o
    j                     @   s~   d dl Z d dlZd dlmZ d dlmZ d dlmZmZ d dl	m
Z
mZ d dlmZ d dlmZ d dlmZmZ dd
dZdS )    N)logger)CredBackupCredentials)Process!PROCESS_QUERY_LIMITED_INFORMATION)enable_debug_privilegeRtlAdjustPrivilege)SetThreadToken)CryptUnprotectData)CREDENTIAL_BLOBCredentialFilewinlogon.exec                 C   sx  d }zz|d u rt jdd}|j}td|  |  t  t|tdd}|	 }t
| tddd t| tdd}| }t|| t|d	}	t|	 }W d    n1 s[w   Y  g }
t|}|j}|jd
krt|}|
| ||jd  }t|dkrt|}|
| ||jd  }t|dks||
d fW W zt| td W S  ty } ztdt|  W Y d }~S d }~ww  ty } z;td|  |d |fW  Y d }~W zt| td W S  ty } ztdt|  W Y d }~S d }~ww d }~ww zt| td W w  ty; } ztdt|  W Y d }~w d }~ww )NF)deletezTemp file path: %sT)nameaccessopen   )thread_or_process)pidr   r   rb   r   zTemp file removedzFailed to remove temp file! %szdpapi_trustedcredman err! %s)tempfileNamedTemporaryFiler   r   debugcloser   r   r   duplicate_tokenr   r   get_process_tokenr   r   r	   readr   
from_bytesdataunkr
   appendsizelenosunlink	Exceptionstr)
target_pidspecial_processtemp_file_pathdec_datatf	pwinlogonwinlogon_tokenpuserprocesspuserprocess_tokenfresultsxf	blobsdatarese r6   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/dpapi/extras.pydpapi_trustedcredman   sx   









r8   )r   N)r   r#   pypykatzr   4pypykatz.commons.winapi.local.function_defs.advapi32r   &pypykatz.commons.readers.local.processr   r   0pypykatz.commons.readers.local.common.privilegesr   r   r   !pypykatz.dpapi.functiondefs.dpapir	   (pypykatz.dpapi.structures.credentialfiler
   r   r8   r6   r6   r6   r7   <module>   s   