o
    Žõ±jÞ8  ã                   @   sÖ   d dl Z d dlZd dlZd dlZd dlZd dlmZ defdd„ZG dd„ dej	ƒZ
G dd	„ d	ƒZG d
d„ dƒZG dd„ dej	ƒZG dd„ dej	ƒZddd„ZG dd„ dejƒZG dd„ dƒZddedefdd„ZdS )é    N)ÚPROCESSOR_ARCHITECTUREÚerrc                 C   s*   t | ƒd }t | j¡D ]}||7 }q|S )Nz
)ÚstrÚ	tracebackÚ	format_tbÚ__traceback__)r   ÚtÚline© r
   úŠ/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/common.pyÚgeterr	   s   
r   c                   @   s   e Zd Ze ¡ Ze ¡ ZdS )ÚKatzSystemArchitectureN)Ú__name__Ú
__module__Ú__qualname__ÚenumÚautoÚX86ÚX64r
   r
   r
   r   r      s    r   c                   @   óˆ   e Zd Zejfdd„Zdd„ Zd dd„Zdd	„ Zd!dd„Z	dd„ Z
dd„ Zd"dd„Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zd
S )#ÚGenericReaderc                 C   ó0   || _ d| _t|ƒ| _t|ƒ| _|| _d| _dS ©z
		data is bytes
		r   N©Úprocessor_architectureÚstart_addressÚlenÚend_addressÚsizeÚdataÚcurrent_position©Úselfr   r   r
   r
   r   Ú__init__   ó   


zGenericReader.__init__c                 C   ó   | j |  ko| jkS   S ©N©r   r   ©r"   Úptrr
   r
   r   Úinrange   ó   zGenericReader.inranger   c                 C   s`   |dkr
| j | }n|dkr| j| }n|dkr| j| }ntdƒ‚|  |¡s+tdƒ‚|| _dS ©aD  
		Changes the current address to an offset of offset. The whence parameter controls from which position should we count the offsets.
		0: beginning of the current memory segment
		1: from current position
		2: from the end of the current memory segment
		If you wish to move out from the segment, use the 'move' function
		r   é   é   z.Seek function whence value must be between 0-2zSeek would point out of bufferN©r   r    r   Ú	Exceptionr*   ©r"   ÚoffsetÚwhencer   r
   r
   r   Úseek"   s   
zGenericReader.seekc                 C   s   |   |¡ dS ©z@
		Moves the buffer to a virtual address specified by address
		N©r4   ©r"   Úaddressr
   r
   r   Úmove9   s   
zGenericReader.moveNc                 C   sP   |du r| j tjkrd}nd}| j| }|dkrdS || | }|  |d¡ dS ©zD
		Repositions the current reader to match architecture alignment
		Né   é   r   r-   ©r   r   r   r    r4   ©r"   Ú	alignmentr2   Úoffset_to_alignedr
   r
   r   Úalign@   s   
zGenericReader.alignc                 C   ó   | j S ©z)
		Returns the current virtual address
		©r    ©r"   r
   r
   r   ÚtellP   ó   zGenericReader.tellc                 C   s8   | j | }|  |¡stdƒ‚| j| j | j || j … S ©z@
		Returns up to length bytes from the current memory segment
		úWould read out of buffer!©r    r*   r0   r   r   ©r"   Úlengthr   r
   r
   r   ÚpeekV   s   

zGenericReader.peekéÿÿÿÿc                 C   sj   |dk rt dƒ‚|dkr| j}| j| _| j|d… S | j| }|  |¡s(t dƒ‚| j}|| _| j||… S ©z‰
		Returns data bytes of size size from the current segment. If size is -1 it returns all the remaining data bytes from memory segment
		rN   zYou shouldnt be doing thisNrI   ©r0   r    r   r   r*   ©r"   r   Ú
oldnew_posr   Úold_new_posr
   r
   r   Úread_   s   

zGenericReader.readc                 C   ó8   | j tjkrtj|  d¡ddd�S tj|  d¡ddd�S )ú¯
		Reads an integer. The size depends on the architecture. 
		Reads a 4 byte small-endian singed int on 32 bit arch
		Reads an 8 byte small-endian singed int on 64 bit arch
		r;   ÚlittleT©Ú	byteorderÚsignedr<   ©r   r   r   ÚintÚ
from_bytesrT   rE   r
   r
   r   Úread_intr   ó   zGenericReader.read_intc                 C   rU   )ú³
		Reads an integer. The size depends on the architecture. 
		Reads a 4 byte small-endian unsinged int on 32 bit arch
		Reads an 8 byte small-endian unsinged int on 64 bit arch
		r;   rW   FrX   r<   r[   rE   r
   r
   r   Ú	read_uint}   r_   zGenericReader.read_uintc                 C   s"   | j  |¡}|dkrdS || j S )ú:
		Searches for a pattern in the current memory segment
		rN   ©r   Úfindr    ©r"   ÚpatternÚposr
   r
   r   rd   ˆ   s   
zGenericReader.findc                 C   s<   g }d}	 | j  ||d ¡}|dkr	 |S | || j ¡ q)úp
		Searches for all occurrences of a pattern in the current memory segment, returns all occurrences as a list
		rN   Tr-   ©r   rd   Úappendr   ©r"   rf   rg   Ú
last_foundr
   r
   r   Úfind_all‘   s   þüzGenericReader.find_allc                 C   s   |   |¡ |  ¡ S r&   ©r9   ra   ©r"   rg   r
   r
   r   Úget_ptrŸ   s   
zGenericReader.get_ptrc                 C   sJ   | j tjkr|  |¡ tj|  d¡ddd�}|d | S |  |¡ |  ¡ S ©Nr<   rW   TrX   ©r   r   r   r9   r\   r]   rT   ra   ©r"   rg   r)   r
   r
   r   Úget_ptr_with_offset¥   s   

z!GenericReader.get_ptr_with_offset©r   r&   ©rN   ©r   r   r   r   r   r#   r*   r4   r9   rA   rF   rM   rT   r^   ra   rd   rm   rp   rt   r
   r
   r
   r   r      s    


		r   c                   @   r   )#ÚAGenericReaderc                 C   r   r   r   r!   r
   r
   r   r#   ´   r$   zAGenericReader.__init__c                 C   r%   r&   r'   r(   r
   r
   r   r*   ¿   r+   zAGenericReader.inranger   c                 Ã   sb   �|dkr| j | }n|dkr| j| }n|dkr| j| }ntdƒ‚|  |¡s,tdƒ‚|| _dS r,   r/   r1   r
   r
   r   r4   Â   s   €
zAGenericReader.seekc                 Ã   s   �|   |¡I dH  dS r5   r6   r7   r
   r
   r   r9   Ù   s   €zAGenericReader.moveNc                 Ã   sX   �|du r| j tjkrd}nd}| j| }|dkrdS || | }|  |d¡I dH  dS r:   r=   r>   r
   r
   r   rA   à   s   €
zAGenericReader.alignc                 C   rB   rC   rD   rE   r
   r
   r   rF   ð   rG   zAGenericReader.tellc                 Ã   s:   �| j | }|  |¡stdƒ‚| j| j | j || j … S rH   rJ   rK   r
   r
   r   rM   ö   s
   €

zAGenericReader.peekrN   c                 Ã   sl   �|dk r	t dƒ‚|dkr| j}| j| _| j|d… S | j| }|  |¡s)t dƒ‚| j}|| _| j||… S rO   rP   rQ   r
   r
   r   rT   ÿ   s   €

zAGenericReader.readc                 Ã   óN   �| j tjkr|  d¡I dH }tj|ddd�S |  d¡I dH }tj|ddd�S )rV   r;   NrW   TrX   r<   ©r   r   r   rT   r\   r]   ©r"   r   r
   r
   r   r^     ó   €zAGenericReader.read_intc                 Ã   ry   )r`   r;   NrW   FrX   r<   rz   r{   r
   r
   r   ra     r|   zAGenericReader.read_uintc                 Ã   s*   �| j  |¡I dH }|dkrdS || j S )rb   NrN   rc   re   r
   r
   r   rd   ,  s
   €
zAGenericReader.findc                 Ã   sD   �g }d}	 | j  ||d ¡I dH }|dkr	 |S | || j ¡ q)rh   rN   Tr-   Nri   rk   r
   r
   r   rm   5  s   €þüzAGenericReader.find_allc                 Ã   s    �|   |¡I d H  |  ¡ I d H S r&   rn   ro   r
   r
   r   rp   C  s   €zAGenericReader.get_ptrc                 Ã   s^   �| j tjkr |  |¡I d H  tj|  d¡ddd�}|d | S |  |¡I d H  |  ¡ I d H S rq   rr   rs   r
   r
   r   rt   I  s   €z"AGenericReader.get_ptr_with_offsetru   r&   rv   rw   r
   r
   r
   r   rx   ³   s    


		rx   c                   @   sd   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdS )ÚWindowsBuildi(
  iÎ  ip  i°  ið#  i€%  i (  iZ)  i98  i×:  i«?  iîB  icE  iºG  i»G  iaJ  ibJ  i|O  i]X  igX  iôe  iXf  N)r   r   r   ÚWIN_XPÚWIN_2K3Ú	WIN_VISTAÚWIN_7ÚWIN_8ÚWIN_BLUEÚWIN_10_1507ÚWIN_10_1511ÚWIN_10_1607ÚWIN_10_1703ÚWIN_10_1709ÚWIN_10_1803ÚWIN_10_1809ÚWIN_10_1903ÚWIN_10_1909ÚWIN_10_2004ÚWIN_10_20H2ÚWIN_11_2022ÚWIN_11_2023ÚWIN_11_23H2ÚWIN_11_24H2ÚWIN_11_25H2r
   r
   r
   r   r}   Y  s.    r}   c                   @   s,   e Zd ZdZdZdZdZdZdZdZ	dZ
d	S )
ÚWindowsMinBuildiÄ	  i¸  iˆ  iX  i@  i¸$  iH&  iðU  N)r   r   r   r~   r   r€   r�   r‚   rƒ   ÚWIN_10ÚWIN_11r
   r
   r
   r   r”   q  s    r”   é   Ú.c                 C   s˜  g }| du rdS z|ddƒ W n t y   t}Y nw |dt| ƒ|ƒD ]£}| ||| … }d}d}	|dt|ƒƒD ]1}
|
|d krD|d7 }||
 }
t|
tƒsQt|
ƒ}
t|
ƒ dd¡}
t|
ƒdkrcd	|
 }
||
d 7 }q8| d¡}d}|D ]"}t|tƒs~t|ƒ}d
|  krˆdk r‘n n|t	|ƒ7 }qs||7 }qs|dkr¯| 
dt|d d ƒ d |||f ¡ q#| 
dt|d d ƒ d || |||f ¡ q#d |¡S )zê
	@brief Return {src} in hex dump.
	@param[in] length	{Int} Nb Bytes by row.
	@param[in] sep		{Char} For the text part, {sep} will be used for non ASCII char.
	@return {Str} The hexdump

	@note Full support for python2 and python3 !
	NÚ r   r-   Fr.   ú Ú0xÚ0é    é   z	%08x:  %-é   zs  |%s|z%08x(+%04x):  %-Ú
)Ú	NameErrorÚranger   Ú
isinstancer\   ÚordÚhexÚreplaceÚstripÚchrrj   r   Újoin)ÚsrcrL   ÚsepÚstartÚresultÚxrangeÚiÚsubSrcÚhexaÚisMiddleÚhÚtextÚcr
   r
   r   Úhexdump|  sD   	ÿ



*0
r¶   c                   @   s   e Zd ZdZdd„ ZdS )ÚUniversalEncoderz”
	Used to override the default json encoder to provide a direct serialization for formats
	that the default json encoder is incapable to serialize
	c                 C   sr   t |tjƒr
| ¡ S t |tjƒr|jS t |tƒr| ¡ S t|dd ƒr2t|dd ƒ}t	|ƒr0| 
¡ S d S tj | |¡S )NÚto_dict)r£   ÚdatetimeÚ	isoformatr   ÚEnumÚvalueÚbytesr¥   ÚgetattrÚcallabler¸   ÚjsonÚJSONEncoderÚdefault)r"   Úobjr¸   r
   r
   r   rÂ   ±  s   
ÿzUniversalEncoder.defaultN)r   r   r   Ú__doc__rÂ   r
   r
   r
   r   r·   ¬  s    r·   c                   @   s@   e Zd Zdd„ Zdd„ Zedd„ ƒZedd„ ƒZed	d
„ ƒZdS )ÚKatzSystemInfoc                 C   s"   d | _ d | _d | _d | _d| _d S )Né   )ÚarchitectureÚbuildnumberÚmsv_dll_timestampÚoperating_systemÚmajor_versionrE   r
   r
   r   r#   È  s
   
zKatzSystemInfo.__init__c                 C   s   d| j j| j| j| jf S )Nz(ARCH:%s BUILD:%s MSV_TS:%s OS(guess): %s)rÇ   ÚnamerÈ   rÉ   rÊ   rE   r
   r
   r   Ú__str__Ï  s   zKatzSystemInfo.__str__c                 C   sD   t ƒ }| jtjkrtj|_n
| jtjkrtj|_| j	|_
| j|_|S r&   )rÅ   r   r   ÚAMD64r   r   rÇ   ÚINTELr   ÚBuildNumberrÈ   rÉ   )ÚlrÚsysinfor
   r
   r   Úfrom_live_readerÒ  s   
zKatzSystemInfo.from_live_readerc                 C   sx   t ƒ }| jjtjkrtj|_n| jjtjkrtj	|_| jj
|_| jj|_d|_| jjD ]}|j d¡dkr9|j|_q+|S )Nr   z
lsasrv.dllrN   )rÅ   rÒ   ÚProcessorArchitecturer   rÎ   r   r   rÇ   rÏ   r   ÚOperatingSystemrÊ   rÐ   rÈ   rÉ   ÚmodulesrÌ   rd   Ú	timestamp)ÚminidumprÒ   Úmoduler
   r
   r   Úfrom_minidumpß  s   


€zKatzSystemInfo.from_minidumpc                 C   s(   t ƒ }| j|_d |_| j|_| j|_|S r&   )rÅ   r   rÇ   rÊ   rÐ   rÈ   rÉ   )ÚrekallreaderrÒ   r
   r
   r   Úfrom_rekallreaderñ  s   z KatzSystemInfo.from_rekallreaderN)	r   r   r   r#   rÍ   ÚstaticmethodrÓ   rÚ   rÜ   r
   r
   r
   r   rÅ   Ç  s    

rÅ   Fr¼   Úreturnc                 C   s:   dt | ƒd  }| d|  } t | ¡}|du r|S | ¡ S )Nr<   ú=T)r   Úbase64Úurlsafe_b64decodeÚdecode)r¼   Úbytes_expectedÚpaddingr­   r
   r
   r   Úbase64_decode_urlü  s   
rå   )r—   r˜   r   )F)r   r   rÀ   r¹   rà   Ú!minidump.streams.SystemInfoStreamr   r0   r   r»   r   r   rx   r}   r”   r¶   rÁ   r·   rÅ   r   rå   r
   r
   r
   r   Ú<module>   s$     ! '
05