o
    j%                     @   s   d dl Z d dlZd dlT d dlmZ d dlZG dd dZG dd dZG dd	 d	ZG d
d dZ	e
dkr\dZeedZe	e ZW d   n1 sOw   Y  eee dS dS )    N)*)sha1c                   @   8   e Zd ZdZdd Zedd Zedd Zdd	 Zd
S )CredHist
	c                 C   s   d | _ d | _d S N)versionguidself r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/dpapi/structures/masterkeyfile.py__init__   s   
zCredHist.__init__c                 C      t t| S r   )r   from_bufferioBytesIOdatar   r   r   
from_bytes      zCredHist.from_bytesc                 C   s.   t  }tj| dddd|_| d|_|S N   littleFsigned   )r   intr   readr   r	   buffskr   r   r   r      s   zCredHist.from_bufferc                 C   n   d}| j D ]/}t| j | tr't| j | D ]\}}|d||t|f 7 }qq|d|t| j | f 7 }q|S )Nz== CredHist ==
   %s: %s: %s	%s: %s 
__dict__
isinstancelist	enumeratestrr   tkiitemr   r   r   __str__!      
zCredHist.__str__N	__name__
__module____qualname____doc__r   staticmethodr   r   r0   r   r   r   r   r      s    

r   c                   @   r   )	DomainKeyr   c                 C   (   d | _ d | _d | _d | _d | _d | _d S r   )r   secret_lengthaccess_check_lengthr	   secretaccess_checkr
   r   r   r   r   .      
zDomainKey.__init__c                 C   r   r   )r8   r   r   r   r   r   r   r   r   6   r   zDomainKey.from_bytesc                 C   sz   t  }tj| dddd|_tj| dddd|_tj| dddd|_| d|_| |j|_| |j|_	|S r   )
r8   r   r   r   r   r:   r;   r	   r<   r=   r   r   r   r   r   :   s   zDomainKey.from_bufferc                 C   r"   )Nz== DomainKey ==
r#   r$   r%   r+   r   r   r   r0   E   r1   zDomainKey.__str__Nr2   r   r   r   r   r8   +   s    


r8   c                   @   s@   e Zd ZdZdd Zedd Zedd Zdd	 Zd
d Z	dS )	MasterKeyz?
	Represents a key, which can be for a masterkey or backupkey
	c                 C   r9   r   )r   saltiteration_counthash_algorithmcrypto_algorithmr   r
   r   r   r   r   S   r>   zMasterKey.__init__c                 C   r   r   )r?   r   r   r   r   r   r   r   r   [   r   zMasterKey.from_bytesc                 C   s   t  }tj| dddd|_| d|_tj| dddd|_ttj| dddd|_ttj| dddd|_	|  |_
|S r   )r?   r   r   r   r   r@   rA   
ALGORITHMSrB   rC   r   r   r   r   r   r   _   s   
zMasterKey.from_bufferc                 C   s  | j tjkr	t}nt| j  d }t| j d t| j d  }d}d}t||k rr| j|jdddd }|d7 }t	
||| }t| jd D ] }t	
||| }	t|tjt|	tjA t|	tj}qG||7 }t||k s(|d | }
|
d t| j d  }|
t| j d d  d t| j d  }t| j d |t| j d	 |d
}|| j}|dd  }|d d }|dd  d t| j  d  }t	
||| }t	
||| }|d t| j  d  |kr|S d S )N   r          r   bigFr      )modeIVir   )rB   rD   	CALG_HMACr   ALGORITHMS_DATArC   lenr@   to_byteshmacnewdigestrangerA   r   r   sys	byteorderdecryptr   )r   key	hash_typekeylentemp_key_blobr.   Uderived_actualtemp_key	crypt_keyivcipher	cleartextkey_dec	hmac_salthmac_reshmac_key	hmac_calcr   r   r   rV   j   s8   ,	("zMasterKey.decryptc                 C   r"   )Nz== MasterKey ==
r#   r$   r%   r+   r   r   r   r0      r1   zMasterKey.__str__N)
r3   r4   r5   r6   r   r7   r   r   rV   r0   r   r   r   r   r?   O   s    


'r?   c                   @   r   )MasterKeyFilez
	A masterkeyfile is a file that can hold multiple different keys, namely the masterkey, backupkey, credential history key, domainkey. 
	Not necessarily all of them present in a file
	c                 C   s^   d | _ d | _d | _d | _d | _d | _d | _d | _d | _d | _	d | _
d | _d | _d | _d | _d S r   )r   unk1unk2r	   unk3policyflagsmasterkey_lengthbackupkey_lengthcredhist_lengthdomainkey_length	masterkey	backupkeycredhist	domainkeyr
   r   r   r   r      s   
zMasterKeyFile.__init__c                 C   r   r   )ri   r   r   r   r   r   r   r   r      r   zMasterKeyFile.from_bytesc                 C   s  t  }tj| dddd|_tj| dddd|_tj| dddd|_| dd|_tj| dddd|_	tj| dddd|_
tj| dddd|_tj| dddd|_tj| dddd|_tj| dddd|_tj| dddd|_|jdkrt| |j|_|jdkrt| |j|_|jdkrt| |j|_|jdkrt| |j|_|S )	Nr   r   Fr   H   z	utf-16-le   r   )ri   r   r   r   r   rj   rk   decoder	   rl   rm   rn   ro   rp   rq   rr   r?   rs   rt   r   ru   r8   rv   r   r   r   r   r      s*   



zMasterKeyFile.from_bufferc                 C   r"   )Nz== MasterKeyFile ==
r#   r$   r%   r+   r   r   r   r0      r1   zMasterKeyFile.__str__Nr2   r   r   r   r   ri      s    

ri   __main__zC:\Users\victim\AppData\Roaming\Microsoft\Protect\S-1-5-21-3448413973-1765323015-1500960949-1105\4c9764dc-aa99-436c-bb30-ff39b3dd407crb)r   rT   pypykatz.dpapi.constantshashlibr   rP   r   r8   r?   ri   r3   filenameopenfr   r   mkfprintr*   r   r   r   r   <module>   s    $MB