o
    Žõ±j£  ã                   @   sV   d dl Z d dlZd dlmZ d dlmZ d dlmZ G dd„ dƒZG dd„ deƒZ	dS )	é    N)Úlogger)ÚPackageDecryptor)ÚPRTL_AVL_TABLEc                   @   s,   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	S )
ÚTspkgCredentialc                 C   s(   d| _ d | _d | _d | _d| _d | _d S )NÚtspkgó    ©ÚcredtypeÚusernameÚ
domainnameÚpasswordÚpassword_rawÚluid©Úself© r   ú¢/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/alsadecryptor/packages/tspkg/decryptor.pyÚ__init__   s   
zTspkgCredential.__init__c                 C   sD   i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< |S )Nr	   r
   r   r   r   r   r   ©r   Útr   r   r   Úto_dict   s   





zTspkgCredential.to_dictc                 C   s   t  |  ¡ ¡S )N)ÚjsonÚdumpsr   r   r   r   r   Úto_json    s   zTspkgCredential.to_jsonc                 C   sJ   d| j  }|d| j 7 }|d| j 7 }|d| j 7 }|d| j ¡  7 }|S )Nz	== TSPKG [%x]==
z		username %s
z		domainname %s
z		password %s
z		password (hex)%s
)r   r
   r   r   r   Úhexr   r   r   r   Ú__str__#   s   
zTspkgCredential.__str__N)Ú__name__Ú
__module__Ú__qualname__r   r   r   r   r   r   r   r   r      s
    
r   c                       s,   e Zd Z‡ fdd„Zdd„ Zdd„ Z‡  ZS )ÚTspkgDecryptorc                    s"   t ƒ  d|||¡ || _g | _d S )NÚTspkg)Úsuperr   Údecryptor_templateÚcredentials)r   Úreaderr"   Úlsa_decryptorÚsysinfo©Ú	__class__r   r   r   ,   s   
zTspkgDecryptor.__init__c                 Ã   sL   �|   d| jj¡I d H }| j || jj ¡I d H }| j |¡I d H }||fS )Nz	TSpkg.dll)Úfind_signaturer"   Ú	signaturer$   Úget_ptr_with_offsetÚ
avl_offsetÚget_ptr)r   ÚpositionÚptr_entry_locÚ	ptr_entryr   r   r   Úfind_first_entry2   s
   €zTspkgDecryptor.find_first_entryc              
   Ã   s   �z|   ¡ I d H \}}W n ty& } z|  d| ¡ W Y d }~d S d }~ww g }| j |¡I d H  zt | j¡I d H }| | j¡I d H }W n ty` } zt 	d| ¡ W Y d }~d S d }~ww |  
|jj|¡I d H  |D ]�}|  || jjj¡I d H  | j |¡I d H  | jj | j¡I d H }|j | j¡I d H }	|	d urýtƒ }
|j|
_|	jj | j¡I d H |
_|	jj | j¡I d H |
_|	jjjdkr÷|	jj | j¡I d H }|
j d¡du rî| j|dd�\|
_ |
_!|
j d urí|
j  "¡ |
_ n	|  |¡\|
_ |
_!| j #|
¡ qnd S )Nz"Failed to find structs! Reason: %sz*Failed to prcess TSPKG package! Reason: %sr   ú$T)Úbytes_expected)$r1   Ú	ExceptionÚlogr$   Úmover   ÚloadÚreadr   ÚerrorÚwalk_avlÚBalancedRootÚ
RightChildÚlog_ptrr"   Úcredential_structr   Ú
pTsPrimaryr   ÚLocallyUniqueIdentifierr   r#   ÚUserNameÚread_stringr   ÚDomainer
   ÚPasswordÚLengthÚread_maxdataÚendswithÚdecrypt_passwordr   r   r   Úappend)r   Úentry_ptr_valueÚentry_ptr_locÚeÚresult_ptr_listÚptableÚ
start_nodeÚptrr>   Úprimary_credentialÚcÚenc_datar   r   r   Ústart8   sP   €€þ€þ
€€çzTspkgDecryptor.start)r   r   r   r   r1   rT   Ú__classcell__r   r   r'   r   r   +   s    r   )
Úior   Úpypykatzr   Ú&pypykatz.alsadecryptor.package_commonsr   Ú$pypykatz.alsadecryptor.win_datatypesr   r   r   r   r   r   r   Ú<module>   s   