o
    Žõ±j  ã                   @   s>   d dl Z d dlZd dlmZ G dd„ dƒZG dd„ deƒZdS )é    N)ÚPackageDecryptorc                   @   s4   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ ZdS )ÚCloudapCredentialc                 C   s4   d| _ d | _d | _d | _d | _d | _d | _d | _d S )NÚcloudap)ÚcredtypeÚluidÚsidÚcachedirÚPRTÚkey_guidÚ	dpapi_keyÚdpapi_key_sha1©Úself© r   ú¤/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/alsadecryptor/packages/cloudap/decryptor.pyÚ__init__   s   
zCloudapCredential.__init__c                 C   sD   i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< |S )Nr   r   r	   r
   r   r   )r   r   r	   r
   r   r   ©r   Útr   r   r   Úto_dict   s   





zCloudapCredential.to_dictc                 C   s   t | jtƒr| j ¡ S | jS ©N)Ú
isinstancer   ÚbytesÚhexr   r   r   r   Úget_masterkey_hex   s   z#CloudapCredential.get_masterkey_hexc                 C   s   t  |  ¡ ¡S r   )ÚjsonÚdumpsr   r   r   r   r   Úto_json   s   zCloudapCredential.to_jsonc                 C   sV   d| j  }|d| j 7 }|d| j 7 }|d| j 7 }|d|  ¡  7 }|d| j 7 }|S )Nz	== Cloudap [%x]==
z		cachedir %s
z			PRT %s
z		key_guid %s
z		dpapi_key %s
z		dpapi_key_sha1 %s
)r   r   r	   r
   r   r   r   r   r   r   Ú__str__    s   
zCloudapCredential.__str__N)Ú__name__Ú
__module__Ú__qualname__r   r   r   r   r   r   r   r   r   r      s    

r   c                       s4   e Zd Z‡ fdd„Zdd„ Zdd„ Zdd„ Z‡  ZS )	ÚCloudapDecryptorc                    s"   t ƒ  d|||¡ || _g | _d S )NÚCloudap)Úsuperr   Údecryptor_templateÚcredentials)r   Úreaderr$   Úlsa_decryptorÚsysinfo©Ú	__class__r   r   r   *   s   
zCloudapDecryptor.__init__c                 Ã   sL   �|   d| jj¡I d H }| j || jj ¡I d H }| j |¡I d H }||fS )NzcloudAP.dll)Úfind_signaturer$   Ú	signaturer&   Úget_ptr_with_offsetÚfirst_entry_offsetÚget_ptr)r   ÚpositionÚptr_entry_locÚ	ptr_entryr   r   r   Úfind_first_entry/   s
   €z!CloudapDecryptor.find_first_entryc           	   
   Ã   sp  �zœt ƒ }|j|_|jd u s|jjdkrW d S |j | j¡I d H }|j d¡ 	dd¡|_
|jdkr]|jjdkr]|j | j|j¡I d H }| j|ddd�\}}z| ¡ }W n   Y t|ƒ|_|jdkrˆ|j | j¡I d H }|d urˆ|j|_| j|jdd�\|_}t |j¡ ¡ |_|jd u r•|jd u r•W d S | j |¡ W d S  ty· } z|  d	| ¡ W Y d }~d S d }~ww )
Nr   z	utf-16-leú Ú Té   )Úbytes_expectedÚsegment_size)r7   z&CloudAP entry parsing error! Reason %s)r   ÚLocallyUniqueIdentifierr   Ú
cacheEntryÚvalueÚreadr&   ÚtonameÚdecodeÚreplacer   ÚcbPRTr	   Úread_rawÚdecrypt_passwordÚstrÚtoDetermineÚguidr
   Úunkr   ÚhashlibÚsha1Ú	hexdigestr   r%   ÚappendÚ	ExceptionÚlog)	r   Úcloudap_entryÚcredÚcacheÚptr_encÚtempÚraw_decrF   Úer   r   r   Ú	add_entry5   s:   €

€ÿzCloudapDecryptor.add_entryc              
   Ã   sŽ   �z|   ¡ I d H \}}W n ty& } z|  d| ¡ W Y d }~d S d }~ww | j |¡I d H  | jj | j¡I d H }|  || j	¡I d H  d S )Nz%Failed to find list entry! Reason: %s)
r3   rK   rL   r&   Úmover$   Ú
list_entryÚloadÚ	walk_listrT   )r   Úentry_ptr_valueÚentry_ptr_locrS   Ú	entry_ptrr   r   r   ÚstartV   s   €€þzCloudapDecryptor.start)r   r   r    r   r3   rT   r\   Ú__classcell__r   r   r)   r   r!   )   s
    !r!   )r   rG   Ú&pypykatz.alsadecryptor.package_commonsr   r   r!   r   r   r   r   Ú<module>   s
    $