o
    j0                     @   s<  d dl mZ d dl mZ d dlmZmZmZmZmZ d dl	m
Z
mZmZmZmZmZmZmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ ed
ZG dd deZ d Z!dZ"dZ#dZ$dZ%dZ&eZ'dZ(dZ)dZ*dZ+dZ,dZ-dZ.G dd deZ/G dd deZ0G dd deZ1G dd deZ2G dd deZ3G dd  d eZ4G d!d" d"eZ5G d#d$ d$eZ6G d%d& d&eZ7G d'd( d(eZ8G d)d* d*eZ9G d+d, d,eZ:G d-d. d.eZ;G d/d0 d0eZ<G d1d2 d2eZ=G d3d4 d4eZ>G d5d6 d6eZ?G d7d8 d8eZ@G d9d: d:eZAG d;d< d<eZBG d=d> d>eZCG d?d@ d@eZDG dAdB dBeZEG dCdD dDeZFG dEdF dFeZGe4e5fe6e7fe8e9fe:e;fe<e=fe>e?fe@eAfeBeCfeDeEfeFeGfdG
ZHefdHdIZIeefdJdKZJdLdM ZKeefdNdOZLdPe,e-B d e*fdQdRZMdPefdSdTZNdPefdUdVZOdWdX ZPdYdZ ZQd[S )\    )division)print_function)NDRCALL	NDRSTRUCTNDRNDRPOINTERNULLNDRUniConformantArray)ULONGLPWSTRRPC_UNICODE_STRINGLPSTRNTSTATUSNULLPRPC_UNICODE_STRINGPULONGUSHORTPRPC_SIDLPBYTE)PRPC_UNICODE_STRING_ARRAY)	Structure)	nt_errors)uuidtup_to_bin)DCERPCException)z$82273FDC-E32A-18C3-3F78-827929DC23EAz0.0c                   @   s   e Zd ZdddZdd ZdS )DCERPCSessionErrorNc                 C   s   t | ||| d S )N)r   __init__)selferror_string
error_codepacket r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/dcerpc/v5/even.pyr   (   s   zDCERPCSessionError.__init__c                 C   sF   | j }|tjv rtj| d }tj| d }d| j ||f S d| j  S )Nr      z'EVEN SessionError: code: 0x%x - %s - %sz+EVEN SessionError: unknown error code: 0x%x)r   r   ERROR_MESSAGES)r   keyerror_msg_shorterror_msg_verboser   r   r    __str__+   s   

zDCERPCSessionError.__str__)NNN)__name__
__module____qualname__r   r&   r   r   r   r    r   '   s    
r   r!                  i i c                   @   s   e Zd ZdZdd ZdS )IELF_HANDLE))Dataz20s=""c                 C   s   dS )Nr!   r   )r   r   r   r    getAlignmentW   s   zIELF_HANDLE.getAlignmentN)r'   r(   r)   	structurer1   r   r   r   r    r/   S   s    r/   c                   @   s   e Zd ZdZdS )EVENTLOGRECORD))Length<L=0)Reservedr5   )RecordNumberr5   )TimeGeneratedr5   )TimeWrittenr5   )EventIDr5   )	EventType<H=0)
NumStringsr<   )EventCategoryr<   )ReservedFlagsr<   )ClosingRecordNumberr5   )StringOffsetr5   )UserSidLengthr5   )UserSidOffsetr5   )
DataLengthr5   )
DataOffsetr5   )
SourceNamez)ComputernamerG   )UserSidPadding:)_UserSidz	_-UserSidzself["UserSidLength"])UserSidrJ   )StringsrJ   )_Dataz_-Datazself["DataLength"])r0   rJ   )PaddingrJ   )Length2r5   N)r'   r(   r)   r2   r   r   r   r    r3   [   s    r3   c                   @      e Zd ZdeffZdS )EVENTLOG_FULL_INFORMATIONdwFullNr'   r(   r)   r	   r2   r   r   r   r    rR   z       rR   c                   @   s   e Zd ZdefdeffZdS )RPC_CLIENT_IDUniqueProcessUniqueThreadNrT   r   r   r   r    rV          rV   c                   @   s,   e Zd ZdddeffZdd Zd
dd	ZdS )
RPC_STRING)r4   r<   )MaximumLengthr<   r0   c                 C   s<   |dkrt |tdu rt|| d< t|| d< t| ||S )Nr0   Fr4   r[   )
isinstancer   lenr   __setitem__)r   r#   valuer   r   r    r^      s   zRPC_STRING.__setitem__Nr   c                 C   s|   |d u r| j j}|dkrtd| dd t| jd tr$tddd d S | jd d dkr5tddd d S | jd d|S )	N z%s )endr0   z NULL
ReferentIDr   )	__class__r'   printr\   fieldsr   dump)r   msgindentr   r   r    rg      s   zRPC_STRING.dump)Nr   )r'   r(   r)   r   r2   r^   rg   r   r   r   r    rZ      s    rZ   c                   @       e Zd ZdZdefdeffZdS )ElfrClearELFWr   	LogHandleBackupFileNameN)r'   r(   r)   opnumr/   r   r2   r   r   r   r    rk      
    rk   c                   @   rQ   )ElfrClearELFWResponse	ErrorCodeNr'   r(   r)   r   r2   r   r   r   r    rp      rU   rp   c                   @   rj   )ElfrBackupELFWr!   rl   rm   N)r'   r(   r)   rn   r/   r   r2   r   r   r   r    rs      ro   rs   c                   @   rQ   )ElfrBackupELFWResponserq   Nrr   r   r   r   r    rt      rU   rt   c                   @      e Zd ZdZdeffZdS )ElfrCloseELr*   rl   Nr'   r(   r)   rn   r/   r2   r   r   r   r    rv          rv   c                   @      e Zd ZdefdeffZdS )ElfrCloseELResponserl   rq   Nr'   r(   r)   r/   r   r2   r   r   r   r    rz      rY   rz   c                   @   ru   )ElfrNumberOfRecordsr+   rl   Nrw   r   r   r   r    r|      rx   r|   c                   @   ry   )ElfrNumberOfRecordsResponseNumberOfRecordsrq   Nr'   r(   r)   r	   r   r2   r   r   r   r    r}      rY   r}   c                   @   ru   )ElfrOldestRecord   rl   Nrw   r   r   r   r    r      rx   r   c                   @   ry   )ElfrOldestRecordResponseOldestRecordNumberrq   Nr   r   r   r   r    r      rY   r   c                   @   2   e Zd ZdZdefdefdefdefdeffZdS )ElfrOpenELW   UNCServerName
ModuleNameRegModuleNameMajorVersionMinorVersionNr'   r(   r)   rn   EVENTLOG_HANDLE_Wr   r	   r2   r   r   r   r    r          r   c                   @   ry   )ElfrOpenELWResponserl   rq   Nr{   r   r   r   r    r      rY   r   c                   @   r   )ElfrRegisterEventSourceWr,   r   r   r   r   r   Nr   r   r   r   r    r      r   r   c                   @   ry   ) ElfrRegisterEventSourceWResponserl   rq   Nr{   r   r   r   r    r      rY   r   c                   @   s,   e Zd ZdZdefdefdefdeffZdS )ElfrOpenBELW	   r   rm   r   r   Nr   r   r   r   r    r         r   c                   @   ry   )ElfrOpenBELWResponserl   rq   Nr{   r   r   r   r    r     rY   r   c                   @   s,   e Zd ZdZdefdefdefdeffZdS )ElfrReadELW
   rl   	ReadFlagsRecordOffsetNumberOfBytesToReadN)r'   r(   r)   rn   r/   r	   r2   r   r   r   r    r     r   r   c                   @   s(   e Zd ZdefdefdefdeffZdS )ElfrReadELWResponseBufferNumberOfBytesReadMinNumberOfBytesNeededrq   N)r'   r(   r)   r   r	   r   r2   r   r   r   r    r      s    r   c                   @   sh   e Zd ZdZdefdefdefdefdefdefdefd	efd
efde	fde
fdefdefdeffZdS )ElfrReportEventW   rl   Timer;   r>   r:   r=   DataSizeComputerNameUserSIDrM   r0   Flagsr7   r9   N)r'   r(   r)   rn   r/   r	   r   r   r   r   r   r   r2   r   r   r   r    r   )  s"    r   c                   @   s"   e Zd ZdefdefdeffZdS )ElfrReportEventWResponser7   r9   rq   N)r'   r(   r)   r   r   r2   r   r   r   r    r   <  s
    r   )
r   r!   r*   r+   r   r   r,   r   r   r   c                 C   s0   t  }t|d< ||d< d|d< d|d< | |S )Nr   rm   r!   r   r   )r   r   request)dcebackupFileNamer   r   r   r    hElfrOpenBELWV  s   
r   c                 C   8   t  }t|d< ||d< ||d< d|d< d|d< | |S Nr   r   r   r!   r   r   )r   r   r   r   
moduleNameregModuleNamer   r   r   r    hElfrOpenELW^     
r   c                 C      t  }||d< | |}|S Nrl   )rv   r   r   	logHandler   respr   r   r    hElfrCloseELg     
r   c                 C   r   r   )r   r   r   r   r   r   r    hElfrRegisterEventSourceWm  r   r   r`   c                 C   s0   t  }||d< ||d< ||d< ||d< | |S )Nrl   r   r   r   )r   r   )r   r   	readFlagsrecordOffsetnumberOfBytesToReadr   r   r   r    hElfrReadELWv  s   
r   c                 C       t  }||d< ||d< | |S Nrl   rm   )rk   r   r   r   r   r   r   r   r    hElfrClearELFW     
r   c                 C   r   r   )rs   r   r   r   r   r    hElfrBackupELFW  r   r   c                 C   r   r   )r|   r   r   r   r   r    hElfrNumberOfRecords  r   r   c                 C   r   r   )r   r   r   r   r   r    hElfrOldestRecordNumber  r   r   N)R
__future__r   r   impacket.dcerpc.v5.ndrr   r   r   r   r   impacket.dcerpc.v5.dtypesr	   r
   r   r   r   r   r   r   r   r   r   impacket.dcerpc.v5.lsadr   impacket.structurer   impacketr   impacket.uuidr   impacket.dcerpc.v5.rpcrtr   MSRPC_UUID_EVENr   EVENTLOG_SUCCESSEVENTLOG_ERROR_TYPEEVENTLOG_WARNING_TYPEEVENTLOG_INFORMATION_TYPEEVENTLOG_AUDIT_SUCCESSEVENTLOG_AUDIT_FAILUREr   MAX_STRINGSMAX_SINGLE_EVENTMAX_BATCH_BUFFEVENTLOG_SEQUENTIAL_READEVENTLOG_SEEK_READEVENTLOG_FORWARDS_READEVENTLOG_BACKWARDS_READr/   r3   rR   rV   rZ   rk   rp   rs   rt   rv   rz   r|   r}   r   r   r   r   r   r   r   r   r   r   r   r   OPNUMSr   r   r   r   r   r   r   r   r   r   r   r   r    <module>   s   4

					
	