o
    Žõ±j’¿ ã                
   @   sÎ  d Z ddlT ddlT dZeeƒ  ¡ ƒZdZdZdZ	dZ
dZd	Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!dZ"d Z#d!Z$d"Z%d#Z&d$Z'd%Z(d&Z)d'Z*d(Z+d)Z,d*Z-d+Z.d,Z/d-Z0d.Z1d/Z2d0Z3d1Z4d2Z5d3Z6d4Z7d5Z8d6Z9d7Z:d8Z;d9Z<d:Z=d;Z>d<Z?d=Z@d>ZAd?ZBd@ZCdAZDdBZEdCZFdDZGdEZHdFZIdGZJdHZKdZLd'ZMd)ZNdIZOdEZPdZQd'ZRdZSd'ZTd)ZUd-ZVd5ZWdEZPdJZXdKZYdLZZe[eVB Z\e]eSB eTB eUB eVB eWB ePB eXB eYB eZB Z^dIZ_dMZ`dNZadOZbdPZcdQZddRZedEZfd)Zgd-ZhdSZid5ZjdZkdSZld'ZmdTZndLZodUZpdVZqdZrd'Zsd(Ztd)ZueuZvd*Zwd+Zxd,Zyd-Zzd.Z{d/Z|d0Z}e}Z~G dWdX„ dXeƒZ€e�e€ƒZ‚G dYdZ„ dZeƒZƒG d[d\„ d\eƒZ„e�e„ƒZ…e†j‡ZˆdZ‰d'ZŠd(Z‹d)ZŒd*Z�d+ZŽd,Z�d-Z�d.Z‘d/Z’d0Z“d1Z”d2Z•d3Z–d4Z—d5Z˜d6Z™d7Zšd8Z›d9Zœd:Z�d;Zžd<ZŸd=Z d>Z¡d?Z¢d@Z£dAZ¤dBZ¥dCZ¦dDZ§dEZ¨dFZ©dGZªdHZ«d]Z¬d^Z­d_Z®d`Z¯daZ°dbZ±e†j‡Z²e�e²ƒZ³dZ´d'ZµdZ¶d'Z·d(Z¸e†j‡Z¹e�e¹ƒZºdVZ»dZ¼d'Z½d(Z¾e†j‡Z¿e�e¿ƒZÀG dcdd„ ddeƒZÁe�eÁƒZÂG dedf„ dfeƒZÃe�eÃƒZÄG dgdh„ dheƒZÅe�eÅƒZÆG didj„ djeƒZÇe�eÇƒZÈG dkdl„ dleƒZÉe�eÉƒZÊG dmdn„ dneƒZËe�eËƒZÌG dodp„ dpeƒZÍe�eÍƒZÎG dqdr„ dreƒZÏe�eÏƒZÐG dsdt„ dteƒZÑe�eÑƒZÒdZÓd'ZÔd(ZÕd)ZÖd*Z×d+ZØd,ZÙd-ZÚd.ZÛd/ZÜd5ZÝdKZÞdZßeßZàdZád'Zâd)ZãeáeâB eãB ZäeåZæeçZèdZéd'Zêd(Zëd)Zìd*Zíd+Zîd,Zïd-Zðd.Zñd/Zòd0ZóeçZôdZõd'Zöd(Z÷d)Zød*Zùd+Zúd,Zûd-Züd.Zýd/Zþd0ZÿG dudv„ dveƒ�Z G dwdx„ dxeƒ�ZG dydz„ dz�eƒ�ZG d{d|„ d|eƒ�Ze��eƒ�ZG d}d~„ d~�eƒ�ZG dd€„ d€�eƒ�Z	�e�Z
d�Zd'�Zd�ZdV�Zd��Zd‚�Zdƒ�Zd„�Zeç�Zd�Zd'�Zd(�Zd)�Zd*�Zd�Zd'�Zd)�Zd-�Zd4�Z�e�Zd…�Zd†�Z d…�Z!d†�Z"d‡�Z#d‡�Z$dˆ�Z%e†j‡�Z&dV�Z'e†j‡�Z(dV�Z)d‰�Z*d�Z+d'�Z,d)�Z-d-�Z.d5�Z/dE�Z0dJ�Z1dK�Z2dL�Z3dR�Z4d�Z5d'�Z6d)�Z7d-�Z8d5�Z9dE�Z:dV�Z;d�Z<d'�Z=d(�Z>d)�Z?dV�Z@d�ZAd'�ZBd(�ZCd�ZDd'�ZEd(�ZFd�ZGd'�ZHd)�ZId-�ZJd5�ZKdE�ZLdL�ZMd0�ZNdŠ�ZOd�ZPd'�ZQd(�ZRd)�ZSd*�ZTd+�ZUd,�ZVd�ZWd'�ZXd)�ZYd-�ZZd5�Z[dE�Z\dJ�Z]dK�Z^dL�Z_d�Z`d�Zad'�Zbd(�Zcd)�Zdd*�Zed+�Zfd,�Zgd-�Zhd.�Zid/�Zjd0�Zkd1�Zld2�Zmd3�Znd�ZWd'�ZXd)�ZYd-�ZZd5�Z[dE�Z\dJ�Z]dK�Z^dL�Z_dT�Zod‹�ZpdŒ�ZqdV�Zrd�Zsd'�Ztd(�Zud�Zvd'�ZwG d�dŽ„ dŽeƒ�Zxe��exƒ�ZyG d�d�„ d�eƒ�Zze��ezƒ�Z{G d‘d’„ d’eƒ�Z|G d“d”„ d”eƒ�Z}e��e|ƒ�Z~e��e}ƒ�ZG d•d–„ d–eƒ�Z€G d—d˜„ d˜eƒ�Z�e��e€ƒ�Z‚e��e�ƒ�ZƒG d™dš„ dš�eƒ�Z„G d›dœ„ dœ�eƒ�Z…G d�dž„ dž�eƒ�Z†G dŸd „ d �eƒ�Z‡G d¡d¢„ d¢�eƒ�ZˆG d£d¤„ d¤�e‰ƒ�ZŠG d¥d¦„ d¦�e‰ƒ�Z‹G d§d¨„ d¨�e‰ƒ�ZŒG d©dª„ dª�e‰ƒ�Z�d«d¬„ �ZŽd­d®„ �Z��e��eŽ�e�ƒ�Z‘d¯d°„ �Z’d±d²„ �Z“�e”�e’�e“ƒ�Z•d³d´„ �Z–dµd¶„ �Z—�e”�e–�e—ƒ�Z˜d·d¸„ �Z™d¹dº„ �Zš�e��e™�ešƒ�Z›d»d¼„ �Zœd½d¾„ �Z��e”�eœ�e�ƒ�Zžd¿dÀ„ �ZŸdÁdÂ„ �Z dÃdÄ„ �Z¡dÅdÆ„ �Z¢dÇdÈ„ �Z£e^fdÉdÊ„�Z¤�dwdÌdÍ„�Z¥e½fdÎdÏ„�Z¦e^de½e´fdÐdÑ„�Z§dÒdÓ„ �Z¨dÔdÕ„ �Z©dÖd×„ �Zª�e”�e©�eªƒ�Z«dØdÙ„ �Z¬dÚdÛ„ �Z­�e”�e¬�e­ƒ�Z®�dxdÝdÞ„�Z¯dßdà„ �Z°dádâ„ �Z±dãdä„ �Z²�dydådæ„�Z³�e´�e³ƒ�Zµ�e��eµ�e³ƒ�Z¶�dzdçdè„�Z·�e´�e·ƒ�Z¸�e��e¸�e·ƒ�Z¹�d{dêdë„�Zº�d{dìdí„�Z»�e”�eº�e»ƒ�Z¼�e½eæ�e¾eç�e¿�e�eÀƒ�ZÁ�d|dîdï„�ZÂdeädðeÝfdñdò„�ZÃdódô„ �ZÄ�e�edVfdõdö„�ZÅ�d}d÷dø„�ZÆdùdú„ �ZÇ�d~dûdü„�ZÈ�eÈ�ZÉdýdþ„ �ZÊdeafdÿ�d „�ZËdeaf�d�d„�ZÌ�e”�eË�eÌƒ�ZÍeadf�d�d„�ZÎeadf�d�d„�ZÏ�e”�eÎ�eÏƒ�ZÐeadf�d�d„�ZÑeadf�d	�d
„�ZÒ�e”�eÑ�eÒƒ�ZÓeadeef�d�d„�ZÔeadeef�d�d„�ZÕ�e”�eÔ�eÕƒ�ZÖeef�d�d„�Z×eef�d�d„�ZØ�d�d�d„�ZÙ�d�d�d„�ZÚ�e”�eÙ�eÚƒ�ZÛ�d€�d�d„�ZÜ�d�d„ �ZÝ�d€�d�d„�ZÞ�d€�d�d„�Zß�e”�eÞ�eßƒ�Zà�d��d�d „�Zá�eá �Zâ�Zã�d!�d"„ �Zä�d#�d$„ �Zå�e��eä�eåƒ�Zæ�dw�d%�d&„�Zç�dw�d'�d(„�Zè�dw�d)�d*„�Zé�e��eè�eéƒ�Zê�d�d+�d,„�Zë�d�d-�d.„�Zì�e”�eë�eìƒ�Zí�d‚�d/�d0„�Zî�d‚�d1�d2„�Zï�e”�eî�eïƒ�Zð�d�d3�d4„�Zñ�d�d5�d6„�Zò�e”�eñ�eòƒ�Zódenf�d7�d8„�Zôdenf�d9�d:„�Zõ�e”�eô�eõƒ�Zö�d;�d<„ �Z÷�d=�d>„ �Zø�e”�e÷�eøƒ�Zù�d�d?�d@„�Zú�d�dA�dB„�Zû�e”�eú�eûƒ�Zü�dC�dD„ �Zý�dE�dF„ �Zþdd�e4f�dG�dH„�Zÿdd�e4f�dI�dJ„�Z �e”�eÿ�e ƒ�Z�e*f�dK�dL„�Z�e*f�dM�dN„�Z�e”�e�eƒ�Zd�e*�eK�e>�eAdddddf
�dO�dP„�Zd�e*�eK�e>�eAdddddf
�dQ�dR„�Z�e”�e�eƒ�Z�dS�dT„ �Z�dU�dV„ �Z	�dW�dX„ �Z
�e”�e	�e
ƒ�Z�dY�dZ„ �Z�d[�d\„ �Z�e”�e�eƒ�Z�d�d]�d^„�Z�d�d_�d`„�Z�e”�e�eƒ�Z�da�db„ �Z�dc�dd„ �Z�e'f�de�df„�Z�eN�eOB �eFf�dg�dh„�Z�eN�eOB �eFf�di�dj„�Z�e��e�eƒ�Z�e)�eN�eOB �eFdf�dk�dl„�Z�e)�eN�eOB �eFdf�dm�dn„�Z�e��e�eƒ�Z�d�do�dp„�Z�dq�dr„ �Z�d}�ds�dt„�Zeeƒ  ¡ ƒ� e¡Z�du�dv„ eD ƒ�Z�e�  ¡  dS (ƒ  z%
Wrapper for advapi32.dll in ctypes.
é   )Ú*NÚSeAssignPrimaryTokenPrivilegeÚSeAuditPrivilegeÚSeBackupPrivilegeÚSeChangeNotifyPrivilegeÚSeCreateGlobalPrivilegeÚSeCreatePagefilePrivilegeÚSeCreatePermanentPrivilegeÚSeCreateSymbolicLinkPrivilegeÚSeCreateTokenPrivilegeÚSeDebugPrivilegeÚSeEnableDelegationPrivilegeÚSeImpersonatePrivilegeÚSeIncreaseBasePriorityPrivilegeÚSeIncreaseQuotaPrivilegeÚSeIncreaseWorkingSetPrivilegeÚSeLoadDriverPrivilegeÚSeLockMemoryPrivilegeÚSeMachineAccountPrivilegeÚSeManageVolumePrivilegeÚSeProfileSingleProcessPrivilegeÚSeRelabelPrivilegeÚSeRemoteShutdownPrivilegeÚSeRestorePrivilegeÚSeSecurityPrivilegeÚSeShutdownPrivilegeÚSeSyncAgentPrivilegeÚSeSystemEnvironmentPrivilegeÚSeSystemProfilePrivilegeÚSeSystemtimePrivilegeÚSeTakeOwnershipPrivilegeÚSeTcbPrivilegeÚSeTimeZonePrivilegeÚSeTrustedCredManAccessPrivilegeÚSeUndockPrivilegeÚSeUnsolicitedInputPrivilegeé   é   é   é   é   é   é   é	   é
   é   é   é   é   é   é   é   é   é   é   é   é   é   é   é   é   é   é   é   é   é   é    é!   é"   é#   l        é@   é€   é   l       l       l       l       l       i?  i  é   i  é    c                   @   ó   e Zd ZdefdefgZdS )ÚLUIDÚLowPartÚHighPartN)Ú__name__Ú
__module__Ú__qualname__ÚDWORDÚLONGÚ_fields_© rW   rW   ú§/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/winapi/local/function_defs/advapi32.pyrN   À   ó    þrN   c                   @   rM   )ÚLUID_AND_ATTRIBUTESÚLuidÚ
AttributesN)rQ   rR   rS   rN   rT   rV   rW   rW   rW   rX   rZ   Í   rY   rZ   c                   @   rM   )ÚTOKEN_PRIVILEGESÚPrivilegeCountÚ
PrivilegesN)rQ   rR   rS   rT   rZ   rV   rW   rW   rW   rX   r]   Ø   s    ýr]   é$   é%   é&   é'   é(   é)   c                   @   rM   )ÚSID_AND_ATTRIBUTESÚSidr\   N)rQ   rR   rS   ÚPSIDrT   rV   rW   rW   rW   rX   rf   g  rY   rf   c                   @   ó   e Zd ZdefgZdS )Ú
TOKEN_USERÚUserN©rQ   rR   rS   rf   rV   rW   rW   rW   rX   rj   q  ó    ÿrj   c                   @   ri   )ÚTOKEN_MANDATORY_LABELÚLabelNrl   rW   rW   rW   rX   rn   z  rm   rn   c                   @   ri   )ÚTOKEN_OWNERÚOwnerN©rQ   rR   rS   rh   rV   rW   rW   rW   rX   rp   ƒ  rm   rp   c                   @   ri   )ÚTOKEN_PRIMARY_GROUPÚPrimaryGroupNrr   rW   rW   rW   rX   rs   Œ  rm   rs   c                   @   ri   )ÚTOKEN_APPCONTAINER_INFORMATIONÚTokenAppContainerNrr   rW   rW   rW   rX   ru   •  rm   ru   c                   @   ri   )ÚTOKEN_ORIGINÚOriginatingLogonSessionN)rQ   rR   rS   rN   rV   rW   rW   rW   rX   rw   ž  rm   rw   c                   @   ri   )ÚTOKEN_LINKED_TOKENÚLinkedTokenN)rQ   rR   rS   ÚHANDLErV   rW   rW   rW   rX   ry   §  rm   ry   c                   @   sL   e Zd Zdefdefdefdefdefdefdefdefd	efd
efg
ZdS )ÚTOKEN_STATISTICSÚTokenIdÚAuthenticationIdÚExpirationTimeÚ	TokenTypeÚImpersonationLevelÚDynamicChargedÚDynamicAvailableÚ
GroupCountr^   Ú
ModifiedIdN)	rQ   rR   rS   rN   ÚLONGLONGÚ
TOKEN_TYPEÚSECURITY_IMPERSONATION_LEVELrT   rV   rW   rW   rW   rX   r|   ¹  s    ör|   c                   @   s&   e Zd Zdee fdefdefgZdS )Ú_WAITCHAIN_NODE_INFO_STRUCT_1Ú
ObjectNameÚTimeoutÚ	AlertableN)rQ   rR   rS   ÚWCHARÚWCT_OBJNAME_LENGTHr†   ÚBOOLrV   rW   rW   rW   rX   r‰   ;  s
    
ýr‰   c                   @   s(   e Zd ZdefdefdefdefgZdS )Ú_WAITCHAIN_NODE_INFO_STRUCT_2Ú	ProcessIdÚThreadIdÚWaitTimeÚContextSwitchesN©rQ   rR   rS   rT   rV   rW   rW   rW   rX   r�   B  s    ür�   c                   @   rM   )Ú_WAITCHAIN_NODE_INFO_UNIONÚ
LockObjectÚThreadObjectN)rQ   rR   rS   r‰   r�   rV   rW   rW   rW   rX   r–   J  rY   r–   c                   @   s"   e Zd ZdefdefdefgZdS )ÚWAITCHAIN_NODE_INFOÚ
ObjectTypeÚObjectStatusÚuN)rQ   rR   rS   ÚWCT_OBJECT_TYPEÚWCT_OBJECT_STATUSr–   rV   rW   rW   rW   rX   r™   P  ó
    ýr™   c                   @   ó   e Zd ZdZdd„ ZdS )ÚWaitChainNodeInfoa  
	Represents a node in the wait chain.

	It's a wrapper on the L{WAITCHAIN_NODE_INFO} structure.

	The following members are defined only
	if the node is of L{WctThreadType} type:
	 - C{ProcessId}
	 - C{ThreadId}
	 - C{WaitTime}
	 - C{ContextSwitches}

	@see: L{GetThreadWaitChain}

	@type ObjectName: unicode
	@ivar ObjectName: Object name. May be an empty string.

	@type ObjectType: int
	@ivar ObjectType: Object type.
		Should be one of the following values:
		 - L{WctCriticalSectionType}
		 - L{WctSendMessageType}
		 - L{WctMutexType}
		 - L{WctAlpcType}
		 - L{WctComType}
		 - L{WctThreadWaitType}
		 - L{WctProcessWaitType}
		 - L{WctThreadType}
		 - L{WctComActivationType}
		 - L{WctUnknownType}

	@type ObjectStatus: int
	@ivar ObjectStatus: Wait status.
		Should be one of the following values:
		 - L{WctStatusNoAccess} I{(ACCESS_DENIED for this object)}
		 - L{WctStatusRunning} I{(Thread status)}
		 - L{WctStatusBlocked} I{(Thread status)}
		 - L{WctStatusPidOnly} I{(Thread status)}
		 - L{WctStatusPidOnlyRpcss} I{(Thread status)}
		 - L{WctStatusOwned} I{(Dispatcher object status)}
		 - L{WctStatusNotOwned} I{(Dispatcher object status)}
		 - L{WctStatusAbandoned} I{(Dispatcher object status)}
		 - L{WctStatusUnknown} I{(All objects)}
		 - L{WctStatusError} I{(All objects)}

	@type ProcessId: int
	@ivar ProcessId: Process global ID.

	@type ThreadId: int
	@ivar ThreadId: Thread global ID.

	@type WaitTime: int
	@ivar WaitTime: Wait time.

	@type ContextSwitches: int
	@ivar ContextSwitches: Number of context switches.
	c                 C   sf   |j | _ |j| _| j tkr*|jjj| _|jjj| _|jjj| _|jjj| _d| _	d S |jj
j	j| _	d S ©NÚ )rš   r›   ÚWctThreadTyperœ   r˜   r‘   r’   r“   r”   rŠ   r—   Úvalue)ÚselfÚ
aStructurerW   rW   rX   Ú__init__œ  s   

zWaitChainNodeInfo.__init__N©rQ   rR   rS   Ú__doc__r¨   rW   rW   rW   rX   r¡   Y  s    Br¡   c                       sT   e Zd ZdZd‡ fdd„	Zdd„ Zdd„ Zdd	d
„Zedd„ ƒZ	edd„ ƒZ
‡  ZS )ÚThreadWaitChainSessionHANDLEzd
	Thread wait chain session handle.

	Returned by L{OpenThreadWaitChainSession}.

	@see: L{HANDLE}
	Nc                    s   t t| ƒj|dd� dS )z?
		@type  aHANDLE: int
		@param aHANDLE: Win32 handle value.
		T©Ú
bOwnershipN)Úsuperr«   r¨   )r¦   ÚaHANDLE©Ú	__class__rW   rX   r¨   ³  s   
ÿz%ThreadWaitChainSessionHANDLE.__init__c                 C   s    | j d u r	tdƒ‚t| j ƒ d S )NzHANDLE was already closed!)r¥   Ú
ValueErrorÚCloseThreadWaitChainSession©r¦   rW   rW   rX   Ú_close»  s   
z#ThreadWaitChainSessionHANDLE._closec                 C   ó   t ƒ ‚©N©ÚNotImplementedErrorr´   rW   rW   rX   ÚdupÀ  ó   z ThreadWaitChainSessionHANDLE.dupc                 C   r¶   r·   r¸   )r¦   ÚdwMillisecondsrW   rW   rX   ÚwaitÃ  r»   z!ThreadWaitChainSessionHANDLE.waitc                 C   ó   dS ©NFrW   r´   rW   rW   rX   ÚinheritÆ  ó   z$ThreadWaitChainSessionHANDLE.inheritc                 C   r¾   r¿   rW   r´   rW   rW   rX   ÚprotectFromCloseÊ  rÁ   z-ThreadWaitChainSessionHANDLE.protectFromCloser·   )rQ   rR   rS   rª   r¨   rµ   rº   r½   ÚpropertyrÀ   rÂ   Ú__classcell__rW   rW   r°   rX   r«   ª  s    

r«   i   é   i   i   ÚServicesActiveÚServicesFailedú+l   ÿÿ iÿ é0   é   i   c                   @   s:   e Zd ZdefdefdefdefdefdefdefgZdS )	ÚSERVICE_STATUSÚdwServiceTypeÚdwCurrentStateÚdwControlsAcceptedÚdwWin32ExitCodeÚdwServiceSpecificExitCodeÚdwCheckPointÚ
dwWaitHintNr•   rW   rW   rW   rX   rË   ~  s    ùrË   c                   @   s"   e Zd Zejdefdefg ZdS )ÚSERVICE_STATUS_PROCESSÚdwProcessIdÚdwServiceFlagsN)rQ   rR   rS   rË   rV   rT   rW   rW   rW   rX   rÓ   •  s
    
þrÓ   c                   @   ó"   e Zd ZdefdefdefgZdS )ÚENUM_SERVICE_STATUSAÚlpServiceNameÚlpDisplayNameÚServiceStatusN)rQ   rR   rS   ÚLPSTRrË   rV   rW   rW   rW   rX   r×   ¡  rŸ   r×   c                   @   rÖ   )ÚENUM_SERVICE_STATUSWrØ   rÙ   rÚ   N)rQ   rR   rS   ÚLPWSTRrË   rV   rW   rW   rW   rX   rÜ   §  rŸ   rÜ   c                   @   rÖ   )ÚENUM_SERVICE_STATUS_PROCESSArØ   rÙ   ÚServiceStatusProcessN)rQ   rR   rS   rÛ   rÓ   rV   rW   rW   rW   rX   rÞ   µ  rŸ   rÞ   c                   @   rÖ   )ÚENUM_SERVICE_STATUS_PROCESSWrØ   rÙ   rß   N)rQ   rR   rS   rÝ   rÓ   rV   rW   rW   rW   rX   rà   »  rŸ   rà   c                   @   r    )rÚ   z0
	Wrapper for the L{SERVICE_STATUS} structure.
	c                 C   s<   |j | _|j| _|j| _|j| _|j| _	|j
| _|j| _dS )z]
		@type  raw: L{SERVICE_STATUS}
		@param raw: Raw structure for this service status data.
		N)rÌ   ÚServiceTyperÍ   ÚCurrentStaterÎ   ÚControlsAcceptedrÏ   ÚWin32ExitCoderÐ   ÚServiceSpecificExitCoderÑ   Ú
CheckPointrÒ   ÚWaitHint©r¦   ÚrawrW   rW   rX   r¨   É  s   zServiceStatus.__init__Nr©   rW   rW   rW   rX   rÚ   Ä  ó    rÚ   c                   @   r    )rß   z8
	Wrapper for the L{SERVICE_STATUS_PROCESS} structure.
	c                 C   sL   |j | _|j| _|j| _|j| _|j| _	|j
| _|j| _|j| _|j| _dS )ze
		@type  raw: L{SERVICE_STATUS_PROCESS}
		@param raw: Raw structure for this service status data.
		N)rÌ   rá   rÍ   râ   rÎ   rã   rÏ   rä   rÐ   rå   rÑ   ræ   rÒ   rç   rÔ   r‘   rÕ   ÚServiceFlagsrè   rW   rW   rX   r¨   Û  s   zServiceStatusProcess.__init__Nr©   rW   rW   rW   rX   rß   Ö  rê   rß   c                   @   ó    e Zd ZdZdd„ Zdd„ ZdS )ÚServiceStatusEntryz;
	Service status entry returned by L{EnumServicesStatus}.
	c                 C   sZ   |j | _|j| _|jj| _|jj| _|jj	| _
|jj| _|jj| _|jj| _|jj| _dS )z
		@type  raw: L{ENUM_SERVICE_STATUSA} or L{ENUM_SERVICE_STATUSW}
		@param raw: Raw structure for this service status entry.
		N)rØ   ÚServiceNamerÙ   ÚDisplayNamerÚ   rÌ   rá   rÍ   râ   rÎ   rã   rÏ   rä   rÐ   rå   rÑ   ræ   rÒ   rç   rè   rW   rW   rX   r¨   ï  s   





zServiceStatusEntry.__init__c                 C   sô   g }| j t@ r| d¡ n| d¡ | jr!| d| j| jf ¡ n| d| j ¡ | jtkr4| d¡ nA| jtkr?| d¡ n6| jtkrJ| d¡ n+| jt	krU| d¡ n | jt
kr`| d	¡ n| jtkrk| d
¡ n
| jtkru| d¡ d |¡S )NzInteractive serviceÚServiceú	"%s" (%s)ú"%s"zis about to continue.zis pausing.z
is paused.zis running.zis starting.zis stopping.zis stopped.ú )rá   ÚSERVICE_INTERACTIVE_PROCESSÚappendrï   rî   râ   ÚSERVICE_CONTINUE_PENDINGÚSERVICE_PAUSE_PENDINGÚSERVICE_PAUSEDÚSERVICE_RUNNINGÚSERVICE_START_PENDINGÚSERVICE_STOP_PENDINGÚSERVICE_STOPPEDÚjoin©r¦   ÚoutputrW   rW   rX   Ú__str__þ  s,   










zServiceStatusEntry.__str__N©rQ   rR   rS   rª   r¨   r   rW   rW   rW   rX   rí   ê  s    rí   c                   @   rì   )ÚServiceStatusProcessEntryz=
	Service status entry returned by L{EnumServicesStatusEx}.
	c                 C   sn   |j | _|j| _|jj| _|jj| _|jj	| _
|jj| _|jj| _|jj| _|jj| _|jj| _|jj| _dS )z�
		@type  raw: L{ENUM_SERVICE_STATUS_PROCESSA} or L{ENUM_SERVICE_STATUS_PROCESSW}
		@param raw: Raw structure for this service status entry.
		N)rØ   rî   rÙ   rï   rß   rÌ   rá   rÍ   râ   rÎ   rã   rÏ   rä   rÐ   rå   rÑ   ræ   rÒ   rç   rÔ   r‘   rÕ   rë   rè   rW   rW   rX   r¨     s   







z"ServiceStatusProcessEntry.__init__c                 C   s  g }| j t@ r| d¡ n| d¡ | jr!| d| j| jf ¡ n| d| j ¡ | jtkr4| d¡ nA| jtkr?| d¡ n6| jtkrJ| d¡ n+| jt	krU| d¡ n | jt
kr`| d	¡ n| jtkrk| d
¡ n
| jtkru| d¡ | jr€| d| j ¡ | d¡ d |¡S )NzInteractive service zService rñ   rò   z is about to continuez is pausingz
 is pausedz is runningz is startingz is stoppingz is stoppedz at process %dÚ.r£   )rá   rô   rõ   rï   rî   râ   rö   r÷   rø   rù   rú   rû   rü   r‘   rý   rþ   rW   rW   rX   r   .  s2   











z!ServiceStatusProcessEntry.__str__Nr  rW   rW   rW   rX   r    s    r  c                   @   s   e Zd ZdZdS )ÚTokenHandlez*
	Access token handle.

	@see: L{HANDLE}
	N)rQ   rR   rS   rª   rW   rW   rW   rX   r  N  s    r  c                   @   ó   e Zd ZdZeZdd„ ZdS )ÚRegistryKeyHandlez
	Registry key handle.
	c                 C   ó   t | jƒ d S r·   )ÚRegCloseKeyr¥   r´   rW   rW   rX   rµ   ]  ó   zRegistryKeyHandle._closeN)rQ   rR   rS   rª   ÚHKEYÚ_TYPErµ   rW   rW   rW   rX   r  V  s    r  c                   @   r  )ÚSaferLevelHandlez_
	Safer level handle.

	@see: U{http://msdn.microsoft.com/en-us/library/ms722425(VS.85).aspx}
	c                 C   r  r·   )ÚSaferCloseLevelr¥   r´   rW   rW   rX   rµ   i  r	  zSaferLevelHandle._closeN)rQ   rR   rS   rª   ÚSAFER_LEVEL_HANDLEr  rµ   rW   rW   rW   rX   r  `  ó    r  c                   @   r  )ÚServiceHandlezm
	Service handle.

	@see: U{http://msdn.microsoft.com/en-us/library/windows/desktop/ms684330(v=vs.85).aspx}
	c                 C   r  r·   ©ÚCloseServiceHANDLEr¥   r´   rW   rW   rX   rµ   u  r	  zServiceHandle._closeN©rQ   rR   rS   rª   Ú	SC_HANDLEr  rµ   rW   rW   rW   rX   r  l  r  r  c                   @   r  )ÚServiceControlManagerHandlezƒ
	Service Control Manager (SCM) handle.

	@see: U{http://msdn.microsoft.com/en-us/library/windows/desktop/ms684323(v=vs.85).aspx}
	c                 C   r  r·   r  r´   rW   rW   rX   rµ   �  r	  z"ServiceControlManagerHandle._closeNr  rW   rW   rW   rX   r  x  r  r  c                  C   óx   t jj} ttg| _t| _tdƒ}| d t	|ƒƒ t
ƒ }|tkr#t |¡‚t d|jd ¡}| |t	|ƒƒ}|s9t ¡ ‚|jS ©NrL   r£   r   )ÚwindllÚadvapi32ÚGetUserNameArÛ   ÚLPDWORDÚargtypesÚboolÚrestyperT   ÚbyrefÚGetLastErrorÚERROR_INSUFFICIENT_BUFFERÚctypesÚWinErrorÚcreate_string_bufferr¥   )Ú_GetUserNameAÚnSizeÚerrorÚlpBufferÚsuccessrW   rW   rX   r  Š  ó   

r  c                  C   r  r  )r  r  ÚGetUserNameWrÝ   r  r  r  r  rT   r  r   r!  r"  r#  Úcreate_unicode_bufferr¥   )Ú_GetUserNameWr&  r'  r(  r)  rW   rW   rX   r+  š  r*  r+  c              	   C   sÞ   t jj}tttttttg|_t|_t	dƒ}t	dƒ}t	dƒ}|| |d t
|ƒd t
|ƒt
|ƒƒ tƒ }|tkr9t |¡‚t d|j¡}t t |¡t¡}t d|jd ¡}	|| ||t
|ƒ|	t
|ƒt
|ƒƒ}
|
sht ¡ ‚||	j|jfS r  )r  r  ÚLookupAccountNameArÛ   rh   r  r  r�   r  rT   r  r   r!  r"  r#  r$  r¥   ÚcastÚpointer)ÚlpSystemNameÚlpAccountNameÚ_LookupAccountNameAÚcbSidÚcchReferencedDomainNameÚpeUser'  ÚsidÚpsidÚlpReferencedDomainNamer)  rW   rW   rX   r.  µ  ó"    
 r.  c              	   C   sÞ   t jj}tttttttg|_t|_t	dƒ}t	dƒ}t	dƒ}|| |d t
|ƒd t
|ƒt
|ƒƒ tƒ }|tkr9t |¡‚t d|j¡}t t |¡t¡}t d|jd ¡}	|| ||t
|ƒ|	t
|ƒt
|ƒƒ}
|
sht ¡ ‚||	j|jfS r  )r  r  ÚLookupAccountNameWrÝ   rh   r  r  r�   r  rT   r  r   r!  r"  r#  r$  r¥   r/  r0  r,  )r1  r2  Ú_LookupAccountNameWr4  r5  r6  r'  r7  r8  r9  r)  rW   rW   rX   r;  É  r:  r;  c           
   	   C   sÎ   t jj}tttttttg|_t|_t	dƒ}t	dƒ}t	dƒ}|| |d t
|ƒd t
|ƒt
|ƒƒ tƒ }|tkr9t |¡‚t d|d ¡}t d|d ¡}|| ||t
|ƒ|t
|ƒt
|ƒƒ}	|	s_t ¡ ‚|j|j|jfS r  )r  r  ÚLookupAccountSidArÛ   rh   r  r  r  r  rT   r  r   r!  r"  r#  r$  r¥   )
r1  ÚlpSidÚ_LookupAccountSidAÚcchNamer5  r6  r'  ÚlpNamer9  r)  rW   rW   rX   r=  è  s     
 r=  c           
   	   C   sÒ   t jj}tttttttg|_t|_	t
dƒ}t
dƒ}t
dƒ}|| |d t|ƒd t|ƒt|ƒƒ tƒ }|tkr9t |¡‚t d|jd ¡}t d|jd ¡}|| ||t|ƒ|t|ƒt|ƒƒ}	|	sat ¡ ‚|j|j|jfS r  )r  r  ÚLookupAccountSidWrÛ   rh   rÝ   r  r  r  r  rT   r  r   r!  r"  r#  r,  r¥   )
r1  r>  Ú_LookupAccountSidWr@  r5  r6  r'  rA  r9  r)  rW   rW   rX   rB  û  s     
 rB  c                 C   sZ   t jj}tttƒg|_t|_t	|_
tƒ }|| t|ƒƒ z|j}W t|ƒ | ¡ S t|ƒ w r·   )r  r  ÚConvertSidToStringSidArh   ÚPOINTERrÛ   r  r  r  ÚRaiseIfZeroÚerrcheckr  r¥   Ú	LocalFreeÚdecode)rg   Ú_ConvertSidToStringSidAÚ
pStringSidÚ	StringSidrW   rW   rX   rD    s   
ÿrD  c                 C   sV   t jj}tttƒg|_t|_t	|_
tƒ }|| t|ƒƒ z
|j}W t|ƒ |S t|ƒ w r·   )r  r  ÚConvertSidToStringSidWrh   rE  rÝ   r  r  r  rF  rG  r  r¥   rH  )rg   Ú_ConvertSidToStringSidWrK  rL  rW   rW   rX   rM  "  s   
ÿrM  c                 C   ó:   t jj}ttg|_t|_t|_	tƒ }|| t
 |¡ƒ |jS r·   )r  r  ÚConvertStringSidToSidArÛ   ÚPVOIDr  r  r  rF  rG  r"  r0  r¥   )rL  Ú_ConvertStringSidToSidArg   rW   rW   rX   rP  6  ó   
rP  c                 C   rO  r·   )r  r  ÚConvertStringSidToSidWrÝ   rQ  r  r  r  rF  rG  r"  r0  r¥   )rL  Ú_ConvertStringSidToSidWrg   rW   rW   rX   rT  @  rS  rT  c                 C   ó   t jj}tg|_t|_|| ƒS r·   )r  r  Ú
IsValidSidrh   r  r  r  )ÚpSidÚ_IsValidSidrW   rW   rX   rW  O  ó   rW  c                 C   s"   t jj}ttg|_t|_|| |ƒS r·   )r  r  ÚEqualSidrh   r  r  r  )ÚpSid1ÚpSid2Ú	_EqualSidrW   rW   rX   r[  Y  s   

r[  c                 C   rV  r·   )r  r  ÚGetLengthSidrh   r  rT   r  )rX  Ú_GetLengthSidrW   rW   rX   r_  b  rZ  r_  c                 C   s^   t jj}tttg|_t|_t	|_
t| ƒ}t d|¡}t t |¡t¡}|||| ƒ t |t¡S r¢   )r  r  ÚCopySidrT   rQ  rh   r  r  r  rF  rG  r_  r"  r$  r/  r0  )Ú
pSourceSidÚ_CopySidÚnDestinationSidLengthÚDestinationSidÚpDestinationSidrW   rW   rX   ra  m  s   ra  c                 C   s(   t jj}tg|_t|_t|_|| ƒ d S r·   )r  r  ÚFreeSidrh   r  r  ÚRaiseIfNotZerorG  )rX  Ú_FreeSidrW   rW   rX   rg  |  ó
   rg  c                 C   óB   t jj}tttg|_t|_t	|_
ttƒ}|| |t|ƒƒ t|jƒS r·   )r  r  ÚOpenProcessTokenr{   rT   ÚPHANDLEr  r  r  rF  rG  ÚINVALID_HANDLE_VALUEr  r  r¥   )ÚProcessHANDLEÚDesiredAccessÚ_OpenProcessTokenÚNewTokenHandlerW   rW   rX   rl  ˆ  ó   
rl  Tc                 C   sF   t jj}ttttg|_t|_	t
|_ttƒ}|| ||t|ƒƒ t|jƒS r·   )r  r  ÚOpenThreadTokenr{   rT   r�   rm  r  r  r  rF  rG  rn  r  r  r¥   )ÚThreadHANDLErp  Ú
OpenAsSelfÚ_OpenThreadTokenrr  rW   rW   rX   rt  ˜  ó   
rt  c                 C   rk  r·   )r  r  ÚDuplicateTokenr{   rˆ   rm  r  r  r  rF  rG  rn  r  r  r¥   )ÚExistingTokenHandler�   Ú_DuplicateTokenÚDuplicateTokenHandlerW   rW   rX   ry  §  rs  ry  c                 C   sN   t jj}ttttttg|_	t
|_t|_ttƒ}|| ||||t|ƒƒ t|jƒS r·   )r  r  ÚDuplicateTokenExr{   rT   ÚLPSECURITY_ATTRIBUTESrˆ   r‡   rm  r  r  r  rF  rG  rn  r  r  r¥   )ÚhExistingTokenÚdwDesiredAccessÚlpTokenAttributesr�   r€   Ú_DuplicateTokenExr|  rW   rW   rX   r}  ¹  s   
r}  c                 C   s,   t jj}tg|_t|_t|_t	t
ƒ || ƒS r·   )r  r  ÚIsTokenRestrictedr{   r  r  r  ÚRaiseIfNotErrorSuccessrG  ÚSetLastErrorÚERROR_SUCCESS)ÚhTokenHandleÚ_IsTokenRestrictedrW   rW   rX   rƒ  Æ  s   rƒ  c                 C   óB   t jj}tttg|_t|_t|_	t
ƒ }| sd } || |t|ƒƒ |S r·   )r  r  ÚLookupPrivilegeValueArÛ   ÚPLUIDr  r  r  rF  rG  rN   r  )r1  rA  Ú_LookupPrivilegeValueAÚlpLuidrW   rW   rX   rŠ  Ô  ó   rŠ  c                 C   r‰  r·   )r  r  ÚLookupPrivilegeValueWrÝ   r‹  r  r  r  rF  rG  rN   r  )r1  rA  Ú_LookupPrivilegeValueWr�  rW   rW   rX   r�  à  rŽ  r�  c                 C   ón   t jj}ttttg|_t|_t	|_
tdƒ}|| t|ƒtt|ƒƒ t d|j¡}|| t|ƒt|ƒt|ƒƒ |jS ©NrL   r£   )r  r  ÚLookupPrivilegeNameArÛ   r‹  r  r  r  r  rF  rG  rT   r  ÚNULLr"  r$  r¥   )r1  r�  Ú_LookupPrivilegeNameAr@  rA  rW   rW   rX   r“  õ  ó   r“  c                 C   r‘  r’  )r  r  ÚLookupPrivilegeNameWrÝ   r‹  r  r  r  r  rF  rG  rT   r  r”  r"  r,  r¥   )r1  r�  Ú_LookupPrivilegeNameWr@  rA  rW   rW   rX   r—    r–  r—  rW   c           
      C   sæ   t jj}ttttttg|_t|_	|s t
|_|| ttdttƒ d S d}d}|D ]C\}}t|tƒs4tt|ƒ}|dkr;t}n|dkrBt}n	|d krId}n|}t||ƒ}td|ƒ}	|| tt|	ƒt|	ƒttƒdkrid}tƒ }q&|sqt |¡‚d S )NrL   TFr   )r  r  ÚAdjustTokenPrivilegesr{   r�   ÚLPVOIDrT   r  r  r  rF  rG  ÚTRUEr”  Ú
isinstancerN   ÚLookupPrivilegeValueÚSE_PRIVILEGE_ENABLEDÚSE_PRIVILEGE_REMOVEDrZ   r]   ÚFALSEr  Úsizeofr   r"  r#  )
r  ÚNewStateÚ_AdjustTokenPrivilegesr)  ÚerrcodeÚ	privilegeÚenabledÚflagsÚlaaÚtprW   rW   rX   r™    s6   



€
ÿr™  c                 C   s  |dks|t krtd| ƒ‚|tkr tƒ }t| ||ƒ |jjjS |tkr1t	ƒ }t| ||ƒ |j
jS |tkrBtƒ }t| ||ƒ |jjS |tkrStƒ }t| ||ƒ |jjS |tkritƒ }t| ||ƒ |jjj|jjfS |tkrytƒ }t| ||ƒ |jS |tkrŠtdƒ}t| ||ƒ |jS |tkr›tdƒ}t| ||ƒ |jS |tkr¬tdƒ}t| ||ƒ |jS |ttfv r¿tdƒ}t| ||ƒ |jS |tt t!t"t#fv r×tdƒ}t| ||ƒ t$|jƒS |t%krít&dƒ}t| ||ƒ t'|j(jdd�S |t)krüt*ƒ }t| ||ƒ |S t+d| ƒ‚)NrL   z,Invalid value for TokenInformationClass (%i)Tr¬   z,TokenInformationClass(%i) not yet supported!),ÚMaxTokenInfoClassr²   Ú	TokenUserrj   Ú_internal_GetTokenInformationrk   rg   r¥   Ú
TokenOwnerrp   rq   rs   rt   ÚTokenAppContainerSidru   rv   ÚTokenIntegrityLevelrn   ro   r\   ÚTokenOriginrw   rx   r€   r‡   ÚTokenElevationÚTOKEN_ELEVATIONrˆ   ÚTokenSessionIdÚTokenAppContainerNumberrT   ÚTokenSandBoxInertÚTokenHasRestrictionsÚTokenUIAccessÚTokenVirtualizationAllowedÚTokenVirtualizationEnabledr  ÚTokenLinkedTokenry   r  rz   ÚTokenStatisticsr|   r¹   )r‡  ÚTokenInformationClassÚTokenInformationrW   rW   rX   ÚGetTokenInformationB  sr   
ÿ
r¾  c                 C   sd   t jj}tttttg|_t	|_
t|_tdƒ}t|ƒ}|| |t|ƒ|t|ƒƒ |j|kr0t t¡‚|S ©NrL   )r  r  r¾  r{   ÚTOKEN_INFORMATION_CLASSrš  rT   ÚPDWORDr  r  r  rF  rG  r¡  r  r¥   r"  r#  r!  )r‡  r¼  r½  Ú_GetTokenInformationÚReturnLengthÚTokenInformationLengthrW   rW   rX   r¬  ˜  s   

r¬  c              
   C   sÈ   t jj}tttttg|_t	|_
t|_tdƒ}z|| dd|t|ƒƒ W n ty4 } zW Y d}~nd}~ww |j}tdƒ}t| ƒ }|| dt|ƒ|t|ƒƒ |j|krWt t¡‚t |ttƒ¡j}|jjS )zP
	The original function wasn't working. this one returns the SID for the token
	rL   r   N)r  r  r¾  r{   rÀ  rš  rT   rÁ  r  r  r  rF  rG  r  Ú	Exceptionr¥   ÚBYTEr"  r#  r!  r/  rE  rj   Úcontentsrk   rg   )r‡  rÂ  rÃ  ÚerÄ  ÚtiÚtrW   rW   rX   ÚGetTokenInformation_sid¦  s&   €ÿ


rË  c
                 C   s  t jj}
tttttttttttg|
_t|
_	t
|
_| sd } |s d }|s$d }|s(d }|s-d }nt |ttt|ƒd ƒ¡}|s?d }nt |¡}|sHd }|	sdtƒ }	ttƒ|	_d|	_d|	_d|	_d|	_d|	_d|	_tƒ }t|_t|_d|_d|_|
| ||||||||t |	ƒt |ƒƒ |S ©Nr   rL   )!r  r  ÚCreateProcessWithLogonWrÝ   rT   rš  ÚLPPROCESS_INFORMATIONr  r  r  rF  rG  r"  r,  ÚmaxÚMAX_PATHÚlenÚSTARTUPINFOWr¡  ÚcbÚ
lpReservedÚ	lpDesktopÚlpTitleÚdwFlagsÚcbReserved2ÚlpReserved2ÚPROCESS_INFORMATIONrn  ÚhProcessÚhThreadrÔ   Ú
dwThreadIdr  )Ú
lpUsernameÚlpDomainÚ
lpPasswordÚdwLogonFlagsÚlpApplicationNameÚlpCommandLineÚdwCreationFlagsÚlpEnvironmentÚlpCurrentDirectoryÚlpStartupInfoÚ_CreateProcessWithLogonWÚlpProcessInformationrW   rW   rX   rÍ  Ö  sH   

$rÍ  c           
      C   sö   t jj}tttttttttg	|_t	|_
t|_| sd } |sd }|s#d }nt |ttt|ƒd ƒ¡}|s5d }nt |¡}|s>d }|sZtƒ }ttƒ|_d|_d|_d|_d|_d|_d|_tƒ }	t|	_t|	_d|	_d|	_ || ||||||t!|ƒt!|	ƒƒ	 |	S rÌ  )"r  r  ÚCreateProcessWithTokenWr{   rT   rÝ   rš  rÎ  r  r  r  rF  rG  r"  r,  rÏ  rÐ  rÑ  rÒ  r¡  rÓ  rÔ  rÕ  rÖ  r×  rØ  rÙ  rÚ  rn  rÛ  rÜ  rÔ   rÝ  r  )
ÚhTokenrá  râ  rã  rä  rå  ræ  rç  Ú_CreateProcessWithTokenWré  rW   rW   rX   rê    s@   

 rê  Fc
                 C   s*  t jj}
ttttttttttt	g|
_
t|
_t|
_|sd }|s!d }nt | d¡ttt|ƒd ƒ¡}|s6d }nt | d¡¡}|sBd }|sGd }nt|ƒ}|sPd }nt|ƒ}|	sptƒ }	ttƒ|	_d|	_d|	_d|	_d|	_d|	_d|	_tƒ }t |_!t |_"d|_#d|_$|
| ||||t|ƒ|||t|	ƒt|ƒƒ |S )NÚasciir   rL   )%r  r  ÚCreateProcessAsUserAr{   rÛ   r~  r�   rT   rš  rÎ  r  r  r  rF  rG  r"  r$  ÚencoderÏ  rÐ  rÑ  r  ÚSTARTUPINFOr¡  rÓ  rÔ  rÕ  rÖ  r×  rØ  rÙ  rÚ  rn  rÛ  rÜ  rÔ   rÝ  )rë  râ  rã  ÚlpProcessAttributesÚlpThreadAttributesÚbInheritHANDLEsrä  rå  ræ  rç  Ú_CreateProcessAsUserAré  rW   rW   rX   rî  B  sH    
(rî  c
                 C   s  t jj}
ttttttttttt	g|
_
t|
_t|
_|sd }|s!d }nt |ttt|ƒd ƒ¡}|s3d }nt |¡}|s<d }|sAd }nt|ƒ}|sJd }nt|ƒ}|	sjtƒ }	ttƒ|	_d|	_d|	_d|	_d|	_d|	_d|	_tƒ }t|_ t|_!d|_"d|_#|
| ||||t|ƒ|||t|	ƒt|ƒƒ |S rÌ  )$r  r  ÚCreateProcessAsUserWr{   rÝ   r~  r�   rT   rš  rÎ  r  r  r  rF  rG  r"  r,  rÏ  rÐ  rÑ  r  rð  r¡  rÓ  rÔ  rÕ  rÖ  r×  rØ  rÙ  rÚ  rn  rÛ  rÜ  rÔ   rÝ  )rë  râ  rã  rñ  rò  ró  rä  rå  ræ  rç  Ú_CreateProcessAsUserWré  rW   rW   rX   rõ  m  sH   

(rõ  c                 C   s@   t jj}ttg|_t|_t|_	|d urt
|ƒ}|| |ƒ}t|ƒS r·   )r  r  ÚOpenThreadWaitChainSessionrT   rQ  r  ÚHWCTr  rF  rG  ÚPWAITCHAINCALLBACKr«   )ÚFlagsÚcallbackÚ_OpenThreadWaitChainSessionr¯   rW   rW   rX   r÷  ¨  s   

r÷  éÿÿÿÿc                    sÜ   t jj}tttttttg|_t	|_
t|_t|ƒ}t| ƒ ‰ tdƒ}|| |||t|ƒt t ˆ ¡t¡t|ƒƒ |j|kr]|j}t| ƒ ‰ || |||t|ƒt t ˆ ¡t¡t|ƒƒ |j|ks;‡ fdd„t|jƒD ƒt	|jƒfS )NrL   c                    s   g | ]}t ˆ | ƒ‘qS rW   )r¡   )Ú.0Úindex©ÚNodeInfoArrayrW   rX   Ú
<listcomp>Ë  s    z&GetThreadWaitChain.<locals>.<listcomp>)r  r  ÚGetThreadWaitChainrø  r  rT   ÚPWAITCHAIN_NODE_INFOÚLPBOOLr  r  r  rF  rG  r™   r�   r  r"  r/  r0  r¥   Úxrange)Ú	WctHANDLEÚContextrú  r’   Ú	NodeCountÚ_GetThreadWaitChainÚdwNodeCountÚIsCyclerW   r   rX   r  ¼  s    
*

*
ýþr  c                 C   s   t jj}tg|_|| ƒ d S r·   )r  r  r³   rø  r  )r  Ú_CloseThreadWaitChainSessionrW   rW   rX   r³   Ò  s   r³   c                 C   sN   t jj}tttttƒtg|_t|_	t
|_ttƒ}|| ||t|ƒd ƒ t|jƒS r·   )r  r  ÚSaferCreateLevelrT   rE  r  rš  r  r�   r  rF  rG  rn  r  ÚSaferLevelHANDLEr¥   )Ú	dwScopeIdÚ	dwLevelIdÚ	OpenFlagsÚ_SaferCreateLevelÚhLevelHANDLErW   rW   rX   r  Þ  s   
r  c                 C   s\   t jj}tttttg|_t	|_
t|_ttƒ}tdƒ}|| |t|ƒ|t|ƒƒ t|jƒ|jfS r¿  )r  r  ÚSaferComputeTokenFromLevelr  r{   rm  rT   r  r  r�   r  rF  rG  rn  r  r  r¥   )ÚLevelHANDLEÚInAccessTokenr×  Ú_SaferComputeTokenFromLevelÚOutAccessTokenrÔ  rW   rW   rX   r  ø  s   r  c                 C   s@   t jj}tg|_t|_t|_t	| dƒr|| j
ƒ d S || ƒ d S ©Nr¥   )r  r  r  r  r  r�   r  rF  rG  Úhasattrr¥   )r  Ú_SaferCloseLevelrW   rW   rX   r    s   
r  c                 C   s8   t jj}ttg|_t|_t|_	t
tƒ t|t| ƒ|ƒƒS r·   )r  r  ÚSaferiIsExecutableFileTyperÝ   ÚBOOLEANr  r�   r  ÚRaiseIfLastErrorrG  r…  r†  r  Úunicode)Ú
szFullPathÚbFromShellExecuteÚ_SaferiIsExecutableFileTyperW   rW   rX   r    s   
r  c                 C   sV   t | dƒr	| j}n| }|ttttttfv rd S tj	j
}tg|_t|_t|_|| ƒ d S r  )r  r¥   ÚHKEY_CLASSES_ROOTÚHKEY_CURRENT_USERÚHKEY_LOCAL_MACHINEÚ
HKEY_USERSÚHKEY_PERFORMANCE_DATAÚHKEY_CURRENT_CONFIGr  r  r  r
  r  rU   r  r„  rG  )ÚhKeyr¥   Ú_RegCloseKeyrW   rW   rX   r  &  s"   
úr  c                 C   óB   t jj}tttg|_t|_t	|_
ttƒ}|| |t|ƒƒ t|jƒS r·   )r  r  ÚRegConnectRegistryArÛ   r
  ÚPHKEYr  rU   r  r„  rG  rn  r  ÚRegistryKeyHANDLEr¥   )ÚlpMachineNamer*  Ú_RegConnectRegistryAÚhkResultrW   rW   rX   r-  A  rs  r-  c                 C   r,  r·   )r  r  ÚRegConnectRegistryWrÝ   r
  r.  r  rU   r  r„  rG  rn  r  r/  r¥   )r0  r*  Ú_RegConnectRegistryWr2  rW   rW   rX   r3  K  rs  r3  c                 C   rk  r·   )r  r  ÚRegCreateKeyAr
  rÛ   r.  r  rU   r  r„  rG  rn  r  r/  r¥   )r*  ÚlpSubKeyÚ_RegCreateKeyAr2  rW   rW   rX   r5  \  rs  r5  c                 C   rk  r·   )r  r  ÚRegCreateKeyWr
  rÝ   r.  r  rU   r  r„  rG  rn  r  r/  r¥   )r*  r6  Ú_RegCreateKeyWr2  rW   rW   rX   r8  f  rs  r8  c                 C   rk  r·   )r  r  ÚRegOpenKeyAr
  rÛ   r.  r  rU   r  r„  rG  rn  r  r/  r¥   )r*  r6  Ú_RegOpenKeyAr2  rW   rW   rX   r:  …  rs  r:  c                 C   rk  r·   )r  r  ÚRegOpenKeyWr
  rÝ   r.  r  rU   r  r„  rG  rn  r  r/  r¥   )r*  r6  Ú_RegOpenKeyWr2  rW   rW   rX   r<  �  rs  r<  c                 C   óJ   t jj}tttttg|_t	|_
t|_ttƒ}|| |d|t|ƒƒ t|jƒS r¿  )r  r  ÚRegOpenKeyExAr
  rÛ   rT   ÚREGSAMr.  r  rU   r  r„  rG  rn  r  r/  r¥   )r*  r6  Ú
samDesiredÚ_RegOpenKeyExAr2  rW   rW   rX   r?  ¢  ó   
r?  c                 C   r>  r¿  )r  r  ÚRegOpenKeyExWr
  rÝ   rT   r@  r.  r  rU   r  r„  rG  rn  r  r/  r¥   )r*  r6  rA  Ú_RegOpenKeyExWr2  rW   rW   rX   rD  ¬  rC  rD  c                 C   s>   t jj}ttg|_t|_t|_	t
tƒ}|| t|ƒƒ t|jƒS r·   )r  r  ÚRegOpenCurrentUserr@  r.  r  rU   r  r„  rG  r
  rn  r  r/  r¥   )rA  Ú_RegOpenCurrentUserr2  rW   rW   rX   rF  ¼  s   

rF  c                 C   sF   t jj}ttttg|_t|_	t
|_ttƒ}|| d|t|ƒƒ t|jƒS r¿  )r  r  ÚRegOpenUserClassesRootr{   rT   r@  r.  r  rU   r  r„  rG  r
  rn  r  r/  r¥   )rë  rA  Ú_RegOpenUserClassesRootr2  rW   rW   rX   rH  Ì  rx  rH  c                 C   s`   t jj}ttttg|_t|_	t
|_tdƒ}|| |d t|ƒƒ t |j¡}|| ||t|ƒƒ |jS r¿  )r  r  ÚRegQueryValueAr
  rÛ   rš  ÚPLONGr  rU   r  r„  rG  r  r"  r$  r¥   )r*  r6  Ú_RegQueryValueAÚcbValueÚlpValuerW   rW   rX   rJ  Ü  s   rJ  c                 C   sh   t jj}ttttg|_t|_	t
|_tdƒ}|| |d t|ƒƒ t |jttƒ ¡}|| ||t|ƒƒ |jS r¿  )r  r  ÚRegQueryValueWr
  rÝ   rš  rK  r  rU   r  r„  rG  r  r"  r,  r¥   r¡  r�   )r*  r6  Ú_RegQueryValueWrM  rN  rW   rW   rX   rO  è  s   rO  c                 C   s  t | ƒ}tdƒ}tdƒ}|||d t|ƒd t|ƒƒ |j}|s#|j|fS |ttfv rK|jdkr5td|j ƒ‚tdƒ}|||d d t|ƒt|ƒƒ |j|fS |tkrq|jdkr[td|j ƒ‚tdƒ}	|||d d t|	ƒt|ƒƒ |	j|fS |t	t
fv r˜| r€t |j¡}
nt |j¡}
|||d d t|
ƒt|ƒƒ |
j|fS |tkrÖ| r¥t |j¡}
nt |j¡}
|||d d t|
ƒt|ƒƒ |
d d … }| rÆ| d¡}n| d¡}dd	„ |D ƒ}||fS |tkròt |j¡}
|||d d t|
ƒt|ƒƒ |
j|fS t |j¡}
|||d d t|
ƒt|ƒƒ |
j|fS )
NrL   rý  r(   úREG_DWORD value of size %dr,   úREG_QWORD value of size %dú c                 S   ó   g | ]}|r|‘qS rW   rW   ©rþ  ÚtokenrW   rW   rX   r  *	  ó    z-_internal_RegQueryValueEx.<locals>.<listcomp>)Ú_caller_RegQueryValueExrT   r  r¥   Ú	REG_DWORDÚREG_DWORD_BIG_ENDIANr²   Ú	REG_QWORDÚQWORDÚREG_SZÚREG_EXPAND_SZr"  r$  r,  ÚREG_MULTI_SZÚsplitÚREG_LINKré   )Úansir*  ÚlpValueNameÚbGetDataÚ_RegQueryValueExÚcbDataÚdwTypeÚTypeÚdwDataÚqwDataÚszDataÚDataÚaDatarW   rW   rX   Ú_internal_RegQueryValueExþ  sV   








rn  c                 C   sJ   | rt jj}ttttttg|_nt jj}tt	ttttg|_t
|_t|_|S r·   )r  r  ÚRegQueryValueExAr
  rÛ   rš  rÁ  r  ÚRegQueryValueExWrÝ   rU   r  r„  rG  )rb  re  rW   rW   rX   rX  7	  s   rX  c                 C   ó   t d| ||ƒS ©NT©rn  ©r*  rc  rd  rW   rW   rX   ro  C	  r	  ro  c                 C   rq  r¿   rs  rt  rW   rW   rX   rp  G	  r	  rp  c           	      C   sþ  |d u rt |tjƒrd}n*t |tjƒrd}n!tjtjk}nt |tjƒr&d}nt |tjƒr/d}ntdt|ƒ ƒ‚|d u rm|d u rBt}n+|d u rIt}n$t |tjƒrRt}nt |tjƒr[t}nt |t	ƒrct
}n
t |tƒrkt}nt}|r}tjj}ttttttg|_ntjj}ttttttg|_t|_t|_|d u r™d }d}n[|t
tfv r¤t|ƒ}nH|tkr­t|ƒ}n?|ttfv rÁ|r»t  |¡}n1t !|¡}n+|t"krÝ|rÒt  d #|¡d ¡}nt !d #|¡d ¡}n|t$krçt !|¡}nt  |¡}t%|ƒ}t&|ƒ}|| |d|||ƒ d S )NTFzString expected, got %s insteadrL   rS  z  )'rœ  ÚGuessStringTypeÚt_ansiÚ	t_unicodeÚ	t_defaultÚ	TypeErrorÚtyper]  ÚREG_NONEÚintrY  Úlongr[  Ú
REG_BINARYr  r  ÚRegSetValueExAr
  rÛ   rT   rš  r  ÚRegSetValueExWrÝ   rU   r  r„  rG  rZ  r\  r^  r"  r$  r,  r_  rý   ra  r  r¡  )	r*  rc  ÚlpDatarg  rb  Ú_RegSetValueExÚDataRefÚDataSizerl  rW   rW   rX   ÚRegSetValueExT	  sj   




r…  c                 C   s„   t jj}ttttg|_t|_d}	 t	 
|¡}|| |||ƒ}|tkr"n|d }|dkr/t	 |¡‚q|tkr6d S |tkr?t	 |¡‚|jS )NrÊ   TrÅ   )r  r  ÚRegEnumKeyAr
  rT   rÛ   r  rU   r  r"  r$  ÚERROR_MORE_DATAr#  ÚERROR_NO_MORE_ITEMSr†  r¥   )r*  ÚdwIndexÚ_RegEnumKeyAr@  rA  r¤  rW   rW   rX   r†  §	  s$   

ù
r†  c                 C   sˆ   t jj}ttttg|_t|_d}	 t	 
|¡}|| |||d ƒ}|tkr$n|d }|dkr1t	 |¡‚q|tkr8d S |tkrAt	 |¡‚|jS )NrK   Tr&   i €  )r  r  ÚRegEnumKeyWr
  rT   rÝ   r  rU   r  r"  r,  r‡  r#  rˆ  r†  r¥   )r*  r‰  Ú_RegEnumKeyWr@  rA  r¤  rW   rW   rX   r‹  »	  s$   

ù
r‹  c              	   C   sˆ  | rt jj}ttttttttg|_nt jj	}ttt
tttttg|_t|_tdƒ}tdƒ}t|ƒ}t|ƒ}| r=t |j¡}	nt |j¡}	|rNtdƒ}
t|
ƒ}nd }d }||||	|d |||ƒ}|tksg|rò|tkrò| rx|jttƒ |_t |j¡}	n|jttƒ |_t |j¡}	|rç|j}|ttfv r¤|
jttƒkrŸtd|
j ƒ‚tdƒ}n?|tkr»|
jttƒkr¶td|
j ƒ‚tdƒ}n(|tttfv rÒ| rËt |
j¡}nt |
j¡}n|tkrÝt |
j¡}nt |
j¡}t|ƒ}||||	|d |||ƒ}|t krød S |�s|	j|jfS |ttttttfv �r|	j|j|jfS |tk�r<|d d … }~| �r)| !d¡}n| !d¡}dd„ |D ƒ}|	j|j|fS |	j|j|j"fS )	NrÊ   rý  rL   rQ  rR  rS  c                 S   rT  rW   rW   rU  rW   rW   rX   r  8
  rW  z*_internal_RegEnumValue.<locals>.<listcomp>)#r  r  ÚRegEnumValueAr
  rT   rÛ   r  rš  r  ÚRegEnumValueWrÝ   rU   r  r  r"  r$  r¥   r,  r‡  r†  r¡  ÚCHARr�   rY  rZ  r²   r[  r\  r]  r^  r_  ra  rˆ  r`  ré   )rb  r*  r‰  rd  Ú_RegEnumValueÚcchValueNamerg  ÚlpcchValueNameÚlpTyperc  rf  ÚlpcbDatar�  r¤  rh  rl  ÚsDatarm  rW   rW   rX   Ú_internal_RegEnumValueè	  sv   




r–  c                 C   rq  rr  ©r–  ©r*  r‰  rd  rW   rW   rX   r�  >
  r	  r�  c                 C   rq  r¿   r—  r˜  rW   rW   rX   rŽ  A
  r	  rŽ  c                 C   ó,   t jj}ttg|_t|_t|_	|| |ƒ d S r·   )
r  r  ÚRegDeleteValueAr
  rÛ   r  rU   r  r„  rG  )ÚhKeySrcrc  Ú_RegDeleteValueArW   rW   rX   rš  a
  ó
   
rš  c                 C   r™  r·   )
r  r  ÚRegDeleteValueWr
  rÝ   r  rU   r  r„  rG  )r›  rc  Ú_RegDeleteValueWrW   rW   rX   rž  g
  r�  rž  c                 C   ó0   t jj}tttg|_t|_t|_	|| ||ƒ d S r·   )
r  r  ÚRegDeleteKeyValueAr
  rÛ   r  rU   r  r„  rG  )r›  r6  rc  Ú_RegDeleteKeyValueArW   rW   rX   r¡  t
  ó
   r¡  c                 C   r   r·   )
r  r  ÚRegDeleteKeyValueWr
  rÝ   r  rU   r  r„  rG  )r›  r6  rc  Ú_RegDeleteKeyValueWrW   rW   rX   r¤  z
  r£  r¤  c                 C   r™  r·   )
r  r  ÚRegDeleteKeyAr
  rÛ   r  rU   r  r„  rG  )r›  r6  Ú_RegDeleteKeyArW   rW   rX   r¦  †
  r�  r¦  c                 C   r™  r·   )
r  r  ÚRegDeleteKeyWr
  rÝ   r  rU   r  r„  rG  )r›  r6  Ú_RegDeleteKeyWrW   rW   rX   r¨  Œ
  r�  r¨  c                 C   ó4   t jj}ttttg|_t|_	t
|_|| ||dƒ d S r¿  )r  r  ÚRegDeleteKeyExAr
  rÛ   r@  rT   r  rU   r  r„  rG  )r›  r6  rA  Ú_RegDeleteKeyExArW   rW   rX   r«  ›
  ó
   r«  c                 C   rª  r¿  )r  r  ÚRegDeleteKeyExWr
  rÝ   r@  rT   r  rU   r  r„  rG  )r›  r6  rA  Ú_RegDeleteKeyExWrW   rW   rX   r®  ¡
  r­  r®  c                 C   ó0   t jj}tttg|_t|_t|_	|| ||ƒ d S r·   )
r  r  ÚRegCopyTreeAr
  rÛ   r  rU   r  r„  rG  )r›  r6  ÚhKeyDestÚ_RegCopyTreeArW   rW   rX   r±  ®
  r£  r±  c                 C   r°  r·   )
r  r  ÚRegCopyTreeWr
  rÝ   r  rU   r  r„  rG  )r›  r6  r²  Ú_RegCopyTreeWrW   rW   rX   r´  ´
  r£  r´  c                 C   r™  r·   )
r  r  ÚRegDeleteTreeAr
  rÝ   r  rU   r  r„  rG  )r*  r6  Ú_RegDeleteTreeArW   rW   rX   r¶  À
  r�  r¶  c                 C   r™  r·   )
r  r  ÚRegDeleteTreeWr
  rÝ   r  rU   r  r„  rG  )r*  r6  Ú_RegDeleteTreeWrW   rW   rX   r¸  Æ
  r�  r¸  c                 C   ó(   t jj}tg|_t|_t|_|| ƒ d S r·   )	r  r  ÚRegFlushKeyr
  r  rU   r  r„  rG  )r*  Ú_RegFlushKeyrW   rW   rX   r»  Ñ
  rj  r»  c                 C   s>   t jj}tg|_t|_t|_t	| t
ƒr|  ¡  d S || ƒ d S r·   )r  r  r  r  r  r  r  rF  rG  rœ  r{   Úclose)Ú	hSCObjectÚ_CloseServiceHANDLErW   rW   rX   r  é
  s   
r  c                 C   s4   t jj}tttg|_t|_t|_	|| ||ƒ}t
|ƒS r·   )r  r  ÚOpenSCManagerArÛ   rT   r  r  r  rF  rG  ÚServiceControlManagerHANDLE)r0  ÚlpDatabaseNamer€  Ú_OpenSCManagerAr¾  rW   rW   rX   rÀ  ú
  s   rÀ  c                 C   s0   t jj}tttg|_t|_t|_	|| ||ƒ}|S r·   )
r  r  ÚOpenSCManagerWrÝ   rT   r  r  r  rF  rG  )r0  rÂ  r€  Ú_OpenSCManagerWr¾  rW   rW   rX   rÄ    s   rÄ  c                 C   ó0   t jj}tttg|_t|_t|_	t
|| ||ƒƒS r·   )r  r  ÚOpenServiceAr  rÛ   rT   r  r  rF  rG  ÚServiceHANDLE)Ú
hSCManagerrØ   r€  Ú_OpenServiceArW   rW   rX   rÇ    r£  rÇ  c                 C   rÆ  r·   )r  r  ÚOpenServiceWr  rÝ   rT   r  r  rF  rG  rÈ  )rÉ  rØ   r€  Ú_OpenServiceWrW   rW   rX   rË    r£  rË  c                 C   ól   t jj}tttttttttttttg|_t|_t	|_
tdƒ}|| |||||||t|ƒ|	|
|ƒ}t|ƒ|jfS r¿  )r  r  ÚCreateServiceAr  rÛ   rT   r  r  r  rF  rG  r  rÈ  r¥   )rÉ  rØ   rÙ   r€  rÌ   ÚdwStartTypeÚdwErrorControlÚlpBinaryPathNameÚlpLoadOrderGroupÚlpDependenciesÚlpServiceStartNamerà  Ú_CreateServiceAÚdwTagIdÚhServicerW   rW   rX   rÎ  2  ó    "rÎ  c                 C   rÍ  r¿  )r  r  ÚCreateServiceWr  rÝ   rT   r  r  r  rF  rG  r  rÈ  r¥   )rÉ  rØ   rÙ   r€  rÌ   rÏ  rÐ  rÑ  rÒ  rÓ  rÔ  rà  Ú_CreateServiceWrÖ  r×  rW   rW   rX   rÙ  G  rØ  rÙ  c                 C   rº  r·   )	r  r  ÚDeleteServicer  r  r  r  rF  rG  )r×  Ú_DeleteServicerW   rW   rX   rÛ  a  rj  rÛ  c                 C   ó†   t jj}ttttg|_t|_t	dƒ}|| |d t
|ƒƒ |jdkr$t ¡ ‚t |jd ¡}t|ƒ|_|| ||t
|ƒƒ}|s@t ¡ ‚|jS ©NrL   r   )r  r  ÚGetServiceKeyNameAr  rÛ   r  r  r  r  rT   r  r¥   r"  r#  r$  r¡  )rÉ  rÙ   Ú_GetServiceKeyNameAÚ	cchBufferrØ   r)  rW   rW   rX   rß  n  ó   

rß  c                 C   rÝ  ©NrL   r&   )r  r  ÚGetServiceKeyNameWr  rÝ   r  r  r  r  rT   r  r¥   r"  r#  r,  r¡  )rÉ  rÙ   Ú_GetServiceKeyNameWrá  rØ   r)  rW   rW   rX   rä  ~  râ  rä  c                 C   rÝ  rÞ  )r  r  ÚGetServiceDisplayNameAr  rÛ   r  r  r  r  rT   r  r¥   r"  r#  r$  r¡  )rÉ  rØ   Ú_GetServiceDisplayNameArá  rÙ   r)  rW   rW   rX   ræ  –  râ  ræ  c                 C   rÝ  rã  )r  r  ÚGetServiceDisplayNameWr  rÝ   r  r  r  r  rT   r  r¥   r"  r#  r,  r¡  )rÉ  rØ   Ú_GetServiceDisplayNameWrá  rÙ   r)  rW   rW   rX   rè  ¦  râ  rè  c                 C   ó\   t jj}tttg|_t|_t	|_
|r"t|ƒ}t| |Ž }t |¡}nd}d }|| ||ƒ d S r¿  )r  r  ÚStartServiceAr  rT   rš  r  r  r  rF  rG  rÑ  rÛ   r"  r0  )r×  ÚServiceArgVectorsÚ_StartServiceAÚdwNumServiceArgsÚCServiceArgVectorsÚlpServiceArgVectorsrW   rW   rX   rë  è  ó   rë  c                 C   rê  r¿  )r  r  ÚStartServiceWr  rT   rš  r  r  r  rF  rG  rÑ  rÝ   r"  r0  )r×  rì  Ú_StartServiceWrî  rï  rð  rW   rW   rX   rò  ÷  rñ  rò  c                 C   s>   t jj}tttg|_t|_t	|_
tƒ }|| |t|ƒƒ t|ƒS r·   )r  r  ÚControlServicer  rT   ÚLPSERVICE_STATUSr  r  r  rF  rG  rË   r  rÚ   )r×  Ú	dwControlÚ_ControlServiceÚrawServiceStatusrW   rW   rX   rô    s   rô  c                 C   s:   t jj}ttg|_t|_t|_	t
ƒ }|| t|ƒƒ t|ƒS r·   )r  r  ÚQueryServiceStatusr  rõ  r  r  r  rF  rG  rË   r  rÚ   )r×  Ú_QueryServiceStatusrø  rW   rW   rX   rù  ,  s   
rù  c                 C   sh   |t krtƒ ‚tjj}ttttt	g|_
t|_t|_tƒ }tt|ƒƒ}|| |t|ƒt|ƒt|ƒƒ t|ƒS r·   )ÚSC_STATUS_PROCESS_INFOr¹   r  r  ÚQueryServiceStatusExr  ÚSC_STATUS_TYPErš  rT   r  r  r  r  rF  rG  rÓ   r¡  r  rß   )r×  Ú	InfoLevelÚ_QueryServiceStatusExr(  ÚcbBytesNeededrW   rW   rX   rü  =  s   rü  c              
   C   s6  t jj}ttttttttg|_t|_	tdƒ}tdƒ}tdƒ}|| ||d dt
|ƒt
|ƒt
|ƒƒ g }d}tƒ tkr“|jttƒk r@nSt d|j¡}	|| ||t
|	ƒt|	ƒt
|ƒt
|ƒt
|ƒƒ}t|	ƒttƒ|j k rkt ¡ ‚t t t |	¡tj¡t¡}
td|jƒD ]}| t|
| ƒ¡ q|rŽntƒ tks8|s™t ¡ ‚|S ©NrL   Fr£   )r  r  ÚEnumServicesStatusAr  rT   rš  r  r  r  r  r  r   r‡  r¥   r¡  r×   r"  r$  r#  r/  r0  Úc_void_pÚLPENUM_SERVICE_STATUSAr  rõ   rí   )rÉ  rÌ   ÚdwServiceStateÚ_EnumServicesStatusAr   ÚServicesReturnedÚResumeHANDLEÚServicesr)  ÚServicesBufferÚlpServicesArrayrÿ  rW   rW   rX   r  V  s0   "
*
ör  c              
   C   s2  t jj}ttttttttg|_t|_	tdƒ}tdƒ}tdƒ}|| ||d dt
|ƒt
|ƒt
|ƒƒ g }d}tƒ tkr‘|jttƒk r@nQt d|j¡}	|| ||t
|	ƒt|	ƒt
|ƒt
|ƒt
|ƒƒ}t|	ƒttƒ|j k rkt ¡ ‚t t t |	¡tj¡t¡}
td|jƒD ]	}| |
| ¡ q|rŒntƒ tks8|s—t ¡ ‚|S ©NrL   Fó    )r  r  ÚEnumServicesStatusWr  rT   rš  r  r  r  r  r  r   r‡  r¥   r¡  rÜ   r"  r$  r#  r/  r0  r  ÚLPENUM_SERVICE_STATUSWÚrangerõ   )rÉ  rÌ   r  Ú_EnumServicesStatusWr   r  r  r	  r)  r
  r  rÿ  rW   rW   rX   r  s  s0   "
*
ör  c                 C   sP  |t krtƒ ‚tjj}ttttttt	t	t	t
g
|_t|_tdƒ}tdƒ}tdƒ}|| |||d dt|ƒt|ƒt|ƒ|ƒ
 g }	d}
tƒ tkr |jttƒk rKnUt d|j¡}|| |||t|ƒt|ƒt|ƒt|ƒt|ƒ|ƒ
}
t|ƒttƒ|j k rxt ¡ ‚t t t |¡tj¡t¡}td|jƒD ]}|	 t|| ƒ¡ qŒ|
r›ntƒ tksC|
s¦t ¡ ‚|	S r  )ÚSC_ENUM_PROCESS_INFOr¹   r  r  ÚEnumServicesStatusExAr  ÚSC_ENUM_TYPErT   rš  r  rÛ   r  r  r  r  r   r‡  r¥   r¡  rÞ   r"  r$  r#  r/  r0  r  ÚLPENUM_SERVICE_STATUS_PROCESSAr  rõ   r  )rÉ  rþ  rÌ   r  ÚpszGroupNameÚ_EnumServicesStatusExAr   r  r  r	  r)  r
  r  rÿ  rW   rW   rX   r  ž  s4   &
.
ör  c                 C   sL  t jj}ttttttttttg
|_	t
|_|tkrtƒ ‚tdƒ}tdƒ}tdƒ}|| |||d dt|ƒt|ƒt|ƒ|ƒ
 g }	d}
tƒ tkrž|jttƒk rKnSt d|j¡}|| |||t|ƒt|ƒt|ƒt|ƒt|ƒ|ƒ
}
t|ƒttƒ|j k rxt ¡ ‚t t t |¡tj¡t¡}td|jƒD ]	}|	 || ¡ qŒ|
r™ntƒ tksC|
s¤t ¡ ‚|	S r  )r  r  ÚEnumServicesStatusExWr  r  rT   rš  r  rÝ   r  r  r  r  r¹   r  r   r‡  r¥   r¡  rà   r"  r$  r#  r/  r0  r  ÚLPENUM_SERVICE_STATUS_PROCESSWr  rõ   )rÉ  rþ  rÌ   r  r  Ú_EnumServicesStatusExWr   r  r  r	  r)  r
  r  rÿ  rW   rW   rX   r  ¿  s4   &
.
ör  c                 C   s,   t jj}ttg|_t|_t|_	||| ƒ d S r·   )
r  r  ÚSetThreadTokenrm  r{   r  r  r  rF  rG  )Útoken_handleÚthread_handleÚ_SetThreadTokenrW   rW   rX   r  ò  s
   
r  c                  C   s$   t jj} g | _t| _t| _| ƒ  d S r·   )r  r  ÚRevertToSelfr  r  r  rF  rG  )Ú_RevertToSelfrW   rW   rX   r  ú  s
   
r  c           	      C   s~   t jj}tttttg|_t|_	t
 |¡}d }tdƒ}|d ur/t
 | d¡¡}tt| d¡ƒƒ}|| ||||ƒ}|s=t
 ¡ ‚|S )NrL   z	utf-16-le)r  r  ÚCredBackupCredentialsr{   rÝ   rQ  rT   r  r  r  r"  r,  r$  rï  rÑ  r#  )	rV  ÚpathÚpasswordr§  Ú_CredBackupCredentialsÚppathÚ	ppasswordÚppasswordlenr)  rW   rW   rX   r!    s   
r!  c                 C   s   g | ]	}|  d ¡s|‘qS )Ú_)Ú
startswith)rþ  Ú_xrW   rW   rX   r    s    r  )T)rW   )
NNNrL   NNrL   NNN)NrL   NNrL   NNN)
NNNNNFrL   NNN)rL   Nr¿  )Fr·   rr  )NNN)NN(!  rª   ÚdefinesÚkernel32Ú_allÚsetÚvarsÚkeysÚSE_ASSIGNPRIMARYTOKEN_NAMEÚSE_AUDIT_NAMEÚSE_BACKUP_NAMEÚSE_CHANGE_NOTIFY_NAMEÚSE_CREATE_GLOBAL_NAMEÚSE_CREATE_PAGEFILE_NAMEÚSE_CREATE_PERMANENT_NAMEÚSE_CREATE_SYMBOLIC_LINK_NAMEÚSE_CREATE_TOKEN_NAMEÚSE_DEBUG_NAMEÚSE_ENABLE_DELEGATION_NAMEÚSE_IMPERSONATE_NAMEÚSE_INC_BASE_PRIORITY_NAMEÚSE_INCREASE_QUOTA_NAMEÚSE_INC_WORKING_SET_NAMEÚSE_LOAD_DRIVER_NAMEÚSE_LOCK_MEMORY_NAMEÚSE_MACHINE_ACCOUNT_NAMEÚSE_MANAGE_VOLUME_NAMEÚSE_PROF_SINGLE_PROCESS_NAMEÚSE_RELABEL_NAMEÚSE_REMOTE_SHUTDOWN_NAMEÚSE_RESTORE_NAMEÚSE_SECURITY_NAMEÚSE_SHUTDOWN_NAMEÚSE_SYNC_AGENT_NAMEÚSE_SYSTEM_ENVIRONMENT_NAMEÚSE_SYSTEM_PROFILE_NAMEÚSE_SYSTEMTIME_NAMEÚSE_TAKE_OWNERSHIP_NAMEÚSE_TCB_NAMEÚSE_TIME_ZONE_NAMEÚSE_TRUSTED_CREDMAN_ACCESS_NAMEÚSE_UNDOCK_NAMEÚSE_UNSOLICITED_INPUT_NAMEÚSE_CREATE_TOKENÚSE_ASSIGNPRIMARYTOKENÚSE_LOCK_MEMORYÚSE_INCREASE_QUOTAÚSE_UNSOLICITED_INPUTÚSE_TCBÚSE_SECURITYÚSE_TAKE_OWNERSHIPÚSE_LOAD_DRIVERÚSE_SYSTEM_PROFILEÚSE_SYSTEMTIMEÚSE_PROF_SINGLE_PROCESSÚSE_INC_BASE_PRIORITYÚSE_CREATE_PAGEFILEÚSE_CREATE_PERMANENTÚ	SE_BACKUPÚ
SE_RESTOREÚSE_SHUTDOWNÚSE_DEBUGÚSE_AUDITÚSE_SYSTEM_ENVIRONMENTÚSE_CHANGE_NOTIFYÚSE_REMOTE_SHUTDOWNÚ	SE_UNDOCKÚSE_SYNC_AGENTÚSE_ENABLE_DELEGATIONÚSE_MANAGE_VOLUMEÚSE_IMPERSONATEÚSE_CREATE_GLOBALÚSE_TRUSTED_CREDMAN_ACCESSÚ
SE_RELABELÚSE_INC_WORKING_SETÚSE_TIME_ZONEÚSE_CREATE_SYMBOLIC_LINKÚSE_PRIVILEGE_ENABLED_BY_DEFAULTrž  rŸ  ÚSE_PRIVILEGE_USED_FOR_ACCESSÚTOKEN_ADJUST_PRIVILEGESÚLOGON_WITH_PROFILEÚLOGON_NETCREDENTIALS_ONLYÚTOKEN_ASSIGN_PRIMARYÚTOKEN_DUPLICATEÚTOKEN_IMPERSONATEÚTOKEN_QUERYÚTOKEN_QUERY_SOURCEÚTOKEN_ADJUST_GROUPSÚTOKEN_ADJUST_DEFAULTÚTOKEN_ADJUST_SESSIONIDÚSTANDARD_RIGHTS_READÚ
TOKEN_READÚSTANDARD_RIGHTS_REQUIREDÚTOKEN_ALL_ACCESSr$  r%  r&  r'  r(  r)  ÚKEY_ALL_ACCESSÚKEY_CREATE_LINKÚKEY_CREATE_SUB_KEYÚKEY_ENUMERATE_SUB_KEYSÚKEY_EXECUTEÚ
KEY_NOTIFYÚKEY_QUERY_VALUEÚKEY_READÚKEY_SET_VALUEÚKEY_WOW64_32KEYÚKEY_WOW64_64KEYÚ	KEY_WRITEr{  r]  r^  r~  rY  ÚREG_DWORD_LITTLE_ENDIANrZ  ra  r_  ÚREG_RESOURCE_LISTÚREG_FULL_RESOURCE_DESCRIPTORÚREG_RESOURCE_REQUIREMENTS_LISTr[  ÚREG_QWORD_LITTLE_ENDIANÚ	StructurerN   rE  r‹  rZ   r]   ÚPTOKEN_PRIVILEGESr"  Úc_intrÀ  r«  ÚTokenGroupsÚTokenPrivilegesr­  ÚTokenPrimaryGroupÚTokenDefaultDaclÚTokenSourcer€   ÚTokenImpersonationLevelr»  ÚTokenRestrictedSidsr³  ÚTokenGroupsAndPrivilegesÚTokenSessionReferencerµ  ÚTokenAuditPolicyr°  ÚTokenElevationTyperº  r±  r¶  ÚTokenAccessInformationr¸  r¹  r¯  r·  ÚTokenMandatoryPolicyÚTokenLogonSidÚTokenIsAppContainerÚTokenCapabilitiesr®  r´  ÚTokenUserClaimAttributesÚTokenDeviceClaimAttributesÚ"TokenRestrictedUserClaimAttributesÚ$TokenRestrictedDeviceClaimAttributesÚTokenDeviceGroupsÚTokenRestrictedDeviceGroupsÚTokenSecurityAttributesÚTokenIsRestrictedrª  r‡   ÚPTOKEN_TYPEÚTokenPrimaryÚTokenImpersonationÚTokenElevationTypeDefaultÚTokenElevationTypeFullÚTokenElevationTypeLimitedÚTOKEN_ELEVATION_TYPEÚPTOKEN_ELEVATION_TYPEÚSecurityAnonymousÚSecurityIdentificationÚSecurityImpersonationÚSecurityDelegationrˆ   ÚPSECURITY_IMPERSONATION_LEVELrf   ÚPSID_AND_ATTRIBUTESrj   ÚPTOKEN_USERrn   ÚPTOKEN_MANDATORY_LABELrp   ÚPTOKEN_OWNERrs   ÚPTOKEN_PRIMARY_GROUPru   ÚPTOKEN_APPCONTAINER_INFORMATIONrw   ÚPTOKEN_ORIGINry   ÚPTOKEN_LINKED_TOKENr|   ÚPTOKEN_STATISTICSÚSidTypeUserÚSidTypeGroupÚSidTypeDomainÚSidTypeAliasÚSidTypeWellKnownGroupÚSidTypeDeletedAccountÚSidTypeInvalidÚSidTypeUnknownÚSidTypeComputerÚSidTypeLabelÚWCT_MAX_NODE_COUNTrŽ   ÚWCT_ASYNC_OPEN_FLAGÚWCTP_OPEN_ALL_FLAGSÚWCT_OUT_OF_PROC_FLAGÚWCT_OUT_OF_PROC_COM_FLAGÚWCT_OUT_OF_PROC_CS_FLAGÚWCTP_GETINFO_ALL_FLAGSrš  rø  rT   r�   ÚWctCriticalSectionTypeÚWctSendMessageTypeÚWctMutexTypeÚWctAlpcTypeÚ
WctComTypeÚWctThreadWaitTypeÚWctProcessWaitTyper¤   ÚWctComActivationTypeÚWctUnknownTypeÚ
WctMaxTyperž   ÚWctStatusNoAccessÚWctStatusRunningÚWctStatusBlockedÚWctStatusPidOnlyÚWctStatusPidOnlyRpcssÚWctStatusOwnedÚWctStatusNotOwnedÚWctStatusAbandonedÚWctStatusUnknownÚWctStatusErrorÚWctStatusMaxr‰   r�   ÚUnionr–   r™   r  Úobjectr¡   r{   r«   r  ÚSAFER_SCOPEID_MACHINEÚSAFER_SCOPEID_USERÚSAFER_LEVEL_OPENÚSAFER_LEVELID_DISALLOWEDÚSAFER_LEVELID_UNTRUSTEDÚSAFER_LEVELID_CONSTRAINEDÚSAFER_LEVELID_NORMALUSERÚSAFER_LEVELID_FULLYTRUSTEDÚSAFER_POLICY_INFO_CLASSÚSaferPolicyLevelListÚ'SaferPolicyEnableTransparentEnforcementÚSaferPolicyDefaultLevelÚSaferPolicyEvaluateUserScopeÚSaferPolicyScopeFlagsÚSAFER_TOKEN_NULL_IF_EQUALÚSAFER_TOKEN_COMPARE_ONLYÚSAFER_TOKEN_MAKE_INERTÚSAFER_TOKEN_WANT_FLAGSÚSAFER_TOKEN_MASKr  ÚSERVICES_ACTIVE_DATABASEWÚSERVICES_FAILED_DATABASEWÚSERVICES_ACTIVE_DATABASEAÚSERVICES_FAILED_DATABASEAÚSC_GROUP_IDENTIFIERWÚSC_GROUP_IDENTIFIERAÚSERVICE_NO_CHANGErý  rû  r  r  ÚSERVICE_ALL_ACCESSÚSERVICE_QUERY_CONFIGÚSERVICE_CHANGE_CONFIGÚSERVICE_QUERY_STATUSÚSERVICE_ENUMERATE_DEPENDENTSÚSERVICE_STARTÚSERVICE_STOPÚSERVICE_PAUSE_CONTINUEÚSERVICE_INTERROGATEÚSERVICE_USER_DEFINED_CONTROLÚSC_MANAGER_ALL_ACCESSÚSC_MANAGER_CONNECTÚSC_MANAGER_CREATE_SERVICEÚSC_MANAGER_ENUMERATE_SERVICEÚSC_MANAGER_LOCKÚSC_MANAGER_QUERY_LOCK_STATUSÚSC_MANAGER_MODIFY_BOOT_CONFIGÚSERVICE_BOOT_STARTÚSERVICE_SYSTEM_STARTÚSERVICE_AUTO_STARTÚSERVICE_DEMAND_STARTÚSERVICE_DISABLEDÚSERVICE_ERROR_IGNOREÚSERVICE_ERROR_NORMALÚSERVICE_ERROR_SEVEREÚSERVICE_ERROR_CRITICALÚSERVICE_ACTIVEÚSERVICE_INACTIVEÚSERVICE_STATE_ALLÚSERVICE_KERNEL_DRIVERÚSERVICE_FILE_SYSTEM_DRIVERÚSERVICE_ADAPTERÚSERVICE_RECOGNIZER_DRIVERÚSERVICE_WIN32_OWN_PROCESSÚSERVICE_WIN32_SHARE_PROCESSrô   ÚSERVICE_DRIVERÚSERVICE_WIN32rü   rú   rû   rù   rö   r÷   rø   ÚSERVICE_ACCEPT_STOPÚSERVICE_ACCEPT_PAUSE_CONTINUEÚSERVICE_ACCEPT_SHUTDOWNÚSERVICE_ACCEPT_PARAMCHANGEÚSERVICE_ACCEPT_NETBINDCHANGEÚ$SERVICE_ACCEPT_HARDWAREPROFILECHANGEÚSERVICE_ACCEPT_POWEREVENTÚSERVICE_ACCEPT_SESSIONCHANGEÚSERVICE_ACCEPT_PRESHUTDOWNÚSERVICE_RUNS_IN_SYSTEM_PROCESSÚSERVICE_CONTROL_STOPÚSERVICE_CONTROL_PAUSEÚSERVICE_CONTROL_CONTINUEÚSERVICE_CONTROL_INTERROGATEÚSERVICE_CONTROL_SHUTDOWNÚSERVICE_CONTROL_PARAMCHANGEÚSERVICE_CONTROL_NETBINDADDÚSERVICE_CONTROL_NETBINDREMOVEÚSERVICE_CONTROL_NETBINDENABLEÚSERVICE_CONTROL_NETBINDDISABLEÚSERVICE_CONTROL_DEVICEEVENTÚ%SERVICE_CONTROL_HARDWAREPROFILECHANGEÚSERVICE_CONTROL_POWEREVENTÚSERVICE_CONTROL_SESSIONCHANGEÚSERVICE_ACCEPT_TIMECHANGEÚSERVICE_ACCEPT_TRIGGEREVENTÚSERVICE_ACCEPT_USERMODEREBOOTÚSC_ACTION_NONEÚSC_ACTION_RESTARTÚSC_ACTION_REBOOTÚSC_ACTION_RUN_COMMANDÚSERVICE_CONFIG_DESCRIPTIONÚSERVICE_CONFIG_FAILURE_ACTIONSrË   rõ  rÓ   ÚLPSERVICE_STATUS_PROCESSr×   rÜ   r  r  rÞ   rà   r  r  rÚ   rß   rí   r  r  ÚUserModeHandler  r  r  r  r  r+  ÚDefaultStringTypeÚGetUserNamer.  r;  ru  ÚLookupAccountNamer=  rB  ÚLookupAccountSidrD  rM  ÚConvertSidToStringSidrP  rT  ÚConvertStringSidToSidrW  r[  r_  ra  rg  rl  rt  ry  r}  rƒ  rŠ  r�  r�  r“  r—  ÚLookupPrivilegeNamer™  r¾  r¬  rË  rÍ  ÚMakeANSIVersionÚCreateProcessWithLogonAÚCreateProcessWithLogonrê  ÚCreateProcessWithTokenAÚCreateProcessWithTokenrî  rõ  ÚCreateProcessAsUserÚWINFUNCTYPEÚ	DWORD_PTRr  r  rù  r÷  r  r³   r  r  r  r  ÚSaferIsExecutableFileTyper  r-  r3  ÚRegConnectRegistryr5  r8  ÚRegCreateKeyr:  r<  Ú
RegOpenKeyr?  rD  ÚRegOpenKeyExrF  rH  rJ  rO  ÚRegQueryValuern  rX  ro  rp  ÚRegQueryValueExr…  r  r€  r†  r‹  Ú
RegEnumKeyr–  r�  rŽ  ÚRegEnumValuerš  rž  ÚRegDeleteValuer¡  r¤  ÚRegDeleteKeyValuer¦  r¨  ÚRegDeleteKeyr«  r®  ÚRegDeleteKeyExr±  r´  ÚRegCopyTreer¶  r¸  ÚRegDeleteTreer»  r  rÀ  rÄ  ÚOpenSCManagerrÇ  rË  ÚOpenServicerÎ  rÙ  ÚCreateServicerÛ  rß  rä  ÚGetServiceKeyNameræ  rè  ÚGetServiceDisplayNamerë  rò  ÚStartServicerô  rù  rü  r  r  ÚEnumServicesStatusr  r  ÚEnumServicesStatusExr  r  r!  Ú
differenceÚ__all__ÚsortrW   rW   rW   rX   Ú<module>   sr  ÿÿÿÿþþþý	0	Q&
.6
















	





	


+
V
0)%++










	


9
KV			öö2$$! 