
    Xfl                         d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZm	Z	m
Z
mZ d dlmZ d dlmZ  ej                   e      ZdefdZ G d d	e	j*                  j,                        Zy)
    N)List)	renderers
interfaces	constants
exceptions)requirements)hivelistreturnc           
         dj                  | D cg c]  }|dz   	 c}      }t        j                  |j                         j	                  d            j                         }t               }t        d      D ]6  }|j                  t        j                  d||dz  |dz  dz          d          8 dd	j                  |D cg c]  }t        |       c}      z   S c c}w c c}w )
zCalculate the Service SID  zutf-8   z<I   r   z	S-1-5-80--)joinhashlibsha1upperencodedigestlistrangeappendstructunpackstr)svccunishadecins          f/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/getservicesids.pycreateservicesidr%      s    
''s+!1v:+
,C
,,		7#fh  &C1X C 	

6==s1q51q519'=>qABC 3"7a3q6"7888 , #8s   CC!
c                   z     e Zd ZdZdZdZ fdZedee	j                  j                     fd       Zd Zd Z xZS )	GetServiceSIDszLists process token sids.   r   r   )   r   r   c                    t        |   |i | t        j                  D ]a  }t        j
                  j                  |t        j
                  j                  dd            }t        j
                  j                  |      sa n0 t        j                  t        j                  d       t        d      t        |d      5 }t        j                  |      d   | _        d d d        y # 1 sw Y   y xY w)Nwindowszsids_and_privileges.jsonz5sids_and_privileges.json file is missing plugin errorzBThe sids_and_privileges.json file missed from you plugin directoryrzservice sids)super__init__r   PLUGINS_PATHospathr   existsvolloglogLOGLEVEL_VVVRuntimeErroropenjsonloadservicesids)selfargskwargs
plugin_dirsids_json_file_namefile_handle	__class__s         r$   r/   zGetServiceSIDs.__init__&   s    $)&) $00 	J"$'',,BGGLL4NO# ww~~12	 JJ&&G T 
 %s+ 	F{#yy5nED	F 	F 	Fs    C''C0r
   c                     t        j                  ddddg      t        j                  dt        j                  d      gS )	NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr	   r(   )rG   pluginversion)r   ModuleRequirementPluginRequirementr	   HiveList)clss    r$   get_requirementszGetServiceSIDs.get_requirements=   sG     **,()4
 **(9(99	
 		
    c              #     K   | j                   j                  | j                  d      }t        j                  j                  | j                   | j                  |j                  |j                  dd       D ]  }	 |j                  d      }|s|j                         D ]\  }|j                         | j                  j!                         vs.t#        |j                               }d||j                         ff ^  y # t        t        j                  f$ r6 	 |j                  d      }n # t        t        j                  f$ r Y Y w xY wY w xY ww)NrD   zmachine\system)contextbase_config_path
layer_namesymbol_tablefilter_stringhive_offsetszCurrentControlSet\ServiceszControlSet001\Servicesr   )rS   modulesconfigr	   rN   
list_hivesconfig_pathrU   symbol_table_nameget_keyKeyErrorr   InvalidAddressExceptionget_subkeysget_namer;   valuesr%   )r<   rD   hiveservicesssids         r$   
_generatorzGetServiceSIDs._generatorK   s5    %%dkk(&;<%%00LL!--((11+ 1 
 	7D<<(EF !--/ 7Azz|4+;+;+B+B+DD.qzz|< 3

"5667%	7 j@@A #||,EFH *"D"DE  s`   A7E:D E=E4E ED,+E,E	EEE		EEEEc                 f    t        j                  dt        fdt        fg| j                               S )NSIDService)r   TreeGridr   rh   )r<   s    r$   runzGetServiceSIDs.rune   s*    !!E3<)S1A"BDOODUVVrQ   )__name__
__module____qualname____doc___version_required_framework_versionr/   classmethodr   r   configurationRequirementInterfacerP   rh   rm   __classcell__)rB   s   @r$   r'   r'       sN    #H"+F. 
j&>&>&S&S!T 
 
74WrQ   r'   )r   r9   loggingr1   r   typingr   volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr   $volatility3.plugins.windows.registryr	   	getLoggerrn   r4   r   r%   pluginsPluginInterfacer'    rQ   r$   <module>r      s_       	   N N < 9			8	$9S 9FWZ''77 FWrQ   