o
    jg                     @   s  d dl mZ d dl mZ d dlZd dlZd dlmZ d dlmZ d dl	Z	d dl
mZ d dlmZmZ d dlmZ d d	lmZmZ d
Zd ZdZdZdZdZdZdZG dd deZG dd deZG dd deZG dd deZG dd deZ G dd deZ!G dd deZ"G dd  d eZ#G d!d" d"eZ$G d#d$ d$eZ%ee e!e"e#e$d%Z&G d&d' d'eZ'G d(d) d)e'Z(G d*d+ d+Z)G d,d- d-e'Z*d1d/d0Z+dS )2    )division)print_functionN)	unhexlify)unpack)b)ABCabstractmethod)LOG)	Structurehexdump,                     c                   @      e Zd ZdZdS )REG_REGF))Magicz"regfUnknown<L=0Unknown2r   
lastChangez<Q=0)MajorVersionr   )MinorVersionr   )0r   )11r   )OffsetFirstRecordr   )DataSizer   )1111r   )Namez48s="")
Remaining1z411s=b"")CheckSumz<L=0xffffffff)
Remaining2z	3585s=b""N__name__
__module____qualname__	structure r-   r-   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/winregistry.pyr   3       r   c                   @   r   )REG_HBIN))r   z"hbin)OffsetFirstHBinr   )OffsetNextHBinr   )	BlockSizer   Nr(   r-   r-   r-   r.   r0   F   r/   r0   c                   @   r   )REG_HBINBLOCK))DataBlockSize<l=0)_Data_-Datazself["DataBlockSize"]*(-1)-4Data:Nr(   r-   r-   r-   r.   r4   N   r/   r4   c                   @   r   )REG_NK))r   z"nk)Type<H=0r   r   )OffsetParentr6   )
NumSubKeysr   r   )OffsetSubKeyLfr6   )Unknown3r   )	NumValuesr   )OffsetValueListr6   )OffsetSkRecordr6   )OffsetClassNamer6   )UnUsedz20s=b""
NameLengthr>   )ClassNameLengthr>   )_KeyNamez	_-KeyNameself["NameLength"])KeyNamer;   Nr(   r-   r-   r-   r.   r<   U   r/   r<   c                   @   r   )REG_VK)	)r   z"vkrH   )DataLenr6   )
OffsetDatar   )	ValueTyper   )Flagr>   rG   r>   )_Namez_-NamerL   )r$   r;   Nr(   r-   r-   r-   r.   rN   k   r/   rN   c                   @   r   )REG_LF))r   z"lfNumKeysr>   HashRecordsr;   Nr(   r-   r-   r-   r.   rU   x   r/   rU   c                   @   r   )REG_LH))r   z"lhrV   rX   Nr(   r-   r-   r-   r.   rZ      r/   rZ   c                   @   r   )REG_RI))r   z"rirV   rX   Nr(   r-   r-   r-   r.   r[      r/   r[   c                   @   r   )REG_SK))r   z"skrS   )OffsetPreviousSkr6   )OffsetNextSkr6   )UsageCounterr   )SizeSkr   r9   Nr(   r-   r-   r-   r.   r\      r/   r\   c                   @   r   )REG_HASH))OffsetNkr   )rM   z4s=b""Nr(   r-   r-   r-   r.   ra      r/   ra   )s   nks   vks   lfs   lhs   ris   skc                   @   sr   e Zd Zdd Zdd Zedd Zedd Zed	d
 Zedd Z	edd Z
edddZedd ZdS )Registryc                 C   s   t | dr| j  d S d S )Nfd)hasattrrd   closeselfr-   r-   r.   rf      s   
zRegistry.closec                 C   s   |    d S N)rf   rg   r-   r-   r.   __del__   s   zRegistry.__del__c                 C      d S ri   r-   rh   	parentKeyr-   r-   r.   walk      zRegistry.walkc                 C   rk   ri   r-   rh   keyr-   r-   r.   findKey   ro   zRegistry.findKeyc                 C   rk   ri   r-   rh   	valueType	valueDatar-   r-   r.   
printValue   ro   zRegistry.printValuec                 C   rk   ri   r-   rl   r-   r-   r.   enumKey   ro   zRegistry.enumKeyc                 C   rk   ri   r-   rp   r-   r-   r.   
enumValues   ro   zRegistry.enumValuesNc                 C   rk   ri   r-   )rh   keyValue	valueNamer-   r-   r.   getValue   ro   zRegistry.getValuec                 C   rk   ri   r-   rh   	classNamer-   r-   r.   getClass   ro   zRegistry.getClassri   )r)   r*   r+   rf   rj   r   rn   rr   rv   rw   rx   r{   r~   r-   r-   r-   r.   rc      s"    




rc   c                   @   s   e Zd Zd-ddZdd Zdd Zdd	 Zd
d Zdd Zdd Z	dd Z
dd Zdd Zdd Zdd Zdd Zdd Zdd Zd d! Zd"d# Zd$d% Zd.d'd(Zd)d* Zd+d, Zd&S )/saveRegistryParserFc                 C   s   || _ |du r| j | _| j   nt|d| _| jd}t|| _d| _|  | _| jd u r6t	
d d S | jd dkrU| jd d	krWt	d
| jd | jd f  d S d S d S )NTzr+b    zCan't find root key!r   r   r      z4Unsupported version (%d.%d) - things might not work!)_saveRegistryParser__hiverd   openreadr   _saveRegistryParser__regfindent _saveRegistryParser__findRootKeyrootKeyr	   errorwarning)rh   hiveisRemotedatar-   r-   r.   __init__   s   


"zsaveRegistryParser.__init__c              
   C   s   | j dd | j d}t|dkrhz6t|d d }|| j |d d 7 }|dd  }| |}|D ]}t|trG|d tkrG|  W S q5W n t	y[ } zW Y d }~nd }~ww | j d}t|dksd S )Nr   r       r2   r=   )
rd   seekr   lenr0   &_saveRegistryParser__processDataBlocks
isinstancer<   ROOT_KEY	Exception)rh   r   hbinblocksblocker-   r-   r.   __findRootKey   s*   


z saveRegistryParser.__findRootKeyc                 C   s   | j d| d | j d}|| j td|d d d  }t|dkr(d S t|}|d d d tv rDt|d d d  |d S td|d d d   |S )	Nr   r   r   <lr:   r   zUnknown type 0x%s)	rd   r   r   r   r   r4   StructMappingsr	   debug)rh   offset	sizeBytesr   r   r-   r-   r.   
__getBlock   s   "zsaveRegistryParser.__getBlockc                 C   sn   g }g }| j d| d t|D ]}|td| j dd  q|D ]}|dkr4| |}|| q$|S )Nr   r   r   r   )rd   r   rangeappendr   r   _saveRegistryParser__getBlock)rh   r   count	valueListresivalueOffsetr   r-   r-   r.   __getValueBlocks   s   

z#saveRegistryParser.__getValueBlocksc                 C   s&   | j d| d | j |dd  S )Nr   r   r   )rd   r   r   )rh   r   r   r-   r-   r.   	__getData  s   zsaveRegistryParser.__getDatac                 C   s"   | j d| d d | j |S )Nr   r   r   )rd   r   write)rh   r   valuer-   r-   r.   	__setData  s   zsaveRegistryParser.__setDatac                 C   s   g }t |dkrZtd|d d d }t }|dkr(t|j}d|d< t||_|| t |}|d d d tv rIt|d d d  |d }|| ||d  }t |dks|S )Nr   r   r   )r7   r8   zself["DataBlockSize"]-4r   r:   r   )	r   r   r4   listr,   tuple
fromStringr   r   )rh   r   r   	blockSizer   tmpListblockLenr-   r-   r.   __processDataBlocks  s    



z&saveRegistryParser.__processDataBlocksc                 C   s<   |d dkrdS |d dk r|d S |  |d |d d S )NrO   r   r   rP   r   )_saveRegistryParser__getData)rh   recr-   r-   r.   __getValueData)  s
   z!saveRegistryParser.__getValueDatac                 C   s\   t ||d krtd|d t |f  td|d dkr&td dS | |d |S )NrO   zGInvalid value length received by __setValueData. Expected: %d - Got: %dz=Setting key values with differing lengths is not implemented.r   z+Received 0 length input for __setValueData.rP   )r   r	   r   NotImplementedError_saveRegistryParser__setData)rh   r   r   r-   r-   r.   __setValueData3  s   
z!saveRegistryParser.__setValueDatac                 C   s.   d}|  D ]}|d9 }|t|7 }q|d S )Nr   %   l        )upperord)rh   rq   r   bbr-   r-   r.   __getLhHashD  s
   zsaveRegistryParser.__getLhHashc                 C   s   |dkrt |}|d dt|d d kr|d S d S |dkr9t |}td|d d | |kr7|d S d S |d	krWtd|d d d }| |}|d |krU|S d S td
|  t	d d S )NlfrM       r   rb   lh<Lr   rizUNKNOWN Magic %sr   )
ra   stripr   r   _saveRegistryParser__getLhHashr   r	   criticalsysexit)rh   magichashDatarq   hashRecr   nkr-   r-   r.   __compareHashK  s&   

z saveRegistryParser.__compareHashc                 C   s   |  |d }|d urz|d }|d dkrFd}t|d D ]&}td|d d d	 }|  |}||d d |d d
   }|dd  }q|}t|d D ]-}	|d d
 }
| |d |
|}|d urs|  |}|d d|krs|  S |d
d  }qLd S )NrA   rY   r   r       rW   r   r   r      r@   rM   utf-8)r   r   r    _saveRegistryParser__compareHashdecode)rh   rm   subKeyr   r   recordsr   r   lrecordr   r   r   r-   r-   r.   __findSubKey`  s(   

zsaveRegistryParser.__findSubKeyc                 C   sF  |  |d }t|tr9td| j|d df  |  jd7  _|d dk r1| jd d | _d S |  |d }n|}|d	 }|d
 dkrvd}t|d D ]&}td|d d d }|  |}||d	 d |d d   }|dd  }qM|}t|d D ]}	t|d d }
| 	|
 |dd  }q|t|tr| jd d | _d S d S )Nrb   %s%srM   r     rA   r   rY   r   r   r   rW   r   r   r   )
r   r   r<   printr   r   r   r   ra   !_saveRegistryParser__walkSubNodes)rh   r   r   r   r   r   r   r   r   rq   r   r-   r-   r.   __walkSubNodes|  s2   



z!saveRegistryParser.__walkSubNodesc                 C   st   |  |}|d u s|d dk rd S | |d }|d }t|d D ]}t|d d }| | |dd  }q"d S )NrA   r   rY   rW   r   )rr   r   r   ra   r   )rh   rm   rq   r   r   r   r   r-   r-   r.   rn     s   

zsaveRegistryParser.walkc                 C   st   |d dkrt |dkr|dd  }| j}t |dkr8|d dkr8|dD ]}| ||}|d ur5|}q& d S |S )Nr   \r   )r   r   split_saveRegistryParser__findSubKey)rh   rq   rm   r   r   r-   r-   r.   rr     s   zsaveRegistryParser.findKeyc                 C   s   |t ttfv rt|trtd d S td|d  d S |tkr-td t|| j	 d S |t
kr9td|  d S |tkrJtdtd|d   d S |tkrtzt|dkr`td t|| j	 ntd	 W d S W d S    td	 Y d S td
|  t| d S )NNULL%sutf-16ler   %d<Qr   r    NULLUnknown Type 0x%x!)REG_SZREG_EXPAND_SZREG_MULTISZr   intr   r   
REG_BINARYr   r   	REG_DWORD	REG_QWORDr   REG_NONEr   rs   r-   r-   r.   rv     s,   
zsaveRegistryParser.printValuec                 C   s   g }|d dkrt|  |d }|d }|d dkrJd}t|d D ]&}td	|d d
 d }|  |}||d d |d d   }|d
d  }q!|}t|d D ]#}t|d d }	|  |	d }
|dd  }|d|
d d  qP|S )Nr@   r   rA   rY   r   r   r   rW   r   r   r   rb   r   rM   r   )r   r   r   ra   r   r   )rh   rm   r   r   r   r   r   r   r   r   r   r-   r-   r.   rw     s$   
zsaveRegistryParser.enumKeyc                 C   s\   g }|d dkr,|  |d |d d }|D ]}|d dkr&||d  q|d q|S )NrC   r   rD   r   rR   r$   s   default)#_saveRegistryParser__getValueBlocksr   )rh   rq   respr   r   r-   r-   r.   rx     s   zsaveRegistryParser.enumValuesNc                 C   s   |du rt |}t |}n|}|}| |}|du rdS |d dkr]| |d |d d }|D ]*}|d t|krG|d | |f  S |dkr\|d	 dkr\|d | |f  S q2dS )
t   returns a tuple with (ValueType, ValueData) for the requested keyValue
            valueName is the name of the value (which can contain '\')
            if valueName is not  given, keyValue must be a string containing the full path to the value
            if valueName is given, keyValue should be the string containing the path to the key containing valueName
        NrC   r   rD   r   r$   rQ   defaultrR   )ntpathdirnamebasenamerr   r   r   !_saveRegistryParser__getValueData)rh   ry   rz   regKeyregValuerq   r   r   r-   r-   r.   r{     s"   

zsaveRegistryParser.getValuec                 C   s   t |}t |}| |}|d u rd S |d dkrV| |d |d d }|D ],}|d t|kr?|d | ||f  S |dkrU|d dkrU|d | ||f  S q)d S )	NrC   r   rD   r   r$   rQ   r   rR   )r   r   r   rr   r   r   !_saveRegistryParser__setValueData)rh   ry   ru   r   r   rq   r   r   r-   r-   r.   setValue  s   


zsaveRegistryParser.setValuec                 C   s<   |  |}|d u rd S |d dkr| |d }|d S d S )NrF   r   r:   )rr   r   )rh   r}   rq   r   r-   r-   r.   r~   /  s   
zsaveRegistryParser.getClassFri   )r)   r*   r+   r   r   r   r   r   r   r   r   r   r   r   r   r   rn   rr   rv   rw   rx   r{   r   r~   r-   r-   r-   r.   r      s,    

 
r   c                   @   s   e Zd ZdddZdd ZdS )RegistryNodeNc                 C   s   || _ || _|| _i | _d S ri   )keyNamenodeNamer   	childKeys)rh   r  r  r   r-   r-   r.   r   =  s   
zRegistryNode.__init__c                 C   s   | j |B | _ d S ri   )r  )rh   childKeyr-   r-   r.   addChildNodeC  s   zRegistryNode.addChildNoderi   )r)   r*   r+   r   r  r-   r-   r-   r.   r   <  s    
r   c                   @   s   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zdd Zdd Z	dd Z
dd Zdd Zdd Zdd Zdd Zd ddZdd ZdS )!exportRegistryParserc                 C   s&   d| _ || _t|dd| _|   d S )Nr   r   )encoding)r   _exportRegistryParser__hiver   rd   (_exportRegistryParser__buildRegistryTree)rh   r   r-   r-   r.   r   H  s   zexportRegistryParser.__init__c                 C   sb   |dkrt S |dkrtS |dkrtS |dkrtS |dkrtS |dkr$tS t|ddd	d
dS )Nzhex(0)zhex(2)hexdwordzhex(7)zhex(b)zhex(0x)r      )r   r   r   r   r   r   r   replace)rh   rQ   r-   r-   r.   __parseTypeN  s   z exportRegistryParser.__parseTypec                 C   s"   | | jj ddddS )Nr   r   )r  registryTreer  r   r   rp   r-   r-   r.   __keyToNodePath^  s   "z$exportRegistryParser.__keyToNodePathc                 C   s8   | j }z|dgkr|D ]}|j| }q|W S    Y d S )Nr   )r  r  )rh   nodePathnodetempNoder-   r-   r.   
__findNodea  s   
zexportRegistryParser.__findNodec                 C   s   |sdt dgiS i }td}td}tdtj}||}|D ]T}||rB||d }t }	|d }
|d r=d}n1|d }n,||d }| |d }	|d	 d
dddddd}
|d rjd}n|d }|||	|
giB }q"|S )Nr   r   z^(?:"(.*)"|(@))="(.*)"$z^(?:"(.*)"|(@))=(.*):([\S\s]*)$z^([\S\s]*?)$(?<!\\)r   r   r   r   
, z\
)	r   recompile	MULTILINEfindallsearch _exportRegistryParser__parseTyper   r  )rh   regkey_valuesr   pattern_regszpattern_otherpattern_split_valuesvaluesr   matchrQ   	ValueData	ValueNamer-   r-   r.   __extractDatak  s.   




&z"exportRegistryParser.__extractDatac                 C   s6   d |ddd  }| |}|t|||i}|S )Nr   r   r   )joinr   "_exportRegistryParser__extractDatar   )rh   r  r   r  r   r  r-   r-   r.   __buildChildNode  s   
z%exportRegistryParser.__buildChildNodec                 C   s   t dt j}| j }d}||D ]E}|d }|d d}|du r?| |}d|	ddd  }t
|||| _d	}q| |d d }	| ||}
| |	}||
 qd S )
Nz^\[(.*?)\]\n([\S\s]*?)?^\nTr   r   r  r   r   r   F)r  r  r  rd   r   r  r   r*  r)  r   r   r  $_exportRegistryParser__keyToNodePath%_exportRegistryParser__buildChildNode_exportRegistryParser__findNoder  )rh   patternfiler   r%  r  r   r   r  
parentPathr  
parentNoder-   r-   r.   __buildRegistryTree  s    


z(exportRegistryParser.__buildRegistryTreec                 C   sr   t d| j|jf  |  jd7  _|ji kr | jd d | _d S t|j D ]}| | q'| jd d | _d S )Nr   r   r   )r   r   r  r  r   r$  #_exportRegistryParser__walkSubNodes)rh   r  subNoder-   r-   r.   r     s   
z#exportRegistryParser.__walkSubNodesc                 C   sB   |  |}| |}|d u rd S t|j D ]}| | qd S ri   )r,  r.  r   r  r$  r4  )rh   rm   pathr  r5  r-   r-   r.   rn     s   

zexportRegistryParser.walkc                 C   s  |t ttfv r |dks|dkrtd d S td|d  d S |tkr0td t|| j d S |tkrG|dkr>td d S tt	
| d S |tkrXtdtd	|d   d S |tkrzt|d
krntd t|| j ntd W d S W d S    td Y d S td|  t| d S )Nr   s     r   r   r   r   r   r   r   r   r   r   )r   r   r   r   r   r   r   r   r   r   
from_bytesr   r   r   r   rs   r-   r-   r.   rv     s0   zexportRegistryParser.printValuec                 C   s   |dkrdS d | |S )Nr   )r)  r,  rp   r-   r-   r.   rr     s   zexportRegistryParser.findKeyc                 C   s"   |  |}| |}t|j S ri   )r,  r.  r   r  keys)rh   rq   r6  r  r-   r-   r.   rw     s   

zexportRegistryParser.enumKeyc                 C   s8   |  |}| |}|sd S t|j }dd |D S )Nc                 S   s   g | ]}| d qS )r   )encode).0sr-   r-   r.   
<listcomp>  s    z3exportRegistryParser.enumValues.<locals>.<listcomp>)r,  r.  r   r   r8  )rh   rq   r6  r  r$  r-   r-   r.   rx     s   

zexportRegistryParser.enumValuesNc           	      C   s   |  |}|du r|dd }d|dd }n|}|}z | |}|j| \}}|tfv r7||dfW S |t|fW S    Y dS )r   Nr   r   r   )r,  r)  r.  r   r   r9  r   )	rh   ry   rz   r6  keyPathr   r  rQ   r&  r-   r-   r.   r{     s   


zexportRegistryParser.getValuec                 C   rk   ri   r-   r|   r-   r-   r.   r~     ro   zexportRegistryParser.getClassri   )r)   r*   r+   r   r  r,  r.  r*  r-  r	  r4  rn   rv   rr   rw   rx   r{   r~   r-   r-   r-   r.   r  G  s     


	r  Fc                 C   s   t | do	t | d}|rt| |S t| d}|d}W d   n1 s&w   Y  |dd dkr8t| |S z|d}d	|v sFd
|v rKt| W S W td ty[   Y tdw )a)  
    Factory function to instantiate the correct registry parser by auto-detecting the hive format.
    :param hive: Path to the registry hive file (str) or file-like object
    :param isRemote: Whether the hive is remote
    :return: An instance of saveRegistryParser or exportRegistryParser
    r   r   rb@   Nr   s   regfr   zWindows Registry EditorREGEDITzFCould not determine registry hive format (not a binary hive or export))re   r   r   r   r   r  r   
ValueError)r   r   is_file_objectrd   r   headerr-   r-   r.   get_registry_parser  s$   	



rD  r   ),
__future__r   r   r   r  binasciir   structr   r   sixr   abcr   r   impacketr	   impacket.structurer
   r   r   r   r   r   r   r   r   r   r   r0   r4   r<   rN   rU   rZ   r[   r\   ra   r   rc   r   r   r  rD  r-   r-   r-   r.   <module>   sX   $  t B