o j@sdZddlTdZeeZdZdZdZdZ dZ dZ e Z d Z d Zd Zd Zd ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!dZ"dZ#dZ$dZ%d Z&d!Z'dZ(d"Z)d#Z*d$Z+d%Z,dZ-d&Z.dZ/dZ0dZ1dZ2d'Z3dZ4d"Z5d$Z6dZ7dZ8dZ9d&Z:dZ;d(ZGd+d,d,e?Z@Gd-d.d.e?ZAGd/d0d0e?ZBGd1d2d2e?ZCeDe@ZEeDeAZFeDeBZGeDeCZHeEZIeFZJeGZKeEZLdZMdZNdZOd&ZPdZQd(ZRd)ZSd*ZTd'ZUd3ZVd4ZWd5ZXd6ZYd7ZZd8Z[d9Z\d$Z]d:Z^d;Z_dZbd?Zcd@ZddAZedBZfdCZgdDZhdEZidFZjdGZkdHZld"ZmdIZndJZodKZpdLZqdMZrdNZsdOZtdPZudQZvdRZwdSZxeTZyeUZzemZ{enZ|dTZ}dUZ~dVZdWZdXZdYZdZZd[Zd\Zd]Zd^Zd_Zd`ZdaZdbZdcZddZdeZdfZdgZdhZdiZdjZdkZdlZdmZdnZdoZdpZdqZdrZdsZdtZduZdvZdwZdxZdyZdzZd{Zd|Zd}Zd~ZdZdZdZd#ZdZdZdZdZdZdZd&ZdZd(Zd)Zd*Zd'Zd3Zd4Zd=ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZGddde?ZGdddeӃZGddde?Ze֠DeաZddZddZddZddZddZddZddZddZddZddZeeeZddZddZddZddZddZdZdZdZdZdZdZdZdZdZdZdZdZdZdZeZeZeZeZeZeZeZeZeZeZeZeeeeeeeeeeeeeeeeeeeeeei ZdΐZdϐZdАZdѐZdҐZdӐZdԐZ dՐZ d֐Z dאZ dؐZ dِZdڐZdېZdܐZdݐZdސZeZeZeZeZeZeZeZe Ze Ze Ze Ze ZeZ eZ!eZ"eZ#eZ$eZ%ddZ&ddZ'ddZ(dddZ)ddZ*e&Z+e'Z,e(Z-eZ.e)e.Z/e*e.Z0e0d$?Z1dZ2dZ3dZ4d'Z5d$Z6d"Z7dZ8dZ9dZ:d&Z;dZdZ?dZ@dZAdZBdZCdZDdZEdZFdZGdZHd&ZIdZJd(ZKd)ZLd*ZMdZNdZOdZPd&ZQdZRd(ZSd)ZTd*ZUd'ZVd3ZWd4ZXd5ZYd6ZZdZ[dZ\d&Z]Gddde?Z^eDe^Z_e_Z`ddZaddZbeeaebZcddZdddZeeedeeZfeegeZddeDZhehidS)z Detect the current architecture and operating system. Some functions here are really from kernel32.dll, others from version.dll. )*Niiiiiiiiiiiiiiiiiilii@@i i ic@8eZdZdefdefdefdefdefdedfgZdS) OSVERSIONINFOAdwOSVersionInfoSizedwMajorVersiondwMinorVersion dwBuildNumber dwPlatformId szCSDVersionrN)__name__ __module__ __qualname__DWORDCHAR_fields_r r /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/readers/local/common/version.pyry rc@r) OSVERSIONINFOWrrrrrrrN)rrrrWCHARrr r r r!r#r"r#c @VeZdZdefdefdefdefdefdedfdefd efd efd efd efg Zd S)OSVERSIONINFOEXArrrrrrrwServicePackMajorwServicePackMinor wSuiteMask wProductType wReservedN)rrrrrWORDBYTErr r r r!r& r&c @r%)OSVERSIONINFOEXWrrrrrrrr'r(r)r*r+N)rrrrr$r,r-rr r r r!r/r.r/ !"#$%&'()*+,-./0123456789:;<=>?CDEFGHIJKLMNOPQRSTVWXY[\]ii i iiiiJii!iiHRiYi[i\ili'i'i'i5ghi i i i iqiOIc@seZdZdefdefgZdS)_SYSTEM_INFO_OEM_ID_STRUCTwProcessorArchitecturer+N)rrrr,rr r r r!rgrc@seZdZdefdefgZdS)_SYSTEM_INFO_OEM_IDdwOemIdwN)rrrrrrr r r r!rmrrc @seZdZdefdefdefdefdefdefdefdefd efd efg Zd d Z d dZ e e e Z ddZ ddZe e eZdS) SYSTEM_INFOid dwPageSizelpMinimumApplicationAddresslpMaximumApplicationAddressdwActiveProcessorMaskdwNumberOfProcessorsdwProcessorTypedwAllocationGranularitywProcessorLevelwProcessorRevisioncCs|jjSNrrselfr r r! __get_dwOemIdszSYSTEM_INFO.__get_dwOemIdcCs ||j_dSrrrvaluer r r! __set_dwOemIds zSYSTEM_INFO.__set_dwOemIdcCs |jjjSrrrrrr r r!__get_wProcessorArchitectures z(SYSTEM_INFO.__get_wProcessorArchitecturecCs||jj_dSrrrr r r!__set_wProcessorArchitecturesz(SYSTEM_INFO.__set_wProcessorArchitectureN)rrrrrLPVOID DWORD_PTRr,r_SYSTEM_INFO__get_dwOemId_SYSTEM_INFO__set_dwOemIdpropertyr(_SYSTEM_INFO__get_wProcessorArchitecture(_SYSTEM_INFO__set_wProcessorArchitecturerr r r r!rss$  rcC,tjj}tg|_d|_t}|t||Sr)windllkernel32 GetSystemInfo LPSYSTEM_INFOargtypesrestyperbyref)_GetSystemInfosysinfor r r!r  rcCrr)rrGetNativeSystemInforrrrr)_GetNativeSystemInforr r r!rrrcCs"tjj}tjg|_tj|_||Sr)ruser32GetSystemMetricsctypesc_intrr)nIndex_GetSystemMetricsr r r!rs rcCtjj}g|_t|_|Sr)rrGetLargePageMinimumrSIZE_Tr)_GetLargePageMinimumr r r!rsrcCrr)rrGetCurrentProcessrHANDLEr)_GetCurrentProcessr r r!rrcCrr)rrGetCurrentThreadrrr)_GetCurrentThreadr r r!rrrcCs<tjj}ttg|_t|_t|_ t t }||t |t|Sr) rrIsWow64ProcessrPBOOLrboolr RaiseIfZeroerrcheckBOOLFALSEr)hProcess_IsWow64Process Wow64Processr r r!rs rcCshtjj}g|_t|_t|_|}|d@}|d@d?}|d@dkr'|d@d?}nd}t|t|t|fS)Nrrrlrir ) rr GetVersionrrrrrint) _GetVersion dwVersionrrdwBuildr r r!rs  rcCtjj}ttg|_t|_t|_ t}t ||_ z |t |W|St y?t}t ||_ ttg|_|t |Y|Swr)rr GetVersionExAPOINTERr&rrrrrsizeofrr WindowsErrorr)_GetVersionExAosir r r!r      rcCrr)rr GetVersionExWrr/rrrrrrrrrr#)_GetVersionExWrr r r!rrrcCsFtjj}tttttg|_t|_t|_ td}|||||t ||j SNr) rrGetProductInforPDWORDrrrrrrr)dwOSMajorVersiondwOSMinorVersiondwSpMajorVersiondwSpMinorVersion_GetProductInfodwReturnedProductTyper r r!rsrcCs4t|tr t|||St|trt|||Std)NzBad OSVERSIONINFOEX structure) isinstancer&VerifyVersionInfoAr/VerifyVersionInfoW TypeError) lpVersionInfo dwTypeMaskdwlConditionMaskr r r!VerifyVersionInfo%s    rcC*tjj}tttg|_t|_|t |||Sr) rrrLPOSVERSIONINFOEXAr DWORDLONGrrrr)rrr_VerifyVersionInfoAr r r!r, rcCrr) rrrLPOSVERSIONINFOEXWrrrrrr)rrr_VerifyVersionInfoWr r r!r2rrcCs&tjj}tttg|_t|_||||Sr)rrVerSetConditionMask ULONGLONGrr-rr)r dwTypeBitMaskdwConditionMask_VerSetConditionMaskr r r!r=s  runknowni386mipsalphappcshxarmarm64thumbia64alpha64msilamd64sparcUnknown Windows NT Windows 2000 Windows XPWindows XP (64 bits) Windows 2003Windows 2003 (64 bits)Windows 2003 R2Windows 2003 R2 (64 bits) Windows 2008Windows 2008 (64 bits)Windows 2008 R2Windows 2008 R2 (64 bits) Windows VistaWindows Vista (64 bits) Windows 7Windows 7 (64 bits)cCs ttdS)z Determines the current integer size in bits. This is useful to know if we're running in a 32 bits or a 64 bits machine. @rtype: int @return: Returns the size of L{SIZE_T} in bits. r)rrr r r r! _get_bitss rcCsLzt}Wn tyt}Ynwzt|jjjWSty%tYSw)a9 Determines the current processor architecture. @rtype: str @return: On error, returns: - L{ARCH_UNKNOWN} (C{"unknown"}) meaning the architecture could not be detected or is not known to WinAppDbg. On success, returns one of the following values: - L{ARCH_I386} (C{"i386"}) for Intel 32-bit x86 processor or compatible. - L{ARCH_AMD64} (C{"amd64"}) for Intel 64-bit x86_64 processor or compatible. May also return one of the following values if you get both Python and WinAppDbg to work in such machines... let me know if you do! :) - L{ARCH_MIPS} (C{"mips"}) for MIPS compatible processors. - L{ARCH_ALPHA} (C{"alpha"}) for Alpha processors. - L{ARCH_PPC} (C{"ppc"}) for PowerPC compatible processors. - L{ARCH_SHX} (C{"shx"}) for Hitachi SH processors. - L{ARCH_ARM} (C{"arm"}) for ARM compatible processors. - L{ARCH_IA64} (C{"ia64"}) for Intel Itanium processor or compatible. - L{ARCH_ALPHA64} (C{"alpha64"}) for Alpha64 processors. - L{ARCH_MSIL} (C{"msil"}) for the .NET virtual machine. - L{ARCH_SPARC} (C{"sparc"}) for Sun Sparc processors. Probably IronPython returns C{ARCH_MSIL} but I haven't tried it. Python on Windows CE and Windows Mobile should return C{ARCH_ARM}. Python on Solaris using Wine would return C{ARCH_SPARC}. Python in an Itanium machine should return C{ARCH_IA64} both on Wine and proper Windows. All other values should only be returned on Linux using Wine. ) r Exceptionr _arch_maprrrKeyError ARCH_UNKNOWN)sir r r! _get_archs"    rcCs:tdkrd}|Sztt}W|Styd}Y|Sw)aF Determines if the current process is running in Windows-On-Windows 64 bits. @rtype: bool @return: C{True} of the current process is a 32 bit program running in a 64 bit version of Windows, C{False} if it's either a 32 bit program in a 32 bit Windows or a 64 bit program in a 64 bit Windows. r F)bitsrrr)wow64r r r! _get_wow64s   rcCsJ|st}|jtkr|jdkr|jdkrP|jdkr2|jtkr(tdks$tr&dSdStdks.tr0dSdS|jd krP|jtkrFtdksBtrDd Sd StdksLtrNd Sd S|jdkr|jdkrt t rhtdksdtrfdSdS|j t t fvrytdksutrwdSdS|jtkrttkrdStdkstrdSdS|jd krdS|jdkrdS|jdkrdSdS)ad Determines the current operating system. This function allows you to quickly tell apart major OS differences. For more detailed information call L{GetVersionEx} instead. @note: Wine reports itself as Windows XP 32 bits (even if the Linux host is 64 bits). ReactOS may report itself as Windows 2000 or Windows XP, depending on the version of ReactOS. @type osvi: L{OSVERSIONINFOEXA} @param osvi: Optional. The return value from L{GetVersionEx}. @rtype: str @return: One of the following values: - L{OS_UNKNOWN} (C{"Unknown"}) - L{OS_NT} (C{"Windows NT"}) - L{OS_W2K} (C{"Windows 2000"}) - L{OS_XP} (C{"Windows XP"}) - L{OS_XP_64} (C{"Windows XP (64 bits)"}) - L{OS_W2K3} (C{"Windows 2003"}) - L{OS_W2K3_64} (C{"Windows 2003 (64 bits)"}) - L{OS_W2K3R2} (C{"Windows 2003 R2"}) - L{OS_W2K3R2_64} (C{"Windows 2003 R2 (64 bits)"}) - L{OS_W2K8} (C{"Windows 2008"}) - L{OS_W2K8_64} (C{"Windows 2008 (64 bits)"}) - L{OS_W2K8R2} (C{"Windows 2008 R2"}) - L{OS_W2K8R2_64} (C{"Windows 2008 R2 (64 bits)"}) - L{OS_VISTA} (C{"Windows Vista"}) - L{OS_VISTA_64} (C{"Windows Vista (64 bits)"}) - L{OS_W7} (C{"Windows 7"}) - L{OS_W7_64} (C{"Windows 7 (64 bits)"}) rrrr rrrr rrrrrrrr r r r rrrrr) GetVersionExrVER_PLATFORM_WIN32_NTrrr*VER_NT_WORKSTATIONrrr SM_SERVERR2r)VER_SUITE_STORAGE_SERVERVER_SUITE_WH_SERVERarch ARCH_AMD64)osvir r r!_get_ossT&                 r(cCsV|st}d}||jd@d>7}||jd@d>7}||jd@d>7}||jd@7}|S)aD Determines the current operating system. This function allows you to quickly tell apart major OS differences. For more detailed information call L{kernel32.GetVersionEx} instead. @note: Wine reports itself as Windows XP 32 bits (even if the Linux host is 64 bits). ReactOS may report itself as Windows 2000 or Windows XP, depending on the version of ReactOS. @type osvi: L{OSVERSIONINFOEXA} @param osvi: Optional. The return value from L{kernel32.GetVersionEx}. @rtype: int @return: NTDDI version number. rrr>r r)rrrr'r()r'ntddir r r! _get_ntddi4sr*iiiiiiiiic@s^eZdZdefdefdefdefdefdefdefdefd efd efd efd efd efg ZdS)VS_FIXEDFILEINFO dwSignaturedwStrucVersiondwFileVersionMSdwFileVersionLSdwProductVersionMSdwProductVersionLSdwFileFlagsMask dwFileFlagsdwFileOS dwFileType dwFileSubtype dwFileDateMS dwFileDateLSN)rrrrrr r r r!r+sr+cCjtjj}ttttg|_t|_t |_ tjj }ttg|_t|_t |_ ||d}t |}||d|t||Sr)rversionGetFileVersionInfoALPSTRrrrrrrrGetFileVersionInfoSizeArcreate_string_bufferr)lptstrFilename_GetFileVersionInfoA_GetFileVersionInfoSizeAdwLenlpDatar r r!r;   r;cCr9r)rr:GetFileVersionInfoWLPWSTRrrrrrrrGetFileVersionInfoSizeWrr>r)r?_GetFileVersionInfoW_GetFileVersionInfoSizeWrBrCr r r!rErDrEcCVtjj}tttttg|_t|_ t |_ td}td}|||t |t |||j fSr)rr:VerQueryValueArr<rUINTrrrrrrr)pBlock lpSubBlock_VerQueryValueAlpBufferuLenr r r!rK rKcCrJr)rr:VerQueryValueWrrFrrLrrrrrrr)rMrN_VerQueryValueWrPrQr r r!rSrRrScCsg|] }|ds|qS)_) startswith).0_xr r r! srYr(j__doc__defines_allsetvarskeys NTDDI_WIN8 NTDDI_WIN7SP1 NTDDI_WIN7 NTDDI_WS08NTDDI_VISTASP1 NTDDI_VISTANTDDI_LONGHORN NTDDI_WS03SP2 NTDDI_WS03SP1 NTDDI_WS03NTDDI_WINXPSP3NTDDI_WINXPSP2NTDDI_WINXPSP1 NTDDI_WINXPNTDDI_WIN2KSP4NTDDI_WIN2KSP3NTDDI_WIN2KSP2NTDDI_WIN2KSP1 NTDDI_WIN2K NTDDI_WINNT4OSVERSION_MASKSPVERSION_MASKSUBVERSION_MASKVER_PLATFORM_WIN32sVER_PLATFORM_WIN32_WINDOWSr VER_SUITE_BACKOFFICEVER_SUITE_BLADEVER_SUITE_COMPUTE_SERVERVER_SUITE_DATACENTERVER_SUITE_ENTERPRISEVER_SUITE_EMBEDDEDNTVER_SUITE_PERSONALVER_SUITE_SINGLEUSERTSVER_SUITE_SMALLBUSINESS"VER_SUITE_SMALLBUSINESS_RESTRICTEDr#VER_SUITE_TERMINALr$VER_NT_DOMAIN_CONTROLLER VER_NT_SERVERr!VER_BUILDNUMBERVER_MAJORVERSIONVER_MINORVERSIONVER_PLATFORMIDVER_PRODUCT_TYPEVER_SERVICEPACKMAJORVER_SERVICEPACKMINOR VER_SUITENAME VER_EQUAL VER_GREATERVER_GREATER_EQUALVER_LESSVER_LESS_EQUALVER_ANDVER_OR Structurerr#r&r/rLPOSVERSIONINFOALPOSVERSIONINFOWrrPOSVERSIONINFOAPOSVERSIONINFOWPOSVERSIONINFOEXAPOSVERSIONINFOEXW SM_CXSCREEN SM_CYSCREEN SM_CXVSCROLL SM_CYHSCROLL SM_CYCAPTION SM_CXBORDER SM_CYBORDER SM_CXDLGFRAME SM_CYDLGFRAME SM_CYVTHUMB SM_CXHTHUMB SM_CXICON SM_CYICON SM_CXCURSOR SM_CYCURSOR SM_CYMENUSM_CXFULLSCREENSM_CYFULLSCREENSM_CYKANJIWINDOWSM_MOUSEPRESENT SM_CYVSCROLL SM_CXHSCROLLSM_DEBUG SM_SWAPBUTTON SM_RESERVED1 SM_RESERVED2 SM_RESERVED3 SM_RESERVED4SM_CXMINSM_CYMIN SM_CXSIZE SM_CYSIZE SM_CXFRAME SM_CYFRAME SM_CXMINTRACK SM_CYMINTRACKSM_CXDOUBLECLKSM_CYDOUBLECLKSM_CXICONSPACINGSM_CYICONSPACINGSM_MENUDROPALIGNMENT SM_PENWINDOWSSM_DBCSENABLEDSM_CMOUSEBUTTONSSM_CXFIXEDFRAMESM_CYFIXEDFRAMESM_CXSIZEFRAMESM_CYSIZEFRAME SM_SECURE SM_CXEDGE SM_CYEDGESM_CXMINSPACINGSM_CYMINSPACING SM_CXSMICON SM_CYSMICONSM_CYSMCAPTION SM_CXSMSIZE SM_CYSMSIZE SM_CXMENUSIZE SM_CYMENUSIZE SM_ARRANGESM_CXMINIMIZEDSM_CYMINIMIZED SM_CXMAXTRACK SM_CYMAXTRACKSM_CXMAXIMIZEDSM_CYMAXIMIZED SM_NETWORK SM_CLEANBOOT SM_CXDRAG SM_CYDRAG SM_SHOWSOUNDSSM_CXMENUCHECKSM_CYMENUCHECKSM_SLOWMACHINESM_MIDEASTENABLEDSM_MOUSEWHEELPRESENTSM_XVIRTUALSCREENSM_YVIRTUALSCREENSM_CXVIRTUALSCREENSM_CYVIRTUALSCREEN SM_CMONITORSSM_SAMEDISPLAYFORMAT SM_IMMENABLEDSM_CXFOCUSBORDERSM_CYFOCUSBORDER SM_TABLETPCSM_MEDIACENTER SM_STARTERr"SM_MOUSEHORIZONTALWHEELPRESENTSM_CXPADDEDBORDER SM_CMETRICSSM_REMOTESESSIONSM_SHUTTINGDOWNSM_REMOTECONTROLSM_CARETBLINKINGENABLEDPROCESSOR_ARCHITECTURE_UNKNOWNPROCESSOR_ARCHITECTURE_INTELPROCESSOR_ARCHITECTURE_MIPSPROCESSOR_ARCHITECTURE_ALPHAPROCESSOR_ARCHITECTURE_PPCPROCESSOR_ARCHITECTURE_SHXPROCESSOR_ARCHITECTURE_ARMPROCESSOR_ARCHITECTURE_IA64PROCESSOR_ARCHITECTURE_ALPHA64PROCESSOR_ARCHITECTURE_MSILPROCESSOR_ARCHITECTURE_AMD64$PROCESSOR_ARCHITECTURE_IA32_ON_WIN64PROCESSOR_ARCHITECTURE_SPARCPROCESSOR_INTEL_386PROCESSOR_INTEL_486PROCESSOR_INTEL_PENTIUMPROCESSOR_INTEL_IA64PROCESSOR_AMD_X8664PROCESSOR_MIPS_R4000PROCESSOR_ALPHA_21064PROCESSOR_PPC_601PROCESSOR_PPC_603PROCESSOR_PPC_604PROCESSOR_PPC_620PROCESSOR_HITACHI_SH3PROCESSOR_HITACHI_SH3EPROCESSOR_HITACHI_SH4PROCESSOR_MOTOROLA_821PROCESSOR_SHx_SH3PROCESSOR_SHx_SH4PROCESSOR_STRONGARMPROCESSOR_ARM720PROCESSOR_ARM820PROCESSOR_ARM920PROCESSOR_ARM_7TDMIPROCESSOR_OPTILrUnionrrrrrrrrrrrrrrGuessStringTyperrrrrrr ARCH_I386 ARCH_MIPS ARCH_ALPHAARCH_PPCARCH_SHXARCH_ARM ARCH_ARM64 ARCH_THUMB ARCH_IA64 ARCH_ALPHA64 ARCH_MSILr& ARCH_SPARC ARCH_IA32ARCH_X86ARCH_X64 ARCH_ARM7 ARCH_ARM8ARCH_T32 ARCH_AARCH32 ARCH_AARCH64 ARCH_POWERPC ARCH_HITACHI ARCH_ITANIUMr OS_UNKNOWNOS_NTOS_W2KOS_XPOS_XP_64OS_W2K3 OS_W2K3_64 OS_W2K3R2 OS_W2K3R2_64OS_W2K8 OS_W2K8_64 OS_W2K8R2 OS_W2K8R2_64OS_VISTA OS_VISTA_64OS_W7OS_W7_64OS_SEVEN OS_SEVEN_64 OS_WINDOWS_NTOS_WINDOWS_2000 OS_WINDOWS_XPOS_WINDOWS_XP_64OS_WINDOWS_2003OS_WINDOWS_2003_64OS_WINDOWS_2003_R2OS_WINDOWS_2003_R2_64OS_WINDOWS_2008OS_WINDOWS_2008_64OS_WINDOWS_2008_R2OS_WINDOWS_2008_R2_64OS_WINDOWS_VISTAOS_WINDOWS_VISTA_64OS_WINDOWS_SEVENOS_WINDOWS_SEVEN_64rrrr(r*rr%r_osvios NTDDI_VERSIONWINVER VS_FF_DEBUGVS_FF_PRERELEASE VS_FF_PATCHEDVS_FF_PRIVATEBUILDVS_FF_INFOINFERREDVS_FF_SPECIALBUILD VOS_UNKNOWNVOS__WINDOWS16 VOS__PM16 VOS__PM32VOS__WINDOWS32VOS_DOS VOS_OS216 VOS_OS232VOS_NTVOS_DOS_WINDOWS16VOS_DOS_WINDOWS32VOS_NT_WINDOWS32VOS_OS216_PM16VOS_OS232_PM32 VFT_UNKNOWNVFT_APPVFT_DLLVFT_DRVVFT_FONTVFT_VXD VFT_RESERVEDVFT_STATIC_LIB VFT2_UNKNOWNVFT2_DRV_PRINTERVFT2_DRV_KEYBOARDVFT2_DRV_LANGUAGEVFT2_DRV_DISPLAYVFT2_DRV_MOUSEVFT2_DRV_NETWORKVFT2_DRV_SYSTEMVFT2_DRV_INSTALLABLEVFT2_DRV_SOUND VFT2_DRV_COMMVFT2_DRV_RESERVEDVFT2_DRV_VERSIONED_PRINTERVFT2_FONT_RASTERVFT2_FONT_VECTORVFT2_FONT_TRUETYPEr+PVS_FIXEDFILEINFOLPVS_FIXEDFILEINFOr;rEGetFileVersionInforKrS VerQueryValue difference__all__sortr r r r!s            +  T