o
    j                     @   s>   d dl Z d dlZd dlmZ G dd dZG dd deZdS )    N)PackageDecryptorc                   @   s4   e Zd Zdd Zdd Zdd Zdd Zd	d
 ZdS )CloudapCredentialc                 C   s4   d| _ d | _d | _d | _d | _d | _d | _d | _d S )Ncloudap)credtypeluidsidcachedirPRTkey_guid	dpapi_keydpapi_key_sha1self r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/alsadecryptor/packages/cloudap/decryptor.py__init__   s   
zCloudapCredential.__init__c                 C   sD   i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< |S )Nr   r   r	   r
   r   r   )r   r   r	   r
   r   r   r   tr   r   r   to_dict   s   





zCloudapCredential.to_dictc                 C   s   t | jtr| j S | jS N)
isinstancer   byteshexr   r   r   r   get_masterkey_hex   s   z#CloudapCredential.get_masterkey_hexc                 C   s   t |  S r   )jsondumpsr   r   r   r   r   to_json   s   zCloudapCredential.to_jsonc                 C   sV   d| j  }|d| j 7 }|d| j 7 }|d| j 7 }|d|   7 }|d| j 7 }|S )Nz	== Cloudap [%x]==
z		cachedir %s
z			PRT %s
z		key_guid %s
z		dpapi_key %s
z		dpapi_key_sha1 %s
)r   r   r	   r
   r   r   r   r   r   r   __str__    s   
zCloudapCredential.__str__N)__name__
__module____qualname__r   r   r   r   r   r   r   r   r   r      s    

r   c                       s4   e Zd Z fddZdd Zdd Zdd Z  ZS )	CloudapDecryptorc                    s"   t  d||| || _g | _d S )NCloudap)superr   decryptor_templatecredentials)r   readerr$   lsa_decryptorsysinfo	__class__r   r   r   *   s   
zCloudapDecryptor.__init__c                    sL   |  d| jjI d H }| j|| jj I d H }| j|I d H }||fS )NzcloudAP.dll)find_signaturer$   	signaturer&   get_ptr_with_offsetfirst_entry_offsetget_ptr)r   positionptr_entry_loc	ptr_entryr   r   r   find_first_entry/   s
   z!CloudapDecryptor.find_first_entryc           	   
      sp  zt  }|j|_|jd u s|jjdkrW d S |j| jI d H }|jd	dd|_
|jdkr]|jjdkr]|j| j|jI d H }| j|ddd\}}z| }W n   Y t||_|jdkr|j| jI d H }|d ur|j|_| j|jdd\|_}t|j |_|jd u r|jd u rW d S | j| W d S  ty } z| d	|  W Y d }~d S d }~ww )
Nr   z	utf-16-le  T   )bytes_expectedsegment_size)r7   z&CloudAP entry parsing error! Reason %s)r   LocallyUniqueIdentifierr   
cacheEntryvaluereadr&   tonamedecodereplacer   cbPRTr	   read_rawdecrypt_passwordstrtoDetermineguidr
   unkr   hashlibsha1	hexdigestr   r%   append	Exceptionlog)	r   cloudap_entrycredcacheptr_enctempraw_decrF   er   r   r   	add_entry5   s:   

zCloudapDecryptor.add_entryc              
      s   z|   I d H \}}W n ty& } z| d|  W Y d }~d S d }~ww | j|I d H  | jj| jI d H }| || j	I d H  d S )Nz%Failed to find list entry! Reason: %s)
r3   rK   rL   r&   mover$   
list_entryload	walk_listrT   )r   entry_ptr_valueentry_ptr_locrS   	entry_ptrr   r   r   startV   s   zCloudapDecryptor.start)r   r   r    r   r3   rT   r\   __classcell__r   r   r)   r   r!   )   s
    !r!   )r   rG   &pypykatz.alsadecryptor.package_commonsr   r   r!   r   r   r   r   <module>   s
    $