
    Xfl                         d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZm	Z	m
Z
mZ d dlmZ d dlmZ  ej        e          ZdefdZ G d d	e	j        j                  ZdS )
    N)List)	renderers
interfaces	constants
exceptions)requirements)hivelistreturnc           
         d                     d | D                       }t          j        |                                                    d                                                    }t                      }t          d          D ]A}|                    t          j
        d||dz  |dz  dz                      d                    Bdd	                     d
 |D                       z   S )zCalculate the Service SID c                     g | ]}|d z   S )  ).0cs     f/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/getservicesids.py
<listcomp>z$createservicesid.<locals>.<listcomp>   s    +++!1v:+++    zutf-8   z<I   r   z	S-1-5-80--c                 ,    g | ]}t          |          S r   )str)r   ns     r   r   z$createservicesid.<locals>.<listcomp>   s    "7"7"7a3q66"7"7"7r   )joinhashlibsha1upperencodedigestlistrangeappendstructunpack)svcunishadecis        r   createservicesidr+      s    
''++s+++
,
,C
,		7## fhh  &&C1XX C C 	

6=s1q51q519+<'=>>qABBBB"7"73"7"7"78888r   c                   r     e Zd ZdZdZdZ fdZedee	j
        j                 fd            Zd Zd Z xZS )	GetServiceSIDszLists process token sids.   r   r   )   r   r   c                     t                      j        |i | t          j        D ]a}t          j                            |t          j                            dd                    }t          j                            |          r n5bt          	                    t          j
        d           t          d          t          |d          5 }t          j        |          d         | _        d d d            d S # 1 swxY w Y   d S )Nwindowszsids_and_privileges.jsonz5sids_and_privileges.json file is missing plugin errorzBThe sids_and_privileges.json file missed from you plugin directoryrzservice sids)super__init__r   PLUGINS_PATHospathr   existsvolloglogLOGLEVEL_VVVRuntimeErroropenjsonloadservicesids)selfargskwargs
plugin_dirsids_json_file_namefile_handle	__class__s         r   r5   zGetServiceSIDs.__init__&   sX   $)&))) $0 	 	J"$',,BGLL4NOO# # w~~122  JJ&G   T  
 %s++ 	F{#y55nED	F 	F 	F 	F 	F 	F 	F 	F 	F 	F 	F 	F 	F 	F 	F 	F 	F 	Fs    C::C>C>r
   c                 v    t          j        ddddg          t          j        dt          j        d          gS )	NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr	   r.   )rM   pluginversion)r   ModuleRequirementPluginRequirementr	   HiveList)clss    r   get_requirementszGetServiceSIDs.get_requirements=   sR     *,()4  
 *(99  	
 		
r   c              #     K   | j         j        | j        d                  }t          j                            | j         | j        |j        |j        dd           D ]}	 |	                    d          }nP# t          t          j        f$ r7 	 |	                    d          }n# t          t          j        f$ r Y Y _w xY wY nw xY w|r|                                D ]j}|                                | j                                        vr;t#          |                                          }d||                                ffV  kd S )NrJ   zmachine\system)contextbase_config_path
layer_namesymbol_tablefilter_stringhive_offsetszCurrentControlSet\ServiceszControlSet001\Servicesr   )rX   modulesconfigr	   rT   
list_hivesconfig_pathrZ   symbol_table_nameget_keyKeyErrorr   InvalidAddressExceptionget_subkeysget_namerA   valuesr+   )rB   rJ   hiveservicesssids         r   
_generatorzGetServiceSIDs._generatorK   sl     %dk(&;<%00L!-(1+ 1 
 
 	7 	7D<<(EFFj@A   #||,EFFHH *"DE   HH H  7!--// 7 7Azz||4+;+B+B+D+DDD.qzz||<< 3

"56666+	7 	7s6   A22B?	BB?B95B?8B99B?>B?c                 p    t          j        dt          fdt          fg|                                           S )NSIDService)r   TreeGridr   rm   )rB   s    r   runzGetServiceSIDs.rune   s-    !E3<)S1A"BDOODUDUVVVr   )__name__
__module____qualname____doc___version_required_framework_versionr5   classmethodr   r   configurationRequirementInterfacerV   rm   rr   __classcell__)rH   s   @r   r-   r-       s        ##H"+F F F F F. 
j&>&S!T 
 
 
 [
7 7 74W W W W W W Wr   r-   )r   r?   loggingr7   r$   typingr   volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr   $volatility3.plugins.windows.registryr	   	getLoggerrs   r:   r   r+   pluginsPluginInterfacer-   r   r   r   <module>r      s	      				        N N N N N N N N N N N N < < < < < < 9 9 9 9 9 9		8	$	$9S 9 9 9 9FW FW FW FW FWZ'7 FW FW FW FW FWr   