
    Xf"                        d dl Z d dlZd dlZd dlZd dlZd dlmZmZmZ d dl	m
Z
mZmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ  ej        e          Zd	eeej
        j        f         fd
Z G d dej         j!                  Z"dS )    N)ListDictUnion)	renderers
interfacesobjects
exceptions	constantslayers)requirements)format_hints)registry)pslist)hivelistreturnc                 j    |D ]\  }}|                     |           r|c S t          j                    S )N)searchr   NotAvailableValue)
sid_stringsid_re_listregnames       _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/getsids.pyfind_sid_rer      sH     !  	T::j!! 	KKK	&(((    c                        e Zd ZdZdZdZ fdZedee	j
        j                 fd            Zdeeef         fdZd Zd	 Z xZS )
GetSIDsz"Print the SIDs owning each process   r   r      r   r   c                 Z    t                      j        |i | t          j        D ]a}t          j                            |t          j                            dd                    }t          j                            |          r n5bt          	                    t          j
        d           t          d          t          |d          5 }t          j        |          }|d         | _        |d         | _        d |d	         D             | _        d d d            d S # 1 swxY w Y   d S )
Nwindowszsids_and_privileges.jsonz5sids_and_privileges.json file is missing plugin errorzBThe sids_and_privileges.json file missed from you plugin directoryrzservice sidsz
well knownc                 R    g | ]$}t          j        |d                    |d         f%S )r   r   )recompile).0c_lists     r   
<listcomp>z$GetSIDs.__init__.<locals>.<listcomp>C   s?     & & & F1I&&q	2& & &r   zsids re)super__init__r
   PLUGINS_PATHospathjoinexistsvolloglogLOGLEVEL_VVVRuntimeErroropenjsonloadservicesidswell_known_sidswell_known_sid_re)selfargskwargs
plugin_dirsids_json_file_namefile_handlesids_json_data	__class__s          r   r,   zGetSIDs.__init__+   s{   $)&)))#0 	 	J"$',,BGLL4NOO# # w~~122  JJ&G   T  
 %s++ 		{!Y{33N-n=D#1,#?D & &,Y7& & &D"		 		 		 		 		 		 		 		 		 		 		 		 		 		 		 		 		 		s   AD  D$'D$r   c                     t          j        ddddg          t          j        ddt          d	          t          j        d
t
          j        d          t          j        dt          j        d          gS )NkernelzWindows kernelIntel32Intel64)r   descriptionarchitecturespidzFilter on specific process IDsT)r   rH   element_typeoptionalr   r    )r   pluginversionr   r   )	r   ModuleRequirementListRequirementintPluginRequirementr   PsListr   HiveList)clss    r   get_requirementszGetSIDs.get_requirementsH   s     *,()4  
 (< 	   *fmY   *(99  
 	
r   c                    d}d}| j         j        | j        d                  }i }t          j                            | j         | j        |j        |j        dd          D ]*}	 |	                    |          
                                D ]}t          |                                          }d}|                                D ]}		 |	                                pd}
n-# t          j        t           j        j        f$ r
}Y d}~@d}~ww xY w	 |	                                }t)          |t*                    rt-          j        |d	
          }nt#          j        |	j                  t"          j        j        k    rt-          j        |d          }nZt#          j        |	j                  t"          j        j        k    rt-          j        |dd          }nt-          j        |d
          }|
|k    rDt          |                              dd          dd         }t;          j        |          }|||<   r# t>          t          j        t           j        j        f$ r}Y d}~d}~ww xY w# t@          t          j        f$ r Y (w xY w|S )z{
        Enumerate the registry for all the users.

        Returns:
            An dictionary of {sid: user name}
        z/Microsoft\Windows NT\CurrentVersion\ProfileListProfileImagePathrE   zconfig\softwareN)contextbase_config_path
layer_namesymbol_tablefilter_stringhive_offsets z	(Default)zutf-8)encodingT)show_hexz	utf-16-le)r`   split_nullsz\x00)!rY   modulesconfigr   rT   
list_hivesconfig_pathr[   symbol_table_nameget_keyget_subkeysstrget_name
get_valuesr	   InvalidAddressExceptionr   r   RegistryFormatExceptiondecode_data
isinstancerQ   r   MultiTypeDataRegValueTypesType
REG_BINARYREG_MULTI_SZreplacentpathbasename
ValueErrorKeyError)r<   keyvalrE   sidshivesubkeysidr/   nodevalue_node_nameexcp
value_datausers                 r   lookup_user_sidszGetSIDs.lookup_user_sids^   s    C %dk(&;<%00L!-(1, 1 
 
 7	 7	D/"ll3//;;== ,% ,%Ffoo//00CD & 1 1 3 3 )% )%%.2mmoo.LOO&>"OC  % % % %HHHH	%
!%)-)9)9););J)*c:: "-9-G$.." ." ."

 !) 6ty A A#+#9#D!E !E .:-G$.." ." ."

 !) 6ty A A#+#9#F!G !G .:-G$.RV." ." ."

 .:-G$.." ." ."
  /#55'*:'>'>w'K'KCRC'P'-t'<'<,0S	&&>"OC  % % %
 %HHHH%I)%,%Z j@A    s\   !A$I,CI, D	=I,D	I,D'H42I,4&I%	I, I%	%I,,JJc              #     K   |                                  }|D ]7}	 |j                                                            d          }n# t          j        $ r d}Y nw xY w|rt          |t          j        j	                  s/dt          |j                  t          |j                  ddgfV  |                                D ]}|| j        v r| j        |         }n@|| j        v r| j        |         }n)||v r	||         }nt#          || j                  }|r|}nd}d|j        t          j                            |j                  ||ffV  9d S )N_TOKENFr   zToken unreadabler_   )r   Tokendereferencecastr	   rn   rq   r   r   ObjectInterfacerQ   UniqueProcessIdrk   ImageFileNameget_sidsr:   r9   r   r;   utilityarray_to_string)r<   procs	user_sidstasktokenr   sid_namesid_name_res           r   
_generatorzGetSIDs._generator   s     ))++	  *	 *	D
..0055h??5     

5*2D2T U U 
D011D.//*	     $nn..  
!555#3J?HH4#333#/
;HH9,,(4HH"-j$:P"Q"QK" &#.#% ,778JKK" 	    )*	 *	s   ,A

AAc                    t           j                            | j                            dd                     }| j        j        | j        d                  }t          j        dt          fdt          fdt          fdt          fg|                     t           j                            | j        |j        |j        |                              S )NrJ   rE   PIDProcessSIDName)rY   r[   r\   filter_func)r   rS   create_pid_filterre   getrY   rd   r   TreeGridrQ   rk   r   list_processesr[   rh   )r<   r   rE   s      r   runzGetSIDs.run   s    m55dkooeT6R6RSS%dk(&;<!S\Is+eS\FC=IOO,, L%0!'!9 +	 -   

 

 
	
r   )__name__
__module____qualname____doc___version_required_framework_versionr,   classmethodr   r   configurationRequirementInterfacerV   r   rk   r   r   r   __classcell__)rC   s   @r   r   r   %   s        ,,H"+    : 
j&>&S!T 
 
 
 [
*F$sCx. F F F FP. . .`
 
 
 
 
 
 
r   r   )#r7   loggingrx   r.   r&   typingr   r   r   volatility3.frameworkr   r   r   r	   r
   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   0volatility3.framework.symbols.windows.extensionsr   volatility3.plugins.windowsr   $volatility3.plugins.windows.registryr   	getLoggerr   r2   rk   BaseAbsentValuer   pluginsPluginInterfacer    r   r   <module>r      s      				 				 $ $ $ $ $ $ $ $ $ $                = < < < < < 8 8 8 8 8 8 E E E E E E . . . . . . 9 9 9 9 9 9		8	$	$)
3
$445) ) ) )
 
 
 
 
j 0 
 
 
 
 
r   