o
    j^%                     @   s   d dl Z d dlZd dlmZ d dlmZ d dlmZmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZmZ G dd dZdS )    N)NTRegistryHeadr)NTRegistryHbin)NTRegistryNKNKFlag)NTRegistryCell)	ValueList)NTRegistryHR)NTRegistryLH)NTRegistryRI)REGTYPE)ABufferAFilec                   @   s   e Zd ZdZd1ddZed1dededefd	d
Z	ed1de
jdedefddZed2dedefddZdd Zdd Zdd Zd3ddZdd Zdd Zd4ddZd4d d!Zd"d# Zd$d% Zd5d&d'Zd4d(d)Zd*d+ Zd6d-d.Zd7d/d0ZdS )8AIOWinRegHivez$
	Async version of the hive parser
	NTc                 C   s>   || _ d | _d | _|| _|| _|d urt | _i | _i | _d S N)readerheaderroot	root_hbinis_filer   _AIOWinRegHive__cells_lookup_AIOWinRegHive__key_lookup)selfr   r   r    r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/aiowinreg/ahive.py__init__   s   
zAIOWinRegHive.__init__datar   r   c                 C   s   t tt| ||dS Nr   r   )r   r   ioBytesIO)r   r   r   r   r   r   
from_bytes   s   zAIOWinRegHive.from_bytesbuffc                 C   s   t t| ||dS r   )r   r   )r!   r   r   r   r   r   from_buffer#      zAIOWinRegHive.from_buffer	file_pathc                 C   s   t t| |ddS )NTr   )r   r   )r$   r   r   r   r   	from_file'   r#   zAIOWinRegHive.from_filec                    s   | j  I dH  dS )zCloses the hiveN)r   closer   r   r   r   r&   +   s   zAIOWinRegHive.closec                    sB   | j du rt| jI dH | _ | jdu r|  I dH | _dS dS )z$Must be called before using the hiveN)r   r   areadr   r   search_root_keyr'   r   r   r   setup/   s   

zAIOWinRegHive.setupc                    s   | j sT| jddI d H  d}d}|dkrP| j|dI d H  t| jI d H }|jD ]}t|jtrCt	j
|jjv rC|| _ |j  S q,||j7 }|j}|dkstd| j jD ]}t|jtrlt	j
|jjv rl|j  S qXtd)N   r   zCould not find root key!)r   r   seekr   r(   cells
isinstancer   r   r   ROOTflagsoffset_next	Exception)r   hbin_offsetr2   hbincellr   r   r   r)   6   s0   



zAIOWinRegHive.search_root_keyFc                    s<   || j vrtj| j|| jddI d H }|| j |< | j | S )NF
nk_partial)r   r   aload_data_from_offsetr   r   )r   offsetr8   r6   r   r   r   __load_cell_from_offsetO   s
   


z%AIOWinRegHive.__load_cell_from_offsetc                    s   t dD ]G}| j|jddI d H }t|tr|}qt|ttfr=|jD ]}| ||I d H }|d ur9|    S q$ d S |j	
 |
 krJ|  S  d S d S )N   Tr7   )range%_AIOWinRegHive__load_cell_from_offset	offset_nkr/   r   r
   r	   hash_records_AIOWinRegHive__find_subkeynameupper)r   hash_reckey_name_subkey	thash_recresr   r   r   __find_subkeyU   s"   

zAIOWinRegHive.__find_subkeyc                    s   | j du r|  I dH  | |jI dH }|du rdS t|tr8|jD ]}| ||I dH }|dur7|  S q$||D ]}| |I dH }|j	
 |
 krT|  S q=dS )z*Find and return a subkey of the parent keyN)r   r*   r>   offset_lf_stabler/   r
   r@   rA   get_key_offsetsrB   rC   )r   parentrE   keyrH   rI   r:   recr   r   r   find_subkeyg   s$   


zAIOWinRegHive.find_subkeyc                    s   | j du r|  I dH  t|dk r| j S d}| j }|dD ]'}| ||I dH }|du r?|du r<td|||f  dS |d| 7 }|}q |S )z&Find and return a key by its full pathN    \TzJCould not find subkey! Full path: %s Working path: %s Missing key name: %sz\%s)r   r*   lensplitrP   r3   )r   key_paththrowworking_path
parent_keyrN   skeyr   r   r   find_key|   s    
zAIOWinRegHive.find_keyc                    st   | j du r|  I dH  g }| ||I dH }|jdkr8| j|jddI dH }|jD ]}|| |I dH 7 }q+|S )zReturn a list of subkey namesNr   Fr7   )r   r*   r[   subkey_cnt_stabler>   rK   r@   _AIOWinRegHive__get_name)r   rV   rW   namesrN   rO   rD   r   r   r   enum_key   s   


zAIOWinRegHive.enum_keyc                    s   | j du r|  I dH  g }|jdkr|S t| j|j|jd | jI dH }|jD ]'}|dk r1q*t	| j|| jI dH }|s@q*|j
dkrK|d q*||j q*|S )zReturn a list of value namesNr      s   default)r   r*   	value_cntr   r9   r   offset_value_listr   record_offsetsr   flagappendrB   )r   rN   valuesvlrecord_offsetblockr   r   r   list_values   s"   

"

zAIOWinRegHive.list_valuesc                    s   g }t dD ]>}| j|jddI d H }t|tr|}qt|ttfr6|jD ]}|| |I d H 7 }q& |S |d u r= |S |	|j
  |S |S )Nr<   Fr7   )r=   r>   r?   r/   r   r
   r	   r@   r]   re   rB   )r   rD   r^   rF   rG   rH   r   r   r   
__get_name   s$   

zAIOWinRegHive.__get_namec           
         sX  | j du r|  I dH  |du r5|ddkr!|dd\}}n
t|}t|}| ||I dH }n|}|du r=dS |jdkrDdS t	
| j|j|jd | jI dH }|jD ]M}|dk r_qXt
| j|| jI dH }|snqX|jdkr|dkr|j| j| jdI dH }	|j|	f  S qX||j kr|j| j| jdI dH }	|j|	f  S qXtd| )	zReturn a value by its full pathN	r,   r`   r   default)r   zCould not find %s)r   r*   findrU   ntpathdirnamebasenamer[   ra   r   r9   r   rb   r   rc   r   rd   
aload_data
value_typerB   decoder3   )
r   
value_pathrW   rN   rV   
value_namerg   rh   ri   r   r   r   r   	get_value   s>   



"

zAIOWinRegHive.get_valuec                    s   | j du r|  I dH  | ||I dH }|du rdS |jdkrd| jdu r6| j|jd d dI dH  n| j|jd dI dH  | j|jI dH }t	|t
r]|\}}|dur\|n|}|dS dS )zReturn the class value of a keyNr   Tr+      z	utf-16-le)r   r*   r[   offset_classnamer   r   r-   readclass_name_lengthr/   tuplert   )r   rV   rW   rN   rI   r   errr   r   r   	get_class   s&   


 

zAIOWinRegHive.get_classc                    s6   | j du r|  I dH  | j|jddI dH }|jS )z'Return the security descriptor of a keyNFr7   )r   r*   r>   	offset_sksd)r   rN   skr   r   r   get_sd  s
   
zAIOWinRegHive.get_sdr,   c                 C  sr   |d8 }|dkrdS |  |I dH D ]#}|dkr|}n|d | }|V  | ||2 z	3 dH W }|V  q+6 qdS )zWalk the registry treer`   r   NrR   rS   )r_   walk)r   pathdepthrN   nprI   r   r   r   r     s   zAIOWinRegHive.walkc                 C  sL  |  dd2 z3 dH W }|du r||dkr|V  |s!|du r| |I dH }| |I dH D ]p}| }|d | }|du rK||dkrK|V  |du r| j||dI dH }	|	\}
}|
tjkro| |dkro|V  q1|
tj	krt
|D ]\}}||dkr|V   nqxq1|}t|tr| }t||dkr|V  q1q6 dS )z&Search the registry tree for a patternrR   r,   NTrS   )rN   )r   rn   r[   rj   rt   rw   r   REG_UNKNOWNhexREG_MULTI_SZ	enumerater/   bytesstr)r   patternin_keysin_valuenames	in_valueskeypathrN   	valuename	valuepathrI   	valuetypevalueivaltr   r   r   search  s>   

zAIOWinRegHive.search)NTr   )F)T)TN)r,   )TTT)__name__
__module____qualname____doc__r   staticmethodr   r   boolr    r   r   r"   r   r%   r&   r*   r)   r>   rA   rP   r[   r_   rj   r]   rw   r~   r   r   r   r   r   r   r   r      s0    





%
r   )ro   r   aiowinreg.filestruct.headerr   aiowinreg.filestruct.hbinr   aiowinreg.filestruct.nkr   r   aiowinreg.filestruct.regcellr   aiowinreg.filestruct.valuelistr   aiowinreg.filestruct.hashrecordr   aiowinreg.filestruct.lhr	   aiowinreg.filestruct.rir
   aiowinreg.filestruct.vkr   aiowinreg.utils.afiler   r   r   r   r   r   r   <module>   s    