o
    j9                     @   sn  d dl mZ d dlmZmZmZmZmZmZm	Z	m
Z
 d dlmZmZmZmZmZmZ d dlmZ d dlmZ edZG dd deZd	d
 ZdZdZdZdZdZdZdZdZ dZ!dZ"dZ#G dd deZ$e$Z%e$Z&G dd deZ'e$Z(G dd deZ)G dd deZ*e$Z+G dd deZ,G dd deZ-G dd  d eZ.G d!d" d"eZ/G d#d$ d$eZ0G d%d& d&eZ1G d'd( d(eZ2G d)d* d*eZ3G d+d, d,eZ4G d-d. d.eZ5G d/d0 d0eZ6G d1d2 d2eZ7G d3d4 d4eZ8G d5d6 d6eZ9G d7d8 d8eZ:G d9d: d:e:Z;G d;d< d<eZ<G d=d> d>eZ=G d?d@ d@e=Z>G dAdB dBeZ?G dCdD dDeZ@G dEdF dFeZAG dGdH dHeZBG dIdJ dJeZCG dKdL dLeZDG dMdN dNeZEG dOdP dPeZFG dQdR dReZGG dSdT dTeZHG dUdV dVeZIG dWdX dXeZJG dYdZ dZeZKG d[d\ d\eZLG d]d^ d^eZMG d_d` d`eZNG dadb dbeZOG dcdd ddeZPG dedf dfeZQG dgdh dheZRG didj djeZSG dkdl dleZTG dmdn dneZUG dodp dpeZVG dqdr dreZWeBeCfeDeEfeFeGfeHeIfeJeKfeLeMfeNeOfePeQfeReSfeTeTfeVeWfdsZXdtdu ZYddwdxZZdydz Z[dd|d}Z\efd~dZ]dd Z^dddZ_dd Z`dd Zadd ZbdS )    )system_errors)WSTRDWORDLPWSTRULONGLARGE_INTEGERWORDBYTEUUID)NDRCALL
NDRPOINTERNDRUniConformantArrayNDRUniVaryingArray	NDRSTRUCTNULL)DCERPCException)uuidtup_to_bin)z$F6BEAFF7-1E19-4FBB-9F8F-B89E2018337Cz1.0c                   @   s   e Zd ZdddZdd ZdS )DCERPCSessionErrorNc                 C   s   t | ||| d S N)r   __init__)selferror_string
error_codepacket r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/dcerpc/v5/even6.pyr   %   s   zDCERPCSessionError.__init__c                 C   sF   | j }|tjv rtj| d }tj| d }d| j ||f S d| j  S )Nr      z(EVEN6 SessionError: code: 0x%x - %s - %sz,EVEN6 SessionError: unknown error code: 0x%x)r   r   ERROR_MESSAGES)r   keyerror_msg_shorterror_msg_verboser   r   r   __str__(   s   

zDCERPCSessionError.__str__)NNN)__name__
__module____qualname__r   r!   r   r   r   r   r   $   s    
r   c                 C   s(   | t kr| S | dd  dkr| d S | S )N )r   )stringr   r   r   checkNullString1   s
   r(   r         i   i   i      i   c                   @   s.   e Zd ZdefdeffZd	ddZdd ZdS )
handle_tcontext_handle_attributescontext_handle_uuidNFc                 C   s   t | || d| d< d S )N                   r.   )r   r   )r   dataisNDR64r   r   r   r   ]   s   zhandle_t.__init__c                 C   s   | d dkS )Nr.   r/   r   )r   r   r   r   isNulla   s   zhandle_t.isNull)NF)r"   r#   r$   r   r
   	structurer   r2   r   r   r   r   r,   W   s    
r,   c                   @      e Zd ZdeffZdS )PCONTEXT_HANDLE_LOG_HANDLEDataN)r"   r#   r$   CONTEXT_HANDLE_LOG_HANDLEreferentr   r   r   r   r5   h       r5   c                   @   r4   )PCONTEXT_HANDLE_LOG_QUERYr6   N)r"   r#   r$   CONTEXT_HANDLE_LOG_QUERYr8   r   r   r   r   r:   o   r9   r:   c                   @   r4   )LPPCONTEXT_HANDLE_LOG_QUERYr6   N)r"   r#   r$   r:   r8   r   r   r   r   r<   t   r9   r<   c                   @   r4   )!PCONTEXT_HANDLE_OPERATION_CONTROLr6   N)r"   r#   r$    CONTEXT_HANDLE_OPERATION_CONTROLr8   r   r   r   r   r=   {   r9   r=   c                   @      e Zd ZdefdeffZdS )EvtRpcQueryChannelInfoNameStatusN)r"   r#   r$   r   r   r3   r   r   r   r   r@          r@   c                   @      e Zd ZeZdS )EvtRpcQueryChannelInfoArrayN)r"   r#   r$   r@   itemr   r   r   r   rE          rE   c                   @      e Zd ZdefZdS )LPEvtRpcQueryChannelInfoArrayr6   N)r"   r#   r$   rE   r8   r   r   r   r   rI          rI   c                   @   s"   e Zd ZdefdefdeffZdS )RPC_INFOErrorSubErrorSubErrorParamN)r"   r#   r$   r   r3   r   r   r   r   rK      
    rK   c                   @   rH   )	PRPC_INFOr6   N)r"   r#   r$   rK   r8   r   r   r   r   rP      rJ   rP   c                   @   rD   )
WSTR_ARRAYN)r"   r#   r$   r   rF   r   r   r   r   rQ      rG   rQ   c                   @   rD   )DWORD_ARRAYNr"   r#   r$   r   rF   r   r   r   r   rR      rG   rR   c                   @   rH   )LPDWORD_ARRAYr6   N)r"   r#   r$   rR   r8   r   r   r   r   rT      rJ   rT   c                   @      e Zd ZdZdS )
BYTE_ARRAYcNr"   r#   r$   rF   r   r   r   r   rV      rG   rV   c                   @   rD   )CBYTE_ARRAYN)r"   r#   r$   r	   rF   r   r   r   r   rY      rG   rY   c                   @   rD   )CDWORD_ARRAYNrS   r   r   r   r   rZ      rG   rZ   c                   @   rH   )LPBYTE_ARRAYr6   N)r"   r#   r$   rY   r8   r   r   r   r   r[      rJ   r[   c                   @   rD   )ULONG_ARRAYN)r"   r#   r$   r   rF   r   r   r   r   r\      rG   r\   c                   @   r4   )PCDWORD_ARRAYr6   N)r"   r#   r$   rZ   r8   r   r   r   r   r]      r9   r]   c                   @      e Zd ZdS )PDWORD_ARRAYNr"   r#   r$   r   r   r   r   r_          r_   c                   @   rU   )BYTE_ARRAY_CONFORMANTrW   NrX   r   r   r   r   rb      rG   rb   c                   @   r4   )PBYTE_ARRAY_CONFORMANTr6   N)r"   r#   r$   rb   r8   r   r   r   r   rc      r9   rc   c                   @   r^   )PBYTE_ARRAYNr`   r   r   r   r   rd      ra   rd   c                   @   s:   e Zd ZdefdefdefdefdefdefdeffZdS )	EVENT_DESCRIPTORIdVersionChannelLevelSeverityOpcodeTaskKeywordN)r"   r#   r$   r   r	   r   r3   r   r   r   r   re      s    re   c                   @   s6   e Zd ZdefddefdefdefdefdeffZdS )	BOOKMARKBookmarkSize)
HeaderSizez<L=0x18ChannelSizeCurrentChannelReadDirectionRecordIdsOffsetLogRecordNumbersN)r"   r#   r$   r   r\   r3   r   r   r   r   rm      s    rm   c                   @   s4   e Zd ZdefdefdefdefdefdeffZdS )
RESULT_SET	TotalSizero   EventOffsetBookmarkOffset
BinXmlSize	EventDataN)r"   r#   r$   r   rV   r3   r   r   r   r   ru          ru   c                   @   s,   e Zd ZdZdefdefdefdeffZdS ) EvtRpcRegisterRemoteSubscriptionr   channelPathquerybookmarkXmlFlagsNr"   r#   r$   opnumr   r   r   r3   r   r   r   r   r|          r|   c                   @   .   e Zd ZdefdefdefdefdeffZdS )(EvtRpcRegisterRemoteSubscriptionResponseHandle	OpControlQueryChannelInfoSizeQueryChannelInforL   N)	r"   r#   r$   "CONTEXT_HANDLE_REMOTE_SUBSCRIPTIONr>   r   rE   rK   r3   r   r   r   r   r          r   c                   @   ,   e Zd ZdZdefdefdefdeffZdS )EvtRpcRemoteSubscriptionNextr)   r   NumRequestedRecordsTimeOutr   N)r"   r#   r$   r   r   r   r3   r   r   r   r   r     r   r   c                   @   4   e Zd ZdefdefdefdefdefdeffZdS )$EvtRpcRemoteSubscriptionNextResponseNumActualRecordsEventDataIndicesEventDataSizesResultBufferSizeResultBuffer	ErrorCodeN)r"   r#   r$   r   r_   rd   r   r3   r   r   r   r   r     r{   r   c                   @   s   e Zd ZdZdZdS )#EvtRpcRegisterControllableOperationr*   r   N)r"   r#   r$   r   r3   r   r   r   r   r     s    r   c                   @   r?   )+EvtRpcRegisterControllableOperationResponser   rL   N)r"   r#   r$   r>   r   r3   r   r   r   r   r     rC   r   c                   @   s&   e Zd ZdZdefdefdeffZdS )EvtRpcRegisterLogQuery   PathQueryr   Nr   r   r   r   r   r   %  s    r   c                   @   r   )EvtRpcRegisterLogQueryResponser   r   r   r   rL   N)	r"   r#   r$   r;   r>   r   rE   rK   r3   r   r   r   r   r   -  r   r   c                   @   s,   e Zd ZdZdefdefdefdeffZdS )EvtRpcClearLog   r   ChannelPath
BackupPathr   Nr"   r#   r$   r   r>   r   r   r3   r   r   r   r   r   6  r   r   c                   @   r4   )EvtRpcClearLogResponserL   Nr"   r#   r$   rK   r3   r   r   r   r   r   ?  r9   r   c                   @   s2   e Zd ZdZdefdefdefdefdeffZdS )EvtRpcExportLog   r   r   r   r   r   Nr   r   r   r   r   r   D  s    r   c                   @   r4   )EvtRpcExportLogResponserL   Nr   r   r   r   r   r   N  r9   r   c                   @   r   )EvtRpcQueryNext   LogQueryr   
TimeOutEndr   N)r"   r#   r$   r   r;   r   r3   r   r   r   r   r   S  r   r   c                   @   r   )EvtRpcQueryNextResponser   r   r   r   r   r   N)r"   r#   r$   r   rR   rV   r   r3   r   r   r   r   r   \  r{   r   c                   @   s,   e Zd ZdZdefdefdefdeffZdS )EvtRpcQuerySeek   r   PosBookmarkXMLr   N)	r"   r#   r$   r   r;   r   r   r   r3   r   r   r   r   r   f  r   r   c                   @   r4   )EvtRpcQuerySeekResponserL   Nr   r   r   r   r   r   o  r9   r   c                   @      e Zd ZdZdeffZdS )EvtRpcClose   r   N)r"   r#   r$   r   r7   r3   r   r   r   r   r   t      r   c                   @   r?   )EvtRpcCloseResponser   r   N)r"   r#   r$   r5   r   r3   r   r   r   r   r   z  rC   r   c                   @   s    e Zd ZdZdefdeffZdS )EvtRpcOpenLogHandle   rh   r   N)r"   r#   r$   r   r   r   r3   r   r   r   r   r     s
    r   c                   @   r?   )EvtRpcOpenLogHandleResponser   rL   N)r"   r#   r$   r5   rK   r3   r   r   r   r   r     rC   r   c                   @   r   )EvtRpcGetChannelList   r   N)r"   r#   r$   r   r   r3   r   r   r   r   r     r   r   c                   @   s"   e Zd ZdefdefdeffZdS )EvtRpcGetChannelListResponseNumChannelPathsChannelPathsr   N)r"   r#   r$   r   rQ   r   r3   r   r   r   r   r     rO   r   )r   r)   r*   r   r   r   r   r   r   r   r   c                 C   s@   t  }t||d< t||d< t||d< ||d< | |}|S )Nr}   r~   r   r   )r|   r(   request)dcer}   r~   r   flagsr   respr   r   r   !hEvtRpcRegisterRemoteSubscription  s   
r     c                 C   s4   t  }||d< ||d< ||d< ||d< | |}|S )Nr   r   r   r   )r   r   )r   handlenumRequestedRecordstimeOutr   r   r   r   r   r   hEvtRpcRemoteSubscriptionNext  s   
r   c                 C   s   t  }| |}|S r   )r   r   r   r   r   r   r   r   $hEvtRpcRegisterControllableOperation  s   
r   * c                 C   s4   t  }t||d< t||d< ||d< | |}|S )Nr   r   r   )r   r(   r   )r   pathr   r~   r   r   r   r   r   hEvtRpcRegisterLogQuery  s   
r   c                 C   s<   t  }||d< t||d< t||d< d|d< | |}|S )Nr   r   r   r   r   )r   r(   r   )r   r   r   
backupPathr   r   r   r   r   hEvtRpcClearLog  s   
r   c                 C   sH   t  }||d< t||d< t||d< t||d< d|d< | |}|S )Nr   r   r   r   r   r   )r   r(   r   )r   r   r}   r~   r   r   r   r   r   r   hEvtRpcExportLog  s   
r   c              
   C   s   t  }||d< ||d< ||d< d|d< tj}| |}|tjkrTz| |}W |S  tyS } zt|ddk r: t|ddk rD | }W Y d }~|S d }~ww d S )Nr   r   r   r   r   ERROR_NO_MORE_ITEMSERROR_TIMEOUT)r   r   ERROR_MORE_DATAr   r   strfind
get_packet)r   r   r   
timeOutEndr   statusr   er   r   r   hEvtRpcQueryNext  s*   

r   c                 C   s   t  }||d< | |}|S )Nr   )r   r   )r   r   r   r   r   r   r   hEvtRpcClose  s   
r   c                 C   s$   t  }t||d< ||d< | |S )Nrh   r   )r   r(   r   )r   channelr   r   r   r   r   hEvtRpcOpenLogHandle  s   
r   c                 C   s   t  }d|d< | |}|S )Nr   r   )r   r   r   r   r   r   hEvtRpcGetChannelList  s   
r   N)r   r   )r   )r   )cimpacketr   impacket.dcerpc.v5.dtypesr   r   r   r   r   r   r	   r
   impacket.dcerpc.v5.ndrr   r   r   r   r   r   impacket.dcerpc.v5.rpcrtr   impacket.uuidr   MSRPC_UUID_EVEN6r   r(   EvtSubscribeToFutureEventsEvtSubscribeStartAtOldestRecordEvtSubscribeStartAfterBookmarkEvtSubscribeTolerateQueryErrorsEvtSubscribeStrictEvtSubscribePullEvtQueryChannelNameEvtQueryFilePathEvtQueryTolerateQueryErrorsEvtReadOldestToNewestEvtReadNewestToOldestr,   r   r7   r5   r;   r:   r<   r>   r=   r@   rE   rI   rK   rP   rQ   rR   rT   rV   rY   rZ   r[   r\   r]   r_   rb   rc   rd   re   rm   ru   r|   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   OPNUMSr   r   r   r   r   r   r   r   r   r   r   r   r   r   <module>   s   ( 			
		
	
	
		
	

