o
    j8                     @   s   d dl Z d dlZd dlZd dlZd dlZd dlmZ defddZG dd dej	Z
G dd	 d	ZG d
d dZG dd dej	ZG dd dej	ZdddZG dd dejZG dd dZddedefddZdS )    N)PROCESSOR_ARCHITECTUREerrc                 C   s*   t | d }t| jD ]}||7 }q|S )Nz
)str	traceback	format_tb__traceback__)r   tline r
   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/common.pygeterr	   s   
r   c                   @   s   e Zd Ze Ze ZdS )KatzSystemArchitectureN)__name__
__module____qualname__enumautoX86X64r
   r
   r
   r   r      s    r   c                   @      e Zd ZejfddZdd Zd ddZdd	 Zd!ddZ	dd Z
dd Zd"ddZdd Zdd Zdd Zdd Zdd Zdd Zd
S )#GenericReaderc                 C   0   || _ d| _t|| _t|| _|| _d| _dS z
		data is bytes
		r   Nprocessor_architecturestart_addresslenend_addresssizedatacurrent_positionselfr   r   r
   r
   r   __init__      


zGenericReader.__init__c                 C      | j |  ko| jkS   S Nr   r   r"   ptrr
   r
   r   inrange      zGenericReader.inranger   c                 C   s`   |dkr
| j | }n|dkr| j| }n|dkr| j| }ntd| |s+td|| _dS aD  
		Changes the current address to an offset of offset. The whence parameter controls from which position should we count the offsets.
		0: beginning of the current memory segment
		1: from current position
		2: from the end of the current memory segment
		If you wish to move out from the segment, use the 'move' function
		r         z.Seek function whence value must be between 0-2zSeek would point out of bufferNr   r    r   	Exceptionr*   r"   offsetwhencer   r
   r
   r   seek"   s   
zGenericReader.seekc                 C   s   |  | dS z@
		Moves the buffer to a virtual address specified by address
		Nr4   r"   addressr
   r
   r   move9   s   
zGenericReader.moveNc                 C   sP   |du r| j tjkrd}nd}| j| }|dkrdS || | }| |d dS zD
		Repositions the current reader to match architecture alignment
		N      r   r-   r   r   r   r    r4   r"   	alignmentr2   offset_to_alignedr
   r
   r   align@   s   
zGenericReader.alignc                 C      | j S z)
		Returns the current virtual address
		r    r"   r
   r
   r   tellP      zGenericReader.tellc                 C   s8   | j | }| |std| j| j | j || j  S z@
		Returns up to length bytes from the current memory segment
		Would read out of buffer!r    r*   r0   r   r   r"   lengthr   r
   r
   r   peekV   s   

zGenericReader.peekc                 C   sj   |dk rt d|dkr| j}| j| _| j|d S | j| }| |s(t d| j}|| _| j|| S z
		Returns data bytes of size size from the current segment. If size is -1 it returns all the remaining data bytes from memory segment
		rN   zYou shouldnt be doing thisNrI   r0   r    r   r   r*   r"   r   
oldnew_posr   old_new_posr
   r
   r   read_   s   

zGenericReader.readc                 C   8   | j tjkrtj| ddddS tj| ddddS )
		Reads an integer. The size depends on the architecture. 
		Reads a 4 byte small-endian singed int on 32 bit arch
		Reads an 8 byte small-endian singed int on 64 bit arch
		r;   littleT	byteordersignedr<   r   r   r   int
from_bytesrT   rE   r
   r
   r   read_intr      zGenericReader.read_intc                 C   rU   )
		Reads an integer. The size depends on the architecture. 
		Reads a 4 byte small-endian unsinged int on 32 bit arch
		Reads an 8 byte small-endian unsinged int on 64 bit arch
		r;   rW   FrX   r<   r[   rE   r
   r
   r   	read_uint}   r_   zGenericReader.read_uintc                 C   s"   | j |}|dkrdS || j S ):
		Searches for a pattern in the current memory segment
		rN   r   findr    r"   patternposr
   r
   r   rd      s   
zGenericReader.findc                 C   s<   g }d}	 | j ||d }|dkr	 |S ||| j  q)p
		Searches for all occurrences of a pattern in the current memory segment, returns all occurrences as a list
		rN   Tr-   r   rd   appendr   r"   rf   rg   
last_foundr
   r
   r   find_all   s   zGenericReader.find_allc                 C   s   |  | |  S r&   r9   ra   r"   rg   r
   r
   r   get_ptr   s   
zGenericReader.get_ptrc                 C   sJ   | j tjkr| | tj| dddd}|d | S | | |  S Nr<   rW   TrX   r   r   r   r9   r\   r]   rT   ra   r"   rg   r)   r
   r
   r   get_ptr_with_offset   s   

z!GenericReader.get_ptr_with_offsetr   r&   rN   r   r   r   r   r   r#   r*   r4   r9   rA   rF   rM   rT   r^   ra   rd   rm   rp   rt   r
   r
   r
   r   r      s    


		r   c                   @   r   )#AGenericReaderc                 C   r   r   r   r!   r
   r
   r   r#      r$   zAGenericReader.__init__c                 C   r%   r&   r'   r(   r
   r
   r   r*      r+   zAGenericReader.inranger   c                    sb   |dkr| j | }n|dkr| j| }n|dkr| j| }ntd| |s,td|| _dS r,   r/   r1   r
   r
   r   r4      s   
zAGenericReader.seekc                    s   |  |I dH  dS r5   r6   r7   r
   r
   r   r9      s   zAGenericReader.moveNc                    sX   |du r| j tjkrd}nd}| j| }|dkrdS || | }| |dI dH  dS r:   r=   r>   r
   r
   r   rA      s   
zAGenericReader.alignc                 C   rB   rC   rD   rE   r
   r
   r   rF      rG   zAGenericReader.tellc                    s:   | j | }| |std| j| j | j || j  S rH   rJ   rK   r
   r
   r   rM      s
   

zAGenericReader.peekrN   c                    sl   |dk r	t d|dkr| j}| j| _| j|d S | j| }| |s)t d| j}|| _| j|| S rO   rP   rQ   r
   r
   r   rT      s   

zAGenericReader.readc                    N   | j tjkr| dI dH }tj|dddS | dI dH }tj|dddS )rV   r;   NrW   TrX   r<   r   r   r   rT   r\   r]   r"   r   r
   r
   r   r^        zAGenericReader.read_intc                    ry   )r`   r;   NrW   FrX   r<   rz   r{   r
   r
   r   ra     r|   zAGenericReader.read_uintc                    s*   | j |I dH }|dkrdS || j S )rb   NrN   rc   re   r
   r
   r   rd   ,  s
   
zAGenericReader.findc                    sD   g }d}	 | j ||d I dH }|dkr	 |S ||| j  q)rh   rN   Tr-   Nri   rk   r
   r
   r   rm   5  s   zAGenericReader.find_allc                    s    |  |I d H  |  I d H S r&   rn   ro   r
   r
   r   rp   C  s   zAGenericReader.get_ptrc                    s^   | j tjkr | |I d H  tj| dddd}|d | S | |I d H  |  I d H S rq   rr   rs   r
   r
   r   rt   I  s   z"AGenericReader.get_ptr_with_offsetru   r&   rv   rw   r
   r
   r
   r   rx      s    


		rx   c                   @   sd   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdS )WindowsBuildi(
  i  ip  i  i#  i%  i (  iZ)  i98  i:  i?  iB  icE  iG  iG  iaJ  ibJ  i|O  i]X  igX  ie  iXf  N)r   r   r   WIN_XPWIN_2K3	WIN_VISTAWIN_7WIN_8WIN_BLUEWIN_10_1507WIN_10_1511WIN_10_1607WIN_10_1703WIN_10_1709WIN_10_1803WIN_10_1809WIN_10_1903WIN_10_1909WIN_10_2004WIN_10_20H2WIN_11_2022WIN_11_2023WIN_11_23H2WIN_11_24H2WIN_11_25H2r
   r
   r
   r   r}   Y  s.    r}   c                   @   s,   e Zd ZdZdZdZdZdZdZdZ	dZ
d	S )
WindowsMinBuildi	  i  i  iX  i@  i$  iH&  iU  N)r   r   r   r~   r   r   r   r   r   WIN_10WIN_11r
   r
   r
   r   r   q  s    r      .c                 C   s  g }| du rdS z|dd W n t y   t}Y nw |dt| |D ]}| |||  }d}d}	|dt|D ]1}
|
|d krD|d7 }||
 }
t|
tsQt|
}
t|
dd}
t|
dkrcd	|
 }
||
d 7 }q8|d}d}|D ]"}t|ts~t|}d
|  krdk rn n|t	|7 }qs||7 }qs|dkr|
dt|d d  d |||f  q#|
dt|d d  d || |||f  q#d|S )z
	@brief Return {src} in hex dump.
	@param[in] length	{Int} Nb Bytes by row.
	@param[in] sep		{Char} For the text part, {sep} will be used for non ASCII char.
	@return {Str} The hexdump

	@note Full support for python2 and python3 !
	N r   r-   Fr.    0x0       z	%08x:  %-   zs  |%s|z%08x(+%04x):  %-
)	NameErrorranger   
isinstancer\   ordhexreplacestripchrrj   r   join)srcrL   sepstartresultxrangeisubSrchexaisMiddlehtextcr
   r
   r   hexdump|  sD   	



*0
r   c                   @   s   e Zd ZdZdd ZdS )UniversalEncoderz
	Used to override the default json encoder to provide a direct serialization for formats
	that the default json encoder is incapable to serialize
	c                 C   sr   t |tjr
| S t |tjr|jS t |tr| S t|dd r2t|dd }t	|r0|
 S d S tj| |S )Nto_dict)r   datetime	isoformatr   Enumvaluebytesr   getattrcallabler   jsonJSONEncoderdefault)r"   objr   r
   r
   r   r     s   
zUniversalEncoder.defaultN)r   r   r   __doc__r   r
   r
   r
   r   r     s    r   c                   @   s@   e Zd Zdd Zdd Zedd Zedd Zed	d
 ZdS )KatzSystemInfoc                 C   s"   d | _ d | _d | _d | _d| _d S )N   )architecturebuildnumbermsv_dll_timestampoperating_systemmajor_versionrE   r
   r
   r   r#     s
   
zKatzSystemInfo.__init__c                 C   s   d| j j| j| j| jf S )Nz(ARCH:%s BUILD:%s MSV_TS:%s OS(guess): %s)r   namer   r   r   rE   r
   r
   r   __str__  s   zKatzSystemInfo.__str__c                 C   sD   t  }| jtjkrtj|_n
| jtjkrtj|_| j	|_
| j|_|S r&   )r   r   r   AMD64r   r   r   INTELr   BuildNumberr   r   )lrsysinfor
   r
   r   from_live_reader  s   
zKatzSystemInfo.from_live_readerc                 C   sx   t  }| jjtjkrtj|_n| jjtjkrtj	|_| jj
|_| jj|_d|_| jjD ]}|jddkr9|j|_q+|S )Nr   z
lsasrv.dllrN   )r   r   ProcessorArchitecturer   r   r   r   r   r   r   OperatingSystemr   r   r   r   modulesr   rd   	timestamp)minidumpr   moduler
   r
   r   from_minidump  s   


zKatzSystemInfo.from_minidumpc                 C   s(   t  }| j|_d |_| j|_| j|_|S r&   )r   r   r   r   r   r   r   )rekallreaderr   r
   r
   r   from_rekallreader  s   z KatzSystemInfo.from_rekallreaderN)	r   r   r   r#   r   staticmethodr   r   r   r
   r
   r
   r   r     s    

r   Fr   returnc                 C   s:   dt | d  }| d|  } t| }|du r|S | S )Nr<   =T)r   base64urlsafe_b64decodedecode)r   bytes_expectedpaddingr   r
   r
   r   base64_decode_url  s   
r   )r   r   r   )F)r   r   r   r   r   !minidump.streams.SystemInfoStreamr   r0   r   r   r   r   rx   r}   r   r   r   r   r   r   r   r
   r
   r
   r   <module>   s$     ! '
05