X f"<ddlZddlZddlZddlZddlZddlmZmZmZddl m Z m Z m Z m Z mZmZddlmZddlmZddlmZddlmZddlmZej4eZd eee jj<ffd ZGd d e j@jBZ"y) N)ListDictUnion) renderers interfacesobjects exceptions constantslayers) requirements) format_hints)registry)pslist)hivelistreturnch|D]\}}|j|s|cStjS)N)searchrNotAvailableValue) sid_string sid_re_listregnames _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/getsids.py find_sid_rers9! T ::j !K  & & ((ceZdZdZdZdZfdZedee jjfdZ de eeffdZdZd ZxZS) GetSIDsz"Print the SIDs owning each processrrrrcnt||i|tjD]a}tj j |tj j dd}tj j|san0tjtjdtdt|d5}tj|}|d|_|d|_|dDcgc]}t#j$|d |d f!c}|_dddycc}w#1swYyxYw) Nwindowszsids_and_privileges.jsonz5sids_and_privileges.json file is missing plugin errorzBThe sids_and_privileges.json file missed from you plugin directoryrz service sidsz well knownzsids rerr)super__init__r PLUGINS_PATHospathjoinexistsvolloglog LOGLEVEL_VVV RuntimeErroropenjsonload servicesidswell_known_sidsrecompilewell_known_sid_re) selfargskwargs plugin_dirsids_json_file_name file_handlesids_json_datac_list __class__s rr&zGetSIDs.__init__+s" $)&)#00 J"$'',,BGGLL4NO# ww~~12  JJ&&G T  %s + {!YY{3N-n=D #1,#?D -Y7&F1I&q 2&D "   &  s1D+1$D&D+&D++D4rctjddddgtjddtd tjd t j d tjd tjd gS)NkernelzWindows kernelIntel32Intel64)r description architecturespidzFilter on specific process IDsT)rrE element_typeoptionalrr )rpluginversionrr) r ModuleRequirementListRequirementintPluginRequirementrPsListrHiveList)clss rget_requirementszGetSIDs.get_requirementsHs~  * *,()4   ( (<     * *fmmY   * *(9(99   rc|d}d}|jj|jd}i}tjj |j|j |j|jddD]} |j|jD]|}t|j}d}|jD]J} | jxsd} | j'} t)| t*rt-j.| d } nt#j0| j2t"j0j4k(rt-j.| d } njt#j0| j2t"j0j6k(rt-j.| d d } nt-j.| d } | |k(r8t| j9dddd}t;j<|} | ||<M|S#tjt j"j$f$r } Yd} ~ d} ~ wwxYw#t>tjt j"j$f$r } Yd} ~ d} ~ wwxYw#t@tjf$rY@wxYw)z{ Enumerate the registry for all the users. Returns: An dictionary of {sid: user name} z/Microsoft\Windows NT\CurrentVersion\ProfileListProfileImagePathrBzconfig\softwareN)contextbase_config_path layer_name symbol_table filter_string hive_offsetsz (Default)zutf-8)encodingT)show_hexz utf-16-le)r] split_nullsz\x00)!rVmodulesconfigrrQ list_hives config_pathrXsymbol_table_nameget_key get_subkeysstrget_name get_valuesr InvalidAddressExceptionr rRegistryFormatException decode_data isinstancerNr MultiTypeData RegValueTypesType REG_BINARY REG_MULTI_SZreplacentpathbasename ValueErrorKeyError)r8keyvalrBsidshivesubkeysidr)nodevalue_node_nameexcp value_datausers rlookup_user_sidszGetSIDs.lookup_user_sids^s{C %%dkk(&;<%%00LL!--((11, 1 7 D/ "ll3/;;=,%Ffoo/0CD & 1 1 3)%%.2mmo.LO !%)-)9)9);J)*c:-9-G-G$.." !) 6 6tyy A#+#9#9#D#D!E.:-G-G$.." !) 6 6tyy A#+#9#9#F#F!G.:-G-G$.RV." .:-G-G$.."  /#5'*:'>'>w'KCR'P'-t'<,0S G)%,%7 r S'>>"OOCC %% %D'&>>"OOCC % % % j@@A  sV?AJH#'D1IJ#-I JI J2J JJ JJ;:J;c#K|j}|D]7} |jjjd}|r$t |tjjs1dt|jt|jddgf|jD]}||jvr|j|}nE||j vr|j |}n'||vr||}nt#||j$}|r|}nd}d|jtj&j)|j||ff:y#tj $rd}Y&wxYww)N_TOKENFrzToken unreadabler\)rToken dereferencecastr rkrnrrObjectInterfacerNUniqueProcessIdrh ImageFileNameget_sidsr4r3rr7utilityarray_to_string)r8procs user_sidstasktokenrsid_name sid_name_res r _generatorzGetSIDs._generatorsu))+ * D  ..055h? 5*2D2D2T2T UD001D../* $nn.  !5!55#33J?H4#3#33#// ;H9,(4H"-j$:P:P"QK"#.#%,,778J8JK"  )* 55  s)E-)EDE-E*&E-)E**E-c tjj|jj dd}|j j |jd}tjdtfdtfdtfdtfg|jtjj|j |j|j|S)NrGrBPIDProcessSIDName)rVrXrY filter_func)rrPcreate_pid_filterrbgetrVrarTreeGridrNrhrlist_processesrXre)r8rrBs rrunz GetSIDs.runsmm55dkkooeT6RS %%dkk(&;<!!S\Is+eS\FC= I OO ,, LL%00!'!9!9 + -   r)__name__ __module__ __qualname____doc___version_required_framework_versionr& classmethodrr configurationRequirementInterfacerSrrhrrr __classcell__)r@s@rrr%sd,H"+: j&>&>&S&S!T  *F$sCx.FP.` rr)#r1loggingrur(r5typingrrrvolatility3.frameworkrrrr r r #volatility3.framework.configurationr volatility3.framework.renderersr 0volatility3.framework.symbols.windows.extensionsrvolatility3.plugins.windowsr$volatility3.plugins.windows.registryr getLoggerrr,rhBaseAbsentValuerpluginsPluginInterfacerrrrs  $$=8E.9   8 $) 3 $$44 45) j  00 r