o
    Žõ±j  ã                   @   sÒ   d dl Z d dl mZ d dlmZmZmZ d dlT dZd ZdZ	dZ
e jZdZdZdZd	Zd
ZdZdZG dd„ deƒZeeƒZG dd„ deƒZeeƒZG dd„ deƒZeeƒZddd„Zdd„ Zddd„Zdd„ ZdS )é    N)Úwindll)ÚULONGÚBOOLÚLONG)Ú*é   é   é   é   é   é   é   é   c                   @   s(   e Zd ZdefdefdefdefgZdS )ÚGENERIC_MAPPINGÚGenericReadÚGenericWriteÚGenericExecuteÚ
GenericAllN)Ú__name__Ú
__module__Ú__qualname__ÚACCESS_MASKÚ_fields_© r   r   ú¤/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/winapi/local/function_defs/ntdll.pyr      s    ür   c                   @   s4   e Zd ZdefdefdefdefdefdefgZdS )ÚSYSTEM_HANDLEÚ	ProcessIdÚObjectTypeNumberÚFlagsÚHandleÚObjectÚGrantedAccessN)	r   r   r   r   ÚBYTEÚUSHORTÚPVOIDr   r   r   r   r   r   r   "   s    úr   c                   @   sŽ   e Zd Zdefdefdefdefdefdefdefdefd	efd
efdefdefdefdefdefdefdefdefdefdefdefgZ	dS )ÚOBJECT_TYPE_INFORMATIONÚNameÚTotalNumberOfObjectsÚTotalNumberOfHandlesÚTotalPagedPoolUsageÚTotalNonPagedPoolUsageÚTotalNamePoolUsageÚTotalHandleTableUsageÚHighWaterNumberOfObjectsÚHighWaterNumberOfHandlesÚHighWaterPagedPoolUsageÚHighWaterNonPagedPoolUsageÚHighWaterNamePoolUsageÚHighWaterHandleTableUsageÚGenericMappingÚValidAccessÚSecurityRequiredÚMaintainHandleCountÚMaintainTypeListÚPoolTypeÚPagedPoolUsageÚNonPagedPoolUsageN)
r   r   r   ÚUNICODE_STRINGr   r   ÚBOOLEANr#   Ú	POOL_TYPEr   r   r   r   r   r%   6   s.    ër%   TFc                 C   sX   t jj}tttttƒg|_t|_|}tƒ }|| ||t	 
|¡ƒ}|dkr)td| ƒ‚|jS )ú
	privilige_id: int
	r   z-Failed call to RtlAdjustPrivilege! Status: %s)r   ÚntdllÚRtlAdjustPrivileger   r   ÚPOINTERÚargtypesÚNTSTATUSÚrestypeÚctypesÚbyrefÚ	ExceptionÚvalue)Úprivilige_idÚenableÚthread_or_processÚ_RtlAdjustPrivilegeÚCurrentThreadÚEnabledÚstatusr   r   r   r@   Y   s   r@   c           
         sD  t jj}ttttg|_t|_i }| dkrtdƒ‚t	dƒ}t
 |j¡}	 t	|jd ƒ}t
 |j¡}|| t
 |¡|t
 |¡ƒ}|dkrBn|dkrNtdt|ƒ ƒ‚|| t
 |¡|t
 |¡ƒ}q#t|jd |j… ƒ}t |¡‰ G ‡ fdd	„d	tƒ}| |¡}t|jƒD ] }	|j|	 j|vr‘g ||j|	 j< ||j|	 j  |j|	 ¡ q|S )
Nr   z)info_type only the value 16 is supported!Tr	   r   ì       z$NtQuerySystemInformation returned %sc                       s"   e Zd Zdefde” j fgZdS )z;NtQuerySystemInformation.<locals>.SYSTEM_HANDLE_INFORMATIONÚHandleCountÚHandlesN)r   r   r   r   r   rH   r   r   ©Úhcr   r   ÚSYSTEM_HANDLE_INFORMATIONˆ   s    þrU   )r   r?   ÚNtQuerySystemInformationr   r$   ÚPULONGrB   rD   rG   ÚDWORDrE   Úcreate_string_bufferrH   rF   ÚhexÚ	bytearrayÚrawÚfrom_bufferÚ	StructureÚrangerQ   rR   r   Úappend)
Ú	info_typeÚ_NtQuerySystemInformationÚhandleinfosÚsizeÚdatarO   Ú
data_bytesrU   ÚsyshandleinfoÚir   rS   r   rV   l   s6   ö

rV   c                 C   sZ   t jj}tttttttg|_t|_tƒ }|| ||t	 
|¡|ddƒ}|dkr+td| ƒ‚|S )r>   r   ú,Failed call to NtDuplicateObject! Status: %s)r   r?   ÚNtDuplicateObjectÚHANDLEÚPHANDLEr   r   rB   rD   rE   rF   rG   )ÚSourceProcessHandleÚSourceHandleÚTargetProcessHandleÚDesiredAccessÚ_NtDuplicateObjectÚoHandlerO   r   r   r   rj   ™   s   rj   c                 C   sÄ   t jj}tttttg|_t|_|t	krt
d| ƒ‚tdƒ}t |j¡}	 t |j¡}|| |||t |¡ƒ}|dkr:q#|dkrFt
dt|ƒ ƒ‚	 |tkrOtdƒ‚|t	kr`t t|jd|j… ƒ¡}|S )	r>   z,Unsupported ObjectInformationClass value %s.r   TrP   r   ri   zTODO: implement me when needed!N)r   r?   ÚNtQueryObjectrk   r   r$   rW   rB   rD   ÚObjectTypeInformationrG   rE   rY   rH   rF   rZ   ÚObjectNameInformationÚNotImplementedErrorr%   r]   r[   r\   )ÚObjectHandleÚObjectInformationClassÚ_NtQueryObjectrd   Ú
oinfo_datarO   Úoinfor   r   r   rs   ª   s(   rs   )TF)r   ) rE   r   Úctypes.wintypesr   r   r   Ú3pypykatz.commons.winapi.local.function_defs.definesÚSystemHandleInformationÚObjectBasicInformationru   rt   Úc_intr=   ÚNonPagedPoolÚ	PagedPoolÚNonPagedPoolMustSucceedÚDontUseThisTypeÚNonPagedPoolCacheAlignedÚPagedPoolCacheAlignedÚNonPagedPoolCacheAlignedMustSr^   r   rA   ÚPGENERIC_MAPPINGr   ÚPSYSTEM_HANDLEr%   ÚPOBJECT_TYPE_INFORMATIONr@   rV   rj   rs   r   r   r   r   Ú<module>   s4   




-