o
    �õ±j^%  ã                   @   s¢   d dl Z d dlZd dlmZ d dlmZ d dlmZmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZmZ G dd„ dƒZdS )é    N)ÚNTRegistryHeadr)ÚNTRegistryHbin)ÚNTRegistryNKÚNKFlag)ÚNTRegistryCell)Ú	ValueList)ÚNTRegistryHR)ÚNTRegistryLH)ÚNTRegistryRI)ÚREGTYPE)ÚABufferÚAFilec                   @   sò   e Zd ZdZd1dd„Zed1dededefd	d
„ƒZ	ed1de
jdedefdd„ƒZed2dedefdd„ƒZdd„ Zdd„ Zdd„ Zd3dd„Zdd„ Zdd„ Zd4dd„Zd4d d!„Zd"d#„ Zd$d%„ Zd5d&d'„Zd4d(d)„Zd*d+„ Zd6d-d.„Zd7d/d0„ZdS )8ÚAIOWinRegHivez$
	Async version of the hive parser
	NTc                 C   s>   || _ d | _d | _|| _|| _|d urtƒ | _i | _i | _d S ©N)ÚreaderÚheaderÚrootÚ	root_hbinÚis_filer   Ú_AIOWinRegHive__cells_lookupÚ_AIOWinRegHive__key_lookup)Úselfr   r   r   © r   ú‚/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/aiowinreg/ahive.pyÚ__init__   s   
zAIOWinRegHive.__init__Údatar   r   c                 C   s   t tt | ¡ƒ||d�S ©N©r   r   )r   r   ÚioÚBytesIO)r   r   r   r   r   r   Ú
from_bytes   s   zAIOWinRegHive.from_bytesÚbuffc                 C   s   t t| ƒ||d�S r   )r   r   )r!   r   r   r   r   r   Úfrom_buffer#   ó   zAIOWinRegHive.from_bufferÚ	file_pathc                 C   s   t t| ƒ|dd�S )NTr   )r   r   )r$   r   r   r   r   Ú	from_file'   r#   zAIOWinRegHive.from_filec                 Ã   s   �| j  ¡ I dH  dS )zCloses the hiveN)r   Úclose©r   r   r   r   r&   +   s   €zAIOWinRegHive.closec                 Ã   sB   �| j du rt | j¡I dH | _ | jdu r|  ¡ I dH | _dS dS )z$Must be called before using the hiveN)r   r   Úareadr   r   Úsearch_root_keyr'   r   r   r   Úsetup/   s   €

ÿzAIOWinRegHive.setupc                 Ã   sâ   �| j sT| j dd¡I d H  d}d}|dkrP| j |d¡I d H  t | j¡I d H }|jD ]}t|jtƒrCt	j
|jjv rC|| _ |j  S q,||j7 }|j}|dkstdƒ‚| j jD ]}t|jtƒrlt	j
|jjv rl|j  S qXtdƒ‚)Né   r   éÿÿÿÿzCould not find root key!)r   r   Úseekr   r(   ÚcellsÚ
isinstancer   r   r   ÚROOTÚflagsÚoffset_nextÚ	Exception)r   Úhbin_offsetr2   ÚhbinÚcellr   r   r   r)   6   s0   €

€
÷û
€zAIOWinRegHive.search_root_keyFc                 Ã   s<   �|| j vrtj| j|| jdd�I d H }|| j |< | j | S )NF©Ú
nk_partial)r   r   Úaload_data_from_offsetr   r   )r   Úoffsetr8   r6   r   r   r   Ú__load_cell_from_offsetO   s
   €


z%AIOWinRegHive.__load_cell_from_offsetc                 Ã   sž   �t dƒD ]G}| j|jdd�I d H }t|tƒr|}qt|ttfƒr=|jD ]}|  ||¡I d H }|d ur9|    S q$ d S |j	 
¡ | 
¡ krJ|  S  d S d S )Néÿ   Tr7   )ÚrangeÚ%_AIOWinRegHive__load_cell_from_offsetÚ	offset_nkr/   r   r
   r	   Úhash_recordsÚ_AIOWinRegHive__find_subkeyÚnameÚupper)r   Úhash_recÚkey_nameÚ_ÚsubkeyÚ	thash_recÚresr   r   r   Ú__find_subkeyU   s"   €

ÿþòzAIOWinRegHive.__find_subkeyc                 Ã   s®   �| j du r|  ¡ I dH  |  |j¡I dH }|du rdS t|tƒr8|jD ]}|  ||¡I dH }|dur7|  S q$| |¡D ]}|  |¡I dH }|j	 
¡ | 
¡ krT|  S q=dS )z*Find and return a subkey of the parent keyN)r   r*   r>   Úoffset_lf_stabler/   r
   r@   rA   Úget_key_offsetsrB   rC   )r   ÚparentrE   ÚkeyrH   rI   r:   Úrecr   r   r   Úfind_subkeyg   s$   €


ÿÿzAIOWinRegHive.find_subkeyc                 Ã   s”   �| j du r|  ¡ I dH  t|ƒdk r| j S d}| j }| d¡D ]'}|  ||¡I dH }|du r?|du r<td|||f ƒ‚ dS |d| 7 }|}q |S )z&Find and return a key by its full pathNé   Ú ú\TzJCould not find subkey! Full path: %s Working path: %s Missing key name: %sz\%s)r   r*   ÚlenÚsplitrP   r3   )r   Úkey_pathÚthrowÚworking_pathÚ
parent_keyrN   Úskeyr   r   r   Úfind_key|   s    €
zAIOWinRegHive.find_keyc                 Ã   st   �| j du r|  ¡ I dH  g }|  ||¡I dH }|jdkr8| j|jdd�I dH }|jD ]}||  |¡I dH 7 }q+|S )zReturn a list of subkey namesNr   Fr7   )r   r*   r[   Úsubkey_cnt_stabler>   rK   r@   Ú_AIOWinRegHive__get_name)r   rV   rW   ÚnamesrN   rO   rD   r   r   r   Úenum_key�   s   €


zAIOWinRegHive.enum_keyc                 Ã   s¨   �| j du r|  ¡ I dH  g }|jdkr|S t | j|j|jd | j¡I dH }|jD ]'}|dk r1q*t	 | j|| j¡I dH }|s@q*|j
dkrK| d¡ q*| |j¡ q*|S )zReturn a list of value namesNr   é   s   default)r   r*   Ú	value_cntr   r9   r   Úoffset_value_listr   Úrecord_offsetsr   ÚflagÚappendrB   )r   rN   ÚvaluesÚvlÚrecord_offsetÚblockr   r   r   Úlist_valuesž   s"   €

"

zAIOWinRegHive.list_valuesc                 Ã   s�   �g }t dƒD ]>}| j|jdd�I d H }t|tƒr|}qt|ttfƒr6|jD ]}||  |¡I d H 7 }q& |S |d u r= |S | 	|j
¡  |S |S )Nr<   Fr7   )r=   r>   r?   r/   r   r
   r	   r@   r]   re   rB   )r   rD   r^   rF   rG   rH   r   r   r   Ú
__get_nameµ   s$   €

ûýzAIOWinRegHive.__get_namec           
      Ã   sX  �| j du r|  ¡ I dH  |du r5| d¡dkr!| dd¡\}}n
t |¡}t |¡}|  ||¡I dH }n|}|du r=dS |jdkrDdS t	 
| j|j|jd | j¡I dH }|jD ]M}|dk r_qXt 
| j|| j¡I dH }|snqX|jdkr‹|dkrŠ|j| j| jd�I dH }	|j|	f  S qX||j ¡ kr¥|j| j| jd�I dH }	|j|	f  S qXtd| ƒ‚)	zReturn a value by its full pathNú	r,   r`   r   Údefault)r   zCould not find %s)r   r*   ÚfindrU   ÚntpathÚdirnameÚbasenamer[   ra   r   r9   r   rb   r   rc   r   rd   Ú
aload_dataÚ
value_typerB   Údecoder3   )
r   Ú
value_pathrW   rN   rV   Ú
value_namerg   rh   ri   r   r   r   r   Ú	get_valueÈ   s>   €



"

þþzAIOWinRegHive.get_valuec                 Ã   sÌ   �| j du r|  ¡ I dH  |  ||¡I dH }|du rdS |jdkrd| jdu r6| j |jd d d¡I dH  n| j |jd d¡I dH  | j |j¡I dH }t	|t
ƒr]|\}}|dur\|‚n|}| d¡S dS )zReturn the class value of a keyNr   Tr+   é   z	utf-16-le)r   r*   r[   Úoffset_classnamer   r   r-   ÚreadÚclass_name_lengthr/   Útuplert   )r   rV   rW   rN   rI   r   Úerrr   r   r   Ú	get_classí   s&   €


 
ÿ
ôzAIOWinRegHive.get_classc                 Ã   s6   �| j du r|  ¡ I dH  | j|jdd�I dH }|jS )z'Return the security descriptor of a keyNFr7   )r   r*   r>   Ú	offset_skÚsd)r   rN   Úskr   r   r   Úget_sd  s
   €
zAIOWinRegHive.get_sdr,   c                 C  sr   �|d8 }|dkrdS |   |¡I dH D ]#}|dkr|}n|d | }|V  |  ||¡2 z	3 dH W }|V  q+6 qdS )zWalk the registry treer`   r   NrR   rS   )r_   Úwalk)r   ÚpathÚdepthrN   ÚnprI   r   r   r   rƒ     s   €ÿúzAIOWinRegHive.walkc                 C  sL  �|   dd¡2 z›3 dH W }|du r| |¡dkr|V  |s!|du r¢|  |¡I dH }|  |¡I dH D ]p}| ¡ }|d | }|du rK| |¡dkrK|V  |du r¡| j||d�I dH }	|	\}
}|
tjkro| ¡  |¡dkro|V  q1|
tj	krŠt
|ƒD ]\}}| |¡dkrˆ|V   nqxq1|}t|tƒr•| ¡ }t|ƒ |¡dkr¡|V  q1q6 dS )z&Search the registry tree for a patternrR   r,   NTrS   )rN   )rƒ   rn   r[   rj   rt   rw   r   ÚREG_UNKNOWNÚhexÚREG_MULTI_SZÚ	enumerater/   ÚbytesÚstr)r   ÚpatternÚin_keysÚin_valuenamesÚ	in_valuesÚkeypathrN   Ú	valuenameÚ	valuepathrI   Ú	valuetypeÚvalueÚiÚvalÚtr   r   r   Úsearch  s>   €
þ€
€åzAIOWinRegHive.search)NTr   )F)T)TN)r,   )TTT)Ú__name__Ú
__module__Ú__qualname__Ú__doc__r   Ústaticmethodr‹   r   Úboolr    r   r   r"   rŒ   r%   r&   r*   r)   r>   rA   rP   r[   r_   rj   r]   rw   r~   r‚   rƒ   r™   r   r   r   r   r      s0    





%
r   )ro   r   Úaiowinreg.filestruct.headerr   Úaiowinreg.filestruct.hbinr   Úaiowinreg.filestruct.nkr   r   Úaiowinreg.filestruct.regcellr   Úaiowinreg.filestruct.valuelistr   Úaiowinreg.filestruct.hashrecordr   Úaiowinreg.filestruct.lhr	   Úaiowinreg.filestruct.rir
   Úaiowinreg.filestruct.vkr   Úaiowinreg.utils.afiler   r   r   r   r   r   r   Ú<module>   s    