   r   r-   r(   class_name_lengthru   )r   rW   rX   rO   r   r   r   	get_class   s   


zAIOWinRegHive.get_classc                 C   s(   | j d u r	|   | j|jdd}|jS r7   )r   r*   r?   	offset_sksd)r   rO   skr   r   r   get_sd   s   
zAIOWinRegHive.get_sdr,   c                 c   sb    |d8 }|dkrd S |  |D ]}|dkr|}n|d | }|V  | ||D ]}|V  q(qd S )Nrc   r   rS   rT   )r`   walk)r   pathdepthrO   nprJ   r   r   r   r      s   zAIOWinRegHive.walkc                 c   s,   |  ddD ]}|du r||dkr|V  |s|du r| |}| |D ]k}| }|d | }|du rA||dkrA|V  |du r| j||d\}	}
|	tjkr`|
 |dkr`|V  q'|	tj	kr{t
|
D ]\}}||dkry|V   nqiq'|
}t|
tr| }t|
|dkr|V  q'qd S )NrS   r,   TrT   )rO   )r   ro   r\   rl   ru   rx   r   REG_UNKNOWNhexREG_MULTI_SZ	enumerater/   bytesstr)r   patternin_keysin_valuenames	in_valueskeypathrO   	valuename	valuepath	valuetypevalueivaltr   r   r   search  s<   


zAIOWinRegHive.search)NTr   )F)T)TN)r,   )TTT)__name__
__module____qualname__r   r   r   boolr   staticmethodr   r   r!   r   r%   r&   r*   r)   r?   rB   rQ   r\   r`   r^   rl   rx   r|   r   r   r   r   r   r   r   r      s.    




"
r   )rp   r   aiowinreg.filestruct.headerr   aiowinreg.filestruct.hbinr   aiowinreg.filestruct.nkr   r   aiowinreg.filestruct.regcellr   aiowinreg.filestruct.valuelistr   aiowinreg.filestruct.hashrecordr   aiowinreg.filestruct.lhr	   aiowinreg.filestruct.rir
   aiowinreg.filestruct.vkr   r   r   r   r   r   <module>   s   