o j6@sddlTddlmZddlTddlTddlTddlTddlmZddl m Z ddl Z ddl Z ddl Z ddlZddlZddlZGdddZGd d d ZGd d d ZGd ddZedkrre jddeZeZeddSdS))*)enable_debug_privilege)PROCESSOR_ARCHITECTURE)loggerNc@s0eZdZddZddZeddZddZd S) ModulecCs4d|_d|_d|_d|_g|_d|_d|_d|_dSN)name baseaddresssize endaddresspages versioninfochecksum timestampselfr/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/readers/local/live_reader.py__init__s zModule.__init__cC|j|ko |jkSSr)r r raddrrrrinrange#zModule.inrangecCs4t}||_|j|_|j|_|j|j|_||_|Sr)rr lpBaseOfDllr SizeOfImager r r)r module_informrrrparse&sz Module.parsecCs(d|jt|jt|jt|j|jfS)Nz%s %s %s %s %s)r hexr r r rrrrr__str__2s(zModule.__str__N)__name__ __module__ __qualname__rr staticmethodrr!rrrrrs    rc@s@eZdZddZeddZddZddZd d Zd d Z d S)PagecCs(d|_d|_d|_d|_d|_d|_dSr) BaseAddressAllocationBaseAllocationProtect RegionSize EndAddressdatarrrrr6s  z Page.__init__cCs>t}|j|_|j|_|j|_t|jd|_|j|j|_|S)Ni@)r&r'r(r)minr*r+) page_infoprrrr?sz Page.parsecCst||j|j|_dSr)ReadProcessMemoryr'r*r,)rprocess_handlerrr read_dataIszPage.read_datacCrr)r'r+rrrrrLrz Page.inrangecCst||jkr gSt||j|j}g}d}t|t|krH||}|dkr(|S||||j||dd}||d7}t|t|ks|S)Nrr)lenr*r0r'findappend)rpatternr1r,floffsetmarkerrrrsearchOs  z Page.searchcCsd|j|j|j|jfS)Nz0x%08x 0x%08x %s 0x%08x)r'r(r)r*rrrrr!_sz Page.__str__N) r"r#r$rr%rr2rr;r!rrrrr&5s   r&c@seZdZddZddZddZd*dd Zd d Zd+d dZddZ ddZ d,ddZ ddZ ddZ ddZddZddZd-d!d"Zd#d$Zd%d&Zd.d(d)Zd S)/BufferedLiveReadercCs||_g|_d|_d|_dSr)readerr current_segmentcurrent_position)rr=rrrrds zBufferedLiveReader.__init__cCs|jD]}||r||_||_dSq|jjD]"}||r:||jjt|}|j |||_||_dSqt d|)z Nz4Memory address 0x%08x is not in process memory space) r rr>r?r=r2r1copydeepcopyr6 Exception)rrequested_positionpage newsegmentrrr_select_segmentks       z"BufferedLiveReader._select_segmentcC|jSr)r=rrrr get_readerzBufferedLiveReader.get_readerrcCsf|dkr |jj|}n|dkr|j|}n|dkr |jj|}ntd|j|s.td||_dS)aD Changes the current address to an offset of offset. The whence parameter controls from which position should we count the offsets. 0: beginning of the current memory segment 1: from current position 2: from the end of the current memory segment If you wish to move out from the segment, use the 'move' function rrz.Seek function whence value must be between 0-2z5Seek would cross memory segment boundaries (use move)N)r>r'r?r+rBr)rr9whencetrrrseeks  zBufferedLiveReader.seekcCs||dS)z@ Moves the buffer to a virtual address specified by address N)rF)raddressrrrmoves zBufferedLiveReader.moveNcCsR|dur|jjtjkrd}nd}|j|}|dkrdS|||}||ddS)zD Repositions the current reader to match architecture alignment Nrr)r=processor_architecturerAMD64r?rM)r alignmentr9offset_to_alignedrrraligns   zBufferedLiveReader.aligncCrG)z) Returns the current virtual address )r?rrrrtellszBufferedLiveReader.tellcCs@|j|}|j|std|jj|j|jj||jjS)z@ Returns up to length bytes from the current memory segment #Would read over segment boundaries!)r?r>rrBr,r')rlengthrLrrrpeeks  "zBufferedLiveReader.peekr3cCs|dkrtd|dkr+|j|j}|sdS|j}|jj|_|jj||jjdS|j|}|j|s:td|j}||_|jj||jj||jjS)z Returns data bytes of size size from the current segment. If size is -1 it returns all the remaining data bytes from memory segment r3zYou shouldnt be doing thisNrX)rBr> remaining_lenr?r+r,r'r)rr rL old_new_posrrrreads    zBufferedLiveReader.readcC:|jjtjkrtj|ddddStj|ddddS)z Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian singed int on 32 bit arch Reads an 8 byte small-endian singed int on 64 bit arch rPlittleT byteordersignedrQr=rRrrSint from_bytesr]rrrrread_intzBufferedLiveReader.read_intcCr^)z Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian unsinged int on 32 bit arch Reads an 8 byte small-endian unsinged int on 64 bit arch rPr_Fr`rQrcrrrr read_uintrgzBufferedLiveReader.read_uintcCs$|jj|}|dkr dS||jS)z: Searches for a pattern in the current memory segment r3)r>r,r5r?)rr7posrrrr5s zBufferedLiveReader.findcCs@g}d} |jj||d}|dkr |S|||jjq)zp Searches for all occurrences of a pattern in the current memory segment, returns all occurrences as a list r3Tr)r>r,r5r6 start_address)rr7ri last_foundrrrfind_allszBufferedLiveReader.find_allcCs$|j|}t|dkrdS|dS)zx Searches for the pattern in the whole process memory space and returns the first occurrence. This is exhaustive! rr3)r=r;r4)rr7pos_srrr find_globals  zBufferedLiveReader.find_globalrQcCs|jj||dS)z Searches for the pattern in the whole process memory space and returns a list of addresses where the pattern begins. This is exhaustive! )allocationprotect)r=r;)rr7rorrrfind_all_globalsz"BufferedLiveReader.find_all_globalcCs|||Sr)rOrh)rrirrrget_ptrs zBufferedLiveReader.get_ptrcCsL|jjtjkr||tj|dddd}|d|S|||S)NrQr_Tr`) r=rRrrSrOrdrer]rh)rriptrrrrget_ptr_with_offsets    z&BufferedLiveReader.get_ptr_with_offsetFcCs|jj||||d}|S)N) find_first reverse_order)r= search_module)r module_namer7rtrurLrrrfind_in_module'sz!BufferedLiveReader.find_in_module)rr)r3rQFF)r"r#r$rrFrHrMrOrVrWrZr]rfrhr5rlrnrprqrsrxrrrrr<cs&        r<c@s\eZdZdddZddZddZd d Zdd d ZddZddZ dddZ dddZ dS) LiveReaderN lsass.execCsJd|_||_||_||_d|_d|_g|_g|_d|_| | dSr) rR process_namer1 process_pidr? BuildNumbermodulesr msv_dll_timestamp sanity_checksetup)rr1r}r~rrrr-s zLiveReader.__init__cCsHtjdk}tdk}td}|dkrtd||kr"tddS)z Check if user is insane Windows API functions don't like when a 32 bit process is accessing a 64 bit process's memory space, Therefore you must use a 64 bit python on a 64bit Windows and a 32bit python on a 32bit Windows lWindows64FzThis will only run on WindowszPPython interpreter must be the same architecure of the OS you are running it on.N)sysmaxsizeplatformsystemmachineendswithrB)r is_python_64 is_windows is_windows_64rrrr<s  zLiveReader.sanity_checkcCsDtddttddt}t|jjj|_tddt t j d}t |d\}}t ||_|jdur|jdure|jdurGtdtddt|j|_tdd |j|jftdd tdd |jttd |j|_|jdurtd tntdtddt|j}|D]5}t|j|}td|d}t|dkrt t|j }||_!t"|j|} |j#$t%&|| |qtddt'|j#|j(} | |j)krt*|j| } |j+$t,&| | | j-7} | |j)kstddt'|j+|j+D]} |j#D]} | .| j/dkr| j+$| q qdS)NrzEnabling debug privilegezGetting generic system infozGetting build numberz-SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentBuildNumberz5Process name or PID or opened handle must be providedzSearching for lsass.exez%s found at PID %dz$Checking Lsass.exe protection statusz Opening %sFz#Failed to open lsass.exe Reason: %szUsing pre-defined handlezEnumerating modulesrz msv1_0.dllzFound %d moduleszFound %d pagesT)0rlogr GetSystemInforidwwProcessorArchitecturerRwinregOpenKeyHKEY_LOCAL_MACHINE QueryValueExrdrr1r~r}rB pid_for_name OpenProcessPROCESS_ALL_ACCESSctypesWinErrordebugEnumProcessModulesGetModuleFileNameExWntpathbasenamelowerosstatst_ctimerGetModuleInformationrr6rrr4lpMinimumApplicationAddresslpMaximumApplicationAddressVirtualQueryExr r&r*rr')rsysinfokey buildnumberrLmodule_handles module_handlemodule_file_pathrmodinfocurrent_addressr.rDmodrrrrKsb                         zLiveReader.setupcCrGr)r1rrrr get_handlerrIzLiveReader.get_handlerrQcCs(g}|jD] }|j|@r||q|Sr)r r)r6)rrorLrDrrr get_memorys    zLiveReader.get_memorycCst|Sr)r<rrrrget_buffered_readerszLiveReader.get_buffered_readercCs0|jD]}|j|dkr|SqdS)Nr3)rr rr5)rrwrrrrget_module_by_names zLiveReader.get_module_by_nameFcCs`||}|durtd|g}|jD]}||||j7}t|dkr-|dur-|Sq|S)NzCould not find module! %srT)rrBr r;r1r4)rrwr7rtrurneedlesrDrrrrvs   zLiveReader.search_modulecCs0g}|jD]}|j|@r||||j7}q|Sr)r r)r;r1)rr7rorLrDrrrr;s   zLiveReader.search)Nr|Nryrz) r"r#r$rrrrrrrrvr;rrrrr{,s B   r{__main__)leveli)common.live_reader_ctypescommon.privilegesr common.psapicommon.versioncommon.kernel32common.fileinfo!minidump.streams.SystemInfoStreamrpypykatzrrr@rrrrrr&r<r{r" basicConfiglrrblrrOrrrrs4   .J