o
    Žõ±jº ã                
   @   sÌ  d Z ddlT ddlT dZeeƒ  ¡ ƒZdZdZdZ	dZ
dZd	Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!dZ"d Z#d!Z$d"Z%d#Z&d$Z'd%Z(d&Z)dZ*d'Z+d(Z,d)Z-d*Z.dZ/d'Z0dZ1d'Z2d(Z3d+Z4d,Z5d*Z.d-Z6d.Z7d/Z8e9e4B Z:e;e1B e2B e3B e4B e5B e.B e6B e7B e8B Z<d)Z=d0Z>d1Z?d2Z@d3ZAd4ZBd5ZCd*ZDd(ZEd+ZFd6ZGd,ZHdZId6ZJd'ZKd7ZLd/ZMd8ZNd9ZOdZPd'ZQd:ZRd(ZSeSZTd;ZUd<ZVd=ZWd+ZXd>ZYd?ZZd@Z[e[Z\G dAdB„ dBe]ƒZ^e_e^ƒZ`G dCdD„ dDe]ƒZaG dEdF„ dFe]ƒZbe_ebƒZcedjeZfdZgd'Zhd:Zid(Zjd;Zkd<Zld=Zmd+Znd>Zod?Zpd@ZqdGZrdHZsdIZtdJZud,ZvdKZwdLZxdMZydNZzdOZ{dPZ|dQZ}dRZ~dSZdTZ€dUZ�dVZ‚dWZƒdXZ„dYZ…d*Z†dZZ‡d[Zˆd\Z‰d]ZŠd^Z‹d_ZŒd`Z�daZŽdbZ�edjeZ�e_e�ƒZ‘dZ’d'Z“dZ”d'Z•d:Z–edjeZ—e_e—ƒZ˜d9Z™dZšd'Z›d:ZœedjeZ�e_e�ƒZžG dcdd„ dde]ƒZŸe_eŸƒZ G dedf„ dfe]ƒZ¡e_e¡ƒZ¢G dgdh„ dhe]ƒZ£e_e£ƒZ¤G didj„ dje]ƒZ¥e_e¥ƒZ¦G dkdl„ dle]ƒZ§e_e§ƒZ¨G dmdn„ dne]ƒZ©e_e©ƒZªG dodp„ dpe]ƒZ«e_e«ƒZ¬G dqdr„ dre]ƒZ­e_e­ƒZ®G dsdt„ dte]ƒZ¯e_e¯ƒZ°dZ±d'Z²d:Z³d(Z´d;Zµd<Z¶d=Z·d+Z¸d>Z¹d?Zºd,Z»d.Z¼dZ½e½Z¾dZ¿d'ZÀd(ZÁe¿eÀB eÁB ZÂeÃZÄeÅZÆdZÇd'ZÈd:ZÉd(ZÊd;ZËd<ZÌd=ZÍd+ZÎd>ZÏd?ZÐd@ZÑeÅZÒdZÓd'ZÔd:ZÕd(ZÖd;Z×d<ZØd=ZÙd+ZÚd>ZÛd?ZÜd@ZÝG dudv„ dve]ƒZÞG dwdx„ dxe]ƒZßG dydz„ dzeàƒZáG d{d|„ d|e]ƒZâe_eâƒZãG d}d~„ d~eäƒZåG dd€„ d€eæƒZçeæZèdZéd'ZêdZëd9Zìd�Zíd‚ZîdƒZïd„ZðeÅZñdZòd'Zód:Zôd(Zõd;ZödZ÷d'Zød(Zùd+ZúdJZûeæZüd…Zýd†Zþd…Zÿd†�Z d‡�Zd‡�Zdˆ�Zedje�Zd9�Zedje�Zd9�Zd‰�Zd�Z	d'�Z
d(�Zd+�Zd,�Zd*�Zd-�Zd.�Zd/�Zd5�Zd�Zd'�Zd(�Zd+�Zd,�Zd*�Zd9�Zd�Zd'�Zd:�Zd(�Zd9�Zd�Zd'�Z d:�Z!d�Z"d'�Z#d:�Z$d�Z%d'�Z&d(�Z'd+�Z(d,�Z)d*�Z*d/�Z+d@�Z,dŠ�Z-d�Z.d'�Z/d:�Z0d(�Z1d;�Z2d<�Z3d=�Z4d�Z5d'�Z6d(�Z7d+�Z8d,�Z9d*�Z:d-�Z;d.�Z<d/�Z=d�Z>d�Z?d'�Z@d:�ZAd(�ZBd;�ZCd<�ZDd=�ZEd+�ZFd>�ZGd?�ZHd@�ZIdG�ZJdH�ZKdI�ZLd�Z5d'�Z6d(�Z7d+�Z8d,�Z9d*�Z:d-�Z;d.�Z<d/�Z=d7�ZMd‹�ZNdŒ�ZOd9�ZPd�ZQd'�ZRd:�ZSd�ZTd'�ZUG d�dŽ„ dŽe]ƒ�ZVe_�eVƒ�ZWG d�d�„ d�e]ƒ�ZXe_�eXƒ�ZYG d‘d’„ d’e]ƒ�ZZG d“d”„ d”e]ƒ�Z[e_�eZƒ�Z\e_�e[ƒ�Z]G d•d–„ d–e]ƒ�Z^G d—d˜„ d˜e]ƒ�Z_e_�e^ƒ�Z`e_�e_ƒ�ZaG d™dš„ dšeäƒ�ZbG d›dœ„ dœeäƒ�ZcG d�dž„ džeäƒ�ZdG dŸd „ d eäƒ�ZeG d¡d¢„ d¢eæƒ�ZfG d£d¤„ d¤�egƒ�ZhG d¥d¦„ d¦�egƒ�ZiG d§d¨„ d¨�egƒ�ZjG d©dª„ dª�egƒ�Zkd«d¬„ �Zld­d®„ �Zm�en�el�emƒ�Zod¯d°„ �Zpd±d²„ �Zq�er�ep�eqƒ�Zsd³d´„ �Ztdµd¶„ �Zu�er�et�euƒ�Zvd·d¸„ �Zwd¹dº„ �Zx�en�ew�exƒ�Zyd»d¼„ �Zzd½d¾„ �Z{�er�ez�e{ƒ�Z|d¿dÀ„ �Z}dÁdÂ„ �Z~dÃdÄ„ �ZdÅdÆ„ �Z€dÇdÈ„ �Z�e<fdÉdÊ„�Z‚�dsdÌdÍ„�Zƒe›fdÎdÏ„�Z„e<de›e’fdÐdÑ„�Z…dÒdÓ„ �Z†dÔdÕ„ �Z‡dÖd×„ �Zˆ�er�e‡�eˆƒ�Z‰dØdÙ„ �ZŠdÚdÛ„ �Z‹�er�eŠ�e‹ƒ�ZŒ�dtdÝdÞ„�Z�dßdà„ �ZŽdádâ„ �Z�dãdä„ �Z��dudådæ„�Z‘�e’�e‘ƒ�Z“�en�e“�e‘ƒ�Z”�dvdçdè„�Z•�e’�e•ƒ�Z–�en�e–�e•ƒ�Z—�dwdêdë„�Z˜�dwdìdí„�Z™�er�e˜�e™ƒ�Zš�e›eÄ�eœeÅ�e�eã�ežƒ�ZŸ�dxdîdï„�Z deÂdðe»fdñdò„�Z¡dódô„ �Z¢eêeïd9fdõdö„�Z£�dyd÷dø„�Z¤dùdú„ �Z¥�dzdûdü„�Z¦�e¦�Z§dýdþ„ �Z¨de?fdÿ�d „�Z©de?f�d�d„�Zª�er�e©�eªƒ�Z«e?df�d�d„�Z¬e?df�d�d„�Z­�er�e¬�e­ƒ�Z®e?df�d�d„�Z¯e?df�d	�d
„�Z°�er�e¯�e°ƒ�Z±e?deCf�d�d„�Z²e?deCf�d�d„�Z³�er�e²�e³ƒ�Z´eCf�d�d„�ZµeCf�d�d„�Z¶�d{�d�d„�Z·�d{�d�d„�Z¸�er�e·�e¸ƒ�Z¹�d|�d�d„�Zº�d�d„ �Z»�d|�d�d„�Z¼�d|�d�d„�Z½�er�e¼�e½ƒ�Z¾�d}�d�d „�Z¿�e¿ �ZÀ�ZÁ�d!�d"„ �ZÂ�d#�d$„ �ZÃ�en�eÂ�eÃƒ�ZÄ�ds�d%�d&„�ZÅ�ds�d'�d(„�ZÆ�ds�d)�d*„�ZÇ�en�eÆ�eÇƒ�ZÈ�d{�d+�d,„�ZÉ�d{�d-�d.„�ZÊ�er�eÉ�eÊƒ�ZË�d~�d/�d0„�ZÌ�d~�d1�d2„�ZÍ�er�eÌ�eÍƒ�ZÎ�d{�d3�d4„�ZÏ�d{�d5�d6„�ZÐ�er�eÏ�eÐƒ�ZÑdeLf�d7�d8„�ZÒdeLf�d9�d:„�ZÓ�er�eÒ�eÓƒ�ZÔ�d;�d<„ �ZÕ�d=�d>„ �ZÖ�er�eÕ�eÖƒ�Z×�d{�d?�d@„�ZØ�d{�dA�dB„�ZÙ�er�eØ�eÙƒ�ZÚ�dC�dD„ �ZÛ�dE�dF„ �ZÜdd�ef�dG�dH„�ZÝdd�ef�dI�dJ„�ZÞ�er�eÝ�eÞƒ�Zß�ef�dK�dL„�Zà�ef�dM�dN„�Zá�er�eà�eáƒ�Zâd�e�e)�e�edddddf
�dO�dP„�Zãd�e�e)�e�edddddf
�dQ�dR„�Zä�er�eã�eäƒ�Zå�dS�dT„ �Zæ�dU�dV„ �Zç�dW�dX„ �Zè�er�eç�eèƒ�Zé�dY�dZ„ �Zê�d[�d\„ �Zë�er�eê�eëƒ�Zì�d{�d]�d^„�Zí�d{�d_�d`„�Zî�er�eí�eîƒ�Zï�da�db„ �Zð�dc�dd„ �Zñ�ef�de�df„�Zò�e,�e-B �e$f�dg�dh„�Zó�e,�e-B �e$f�di�dj„�Zô�en�eó�eôƒ�Zõ�e�e,�e-B �e$df�dk�dl„�Zö�e�e,�e-B �e$df�dm�dn„�Z÷�en�eö�e÷ƒ�Zø�d{�do�dp„�Zùeeƒ  ¡ ƒ� úe¡Z�dq�dr„ eD ƒ�Zû�eû� ü¡  dS (  z%
Wrapper for advapi32.dll in ctypes.
é   )Ú*NÚSeAssignPrimaryTokenPrivilegeÚSeAuditPrivilegeÚSeBackupPrivilegeÚSeChangeNotifyPrivilegeÚSeCreateGlobalPrivilegeÚSeCreatePagefilePrivilegeÚSeCreatePermanentPrivilegeÚSeCreateSymbolicLinkPrivilegeÚSeCreateTokenPrivilegeÚSeDebugPrivilegeÚSeEnableDelegationPrivilegeÚSeImpersonatePrivilegeÚSeIncreaseBasePriorityPrivilegeÚSeIncreaseQuotaPrivilegeÚSeIncreaseWorkingSetPrivilegeÚSeLoadDriverPrivilegeÚSeLockMemoryPrivilegeÚSeMachineAccountPrivilegeÚSeManageVolumePrivilegeÚSeProfileSingleProcessPrivilegeÚSeRelabelPrivilegeÚSeRemoteShutdownPrivilegeÚSeRestorePrivilegeÚSeSecurityPrivilegeÚSeShutdownPrivilegeÚSeSyncAgentPrivilegeÚSeSystemEnvironmentPrivilegeÚSeSystemProfilePrivilegeÚSeSystemtimePrivilegeÚSeTakeOwnershipPrivilegeÚSeTcbPrivilegeÚSeTimeZonePrivilegeÚSeTrustedCredManAccessPrivilegeÚSeUndockPrivilegeÚSeUnsolicitedInputPrivilegeé   é   l        é    é   é   é@   é€   é   l       l       l       l       l       i?  i  é   i  é    é   é   é   é   é	   é
   é   c                   @   ó   e Zd ZdefdefgZdS )ÚLUIDÚLowPartÚHighPartN)Ú__name__Ú
__module__Ú__qualname__ÚDWORDÚLONGÚ_fields_© rA   rA   ú¡/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/readers/local/common/advapi32.pyr8   �   ó    þr8   c                   @   r7   )ÚLUID_AND_ATTRIBUTESÚLuidÚ
AttributesN)r;   r<   r=   r8   r>   r@   rA   rA   rA   rB   rD   ª   rC   rD   c                   @   r7   )ÚTOKEN_PRIVILEGESÚPrivilegeCountÚ
PrivilegesN)r;   r<   r=   r>   rD   r@   rA   rA   rA   rB   rG   µ   s    ýrG   é   é   é   é   é   é   é   é   é   é   é   é   é   é   é   é   é   é   é   é!   é"   é#   é$   é%   é&   é'   é(   é)   c                   @   r7   )ÚSID_AND_ATTRIBUTESÚSidrF   N)r;   r<   r=   ÚPSIDr>   r@   rA   rA   rA   rB   rf   D  rC   rf   c                   @   ó   e Zd ZdefgZdS )Ú
TOKEN_USERÚUserN©r;   r<   r=   rf   r@   rA   rA   rA   rB   rj   N  ó    ÿrj   c                   @   ri   )ÚTOKEN_MANDATORY_LABELÚLabelNrl   rA   rA   rA   rB   rn   W  rm   rn   c                   @   ri   )ÚTOKEN_OWNERÚOwnerN©r;   r<   r=   rh   r@   rA   rA   rA   rB   rp   `  rm   rp   c                   @   ri   )ÚTOKEN_PRIMARY_GROUPÚPrimaryGroupNrr   rA   rA   rA   rB   rs   i  rm   rs   c                   @   ri   )ÚTOKEN_APPCONTAINER_INFORMATIONÚTokenAppContainerNrr   rA   rA   rA   rB   ru   r  rm   ru   c                   @   ri   )ÚTOKEN_ORIGINÚOriginatingLogonSessionN)r;   r<   r=   r8   r@   rA   rA   rA   rB   rw   {  rm   rw   c                   @   ri   )ÚTOKEN_LINKED_TOKENÚLinkedTokenN)r;   r<   r=   ÚHANDLEr@   rA   rA   rA   rB   ry   „  rm   ry   c                   @   sL   e Zd Zdefdefdefdefdefdefdefdefd	efd
efg
ZdS )ÚTOKEN_STATISTICSÚTokenIdÚAuthenticationIdÚExpirationTimeÚ	TokenTypeÚImpersonationLevelÚDynamicChargedÚDynamicAvailableÚ
GroupCountrH   Ú
ModifiedIdN)	r;   r<   r=   r8   ÚLONGLONGÚ
TOKEN_TYPEÚSECURITY_IMPERSONATION_LEVELr>   r@   rA   rA   rA   rB   r|   –  s    ör|   c                   @   s&   e Zd Zdee fdefdefgZdS )Ú_WAITCHAIN_NODE_INFO_STRUCT_1Ú
ObjectNameÚTimeoutÚ	AlertableN)r;   r<   r=   ÚWCHARÚWCT_OBJNAME_LENGTHr†   ÚBOOLr@   rA   rA   rA   rB   r‰     s
    
ýr‰   c                   @   s(   e Zd ZdefdefdefdefgZdS )Ú_WAITCHAIN_NODE_INFO_STRUCT_2Ú	ProcessIdÚThreadIdÚWaitTimeÚContextSwitchesN©r;   r<   r=   r>   r@   rA   rA   rA   rB   r�     s    ür�   c                   @   r7   )Ú_WAITCHAIN_NODE_INFO_UNIONÚ
LockObjectÚThreadObjectN)r;   r<   r=   r‰   r�   r@   rA   rA   rA   rB   r–   '  rC   r–   c                   @   s"   e Zd ZdefdefdefgZdS )ÚWAITCHAIN_NODE_INFOÚ
ObjectTypeÚObjectStatusÚuN)r;   r<   r=   ÚWCT_OBJECT_TYPEÚWCT_OBJECT_STATUSr–   r@   rA   rA   rA   rB   r™   -  ó
    ýr™   c                   @   ó   e Zd ZdZdd„ ZdS )ÚWaitChainNodeInfoa  
	Represents a node in the wait chain.

	It's a wrapper on the L{WAITCHAIN_NODE_INFO} structure.

	The following members are defined only
	if the node is of L{WctThreadType} type:
	 - C{ProcessId}
	 - C{ThreadId}
	 - C{WaitTime}
	 - C{ContextSwitches}

	@see: L{GetThreadWaitChain}

	@type ObjectName: unicode
	@ivar ObjectName: Object name. May be an empty string.

	@type ObjectType: int
	@ivar ObjectType: Object type.
		Should be one of the following values:
		 - L{WctCriticalSectionType}
		 - L{WctSendMessageType}
		 - L{WctMutexType}
		 - L{WctAlpcType}
		 - L{WctComType}
		 - L{WctThreadWaitType}
		 - L{WctProcessWaitType}
		 - L{WctThreadType}
		 - L{WctComActivationType}
		 - L{WctUnknownType}

	@type ObjectStatus: int
	@ivar ObjectStatus: Wait status.
		Should be one of the following values:
		 - L{WctStatusNoAccess} I{(ACCESS_DENIED for this object)}
		 - L{WctStatusRunning} I{(Thread status)}
		 - L{WctStatusBlocked} I{(Thread status)}
		 - L{WctStatusPidOnly} I{(Thread status)}
		 - L{WctStatusPidOnlyRpcss} I{(Thread status)}
		 - L{WctStatusOwned} I{(Dispatcher object status)}
		 - L{WctStatusNotOwned} I{(Dispatcher object status)}
		 - L{WctStatusAbandoned} I{(Dispatcher object status)}
		 - L{WctStatusUnknown} I{(All objects)}
		 - L{WctStatusError} I{(All objects)}

	@type ProcessId: int
	@ivar ProcessId: Process global ID.

	@type ThreadId: int
	@ivar ThreadId: Thread global ID.

	@type WaitTime: int
	@ivar WaitTime: Wait time.

	@type ContextSwitches: int
	@ivar ContextSwitches: Number of context switches.
	c                 C   sf   |j | _ |j| _| j tkr*|jjj| _|jjj| _|jjj| _|jjj| _d| _	d S |jj
j	j| _	d S ©NÚ )rš   r›   ÚWctThreadTyperœ   r˜   r‘   r’   r“   r”   rŠ   r—   Úvalue)ÚselfÚ
aStructurerA   rA   rB   Ú__init__y  s   

zWaitChainNodeInfo.__init__N©r;   r<   r=   Ú__doc__r¨   rA   rA   rA   rB   r¡   6  s    Br¡   c                       sT   e Zd ZdZd‡ fdd„	Zdd„ Zdd„ Zdd	d
„Zedd„ ƒZ	edd„ ƒZ
‡  ZS )ÚThreadWaitChainSessionHANDLEzd
	Thread wait chain session handle.

	Returned by L{OpenThreadWaitChainSession}.

	@see: L{HANDLE}
	Nc                    s   t t| ƒj|dd� dS )z?
		@type  aHANDLE: int
		@param aHANDLE: Win32 handle value.
		T©Ú
bOwnershipN)Úsuperr«   r¨   )r¦   ÚaHANDLE©Ú	__class__rA   rB   r¨   �  s   
ÿz%ThreadWaitChainSessionHANDLE.__init__c                 C   s    | j d u r	tdƒ‚t| j ƒ d S )NzHANDLE was already closed!)r¥   Ú
ValueErrorÚCloseThreadWaitChainSession©r¦   rA   rA   rB   Ú_close˜  s   
z#ThreadWaitChainSessionHANDLE._closec                 C   ó   t ƒ ‚©N©ÚNotImplementedErrorr´   rA   rA   rB   Údup�  ó   z ThreadWaitChainSessionHANDLE.dupc                 C   r¶   r·   r¸   )r¦   ÚdwMillisecondsrA   rA   rB   Úwait   r»   z!ThreadWaitChainSessionHANDLE.waitc                 C   ó   dS ©NFrA   r´   rA   rA   rB   Úinherit£  ó   z$ThreadWaitChainSessionHANDLE.inheritc                 C   r¾   r¿   rA   r´   rA   rA   rB   ÚprotectFromClose§  rÁ   z-ThreadWaitChainSessionHANDLE.protectFromCloser·   )r;   r<   r=   rª   r¨   rµ   rº   r½   ÚpropertyrÀ   rÂ   Ú__classcell__rA   rA   r°   rB   r«   ‡  s    

r«   i   é   i   i   ÚServicesActiveÚServicesFailedú+l   ÿÿ iÿ é0   é   i   c                   @   s:   e Zd ZdefdefdefdefdefdefdefgZdS )	ÚSERVICE_STATUSÚdwServiceTypeÚdwCurrentStateÚdwControlsAcceptedÚdwWin32ExitCodeÚdwServiceSpecificExitCodeÚdwCheckPointÚ
dwWaitHintNr•   rA   rA   rA   rB   rË   [  s    ùrË   c                   @   s"   e Zd Zejdefdefg ZdS )ÚSERVICE_STATUS_PROCESSÚdwProcessIdÚdwServiceFlagsN)r;   r<   r=   rË   r@   r>   rA   rA   rA   rB   rÓ   r  s
    
þrÓ   c                   @   ó"   e Zd ZdefdefdefgZdS )ÚENUM_SERVICE_STATUSAÚlpServiceNameÚlpDisplayNameÚServiceStatusN)r;   r<   r=   ÚLPSTRrË   r@   rA   rA   rA   rB   r×   ~  rŸ   r×   c                   @   rÖ   )ÚENUM_SERVICE_STATUSWrØ   rÙ   rÚ   N)r;   r<   r=   ÚLPWSTRrË   r@   rA   rA   rA   rB   rÜ   „  rŸ   rÜ   c                   @   rÖ   )ÚENUM_SERVICE_STATUS_PROCESSArØ   rÙ   ÚServiceStatusProcessN)r;   r<   r=   rÛ   rÓ   r@   rA   rA   rA   rB   rÞ   ’  rŸ   rÞ   c                   @   rÖ   )ÚENUM_SERVICE_STATUS_PROCESSWrØ   rÙ   rß   N)r;   r<   r=   rÝ   rÓ   r@   rA   rA   rA   rB   rà   ˜  rŸ   rà   c                   @   r    )rÚ   z0
	Wrapper for the L{SERVICE_STATUS} structure.
	c                 C   s<   |j | _|j| _|j| _|j| _|j| _	|j
| _|j| _dS )z]
		@type  raw: L{SERVICE_STATUS}
		@param raw: Raw structure for this service status data.
		N)rÌ   ÚServiceTyperÍ   ÚCurrentStaterÎ   ÚControlsAcceptedrÏ   ÚWin32ExitCoderÐ   ÚServiceSpecificExitCoderÑ   Ú
CheckPointrÒ   ÚWaitHint©r¦   ÚrawrA   rA   rB   r¨   ¦  s   zServiceStatus.__init__Nr©   rA   rA   rA   rB   rÚ   ¡  ó    rÚ   c                   @   r    )rß   z8
	Wrapper for the L{SERVICE_STATUS_PROCESS} structure.
	c                 C   sL   |j | _|j| _|j| _|j| _|j| _	|j
| _|j| _|j| _|j| _dS )ze
		@type  raw: L{SERVICE_STATUS_PROCESS}
		@param raw: Raw structure for this service status data.
		N)rÌ   rá   rÍ   râ   rÎ   rã   rÏ   rä   rÐ   rå   rÑ   ræ   rÒ   rç   rÔ   r‘   rÕ   ÚServiceFlagsrè   rA   rA   rB   r¨   ¸  s   zServiceStatusProcess.__init__Nr©   rA   rA   rA   rB   rß   ³  rê   rß   c                   @   ó    e Zd ZdZdd„ Zdd„ ZdS )ÚServiceStatusEntryz;
	Service status entry returned by L{EnumServicesStatus}.
	c                 C   sZ   |j | _|j| _|jj| _|jj| _|jj	| _
|jj| _|jj| _|jj| _|jj| _dS )z
		@type  raw: L{ENUM_SERVICE_STATUSA} or L{ENUM_SERVICE_STATUSW}
		@param raw: Raw structure for this service status entry.
		N)rØ   ÚServiceNamerÙ   ÚDisplayNamerÚ   rÌ   rá   rÍ   râ   rÎ   rã   rÏ   rä   rÐ   rå   rÑ   ræ   rÒ   rç   rè   rA   rA   rB   r¨   Ì  s   





zServiceStatusEntry.__init__c                 C   sô   g }| j t@ r| d¡ n| d¡ | jr!| d| j| jf ¡ n| d| j ¡ | jtkr4| d¡ nA| jtkr?| d¡ n6| jtkrJ| d¡ n+| jt	krU| d¡ n | jt
kr`| d	¡ n| jtkrk| d
¡ n
| jtkru| d¡ d |¡S )NzInteractive serviceÚServiceú	"%s" (%s)ú"%s"zis about to continue.zis pausing.z
is paused.zis running.zis starting.zis stopping.zis stopped.ú )rá   ÚSERVICE_INTERACTIVE_PROCESSÚappendrï   rî   râ   ÚSERVICE_CONTINUE_PENDINGÚSERVICE_PAUSE_PENDINGÚSERVICE_PAUSEDÚSERVICE_RUNNINGÚSERVICE_START_PENDINGÚSERVICE_STOP_PENDINGÚSERVICE_STOPPEDÚjoin©r¦   ÚoutputrA   rA   rB   Ú__str__Û  s,   










zServiceStatusEntry.__str__N©r;   r<   r=   rª   r¨   r   rA   rA   rA   rB   rí   Ç  s    rí   c                   @   rì   )ÚServiceStatusProcessEntryz=
	Service status entry returned by L{EnumServicesStatusEx}.
	c                 C   sn   |j | _|j| _|jj| _|jj| _|jj	| _
|jj| _|jj| _|jj| _|jj| _|jj| _|jj| _dS )z�
		@type  raw: L{ENUM_SERVICE_STATUS_PROCESSA} or L{ENUM_SERVICE_STATUS_PROCESSW}
		@param raw: Raw structure for this service status entry.
		N)rØ   rî   rÙ   rï   rß   rÌ   rá   rÍ   râ   rÎ   rã   rÏ   rä   rÐ   rå   rÑ   ræ   rÒ   rç   rÔ   r‘   rÕ   rë   rè   rA   rA   rB   r¨   ú  s   







z"ServiceStatusProcessEntry.__init__c                 C   s  g }| j t@ r| d¡ n| d¡ | jr!| d| j| jf ¡ n| d| j ¡ | jtkr4| d¡ nA| jtkr?| d¡ n6| jtkrJ| d¡ n+| jt	krU| d¡ n | jt
kr`| d	¡ n| jtkrk| d
¡ n
| jtkru| d¡ | jr€| d| j ¡ | d¡ d |¡S )NzInteractive service zService rñ   rò   z is about to continuez is pausingz
 is pausedz is runningz is startingz is stoppingz is stoppedz at process %dÚ.r£   )rá   rô   rõ   rï   rî   râ   rö   r÷   rø   rù   rú   rû   rü   r‘   rý   rþ   rA   rA   rB   r     s2   











z!ServiceStatusProcessEntry.__str__Nr  rA   rA   rA   rB   r  õ  s    r  c                   @   s   e Zd ZdZdS )ÚTokenHandlez*
	Access token handle.

	@see: L{HANDLE}
	N)r;   r<   r=   rª   rA   rA   rA   rB   r  +  s    r  c                   @   ó   e Zd ZdZeZdd„ ZdS )ÚRegistryKeyHandlez
	Registry key handle.
	c                 C   ó   t | jƒ d S r·   )ÚRegCloseKeyr¥   r´   rA   rA   rB   rµ   :  ó   zRegistryKeyHandle._closeN)r;   r<   r=   rª   ÚHKEYÚ_TYPErµ   rA   rA   rA   rB   r  3  s    r  c                   @   r  )ÚSaferLevelHandlez_
	Safer level handle.

	@see: U{http://msdn.microsoft.com/en-us/library/ms722425(VS.85).aspx}
	c                 C   r  r·   )ÚSaferCloseLevelr¥   r´   rA   rA   rB   rµ   F  r	  zSaferLevelHandle._closeN)r;   r<   r=   rª   ÚSAFER_LEVEL_HANDLEr  rµ   rA   rA   rA   rB   r  =  ó    r  c                   @   r  )ÚServiceHandlezm
	Service handle.

	@see: U{http://msdn.microsoft.com/en-us/library/windows/desktop/ms684330(v=vs.85).aspx}
	c                 C   r  r·   ©ÚCloseServiceHANDLEr¥   r´   rA   rA   rB   rµ   R  r	  zServiceHandle._closeN©r;   r<   r=   rª   Ú	SC_HANDLEr  rµ   rA   rA   rA   rB   r  I  r  r  c                   @   r  )ÚServiceControlManagerHandlezƒ
	Service Control Manager (SCM) handle.

	@see: U{http://msdn.microsoft.com/en-us/library/windows/desktop/ms684323(v=vs.85).aspx}
	c                 C   r  r·   r  r´   rA   rA   rB   rµ   ^  r	  z"ServiceControlManagerHandle._closeNr  rA   rA   rA   rB   r  U  r  r  c                  C   óx   t jj} ttg| _t| _tdƒ}| d t	|ƒƒ t
ƒ }|tkr#t |¡‚t d|jd ¡}| |t	|ƒƒ}|s9t ¡ ‚|jS ©Nr/   r£   r   )ÚwindllÚadvapi32ÚGetUserNameArÛ   ÚLPDWORDÚargtypesÚboolÚrestyper>   ÚbyrefÚGetLastErrorÚERROR_INSUFFICIENT_BUFFERÚctypesÚWinErrorÚcreate_string_bufferr¥   )Ú_GetUserNameAÚnSizeÚerrorÚlpBufferÚsuccessrA   rA   rB   r  g  ó   

r  c                  C   r  r  )r  r  ÚGetUserNameWrÝ   r  r  r  r  r>   r  r   r!  r"  r#  Úcreate_unicode_bufferr¥   )Ú_GetUserNameWr&  r'  r(  r)  rA   rA   rB   r+  w  r*  r+  c              	   C   sÞ   t jj}tttttttg|_t|_t	dƒ}t	dƒ}t	dƒ}|| |d t
|ƒd t
|ƒt
|ƒƒ tƒ }|tkr9t |¡‚t d|j¡}t t |¡t¡}t d|jd ¡}	|| ||t
|ƒ|	t
|ƒt
|ƒƒ}
|
sht ¡ ‚||	j|jfS r  )r  r  ÚLookupAccountNameArÛ   rh   r  r  r�   r  r>   r  r   r!  r"  r#  r$  r¥   ÚcastÚpointer)ÚlpSystemNameÚlpAccountNameÚ_LookupAccountNameAÚcbSidÚcchReferencedDomainNameÚpeUser'  ÚsidÚpsidÚlpReferencedDomainNamer)  rA   rA   rB   r.  ’  ó"    
 r.  c              	   C   sÞ   t jj}tttttttg|_t|_t	dƒ}t	dƒ}t	dƒ}|| |d t
|ƒd t
|ƒt
|ƒƒ tƒ }|tkr9t |¡‚t d|j¡}t t |¡t¡}t d|jd ¡}	|| ||t
|ƒ|	t
|ƒt
|ƒƒ}
|
sht ¡ ‚||	j|jfS r  )r  r  ÚLookupAccountNameWrÝ   rh   r  r  r�   r  r>   r  r   r!  r"  r#  r$  r¥   r/  r0  r,  )r1  r2  Ú_LookupAccountNameWr4  r5  r6  r'  r7  r8  r9  r)  rA   rA   rB   r;  ¦  r:  r;  c           
   	   C   sÎ   t jj}tttttttg|_t|_t	dƒ}t	dƒ}t	dƒ}|| |d t
|ƒd t
|ƒt
|ƒƒ tƒ }|tkr9t |¡‚t d|d ¡}t d|d ¡}|| ||t
|ƒ|t
|ƒt
|ƒƒ}	|	s_t ¡ ‚|j|j|jfS r  )r  r  ÚLookupAccountSidArÛ   rh   r  r  r  r  r>   r  r   r!  r"  r#  r$  r¥   )
r1  ÚlpSidÚ_LookupAccountSidAÚcchNamer5  r6  r'  ÚlpNamer9  r)  rA   rA   rB   r=  Å  s     
 r=  c           
   	   C   sÒ   t jj}tttttttg|_t|_	t
dƒ}t
dƒ}t
dƒ}|| |d t|ƒd t|ƒt|ƒƒ tƒ }|tkr9t |¡‚t d|jd ¡}t d|jd ¡}|| ||t|ƒ|t|ƒt|ƒƒ}	|	sat ¡ ‚|j|j|jfS r  )r  r  ÚLookupAccountSidWrÛ   rh   rÝ   r  r  r  r  r>   r  r   r!  r"  r#  r,  r¥   )
r1  r>  Ú_LookupAccountSidWr@  r5  r6  r'  rA  r9  r)  rA   rA   rB   rB  Ø  s     
 rB  c                 C   sZ   t jj}tttƒg|_t|_t	|_
tƒ }|| t|ƒƒ z|j}W t|ƒ | ¡ S t|ƒ w r·   )r  r  ÚConvertSidToStringSidArh   ÚPOINTERrÛ   r  r  r  ÚRaiseIfZeroÚerrcheckr  r¥   Ú	LocalFreeÚdecode)rg   Ú_ConvertSidToStringSidAÚ
pStringSidÚ	StringSidrA   rA   rB   rD  ñ  s   
ÿrD  c                 C   sV   t jj}tttƒg|_t|_t	|_
tƒ }|| t|ƒƒ z
|j}W t|ƒ |S t|ƒ w r·   )r  r  ÚConvertSidToStringSidWrh   rE  rÝ   r  r  r  rF  rG  r  r¥   rH  )rg   Ú_ConvertSidToStringSidWrK  rL  rA   rA   rB   rM  ÿ  s   
ÿrM  c                 C   ó:   t jj}ttg|_t|_t|_	tƒ }|| t
 |¡ƒ |jS r·   )r  r  ÚConvertStringSidToSidArÛ   ÚPVOIDr  r  r  rF  rG  r"  r0  r¥   )rL  Ú_ConvertStringSidToSidArg   rA   rA   rB   rP    ó   
rP  c                 C   rO  r·   )r  r  ÚConvertStringSidToSidWrÝ   rQ  r  r  r  rF  rG  r"  r0  r¥   )rL  Ú_ConvertStringSidToSidWrg   rA   rA   rB   rT    rS  rT  c                 C   ó   t jj}tg|_t|_|| ƒS r·   )r  r  Ú
IsValidSidrh   r  r  r  )ÚpSidÚ_IsValidSidrA   rA   rB   rW  ,  ó   rW  c                 C   s"   t jj}ttg|_t|_|| |ƒS r·   )r  r  ÚEqualSidrh   r  r  r  )ÚpSid1ÚpSid2Ú	_EqualSidrA   rA   rB   r[  6  s   

r[  c                 C   rV  r·   )r  r  ÚGetLengthSidrh   r  r>   r  )rX  Ú_GetLengthSidrA   rA   rB   r_  ?  rZ  r_  c                 C   s^   t jj}tttg|_t|_t	|_
t| ƒ}t d|¡}t t |¡t¡}|||| ƒ t |t¡S r¢   )r  r  ÚCopySidr>   rQ  rh   r  r  r  rF  rG  r_  r"  r$  r/  r0  )Ú
pSourceSidÚ_CopySidÚnDestinationSidLengthÚDestinationSidÚpDestinationSidrA   rA   rB   ra  J  s   ra  c                 C   s(   t jj}tg|_t|_t|_|| ƒ d S r·   )r  r  ÚFreeSidrh   r  r  ÚRaiseIfNotZerorG  )rX  Ú_FreeSidrA   rA   rB   rg  Y  ó
   rg  c                 C   óB   t jj}tttg|_t|_t	|_
ttƒ}|| |t|ƒƒ t|jƒS r·   )r  r  ÚOpenProcessTokenr{   r>   ÚPHANDLEr  r  r  rF  rG  ÚINVALID_HANDLE_VALUEr  r  r¥   )ÚProcessHANDLEÚDesiredAccessÚ_OpenProcessTokenÚNewTokenHandlerA   rA   rB   rl  e  ó   
rl  Tc                 C   sF   t jj}ttttg|_t|_	t
|_ttƒ}|| ||t|ƒƒ t|jƒS r·   )r  r  ÚOpenThreadTokenr{   r>   r�   rm  r  r  r  rF  rG  rn  r  r  r¥   )ÚThreadHANDLErp  Ú
OpenAsSelfÚ_OpenThreadTokenrr  rA   rA   rB   rt  u  ó   
rt  c                 C   rk  r·   )r  r  ÚDuplicateTokenr{   rˆ   rm  r  r  r  rF  rG  rn  r  r  r¥   )ÚExistingTokenHandler�   Ú_DuplicateTokenÚDuplicateTokenHandlerA   rA   rB   ry  „  rs  ry  c                 C   sN   t jj}ttttttg|_	t
|_t|_ttƒ}|| ||||t|ƒƒ t|jƒS r·   )r  r  ÚDuplicateTokenExr{   r>   ÚLPSECURITY_ATTRIBUTESrˆ   r‡   rm  r  r  r  rF  rG  rn  r  r  r¥   )ÚhExistingTokenÚdwDesiredAccessÚlpTokenAttributesr�   r€   Ú_DuplicateTokenExr|  rA   rA   rB   r}  –  s   
r}  c                 C   s,   t jj}tg|_t|_t|_t	t
ƒ || ƒS r·   )r  r  ÚIsTokenRestrictedr{   r  r  r  ÚRaiseIfNotErrorSuccessrG  ÚSetLastErrorÚERROR_SUCCESS)ÚhTokenHandleÚ_IsTokenRestrictedrA   rA   rB   rƒ  £  s   rƒ  c                 C   óB   t jj}tttg|_t|_t|_	t
ƒ }| sd } || |t|ƒƒ |S r·   )r  r  ÚLookupPrivilegeValueArÛ   ÚPLUIDr  r  r  rF  rG  r8   r  )r1  rA  Ú_LookupPrivilegeValueAÚlpLuidrA   rA   rB   rŠ  ±  ó   rŠ  c                 C   r‰  r·   )r  r  ÚLookupPrivilegeValueWrÝ   r‹  r  r  r  rF  rG  r8   r  )r1  rA  Ú_LookupPrivilegeValueWr�  rA   rA   rB   r�  ½  rŽ  r�  c                 C   ón   t jj}ttttg|_t|_t	|_
tdƒ}|| t|ƒtt|ƒƒ t d|j¡}|| t|ƒt|ƒt|ƒƒ |jS ©Nr/   r£   )r  r  ÚLookupPrivilegeNameArÛ   r‹  r  r  r  r  rF  rG  r>   r  ÚNULLr"  r$  r¥   )r1  r�  Ú_LookupPrivilegeNameAr@  rA  rA   rA   rB   r“  Ò  ó   r“  c                 C   r‘  r’  )r  r  ÚLookupPrivilegeNameWrÝ   r‹  r  r  r  r  rF  rG  r>   r  r”  r"  r,  r¥   )r1  r�  Ú_LookupPrivilegeNameWr@  rA  rA   rA   rB   r—  Þ  r–  r—  rA   c           
      C   sæ   t jj}ttttttg|_t|_	|s t
|_|| ttdttƒ d S d}d}|D ]C\}}t|tƒs4tt|ƒ}|dkr;t}n|dkrBt}n	|d krId}n|}t||ƒ}td|ƒ}	|| tt|	ƒt|	ƒttƒdkrid}tƒ }q&|sqt |¡‚d S )Nr/   TFr   )r  r  ÚAdjustTokenPrivilegesr{   r�   ÚLPVOIDr>   r  r  r  rF  rG  ÚTRUEr”  Ú
isinstancer8   ÚLookupPrivilegeValueÚSE_PRIVILEGE_ENABLEDÚSE_PRIVILEGE_REMOVEDrD   rG   ÚFALSEr  Úsizeofr   r"  r#  )
r  ÚNewStateÚ_AdjustTokenPrivilegesr)  ÚerrcodeÚ	privilegeÚenabledÚflagsÚlaaÚtprA   rA   rB   r™  ô  s6   



€
ÿr™  c                 C   s  |dks|t krtd| ƒ‚|tkr tƒ }t| ||ƒ |jjjS |tkr1t	ƒ }t| ||ƒ |j
jS |tkrBtƒ }t| ||ƒ |jjS |tkrStƒ }t| ||ƒ |jjS |tkritƒ }t| ||ƒ |jjj|jjfS |tkrytƒ }t| ||ƒ |jS |tkrŠtdƒ}t| ||ƒ |jS |tkr›tdƒ}t| ||ƒ |jS |tkr¬tdƒ}t| ||ƒ |jS |ttfv r¿tdƒ}t| ||ƒ |jS |tt t!t"t#fv r×tdƒ}t| ||ƒ t$|jƒS |t%krít&dƒ}t| ||ƒ t'|j(jdd�S |t)krüt*ƒ }t| ||ƒ |S t+d| ƒ‚)Nr/   z,Invalid value for TokenInformationClass (%i)Tr¬   z,TokenInformationClass(%i) not yet supported!),ÚMaxTokenInfoClassr²   Ú	TokenUserrj   Ú_internal_GetTokenInformationrk   rg   r¥   Ú
TokenOwnerrp   rq   rs   rt   ÚTokenAppContainerSidru   rv   ÚTokenIntegrityLevelrn   ro   rF   ÚTokenOriginrw   rx   r€   r‡   ÚTokenElevationÚTOKEN_ELEVATIONrˆ   ÚTokenSessionIdÚTokenAppContainerNumberr>   ÚTokenSandBoxInertÚTokenHasRestrictionsÚTokenUIAccessÚTokenVirtualizationAllowedÚTokenVirtualizationEnabledr  ÚTokenLinkedTokenry   r  rz   ÚTokenStatisticsr|   r¹   )r‡  ÚTokenInformationClassÚTokenInformationrA   rA   rB   ÚGetTokenInformation  sr   
ÿ
r¾  c                 C   sd   t jj}tttttg|_t	|_
t|_tdƒ}t|ƒ}|| |t|ƒ|t|ƒƒ |j|kr0t t¡‚|S ©Nr/   )r  r  r¾  r{   ÚTOKEN_INFORMATION_CLASSrš  r>   ÚPDWORDr  r  r  rF  rG  r¡  r  r¥   r"  r#  r!  )r‡  r¼  r½  Ú_GetTokenInformationÚReturnLengthÚTokenInformationLengthrA   rA   rB   r¬  u  s   

r¬  c              
   C   sÈ   t jj}tttttg|_t	|_
t|_tdƒ}z|| dd|t|ƒƒ W n ty4 } zW Y d}~nd}~ww |j}tdƒ}t| ƒ }|| dt|ƒ|t|ƒƒ |j|krWt t¡‚t |ttƒ¡j}|jjS )zP
	The original function wasn't working. this one returns the SID for the token
	r/   r   N)r  r  r¾  r{   rÀ  rš  r>   rÁ  r  r  r  rF  rG  r  Ú	Exceptionr¥   ÚBYTEr"  r#  r!  r/  rE  rj   Úcontentsrk   rg   )r‡  rÂ  rÃ  ÚerÄ  ÚtiÚtrA   rA   rB   ÚGetTokenInformation_sidƒ  s&   €ÿ


rË  c
                 C   s  t jj}
tttttttttttg|
_t|
_	t
|
_| sd } |s d }|s$d }|s(d }|s-d }nt |ttt|ƒd ƒ¡}|s?d }nt |¡}|sHd }|	sdtƒ }	ttƒ|	_d|	_d|	_d|	_d|	_d|	_d|	_tƒ }t|_t|_d|_d|_|
| ||||||||t |	ƒt |ƒƒ |S ©Nr   r/   )!r  r  ÚCreateProcessWithLogonWrÝ   r>   rš  ÚLPPROCESS_INFORMATIONr  r  r  rF  rG  r"  r,  ÚmaxÚMAX_PATHÚlenÚSTARTUPINFOWr¡  ÚcbÚ
lpReservedÚ	lpDesktopÚlpTitleÚdwFlagsÚcbReserved2ÚlpReserved2ÚPROCESS_INFORMATIONrn  ÚhProcessÚhThreadrÔ   Ú
dwThreadIdr  )Ú
lpUsernameÚlpDomainÚ
lpPasswordÚdwLogonFlagsÚlpApplicationNameÚlpCommandLineÚdwCreationFlagsÚlpEnvironmentÚlpCurrentDirectoryÚlpStartupInfoÚ_CreateProcessWithLogonWÚlpProcessInformationrA   rA   rB   rÍ  ³  sH   

$rÍ  c           
      C   sö   t jj}tttttttttg	|_t	|_
t|_| sd } |sd }|s#d }nt |ttt|ƒd ƒ¡}|s5d }nt |¡}|s>d }|sZtƒ }ttƒ|_d|_d|_d|_d|_d|_d|_tƒ }	t|	_t|	_d|	_d|	_ || ||||||t!|ƒt!|	ƒƒ	 |	S rÌ  )"r  r  ÚCreateProcessWithTokenWr{   r>   rÝ   rš  rÎ  r  r  r  rF  rG  r"  r,  rÏ  rÐ  rÑ  rÒ  r¡  rÓ  rÔ  rÕ  rÖ  r×  rØ  rÙ  rÚ  rn  rÛ  rÜ  rÔ   rÝ  r  )
ÚhTokenrá  râ  rã  rä  rå  ræ  rç  Ú_CreateProcessWithTokenWré  rA   rA   rB   rê  ê  s@   

 rê  Fc
                 C   s*  t jj}
ttttttttttt	g|
_
t|
_t|
_|sd }|s!d }nt | d¡ttt|ƒd ƒ¡}|s6d }nt | d¡¡}|sBd }|sGd }nt|ƒ}|sPd }nt|ƒ}|	sptƒ }	ttƒ|	_d|	_d|	_d|	_d|	_d|	_d|	_tƒ }t |_!t |_"d|_#d|_$|
| ||||t|ƒ|||t|	ƒt|ƒƒ |S )NÚasciir   r/   )%r  r  ÚCreateProcessAsUserAr{   rÛ   r~  r�   r>   rš  rÎ  r  r  r  rF  rG  r"  r$  ÚencoderÏ  rÐ  rÑ  r  ÚSTARTUPINFOr¡  rÓ  rÔ  rÕ  rÖ  r×  rØ  rÙ  rÚ  rn  rÛ  rÜ  rÔ   rÝ  )rë  râ  rã  ÚlpProcessAttributesÚlpThreadAttributesÚbInheritHANDLEsrä  rå  ræ  rç  Ú_CreateProcessAsUserAré  rA   rA   rB   rî    sH    
(rî  c
                 C   s  t jj}
ttttttttttt	g|
_
t|
_t|
_|sd }|s!d }nt |ttt|ƒd ƒ¡}|s3d }nt |¡}|s<d }|sAd }nt|ƒ}|sJd }nt|ƒ}|	sjtƒ }	ttƒ|	_d|	_d|	_d|	_d|	_d|	_d|	_tƒ }t|_ t|_!d|_"d|_#|
| ||||t|ƒ|||t|	ƒt|ƒƒ |S rÌ  )$r  r  ÚCreateProcessAsUserWr{   rÝ   r~  r�   r>   rš  rÎ  r  r  r  rF  rG  r"  r,  rÏ  rÐ  rÑ  r  rð  r¡  rÓ  rÔ  rÕ  rÖ  r×  rØ  rÙ  rÚ  rn  rÛ  rÜ  rÔ   rÝ  )rë  râ  rã  rñ  rò  ró  rä  rå  ræ  rç  Ú_CreateProcessAsUserWré  rA   rA   rB   rõ  J  sH   

(rõ  c                 C   s@   t jj}ttg|_t|_t|_	|d urt
|ƒ}|| |ƒ}t|ƒS r·   )r  r  ÚOpenThreadWaitChainSessionr>   rQ  r  ÚHWCTr  rF  rG  ÚPWAITCHAINCALLBACKr«   )ÚFlagsÚcallbackÚ_OpenThreadWaitChainSessionr¯   rA   rA   rB   r÷  …  s   

r÷  éÿÿÿÿc                    sÜ   t jj}tttttttg|_t	|_
t|_t|ƒ}t| ƒ ‰ tdƒ}|| |||t|ƒt t ˆ ¡t¡t|ƒƒ |j|kr]|j}t| ƒ ‰ || |||t|ƒt t ˆ ¡t¡t|ƒƒ |j|ks;‡ fdd„t|jƒD ƒt	|jƒfS )Nr/   c                    s   g | ]}t ˆ | ƒ‘qS rA   )r¡   )Ú.0Úindex©ÚNodeInfoArrayrA   rB   Ú
<listcomp>¨  s    z&GetThreadWaitChain.<locals>.<listcomp>)r  r  ÚGetThreadWaitChainrø  r  r>   ÚPWAITCHAIN_NODE_INFOÚLPBOOLr  r  r  rF  rG  r™   r�   r  r"  r/  r0  r¥   Úxrange)Ú	WctHANDLEÚContextrú  r’   Ú	NodeCountÚ_GetThreadWaitChainÚdwNodeCountÚIsCyclerA   r   rB   r  ™  s    
*

*
ýþr  c                 C   s   t jj}tg|_|| ƒ d S r·   )r  r  r³   rø  r  )r  Ú_CloseThreadWaitChainSessionrA   rA   rB   r³   ¯  s   r³   c                 C   sN   t jj}tttttƒtg|_t|_	t
|_ttƒ}|| ||t|ƒd ƒ t|jƒS r·   )r  r  ÚSaferCreateLevelr>   rE  r  rš  r  r�   r  rF  rG  rn  r  ÚSaferLevelHANDLEr¥   )Ú	dwScopeIdÚ	dwLevelIdÚ	OpenFlagsÚ_SaferCreateLevelÚhLevelHANDLErA   rA   rB   r  »  s   
r  c                 C   s\   t jj}tttttg|_t	|_
t|_ttƒ}tdƒ}|| |t|ƒ|t|ƒƒ t|jƒ|jfS r¿  )r  r  ÚSaferComputeTokenFromLevelr  r{   rm  r>   r  r  r�   r  rF  rG  rn  r  r  r¥   )ÚLevelHANDLEÚInAccessTokenr×  Ú_SaferComputeTokenFromLevelÚOutAccessTokenrÔ  rA   rA   rB   r  Õ  s   r  c                 C   s@   t jj}tg|_t|_t|_t	| dƒr|| j
ƒ d S || ƒ d S ©Nr¥   )r  r  r  r  r  r�   r  rF  rG  Úhasattrr¥   )r  Ú_SaferCloseLevelrA   rA   rB   r  ã  s   
r  c                 C   s8   t jj}ttg|_t|_t|_	t
tƒ t|t| ƒ|ƒƒS r·   )r  r  ÚSaferiIsExecutableFileTyperÝ   ÚBOOLEANr  r�   r  ÚRaiseIfLastErrorrG  r…  r†  r  Úunicode)Ú
szFullPathÚbFromShellExecuteÚ_SaferiIsExecutableFileTyperA   rA   rB   r  ò  s   
r  c                 C   sV   t | dƒr	| j}n| }|ttttttfv rd S tj	j
}tg|_t|_t|_|| ƒ d S r  )r  r¥   ÚHKEY_CLASSES_ROOTÚHKEY_CURRENT_USERÚHKEY_LOCAL_MACHINEÚ
HKEY_USERSÚHKEY_PERFORMANCE_DATAÚHKEY_CURRENT_CONFIGr  r  r  r
  r  r?   r  r„  rG  )ÚhKeyr¥   Ú_RegCloseKeyrA   rA   rB   r    s"   
úr  c                 C   óB   t jj}tttg|_t|_t	|_
ttƒ}|| |t|ƒƒ t|jƒS r·   )r  r  ÚRegConnectRegistryArÛ   r
  ÚPHKEYr  r?   r  r„  rG  rn  r  ÚRegistryKeyHANDLEr¥   )ÚlpMachineNamer*  Ú_RegConnectRegistryAÚhkResultrA   rA   rB   r-    rs  r-  c                 C   r,  r·   )r  r  ÚRegConnectRegistryWrÝ   r
  r.  r  r?   r  r„  rG  rn  r  r/  r¥   )r0  r*  Ú_RegConnectRegistryWr2  rA   rA   rB   r3  (  rs  r3  c                 C   rk  r·   )r  r  ÚRegCreateKeyAr
  rÛ   r.  r  r?   r  r„  rG  rn  r  r/  r¥   )r*  ÚlpSubKeyÚ_RegCreateKeyAr2  rA   rA   rB   r5  9  rs  r5  c                 C   rk  r·   )r  r  ÚRegCreateKeyWr
  rÝ   r.  r  r?   r  r„  rG  rn  r  r/  r¥   )r*  r6  Ú_RegCreateKeyWr2  rA   rA   rB   r8  C  rs  r8  c                 C   rk  r·   )r  r  ÚRegOpenKeyAr
  rÛ   r.  r  r?   r  r„  rG  rn  r  r/  r¥   )r*  r6  Ú_RegOpenKeyAr2  rA   rA   rB   r:  b  rs  r:  c                 C   rk  r·   )r  r  ÚRegOpenKeyWr
  rÝ   r.  r  r?   r  r„  rG  rn  r  r/  r¥   )r*  r6  Ú_RegOpenKeyWr2  rA   rA   rB   r<  l  rs  r<  c                 C   óJ   t jj}tttttg|_t	|_
t|_ttƒ}|| |d|t|ƒƒ t|jƒS r¿  )r  r  ÚRegOpenKeyExAr
  rÛ   r>   ÚREGSAMr.  r  r?   r  r„  rG  rn  r  r/  r¥   )r*  r6  Ú
samDesiredÚ_RegOpenKeyExAr2  rA   rA   rB   r?    ó   
r?  c                 C   r>  r¿  )r  r  ÚRegOpenKeyExWr
  rÝ   r>   r@  r.  r  r?   r  r„  rG  rn  r  r/  r¥   )r*  r6  rA  Ú_RegOpenKeyExWr2  rA   rA   rB   rD  ‰  rC  rD  c                 C   s>   t jj}ttg|_t|_t|_	t
tƒ}|| t|ƒƒ t|jƒS r·   )r  r  ÚRegOpenCurrentUserr@  r.  r  r?   r  r„  rG  r
  rn  r  r/  r¥   )rA  Ú_RegOpenCurrentUserr2  rA   rA   rB   rF  ™  s   

rF  c                 C   sF   t jj}ttttg|_t|_	t
|_ttƒ}|| d|t|ƒƒ t|jƒS r¿  )r  r  ÚRegOpenUserClassesRootr{   r>   r@  r.  r  r?   r  r„  rG  r
  rn  r  r/  r¥   )rë  rA  Ú_RegOpenUserClassesRootr2  rA   rA   rB   rH  ©  rx  rH  c                 C   s`   t jj}ttttg|_t|_	t
|_tdƒ}|| |d t|ƒƒ t |j¡}|| ||t|ƒƒ |jS r¿  )r  r  ÚRegQueryValueAr
  rÛ   rš  ÚPLONGr  r?   r  r„  rG  r  r"  r$  r¥   )r*  r6  Ú_RegQueryValueAÚcbValueÚlpValuerA   rA   rB   rJ  ¹  s   rJ  c                 C   sh   t jj}ttttg|_t|_	t
|_tdƒ}|| |d t|ƒƒ t |jttƒ ¡}|| ||t|ƒƒ |jS r¿  )r  r  ÚRegQueryValueWr
  rÝ   rš  rK  r  r?   r  r„  rG  r  r"  r,  r¥   r¡  r�   )r*  r6  Ú_RegQueryValueWrM  rN  rA   rA   rB   rO  Å  s   rO  c                 C   s  t | ƒ}tdƒ}tdƒ}|||d t|ƒd t|ƒƒ |j}|s#|j|fS |ttfv rK|jdkr5td|j ƒ‚tdƒ}|||d d t|ƒt|ƒƒ |j|fS |tkrq|jdkr[td|j ƒ‚tdƒ}	|||d d t|	ƒt|ƒƒ |	j|fS |t	t
fv r˜| r€t |j¡}
nt |j¡}
|||d d t|
ƒt|ƒƒ |
j|fS |tkrÖ| r¥t |j¡}
nt |j¡}
|||d d t|
ƒt|ƒƒ |
d d … }| rÆ| d¡}n| d¡}dd	„ |D ƒ}||fS |tkròt |j¡}
|||d d t|
ƒt|ƒƒ |
j|fS t |j¡}
|||d d t|
ƒt|ƒƒ |
j|fS )
Nr/   rý  r'   úREG_DWORD value of size %dr)   úREG_QWORD value of size %dú c                 S   ó   g | ]}|r|‘qS rA   rA   ©rþ  ÚtokenrA   rA   rB   r  	  ó    z-_internal_RegQueryValueEx.<locals>.<listcomp>)Ú_caller_RegQueryValueExr>   r  r¥   Ú	REG_DWORDÚREG_DWORD_BIG_ENDIANr²   Ú	REG_QWORDÚQWORDÚREG_SZÚREG_EXPAND_SZr"  r$  r,  ÚREG_MULTI_SZÚsplitÚREG_LINKré   )Úansir*  ÚlpValueNameÚbGetDataÚ_RegQueryValueExÚcbDataÚdwTypeÚTypeÚdwDataÚqwDataÚszDataÚDataÚaDatarA   rA   rB   Ú_internal_RegQueryValueExÛ  sV   








rn  c                 C   sJ   | rt jj}ttttttg|_nt jj}tt	ttttg|_t
|_t|_|S r·   )r  r  ÚRegQueryValueExAr
  rÛ   rš  rÁ  r  ÚRegQueryValueExWrÝ   r?   r  r„  rG  )rb  re  rA   rA   rB   rX  	  s   rX  c                 C   ó   t d| ||ƒS ©NT©rn  ©r*  rc  rd  rA   rA   rB   ro   	  r	  ro  c                 C   rq  r¿   rs  rt  rA   rA   rB   rp  $	  r	  rp  c           	      C   sþ  |d u rt |tjƒrd}n*t |tjƒrd}n!tjtjk}nt |tjƒr&d}nt |tjƒr/d}ntdt|ƒ ƒ‚|d u rm|d u rBt}n+|d u rIt}n$t |tjƒrRt}nt |tjƒr[t}nt |t	ƒrct
}n
t |tƒrkt}nt}|r}tjj}ttttttg|_ntjj}ttttttg|_t|_t|_|d u r™d }d}n[|t
tfv r¤t|ƒ}nH|tkr­t|ƒ}n?|ttfv rÁ|r»t  |¡}n1t !|¡}n+|t"krÝ|rÒt  d #|¡d ¡}nt !d #|¡d ¡}n|t$krçt !|¡}nt  |¡}t%|ƒ}t&|ƒ}|| |d|||ƒ d S )NTFzString expected, got %s insteadr/   rS  z  )'rœ  ÚGuessStringTypeÚt_ansiÚ	t_unicodeÚ	t_defaultÚ	TypeErrorÚtyper]  ÚREG_NONEÚintrY  Úlongr[  Ú
REG_BINARYr  r  ÚRegSetValueExAr
  rÛ   r>   rš  r  ÚRegSetValueExWrÝ   r?   r  r„  rG  rZ  r\  r^  r"  r$  r,  r_  rý   ra  r  r¡  )	r*  rc  ÚlpDatarg  rb  Ú_RegSetValueExÚDataRefÚDataSizerl  rA   rA   rB   ÚRegSetValueEx1	  sj   




r…  c                 C   s„   t jj}ttttg|_t|_d}	 t	 
|¡}|| |||ƒ}|tkr"n|d }|dkr/t	 |¡‚q|tkr6d S |tkr?t	 |¡‚|jS )NrÊ   TrÅ   )r  r  ÚRegEnumKeyAr
  r>   rÛ   r  r?   r  r"  r$  ÚERROR_MORE_DATAr#  ÚERROR_NO_MORE_ITEMSr†  r¥   )r*  ÚdwIndexÚ_RegEnumKeyAr@  rA  r¤  rA   rA   rB   r†  „	  s$   

ù
r†  c                 C   sˆ   t jj}ttttg|_t|_d}	 t	 
|¡}|| |||d ƒ}|tkr$n|d }|dkr1t	 |¡‚q|tkr8d S |tkrAt	 |¡‚|jS )Nr.   Tr&   i €  )r  r  ÚRegEnumKeyWr
  r>   rÝ   r  r?   r  r"  r,  r‡  r#  rˆ  r†  r¥   )r*  r‰  Ú_RegEnumKeyWr@  rA  r¤  rA   rA   rB   r‹  ˜	  s$   

ù
r‹  c              	   C   sˆ  | rt jj}ttttttttg|_nt jj	}ttt
tttttg|_t|_tdƒ}tdƒ}t|ƒ}t|ƒ}| r=t |j¡}	nt |j¡}	|rNtdƒ}
t|
ƒ}nd }d }||||	|d |||ƒ}|tksg|rò|tkrò| rx|jttƒ |_t |j¡}	n|jttƒ |_t |j¡}	|rç|j}|ttfv r¤|
jttƒkrŸtd|
j ƒ‚tdƒ}n?|tkr»|
jttƒkr¶td|
j ƒ‚tdƒ}n(|tttfv rÒ| rËt |
j¡}nt |
j¡}n|tkrÝt |
j¡}nt |
j¡}t|ƒ}||||	|d |||ƒ}|t krød S |�s|	j|jfS |ttttttfv �r|	j|j|jfS |tk�r<|d d … }~| �r)| !d¡}n| !d¡}dd„ |D ƒ}|	j|j|fS |	j|j|j"fS )	NrÊ   rý  r/   rQ  rR  rS  c                 S   rT  rA   rA   rU  rA   rA   rB   r  
  rW  z*_internal_RegEnumValue.<locals>.<listcomp>)#r  r  ÚRegEnumValueAr
  r>   rÛ   r  rš  r  ÚRegEnumValueWrÝ   r?   r  r  r"  r$  r¥   r,  r‡  r†  r¡  ÚCHARr�   rY  rZ  r²   r[  r\  r]  r^  r_  ra  rˆ  r`  ré   )rb  r*  r‰  rd  Ú_RegEnumValueÚcchValueNamerg  ÚlpcchValueNameÚlpTyperc  rf  ÚlpcbDatar�  r¤  rh  rl  ÚsDatarm  rA   rA   rB   Ú_internal_RegEnumValueÅ	  sv   




r–  c                 C   rq  rr  ©r–  ©r*  r‰  rd  rA   rA   rB   r�  
  r	  r�  c                 C   rq  r¿   r—  r˜  rA   rA   rB   rŽ  
  r	  rŽ  c                 C   ó,   t jj}ttg|_t|_t|_	|| |ƒ d S r·   )
r  r  ÚRegDeleteValueAr
  rÛ   r  r?   r  r„  rG  )ÚhKeySrcrc  Ú_RegDeleteValueArA   rA   rB   rš  >
  ó
   
rš  c                 C   r™  r·   )
r  r  ÚRegDeleteValueWr
  rÝ   r  r?   r  r„  rG  )r›  rc  Ú_RegDeleteValueWrA   rA   rB   rž  D
  r�  rž  c                 C   ó0   t jj}tttg|_t|_t|_	|| ||ƒ d S r·   )
r  r  ÚRegDeleteKeyValueAr
  rÛ   r  r?   r  r„  rG  )r›  r6  rc  Ú_RegDeleteKeyValueArA   rA   rB   r¡  Q
  ó
   r¡  c                 C   r   r·   )
r  r  ÚRegDeleteKeyValueWr
  rÝ   r  r?   r  r„  rG  )r›  r6  rc  Ú_RegDeleteKeyValueWrA   rA   rB   r¤  W
  r£  r¤  c                 C   r™  r·   )
r  r  ÚRegDeleteKeyAr
  rÛ   r  r?   r  r„  rG  )r›  r6  Ú_RegDeleteKeyArA   rA   rB   r¦  c
  r�  r¦  c                 C   r™  r·   )
r  r  ÚRegDeleteKeyWr
  rÝ   r  r?   r  r„  rG  )r›  r6  Ú_RegDeleteKeyWrA   rA   rB   r¨  i
  r�  r¨  c                 C   ó4   t jj}ttttg|_t|_	t
|_|| ||dƒ d S r¿  )r  r  ÚRegDeleteKeyExAr
  rÛ   r@  r>   r  r?   r  r„  rG  )r›  r6  rA  Ú_RegDeleteKeyExArA   rA   rB   r«  x
  ó
   r«  c                 C   rª  r¿  )r  r  ÚRegDeleteKeyExWr
  rÝ   r@  r>   r  r?   r  r„  rG  )r›  r6  rA  Ú_RegDeleteKeyExWrA   rA   rB   r®  ~
  r­  r®  c                 C   ó0   t jj}tttg|_t|_t|_	|| ||ƒ d S r·   )
r  r  ÚRegCopyTreeAr
  rÛ   r  r?   r  r„  rG  )r›  r6  ÚhKeyDestÚ_RegCopyTreeArA   rA   rB   r±  ‹
  r£  r±  c                 C   r°  r·   )
r  r  ÚRegCopyTreeWr
  rÝ   r  r?   r  r„  rG  )r›  r6  r²  Ú_RegCopyTreeWrA   rA   rB   r´  ‘
  r£  r´  c                 C   r™  r·   )
r  r  ÚRegDeleteTreeAr
  rÝ   r  r?   r  r„  rG  )r*  r6  Ú_RegDeleteTreeArA   rA   rB   r¶  �
  r�  r¶  c                 C   r™  r·   )
r  r  ÚRegDeleteTreeWr
  rÝ   r  r?   r  r„  rG  )r*  r6  Ú_RegDeleteTreeWrA   rA   rB   r¸  £
  r�  r¸  c                 C   ó(   t jj}tg|_t|_t|_|| ƒ d S r·   )	r  r  ÚRegFlushKeyr
  r  r?   r  r„  rG  )r*  Ú_RegFlushKeyrA   rA   rB   r»  ®
  rj  r»  c                 C   s>   t jj}tg|_t|_t|_t	| t
ƒr|  ¡  d S || ƒ d S r·   )r  r  r  r  r  r  r  rF  rG  rœ  r{   Úclose)Ú	hSCObjectÚ_CloseServiceHANDLErA   rA   rB   r  Æ
  s   
r  c                 C   s4   t jj}tttg|_t|_t|_	|| ||ƒ}t
|ƒS r·   )r  r  ÚOpenSCManagerArÛ   r>   r  r  r  rF  rG  ÚServiceControlManagerHANDLE)r0  ÚlpDatabaseNamer€  Ú_OpenSCManagerAr¾  rA   rA   rB   rÀ  ×
  ó   rÀ  c                 C   s4   t jj}tttg|_t|_t|_	t
| ||ƒ}t|ƒS r·   )r  r  ÚOpenSCManagerWrÝ   r>   r  r  r  rF  rG  rÃ  rÁ  )r0  rÂ  r€  Ú_OpenSCManagerWr¾  rA   rA   rB   rÅ  à
  rÄ  rÅ  c                 C   ó0   t jj}tttg|_t|_t|_	t
|| ||ƒƒS r·   )r  r  ÚOpenServiceAr  rÛ   r>   r  r  rF  rG  ÚServiceHANDLE)Ú
hSCManagerrØ   r€  Ú_OpenServiceArA   rA   rB   rÈ  ð
  r£  rÈ  c                 C   rÇ  r·   )r  r  ÚOpenServiceWr  rÝ   r>   r  r  rF  rG  rÉ  )rÊ  rØ   r€  Ú_OpenServiceWrA   rA   rB   rÌ  ÷
  r£  rÌ  c                 C   ól   t jj}tttttttttttttg|_t|_t	|_
tdƒ}|| |||||||t|ƒ|	|
|ƒ}t|ƒ|jfS r¿  )r  r  ÚCreateServiceAr  rÛ   r>   r  r  r  rF  rG  r  rÉ  r¥   )rÊ  rØ   rÙ   r€  rÌ   ÚdwStartTypeÚdwErrorControlÚlpBinaryPathNameÚlpLoadOrderGroupÚlpDependenciesÚlpServiceStartNamerà  Ú_CreateServiceAÚdwTagIdÚhServicerA   rA   rB   rÏ    ó    "rÏ  c                 C   rÎ  r¿  )r  r  ÚCreateServiceWr  rÝ   r>   r  r  r  rF  rG  r  rÉ  r¥   )rÊ  rØ   rÙ   r€  rÌ   rÐ  rÑ  rÒ  rÓ  rÔ  rÕ  rà  Ú_CreateServiceWr×  rØ  rA   rA   rB   rÚ  $  rÙ  rÚ  c                 C   rº  r·   )	r  r  ÚDeleteServicer  r  r  r  rF  rG  )rØ  Ú_DeleteServicerA   rA   rB   rÜ  >  rj  rÜ  c                 C   ó†   t jj}ttttg|_t|_t	dƒ}|| |d t
|ƒƒ |jdkr$t ¡ ‚t |jd ¡}t|ƒ|_|| ||t
|ƒƒ}|s@t ¡ ‚|jS ©Nr/   r   )r  r  ÚGetServiceKeyNameAr  rÛ   r  r  r  r  r>   r  r¥   r"  r#  r$  r¡  )rÊ  rÙ   Ú_GetServiceKeyNameAÚ	cchBufferrØ   r)  rA   rA   rB   rà  K  ó   

rà  c                 C   rÞ  ©Nr/   r&   )r  r  ÚGetServiceKeyNameWr  rÝ   r  r  r  r  r>   r  r¥   r"  r#  r,  r¡  )rÊ  rÙ   Ú_GetServiceKeyNameWrâ  rØ   r)  rA   rA   rB   rå  [  rã  rå  c                 C   rÞ  rß  )r  r  ÚGetServiceDisplayNameAr  rÛ   r  r  r  r  r>   r  r¥   r"  r#  r$  r¡  )rÊ  rØ   Ú_GetServiceDisplayNameArâ  rÙ   r)  rA   rA   rB   rç  s  rã  rç  c                 C   rÞ  rä  )r  r  ÚGetServiceDisplayNameWr  rÝ   r  r  r  r  r>   r  r¥   r"  r#  r,  r¡  )rÊ  rØ   Ú_GetServiceDisplayNameWrâ  rÙ   r)  rA   rA   rB   ré  ƒ  rã  ré  c                 C   ó\   t jj}tttg|_t|_t	|_
|r"t|ƒ}t| |Ž }t |¡}nd}d }|| ||ƒ d S r¿  )r  r  ÚStartServiceAr  r>   rš  r  r  r  rF  rG  rÑ  rÛ   r"  r0  )rØ  ÚServiceArgVectorsÚ_StartServiceAÚdwNumServiceArgsÚCServiceArgVectorsÚlpServiceArgVectorsrA   rA   rB   rì  Å  ó   rì  c                 C   rë  r¿  )r  r  ÚStartServiceWr  r>   rš  r  r  r  rF  rG  rÑ  rÝ   r"  r0  )rØ  rí  Ú_StartServiceWrï  rð  rñ  rA   rA   rB   ró  Ô  rò  ró  c                 C   s>   t jj}tttg|_t|_t	|_
tƒ }|| |t|ƒƒ t|ƒS r·   )r  r  ÚControlServicer  r>   ÚLPSERVICE_STATUSr  r  r  rF  rG  rË   r  rÚ   )rØ  Ú	dwControlÚ_ControlServiceÚrawServiceStatusrA   rA   rB   rõ  ê  s   rõ  c                 C   s:   t jj}ttg|_t|_t|_	t
ƒ }|| t|ƒƒ t|ƒS r·   )r  r  ÚQueryServiceStatusr  rö  r  r  r  rF  rG  rË   r  rÚ   )rØ  Ú_QueryServiceStatusrù  rA   rA   rB   rú  	  s   
rú  c                 C   sh   |t krtƒ ‚tjj}ttttt	g|_
t|_t|_tƒ }tt|ƒƒ}|| |t|ƒt|ƒt|ƒƒ t|ƒS r·   )ÚSC_STATUS_PROCESS_INFOr¹   r  r  ÚQueryServiceStatusExr  ÚSC_STATUS_TYPErš  r>   r  r  r  r  rF  rG  rÓ   r¡  r  rß   )rØ  Ú	InfoLevelÚ_QueryServiceStatusExr(  ÚcbBytesNeededrA   rA   rB   rý    s   rý  c              
   C   ó6  t jj}ttttttttg|_t|_	tdƒ}tdƒ}tdƒ}|| ||d dt
|ƒt
|ƒt
|ƒƒ g }d}tƒ tkr“|jttƒk r@nSt d|j¡}	|| ||t
|	ƒt|	ƒt
|ƒt
|ƒt
|ƒƒ}t|	ƒttƒ|j k rkt ¡ ‚t t t |	¡tj¡t¡}
td|jƒD ]}| t|
| ƒ¡ q|rŽntƒ tks8|s™t ¡ ‚|S ©Nr/   Fr£   )r  r  ÚEnumServicesStatusAr  r>   rš  r  r  r  r  r  r   r‡  r¥   r¡  r×   r"  r$  r#  r/  r0  Úc_void_pÚLPENUM_SERVICE_STATUSAr  rõ   rí   )rÊ  rÌ   ÚdwServiceStateÚ_EnumServicesStatusAr  ÚServicesReturnedÚResumeHANDLEÚServicesr)  ÚServicesBufferÚlpServicesArrayrÿ  rA   rA   rB   r  3  ó0   "
*
ör  c              
   C   r  r  )r  r  ÚEnumServicesStatusWr  r>   rš  r  r  r  r  r  r   r‡  r¥   r¡  rÜ   r"  r$  r#  r/  r0  r  ÚLPENUM_SERVICE_STATUSWr  rõ   rí   )rÊ  rÌ   r  Ú_EnumServicesStatusWr  r	  r
  r  r)  r  r  rÿ  rA   rA   rB   r  P  r  r  c                 C   sP  |t krtƒ ‚tjj}ttttttt	t	t	t
g
|_t|_tdƒ}tdƒ}tdƒ}|| |||d dt|ƒt|ƒt|ƒ|ƒ
 g }	d}
tƒ tkr |jttƒk rKnUt d|j¡}|| |||t|ƒt|ƒt|ƒt|ƒt|ƒ|ƒ
}
t|ƒttƒ|j k rxt ¡ ‚t t t |¡tj¡t¡}td|jƒD ]}|	 t|| ƒ¡ qŒ|
r›ntƒ tksC|
s¦t ¡ ‚|	S r  )ÚSC_ENUM_PROCESS_INFOr¹   r  r  ÚEnumServicesStatusExAr  ÚSC_ENUM_TYPEr>   rš  r  rÛ   r  r  r  r  r   r‡  r¥   r¡  rÞ   r"  r$  r#  r/  r0  r  ÚLPENUM_SERVICE_STATUS_PROCESSAr  rõ   r  )rÊ  rÿ  rÌ   r  ÚpszGroupNameÚ_EnumServicesStatusExAr  r	  r
  r  r)  r  r  rÿ  rA   rA   rB   r  {  s4   &
.
ör  c                 C   sP  t jj}ttttttttttg
|_	t
|_|tkrtƒ ‚tdƒ}tdƒ}tdƒ}|| |||d dt|ƒt|ƒt|ƒ|ƒ
 g }	d}
tƒ tkr |jttƒk rKnUt d|j¡}|| |||t|ƒt|ƒt|ƒt|ƒt|ƒ|ƒ
}
t|ƒttƒ|j k rxt ¡ ‚t t t |¡tj¡t¡}td|jƒD ]}|	 t|| ƒ¡ qŒ|
r›ntƒ tksC|
s¦t ¡ ‚|	S r  )r  r  ÚEnumServicesStatusExWr  r  r>   rš  r  rÝ   r  r  r  r  r¹   r  r   r‡  r¥   r¡  rà   r"  r$  r#  r/  r0  r  ÚLPENUM_SERVICE_STATUS_PROCESSWr  rõ   r  )rÊ  rÿ  rÌ   r  r  Ú_EnumServicesStatusExWr  r	  r
  r  r)  r  r  rÿ  rA   rA   rB   r  œ  s4   &
.
ör  c                 C   s,   t jj}ttg|_t|_t|_	||| ƒ d S r·   )
r  r  ÚSetThreadTokenrm  r{   r  r  r  rF  rG  )Útoken_handleÚthread_handleÚ_SetThreadTokenrA   rA   rB   r  Ï  s
   
r  c                 C   s   g | ]	}|  d ¡s|‘qS )Ú_)Ú
startswith)rþ  Ú_xrA   rA   rB   r  Ú  s    r  )T)rA   )
NNNr/   NNr/   NNN)Nr/   NNr/   NNN)
NNNNNFr/   NNN)r/   Nr¿  )Fr·   rr  )NNN)NN(ý  rª   ÚdefinesÚkernel32Ú_allÚsetÚvarsÚkeysÚSE_ASSIGNPRIMARYTOKEN_NAMEÚSE_AUDIT_NAMEÚSE_BACKUP_NAMEÚSE_CHANGE_NOTIFY_NAMEÚSE_CREATE_GLOBAL_NAMEÚSE_CREATE_PAGEFILE_NAMEÚSE_CREATE_PERMANENT_NAMEÚSE_CREATE_SYMBOLIC_LINK_NAMEÚSE_CREATE_TOKEN_NAMEÚSE_DEBUG_NAMEÚSE_ENABLE_DELEGATION_NAMEÚSE_IMPERSONATE_NAMEÚSE_INC_BASE_PRIORITY_NAMEÚSE_INCREASE_QUOTA_NAMEÚSE_INC_WORKING_SET_NAMEÚSE_LOAD_DRIVER_NAMEÚSE_LOCK_MEMORY_NAMEÚSE_MACHINE_ACCOUNT_NAMEÚSE_MANAGE_VOLUME_NAMEÚSE_PROF_SINGLE_PROCESS_NAMEÚSE_RELABEL_NAMEÚSE_REMOTE_SHUTDOWN_NAMEÚSE_RESTORE_NAMEÚSE_SECURITY_NAMEÚSE_SHUTDOWN_NAMEÚSE_SYNC_AGENT_NAMEÚSE_SYSTEM_ENVIRONMENT_NAMEÚSE_SYSTEM_PROFILE_NAMEÚSE_SYSTEMTIME_NAMEÚSE_TAKE_OWNERSHIP_NAMEÚSE_TCB_NAMEÚSE_TIME_ZONE_NAMEÚSE_TRUSTED_CREDMAN_ACCESS_NAMEÚSE_UNDOCK_NAMEÚSE_UNSOLICITED_INPUT_NAMEÚSE_PRIVILEGE_ENABLED_BY_DEFAULTrž  rŸ  ÚSE_PRIVILEGE_USED_FOR_ACCESSÚTOKEN_ADJUST_PRIVILEGESÚLOGON_WITH_PROFILEÚLOGON_NETCREDENTIALS_ONLYÚTOKEN_ASSIGN_PRIMARYÚTOKEN_DUPLICATEÚTOKEN_IMPERSONATEÚTOKEN_QUERYÚTOKEN_QUERY_SOURCEÚTOKEN_ADJUST_GROUPSÚTOKEN_ADJUST_DEFAULTÚTOKEN_ADJUST_SESSIONIDÚSTANDARD_RIGHTS_READÚ
TOKEN_READÚSTANDARD_RIGHTS_REQUIREDÚTOKEN_ALL_ACCESSr$  r%  r&  r'  r(  r)  ÚKEY_ALL_ACCESSÚKEY_CREATE_LINKÚKEY_CREATE_SUB_KEYÚKEY_ENUMERATE_SUB_KEYSÚKEY_EXECUTEÚ
KEY_NOTIFYÚKEY_QUERY_VALUEÚKEY_READÚKEY_SET_VALUEÚKEY_WOW64_32KEYÚKEY_WOW64_64KEYÚ	KEY_WRITEr{  r]  r^  r~  rY  ÚREG_DWORD_LITTLE_ENDIANrZ  ra  r_  ÚREG_RESOURCE_LISTÚREG_FULL_RESOURCE_DESCRIPTORÚREG_RESOURCE_REQUIREMENTS_LISTr[  ÚREG_QWORD_LITTLE_ENDIANÚ	Structurer8   rE  r‹  rD   rG   ÚPTOKEN_PRIVILEGESr"  Úc_intrÀ  r«  ÚTokenGroupsÚTokenPrivilegesr­  ÚTokenPrimaryGroupÚTokenDefaultDaclÚTokenSourcer€   ÚTokenImpersonationLevelr»  ÚTokenRestrictedSidsr³  ÚTokenGroupsAndPrivilegesÚTokenSessionReferencerµ  ÚTokenAuditPolicyr°  ÚTokenElevationTyperº  r±  r¶  ÚTokenAccessInformationr¸  r¹  r¯  r·  ÚTokenMandatoryPolicyÚTokenLogonSidÚTokenIsAppContainerÚTokenCapabilitiesr®  r´  ÚTokenUserClaimAttributesÚTokenDeviceClaimAttributesÚ"TokenRestrictedUserClaimAttributesÚ$TokenRestrictedDeviceClaimAttributesÚTokenDeviceGroupsÚTokenRestrictedDeviceGroupsÚTokenSecurityAttributesÚTokenIsRestrictedrª  r‡   ÚPTOKEN_TYPEÚTokenPrimaryÚTokenImpersonationÚTokenElevationTypeDefaultÚTokenElevationTypeFullÚTokenElevationTypeLimitedÚTOKEN_ELEVATION_TYPEÚPTOKEN_ELEVATION_TYPEÚSecurityAnonymousÚSecurityIdentificationÚSecurityImpersonationÚSecurityDelegationrˆ   ÚPSECURITY_IMPERSONATION_LEVELrf   ÚPSID_AND_ATTRIBUTESrj   ÚPTOKEN_USERrn   ÚPTOKEN_MANDATORY_LABELrp   ÚPTOKEN_OWNERrs   ÚPTOKEN_PRIMARY_GROUPru   ÚPTOKEN_APPCONTAINER_INFORMATIONrw   ÚPTOKEN_ORIGINry   ÚPTOKEN_LINKED_TOKENr|   ÚPTOKEN_STATISTICSÚSidTypeUserÚSidTypeGroupÚSidTypeDomainÚSidTypeAliasÚSidTypeWellKnownGroupÚSidTypeDeletedAccountÚSidTypeInvalidÚSidTypeUnknownÚSidTypeComputerÚSidTypeLabelÚWCT_MAX_NODE_COUNTrŽ   ÚWCT_ASYNC_OPEN_FLAGÚWCTP_OPEN_ALL_FLAGSÚWCT_OUT_OF_PROC_FLAGÚWCT_OUT_OF_PROC_COM_FLAGÚWCT_OUT_OF_PROC_CS_FLAGÚWCTP_GETINFO_ALL_FLAGSrš  rø  r>   r�   ÚWctCriticalSectionTypeÚWctSendMessageTypeÚWctMutexTypeÚWctAlpcTypeÚ
WctComTypeÚWctThreadWaitTypeÚWctProcessWaitTyper¤   ÚWctComActivationTypeÚWctUnknownTypeÚ
WctMaxTyperž   ÚWctStatusNoAccessÚWctStatusRunningÚWctStatusBlockedÚWctStatusPidOnlyÚWctStatusPidOnlyRpcssÚWctStatusOwnedÚWctStatusNotOwnedÚWctStatusAbandonedÚWctStatusUnknownÚWctStatusErrorÚWctStatusMaxr‰   r�   ÚUnionr–   r™   r  Úobjectr¡   r{   r«   r  ÚSAFER_SCOPEID_MACHINEÚSAFER_SCOPEID_USERÚSAFER_LEVEL_OPENÚSAFER_LEVELID_DISALLOWEDÚSAFER_LEVELID_UNTRUSTEDÚSAFER_LEVELID_CONSTRAINEDÚSAFER_LEVELID_NORMALUSERÚSAFER_LEVELID_FULLYTRUSTEDÚSAFER_POLICY_INFO_CLASSÚSaferPolicyLevelListÚ'SaferPolicyEnableTransparentEnforcementÚSaferPolicyDefaultLevelÚSaferPolicyEvaluateUserScopeÚSaferPolicyScopeFlagsÚSAFER_TOKEN_NULL_IF_EQUALÚSAFER_TOKEN_COMPARE_ONLYÚSAFER_TOKEN_MAKE_INERTÚSAFER_TOKEN_WANT_FLAGSÚSAFER_TOKEN_MASKr  ÚSERVICES_ACTIVE_DATABASEWÚSERVICES_FAILED_DATABASEWÚSERVICES_ACTIVE_DATABASEAÚSERVICES_FAILED_DATABASEAÚSC_GROUP_IDENTIFIERWÚSC_GROUP_IDENTIFIERAÚSERVICE_NO_CHANGErþ  rü  r  r  ÚSERVICE_ALL_ACCESSÚSERVICE_QUERY_CONFIGÚSERVICE_CHANGE_CONFIGÚSERVICE_QUERY_STATUSÚSERVICE_ENUMERATE_DEPENDENTSÚSERVICE_STARTÚSERVICE_STOPÚSERVICE_PAUSE_CONTINUEÚSERVICE_INTERROGATEÚSERVICE_USER_DEFINED_CONTROLÚSC_MANAGER_ALL_ACCESSÚSC_MANAGER_CONNECTÚSC_MANAGER_CREATE_SERVICEÚSC_MANAGER_ENUMERATE_SERVICEÚSC_MANAGER_LOCKÚSC_MANAGER_QUERY_LOCK_STATUSÚSC_MANAGER_MODIFY_BOOT_CONFIGÚSERVICE_BOOT_STARTÚSERVICE_SYSTEM_STARTÚSERVICE_AUTO_STARTÚSERVICE_DEMAND_STARTÚSERVICE_DISABLEDÚSERVICE_ERROR_IGNOREÚSERVICE_ERROR_NORMALÚSERVICE_ERROR_SEVEREÚSERVICE_ERROR_CRITICALÚSERVICE_ACTIVEÚSERVICE_INACTIVEÚSERVICE_STATE_ALLÚSERVICE_KERNEL_DRIVERÚSERVICE_FILE_SYSTEM_DRIVERÚSERVICE_ADAPTERÚSERVICE_RECOGNIZER_DRIVERÚSERVICE_WIN32_OWN_PROCESSÚSERVICE_WIN32_SHARE_PROCESSrô   ÚSERVICE_DRIVERÚSERVICE_WIN32rü   rú   rû   rù   rö   r÷   rø   ÚSERVICE_ACCEPT_STOPÚSERVICE_ACCEPT_PAUSE_CONTINUEÚSERVICE_ACCEPT_SHUTDOWNÚSERVICE_ACCEPT_PARAMCHANGEÚSERVICE_ACCEPT_NETBINDCHANGEÚ$SERVICE_ACCEPT_HARDWAREPROFILECHANGEÚSERVICE_ACCEPT_POWEREVENTÚSERVICE_ACCEPT_SESSIONCHANGEÚSERVICE_ACCEPT_PRESHUTDOWNÚSERVICE_RUNS_IN_SYSTEM_PROCESSÚSERVICE_CONTROL_STOPÚSERVICE_CONTROL_PAUSEÚSERVICE_CONTROL_CONTINUEÚSERVICE_CONTROL_INTERROGATEÚSERVICE_CONTROL_SHUTDOWNÚSERVICE_CONTROL_PARAMCHANGEÚSERVICE_CONTROL_NETBINDADDÚSERVICE_CONTROL_NETBINDREMOVEÚSERVICE_CONTROL_NETBINDENABLEÚSERVICE_CONTROL_NETBINDDISABLEÚSERVICE_CONTROL_DEVICEEVENTÚ%SERVICE_CONTROL_HARDWAREPROFILECHANGEÚSERVICE_CONTROL_POWEREVENTÚSERVICE_CONTROL_SESSIONCHANGEÚSERVICE_ACCEPT_TIMECHANGEÚSERVICE_ACCEPT_TRIGGEREVENTÚSERVICE_ACCEPT_USERMODEREBOOTÚSC_ACTION_NONEÚSC_ACTION_RESTARTÚSC_ACTION_REBOOTÚSC_ACTION_RUN_COMMANDÚSERVICE_CONFIG_DESCRIPTIONÚSERVICE_CONFIG_FAILURE_ACTIONSrË   rö  rÓ   ÚLPSERVICE_STATUS_PROCESSr×   rÜ   r  r  rÞ   rà   r  r  rÚ   rß   rí   r  r  ÚUserModeHandler  r  r  r  r  r+  ÚDefaultStringTypeÚGetUserNamer.  r;  ru  ÚLookupAccountNamer=  rB  ÚLookupAccountSidrD  rM  ÚConvertSidToStringSidrP  rT  ÚConvertStringSidToSidrW  r[  r_  ra  rg  rl  rt  ry  r}  rƒ  rŠ  r�  r�  r“  r—  ÚLookupPrivilegeNamer™  r¾  r¬  rË  rÍ  ÚMakeANSIVersionÚCreateProcessWithLogonAÚCreateProcessWithLogonrê  ÚCreateProcessWithTokenAÚCreateProcessWithTokenrî  rõ  ÚCreateProcessAsUserÚWINFUNCTYPEÚ	DWORD_PTRr  r  rù  r÷  r  r³   r  r  r  r  ÚSaferIsExecutableFileTyper  r-  r3  ÚRegConnectRegistryr5  r8  ÚRegCreateKeyr:  r<  Ú
RegOpenKeyr?  rD  ÚRegOpenKeyExrF  rH  rJ  rO  ÚRegQueryValuern  rX  ro  rp  ÚRegQueryValueExr…  r  r€  r†  r‹  Ú
RegEnumKeyr–  r�  rŽ  ÚRegEnumValuerš  rž  ÚRegDeleteValuer¡  r¤  ÚRegDeleteKeyValuer¦  r¨  ÚRegDeleteKeyr«  r®  ÚRegDeleteKeyExr±  r´  ÚRegCopyTreer¶  r¸  ÚRegDeleteTreer»  r  rÀ  rÅ  ÚOpenSCManagerrÈ  rÌ  ÚOpenServicerÏ  rÚ  ÚCreateServicerÜ  rà  rå  ÚGetServiceKeyNamerç  ré  ÚGetServiceDisplayNamerì  ró  ÚStartServicerõ  rú  rý  r  r  ÚEnumServicesStatusr  r  ÚEnumServicesStatusExr  Ú
differenceÚ__all__ÚsortrA   rA   rA   rB   Ú<module>   s*  ÿÿÿÿþþþý	0	Q&
.6
















	





	


+
V
0)%++










	


9
KV			öö2$$! 
