# Path: owade/fileAnalyze/creddump/addrspace.py
# class HiveFileAddressSpace:
#     def __init__(self, fname):
#         self.fname = fname
#         self.base = FileAddressSpace(fname)
# 
#     def vtop(self, vaddr):
#         return vaddr + BLOCK_SIZE + 4
# 
#     def read(self, vaddr, length, zero=False):
#         first_block = BLOCK_SIZE - vaddr % BLOCK_SIZE
#         full_blocks = ((length + (vaddr % BLOCK_SIZE)) / BLOCK_SIZE) - 1
#         left_over = (length + vaddr) % BLOCK_SIZE
#         
#         paddr = self.vtop(vaddr)
#         if paddr == None and zero:
#             if length < first_block:
#                 return "\0" * length
#             else:
#                 stuff_read = "\0" * first_block
#         elif paddr == None:
#             return None
#         else:
#             if length < first_block:
#                 stuff_read = self.base.read(paddr, length)
#                 if not stuff_read and zero:
#                     return "\0" * length
#                 else:
#                     return stuff_read
# 
#             stuff_read = self.base.read(paddr, first_block)
#             if not stuff_read and zero:
#                 stuff_read = "\0" * first_block
# 
#         new_vaddr = vaddr + first_block
#         for i in range(0,full_blocks):
#             paddr = self.vtop(new_vaddr)
#             if paddr == None and zero:
#                 stuff_read = stuff_read + "\0" * BLOCK_SIZE
#             elif paddr == None:
#                 return None
#             else:
#                 new_stuff = self.base.read(paddr, BLOCK_SIZE)
#                 if not new_stuff and zero:
#                     new_stuff = "\0" * BLOCK_SIZE
#                 elif not new_stuff:
#                     return None
#                 else:
#                     stuff_read = stuff_read + new_stuff
#             new_vaddr = new_vaddr + BLOCK_SIZE
# 
#         if left_over > 0:
#             paddr = self.vtop(new_vaddr)
#             if paddr == None and zero:
#                 stuff_read = stuff_read + "\0" * left_over
#             elif paddr == None:
#                 return None
#             else:
#                 stuff_read = stuff_read + self.base.read(paddr, left_over)
#         return stuff_read
# 
#     def read_long_phys(self, addr):
#         string = self.base.read(addr, 4)
#         (longval, ) =  struct.unpack('L', string)
#         return longval
# 
#     def is_valid_address(self, vaddr):
#         paddr = self.vtop(vaddr)
#         if not paddr: return False
#         return self.base.is_valid_address(paddr)


from struct import unpack,pack
from Crypto.Hash import MD5
from Crypto.Cipher import ARC4,DES
from owade.fileAnalyze.creddump.win32.rawreg import *
from owade.fileAnalyze.creddump.addrspace import HiveFileAddressSpace
        lmhash,nthash = get_user_hashes(user,hbootkey)
        if not lmhash: lmhash = empty_lm
        if not nthash: nthash = empty_nt
        print "%s:%d:%s:%s:::" % (get_user_name(user), int(user.Name,16),
                            lmhash.encode('hex'), nthash.encode('hex'))


#################################################
###### BEGIN OWADE CODE ADAPTATION
#################################################
def owade_get_hashes(sysaddr, samaddr):
    sysaddr = HiveFileAddressSpace(sysaddr)
    samaddr = HiveFileAddressSpace(samaddr)
    hashes = {}
    bootkey = get_bootkey(sysaddr)
    hbootkey = get_hbootkey(samaddr,bootkey)

    for user in get_user_keys(samaddr):
        lmhash,nthash = get_user_hashes(user,hbootkey)
        if not lmhash: lmhash = empty_lm
        if not nthash: nthash = empty_nt
        name = get_user_name(user)
        hashes[name] = {'name':name, 'id':int(user.Name,16),
            'lmhash':lmhash.encode('hex'), 'nthash':nthash.encode('hex')}
    return hashes
#################################################
###### END OWADE CODE ADAPTATION
#################################################

def dump_file_hashes(syshive_fname, samhive_fname):

# Path: owade/fileAnalyze/creddump/addrspace.py
# class HiveFileAddressSpace:
#     def __init__(self, fname):
#         self.fname = fname
#         self.base = FileAddressSpace(fname)
# 
#     def vtop(self, vaddr):
#         return vaddr + BLOCK_SIZE + 4
# 
#     def read(self, vaddr, length, zero=False):
#         first_block = BLOCK_SIZE - vaddr % BLOCK_SIZE
#         full_blocks = ((length + (vaddr % BLOCK_SIZE)) / BLOCK_SIZE) - 1
#         left_over = (length + vaddr) % BLOCK_SIZE
#         
#         paddr = self.vtop(vaddr)
#         if paddr == None and zero:
#             if length < first_block:
#                 return "\0" * length
#             else:
#                 stuff_read = "\0" * first_block
#         elif paddr == None:
#             return None
#         else:
#             if length < first_block:
#                 stuff_read = self.base.read(paddr, length)
#                 if not stuff_read and zero:
#                     return "\0" * length
#                 else:
#                     return stuff_read
# 
#             stuff_read = self.base.read(paddr, first_block)
#             if not stuff_read and zero:
#                 stuff_read = "\0" * first_block
# 
#         new_vaddr = vaddr + first_block
#         for i in range(0,full_blocks):
#             paddr = self.vtop(new_vaddr)
#             if paddr == None and zero:
#                 stuff_read = stuff_read + "\0" * BLOCK_SIZE
#             elif paddr == None:
#                 return None
#             else:
#                 new_stuff = self.base.read(paddr, BLOCK_SIZE)
#                 if not new_stuff and zero:
#                     new_stuff = "\0" * BLOCK_SIZE
#                 elif not new_stuff:
#                     return None
#                 else:
#                     stuff_read = stuff_read + new_stuff
#             new_vaddr = new_vaddr + BLOCK_SIZE
# 
#         if left_over > 0:
#             paddr = self.vtop(new_vaddr)
#             if paddr == None and zero:
#                 stuff_read = stuff_read + "\0" * left_over
#             elif paddr == None:
#                 return None
#             else:
#                 stuff_read = stuff_read + self.base.read(paddr, left_over)
#         return stuff_read
# 
#     def read_long_phys(self, addr):
#         string = self.base.read(addr, 4)
#         (longval, ) =  struct.unpack('L', string)
#         return longval
# 
#     def is_valid_address(self, vaddr):
#         paddr = self.vtop(vaddr)
#         if not paddr: return False
#         return self.base.is_valid_address(paddr)


# Path: owade/fileAnalyze/creddump/win32/hashdump.py
from struct import unpack,pack
from Crypto.Hash import MD5
from Crypto.Cipher import ARC4,DES
from owade.fileAnalyze.creddump.win32.rawreg import *
from owade.fileAnalyze.creddump.addrspace import HiveFileAddressSpace

        lmhash,nthash = get_user_hashes(user,hbootkey)
        if not lmhash: lmhash = empty_lm
        if not nthash: nthash = empty_nt
        print "%s:%d:%s:%s:::" % (get_user_name(user), int(user.Name,16),
                            lmhash.encode('hex'), nthash.encode('hex'))


#################################################
###### BEGIN OWADE CODE ADAPTATION
#################################################
def owade_get_hashes(sysaddr, samaddr):
    sysaddr = HiveFileAddressSpace(sysaddr)
    samaddr = HiveFileAddressSpace(samaddr)
    hashes = {}
    bootkey = get_bootkey(sysaddr)
    hbootkey = get_hbootkey(samaddr,bootkey)

    for user in get_user_keys(samaddr):
        lmhash,nthash = get_user_hashes(user,hbootkey)
        if not lmhash: lmhash = empty_lm
        if not nthash: nthash = empty_nt
        name = get_user_name(user)
        hashes[name] = {'name':name, 'id':int(user.Name,16),
            'lmhash':lmhash.encode('hex'), 'nthash':nthash.encode('hex')}
    return hashes
#################################################
###### END OWADE CODE ADAPTATION
#################################################

def dump_file_hashes(syshive_fname, samhive_fname):

    sysaddr = HiveFileAddressSpace(syshive_fname)