o
    Žõ±jŠ5  ã                   @   s(  d Z ddlT dZeeƒ  ¡ ƒZdZdZdZdZ	G dd„ de
ƒZeeƒZd	d
„ Zdd„ Zdd„ Zefdd„Zdd„ Zdd„ ZeeeƒZdd„ Zdd„ ZeeeƒZdd„ Zdd„ ZeeeƒZd)dd„Zd)dd „ZeeeƒZd)d!d"„Zd#d$„ Z d%d&„ Z!ee e!ƒZ"eeƒ  ¡ ƒ #e¡Zd'd(„ eD ƒZ$e$ %¡  dS )*z"
Wrapper for psapi.dll in ctypes.
é   )Ú*Né    é   é   c                   @   s"   e Zd ZdefdefdefgZdS )Ú
MODULEINFOÚlpBaseOfDllÚSizeOfImageÚ
EntryPointN)Ú__name__Ú
__module__Ú__qualname__ÚLPVOIDÚDWORDÚ_fields_© r   r   ú¤/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/winapi/local/function_defs/psapi.pyr   7   s
    ýr   c                     sŠ   t jj} tttg| _t| _t	| _
d}t|ƒ}ttƒ}	 t||  ƒ ‰ | tˆ ƒ|t|ƒƒ |j}||kr4n|}q‡ fdd„td|| ƒD ƒS )Né   r   c                    ó   g | ]}ˆ | ‘qS r   r   ©Ú.0Úindex©ÚlpImageBaser   r   Ú
<listcomp>V   ó    z%EnumDeviceDrivers.<locals>.<listcomp>r   )ÚwindllÚpsapiÚEnumDeviceDriversr   r   ÚLPDWORDÚargtypesÚboolÚrestypeÚRaiseIfZeroÚerrcheckÚsizeofÚbyrefÚvalueÚrange)Ú_EnumDeviceDriversÚsizeÚ
lpcbNeededÚunitÚneededr   r   r   r   F   s    úr   c                  C   s¤   t jj} tttg| _t| _t	| _
d}tƒ }ttƒ}	 t||  ƒ }||_| t|ƒ|t|ƒƒ |j}||k r6n|d }qi }|D ]}|d u rG nd||< q?t| ¡ ƒS )Nr   r   )r   r   ÚEnumProcessesr   r   r   r   r    r!   r"   r#   r$   r&   r%   ÚlistÚkeys)Ú_EnumProcessesr)   ÚcbBytesReturnedr+   Ú
ProcessIdsÚreturnedÚProcessIdListÚ	ProcessIdr   r   r   r-   ]   s,   ù
r-   c                    s’   t jj}ttttg|_t|_	t
|_d}t|ƒ}ttƒ}	 t||  ƒ ‰ || tˆ ƒ|t|ƒƒ |j}||kr6n|}q‡ fdd„tdt|| ƒƒD ƒS )Nr   r   c                    r   r   r   r   ©Ú	lphModuler   r   r   ‹   r   z&EnumProcessModules.<locals>.<listcomp>r   )r   r   ÚEnumProcessModulesÚHANDLEr   r   r   r   r    r!   r"   r#   r$   ÚHMODULEr%   r&   r'   Úint)ÚhProcessÚ_EnumProcessModulesr)   r*   r+   r,   r   r6   r   r8   {   s    ú r8   c                    s’   t jj}tttttg|_t|_	t
|_d}t|ƒ}ttƒ}	 t||  ƒ ‰ || tˆ ƒ|t|ƒ|ƒ |j}||kr8n|}q‡ fdd„td|| ƒD ƒS )Nr   r   c                    r   r   r   r   r6   r   r   r   ¤   r   z(EnumProcessModulesEx.<locals>.<listcomp>r   )r   r   ÚEnumProcessModulesExr9   r   r   r   r   r    r!   r"   r#   r$   r:   r%   r&   r'   )r<   ÚdwFilterFlagÚ_EnumProcessModulesExr)   r*   r+   r,   r   r6   r   r>   ”   s    úr>   c                 C   óf   t jj}tttg|_t|_t}	 t	 
d|¡}|| ||ƒ}|dkr$t	 ¡ ‚||d k r.	 |jS |t }q©Nr   Ú r   )r   r   ÚGetDeviceDriverBaseNameAr   ÚLPSTRr   r   r!   ÚMAX_PATHÚctypesÚcreate_string_bufferÚWinErrorr&   )Ú	ImageBaseÚ_GetDeviceDriverBaseNameAÚnSizeÚ
lpBaseNameÚnCopiedr   r   r   rD   «   ó   ÿùrD   c                 C   rA   rB   )r   r   ÚGetDeviceDriverBaseNameWr   ÚLPWSTRr   r   r!   rF   rG   Úcreate_unicode_bufferrI   r&   )rJ   Ú_GetDeviceDriverBaseNameWrL   rM   rN   r   r   r   rP   »   rO   rP   c                 C   ól   t jj}tttg|_t|_t}	 t	 
d|¡}t	j j | ||¡}|dkr't	 ¡ ‚||d k r1	 |jS |t }qrB   )r   r   ÚGetDeviceDriverFileNameAr   rE   r   r   r!   rF   rG   rH   rI   r&   )rJ   Ú_GetDeviceDriverFileNameArL   Ú
lpFilenamerN   r   r   r   rU   Ò   ó   ÿùrU   c                 C   rT   rB   )r   r   ÚGetDeviceDriverFileNameWr   rQ   r   r   r!   rF   rG   rR   rI   r&   )rJ   Ú_GetDeviceDriverFileNameWrL   rW   rN   r   r   r   rY   â   rX   rY   c                 C   ól   t jjj}ttttg|_t|_	t
}	 t  d|¡}|| |||ƒ}|dkr't  ¡ ‚||d k r1	 |jS |t
 }qrB   )rG   r   r   ÚGetMappedFileNameAr9   r   rE   r   r   r!   rF   rH   rI   r&   )r<   ÚlpvÚ_GetMappedFileNameArL   rW   rN   r   r   r   r\   ú   ó   
ÿùr\   c                 C   r[   rB   )rG   r   r   ÚGetMappedFileNameWr9   r   rQ   r   r   r!   rF   rR   rI   r&   )r<   r]   Ú_GetMappedFileNameWrL   rW   rN   r   r   r   r`   
  r_   r`   c                 C   r[   rB   )rG   r   r   ÚGetModuleFileNameExAr9   r:   rE   r   r   r!   rF   rH   rI   r&   )r<   ÚhModuleÚ_GetModuleFileNameExArL   rW   rN   r   r   r   rb   "  r_   rb   c                 C   r[   rB   )rG   r   r   ÚGetModuleFileNameExWr9   r:   rQ   r   r   r!   rF   rR   rI   r&   )r<   rc   Ú_GetModuleFileNameExWrL   rW   rN   r   r   r   re   2  r_   re   c                 C   sJ   t jj}ttttg|_t|_	t
|_|d u rtƒ }|| |t|ƒt|ƒƒ |S ©N)r   r   ÚGetModuleInformationr9   r:   ÚLPMODULEINFOr   r   r    r!   r"   r#   r   r%   r$   )r<   rc   Ú	lpmodinfoÚ_GetModuleInformationr   r   r   rh   J  s   rh   c                 C   rA   rB   )r   r   ÚGetProcessImageFileNameAr9   rE   r   r   r!   rF   rG   rH   rI   r&   )r<   Ú_GetProcessImageFileNameArL   rW   rN   r   r   r   rl   Z  rO   rl   c                 C   rA   rB   )r   r   ÚGetProcessImageFileNameWr9   rQ   r   r   r!   rF   rG   rR   rI   r&   )r<   Ú_GetProcessImageFileNameWrL   rW   rN   r   r   r   rn   j  rO   rn   c                 C   s   g | ]	}|  d ¡s|‘qS )Ú_)Ú
startswith)r   Ú_xr   r   r   r     s    r   rg   )&Ú__doc__ÚdefinesÚ_allÚsetÚvarsr/   ÚLIST_MODULES_DEFAULTÚLIST_MODULES_32BITÚLIST_MODULES_64BITÚLIST_MODULES_ALLÚ	Structurer   ÚPOINTERri   r   r-   r8   r>   rD   rP   ÚGuessStringTypeÚGetDeviceDriverBaseNamerU   rY   ÚGetDeviceDriverFileNamer\   r`   ÚGetMappedFileNamerb   re   ÚGetModuleFileNameExrh   rl   rn   ÚGetProcessImageFileNameÚ
differenceÚ__all__Úsortr   r   r   r   Ú<module>   sB   	







