o
    j	                     @   sF   d dl Z d dlZd dlZd dlmZ G dd dZG dd deZdS )    N)PackageDecryptorc                   @   s,   e Zd Zdd Zdd Zdd Zdd Zd	S )
DpapiCredentialc                 C   s"   d| _ d | _d | _d | _d | _d S )Ndpapi)credtypeluidkey_guid	masterkeysha1_masterkeyself r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/lsadecryptor/packages/dpapi/decryptor.py__init__   s
   
zDpapiCredential.__init__c                 C   s:   i }| j |d< | j|d< | j|d< | j|d< | j|d< |S )Nr   r   r   r	   r   )r   r   r   r	   r   r   tr   r   r   to_dict   s   




zDpapiCredential.to_dictc                 C   s   t |  S N)jsondumpsr   r
   r   r   r   to_json   s   zDpapiCredential.to_jsonc                 C   sF   d| j  }|d| j  7 }|d| j 7 }|d| j 7 }|d| j 7 }|S )Nz	== DPAPI [%x]==
z
		luid %s
z		key_guid %s
z		masterkey %s
z		sha1_masterkey %s
)r   r   r   r	   r   r   r   r   __str__   s   
zDpapiCredential.__str__N)__name__
__module____qualname__r   r   r   r   r   r   r   r   r      s
    	r   c                       s4   e Zd Z fddZdd Zdd Zdd Z  ZS )	DpapiDecryptorc                    s"   t  d||| || _g | _d S )NDpapi)superr   decryptor_templatecredentials)r   readerr   lsa_decryptorsysinfo	__class__r   r   r   (   s   
zDpapiDecryptor.__init__c                 C   s8   |  || jj}| j|| jj }| j|}||fS r   )find_signaturer   	signaturer   get_ptr_with_offsetfirst_entry_offsetget_ptr)r   
modulenamepositionptr_entry_loc	ptr_entryr   r   r   find_first_entry.   s   zDpapiDecryptor.find_first_entryc                 C   s|   |j d u rd S |r:|jdkr<| j|j dd\}}t| }t }|j|_|j	|_
| |_||_| j| d S d S d S )Nr   T)bytes_expected)keykeySizedecrypt_passwordhashlibsha1	hexdigestr   LogonIdr   KeyUidr   hexr   r	   r   append)r   dpapi_entrydec_masterkeyraw_decsha_masterkeycr   r   r   	add_entry4   s   

zDpapiDecryptor.add_entryc                 C   s|   dD ]9}z	|  |\}}W n ty& } z| d|  W Y d }~qd }~ww | j| | j| j}| || j qd S )N)z
lsasrv.dllzdpapisrv.dllz"Failed to find structs! Reason: %s)	r-   	Exceptionlogr   mover   
list_entry	walk_listr>   )r   r)   entry_ptr_valueentry_ptr_loce	entry_ptrr   r   r   startC   s   zDpapiDecryptor.start)r   r   r   r   r-   r>   rH   __classcell__r   r   r"   r   r   '   s
    r   )ior   r2   %pypykatz.lsadecryptor.package_commonsr   r   r   r   r   r   r   <module>   s   