o
    j5                  	   @   s   d dl mZ d dlmZ d dlmZ G dd deZg dg dg dg d	g d
g dg dg dgZdd Zdd Z	dd Z
dd ZdS )    )RC4)PackageDecryptor)LONGc                       sp   e Zd Z fddZdd Zdd Zdd Zd	d
 Zdd ZdddZ	dd Z
dd Zdd ZdddZ  ZS )LsaDecryptor_NT5c                    s4   t  dd || || _d | _d | _d | _d | _d S )NLsaDecryptor)super__init__decryptor_templatefeedbackfeedback_offsetdes_key
random_key)selfreaderr	   sysinfo	__class__ /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/alsadecryptor/lsa_decryptor_nt5.pyr      s   
zLsaDecryptor_NT5.__init__c                    s   |  d |  I d H }| j|I d H  | jj| jjfD ]1}|| _z| |I d H | _	| 
|I d H | _| |I d H | _W  d S    dd l}|  Y qd S )NzAcquireing crypto stuff...r   )logfind_signaturer   mover	   feedback_ptr_offsetold_feedback_offsetr   get_feedbackr
   get_keyr   
get_randomr   	traceback	print_exc)r   sigposxr   r   r   r   acquire_crypto_material   s   
z(LsaDecryptor_NT5.acquire_crypto_materialc                    s   | j jdkr%| j|| j I d H }| j|I d H  | jdI d H S | j|| j I d H  t| jI d H }|| j d | }| j|I d H  | jdI d H S )Nx86      )	r	   archr   get_ptr_with_offsetr   r   readr   	loadvalue)r   r   new_ptroffsetnewposr   r   r   r   ,   s   zLsaDecryptor_NT5.get_feedbackc                    s   | j jdkr3| j|| j j I d H }| j|I d H  | j j| jI d H }|| jI d H }|S | j|| j j I d H  t	
| jI d H }|| j j d | }| j|I d H  | j j| jI d H }|| jI d H }|S )Nr"   r$   )r	   r%   r   r&   desx_key_ptr_offsetr   key_struct_ptrloadr'   r   r(   )r   r   r)   des_key_ptrr   r*   r+   r   r   r   r   8   s   	zLsaDecryptor_NT5.get_keyc                    s   | j jdkr'| j|| j j I d H }| j|I d H }| j|I d H  n)| j|| j j I d H  t| jI d H }|| j j d | }| j|I d H  | j	dI d H S )Nr"   r$      )
r	   r%   r   r&   randomkey_ptr_offsetr   r   r(   r,   r'   )r   r   random_key_ptrr*   r+   r   r   r   r   H   s   zLsaDecryptor_NT5.get_randomc                    s   |  d | jd| jjI d H }t|dkr(| j d| jj   td|  dd	dd	 |D   |  d
|d   |d S )Nz.Looking for main struct signature in memory...z
lsasrv.dllr   zsignature not found! %szLSA signature not found!z/Found candidates on the following positions: %s c                 s   s    | ]}t |V  qd S N)hex).0r    r   r   r   	<genexpr>\   s    z2LsaDecryptor_NT5.find_signature.<locals>.<genexpr>zSelecting first one @ 0x%08x)
r   r   find_in_moduler	   	signaturelenloggerr5   	Exceptionjoin)r   flr   r   r   r   U   s   
zLsaDecryptor_NT5.find_signature   c                 C   sB   d}t |}|r|d dkrt| j}||}|S | |}|S )N    r#   r   )r:   r   r   decrypt_LsaDecryptor_NT5__desx_decrypt)r   	encryptedsegment_size	cleartextsizectxr   r   r   rA   `   s   


zLsaDecryptor_NT5.decryptc                 C   s   |  d |  dt| j| j  |  dt| j| j  |  dt| jj| jj  |  dt| jj| jj  d S )NzRecovered LSA encryption keys
zFeedback ({}): {}zRandom Key ({}): {}z DESX inputwhitening Key ({}): {}z!DESX outputwhitening Key ({}): {})	r   formatr:   r
   r5   r   r   inputWhiteningoutputWhitening)r   r   r   r   dumpo   s
   
"&zLsaDecryptor_NT5.dumpc                 C   s.   t || jj}| j|dd}t || jj}|S )NF)encrypt)xorr   rJ   &_LsaDecryptor_NT5__desx_internal_blockrI   )r   chunkr   r   r   __desx_decrypt_internal_blockw   s   z.LsaDecryptor_NT5.__desx_decrypt_internal_blockc                 C   sf   d}d}| j }|t|kr1| |||d  }|t||7 }|||d  }|d7 }|t|ks|S )Nr@   r   r#   )r
   r:   ._LsaDecryptor_NT5__desx_decrypt_internal_blockrM   )r   dataresiIVrO   r   r   r   __desx_decrypt}   s   zLsaDecryptor_NT5.__desx_decryptFc                 C   sz  t j|dd  ddd}t j|d d ddd}t|d}||A d@ }||A }||A }t|d}||A d@ }||A }||A }t|d}||A d	@ }||A }||A }t|d
}||A d@ }||A }||A }t|d}||A d@ }||A }||A }t|d}|rtdddD ]}t||| jjj| \}}t||| jjj|d  \}}qn%tdddD ]}t||| jjj|d  \}}t||| jjj| \}}qt|d}||A d@ }||A }||A }t|d}||A d@ }||N }||N }t|d
}||A d	@ }||N }||N }t|d}||A d@ }||N }||N }t|d}||A d@ }||N }||N }t|d}|j	dddd|j	dddd S )Nr$   littleF)signedl   pa    l        i3333   i	   l   *UU    r      )
int
from_bytesrol32rangeFr   desKeyroundKeyror32to_bytes)r   rR   rL   LRTarT   r   r   r   __desx_internal_block   sj   





 





 z&LsaDecryptor_NT5.__desx_internal_block)r?   )F)__name__
__module____qualname__r   r!   r   r   r   r   rA   rK   rQ   rB   rN   __classcell__r   r   r   r   r      s    
r   )@            rs   rv   rq        ru   r   rw   rr   r^       rt   rx   ry   r{   r^      r|    r}   rz   r~   r   r   rt   r{   rw   rq   rr   ry   r{   r~   r}   r|   rs   rv   r^   rs   rx   rt   r|   rx   rz   ru   ry   rw   r   rr   ru   rz   rq   r^   r~   r}   rv   )@@r       @  @    @r       @   r      @r   r       @r   r       @r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   )@   r0         r            r]     r]    r   r   r   r0   r   r   r   r   r   r    r   r   r   r   r   r   r0   r]   r   r   r   r   r   r   r   r   r   r   r   r   r]   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r0   r   )@@   r#   @r     @  @  @       r   r     @ r    @ @    r#   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r#   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r#   r   r   r   r   r   r   r   r   r   r   )@                  r              r    r   r   r         r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   )@   @    @   r        @  r          @        @      @ @                      r        @  @   r   r      @ @  r   r   @   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   )@ @         B @   B  r          @ r$    B r   r   r   r   r   r   r   r   r   r   @ B  r   r$   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r$   r   r   r   r   r   r   r   r   r   r   r$   r   r   r   r   r   r   )@       r             r?          r          r      r   r   r   r   r   r   r   r      r   r   r   r   r   r?   r   r   r   r   r   r   r   r   r   r   r   r   r   r?   r   r   r   r   r   r   r   r   r   r   r?   r   r   r   r   r   r   r   c                 C   s  |d |A }|d |A }t |d}| td |d@ d  N } | td |d@ d  N } | td |d? d@ d  N } | td |d? d@ d  N } | td |d? d@ d  N } | td	 |d? d@ d  N } | td
 |d? d@ d  N } | td |d? d@ d  N } | |fS )Nr   r]   r$      r^   r#      r               )rg   SymCryptDesSpbox)ri   rj   keyark   Tbr   r   r   rd     s   
rd   c                 C   s   | |> | d| ? B d@ S Nr   l    r   ndr   r   r   rb        rb   c                 C   s   | |? | d| > B d@ S r   r   r   r   r   r   rg   !  r   rg   c                 C   s   t dd t| |D S )Nc                 s   s    | ]	\}}||A V  qd S r4   r   )r6   abr   r   r   r7   %  s    zxor.<locals>.<genexpr>)byteszip)d1d2r   r   r   rM   $  r   rM   N)unicrypto.symmetricr   &pypykatz.alsadecryptor.package_commonsr   $pypykatz.alsadecryptor.win_datatypesr   r   r   rd   rb   rg   rM   r   r   r   r   <module>   s$    S3