# Path: owade/tools/domainFormater.py
# def format(url):
#     if not re.match(r'^http', url):
#         return None
#     if re.match(r'https?://[^/.]*(:[0-9]{1,5})?(/.*)?$', url):
#         return None
#     match = re.match(r'^https?://([^/]*\.)*([^/.]*\.[^/.]{2}\.[^/.]{2,3})(:[0-9]{1,5})?(/.*)?$', url)
#     if match == None:
#         match = re.match(r'^https?://([^/]*\.)*([^/.]*\.com\.[^/.]{2,3})(:[0-9]{1,5})?(/.*)?$', url)
#         if match == None:
#             match = re.match(r'^https?://([^/]*\.)*([^/.]*\.[^/.]{2,4})(:[0-9]{1,5})?(/.*)?$', url)
#             if match == None:
#                 match = re.match(r'^https?://([^/]*\.)*([^/.]*)(:[0-9]{1,5})?(/.*)?$', url)
#                 if match != None:
#                     return match.group(1) + match.group(2)
#                 raise Exception("One case isn't dealed with: %s" % url)
#     return match.group(2)


from DPAPI.Probes import IE7
from owade.tools.domainFormater import format



class GetIE7Passwords:

    _descr = "Decrypt Internet Explorer 7+ autocomplete passwords"

    ## autocomplete are stored under
    ## HKLM\\Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2
    ##
    ## regkeys is a dict of reg entries such as the key is the hash value and
    ## the value is the DPAPI blob
    ##
    ## urls is an array of URLs that will be used to decipher password entries
    def main(self, regkeys, places, mkp, sid, h):
        values = {}

        urls = self.formatUrls(places)
    
        i = 0
        b = IE7.IE7Autocomplete()
        if b.try_decrypt_with_hash(h, mkp, sid, values=regkeys, urls=urls):
            for k in b.entries.keys():
                if b.entries[k].entropy is None:
                    continue
                e = b.entries[k]
                u = e.entropy.decode('UTF-16LE')[:-1]
                i += 1
                key = 'password%d' % i
                values[key] = {'login': e.login, 'password': e.password,

# Path: owade/tools/domainFormater.py
# def format(url):
#     if not re.match(r'^http', url):
#         return None
#     if re.match(r'https?://[^/.]*(:[0-9]{1,5})?(/.*)?$', url):
#         return None
#     match = re.match(r'^https?://([^/]*\.)*([^/.]*\.[^/.]{2}\.[^/.]{2,3})(:[0-9]{1,5})?(/.*)?$', url)
#     if match == None:
#         match = re.match(r'^https?://([^/]*\.)*([^/.]*\.com\.[^/.]{2,3})(:[0-9]{1,5})?(/.*)?$', url)
#         if match == None:
#             match = re.match(r'^https?://([^/]*\.)*([^/.]*\.[^/.]{2,4})(:[0-9]{1,5})?(/.*)?$', url)
#             if match == None:
#                 match = re.match(r'^https?://([^/]*\.)*([^/.]*)(:[0-9]{1,5})?(/.*)?$', url)
#                 if match != None:
#                     return match.group(1) + match.group(2)
#                 raise Exception("One case isn't dealed with: %s" % url)
#     return match.group(2)


# Path: owade/fileAnalyze/ie7.py
from DPAPI.Probes import IE7
from owade.tools.domainFormater import format




class GetIE7Passwords:

    _descr = "Decrypt Internet Explorer 7+ autocomplete passwords"

    ## autocomplete are stored under
    ## HKLM\\Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2
    ##
    ## regkeys is a dict of reg entries such as the key is the hash value and
    ## the value is the DPAPI blob
    ##
    ## urls is an array of URLs that will be used to decipher password entries
    def main(self, regkeys, places, mkp, sid, h):
        values = {}

        urls = self.formatUrls(places)
    
        i = 0
        b = IE7.IE7Autocomplete()
        if b.try_decrypt_with_hash(h, mkp, sid, values=regkeys, urls=urls):
            for k in b.entries.keys():
                if b.entries[k].entropy is None:
                    continue
                e = b.entries[k]
                u = e.entropy.decode('UTF-16LE')[:-1]
                i += 1
                key = 'password%d' % i
                values[key] = {'login': e.login, 'password': e.password,

                    'origin':u, 'domain':format(u)}