o
    j                     @   sR  d dl mZ d dl mZ d dlmZ d dlmZ d dlmZm	Z	 d dl
mZ d dlmZ d dlmZ d Zd	Zd	Zd
ZdZdZdZd	Zd
ZdZdZdZdZdZdZdZdZ dZ!d	Z"d
Z#dZ$d	Z%dZ&dZ'd	Z(d
Z)dZ*d	Z+d
Z,dZ-dZ.dZ/d Z0d	Z1d
Z2dZ3dZ4dZ5dZ6dZ7dZ8dZ9dZ:dZ;dZ<dZ=dZ>dZ?dZ@dZAd ZBi e0d!e1d"e2d#e3d$e4d%e5d&e6d'e7d(e8d)e9d*e:d+e;d,e<d-e=d.e>d/e?d0e@d1eAd2eBd3iZCi e0d4e1d5e2d5e3d6e4d7e5d8e6d9e7d:e8d8e9d4e:d4e;d4e<d4e=d4e>d;e?d8e@d<eAd=eBd4iZDd	ZEd
ZFdZGdZHdZId>ZJd?ZKd@ZLeJdAeKdBeLdCiZMdDd dDd dEZNG dFdG dGeZOG dHdI dIeZPG dJdK dKeZQG dLdM dMeZRG dNdO dOeZSG dPdQ dQeZTG dRdS dSeZUG dTdU dUeZVG dVdW dWeZWG dXdY dYeZXG dZd[ d[eZYG d\d] d]eZZG d^d_ d_eZ[d`da Z\G dbdc dcZ]G ddde deZ^d4S )f    )division)print_function)LOG)OrderedDict)	Structurehexdump)unpack)hexlify)b                      @          i              	   
                        NULLBooleanzSigned bytezSigned shortzSigned longCurrencyzSingle precision FPzDouble precision FPDateTimeBinaryTextzLong Binaryz	Long TextObsoletezUnsigned longz	Long longGUIDzUnsigned shortMaxN)r   B)r   z<h)r   z<l)r   z<Q)r   z<f)r   z<d)r   z<L)r   16s)r   <Hi  iN  i  zutf-16leasciicp1252    )	TableDataFatherDataPageNumberCurrentPageData
CurrentTagc                   @      e Zd ZdZdS )ESENT_JET_SIGNATURE))Random<L=0)CreationTime<Q=0)NetBiosName16s=b""N__name__
__module____qualname__	structure rB   rB   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/ese.pyr6          r6   c                   @   s   e Zd Zg dddddddefdd	d
ddddddefddddddddddddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9R Zd:S );ESENT_DB_HEADERCheckSumr8   )	Signatureu	   "ïÍ«)Versionr8   )FileTyper8   )DBTimer:   DBSignature:)DBStater8   )ConsistentPositionr:   )ConsistentTimer:   )
AttachTimer:   )AttachPositionr:   )
DetachTimer:   )DetachPositionr:   LogSignature)Unknownr8   )PreviousBackup24s=b"")PreviousIncBackuprX   )CurrentFullBackuprX   )ShadowingDisablesr8   )LastObjectIDr8   )WindowsMajorVersionr8   )WindowsMinorVersionr8   )WindowsBuildNumberr8   )WindowsServicePackNumberr8   )FileFormatRevisionr8   )PageSizer8   )RepairCountr8   )
RepairTimer:   )Unknown2z28s=b"")	ScrubTimer:   )RequiredLogr:   )UpgradeExchangeFormatr8   )UpgradeFreePagesr8   )UpgradeSpaceMapPagesr8   )CurrentShadowBackuprX   )CreationFileFormatVersionr8   )CreationFileFormatRevisionr8   )Unknown3r<   )OldRepairCountr8   )ECCCountr8   )LastECCTimer:   )OldECCFixSuccessCountr8   )ECCFixErrorCountr8   )LastECCFixErrorTimer:   )OldECCFixErrorCountr8   )BadCheckSumErrorCountr8   )LastBadCheckSumTimer:   )OldCheckSumErrorCountr8   )CommittedLogr8   )PreviousShadowCopyrX   )PreviousDifferentialBackuprX   )Unknown4z40s=b"")NLSMajorVersionr8   )NLSMinorVersionr8   )Unknown5z148s=b"")UnknownFlagsr8   N)r>   r?   r@   r6   rA   rB   rB   rB   rC   rE      s    	
 !"#$%&'()*+,-./012345678
rE   c                   @   s*   e Zd ZdZdZdZdZdZd
dd	ZdS )ESENT_PAGE_HEADER)rF   )
PageNumberr8   )rF   )ECCCheckSumr8   ))rG   r:   )	)LastModificationTimer:   )PreviousPageNumberr8   )NextPageNumberr8   )FatherDataPager8   )AvailableDataSize<H=0)AvailableUncommittedDataSizer   )FirstAvailableDataOffsetr   )FirstAvailablePageTagr   )	PageFlagsr8   ))ExtendedCheckSum1r:   )ExtendedCheckSum2r:   )ExtendedCheckSum3r:   )r   r:   rV   r:   r   Nc                 C   s~   |dk s|dkr|dk r| j | j | _n#|dkr$|dk r$| j| j | _n| j| j | _|dkr7|  j| j7  _t| | d S )N   r   r    r   )structure_2003_SP0commonrA   structure_0x620_0x0bstructure_win7extended_win7r   __init__)selfversionrevisionpageSizedatarB   rB   rC   r     s   zESENT_PAGE_HEADER.__init__)r   N)	r>   r?   r@   r   r   r   r   r   r   rB   rB   rB   rC   r      s    r   c                   @   r5   )ESENT_ROOT_HEADER))InitialNumberOfPagesr8   )ParentFatherDataPager8   )ExtentSpacer8   )SpaceTreePageNumberr8   Nr=   rB   rB   rB   rC   r   $  rD   r   c                   @   r5   )ESENT_BRANCH_HEADER)CommonPageKeyrM   Nr=   rB   rB   rB   rC   r   ,  rD   r   c                   @      e Zd ZdZdZdddZdS )ESENT_BRANCH_ENTRY)CommonPageKeySizer   )LocalPageKeySizer   _LocalPageKeyz_-LocalPageKeyzself["LocalPageKeySize"]LocalPageKeyrM   )ChildPageNumberr8   Nc                 C   *   |t @ dkr| j| j | _t| | d S Nr   
TAG_COMMONr   rA   r   r   r   flagsr   rB   rB   rC   r   ;     zESENT_BRANCH_ENTRY.__init__Nr>   r?   r@   r   rA   r   rB   rB   rB   rC   r   1      r   c                   @   r5   )ESENT_LEAF_HEADERr   Nr=   rB   rB   rB   rC   r   A  rD   r   c                   @   r   )ESENT_LEAF_ENTRYr   )r   r   r   )	EntryDatarM   Nc                 C   r   r   r   r   rB   rB   rC   r   P  r   zESENT_LEAF_ENTRY.__init__r   r   rB   rB   rB   rC   r   F  r   r   c                   @   r5   )ESENT_SPACE_TREE_HEADER)r   Nr=   rB   rB   rB   rC   r   V  rD   r   c                   @   r5   )ESENT_SPACE_TREE_ENTRY))PageKeySizer   )LastPageNumberr8   )NumberOfPagesr8   Nr=   rB   rB   rB   rC   r   [  rD   r   c                   @   r5   )ESENT_INDEX_ENTRY))RecordPageKeyrM   Nr=   rB   rB   rB   rC   r   b  rD   r   c                   @   r5   )ESENT_DATA_DEFINITION_HEADER))LastFixedSize<B=0)LastVariableDataTyper   )VariableSizeOffsetr   Nr=   rB   rB   rB   rC   r   g  rD   r   c                   @   s0   e Zd ZdZdZdZdZdZdZdZ	dd Z
d	S )
#ESENT_CATALOG_DATA_DEFINITION_ENTRY))FatherDataPageIDr8   )Typer   )
Identifierr8   ))
ColumnTyper8   
SpaceUsager8   )ColumnFlagsr8   )CodePager8   ))r2   r8   )r   )r   )
IndexFlagsr8   )Localer8   ))TrailingrM   c                 C   s   t d|dd  d d d }| j| _|tkr#|  j| j| j 7  _nE|tkr0|  j| j7  _n8|tkr@|  j| j| j	 7  _n(|t
krP|  j| j| j 7  _n|tkrXtdtd|  d| _t| | |  j| j7  _t| | d S )Nr-   r   r   r   zCallBack types not supported!zUnknown catalog type 0x%xrB   )r   fixedrA   CATALOG_TYPE_TABLEothertable_stuffCATALOG_TYPE_COLUMNcolumn_stuffCATALOG_TYPE_INDEXindex_stuffCATALOG_TYPE_LONG_VALUElv_stuffCATALOG_TYPE_CALLBACK	Exceptionr   errorr   r   r   )r   r   dataTyperB   rB   rC   r     s"   z,ESENT_CATALOG_DATA_DEFINITION_ENTRY.__init__N)r>   r?   r@   r   r   r   r   r   r   r   r   rB   rB   rB   rC   r   n  s    r   c                 C   s   | d8 } | d } | S )Nl     }*{Gi rB   )trB   rB   rC   getUnixTime  s   r   c                   @   s6   e Zd ZdddZdd Zdd Zdd	 Zd
d ZdS )
ESENT_PAGENc                 C   s   || _ || _d | _d| _d| _d| _|d ur^t| j d | j d | j d || _| jd | _| j d dkrT| j d dkrT| j d d	krT| jd t? pJd| _| jd t@ | _t	| j| j| _d S d S )
Nr   r   rI   ra   rb   r   r   r    r   )
_ESENT_PAGE__DBHeaderr   recordtagCounttagReservedfirstDataTagr   'FIRST_AVAILABLE_PAGE_TAG_RESERVED_SHIFTFIRST_AVAILABLE_PAGE_TAG_MASKmin)r   dbr   rB   rB   rC   r     s   "*zESENT_PAGE.__init__c                 C   s   t | j| jS r   )ranger   r   r   rB   rB   rC   iterDataTagNums     zESENT_PAGE.iterDataTagNumsc                 C   s   | j d }|t@ rtd |t@ rtd |t@ rtd ntd |t@ r*td |t@ r2td |t@ r:td |t@ rBtd	 |t	@ rJtd
 |t
@ rTtd d S d S )Nr   z	Emptyz	Indexz	Leafz	Branchz	Long Valuez	New Checksumz	New Formatz	Parentz	Rootz	Space Tree)r   FLAGS_EMPTYprintFLAGS_INDEX
FLAGS_LEAFFLAGS_LONG_VALUEFLAGS_NEW_CHECKSUMFLAGS_NEW_FORMATFLAGS_PARENT
FLAGS_ROOTFLAGS_SPACE_TREE)r   r   rB   rB   rC   
printFlags  s*   

zESENT_PAGE.printFlagsc                 C   s  t | j}| j  | jd| j d  }td |   t  t| jD ]}|dd  }| jd dkrz| jd dkrz| jd dkrzt	d	|d d
 d d@ }t	d	|d
d  d d@ }t
| j|| d  d d  t| j|| d  d d? }n)t	d	|d d
 d d@ }t	d	|d
d  d d@ d? }t	d	|d
d  d d@ }td||||f  |d d }q$| jd t@ dkrt| dd }|  n:| jd t@ dkr| d\}	}
t|
}|  n!| d\}	}
| jd t@ dkrt|
}|  nt|
}|  |  D ]|}| |\}	}
| jd t@ dkr't|	|
}|  q	| jd t@ dkr| jd t@ dkrAt|
}q	| jd t@ dkrQt|
}q	| jd t@ dkr_tdt|	|
}t|d }|  t|d t |d  }|  t
|d  q	d S )NzFLAGS: rI   r   ra   r   rb   r   r-   r   r     r   r   r        r   z2TAG %-8d offset:0x%-6x flags:0x%-4x valueSize:0x%xr   zLong value still not supportedr   )lenr   dumpr   r   r   r   r   r   r   r   ordr   r   getTagr   r   r   r   r   r   r   r   r   r   r   r   r   r   r   )r   
baseOffsettagsitag	valueSizevalueOffset	pageFlags
rootHeaderr   r   branchHeaderspaceTreeHeader
leafHeadertagNumbranchEntryspaceTreeEntry
indexEntry	leafEntrydataDefinitionHeadercatalogEntryrB   rB   rC   r    sf   

* 




zESENT_PAGE.dumpc                 C   s  | j |krtd| | jd| j  d  }t| j}t|D ]}|d d }q|dd  }| jd dkr| jd dkr| jd dkrtd	|d d
 d d@ }td	|d
d  d d@ }t| j|| d  d | }|d d? }	|dd
 d d@ |d< t	|}|}
|	|
fS td	|d d
 d d@ }td	|d
d  d d@ d? }	td	|d
d  d d@ }| j|| d  d | }
|	|
fS )Nz"Trying to grab an unknown tag 0x%xr   rI   r   ra   r    rb   r   r-   r   r   r   r   r      r  r  r   )
r   r   r   r  r   r   r   r   	bytearraybytes)r   r  r  r  r	  r
  r  r  tmpDatar  tagDatarB   rB   rC   r  .  s*   

*zESENT_PAGE.getTagr   )r>   r?   r@   r   r   r   r  r  rB   rB   rB   rC   r     s    
Mr   c                   @   s   e Zd Zd"ddZdd Zdd Zd	d
 Zdd Zdd Zdd Z	dd Z
dd Zdd Zdd Zdd Zdd Zd#ddZd#d d!ZdS )$ESENT_DBr   Fc                 C   s>   || _ || _d | _d | _d | _t | _d | _|| _| 	  d S r   )
_ESENT_DB__fileName_ESENT_DB__pageSize_ESENT_DB__DB_ESENT_DB__DBHeader_ESENT_DB__totalPagesr   _ESENT_DB__tables_ESENT_DB__currentTable_ESENT_DB__isRemotemountDB)r   fileNamer   isRemoterB   rB   rC   r   K  s   zESENT_DB.__init__c                 C   s   t d | jdu r| j| _| j  nt| jd| _| d}t|| _| jd | _	| j
dd | j | j	 d | _t d| jd	 | jd
 f  t d| j	  t d| j  | t d S )NzMounting DB...Trbrb   r   r   z$Database Version:0x%x, Revision:0x%xrI   ra   zPage Size: %dzTotal Pages in file: %d)r   debugr&  r  r!  opengetPagerE   r"  r   seektellr#  parseCatalogCATALOG_PAGE_NUMBER)r   
mainHeaderrB   rB   rC   r'  V  s   



zESENT_DB.mountDBc              
   C   s,  d}t d| jd | jd f  t d| j  t d| j  t   t d| j  t| j D ]d}t d|d	  t d
|  t| j| d  D ]"}| j| d | d }t d|d |d |dt	|d  f  qKt d|  t| j| d  D ]}t d|d |df  qt d q/d S )Nz    zDatabase version: 0x%x, 0x%xrI   ra   zPage size: %d zNumber of pages: %dzCatalog for %sz[%s]utf8z
%sColumns ColumnsRecordz%s%-5d%-30s%sr   r   zutf-8r   z	%sIndexesIndexesz%s%s )
r   r"  r   r#  r  listr$  keysdecodeColumnTypeToName)r   indenttablecolumnr   indexrB   rB   rC   printCatalogg  s"   ,
zESENT_DB.printCatalogc                 C   s0  t |d }t|d t|d  }| |}|d tkrGt | j|< || j| d< t | j| d< t | j| d< t | j| d< || _d S |d tkrq|| j| j d |< || j| j d | d< || j| j d | d< d S |d t	kr|| j| j d |< d S |d t
kr| | d S td	|d  )
Nr   r   
TableEntryr5  r7  
LongValuesHeaderr6  zUnknown type 0x%x)r   r   r  _ESENT_DB__parseItemNamer   r   r$  r%  r   r   r   _ESENT_DB__addLongValuer   )r   entryr  r  itemNamerB   rB   rC   	__addItemz  s&   

zESENT_DB.__addItemc                 C   s   t |d }|d dkr|d d }n|d }td|d |d d  d d d }|d |d d  d| d  d | }|S )Nr   r      r-   r   r   r   )r   r   )r   rG  r  
numEntriesitemLenrH  rB   rB   rC   __parseItemName  s   &(zESENT_DB.__parseItemNamec                 C   sn   t |d }td|d |d d  d d d }|d |d d  dd  d | }|| j| j d |< d S )Nr   r-   r   r   r   r   rC  )r   r   r$  r%  )r   rG  r  lvLenlvNamerB   rB   rC   __addLongValue  s   &$zESENT_DB.__addLongValuec                 C   s   |  D ]:}||\}}|jd t@ dkr>|jd t@ dkr q|jd t@ dkr*q|jd t@ dkr4qt||}| | qd S )Nr   r   )	r   r  r   r   r   r   r   r   _ESENT_DB__addItem)r   pager  r   r   r  rB   rB   rC   	parsePage  s   

zESENT_DB.parsePagec                 C   s^   |  |}| | | D ]}||\}}|jd t@ dkr,t||}| |d  qd S )Nr   r   r   )r.  rS  r   r  r   r   r   r1  )r   pageNumrR  r	  r   r   r  rB   rB   rC   r1    s   


zESENT_DB.parseCatalogc                 C   s   t d| j  d S )NzReading Boot Sector for %s)r   r,  _ESENT_DB__volumeNamer   rB   rB   rC   
readHeader  s   zESENT_DB.readHeaderc                 C   s   t d||d | j f  | j|d | j d | j| j}t|| jk r>| jt| }|| j|7 }t|| jk s(|dkrD|S t| j|S )NzTrying to fetch page %d (0x%x)r   r   )	r   r,  r   r!  r/  readr  r   r"  )r   rT  r   	remainingrB   rB   rC   r.    s   zESENT_DB.getPagec                 C   s   | j   d S r   )r!  closer   rB   rB   rC   rY    r   zESENT_DB.closec                 C   s  t |tdurt|}|| jv r| j| d }t|d }t|d t|d  }|d }d}|du rh| |}|j|j	kr@d}|
 D ]}||\}	}
|jd t@ dkrat|	|
}|d } nd} |du s3t}| j| |d	< |d |d< ||d
< |j	d |d< |S d S )NTrB  r   r2   Fr   r   r   r1   r3   r   r4   )
isinstancer  r
   r$  r   r   r  r.  r   r   r   r  r   r   r   TABLE_CURSOR)r   	tableNamerG  r  r  rT  donerR  r	  r   r   r  cursorrB   rB   rC   	openTable  s8   


zESENT_DB.openTablec                 C   s   |d }|d |j krd S ||d \}}|jd t@ dkrM|jd t@ dkr,td|jd t@ dkr9td|jd t@ dkrFtdt||}|S d S )Nr3   r4   r   r   zFLAGS_SPACE_TREE > 0zFLAGS_INDEX > 0zFLAGS_LONG_VALUE > 0)	r   r  r   r   r   r   r   r   r   )r   r^  rR  r   r   r  rB   rB   rC   __getNextTag  s   
zESENT_DB.__getNextTagNc                 C   s   |d  d7  < |  |}|d u r8|d }|jd dkrd S | |jd |d< |d jd |d< | j||dS | j||d |dS )Nr4   r   r3   r   r   )filter_tablesr   )_ESENT_DB__getNextTagr   r.  r   
getNextRow_ESENT_DB__tagToRecord)r   r^  ra  r
  rR  rB   rB   rC   rc    s   
zESENT_DB.getNextRowc           %      C   sH  t  }t  }d}t|}|d d d }d}	t|}
t|}|d }|d d }t| D ]r}|d ur:||vr:q.|| d	 }|d
 |d kr^||d  d |d  ||< ||d 7 }nd|d
   k rl|d krn nB|d
 d d }td|||d  d  d d d }|d@ r|	}d ||< n||| d  d ||	  }|||< |||	 7 }|}	nU|d
 dkr|du r|| |
k r|| }| j}td||d d  d d d d@ | | }	 td||d  d d d }|d7 }td||d  d d d d@ }| jd dkr!| jd dkr!| jd dkr!d}ntd||d  d d d d@ }|d7 }||k r=|}||
|f||< ||krJnqt| d }tdt|D ](}|| \}}}t|	 | d \}}}||| |f||< t| | }qZd}|d
 |v r|| ||d
  d  }||d
  d } ||d
  d dkrt
|||d  }!|d7 }| d8 } nd}!|!t@ rtd||!f  d ||< n2|!t@ rtd|  t||d  d |  f||< n||d  d |  ||< n	d ||< nd ||< t|| tu r|| d ||< q.|d tks%|d tkrw|| d urv|d tvr;td|d  t|d  }"z|| |"||< W q. tyu   tjddd  td!||d || f  || |"d"||< Y q.w q.t|d  }#|| d ur|#d u rt|| ||< q.|#d }$t|$|| d ||< q.|S )#NFr   rJ  r   r   r   r1   r5  r6  r   r   r   r   r-   i      i?  TrI   r   ra   r    rb   r   i @  z%Unsupported tag column: %s, flag:0x%xz7Multivalue detected in column %s, returning raw resultsr   r   zUnknown codepage 0x%xz
Exception:)exc_infozFixing Record[%r][%d]: %rreplace)r   r   r  r9  r:  r   r   r"  r   itemsr  TAGGED_DATA_TYPE_COMPRESSEDr   r   TAGGED_DATA_TYPE_MULTI_VALUEr,  r	   typetupleJET_coltypTextJET_coltypLongTextStringCodePagesr   r;  ColumnTypeSize)%r   r^  r
  ra  r   taggedItemstaggedItemsParsedr  variableDataBytesProcessedprevItemLentagLenfixedSizeOffsetvariableSizeOffsetcolumnsr?  columnRecordr@  rL  	itemValueendOfVSfirstOffsetTagtaggedIdentifiertaggedOffsetflagsPresentprevKeyr	  offset0lengthr   offset_
offsetItemitemSizeitemFlagstringDecoder
unpackData	unpackStrrB   rB   rC   __tagToRecord%  s    &
."0"





 

zESENT_DB.__tagToRecord)r   Fr   )r>   r?   r@   r   r'  rA  rQ  rE  rF  rS  r1  rV  r.  rY  r_  rb  rc  rd  rB   rB   rB   rC   r  J  s     
'
r  )_
__future__r   r   impacketr   collectionsr   impacket.structurer   r   structr   binasciir	   sixr
   FILE_TYPE_DATABASEFILE_TYPE_STREAMING_FILEJET_dbstateJustCreatedJET_dbstateDirtyShutdownJET_dbstateCleanShutdownJET_dbstateBeingConvertedJET_dbstateForceDetachr   r   r   r   r   r   r   r   r   r   r   TAG_UNKNOWNTAG_DEFUNCTr   DATABASE_PAGE_NUMBERr2  CATALOG_BACKUP_PAGE_NUMBERDATABASE_FDPCATALOG_FDPCATALOG_BACKUP_FDPr   r   r   r   r   JET_coltypNilJET_coltypBitJET_coltypUnsignedByteJET_coltypShortJET_coltypLongJET_coltypCurrencyJET_coltypIEEESingleJET_coltypIEEEDoubleJET_coltypDateTimeJET_coltypBinaryrm  JET_coltypLongBinaryrn  JET_coltypSLVJET_coltypUnsignedLongJET_coltypLongLongJET_coltypGUIDJET_coltypUnsignedShortJET_coltypMaxr<  rp  TAGGED_DATA_TYPE_VARIABLE_SIZEri  TAGGED_DATA_TYPE_STOREDrj  TAGGED_DATA_TYPE_WHO_KNOWSCODEPAGE_UNICODECODEPAGE_ASCIICODEPAGE_WESTERNro  r[  r6   rE   r   r   r   r   r   r   r   r   r   r   r   r   r   r  rB   rB   rB   rC   <module>   sR  	
	
	<-D 