def __init__(self, reader): #IMPORTANT NOTICE, THE STRUCTURE STARTS BEFORE THE FLINK/BLINK POINTER, SO WE NEED TO READ BACKWARDS # reader.move(reader.tell() - 32) reader.align() #not sure if it's needed here # #input('KIWI_CREDMAN_LIST_ENTRY_60 \n%s' % hexdump(reader.peek(0x200), start = reader.tell())) # self.cbEncPassword = ULONG(reader).value reader.align() self.encPassword = PWSTR(reader) self.unk0 = ULONG(reader).value self.unk1 = ULONG(reader).value self.unk2 = PVOID(reader) self.unk3 = PVOID(reader) self.UserName = PWSTR(reader) self.cbUserName = ULONG(reader).value reader.align() self.Flink = PKIWI_CREDMAN_LIST_ENTRY_60 self.Blink = PKIWI_CREDMAN_LIST_ENTRY_60 self.type = LSA_UNICODE_STRING(reader) self.unk5 = PVOID(reader) self.server1 = LSA_UNICODE_STRING(reader) self.unk6 = PVOID(reader) self.unk7 = PVOID(reader) self.unk8 = PVOID(reader) self.unk9 = PVOID(reader) self.unk10 = PVOID(reader) self.user = LSA_UNICODE_STRING(reader) self.unk11 = ULONG(reader).value reader.align() self.server2 = LSA_UNICODE_STRING(reader)
def __init__(self, reader): #IMPORTANT NOTICE, THE STRUCTURE STARTS BEFORE THE FLINK/BLINK POINTER, SO WE NEED TO READ BACKWARDS # reader.move(reader.tell() - 32) reader.align() #not sure if it's needed here # self.cbEncPassword = ULONG(reader).value reader.align() self.encPassword = PWSTR self.unk0 = ULONG(reader).value self.unk1 = ULONG(reader).value self.unk2 = PVOID(reader) self.unk3 = PVOID(reader) self.UserName = PWSTR(reader) self.cbUserName = ULONG(reader).value reader.align() self.Flink = PKIWI_CREDMAN_LIST_ENTRY_5 self.Blink = PKIWI_CREDMAN_LIST_ENTRY_5 self.server1 = LSA_UNICODE_STRING self.unk6 = PVOID(reader) self.unk7 = PVOID(reader) self.user = LSA_UNICODE_STRING(reader) self.unk8 = ULONG(reader).value reader.align() self.server2 = LSA_UNICODE_STRING